commit 80a873ab2afd55ec87c16d3e5df78ef7fc25936c · bretton.dev/coves-mobile

+49 -29

packages/atproto_oauth_flutter/lib/src/client/oauth_client.dart

···

       476
        
           final dpopKeyJwk = (dpopKey as dynamic).privateJwk ?? dpopKey.bareJwk ?? {};

     

       477
        
       

     

       478
        
           if (kDebugMode) {

     

       479
       -
             print('🔑 Storing DPoP key:');

     

       480
       -
             print('   Has privateJwk: ${(dpopKey as dynamic).privateJwk != null}');

     

       481
       -
             print('   Has bareJwk: ${dpopKey.bareJwk != null}');

     

       482
       -
             print('   Stored JWK has "d" (private): ${dpopKeyJwk.containsKey('d')}');

     

       483
       -
             print('   Stored JWK keys: ${dpopKeyJwk.keys.toList()}');

     

       484
        
           }

     

       485
        
       

     

       486
        
           await _stateStore.set(

     
···

       659
        
             }

     

       660
        
       

     

       661
        
             // Create OAuth server agent

     

       662
       -
             // TODO: Implement proper Key reconstruction from stored bareJwk

     

       663
       -
             // For now, we regenerate the key with the same algorithms

     

       664
       -
             // This works but is not ideal - we should restore the exact same key

     

       665
        
             final authMethod =

     

       666
        
                 stateData.authMethod != null

     

       667
        
                     ? ClientAuthMethod.fromJson(

     
···

       670
        
                     : const ClientAuthMethod.none(); // Legacy fallback

     

       671
        
       

     

       672
        
             // Restore dpopKey from stored private JWK

     

       673
       -
             // Import FlutterKey to access fromJwk factory

     

       674
       -
             if (kDebugMode) {

     

       675
       -
               print('🔓 Restoring DPoP key:');

     

       676
       -
               print(

     

       677
       -
                 '   Stored JWK has "d" (private): ${(stateData.dpopKey as Map).containsKey('d')}',

     

       678
        
               );

     

       679
       -
               print(

     

       680
       -
                 '   Stored JWK keys: ${(stateData.dpopKey as Map).keys.toList()}',

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       681
        
               );

     

       682
       -
             }

     

       683
       -
       

     

       684
       -
             final dpopKey = FlutterKey.fromJwk(

     

       685
       -
               stateData.dpopKey as Map<String, dynamic>,

     

       686
       -
             );

     

       687
       -
       

     

       688
       -
             if (kDebugMode) {

     

       689
       -
               print('   ✅ DPoP key restored successfully');

     

       690
        
             }

     

       691
        
       

     

       692
        
             final server = await serverFactory.fromIssuer(

     
···

       839
        
                     )

     

       840
        
                     : const ClientAuthMethod.none(); // Legacy

     

       841
        
       

     

       842
       -
             // TODO: Implement proper Key reconstruction from stored bareJwk

     

       843
       -
             // For now, we regenerate the key

     

       844
       -
             final dpopKey = await runtime.generateKey([fallbackAlg]);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       845
        
       

     

       846
        
             // Create server agent

     

       847
        
             final server = await serverFactory.fromIssuer(

     
···

       895
        
                     )

     

       896
        
                     : const ClientAuthMethod.none(); // Legacy

     

       897
        
       

     

       898
       -
             // TODO: Implement proper Key reconstruction from stored bareJwk

     

       899
       -
             // For now, we regenerate the key

     

       900
       -
             final dpopKey = await runtime.generateKey([fallbackAlg]);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       901
        
       

     

       902
        
             final server = await serverFactory.fromIssuer(

     

       903
        
               session.tokenSet.iss,

···

       476
        
           final dpopKeyJwk = (dpopKey as dynamic).privateJwk ?? dpopKey.bareJwk ?? {};

     

       477
        
       

     

       478
        
           if (kDebugMode) {

     

       479
       +
             print('🔑 Storing DPoP key for authorization flow');

