From d3d91f8be12e1bb596527a845e96324944c146bf Mon Sep 17 00:00:00 2001
From: Bailey Townsend <baileytownsend2323@gmail.com>
Date: Tue, 10 Feb 2026 18:00:52 -0600
Subject: [PATCH 1/3] I think that's the session store

Should be state store as well

should be conf client
commiting to swap

I think that's the redirect

appeasing my robotic overlords in the ci

resolves setting a new session id everytime

that rabbit

redis cache and other updates

pretend you don't see this till Saturday. I'll be at a football game

also pretend like you didnt see this.

changed to useRunTimeConfig for jwk
---
 app/components/Header/AuthModal.client.vue    |   8 ++
 modules/cache.ts                              |   7 ++
 nuxt.config.ts                                |   2 +
 package.json                                  |   1 +
 scripts/gen-jwk.ts                            |  11 ++
 server/api/auth/atproto.get.ts                |  26 ++---
 server/api/auth/session.get.ts                |  15 ++-
 server/plugins/oauth-client.ts                |  20 ++++
 server/routes/.well-known/jwks.json.get.ts    |  11 ++
 .../routes/oauth-client-metadata.json.get.ts  |   6 +-
 server/utils/atproto/oauth-session-store.ts   |  47 ++++----
 server/utils/atproto/oauth-state-store.ts     |  36 +++---
 server/utils/atproto/oauth.ts                 | 106 +++++++++++++-----
 server/utils/atproto/storage.ts               |  10 +-
 server/utils/server-session.ts                |   3 +-
 shared/schemas/oauth.ts                       |  14 ---
 shared/schemas/publicUserSession.ts           |  13 ++-
 shared/types/userSession.ts                   |  10 +-
 18 files changed, 220 insertions(+), 126 deletions(-)
 create mode 100644 scripts/gen-jwk.ts
 create mode 100644 server/plugins/oauth-client.ts
 create mode 100644 server/routes/.well-known/jwks.json.get.ts
 delete mode 100644 shared/schemas/oauth.ts

diff --git a/app/components/Header/AuthModal.client.vue b/app/components/Header/AuthModal.client.vue
index f0f2ea263b..6f28f2aede 100644
--- a/app/components/Header/AuthModal.client.vue
+++ b/app/components/Header/AuthModal.client.vue
@@ -50,6 +50,14 @@ watch(handleInput, newHandleInput => {
     handleInput.value = normalized
   }
 })
+
+watch(user, async newUser => {
+  if (newUser?.relogin) {
+    await authRedirect(newUser.did, {
+      redirectTo: route.fullPath,
+    })
+  }
+})
 </script>
 
 <template>
diff --git a/modules/cache.ts b/modules/cache.ts
index a2e7c3a410..31df72a6b7 100644
--- a/modules/cache.ts
+++ b/modules/cache.ts
@@ -4,6 +4,8 @@ import { provider } from 'std-env'
 
 // Storage key for fetch cache - must match shared/utils/fetch-cache-config.ts
 const FETCH_CACHE_STORAGE_BASE = 'fetch-cache'
+// Storage key for OAuth cache - must match server/utils/atproto/storage.ts
+const OAUTH_CACHE_STORAGE_BASE = 'atproto:oauth'
 
 export default defineNuxtModule({
   meta: {
@@ -37,6 +39,11 @@ export default defineNuxtModule({
           ...nitroConfig.storage[FETCH_CACHE_STORAGE_BASE],
           driver: 'vercel-runtime-cache',
         }
+
+        nitroConfig.storage[OAUTH_CACHE_STORAGE_BASE] = {
+          ...nitroConfig.storage[OAUTH_CACHE_STORAGE_BASE],
+          driver: 'vercel-runtime-cache',
+        }
       }
 
