From 0308f17db70e5a66e0e2e59b87a810c81f9a3546 Mon Sep 17 00:00:00 2001
From: erri120 <erri120@protonmail.com>
Date: Wed, 20 Sep 2023 15:56:36 +0200
Subject: [PATCH 01/15] Update TopBar controls

---
 .../Controls/TopBar/TopBarDesignViewModel.cs  | 25 +++++++----------
 .../Controls/TopBar/TopBarView.axaml          |  4 +--
 .../Controls/TopBar/TopBarView.axaml.cs       | 27 +++++++++----------
 .../Controls/TopBar/TopBarViewModel.cs        | 26 +++++++++++-------
 src/NexusMods.App.UI/NexusMods.App.UI.csproj  |  6 +++++
 5 files changed, 46 insertions(+), 42 deletions(-)

diff --git a/src/NexusMods.App.UI/Controls/TopBar/TopBarDesignViewModel.cs b/src/NexusMods.App.UI/Controls/TopBar/TopBarDesignViewModel.cs
index efe98bdd90..5e531c72ff 100644
--- a/src/NexusMods.App.UI/Controls/TopBar/TopBarDesignViewModel.cs
+++ b/src/NexusMods.App.UI/Controls/TopBar/TopBarDesignViewModel.cs
@@ -1,4 +1,5 @@
 using System.Reactive;
+using System.Reactive.Disposables;
 using System.Reactive.Linq;
 using Avalonia.Media;
 using Avalonia.Media.Imaging;
@@ -16,17 +17,13 @@ public class TopBarDesignViewModel : AViewModel<ITopBarViewModel>, ITopBarViewMo
     [Reactive]
     public bool IsLoggedIn { get; set; }
 
-    [Reactive]
-    public bool IsPremium { get; set; }
+    [Reactive] public bool IsPremium { get; set; } = true;
 
-    [Reactive]
-    public IImage Avatar { get; set; }
+    [Reactive] public IImage Avatar { get; set; } = new Bitmap(AssetLoader.Open(new Uri("avares://NexusMods.App.UI/Assets/DesignTime/cyberpunk_game.png")));
 
-    [Reactive]
-    public ReactiveCommand<Unit, Unit> LoginCommand { get; set; }
+    [Reactive] public ReactiveCommand<Unit, Unit> LoginCommand { get; set; } = Initializers.EnabledReactiveCommand;
 
-    [Reactive]
-    public ReactiveCommand<Unit, Unit> LogoutCommand { get; set; }
+    [Reactive] public ReactiveCommand<Unit, Unit> LogoutCommand { get; set; } = Initializers.EnabledReactiveCommand;
 
     [Reactive]
     public ReactiveCommand<Unit, Unit> MinimizeCommand { get; set; } = ReactiveCommand.Create(() => { });
@@ -38,13 +35,11 @@ public class TopBarDesignViewModel : AViewModel<ITopBarViewModel>, ITopBarViewMo
 
     public TopBarDesignViewModel()
     {
-        Avatar = new Bitmap(AssetLoader.Open(new Uri("avares://NexusMods.App.UI/Assets/DesignTime/cyberpunk_game.png")));
-        IsLoggedIn = false;
-        IsPremium = true;
-
-        LogoutCommand = ReactiveCommand.Create(ToggleLogin, this.WhenAnyValue(vm => vm.IsLoggedIn));
-        LoginCommand = ReactiveCommand.Create(ToggleLogin, this.WhenAnyValue(vm => vm.IsLoggedIn)
-            .Select(x => !x));
+        this.WhenActivated(disposables =>
+        {
+            LogoutCommand = ReactiveCommand.Create(ToggleLogin, this.WhenAnyValue(vm => vm.IsLoggedIn)).DisposeWith(disposables);
+            LoginCommand = ReactiveCommand.Create(ToggleLogin, this.WhenAnyValue(vm => vm.IsLoggedIn).Select(x => !x)).DisposeWith(disposables);
+        });
     }
 
     private void ToggleLogin()
diff --git a/src/NexusMods.App.UI/Controls/TopBar/TopBarView.axaml b/src/NexusMods.App.UI/Controls/TopBar/TopBarView.axaml
index 632af15331..c1a8efd19b 100644
--- a/src/NexusMods.App.UI/Controls/TopBar/TopBarView.axaml
+++ b/src/NexusMods.App.UI/Controls/TopBar/TopBarView.axaml
@@ -26,7 +26,7 @@
             Path="avares://NexusMods.App.UI/Assets/nexus-logo-with-text.svg"
             VerticalAlignment="Center"/>
 
-        <Button Classes="Pill Light" Grid.Column="1" Grid.Row="0" x:Name="Premium">
+        <Button Classes="Pill Light" Grid.Column="1" Grid.Row="0" x:Name="Premium" IsVisible="False">
             <StackPanel>
                 <avalonia:Icon Classes="Star" />
                 <TextBlock Text="{x:Static resources:Language.Nexus_Premium_Status__Premium}"></TextBlock>
@@ -79,7 +79,7 @@
             BorderBrush="{DynamicResource StructuralBorderBrush}"
             BorderThickness="1,0,0,0"
             Grid.Column="4"
-            x:Name="UserPanel">
+            x:Name="UserPanel" IsVisible="False">
             <StackPanel Orientation="Horizontal" Spacing="16" Margin="16, 0">
                 <Button
                     Classes="Action"
diff --git a/src/NexusMods.App.UI/Controls/TopBar/TopBarView.axaml.cs b/src/NexusMods.App.UI/Controls/TopBar/TopBarView.axaml.cs
index ba275887e0..6a69d86c3e 100644
--- a/src/NexusMods.App.UI/Controls/TopBar/TopBarView.axaml.cs
+++ b/src/NexusMods.App.UI/Controls/TopBar/TopBarView.axaml.cs
@@ -1,6 +1,8 @@
 using System.Reactive.Disposables;
+using System.Reactive.Disposables;
 using System.Reactive.Linq;
 using Avalonia.ReactiveUI;
+using NexusMods.App.UI;
 using ReactiveUI;
 
 namespace NexusMods.App.UI.Controls.TopBar;
@@ -13,33 +15,28 @@ public TopBarView()
 
         this.WhenActivated(d =>
         {
-            this.BindCommand(ViewModel, vm => vm.LoginCommand, v => v.LoginButton)
+            this.BindCommand(ViewModel, vm => vm.LoginCommand, view => view.LoginButton)
                 .DisposeWith(d);
 
             this.BindCommand(ViewModel, vm => vm.LogoutCommand, view => view.UserButton)
                 .DisposeWith(d);
 
-            this.WhenAnyValue(v => v.ViewModel!.IsLoggedIn)
-                .Select(v => !v)
-                .BindToUi(this, v => v.LoginButton.IsVisible)
+            this.OneWayBind(ViewModel, vm => vm.IsLoggedIn, view => view.LoginButton.IsVisible,isLoggedIn => !isLoggedIn)
                 .DisposeWith(d);
 
-            this.WhenAnyValue(v => v.ViewModel!.IsLoggedIn)
-                .Select(v => v)
-                .BindToUi(this, v => v.UserPanel.IsVisible)
+            this.OneWayBind(ViewModel, vm => vm.IsLoggedIn, view => view.UserPanel.IsVisible)
                 .DisposeWith(d);
 
-            this.WhenAnyValue(view => view.ViewModel!.IsLoggedIn)
-                .CombineLatest(this.WhenAnyValue(view => view.ViewModel!.IsPremium))
-                .Select(t => t.First && t.Second)
-                .BindToUi(this, view => view.Premium.IsVisible)
+            this.WhenAnyValue(
+                    x => x.ViewModel!.IsLoggedIn,
+                    x => x.ViewModel!.IsPremium,
+                    (isLoggedIn, isPremium) => isLoggedIn && isPremium
+                )
+                .BindTo(this, view => view.Premium.IsVisible)
                 .DisposeWith(d);
 
-            ViewModel.WhenAnyValue(vm => vm.Avatar)
-                .WhereNotNull()
-                .BindToUi(AvatarImage, v => v.Source)
+            this.OneWayBind(ViewModel, vm => vm.Avatar, view => view.AvatarImage.Source)
                 .DisposeWith(d);
-            
         });
     }
 
diff --git a/src/NexusMods.App.UI/Controls/TopBar/TopBarViewModel.cs b/src/NexusMods.App.UI/Controls/TopBar/TopBarViewModel.cs
index c5b2e38540..bd4229b11d 100644
--- a/src/NexusMods.App.UI/Controls/TopBar/TopBarViewModel.cs
+++ b/src/NexusMods.App.UI/Controls/TopBar/TopBarViewModel.cs
@@ -19,31 +19,38 @@ public TopBarViewModel(ILogger<TopBarViewModel> logger, LoginManager loginManage
     {
         _logger = logger;
         _loginManager = loginManager;
-        LoginCommand = ReactiveCommand.CreateFromTask(Login, _loginManager.IsLoggedIn.OnUI().Select(b => !b));
-        LogoutCommand = ReactiveCommand.CreateFromTask(Logout, _loginManager.IsLoggedIn.OnUI().Select(b => b));
 
         this.WhenActivated(d =>
         {
+            var canLogin = this.WhenAnyValue(x => x.IsLoggedIn).Select(isLoggedIn => !isLoggedIn);
+            LoginCommand = ReactiveCommand.CreateFromTask(Login, canLogin).DisposeWith(d);
+
+            var canLogout = this.WhenAnyValue(x => x.IsLoggedIn);
+            LogoutCommand = ReactiveCommand.CreateFromTask(Logout, canLogout).DisposeWith(d);
+
             _loginManager.IsLoggedIn
+                .OnUI()
                 .SubscribeWithErrorLogging(logger, x => IsLoggedIn = x)
                 .DisposeWith(d);
 
