+12

atproto/auth/oauth/oauth.go

reviewed

··· 521 521 // 522 522 // The returned sting will be a web URL that the user should be redirected to (in browser) to approve the auth flow. 523 523 func (app *ClientApp) StartAuthFlow(ctx context.Context, identifier string) (string, error) { 524 524 + return app.StartAuthFlowWithUserData(ctx, identifier, "") 525 525 + } 526 526 + 527 527 + // The same as StartAuthFlow, but accepting an additional `userData` string argument. 528 528 + // 529 529 + // This string will be persisted to the session store, along with the rest of the session metadata. 530 530 + // 531 531 + // At the end of a successful auth flow, it is accessible via the `ClientSessionData.UserData` field. 532 532 + func (app *ClientApp) StartAuthFlowWithUserData(ctx context.Context, identifier string, userData string) (string, error) { 524 533 525 534 var authserverURL string 526 535 var accountDID syntax.DID ··· 565 574 if accountDID != "" { 566 575 info.AccountDID = &accountDID 567 576 } 577 577 + 578 578 + info.UserData = userData 568 579 569 580 // persist auth request info 570 581 app.Store.SaveAuthRequestInfo(ctx, *info) ··· 681 692 DPoPAuthServerNonce: info.DPoPAuthServerNonce, 682 693 DPoPHostNonce: info.DPoPAuthServerNonce, // bootstrap host nonce from authserver 683 694 DPoPPrivateKeyMultibase: info.DPoPPrivateKeyMultibase, 695 695 + UserData: info.UserData, 684 696 } 685 697 if err := app.Store.SaveSession(ctx, sessData); err != nil { 686 698 return nil, err

+3

atproto/auth/oauth/session.go

reviewed

··· 61 61 // The secret cryptographic key generated by the client for this specific OAuth session 62 62 DPoPPrivateKeyMultibase string `json:"dpop_privatekey_multibase"` 63 63 64 64 + // Additional data with user-defined purpose 65 65 + UserData string `json:"user_data,omitempty"` 66 66 + 64 67 // TODO: also persist access token creation time / expiration time? In context that token might not be an easily parsed JWT 65 68 } 66 69

+3

atproto/auth/oauth/types.go

reviewed

··· 353 353 354 354 // The secret cryptographic key generated by the client for this specific OAuth session 355 355 DPoPPrivateKeyMultibase string `json:"dpop_privatekey_multibase"` 356 356 + 357 357 + // Additional data with user-defined purpose 358 358 + UserData string `json:"user_data,omitempty"` 356 359 } 357 360 358 361 // The fields which are included in an initial token refresh request. These HTTP POST bodies are form-encoded, so use URL encoding syntax, not JSON.