       const env = process.env.VERCEL_ENV
diff --git a/nuxt.config.ts b/nuxt.config.ts
index 2a3629aa3c..2e93d27ac6 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -37,6 +37,7 @@ export default defineNuxtConfig({
     github: {
       orgToken: '',
     },
+    oauthJwkOne: process.env.OAUTH_JWK_ONE || undefined,
     // Upstash Redis for distributed OAuth token refresh locking in production
     upstash: {
       redisRestUrl: process.env.UPSTASH_KV_REST_API_URL || process.env.KV_REST_API_URL || '',
@@ -122,6 +123,7 @@ export default defineNuxtConfig({
     '/_avatar/**': { isr: 3600, proxy: 'https://www.gravatar.com/avatar/**' },
     '/opensearch.xml': { isr: true },
     '/oauth-client-metadata.json': { prerender: true },
+    '/.well-known/jwks.json': { prerender: true },
     // never cache
     '/api/auth/**': { isr: false, cache: false },
     '/api/social/**': { isr: false, cache: false },
diff --git a/package.json b/package.json
index 2e67823579..06a2a4185b 100644
--- a/package.json
+++ b/package.json
@@ -34,6 +34,7 @@
     "generate:sprite": "node scripts/generate-file-tree-sprite.ts",
     "generate:fixtures": "node scripts/generate-fixtures.ts",
     "generate:lexicons": "lex build --lexicons lexicons --out shared/types/lexicons --clear",
+    "generate:jwk": "node scripts/gen-jwk.ts",
     "test": "vite test",
     "test:a11y": "pnpm build:test && LIGHTHOUSE_COLOR_MODE=dark pnpm test:a11y:prebuilt && LIGHTHOUSE_COLOR_MODE=light pnpm test:a11y:prebuilt",
     "test:a11y:prebuilt": "./scripts/lighthouse.sh",
diff --git a/scripts/gen-jwk.ts b/scripts/gen-jwk.ts
new file mode 100644
index 0000000000..39a2740c87
--- /dev/null
+++ b/scripts/gen-jwk.ts
@@ -0,0 +1,11 @@
+import { JoseKey } from '@atproto/oauth-client-node'
+
+async function run() {
+  const kid = Date.now().toString()
+  const key = await JoseKey.generate(['ES256'], kid)
+  const jwk = key.privateJwk
+
+  console.log(JSON.stringify(jwk))
+}
+
+await run()
diff --git a/server/api/auth/atproto.get.ts b/server/api/auth/atproto.get.ts
index 0ff4b2eafa..2c7836d0df 100644
--- a/server/api/auth/atproto.get.ts
+++ b/server/api/auth/atproto.get.ts
@@ -1,19 +1,16 @@
 import type { OAuthSession } from '@atproto/oauth-client-node'
-import { NodeOAuthClient, OAuthCallbackError } from '@atproto/oauth-client-node'
+import { OAuthCallbackError } from '@atproto/oauth-client-node'
 import { createError, getQuery, sendRedirect, setCookie, getCookie, deleteCookie } from 'h3'
 import type { H3Event } from 'h3'
-import { getOAuthLock } from '#server/utils/atproto/lock'
-import { useOAuthStorage } from '#server/utils/atproto/storage'
 import { SLINGSHOT_HOST } from '#shared/utils/constants'
 import { useServerSession } from '#server/utils/server-session'
-import { handleResolver } from '#server/utils/atproto/oauth'
 import { handleApiError } from '#server/utils/error-handler'
 import type { DidString } from '@atproto/lex'
 import { Client } from '@atproto/lex'
 import * as com from '#shared/types/lexicons/com'
 import * as app from '#shared/types/lexicons/app'
 import { isAtIdentifierString } from '@atproto/lex'
-import { scope, getOauthClientMetadata } from '#server/utils/atproto/oauth'
+import { scope } from '#server/utils/atproto/oauth'
 import { UNSET_NUXT_SESSION_PASSWORD } from '#shared/utils/constants'
 // @ts-expect-error virtual file from oauth module
 import { clientUri } from '#oauth/config'
@@ -28,17 +25,7 @@ export default defineEventHandler(async event => {
   }
 