             _loginManager.IsPremium
+                .OnUI()
                 .SubscribeWithErrorLogging(logger, x => IsPremium = x)
                 .DisposeWith(d);
 
             _loginManager.Avatar
                 .WhereNotNull()
+                .OffUi()
                 .SelectMany(LoadImage)
                 .WhereNotNull()
+                .OnUI()
                 .SubscribeWithErrorLogging(logger, x => Avatar = x)
                 .DisposeWith(d);
         });
     }
 
-    private async Task<IImage?> LoadImage(Uri? uri)
+    private async Task<IImage?> LoadImage(Uri uri)
     {
-        if (uri == null) return null;
         try
         {
             var client = new HttpClient();
@@ -79,15 +86,14 @@ private async Task Logout()
 
     [Reactive] public IImage Avatar { get; set; } = Initializers.IImage;
 
-    [Reactive] public ReactiveCommand<Unit, Unit> LoginCommand { get; set; }
+    [Reactive] public ReactiveCommand<Unit, Unit> LoginCommand { get; set; } = Initializers.EnabledReactiveCommand;
 
-    [Reactive] public ReactiveCommand<Unit, Unit> LogoutCommand { get; set; }
+    [Reactive] public ReactiveCommand<Unit, Unit> LogoutCommand { get; set; } = Initializers.DisabledReactiveCommand;
 
-    [Reactive]
-    public ReactiveCommand<Unit, Unit> MinimizeCommand { get; set; } = ReactiveCommand.Create(() => { });
+    [Reactive] public ReactiveCommand<Unit, Unit> MinimizeCommand { get; set; } = Initializers.DisabledReactiveCommand;
 
     [Reactive]
-    public ReactiveCommand<Unit, Unit> ToggleMaximizeCommand { get; set; } = ReactiveCommand.Create(() => { });
+    public ReactiveCommand<Unit, Unit> ToggleMaximizeCommand { get; set; } = Initializers.DisabledReactiveCommand;
 
-    [Reactive] public ReactiveCommand<Unit, Unit> CloseCommand { get; set; } = ReactiveCommand.Create(() => { });
+    [Reactive] public ReactiveCommand<Unit, Unit> CloseCommand { get; set; } = Initializers.DisabledReactiveCommand;
 }
diff --git a/src/NexusMods.App.UI/NexusMods.App.UI.csproj b/src/NexusMods.App.UI/NexusMods.App.UI.csproj
index b95e098cac..9d908e3490 100644
--- a/src/NexusMods.App.UI/NexusMods.App.UI.csproj
+++ b/src/NexusMods.App.UI/NexusMods.App.UI.csproj
@@ -303,6 +303,12 @@
         <Compile Update="Overlays\Updater\UpdaterDesignViewModel.cs">
           <DependentUpon>IUpdaterViewModel.cs</DependentUpon>
         </Compile>
+        <Compile Update="Controls\TopBar\TopBarDesignViewModel.cs">
+          <DependentUpon>ITopBarViewModel.cs</DependentUpon>
+        </Compile>
+        <Compile Update="Controls\TopBar\TopBarViewModel.cs">
+          <DependentUpon>ITopBarViewModel.cs</DependentUpon>
+        </Compile>
     </ItemGroup>
 
     <ItemGroup>

From 459bd6ac6ecccb7a9d48c24dc1d999005aac95dd Mon Sep 17 00:00:00 2001
From: erri120 <erri120@protonmail.com>
Date: Wed, 20 Sep 2023 15:58:44 +0200
Subject: [PATCH 02/15] Add ExpiresAt to JWTTokenEntity

---
 NexusMods.App.sln.DotSettings                 |  1 +
 .../JWTTokenEntity.cs                         | 22 ++++++++++---------
 .../LoginManager.cs                           | 12 +++++++---
 .../DTOs/OAuth/JwtTokenReply.cs               |  2 +-
 4 files changed, 23 insertions(+), 14 deletions(-)

diff --git a/NexusMods.App.sln.DotSettings b/NexusMods.App.sln.DotSettings
index f73699d2f0..f89265b266 100644
--- a/NexusMods.App.sln.DotSettings
+++ b/NexusMods.App.sln.DotSettings
@@ -4,6 +4,7 @@
 	<s:String x:Key="/Default/CodeStyle/Naming/CSharpNaming/Abbreviations/=DI/@EntryIndexedValue">DI</s:String>
 	<s:String x:Key="/Default/CodeStyle/Naming/CSharpNaming/Abbreviations/=EA/@EntryIndexedValue">EA</s:String>
 	<s:String x:Key="/Default/CodeStyle/Naming/CSharpNaming/Abbreviations/=GOG/@EntryIndexedValue">GOG</s:String>
+	<s:String x:Key="/Default/CodeStyle/Naming/CSharpNaming/Abbreviations/=JWT/@EntryIndexedValue">JWT</s:String>
 	<s:String x:Key="/Default/CodeStyle/Naming/CSharpNaming/Abbreviations/=VM/@EntryIndexedValue">VM</s:String>
 	<s:Boolean x:Key="/Default/UserDictionary/Words/=ative/@EntryIndexedValue">True</s:Boolean>
 	<s:Boolean x:Key="/Default/UserDictionary/Words/=Avalonia/@EntryIndexedValue">True</s:Boolean>
diff --git a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/JWTTokenEntity.cs b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/JWTTokenEntity.cs
index 6f1cdfc0d8..8ada66020c 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/JWTTokenEntity.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/JWTTokenEntity.cs
@@ -5,15 +5,9 @@
 namespace NexusMods.Networking.NexusWebApi.NMA;
 
 /// <summary>
-/// entity to store a JWT token
-/// TODO: Right now we follow a "ask for forgiveness, not permission" approach to using the token,
-///   so we use the access token until we get an error indicating it has expired, then refresh the
-///   token and retry. This way we don't need to store when the token expires even though we have
-///   that information. If we wanted to save one request every six hours or if the lifetime of access tokens
-///   changes, we might want to refresh tokens more proactively and then we'd need to save the expire time.
+/// Represents a JWT Token in our DataStore.
 /// </summary>
 [JsonName("JWTTokens")]
-// ReSharper disable once InconsistentNaming
 public record JWTTokenEntity : Entity
 {
     /// <summary>
@@ -22,17 +16,25 @@ public record JWTTokenEntity : Entity
     public static readonly IId StoreId = new IdVariableLength(EntityCategory.AuthData, "NexusMods.Networking.NexusWebApi.JWTTokens"u8.ToArray());
 
     /// <inheritdoc/>
-    public override EntityCategory Category => EntityCategory.AuthData;
+    public override EntityCategory Category => StoreId.Category;
 
     /// <summary>
-    /// the current access token
+    /// Gets the access token.
     /// </summary>
+    /// <remarks>
+    /// This token expires at <see cref="ExpiresAt"/> and needs to be refreshed using <see cref="RefreshToken"/>.
+    /// </remarks>
     public required string AccessToken { get; init; }
 
     /// <summary>
-    /// token needed to generate a new access token when the current one has expired.
+    /// Gets the refresh token.
     /// </summary>
     public required string RefreshToken { get; init; }
+
+    /// <summary>
+    /// Gets the date at which the <see cref="AccessToken"/> expires.
+    /// </summary>
+    public required DateTimeOffset ExpiresAt { get; init; }
 }
 
 
diff --git a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs
index a01dae023f..40e16c1b61 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs
@@ -1,4 +1,5 @@
 using System.Reactive.Linq;
+using JetBrains.Annotations;
 using NexusMods.Common.ProtocolRegistration;
 using NexusMods.DataModel.Abstractions;
 using NexusMods.Networking.NexusWebApi.Types;
@@ -8,6 +9,7 @@ namespace NexusMods.Networking.NexusWebApi.NMA;
 /// <summary>
 /// Component for handling login and logout from the Nexus Mods
 /// </summary>
+[PublicAPI]
 public class LoginManager
 {
     private readonly OAuth _oauth;
@@ -51,10 +53,9 @@ public LoginManager(Client client,
         _client = client;
         _dataStore = dataStore;
         _protocolRegistration = protocolRegistration;
+
         UserInfo = _dataStore.IdChanges
             .Where(id => id.Equals(JWTTokenEntity.StoreId))
-            .Select(_ => true)
-            .StartWith(true)
             .SelectMany(async _ => await Verify());
     }
 
