From eccf22454631c5e846bc7a61a36f7e559fe4a996 Mon Sep 17 00:00:00 2001
From: Seongmin Lee <git@boltless.me>
Date: Thu, 26 Mar 2026 13:07:57 +0900
Subject: [PATCH] appview: drain pds rewrites on any active sessions

Signed-off-by: Seongmin Lee <git@boltless.me>
---
 appview/oauth/handler.go | 14 +++++++++++++-
 appview/state/router.go  |  2 ++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/appview/oauth/handler.go b/appview/oauth/handler.go
index 4f6f8aaa..f08836b2 100644
--- a/appview/oauth/handler.go
+++ b/appview/oauth/handler.go
@@ -96,7 +96,6 @@ func (o *OAuth) callback(w http.ResponseWriter, r *http.Request) {
 	go o.addToDefaultSpindle(sessData.AccountDID.String())
 	go o.ensureTangledProfile(sessData)
 	go o.autoClaimTnglShDomain(sessData.AccountDID.String())
-	go o.drainPdsRewrites(sessData)
 
 	if !o.Config.Core.Dev {
 		err = o.Posthog.Enqueue(posthog.Capture{
@@ -274,6 +273,19 @@ func (o *OAuth) ensureTangledProfile(sessData *oauth.ClientSessionData) {
 	l.Debug("successfully created empty Tangled profile on PDS and DB")
 }
 
+func (o *OAuth) PdsRewriteMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		defer next.ServeHTTP(w, r)
+
+		sess, err := o.ResumeSession(r)
+		if err != nil {
+			return
+		}
+
+		go o.drainPdsRewrites(sess.Data)
+	})
+}
+
 func (o *OAuth) drainPdsRewrites(sessData *oauth.ClientSessionData) {
 	ctx := context.Background()
 	did := sessData.AccountDID.String()
diff --git a/appview/state/router.go b/appview/state/router.go
index a6103624..827abc13 100644
--- a/appview/state/router.go
+++ b/appview/state/router.go
@@ -37,6 +37,8 @@ func (s *State) Router() http.Handler {
 		s.logger,
 	)
 
+	router.Use(s.oauth.PdsRewriteMiddleware)
+
 	router.Get("/pwa-manifest.json", s.WebAppManifest)
 	router.Get("/robots.txt", s.RobotsTxt)
 	router.Get("/.well-known/security.txt", s.SecurityTxt)
-- 
2.51.2