   const query = getQuery(event)
-  const clientMetadata = getOauthClientMetadata()
   const session = await useServerSession(event)
-  const { stateStore, sessionStore } = useOAuthStorage(session)
-
-  const atclient = new NodeOAuthClient({
-    stateStore,
-    sessionStore,
-    clientMetadata,
-    requestLock: getOAuthLock(),
-    handleResolver,
-  })
 
   if (query.handle) {
     // Initiate auth flow
@@ -66,10 +53,13 @@ export default defineEventHandler(async event => {
     }
 
     try {
-      const redirectUrl = await atclient.authorize(query.handle, {
+      const redirectUrl = await event.context.oauthClient.authorize(query.handle, {
         scope,
         prompt: query.create ? 'create' : undefined,
-        ui_locales: query.locale?.toString(),
+        // TODO: I do not beleive this is working as expected on
+        // a unsupported locale on the PDS. Gives Invalid at body.ui_locales
+        // Commenting out for now
+        // ui_locales: query.locale?.toString(),
         state: encodeOAuthState(event, { redirectPath }),
       })
 
@@ -87,7 +77,7 @@ export default defineEventHandler(async event => {
     // Handle callback
     try {
       const params = new URLSearchParams(query as Record<string, string>)
-      const result = await atclient.callback(params)
+      const result = await event.context.oauthClient.callback(params)
       try {
         const state = decodeOAuthState(event, result.state)
         const profile = await getMiniProfile(result.session)
diff --git a/server/api/auth/session.get.ts b/server/api/auth/session.get.ts
index 771ab6c00d..3fb970818f 100644
--- a/server/api/auth/session.get.ts
+++ b/server/api/auth/session.get.ts
@@ -1,12 +1,23 @@
 import { PublicUserSessionSchema } from '#shared/schemas/publicUserSession'
 import { safeParse } from 'valibot'
 
-export default defineEventHandler(async event => {
-  const serverSession = await useServerSession(event)
+export default eventHandlerWithOAuthSession(async (event, _, serverSession) => {
   const result = safeParse(PublicUserSessionSchema, serverSession.data.public)
   if (!result.success) {
     return null
   }
 
+  // A one time redirect to upgrade the previous sessions.
+  // Can remove in 2 weeks from merge if we'd like
+  if (serverSession.data.oauthSession && serverSession.data?.public?.did) {
+    await serverSession.update({
+      oauthSession: undefined,
+    })
+    return {
+      ...result.output,
+      relogin: true,
+    }
+  }
+
   return result.output
 })
diff --git a/server/plugins/oauth-client.ts b/server/plugins/oauth-client.ts
new file mode 100644
index 0000000000..7f888271ba
--- /dev/null
+++ b/server/plugins/oauth-client.ts
@@ -0,0 +1,20 @@
+import type { NodeOAuthClient } from '@atproto/oauth-client-node'
+
+/**
+ * Creates a long living instance of the NodeOAuthClient.
+ */
+export default defineNitroPlugin(async nitroApp => {
+  const oauthClient = await getNodeOAuthClient()
+
+  // Attach to event context for access in composables via useRequestEvent()
+  nitroApp.hooks.hook('request', event => {
+    event.context.oauthClient = oauthClient
+  })
+})
+
+// Extend the H3EventContext type
+declare module 'h3' {
+  interface H3EventContext {
+    oauthClient: NodeOAuthClient
+  }
+}
diff --git a/server/routes/.well-known/jwks.json.get.ts b/server/routes/.well-known/jwks.json.get.ts
new file mode 100644
index 0000000000..f7c2eda628
--- /dev/null
+++ b/server/routes/.well-known/jwks.json.get.ts
@@ -0,0 +1,11 @@
+import { loadJWKs } from '#server/utils/atproto/oauth'
+
+export default defineEventHandler(async _ => {
+  const keys = await loadJWKs()
+  if (!keys) {
+    console.error('Failed to load JWKs. May not be set')
+    return []
+  }
+
+  return keys.publicJwks
+})
diff --git a/server/routes/oauth-client-metadata.json.get.ts b/server/routes/oauth-client-metadata.json.get.ts
index 0ea235ed64..60706d617e 100644
--- a/server/routes/oauth-client-metadata.json.get.ts
+++ b/server/routes/oauth-client-metadata.json.get.ts
@@ -1,3 +1,5 @@
-export default defineEventHandler(() => {
-  return getOauthClientMetadata()
+export default defineEventHandler(async _ => {
+  const keyset = await loadJWKs()
+  const pk = keyset?.findPrivateKey({ usage: 'sign' })
+  return getOauthClientMetadata(pk?.alg)
 })
diff --git a/server/utils/atproto/oauth-session-store.ts b/server/utils/atproto/oauth-session-store.ts
index 041e097195..9bdc52f054 100644
--- a/server/utils/atproto/oauth-session-store.ts
+++ b/server/utils/atproto/oauth-session-store.ts
@@ -1,39 +1,32 @@
 import type { NodeSavedSession, NodeSavedSessionStore } from '@atproto/oauth-client-node'
-import type { UserServerSession } from '#shared/types/userSession'
-import type { SessionManager } from 'h3'
+import { OAUTH_CACHE_STORAGE_BASE } from '#server/utils/atproto/storage'
+
+// Refresh tokens from a confidential client should last for 180 days, each new refresh of access token resets
+// the expiration with the new refresh token. Shorting to 179 days to keep it a bit simpler since we rely on redis to clear sessions
+// Note: This expiration only lasts this long in production. Local dev is 2 weeks
+const SESSION_EXPIRATION = CACHE_MAX_AGE_ONE_DAY * 179
 