@@ -75,10 +76,15 @@ public async Task LoginAsync(CancellationToken token = default)
         await _protocolRegistration.RegisterSelf("nxm");
 
         var jwtToken = await _oauth.AuthorizeRequest(token);
+        var createdAt = DateTimeOffset.FromUnixTimeSeconds(jwtToken.CreatedAt);
+        var expiresIn = TimeSpan.FromSeconds(jwtToken.ExpiresIn);
+        var expiresAt = createdAt + expiresIn;
+
         _dataStore.Put(JWTTokenEntity.StoreId, new JWTTokenEntity
         {
             RefreshToken = jwtToken.RefreshToken,
-            AccessToken = jwtToken.AccessToken
+            AccessToken = jwtToken.AccessToken,
+            ExpiresAt = expiresAt
         });
     }
 
diff --git a/src/Networking/NexusMods.Networking.NexusWebApi/DTOs/OAuth/JwtTokenReply.cs b/src/Networking/NexusMods.Networking.NexusWebApi/DTOs/OAuth/JwtTokenReply.cs
index c815ca9f04..4c782f1442 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi/DTOs/OAuth/JwtTokenReply.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi/DTOs/OAuth/JwtTokenReply.cs
@@ -36,5 +36,5 @@ public struct JwtTokenReply
     /// unix timestamp (seconds resolution) of when the token was created
     /// </summary>
     [JsonPropertyName("created_at")]
-    public ulong CreatedAt { get; set; }
+    public long CreatedAt { get; set; }
 }

From abbdd506b15d7197a43796248b03ef32ebc61f4b Mon Sep 17 00:00:00 2001
From: erri120 <erri120@protonmail.com>
Date: Thu, 21 Sep 2023 11:24:14 +0200
Subject: [PATCH 03/15] Update OAuth

---
 .../LoginManager.cs                           |  12 +-
 ...exusMods.Networking.NexusWebApi.NMA.csproj |   8 +-
 .../OAuth.cs                                  |  86 +++++++-------
 .../OAuth2MessageFactory.cs                   |   3 +-
 .../IAuthenticatingMessageFactory.cs          |   2 +-
 src/NexusMods.Common/IDGenerator.cs           |   2 +-
 .../StringEncodingExtension.cs                | 108 +++++++++++++++++-
 .../OAuth2MessageFactoryTests.cs              |   6 +-
 .../OAuthTests.cs                             |   7 ++
 9 files changed, 180 insertions(+), 54 deletions(-)

diff --git a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs
index 40e16c1b61..7a06211a6c 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs
@@ -26,7 +26,7 @@ public class LoginManager
     /// <summary>
     /// True if the user is logged in
     /// </summary>
-    public IObservable<bool> IsLoggedIn => UserInfo.Select(info => info != null);
+    public IObservable<bool> IsLoggedIn => UserInfo.Select(info => info is not null);
 
     /// <summary>
     /// True if the user is logged in and is a premium member
@@ -46,7 +46,9 @@ public class LoginManager
     /// <param name="protocolRegistration">Used to register NXM protocol.</param>
     public LoginManager(Client client,
         IAuthenticatingMessageFactory msgFactory,
-        OAuth oauth, IDataStore dataStore, IProtocolRegistration protocolRegistration)
+        OAuth oauth,
+        IDataStore dataStore,
+        IProtocolRegistration protocolRegistration)
     {
         _oauth = oauth;
         _msgFactory = msgFactory;
@@ -56,13 +58,13 @@ public LoginManager(Client client,
 
         UserInfo = _dataStore.IdChanges
             .Where(id => id.Equals(JWTTokenEntity.StoreId))
-            .SelectMany(async _ => await Verify());
+            .SelectMany(async _ => await Verify(CancellationToken.None));
     }
 
-    private async Task<UserInfo?> Verify()
+    private async Task<UserInfo?> Verify(CancellationToken cancellationToken)
     {
         if (await _msgFactory.IsAuthenticated())
-            return await _msgFactory.Verify(_client, CancellationToken.None);
+            return await _msgFactory.Verify(_client, cancellationToken);
         return null;
     }
 
diff --git a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/NexusMods.Networking.NexusWebApi.NMA.csproj b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/NexusMods.Networking.NexusWebApi.NMA.csproj
index b025a306f7..f4f9b74731 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/NexusMods.Networking.NexusWebApi.NMA.csproj
+++ b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/NexusMods.Networking.NexusWebApi.NMA.csproj
@@ -9,8 +9,12 @@
     </ItemGroup>
 
     <ItemGroup>
-      <ProjectReference Include="..\..\NexusMods.DataModel\NexusMods.DataModel.csproj" />
-      <ProjectReference Include="..\NexusMods.Networking.NexusWebApi\NexusMods.Networking.NexusWebApi.csproj" />
+        <ProjectReference Include="..\..\NexusMods.DataModel\NexusMods.DataModel.csproj" />
+        <ProjectReference Include="..\NexusMods.Networking.NexusWebApi\NexusMods.Networking.NexusWebApi.csproj" />
+    </ItemGroup>
+
+    <ItemGroup>
+        <InternalsVisibleTo Include="NexusMods.Networking.NexusWebApi.Tests" />
     </ItemGroup>
 
 </Project>
diff --git a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth.cs b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth.cs
index a2fcbc57d0..2d29626c16 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth.cs
@@ -1,6 +1,7 @@
 using System.Reactive.Linq;
 using System.Security.Cryptography;
 using System.Text;
+using System.Text.Encodings.Web;
 using System.Text.Json;
 using Microsoft.Extensions.Logging;
 using NexusMods.Common;
@@ -20,8 +21,8 @@ namespace NexusMods.Networking.NexusWebApi.NMA;
 public class OAuth
 {
     private const string OAuthUrl = "https://users.nexusmods.com/oauth";
-    // the redirect url has to explicitly be permitted by the server so we can't change
-    // this without consulting the backend team
+    // NOTE(erri120): The backend has a list of valid redirect URLs and client IDs.
+    // We can't change these on our own.
     private const string OAuthRedirectUrl = "nxm://oauth/callback";
     private const string OAuthClientId = "vortex";
 
@@ -35,8 +36,11 @@ public class OAuth
     /// <summary>
     /// constructor
     /// </summary>
-    public OAuth(ILogger<OAuth> logger, HttpClient http, IIDGenerator idGen,
-        IOSInterop os, IMessageConsumer<NXMUrlMessage> nxmUrlMessages,
+    public OAuth(ILogger<OAuth> logger,
+        HttpClient http,
+        IIDGenerator idGen,
+        IOSInterop os,
+        IMessageConsumer<NXMUrlMessage> nxmUrlMessages,
         IInterprocessJobManager jobManager)
     {
         _logger = logger;
@@ -48,39 +52,38 @@ public OAuth(ILogger<OAuth> logger, HttpClient http, IIDGenerator idGen,
     }
 
     /// <summary>
-    /// make an authorization request
+    /// Make an authorization request
     /// </summary>
-    /// <param name="cancel"></param>
+    /// <param name="cancellationToken"></param>
     /// <returns>task with the jwt token once we receive one</returns>
-    public async Task<JwtTokenReply> AuthorizeRequest(CancellationToken cancel)
+    public async Task<JwtTokenReply> AuthorizeRequest(CancellationToken cancellationToken)
     {
-        _logger.LogInformation("Starting NexusMods OAuth2 authorization request");
-        var state = _idGen.UUIDv4();
-
         // see https://www.rfc-editor.org/rfc/rfc7636#section-4.1
-        var verifier = _idGen.UUIDv4().Replace("-", "").ToBase64();
+        var codeVerifier = _idGen.UUIDv4().ToBase64();
+
         // see https://www.rfc-editor.org/rfc/rfc7636#section-4.2
-        using var sha256 = SHA256.Create();
-        var challenge = sha256.ComputeHash(Encoding.UTF8.GetBytes(verifier)).ToBase64();
+        var codeChallengeBytes = SHA256.HashData(Encoding.UTF8.GetBytes(codeVerifier));
+        var codeChallenge = StringEncodingExtension.Base64UrlEncode(codeChallengeBytes);
+
+        var state = _idGen.UUIDv4();
 
         // Start listening first, otherwise we might miss the message
         var codeTask = _nxmUrlMessages.Messages
-            .Where(url => url.Value.UrlType == NXMUrlType.OAuth)
-            .Where(url => url.Value.OAuth.State == state)
-            .Select(url => url.Value.OAuth.Code!)
+            .Where(url => url.Value.UrlType == NXMUrlType.OAuth && url.Value.OAuth.State == state)
+            .Select(url => url.Value.OAuth.Code)
+            .Where(code => code is not null)
+            .Select(code => code!)
             .ToAsyncEnumerable()
-            .FirstAsync(cancel);
+            .FirstAsync(cancellationToken);
 
