From add274996cda94b8a50f4392f459e64ea4bd706d Mon Sep 17 00:00:00 2001
From: Will Andrews <will7989@hotmail.com>
Date: Thu, 15 Jan 2026 23:03:47 +0000
Subject: [PATCH] fix the sessions table to make a session unique accross the
 did and sessionID

---
 database/oauth_sessions.go | 8 ++++----
 home_handler.go            | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/database/oauth_sessions.go b/database/oauth_sessions.go
index 845a57e..e089b05 100644
--- a/database/oauth_sessions.go
+++ b/database/oauth_sessions.go
@@ -25,7 +25,7 @@ func createOauthSessionsTable(db *sql.DB) error {
 		"dpopAuthServerNonce" TEXT,
 		"dpopHostNonce" TEXT,
 		"dpopPrivateKeyMultibase" TEXT,
-		UNIQUE(accountDID)
+		UNIQUE(accountDID,sessionID)
 	  );`
 
 	slog.Info("Create oauthsessions table...")
@@ -48,7 +48,7 @@ func (d *DB) SaveSession(ctx context.Context, sess oauth.ClientSessionData) erro
 		return fmt.Errorf("marshalling scopes: %w", err)
 	}
 
-	sql := `INSERT INTO oauthsessions (accountDID, sessionID, hostURL,  authServerURL, authServerTokenEndpoint, scopes, accessToken, refreshToken, dpopAuthServerNonce, dpopHostNonce, dpopPrivateKeyMultibase) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(accountDID) DO NOTHING;` // TODO: update on conflict
+	sql := `INSERT INTO oauthsessions (accountDID, sessionID, hostURL,  authServerURL, authServerTokenEndpoint, scopes, accessToken, refreshToken, dpopAuthServerNonce, dpopHostNonce, dpopPrivateKeyMultibase) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(accountDID,sessionID) DO NOTHING;`
 	_, err = d.db.Exec(sql, sess.AccountDID.String(), sess.SessionID, sess.HostURL, sess.AuthServerURL, sess.AuthServerTokenEndpoint, string(scopes), sess.AccessToken, sess.RefreshToken, sess.DPoPAuthServerNonce, sess.DPoPHostNonce, sess.DPoPPrivateKeyMultibase)
 	if err != nil {
 		slog.Error("saving session", "error", err)
@@ -88,8 +88,8 @@ func (d *DB) GetSession(ctx context.Context, did syntax.DID, sessionID string) (
 }
 
 func (d *DB) DeleteSession(ctx context.Context, did syntax.DID, sessionID string) error {
-	sql := "DELETE FROM oauthsessions WHERE accountDID = ?;"
-	_, err := d.db.Exec(sql, did.String())
+	sql := "DELETE FROM oauthsessions WHERE accountDID = ? AND sessionID = ?;"
+	_, err := d.db.Exec(sql, did.String(), sessionID)
 	if err != nil {
 		return fmt.Errorf("exec delete oauth session: %w", err)
 	}
diff --git a/home_handler.go b/home_handler.go
index 7a87cd7..502cdb5 100644
--- a/home_handler.go
+++ b/home_handler.go
@@ -116,7 +116,7 @@ func (s *Server) HandleStatus(w http.ResponseWriter, r *http.Request) {
 
 	oauthSess, err := s.oauthClient.ResumeSession(r.Context(), *did, sessionID)
 	if err != nil {
-		slog.Error("resuming session", "error", err, "did", *did)
+		slog.Error("resuming session", "error", err, "did", *did, "session ID", sessionID)
 
 		// clear the session out
 		sess, _ := s.sessionStore.Get(r, sessionStoreName)
-- 
2.51.2