 export class OAuthSessionStore implements NodeSavedSessionStore {
-  private readonly session: SessionManager<UserServerSession>
+  private readonly cache: CacheAdapter
+
+  constructor() {
+    this.cache = getCacheAdapter(OAUTH_CACHE_STORAGE_BASE)
+  }
 
-  constructor(session: SessionManager<UserServerSession>) {
-    this.session = session
+  private createStorageKey(did: string) {
+    return `sessions:${did}`
   }
 
-  async get(): Promise<NodeSavedSession | undefined> {
-    const sessionData = this.session.data
-    if (!sessionData) return undefined
-    return sessionData.oauthSession
+  async get(key: string): Promise<NodeSavedSession | undefined> {
+    let session = await this.cache.get<NodeSavedSession>(this.createStorageKey(key))
+    return session ?? undefined
   }
 
-  async set(_key: string, val: NodeSavedSession) {
-    // We are ignoring the key since the mapping is already done in the session
-    try {
-      await this.session.update({
-        oauthSession: val,
-      })
-    } catch (error) {
-      // Not sure if this has been happening. But helps with debugging
-      console.error(
-        '[oauth session store] Failed to set session:',
-        error instanceof Error ? error.message : 'Unknown error',
-      )
-      throw error
-    }
+  async set(key: string, val: NodeSavedSession) {
+    await this.cache.set<NodeSavedSession>(this.createStorageKey(key), val, SESSION_EXPIRATION)
   }
 
-  async del() {
-    await this.session.update({
-      oauthSession: undefined,
-    })
+  async del(key: string) {
+    await this.cache.delete(this.createStorageKey(key))
   }
 }
diff --git a/server/utils/atproto/oauth-state-store.ts b/server/utils/atproto/oauth-state-store.ts
index d15a95e96e..b04da8ff8c 100644
--- a/server/utils/atproto/oauth-state-store.ts
+++ b/server/utils/atproto/oauth-state-store.ts
@@ -1,30 +1,30 @@
 import type { NodeSavedState, NodeSavedStateStore } from '@atproto/oauth-client-node'
-import type { UserServerSession } from '#shared/types/userSession'
-import type { SessionManager } from 'h3'
+import { OAUTH_CACHE_STORAGE_BASE } from './storage'
+
+// It is recommended that oauth state is only saved for 30 minutes
+const STATE_EXPIRATION = CACHE_MAX_AGE_ONE_MINUTE * 30
 
 export class OAuthStateStore implements NodeSavedStateStore {
-  private readonly session: SessionManager<UserServerSession>
+  private readonly cache: CacheAdapter
+
+  constructor() {
+    this.cache = getCacheAdapter(OAUTH_CACHE_STORAGE_BASE)
+  }
 
