refactor: moved the oauth to useSession

[fatfingers23]

Moved away from using a cookie and tying the oauth session to a kv store and use useSession for all store needs

concerns:

• I think those session.update({key: "blah"}) looks to be updating only the property passed in and not the ones
• Added some comments on how we can support multi atproto account logins if we ever want to

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
npmx.dev	Ready	Preview, Comment	Feb 3, 2026 6:26pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs.npmx.dev	Ignored	Preview	Feb 3, 2026 6:26pm
npmx-lunaria	Ignored		Feb 3, 2026 6:26pm

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR centralises server-side session handling by adding useServerSession (returns a SessionManager<UserServerSession>), moving OAuth state/session stores to use that server session instead of event/cookie storage, and introducing UserServerSession and PublicUserSessionSchema. API handlers and utilities now pass and validate the public portion of session data (session.data.public) and store oauthSession/oauthState on the server session. Session sign-out is now performed sequentially (signOut awaited before clearing the server session).

Possibly related PRs

• perf: handle session cleanup in parallel #837: Modifies the same session deletion flow for server/api/auth/session.delete.ts, changing coordination between sign-out and server-session clearing.

🚥 Pre-merge checks | ✅ 1

✅ Passed checks (1 passed)

Check name	Status	Explanation
Description check	✅ Passed	The pull request description accurately describes the changeset, detailing the migration from cookie/KV store-based OAuth storage to session-based storage using useSession.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

server/utils/atproto/oauth.ts (1)

39-43: ⚠️ Potential issue | 🟡 Minor

Missing generic type parameter on SessionManager.

Line 42 declares serverSession: SessionManager without the generic type parameter. For type safety and consistency with the rest of the codebase (e.g., SessionManager<UserServerSession> in the storage classes), this should be typed explicitly.

🔧 Proposed fix

+import type { UserServerSession } from '#shared/types/userSession'
+
 type EventHandlerWithOAuthSession<T extends EventHandlerRequest, D> = (
   event: H3Event<T>,
   session: OAuthSession | undefined,
-  serverSession: SessionManager,
+  serverSession: SessionManager<UserServerSession>,
 ) => Promise<D>

🧹 Nitpick comments (2)

shared/types/userSession.ts (1)

1-14: Consider optional properties instead of | undefined.

This reads more idiomatically and avoids explicit undefined assignments.

Suggested refactor

-  oauthSession: NodeSavedSession | undefined
-  oauthState: NodeSavedState | undefined
+  oauthSession?: NodeSavedSession
+  oauthState?: NodeSavedState

server/utils/atproto/oauth.ts (1)

45-72: Redundant useServerSession calls for the same request.

useServerSession(event) is called twice per request: once in getOAuthSession (line 47) and again in eventHandlerWithOAuthSession (line 68). Although h3's useSession typically caches by event, this pattern is unclear and potentially inefficient.

Consider passing serverSession as a parameter to getOAuthSession instead of having it fetch its own.

♻️ Proposed refactor

-async function getOAuthSession(event: H3Event): Promise<OAuthSession | undefined> {
+async function getOAuthSession(
+  event: H3Event,
+  serverSession: SessionManager<UserServerSession>,
+): Promise<OAuthSession | undefined> {
   const clientMetadata = getOauthClientMetadata()
-  const serverSession = await useServerSession(event)
   const { stateStore, sessionStore } = useOAuthStorage(serverSession)

   const client = new NodeOAuthClient({
@@ export function eventHandlerWithOAuthSession
   return defineEventHandler(async event => {
     const serverSession = await useServerSession(event)

-    const oAuthSession = await getOAuthSession(event)
+    const oAuthSession = await getOAuthSession(event, serverSession)
     return await handler(event, oAuthSession, serverSession)
   })
 }

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Ensure server session is cleared even when sign‑out fails.

If signOut() throws, serverSession.clear() will never run, leaving stale session state.

Proposed fix

-  await oAuthSession?.signOut()
-  await serverSession.clear()
+  try {
+    await oAuthSession?.signOut()
+  } finally {
+    await serverSession.clear()
+  }

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Guard against missing session data before validation.

serverSession.data can be undefined; accessing .public will throw and bypass the intended validation.

Proposed fix

-  const result = safeParse(PublicUserSessionSchema, serverSession.data.public)
+  const result = safeParse(PublicUserSessionSchema, serverSession.data?.public)

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	import { PublicUserSessionSchema } from '#shared/schemas/publicUserSession'
	import { safeParse } from 'valibot'
	export default eventHandlerWithOAuthSession(async (event, oAuthSession, serverSession) => {
	const result = safeParse(UserSessionSchema, serverSession.data)
	const result = safeParse(PublicUserSessionSchema, serverSession.data.public)
	import { PublicUserSessionSchema } from '#shared/schemas/publicUserSession'
	import { safeParse } from 'valibot'
	export default eventHandlerWithOAuthSession(async (event, oAuthSession, serverSession) => {
	const result = safeParse(PublicUserSessionSchema, serverSession.data?.public)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

Actionable comments posted: 1