-        _logger.LogInformation("Opening browser for NexusMods OAuth2 authorization request");
-        var url = GenerateAuthorizeUrl(challenge, state);
+        var url = GenerateAuthorizeUrl(codeChallenge, state);
         using var job = CreateJob(url);
+
         // see https://www.rfc-editor.org/rfc/rfc7636#section-4.3
-        await _os.OpenUrl(url, cancel);
+        await _os.OpenUrl(url, cancellationToken);
         var code = await codeTask;
 
-        _logger.LogInformation("Received OAuth2 authorization code, requesting token");
-        return await AuthorizeToken(verifier, code, cancel);
-
+        return await AuthorizeToken(codeVerifier, code, cancellationToken);
     }
 
     private IInterprocessJob CreateJob(Uri url)
@@ -127,16 +130,9 @@ private async Task<JwtTokenReply> AuthorizeToken(string verifier, string code, C
         return JsonSerializer.Deserialize<JwtTokenReply>(responseString);
     }
 
-    private string SanitizeBase64(string input)
-    {
-        return input
-            .Replace("+", "-")
-            .Replace("/", "_")
-            .TrimEnd('=');
-    }
-
-    private Uri GenerateAuthorizeUrl(string challenge, string state)
+    internal static Uri GenerateAuthorizeUrl(string challenge, string state)
     {
+        // TODO: switch to Microsoft.AspNetCore.WebUtilities when .NET 8 is available
         var request = new Dictionary<string, string>
         {
             { "response_type", "code" },
@@ -144,20 +140,32 @@ private Uri GenerateAuthorizeUrl(string challenge, string state)
             { "code_challenge_method", "S256" },
             { "client_id", OAuthClientId },
             { "redirect_uri",  OAuthRedirectUrl },
-            { "code_challenge", SanitizeBase64(challenge) },
+            { "code_challenge", challenge },
             { "state", state },
         };
-        return new Uri($"{OAuthUrl}/authorize?{StringifyRequest(request)}");
+
+        return new Uri($"{OAuthUrl}/authorize{CreateQueryString(request)}");
     }
 
-    private string StringifyRequest(IDictionary<string, string> input)
+    private static string CreateQueryString(Dictionary<string, string> parameters)
     {
-        IList<string> properties = new List<string>();
-        foreach (var kv in input)
+        var builder = new StringBuilder();
+        var first = true;
+        foreach (var pair in parameters)
         {
-            properties.Add($"{kv.Key}={Uri.EscapeDataString(kv.Value)}");
+            var (key, value) = pair;
+
+            builder.Append(first ? '?' : '&');
+            builder.Append(UrlEncoder.Default.Encode(key));
+            builder.Append('=');
+            if (!string.IsNullOrEmpty(value))
+            {
+                builder.Append(UrlEncoder.Default.Encode(value));
+            }
+
+            first = false;
         }
 
-        return string.Join("&", properties);
+        return builder.ToString();
     }
 }
diff --git a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth2MessageFactory.cs b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth2MessageFactory.cs
index 9fafb99adb..d831861f29 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth2MessageFactory.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth2MessageFactory.cs
@@ -100,7 +100,8 @@ public async ValueTask<bool> IsAuthenticated()
             _store.Put(JWTTokenEntity.StoreId, new JWTTokenEntity
             {
                 RefreshToken = newToken.RefreshToken,
-                AccessToken = newToken.AccessToken
+                AccessToken = newToken.AccessToken,
+                ExpiresAt = DateTimeOffset.UtcNow
             });
 
             var msg = new HttpRequestMessage(original.Method, original.RequestUri);
diff --git a/src/Networking/NexusMods.Networking.NexusWebApi/IAuthenticatingMessageFactory.cs b/src/Networking/NexusMods.Networking.NexusWebApi/IAuthenticatingMessageFactory.cs
index a50f9fe398..c2a21a7a62 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi/IAuthenticatingMessageFactory.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi/IAuthenticatingMessageFactory.cs
@@ -13,7 +13,7 @@ public interface IAuthenticatingMessageFactory : IHttpMessageFactory
     /// verify that the authentication information we have for a user is valid
     /// </summary>
     /// <param name="client">api client to use for making api requests</param>
-    /// <param name="token">cancelation token</param>
+    /// <param name="token">cancellation token</param>
     /// <returns>information about the user, null if not valid</returns>
     public ValueTask<UserInfo?> Verify(Client client, CancellationToken token);
 }
diff --git a/src/NexusMods.Common/IDGenerator.cs b/src/NexusMods.Common/IDGenerator.cs
index b8a638d806..4de9826067 100644
--- a/src/NexusMods.Common/IDGenerator.cs
+++ b/src/NexusMods.Common/IDGenerator.cs
@@ -9,6 +9,6 @@ public class IDGenerator : IIDGenerator
     /// <inheritdoc/>
     public string UUIDv4()
     {
-        return Guid.NewGuid().ToString();
+        return Guid.NewGuid().ToString("N");
     }
 }
diff --git a/src/NexusMods.Common/StringEncodingExtension.cs b/src/NexusMods.Common/StringEncodingExtension.cs
index 4cb3623ea6..47c11d4c21 100644
--- a/src/NexusMods.Common/StringEncodingExtension.cs
+++ b/src/NexusMods.Common/StringEncodingExtension.cs
@@ -1,17 +1,20 @@
-using System.Diagnostics.Contracts;
+using System.Buffers;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
 using System.Text;
+using JetBrains.Annotations;
 
 namespace NexusMods.Common;
 
 /// <summary>
 /// String encoding routines
 /// </summary>
+[PublicAPI]
 public static class StringEncodingExtension
 {
     /// <summary>
     /// Convert string to base 64 encoding
     /// </summary>
-    [Pure]
     public static string ToBase64(this string input)
     {
         return ToBase64(Encoding.UTF8.GetBytes(input));
@@ -20,9 +23,108 @@ public static string ToBase64(this string input)
     /// <summary>
     /// Convert byte array to base 64 encoding
     /// </summary>
-    [Pure]
     public static string ToBase64(this byte[] input)
     {
         return Convert.ToBase64String(input);
     }
+
+    /// <summary>
+    /// Encodes <paramref name="input"/> using base64url encoding.
+    /// </summary>
+    /// <param name="input">The binary input to encode.</param>
+    /// <returns>The base64url-encoded form of <paramref name="input"/>.</returns>
+    [SkipLocalsInit]
+    public static string Base64UrlEncode(ReadOnlySpan<byte> input)
+    {
+        // TODO: use Microsoft.AspNetCore.WebUtilities when .NET 8 is available
+        // Source: https://github.com/dotnet/aspnetcore/blob/main/src/Shared/WebEncoders/WebEncoders.cs
+        // The MIT License (MIT)
+        //
+        // Copyright (c) .NET Foundation and Contributors
+        //
+        // All rights reserved.
+        //
+        // Permission is hereby granted, free of charge, to any person obtaining a copy
+        // of this software and associated documentation files (the "Software"), to deal
+        // in the Software without restriction, including without limitation the rights
+        // to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        // copies of the Software, and to permit persons to whom the Software is
+        // furnished to do so, subject to the following conditions:
+        //
+        // The above copyright notice and this permission notice shall be included in all
+        // copies or substantial portions of the Software.
+        //
+        // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        // FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        // AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        // LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        // SOFTWARE.
+
+        const int stackAllocThreshold = 128;
+
+        if (input.IsEmpty)
+        {
+            return string.Empty;
+        }
+
+        var bufferSize = GetArraySizeRequiredToEncode(input.Length);
+
+        char[]? bufferToReturnToPool = null;
+        var buffer = bufferSize <= stackAllocThreshold
+            ? stackalloc char[stackAllocThreshold]
+            : bufferToReturnToPool = ArrayPool<char>.Shared.Rent(bufferSize);
+
+        var numBase64Chars = Base64UrlEncode(input, buffer);
+        var base64Url = new string(buffer[..numBase64Chars]);
+
+        if (bufferToReturnToPool != null)
+        {
+            ArrayPool<char>.Shared.Return(bufferToReturnToPool);
+        }
+
+        return base64Url;
+    }
+
+
+    private static int Base64UrlEncode(ReadOnlySpan<byte> input, Span<char> output)
+    {
+        Debug.Assert(output.Length >= GetArraySizeRequiredToEncode(input.Length));
+
+        if (input.IsEmpty)
+        {
+            return 0;
+        }
+
+        // Use base64url encoding with no padding characters. See RFC 4648, Sec. 5.
+
+        Convert.TryToBase64Chars(input, output, out int charsWritten);
+
+        // Fix up '+' -> '-' and '/' -> '_'. Drop padding characters.
+        for (var i = 0; i < charsWritten; i++)
+        {
+            var ch = output[i];
+            switch (ch)
+            {
+                case '+':
+                    output[i] = '-';
+                    break;
+                case '/':
+                    output[i] = '_';
+                    break;
+                case '=':
+                    // We've reached a padding character; truncate the remainder.
+                    return i;
+            }
+        }
+
+        return charsWritten;
+    }
+
+    private static int GetArraySizeRequiredToEncode(int count)
+    {
+        var numWholeOrPartialInputBlocks = checked(count + 2) / 3;
+        return checked(numWholeOrPartialInputBlocks * 4);
+    }
 }
diff --git a/tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuth2MessageFactoryTests.cs b/tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuth2MessageFactoryTests.cs
index 580eadcf51..59423d2491 100644
--- a/tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuth2MessageFactoryTests.cs
+++ b/tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuth2MessageFactoryTests.cs
@@ -45,7 +45,8 @@ public async void AddsHeaderToRequest()
             .Returns(_ => new JWTTokenEntity
             {
                 AccessToken = "access_token",
-                RefreshToken = "refresh_token"
+                RefreshToken = "refresh_token",
+                ExpiresAt = DateTimeOffset.UtcNow
             });
 
         var request = await _factory.Create(HttpMethod.Get, new Uri("test://foobar"));
@@ -79,7 +80,8 @@ public async void RequestsRefreshOnTokenExpired()
             .Returns(_ => new JWTTokenEntity
             {
                 AccessToken = "access_token",
-                RefreshToken = "refresh_token"
+                RefreshToken = "refresh_token",
+                ExpiresAt = DateTimeOffset.UtcNow
             });
 