-  constructor(session: SessionManager<UserServerSession>) {
-    this.session = session
+  private createStorageKey(key: string) {
+    return `state:${key}`
   }
 
-  async get(): Promise<NodeSavedState | undefined> {
-    const sessionData = this.session.data
-    if (!sessionData) return undefined
-    return sessionData.oauthState
+  async get(key: string): Promise<NodeSavedState | undefined> {
+    const state = await this.cache.get<NodeSavedState>(this.createStorageKey(key))
+    return state ?? undefined
   }
 
-  async set(_key: string, val: NodeSavedState) {
-    // We are ignoring the key since the mapping is already done in the session
-    await this.session.update({
-      oauthState: val,
-    })
+  async set(key: string, val: NodeSavedState) {
+    await this.cache.set<NodeSavedState>(this.createStorageKey(key), val, STATE_EXPIRATION)
   }
 
-  async del() {
-    await this.session.update({
-      oauthState: undefined,
-    })
+  async del(key: string) {
+    await this.cache.delete(this.createStorageKey(key))
   }
 }
diff --git a/server/utils/atproto/oauth.ts b/server/utils/atproto/oauth.ts
index c5c3380dc6..b39f5258d2 100644
--- a/server/utils/atproto/oauth.ts
+++ b/server/utils/atproto/oauth.ts
@@ -1,13 +1,19 @@
-import type { OAuthClientMetadataInput, OAuthSession } from '@atproto/oauth-client-node'
+import type {
+  OAuthClientMetadata,
+  OAuthRedirectUri,
+  OAuthSession,
+  WebUri,
+} from '@atproto/oauth-client-node'
+import { JoseKey, Keyset, oauthRedirectUriSchema, webUriSchema } from '@atproto/oauth-client-node'
 import type { EventHandlerRequest, H3Event, SessionManager } from 'h3'
 import { NodeOAuthClient, AtprotoDohHandleResolver } from '@atproto/oauth-client-node'
-import { parse } from 'valibot'
 import { getOAuthLock } from '#server/utils/atproto/lock'
 import { useOAuthStorage } from '#server/utils/atproto/storage'
 import { LIKES_SCOPE } from '#shared/utils/constants'
-import { OAuthMetadataSchema } from '#shared/schemas/oauth'
+import type { UserServerSession } from '#shared/types/userSession'
 // @ts-expect-error virtual file from oauth module
 import { clientUri } from '#oauth/config'
+
 // TODO: If you add writing a new record you will need to add a scope for it
 export const scope = `atproto ${LIKES_SCOPE}`
 
@@ -18,27 +24,38 @@ export const handleResolver = new AtprotoDohHandleResolver({
   dohEndpoint: 'https://cloudflare-dns.com/dns-query',
 })
 
-export function getOauthClientMetadata() {
-  const redirect_uri = `${clientUri}/api/auth/atproto`
+/**
+ * Generates the OAuth client metadata. pkAlg is used to signify that the OAuth client is confidential
+ */
+export function getOauthClientMetadata(pkAlg: string | undefined = undefined): OAuthClientMetadata {
+  const dev = import.meta.dev
 
-  const client_id =
-    import.meta.dev || import.meta.test
-      ? `http://localhost?redirect_uri=${encodeURIComponent(redirect_uri)}&scope=${encodeURIComponent(scope)}`
-      : `${clientUri}/oauth-client-metadata.json`
+  const client_uri = clientUri
+  const redirect_uri: OAuthRedirectUri = oauthRedirectUriSchema.parse(
+    `${client_uri}/api/auth/atproto`,
+  )
+  const jwks_uri: WebUri | undefined = pkAlg
+    ? webUriSchema.parse(`${client_uri}/.well-known/jwks.json`)
+    : undefined
 