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       480
        
           }

     

       481
        
       

     

       482
        
           await _stateStore.set(

     
···

       655
        
             }

     

       656
        
       

     

       657
        
             // Create OAuth server agent

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       658
        
             final authMethod =

     

       659
        
                 stateData.authMethod != null

     

       660
        
                     ? ClientAuthMethod.fromJson(

     
···

       663
        
                     : const ClientAuthMethod.none(); // Legacy fallback

     

       664
        
       

     

       665
        
             // Restore dpopKey from stored private JWK

     

       666
       +
             // Restore DPoP key with error handling for corrupted JWK data

     

       667
       +
             final FlutterKey dpopKey;

     

       668
       +
             try {

     

       669
       +
               dpopKey = FlutterKey.fromJwk(

     

       670
       +
                 stateData.dpopKey as Map<String, dynamic>,

     

       671
        
               );

     

       672
       +
               if (kDebugMode) {

     

       673
       +
                 print('🔓 DPoP key restored successfully for token exchange');

     

       674
       +
               }

     

       675
       +
             } catch (e) {

     

       676
       +
               throw Exception(

     

       677
       +
                 'Failed to restore DPoP key from stored state: $e. '

     

       678
       +
                 'The stored key may be corrupted. Please try authenticating again.',

     

       679
        
               );

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       680
        
             }

     

       681
        
       

     

       682
        
             final server = await serverFactory.fromIssuer(

     
···

       829
        
                     )

     

       830
        
                     : const ClientAuthMethod.none(); // Legacy

     

       831
        
       

     

       832
       +
             // Restore dpopKey from stored private JWK with error handling

     

       833
       +
             // CRITICAL FIX: Use the stored key instead of generating a new one

     

       834
       +
             // This ensures DPoP proofs match the token binding

     

       835
       +
             final FlutterKey dpopKey;

     

       836
       +
             try {

     

       837
       +
               dpopKey = FlutterKey.fromJwk(

     

       838
       +
                 session.dpopKey as Map<String, dynamic>,

     

       839
       +
               );

     

       840
       +
             } catch (e) {

     

       841
       +
               // If key is corrupted, delete the session and force re-authentication

     

       842
       +
               await _sessionGetter.delStored(

     

       843
       +
                 sub,

     

       844
       +
                 Exception('Corrupted DPoP key in stored session: $e'),

     

       845
       +
               );

     

       846
       +
               throw Exception(

     

       847
       +
                 'Failed to restore DPoP key for session. The stored key is corrupted. '

     

       848
       +
                 'Please authenticate again.',

     

       849
       +
               );

     

       850
       +
             }

     

       851
        
       

     

       852
        
             // Create server agent

     

       853
        
             final server = await serverFactory.fromIssuer(

     
···

       901
        
                     )

     

       902
        
                     : const ClientAuthMethod.none(); // Legacy

     

       903
        
       

     

       904
       +
             // Restore dpopKey from stored private JWK with error handling

     

       905
       +
             // CRITICAL FIX: Use the stored key instead of generating a new one

     

       906
       +
             // This ensures DPoP proofs match the token binding

     

       907
       +
             final FlutterKey dpopKey;

     

       908
       +
             try {

     

       909
       +
               dpopKey = FlutterKey.fromJwk(

     

       910
       +
                 session.dpopKey as Map<String, dynamic>,

     

       911
       +
               );

     

       912
       +
             } catch (e) {

     

       913
       +
               // If key is corrupted, skip server-side revocation

     

       914
       +
               // The finally block will still delete the local session

     

       915
       +
               if (kDebugMode) {

     

       916
       +
                 print('⚠️  Cannot revoke on server: corrupted DPoP key ($e)');

     

       917
       +
                 print('   Local session will still be deleted');

     

       918
       +
               }

     

       919
       +
               return;

     

       920
       +
             }

     

       921
        
       

     

       922
        
             final server = await serverFactory.fromIssuer(

     

       923
        
               session.tokenSet.iss,