@@ -29,6 +29,7 @@ "strings"
 	"sync"
 	"time"
 
+	"github.com/jmoiron/sqlx"
 	"humungus.tedunangst.com/r/webs/cache"
 	"humungus.tedunangst.com/r/webs/htfilter"
 	"humungus.tedunangst.com/r/webs/httpsig"
@@ -1194,9 +1195,18 @@ var stmtGetLocalHonkCount *sql.Stmt
 var stmtSaveMastoApp *sql.Stmt
 var stmtCheckClientId *sql.Stmt
 var stmtSaveMastoAppToken *sql.Stmt
+var stmtGetMastoApp *sqlx.Stmt
 
 func preparetodie(db *sql.DB, s string) *sql.Stmt {
 	stmt, err := db.Prepare(s)
+	if err != nil {
+		elog.Fatalf("error %s: %s", err, s)
+	}
+	return stmt
+}
+
+func preparetodiex(db *sqlx.DB, s string) *sqlx.Stmt {
+	stmt, err := db.Preparex(s)
 	if err != nil {
 		elog.Fatalf("error %s: %s", err, s)
 	}
@@ -1290,3 +1300,7 @@ stmtSaveMastoApp = preparetodie(db, "insert into masto (clientname, redirecturis, scopes, clientid, clientsecret, vapidkey, authtoken) values (?, ?, ?, ?, ?, ?, ?)")
 	stmtSaveMastoAppToken = preparetodie(db, "update masto set authtoken = ?")
 	stmtCheckClientId = preparetodie(db, "select clientid from masto where clientid = ?")
 }
+
+func prepareStatementsx(dbx *sqlx.DB) {
+	stmtGetMastoApp = preparetodiex(dbx, "select * from masto where clientid = ?")
+}

@@ -6,6 +6,7 @@ require (
 	github.com/andybalholm/cascadia v1.3.2
 	github.com/dustin/go-humanize v1.0.1
 	github.com/gorilla/mux v1.8.0
+	github.com/jmoiron/sqlx v1.3.5
 	github.com/mattn/go-runewidth v0.0.15
 	golang.org/x/crypto v0.12.0
 	golang.org/x/net v0.14.0

@@ -2,10 +2,18 @@ github.com/andybalholm/cascadia v1.3.2 h1:3Xi6Dw5lHF15JtdcmAHD3i1+T8plmv7BQ/nsViSLyss=
 github.com/andybalholm/cascadia v1.3.2/go.mod h1:7gtRlve5FxPPgIgX36uWBX58OdBsSS6lUvCFb+h7KvU=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
+github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
 github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
+github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g=
+github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ=
+github.com/lib/pq v1.2.0 h1:LXpIM/LZ5xGFhOpXAQUIMM1HdyqzVYM13zNdjCEEcA0=
+github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
 github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-sqlite3 v1.14.6 h1:dNPt6NO46WmLVt2DLNpwczCmdV5boIZ6g/tlDrlRUbg=
+github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
 github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=

@@ -10,6 +10,16 @@ "humungus.tedunangst.com/r/webs/junk"
 	"humungus.tedunangst.com/r/webs/login"
 )
 
+type MastoApp struct {
+	Name         string `db:"clientname"`
+	RedirectURI  string `db:"redirecturi"`
+	ClientID     string `db:"clientid"`
+	ClientSecret string `db:"clientsecret"`
+	VapidKey     string `db:"vapidkey"`
+	AuthToken    string `db:"authtoken"`
+	Scopes       string `db:"scopes"`
+}
+
 func showoauthlogin(rw http.ResponseWriter, r *http.Request) {
 	templinfo := make(map[string]interface{})
 	templinfo = getInfo(r)
@@ -84,6 +94,25 @@ log.Println("redirecting to", uri)
 	rw.Header().Set("Content-Type", "")
 	rw.Header().Set("Location", uri)
 	rw.WriteHeader(302)
+}
+
+// https://docs.joinmastodon.org/methods/oauth/#token
+func oauthtoken(rw http.ResponseWriter, r *http.Request) {
+	// grantType := r.FormValue("grant_type")
+	// code := r.FormValue("code")
+	clientID := r.FormValue("client_id")
+	// clientSecret := r.FormValue("client_Secret")
+	// redirectURI := r.FormValue("redirect_uri")
+	// gotScopes := r.FormValue("scopes")
+
+	app := MastoApp{}
+	err := stmtGetMastoApp.Select(&app, clientID)
+	if err == sql.ErrNoRows {
+		elog.Println("oauth: no such client:", clientID)
+		rw.WriteHeader(http.StatusUnauthorized)
+		return
+	}
+
 }
 
 // https://docs.joinmastodon.org/methods/instance/#v2

@@ -46,7 +46,7 @@ rw.Write(j.ToBytes())
 }
 
 func tokengen() string {
-	b := make([]byte, 64)
+	b := make([]byte, 32)
 	rand.Read(b)
 	return fmt.Sprintf("%x", b)
 }

@@ -46,6 +46,7 @@ "os/signal"
 	"regexp"
 	"strings"
 
+	"github.com/jmoiron/sqlx"
 	"golang.org/x/crypto/bcrypt"
 	_ "humungus.tedunangst.com/r/go-sqlite3"
 	"humungus.tedunangst.com/r/webs/httpsig"
@@ -73,6 +74,7 @@
 var dbtimeformat = "2006-01-02 15:04:05"
 
 var alreadyopendb *sql.DB
+var alreadyopendbx *sqlx.DB
 var stmtConfig *sql.Stmt
 
 func initdb() {
@@ -85,7 +87,12 @@ db, err := sql.Open("sqlite3", dbname)
 	if err != nil {
 		elog.Fatal(err)
 	}
-	alreadyopendb = db
+	dbx, err := sqlx.Open("sqlite3", dbname)
+	if err != nil {
+		elog.Fatal(err)
+	}
+	alreadyopendbx = dbx
+
 	defer func() {
 		os.Remove(dbname)
 		os.Exit(1)
@@ -117,6 +124,7 @@
 	initblobdb()
 
 	prepareStatements(db)
+	prepareStatementsx(dbx)
 
 	err = createuser(db, r)
 	if err != nil {
@@ -372,6 +380,27 @@ if err != nil {
 		return err
 	}
 	return nil
+}
+
+func opendatabasex() *sqlx.DB {
+	if alreadyopendb != nil {
+		return alreadyopendbx
+	}
+	dbname := dataDir + "/honk.db"
+	_, err := os.Stat(dbname)
+	if err != nil {
+		elog.Fatalf("unable to open database: %s", err)
+	}
+	db, err := sqlx.Open("sqlite3", dbname)
+	if err != nil {
+		elog.Fatalf("unable to open database: %s", err)
+	}
+	stmtConfig, err = db.Prepare("select value from config where key = ?")
+	if err != nil {
+		elog.Fatal(err)
+	}
+	alreadyopendbx = db
+	return db
 }
 
 func opendatabase() *sql.DB {

@@ -2988,6 +2988,7 @@ mastopost := mux.Methods("POST").Subrouter()
 	mastoget := mux.Methods("GET").Subrouter()
 	mastoget.HandleFunc("/oauth/authorize", showoauthlogin)
 	mastopost.HandleFunc("/oauth/authorize", oauthorize)
+	mastopost.HandleFunc("/oauth/token", oauthtoken)
 	mastoget.HandleFunc("/api/v1/instance", instance)
 	mastopost.HandleFunc("/api/v1/apps", apiapps)