   // If anything changes here, please make sure to also update /shared/schemas/oauth.ts to match
-  return parse(OAuthMetadataSchema, {
+  return {
     client_name: 'npmx.dev',
     client_id,
     client_uri: clientUri,
     scope,
-    redirect_uris: [redirect_uri] as [string, ...string[]],
+    redirect_uris: [redirect_uri],
     grant_types: ['authorization_code', 'refresh_token'],
     application_type: 'web',
-    token_endpoint_auth_method: 'none',
     dpop_bound_access_tokens: true,
     response_types: ['code'],
-  }) as OAuthClientMetadataInput
+    subject_type: 'public',
+    authorization_signed_response_alg: 'RS256',
+    // confidential client values
+    token_endpoint_auth_method: pkAlg ? 'private_key_jwt' : 'none',
+    jwks_uri,
+    token_endpoint_auth_signing_alg: pkAlg,
+  }
 }
 
 type EventHandlerWithOAuthSession<T extends EventHandlerRequest, D> = (
@@ -47,30 +64,51 @@ type EventHandlerWithOAuthSession<T extends EventHandlerRequest, D> = (
   serverSession: SessionManager,
 ) => Promise<D>
 
-async function getOAuthSession(
-  event: H3Event,
-): Promise<{ oauthSession: OAuthSession | undefined; serverSession: SessionManager }> {
+export async function getNodeOAuthClient(): Promise<NodeOAuthClient> {
+  const { stateStore, sessionStore } = useOAuthStorage()
+
+  // These are optional and not expected or can be used easily in local development, only in production
+  const keyset = await loadJWKs()
+  const pk = keyset?.findPrivateKey({ usage: 'sign' })
+  const clientMetadata = getOauthClientMetadata(pk?.alg)
+
+  return new NodeOAuthClient({
+    stateStore,
+    sessionStore,
+    clientMetadata,
+    requestLock: getOAuthLock(),
+    handleResolver,
+    keyset,
+  })
+}
+
+export async function loadJWKs(): Promise<Keyset | undefined> {
+  // If we ever need to add multiple JWKs to rotate keys we will need to add a new one
+  // under a new variable and update here
+  const jwkOne = useRuntimeConfig().oauthJwkOne
+  if (!jwkOne) return undefined
+
+  // For multiple keys if we need to rotate
+  // const keys = await Promise.all([JoseKey.fromImportable(jwkOne)])
+
+  const keys = await JoseKey.fromImportable(jwkOne)
+  return new Keyset([keys])
+}
+
+async function getOAuthSession(event: H3Event): Promise<{
+  oauthSession: OAuthSession | undefined
+  serverSession: SessionManager<UserServerSession>
+}> {
   const serverSession = await useServerSession(event)
 
   try {
-    const clientMetadata = getOauthClientMetadata()
-    const { stateStore, sessionStore } = useOAuthStorage(serverSession)
-
-    const client = new NodeOAuthClient({
-      stateStore,
-      sessionStore,
-      clientMetadata,
-      requestLock: getOAuthLock(),
-      handleResolver,
-    })
-
     const currentSession = serverSession.data
     // TODO (jg): why can a session be `{}`?
     if (!currentSession || !currentSession.public?.did) {
       return { oauthSession: undefined, serverSession }
     }
 