         _handler
diff --git a/tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuthTests.cs b/tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuthTests.cs
index fee91bdf46..81ad83c024 100644
--- a/tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuthTests.cs
+++ b/tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuthTests.cs
@@ -181,4 +181,11 @@ public async void AuthorizationCanBeCanceled()
 
     // ReSharper disable once InconsistentNaming
     private readonly Uri ExpectedAuthURL = new("https://users.nexusmods.com/oauth/authorize?response_type=code&scope=public&code_challenge_method=S256&client_id=vortex&redirect_uri=nxm%3A%2F%2Foauth%2Fcallback&code_challenge=-pSOp5xdZffKD0gc1lb5JALgN_ZtE9X573ib3yS8BT4&state=00000000-0000-0000-0000-000000000000");
+
+    [Fact]
+    public void Test_GenerateAuthorizeUrl()
+    {
+        var res = OAuth.GenerateAuthorizeUrl("-pSOp5xdZffKD0gc1lb5JALgN_ZtE9X573ib3yS8BT4", "00000000-0000-0000-0000-000000000000");
+        res.Should().Be(ExpectedAuthURL);
+    }
 }

From 0a7bd829259695e650cc1d1d4f42074fe6e29112 Mon Sep 17 00:00:00 2001
From: erri120 <erri120@protonmail.com>
Date: Thu, 21 Sep 2023 14:26:47 +0200
Subject: [PATCH 04/15] Downgrade System.IdentityModel.Tokens.Jwt to
 7.0.0-preview3

---
 Directory.Packages.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 5b5e25d0cf..de456ced6f 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -29,7 +29,7 @@
         <!-- System -->
         <PackageVersion Include="System.CommandLine" Version="2.0.0-beta4.22272.1" />
         <PackageVersion Include="System.CommandLine.NamingConventionBinder" Version="2.0.0-beta4.22272.1" />
-        <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="7.0.0" />
+        <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="7.0.0-preview3" />
         <PackageVersion Include="System.IO.Hashing" Version="8.0.0-rc.1.23419.4" />
         <PackageVersion Include="System.Linq.Async" Version="6.0.1" />
         <PackageVersion Include="System.Reactive" Version="6.0.0" />

From 9f9a48d28cea036a81ebb1bb4c44a3b6bf581f35 Mon Sep 17 00:00:00 2001
From: erri120 <erri120@protonmail.com>
Date: Thu, 21 Sep 2023 14:58:03 +0200
Subject: [PATCH 05/15] Rework OAuth

---
 .../JWTTokenEntity.cs                         |   8 ++
 .../LoginManager.cs                           |   4 +
 .../OAuth2MessageFactory.cs                   | 134 ++++++++----------
 .../IAuthenticatingMessageFactory.cs          |   2 +-
 .../IHttpMessageFactory.cs                    |   2 +-
 5 files changed, 72 insertions(+), 78 deletions(-)

diff --git a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/JWTTokenEntity.cs b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/JWTTokenEntity.cs
index 8ada66020c..2b68575273 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/JWTTokenEntity.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/JWTTokenEntity.cs
@@ -35,6 +35,14 @@ public record JWTTokenEntity : Entity
     /// Gets the date at which the <see cref="AccessToken"/> expires.
     /// </summary>
     public required DateTimeOffset ExpiresAt { get; init; }
+
+    /// <summary>
+    /// Checks whether the token has expired.
+    /// </summary>
+    public bool HasExpired()
+    {
+        return ExpiresAt - TimeSpan.FromMinutes(5) <= DateTimeOffset.UtcNow;
+    }
 }
 
 
diff --git a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs
index 7a06211a6c..7c89176225 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs
@@ -57,6 +57,10 @@ public LoginManager(Client client,
         _protocolRegistration = protocolRegistration;
 
         UserInfo = _dataStore.IdChanges
+            // NOTE(err120): Since id's don't change on startup, we can insert
+            // a fake change at the start of the observable chain. This will only
+            // run once at startup and notify the subscribers.
+            .Merge(Observable.Return(JWTTokenEntity.StoreId))
             .Where(id => id.Equals(JWTTokenEntity.StoreId))
             .SelectMany(async _ => await Verify(CancellationToken.None));
     }
diff --git a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth2MessageFactory.cs b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth2MessageFactory.cs
index d831861f29..2861d3936a 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth2MessageFactory.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth2MessageFactory.cs
@@ -1,9 +1,8 @@
 using System.IdentityModel.Tokens.Jwt;
 using System.Text.Json;
+using Microsoft.Extensions.Logging;
 using NexusMods.DataModel.Abstractions;
-using NexusMods.DataModel.Games;
 using NexusMods.Networking.NexusWebApi.DTOs.OAuth;
-using NexusMods.Networking.NexusWebApi.NMA.Extensions;
 using NexusMods.Networking.NexusWebApi.Types;
 
 namespace NexusMods.Networking.NexusWebApi.NMA;
@@ -13,117 +12,100 @@ namespace NexusMods.Networking.NexusWebApi.NMA;
 /// </summary>
 public class OAuth2MessageFactory : IAuthenticatingMessageFactory
 {
+    private readonly ILogger<OAuth2MessageFactory> _logger;
     private readonly IDataStore _store;
     private readonly OAuth _auth;
+    private readonly JwtSecurityTokenHandler _tokenHandler = new();
 
     /// <summary>
-    /// constructor
+    /// Constructor.
     /// </summary>
-    public OAuth2MessageFactory(IDataStore store, OAuth auth)
+    public OAuth2MessageFactory(
+        IDataStore store,
+        OAuth auth,
+        ILogger<OAuth2MessageFactory> logger)
     {
         _store = store;
         _auth = auth;
+        _logger = logger;
     }
 
-    /// <inheritdoc/>
-    public ValueTask<HttpRequestMessage> Create(HttpMethod method, Uri uri)
-    {/*
-        if (uri.LocalPath == "/v1/users/validate.json")
+    // TODO: listen to DB changes when the user wants to logout
+    private JWTTokenEntity? _cachedTokenEntity;
+    private UserInfo? _cachedUserInfo;
+
+    private async ValueTask<string?> GetOrRefreshToken(CancellationToken cancellationToken)
+    {
+        _cachedTokenEntity ??= _store.Get<JWTTokenEntity>(JWTTokenEntity.StoreId);
+        if (_cachedTokenEntity is null) return null;
+        if (!_cachedTokenEntity.HasExpired()) return _cachedTokenEntity.AccessToken;
+
+        _logger.LogDebug("Refreshing expired OAuth token");
+
+        var newToken = await _auth.RefreshToken(_cachedTokenEntity.RefreshToken, cancellationToken);
+        _cachedTokenEntity = new JWTTokenEntity
         {
-            // we shouldn't have tried to call this
-            throw new Exception("the validate endpoint does not work when using oauth");
-        }*/
+            RefreshToken = newToken.RefreshToken,
+            AccessToken = newToken.AccessToken,
+            ExpiresAt = DateTimeOffset.UtcNow
+        };
+
+        _cachedUserInfo = null;
+        _store.Put(JWTTokenEntity.StoreId, _cachedTokenEntity);
+        return _cachedTokenEntity.AccessToken;
+    }
+
+    /// <inheritdoc/>
+    public async ValueTask<HttpRequestMessage> Create(HttpMethod method, Uri uri)
+    {
+        var token = await GetOrRefreshToken(CancellationToken.None);
+        if (token is null) throw new Exception("Unauthorized!");
+
         var msg = new HttpRequestMessage(method, uri);
-        msg.Headers.Add("Authorization", $"Bearer {Token}");
-        return ValueTask.FromResult(msg);
+        msg.Headers.Add("Authorization", $"Bearer {token}");
+
+        return msg;
     }
 
