From f744f92ec594414c2a4fc0241a8981f0b49f088c Mon Sep 17 00:00:00 2001
From: Hayleigh Thompson <me@hayleigh.dev>
Date: Thu, 13 Aug 2026 09:07:27 +0100
Subject: [PATCH] =?UTF-8?q?=E2=9C=A8=20Add=20a=20decoder=20for=20verified?=
 =?UTF-8?q?=20refresh=20sessions.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/at/oauth.gleam | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/src/at/oauth.gleam b/src/at/oauth.gleam
index 130dbb7..43e1762 100644
--- a/src/at/oauth.gleam
+++ b/src/at/oauth.gleam
@@ -920,6 +920,29 @@ pub fn session_decoder() -> Decoder(Session(Unverified)) {
   ))
 }
 
+pub fn refreshed_session_decoder(
+  previous: Session(Verified),
+) -> Decoder(Session(Verified)) {
+  use _ <- decode.field("sub", {
+    decode.then(did.decoder(), fn(subject) {
+      case subject == previous.subject {
+        True -> decode.success(subject)
+        False -> decode.failure(subject, did.to_string(previous.subject))
+      }
+    })
+  })
+
+  use next <- decode.map(session_decoder())
+
+  Session(
+    access_token: next.access_token,
+    refresh_token: next.refresh_token,
+    expires_in: next.expires_in,
+    scopes: next.scopes,
+    subject: next.subject,
+  )
+}
+
 // DPOP REQUESTS ---------------------------------------------------------------
 
 pub opaque type DpopRequest(body) {
-- 
2.51.2