-    const oauthSession = await client.restore(currentSession.public.did)
+    const oauthSession = await event.context.oauthClient.restore(currentSession.public.did)
     return { oauthSession, serverSession }
   } catch (error) {
     // Log error safely without using util.inspect on potentially problematic objects
@@ -106,6 +144,18 @@ export function eventHandlerWithOAuthSession<T extends EventHandlerRequest, D>(
 ) {
   return defineEventHandler(async event => {
     const { oauthSession, serverSession } = await getOAuthSession(event)
+    const publicData = serverSession.data.public
+    // User was authenticated at one point, but was not able to restore
+    // the session to the PDS
+    if (!oauthSession && publicData) {
+      // cleans up our server side session store
+      await serverSession.clear()
+      throw createError({
+        status: 401,
+        message: 'User needs to re authenticate',
+      })
+    }
+
     return await handler(event, oauthSession, serverSession)
   })
 }
diff --git a/server/utils/atproto/storage.ts b/server/utils/atproto/storage.ts
index 9575250cc8..a62c9ceb71 100644
--- a/server/utils/atproto/storage.ts
+++ b/server/utils/atproto/storage.ts
@@ -1,11 +1,11 @@
-import type { SessionManager } from 'h3'
 import { OAuthStateStore } from './oauth-state-store'
 import { OAuthSessionStore } from './oauth-session-store'
-import type { UserServerSession } from '#shared/types/userSession'
 
-export const useOAuthStorage = (session: SessionManager<UserServerSession>) => {
+export const OAUTH_CACHE_STORAGE_BASE = 'atproto:oauth'
+
+export const useOAuthStorage = () => {
   return {
-    stateStore: new OAuthStateStore(session),
-    sessionStore: new OAuthSessionStore(session),
+    stateStore: new OAuthStateStore(),
+    sessionStore: new OAuthSessionStore(),
   }
 }
diff --git a/server/utils/server-session.ts b/server/utils/server-session.ts
index 1d41fff7ba..ad206dac9b 100644
--- a/server/utils/server-session.ts
+++ b/server/utils/server-session.ts
@@ -14,8 +14,9 @@ export const useServerSession = async (event: H3Event) => {
     throw new Error('Session password is not configured')
   }
 
-  const serverSession = useSession<UserServerSession>(event, {
+  const serverSession = await useSession<UserServerSession>(event, {
     password: config.sessionPassword,
+    maxAge: CACHE_MAX_AGE_ONE_DAY * 179,
   })
 
   return serverSession
diff --git a/shared/schemas/oauth.ts b/shared/schemas/oauth.ts
deleted file mode 100644
index 1e72ff319d..0000000000
--- a/shared/schemas/oauth.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-import { object, string, pipe, url, array, minLength, boolean } from 'valibot'
-
-export const OAuthMetadataSchema = object({
-  client_id: pipe(string(), url()),
-  client_name: string(),
-  client_uri: pipe(string(), url()),
-  redirect_uris: pipe(array(string()), minLength(1)),
-  scope: string(),
-  grant_types: array(string()),
-  application_type: string(),
-  token_endpoint_auth_method: string(),
-  dpop_bound_access_tokens: boolean(),
-  response_types: array(string()),
-})
diff --git a/shared/schemas/publicUserSession.ts b/shared/schemas/publicUserSession.ts
index 1c9e15a923..c3921af93f 100644
--- a/shared/schemas/publicUserSession.ts
+++ b/shared/schemas/publicUserSession.ts
@@ -1,12 +1,13 @@
-import { object, string, pipe, url, optional } from 'valibot'
+import * as v from 'valibot'
 import type { InferOutput } from 'valibot'
 
-export const PublicUserSessionSchema = object({
+export const PublicUserSessionSchema = v.object({
   // Safe to pass to the frontend
-  did: string(),
-  handle: string(),
-  pds: pipe(string(), url()),
-  avatar: optional(pipe(string(), url())),
+  did: v.string(),
+  handle: v.string(),
+  pds: v.pipe(v.string(), v.url()),
+  avatar: v.optional(v.pipe(v.string(), v.url())),
+  relogin: v.optional(v.boolean()),
 })
 
 export type PublicUserSession = InferOutput<typeof PublicUserSessionSchema>
diff --git a/shared/types/userSession.ts b/shared/types/userSession.ts
index d761c1336d..e088d2127a 100644
--- a/shared/types/userSession.ts
+++ b/shared/types/userSession.ts
@@ -1,4 +1,4 @@
-import type { NodeSavedSession, NodeSavedState } from '@atproto/oauth-client-node'
+import type { NodeSavedSession } from '@atproto/oauth-client-node'
 