     /// <inheritdoc/>
     public async ValueTask<bool> IsAuthenticated()
     {
-        var token = _store.Get<JWTTokenEntity>(JWTTokenEntity.StoreId);
-        return await ValueTask.FromResult(token != null);
+        var token = await GetOrRefreshToken(CancellationToken.None);
+        return token is not null;
     }
 
     /// <inheritdoc/>
     public async ValueTask<UserInfo?> Verify(Client client, CancellationToken cancel)
     {
-        // TODO: there is no dedicated api endpoint we can call just to check the oauth token.
-        //   Once graphql is implemented I recommend to fetch user info about the user the token belongs to
-        //   so we can report more details about them.
-        //   For now, any query will fail if the token is valid
-        await client.ModFilesAsync(GameDomain.From("site"), ModId.From(1), cancel);
-
-        var tokens = _store.Get<JWTTokenEntity>(JWTTokenEntity.StoreId);
-        if (tokens == null)
-        {
-            return null;
-        }
+        if (_cachedUserInfo is not null) return _cachedUserInfo;
+        _logger.LogDebug("Renewing cached user info");
 
-        var handler = new JwtSecurityTokenHandler();
-        var tokenInfo = handler.ReadJwtToken(tokens.AccessToken);
+        var token = await GetOrRefreshToken(cancellationToken: cancel);
+
+        var tokenInfo = _tokenHandler.ReadJwtToken(token);
         var userClaim = tokenInfo?.Claims.FirstOrDefault(iter => iter.Type == "user");
-        var userInfo = userClaim != null ? JsonSerializer.Deserialize<TokenUserInfo>(userClaim.Value) : null;
+        var userInfo = userClaim is not null ? JsonSerializer.Deserialize<TokenUserInfo>(userClaim.Value) : null;
 
-        if (userInfo == null)
+        if (userInfo is null)
         {
-            // we have a token but it's invalid, should we report this or assume it's the server's fault?
+            _logger.LogError("Unable to extract user info from token!");
             return null;
         }
 
-        return new UserInfo
+        _cachedUserInfo = new UserInfo
         {
             Name = userInfo.Name,
             IsPremium = userInfo.MembershipRoles.Contains(MembershipRole.Premium),
             IsSupporter = userInfo.MembershipRoles.Contains(MembershipRole.Supporter),
-            Avatar = new Uri($"https://forums.nexusmods.com/uploads/profile/photo-thumb-{userInfo.Id}.png")
+            // TODO: fetch avatar
         };
-    }
 
-    /// <summary>
-    /// will handle "Token has expired" errors by refreshing the JWT token and then triggering a retry of the same
-    /// query
-    /// </summary>
-    public async ValueTask<HttpRequestMessage?> HandleError(HttpRequestMessage original, HttpRequestException ex, CancellationToken cancel)
-    {
-        if ((ex.StatusCode == System.Net.HttpStatusCode.Unauthorized) && (ex.Message == "Token has expired"))
-        {
-            var tokens = _store.Get<JWTTokenEntity>(JWTTokenEntity.StoreId);
-            if (tokens == null)
-            {
-                // this shouldn't be possible, why would we get "Token has expired" if we don't _have_ a token?
-                // unless there is a race condition whereby another thread has deleted the token after the request was made
-                return null;
-            }
-            var newToken = await _auth.RefreshToken(tokens.RefreshToken, cancel);
-
-            _store.Put(JWTTokenEntity.StoreId, new JWTTokenEntity
-            {
-                RefreshToken = newToken.RefreshToken,
-                AccessToken = newToken.AccessToken,
-                ExpiresAt = DateTimeOffset.UtcNow
-            });
-
-            var msg = new HttpRequestMessage(original.Method, original.RequestUri);
-            msg.Headers.Add("Authorization", $"Bearer {newToken.AccessToken}");
-            return msg;
-        }
-
-        return null;
+        return _cachedUserInfo;
     }
 
-    private string Token
+    /// <inheritdoc/>
+    public ValueTask<HttpRequestMessage?> HandleError(HttpRequestMessage original, HttpRequestException ex, CancellationToken cancel)
     {
-        get
-        {
-            var token = _store.Get<JWTTokenEntity>(JWTTokenEntity.StoreId);
-            var value = token?.AccessToken ?? null;
-            if (string.IsNullOrWhiteSpace(value))
-            {
-                throw new Exception("No OAuth2 token");
-            }
-
-            return value;
-        }
+        return ValueTask.FromResult<HttpRequestMessage?>(null);
     }
 }
diff --git a/src/Networking/NexusMods.Networking.NexusWebApi/IAuthenticatingMessageFactory.cs b/src/Networking/NexusMods.Networking.NexusWebApi/IAuthenticatingMessageFactory.cs
index c2a21a7a62..6b5808018f 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi/IAuthenticatingMessageFactory.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi/IAuthenticatingMessageFactory.cs
@@ -10,7 +10,7 @@ namespace NexusMods.Networking.NexusWebApi;
 public interface IAuthenticatingMessageFactory : IHttpMessageFactory
 {
     /// <summary>
-    /// verify that the authentication information we have for a user is valid
+    /// Verify that the authentication information we have for a user is valid
     /// </summary>
     /// <param name="client">api client to use for making api requests</param>
     /// <param name="token">cancellation token</param>
diff --git a/src/Networking/NexusMods.Networking.NexusWebApi/IHttpMessageFactory.cs b/src/Networking/NexusMods.Networking.NexusWebApi/IHttpMessageFactory.cs
index bc83d5d9c6..d8e8d11c81 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi/IHttpMessageFactory.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi/IHttpMessageFactory.cs
@@ -22,7 +22,7 @@ public interface IHttpMessageFactory
     /// </summary>
     /// <param name="original">the original request that led to this error</param>
     /// <param name="ex">the exception to handle (or not)</param>
-    /// <param name="cancel">cancelation token</param>
+    /// <param name="cancel">cancellation token</param>
     /// <returns>a new/updated request to be sent or null if the exception should be thrown</returns>
     public ValueTask<HttpRequestMessage?> HandleError(HttpRequestMessage original, HttpRequestException ex, CancellationToken cancel);
 }

From 9394441a5c049938b2cc076477a8612d9ae6e74a Mon Sep 17 00:00:00 2001
From: erri120 <erri120@protonmail.com>
Date: Mon, 25 Sep 2023 14:10:54 +0200
Subject: [PATCH 06/15] Escape arguments when opening URLs on Linux

---
 src/NexusMods.Common/OSInterop/OSInteropLinux.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/NexusMods.Common/OSInterop/OSInteropLinux.cs b/src/NexusMods.Common/OSInterop/OSInteropLinux.cs
index 29f6239434..9bfb7966e6 100644
--- a/src/NexusMods.Common/OSInterop/OSInteropLinux.cs
+++ b/src/NexusMods.Common/OSInterop/OSInteropLinux.cs
@@ -21,7 +21,7 @@ public OSInteropLinux(IProcessFactory processFactory)
     /// <inheritdoc/>
     public async Task OpenUrl(Uri url, CancellationToken cancellationToken = default)
     {
-        var command = Cli.Wrap("xdg-open").WithArguments(url.ToString());
+        var command = Cli.Wrap("xdg-open").WithArguments(new[] { url.ToString() }, escape: true);
         await _processFactory.ExecuteAsync(command, cancellationToken);
     }
 }

From fdec6587d3a34c27dbe944decc2354f3506b8173 Mon Sep 17 00:00:00 2001
From: erri120 <erri120@protonmail.com>
Date: Mon, 25 Sep 2023 14:11:33 +0200
Subject: [PATCH 07/15] Add CachedObject

---
 src/NexusMods.Common/CachedObject.cs | 58 ++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 src/NexusMods.Common/CachedObject.cs

diff --git a/src/NexusMods.Common/CachedObject.cs b/src/NexusMods.Common/CachedObject.cs
new file mode 100644
index 0000000000..51acfedcb0
--- /dev/null
+++ b/src/NexusMods.Common/CachedObject.cs
@@ -0,0 +1,58 @@
+using System.Diagnostics;
+using JetBrains.Annotations;
+
+namespace NexusMods.Common;
+
+/// <summary>
+/// Simple reference value object cache with a lifetime.
+/// </summary>
+[PublicAPI]
+public struct CachedObject<T> where T : class
+{
+    private T? _object;
+    private DateTimeOffset _expiredAt;
+    private readonly TimeSpan _lifetime;
+
+    /// <summary>
+    /// Constructor
+    /// </summary>
+    public CachedObject(TimeSpan lifetime)
+    {
+        _expiredAt = DateTimeOffset.MinValue;
+        _lifetime = lifetime;
+    }
+
+    /// <summary>
+    /// Constructor.
+    /// </summary>
+    public CachedObject(T? initialValue, TimeSpan lifetime)
+    {
+        _lifetime = lifetime;
+        Store(initialValue);
+    }
+
+    /// <summary>
+    /// Returns <c>true</c> if the cache has expired.
+    /// </summary>
+    public bool HasExpired() => _expiredAt - TimeSpan.FromSeconds(1) < DateTimeOffset.UtcNow;
+
+    /// <summary>
+    /// Returns the stored object or <c>null</c> if the cache has expired.
+    /// </summary>
+    public T? Get()
+    {
+        if (_object is null) return null;
+        return HasExpired() ? null : _object;
+    }
+
+    /// <summary>
+    /// Stores an object in the cache and updates the expiration date.
+    /// </summary>
+    public void Store(T? obj)
+    {
+        Debug.Assert(obj is not IDisposable and not IAsyncDisposable, "Disposable objects can't be stored in the cache.");
+
+        _object = obj;
+        _expiredAt = DateTimeOffset.UtcNow + _lifetime;
+    }
+}