 export interface UserServerSession {
   public?:
@@ -7,11 +7,11 @@ export interface UserServerSession {
         handle: string
         pds: string
         avatar?: string
+        relogin?: boolean
       }
     | undefined
-  // Only to be used in the atproto session and state stores
-  // Will need to change to Record<string, T> and add a current logged in user if we ever want to support
-  // multiple did logins per server session
+
+  // DO NOT USE
+  // Here for historic reasons to redirect users logged in with the previous oauth to login again
   oauthSession?: NodeSavedSession | undefined
-  oauthState?: NodeSavedState | undefined
 }

From 185d4b85484f05297121ded2a61c280a3bf68ede Mon Sep 17 00:00:00 2001
From: Bailey Townsend <baileytownsend2323@gmail.com>
Date: Mon, 23 Feb 2026 07:17:33 -0600
Subject: [PATCH 2/3] rebase fixes

---
 server/utils/atproto/oauth.ts | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/server/utils/atproto/oauth.ts b/server/utils/atproto/oauth.ts
index b39f5258d2..25ef84e6d8 100644
--- a/server/utils/atproto/oauth.ts
+++ b/server/utils/atproto/oauth.ts
@@ -28,14 +28,17 @@ export const handleResolver = new AtprotoDohHandleResolver({
  * Generates the OAuth client metadata. pkAlg is used to signify that the OAuth client is confidential
  */
 export function getOauthClientMetadata(pkAlg: string | undefined = undefined): OAuthClientMetadata {
-  const dev = import.meta.dev
-
-  const client_uri = clientUri
   const redirect_uri: OAuthRedirectUri = oauthRedirectUriSchema.parse(
-    `${client_uri}/api/auth/atproto`,
+    `${clientUri}/api/auth/atproto`,
   )
+
+  const client_id =
+    import.meta.dev || import.meta.test
+      ? `http://localhost?redirect_uri=${encodeURIComponent(redirect_uri)}&scope=${encodeURIComponent(scope)}`
+      : `${clientUri}/oauth-client-metadata.json`
+
   const jwks_uri: WebUri | undefined = pkAlg
-    ? webUriSchema.parse(`${client_uri}/.well-known/jwks.json`)
+    ? webUriSchema.parse(`${clientUri}/.well-known/jwks.json`)
     : undefined
 
   // If anything changes here, please make sure to also update /shared/schemas/oauth.ts to match

From 40e3319454e76c2ecb4d306003463635b95990c4 Mon Sep 17 00:00:00 2001
From: Bailey Townsend <baileytownsend2323@gmail.com>
Date: Mon, 23 Feb 2026 07:28:26 -0600
Subject: [PATCH 3/3] cleaning up some left overs

---
 modules/cache.ts | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/modules/cache.ts b/modules/cache.ts
index 31df72a6b7..a2e7c3a410 100644
--- a/modules/cache.ts
+++ b/modules/cache.ts
@@ -4,8 +4,6 @@ import { provider } from 'std-env'
 
 // Storage key for fetch cache - must match shared/utils/fetch-cache-config.ts
 const FETCH_CACHE_STORAGE_BASE = 'fetch-cache'
-// Storage key for OAuth cache - must match server/utils/atproto/storage.ts
-const OAUTH_CACHE_STORAGE_BASE = 'atproto:oauth'
 
 export default defineNuxtModule({
   meta: {
@@ -39,11 +37,6 @@ export default defineNuxtModule({
           ...nitroConfig.storage[FETCH_CACHE_STORAGE_BASE],
           driver: 'vercel-runtime-cache',
         }
-
-        nitroConfig.storage[OAUTH_CACHE_STORAGE_BASE] = {
-          ...nitroConfig.storage[OAUTH_CACHE_STORAGE_BASE],
-          driver: 'vercel-runtime-cache',
-        }
       }
 
       const env = process.env.VERCEL_ENV