From 15bbc551a8397bcdcd0b9ef30e12c9565bc51de7 Mon Sep 17 00:00:00 2001
From: erri120 <erri120@protonmail.com>
Date: Mon, 25 Sep 2023 14:11:58 +0200
Subject: [PATCH 08/15] Add OAuthUserInfo DTO

---
 .../DTOs/OAuth/OAuthUserInfo.cs               | 45 +++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 src/Networking/NexusMods.Networking.NexusWebApi/DTOs/OAuth/OAuthUserInfo.cs

diff --git a/src/Networking/NexusMods.Networking.NexusWebApi/DTOs/OAuth/OAuthUserInfo.cs b/src/Networking/NexusMods.Networking.NexusWebApi/DTOs/OAuth/OAuthUserInfo.cs
new file mode 100644
index 0000000000..9bc87691bc
--- /dev/null
+++ b/src/Networking/NexusMods.Networking.NexusWebApi/DTOs/OAuth/OAuthUserInfo.cs
@@ -0,0 +1,45 @@
+using System.Text.Json.Serialization;
+using System.Text.Json.Serialization.Metadata;
+using JetBrains.Annotations;
+using NexusMods.Networking.NexusWebApi.DTOs.Interfaces;
+
+namespace NexusMods.Networking.NexusWebApi.DTOs.OAuth;
+
+/// <summary>
+/// Data returned by the OAuth userinfo endpoint.
+/// </summary>
+[PublicAPI]
+public record OAuthUserInfo : IJsonSerializable<OAuthUserInfo>
+{
+    /// <summary>
+    /// Gets the User ID.
+    /// </summary>
+    [JsonPropertyName("sub")]
+    public ulong Sub { get; init; }
+
+    /// <summary>
+    /// Gets the User Name.
+    /// </summary>
+    [JsonPropertyName("name")]
+    public string Name { get; init; } = string.Empty;
+
+    /// <summary>
+    /// Gets the avatar url.
+    /// </summary>
+    [JsonPropertyName("avatar")]
+    public Uri? Avatar { get; init; }
+
+    /// <summary>
+    /// Gets an array of membership roles.
+    /// </summary>
+    [JsonPropertyName("membership_roles")]
+    public MembershipRole[] MembershipRoles { get; init; } = Array.Empty<MembershipRole>();
+
+    /// <inheritdoc />
+    public static JsonTypeInfo<OAuthUserInfo> GetTypeInfo() => OAuthUserInfoContext.Default.OAuthUserInfo;
+}
+
+/// <summary/>
+[JsonSourceGenerationOptions(GenerationMode = JsonSourceGenerationMode.Metadata)]
+[JsonSerializable(typeof(OAuthUserInfo))]
+public partial class OAuthUserInfoContext : JsonSerializerContext { }

From 15dd449a5a2b9369053f91c898953dfabb140d08 Mon Sep 17 00:00:00 2001
From: erri120 <erri120@protonmail.com>
Date: Mon, 25 Sep 2023 14:12:24 +0200
Subject: [PATCH 09/15] Add OAuthUserInfo endpoint

---
 .../NexusMods.Networking.NexusWebApi/Client.cs       | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/Networking/NexusMods.Networking.NexusWebApi/Client.cs b/src/Networking/NexusMods.Networking.NexusWebApi/Client.cs
index 35fe1e7cd5..11a6f09fe2 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi/Client.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi/Client.cs
@@ -3,6 +3,7 @@
 using Microsoft.Extensions.Logging;
 using NexusMods.Networking.NexusWebApi.DTOs;
 using NexusMods.Networking.NexusWebApi.DTOs.Interfaces;
+using NexusMods.Networking.NexusWebApi.DTOs.OAuth;
 using NexusMods.Networking.NexusWebApi.Types;
 
 namespace NexusMods.Networking.NexusWebApi;
@@ -42,6 +43,17 @@ public async Task<Response<ValidateInfo>> Validate(CancellationToken token = def
         return await SendAsync<ValidateInfo>(msg, token);
     }
 
+    private static readonly Uri OAuthUserInfoUri = new("https://users.nexusmods.com/oauth/userinfo");
+
+    /// <summary>
+    /// Retrieves information about the current user when logged in via OAuth.
+    /// </summary>
+    public async Task<Response<OAuthUserInfo>> GetOAuthUserInfo(CancellationToken cancellationToken = default)
+    {
+        var msg = await _factory.Create(HttpMethod.Get, OAuthUserInfoUri);
+        return await SendAsync<OAuthUserInfo>(msg, cancellationToken);
+    }
+
     /// <summary>
     /// Returns a list of games supported by Nexus.
     /// </summary>

From 70d7ba6a4ce9cbd4eebed99dd26c113a98f6f39b Mon Sep 17 00:00:00 2001
From: erri120 <erri120@protonmail.com>
Date: Mon, 25 Sep 2023 15:23:22 +0200
Subject: [PATCH 10/15] Use new client

---
 .../NexusMods.Networking.NexusWebApi.NMA/OAuth.cs           | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth.cs b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth.cs
index 2d29626c16..e0e781ec91 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth.cs
@@ -1,8 +1,10 @@
+using System.Net;
 using System.Reactive.Linq;
 using System.Security.Cryptography;
 using System.Text;
 using System.Text.Encodings.Web;
 using System.Text.Json;
+using System.Web;
 using Microsoft.Extensions.Logging;
 using NexusMods.Common;
 using NexusMods.Common.OSInterop;
@@ -24,7 +26,7 @@ public class OAuth
     // NOTE(erri120): The backend has a list of valid redirect URLs and client IDs.
     // We can't change these on our own.
     private const string OAuthRedirectUrl = "nxm://oauth/callback";
-    private const string OAuthClientId = "vortex";
+    private const string OAuthClientId = "nma";
 
     private readonly ILogger<OAuth> _logger;
     private readonly HttpClient _http;
@@ -136,7 +138,7 @@ internal static Uri GenerateAuthorizeUrl(string challenge, string state)
         var request = new Dictionary<string, string>
         {
             { "response_type", "code" },
-            { "scope", "public" },
+            { "scope", "public openid profile email" },
             { "code_challenge_method", "S256" },
             { "client_id", OAuthClientId },
             { "redirect_uri",  OAuthRedirectUrl },

From cf59843628e7a9b6a01d598a27eb35b477bcbc78 Mon Sep 17 00:00:00 2001
From: erri120 <erri120@protonmail.com>
Date: Mon, 25 Sep 2023 15:26:25 +0200
Subject: [PATCH 11/15] Update OAuth

---
 .../ApiKeyMessageFactory.cs                   |  4 +-
 .../LoginManager.cs                           | 35 ++++++++++++---
 .../OAuth2MessageFactory.cs                   | 45 +++++++++----------
 .../DTOs/OAuth/OAuthUserInfo.cs               |  8 ++--
 .../Types/UserInfo.cs                         | 20 ++++-----
 src/NexusMods.Common/CachedObject.cs          |  9 ++++
 6 files changed, 73 insertions(+), 48 deletions(-)

diff --git a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/ApiKeyMessageFactory.cs b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/ApiKeyMessageFactory.cs
index 3b19997e8d..bbc6fcc337 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/ApiKeyMessageFactory.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/ApiKeyMessageFactory.cs
@@ -14,7 +14,7 @@ public class ApiKeyMessageFactory : IAuthenticatingMessageFactory
     /// The name of the environment variable that contains the API key.
     /// </summary>
     public const string NexusApiKeyEnvironmentVariable = "NEXUS_API_KEY";
-    
+
     private static readonly IId ApiKeyId = new IdVariableLength(EntityCategory.AuthData, "NexusMods.Networking.NexusWebApi.ApiKey"u8.ToArray());
 
     private readonly IDataStore _store;
@@ -75,7 +75,7 @@ public ValueTask SetApiKey(string apiKey)
         {
             Name = result.Data.Name,
             IsPremium = result.Data.IsPremium,
-            IsSupporter = result.Data.IsSupporter,
+            AvatarUrl = result.Data.ProfileUrl
         };
     }
 
diff --git a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs
index 7c89176225..4d016575fb 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs
@@ -1,5 +1,7 @@
+using System.Reactive.Concurrency;
 using System.Reactive.Linq;
 using JetBrains.Annotations;
+using NexusMods.Common;
 using NexusMods.Common.ProtocolRegistration;
 using NexusMods.DataModel.Abstractions;
 using NexusMods.Networking.NexusWebApi.Types;
@@ -10,7 +12,7 @@ namespace NexusMods.Networking.NexusWebApi.NMA;
 /// Component for handling login and logout from the Nexus Mods
 /// </summary>
 [PublicAPI]
-public class LoginManager
+public sealed class LoginManager : IDisposable
 {
     private readonly OAuth _oauth;
     private readonly IDataStore _dataStore;
@@ -36,7 +38,7 @@ public class LoginManager
     /// <summary>
     /// The user's avatar
     /// </summary>
-    public IObservable<Uri?> Avatar => UserInfo.Select(info => info?.Avatar);
+    public IObservable<Uri?> Avatar => UserInfo.Select(info => info?.AvatarUrl);
 
     /// <summary/>
     /// <param name="client">Nexus API client.</param>
@@ -57,19 +59,33 @@ public LoginManager(Client client,
         _protocolRegistration = protocolRegistration;
 
         UserInfo = _dataStore.IdChanges
-            // NOTE(err120): Since id's don't change on startup, we can insert
+            // NOTE(err120): Since IDs don't change on startup, we can insert
             // a fake change at the start of the observable chain. This will only
             // run once at startup and notify the subscribers.
             .Merge(Observable.Return(JWTTokenEntity.StoreId))
             .Where(id => id.Equals(JWTTokenEntity.StoreId))
+            .ObserveOn(TaskPoolScheduler.Default)
             .SelectMany(async _ => await Verify(CancellationToken.None));
     }
 
+    private CachedObject<UserInfo> _cachedUserInfo = new(TimeSpan.FromHours(1));
+    private readonly SemaphoreSlim _verifySemaphore = new(initialCount: 1, maxCount: 1);
+
     private async Task<UserInfo?> Verify(CancellationToken cancellationToken)
     {
-        if (await _msgFactory.IsAuthenticated())
-            return await _msgFactory.Verify(_client, cancellationToken);
-        return null;
+        var cachedValue = _cachedUserInfo.Get();
+        if (cachedValue is not null) return cachedValue;
+
+        using var waiter = _verifySemaphore.CustomWait(timeout: TimeSpan.FromSeconds(30), cancellationToken);
+        if (!waiter.HasEntered) return null;
+
+        var isAuthenticated = await _msgFactory.IsAuthenticated();
+        if (!isAuthenticated) return null;
+
+        var userInfo = await _msgFactory.Verify(_client, cancellationToken);
+        _cachedUserInfo.Store(userInfo);
+
+        return userInfo;
     }
 
     /// <summary>
@@ -100,6 +116,13 @@ public async Task LoginAsync(CancellationToken token = default)
     public Task Logout()
     {
         _dataStore.Delete(JWTTokenEntity.StoreId);
+        _cachedUserInfo.Evict();
         return Task.CompletedTask;
     }
+
+    /// <inheritdoc/>
+    public void Dispose()
+    {
+        _verifySemaphore.Dispose();
+    }
 }
diff --git a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth2MessageFactory.cs b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth2MessageFactory.cs
index 2861d3936a..513ace0a4e 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth2MessageFactory.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth2MessageFactory.cs
@@ -1,5 +1,4 @@
-using System.IdentityModel.Tokens.Jwt;
-using System.Text.Json;
+using System.Reactive.Linq;
 using Microsoft.Extensions.Logging;
 using NexusMods.DataModel.Abstractions;
 using NexusMods.Networking.NexusWebApi.DTOs.OAuth;
@@ -15,7 +14,6 @@ public class OAuth2MessageFactory : IAuthenticatingMessageFactory
     private readonly ILogger<OAuth2MessageFactory> _logger;
     private readonly IDataStore _store;
     private readonly OAuth _auth;
-    private readonly JwtSecurityTokenHandler _tokenHandler = new();
 
     /// <summary>
     /// Constructor.
@@ -28,11 +26,13 @@ public OAuth2MessageFactory(
         _store = store;
         _auth = auth;
         _logger = logger;
+
+        _store.IdChanges
+            .Where(x => x.Equals(JWTTokenEntity.StoreId))
+            .Subscribe(_ => _cachedTokenEntity = null);
     }
 
-    // TODO: listen to DB changes when the user wants to logout
     private JWTTokenEntity? _cachedTokenEntity;
-    private UserInfo? _cachedUserInfo;
 
     private async ValueTask<string?> GetOrRefreshToken(CancellationToken cancellationToken)
     {
@@ -47,11 +47,12 @@ public OAuth2MessageFactory(
         {
             RefreshToken = newToken.RefreshToken,
             AccessToken = newToken.AccessToken,
-            ExpiresAt = DateTimeOffset.UtcNow
+            ExpiresAt = DateTimeOffset.UtcNow,
         };
 
-        _cachedUserInfo = null;
         _store.Put(JWTTokenEntity.StoreId, _cachedTokenEntity);
+        _cachedTokenEntity.DataStoreId = JWTTokenEntity.StoreId;
+
         return _cachedTokenEntity.AccessToken;
     }
 
@@ -77,30 +78,24 @@ public async ValueTask<bool> IsAuthenticated()
     /// <inheritdoc/>
     public async ValueTask<UserInfo?> Verify(Client client, CancellationToken cancel)
     {
-        if (_cachedUserInfo is not null) return _cachedUserInfo;
-        _logger.LogDebug("Renewing cached user info");
-
-        var token = await GetOrRefreshToken(cancellationToken: cancel);
-
-        var tokenInfo = _tokenHandler.ReadJwtToken(token);
-        var userClaim = tokenInfo?.Claims.FirstOrDefault(iter => iter.Type == "user");
-        var userInfo = userClaim is not null ? JsonSerializer.Deserialize<TokenUserInfo>(userClaim.Value) : null;
-
-        if (userInfo is null)
+        OAuthUserInfo oAuthUserInfo;
+        try
+        {
+            var res = await client.GetOAuthUserInfo(cancellationToken: cancel);
+            oAuthUserInfo = res.Data;
+        }
+        catch (Exception e)
         {
-            _logger.LogError("Unable to extract user info from token!");
+            _logger.LogError(e, "Exception while fetching OAuth user info");
             return null;
         }
 
-        _cachedUserInfo = new UserInfo
+        return new UserInfo
         {
-            Name = userInfo.Name,
-            IsPremium = userInfo.MembershipRoles.Contains(MembershipRole.Premium),
-            IsSupporter = userInfo.MembershipRoles.Contains(MembershipRole.Supporter),
-            // TODO: fetch avatar
+            Name = oAuthUserInfo.Name,
+            IsPremium = oAuthUserInfo.MembershipRoles.Contains(MembershipRole.Premium),
+            AvatarUrl = oAuthUserInfo.Avatar
         };
-
-        return _cachedUserInfo;
     }
 
     /// <inheritdoc/>
diff --git a/src/Networking/NexusMods.Networking.NexusWebApi/DTOs/OAuth/OAuthUserInfo.cs b/src/Networking/NexusMods.Networking.NexusWebApi/DTOs/OAuth/OAuthUserInfo.cs
index 9bc87691bc..d0fb949b00 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi/DTOs/OAuth/OAuthUserInfo.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi/DTOs/OAuth/OAuthUserInfo.cs
@@ -15,25 +15,25 @@ public record OAuthUserInfo : IJsonSerializable<OAuthUserInfo>
     /// Gets the User ID.
     /// </summary>
     [JsonPropertyName("sub")]
-    public ulong Sub { get; init; }
+    public string Sub { get; set; } = string.Empty;
 
     /// <summary>
     /// Gets the User Name.
     /// </summary>
     [JsonPropertyName("name")]
-    public string Name { get; init; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
 
     /// <summary>
     /// Gets the avatar url.
     /// </summary>
     [JsonPropertyName("avatar")]
-    public Uri? Avatar { get; init; }
+    public Uri? Avatar { get; set; }
 
     /// <summary>
     /// Gets an array of membership roles.
     /// </summary>
     [JsonPropertyName("membership_roles")]
-    public MembershipRole[] MembershipRoles { get; init; } = Array.Empty<MembershipRole>();
+    public MembershipRole[] MembershipRoles { get; set; } = Array.Empty<MembershipRole>();
 
     /// <inheritdoc />
     public static JsonTypeInfo<OAuthUserInfo> GetTypeInfo() => OAuthUserInfoContext.Default.OAuthUserInfo;
diff --git a/src/Networking/NexusMods.Networking.NexusWebApi/Types/UserInfo.cs b/src/Networking/NexusMods.Networking.NexusWebApi/Types/UserInfo.cs
index 6c4c137e99..42359404eb 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi/Types/UserInfo.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi/Types/UserInfo.cs
@@ -1,27 +1,25 @@
+using JetBrains.Annotations;
+
 namespace NexusMods.Networking.NexusWebApi.Types;
 
 /// <summary>
 /// Information about a logged in user
 /// </summary>
+[PublicAPI]
 public record UserInfo
 {
     /// <summary>
-    /// user name
-    /// </summary>
-    public string Name = "";
-
-    /// <summary>
-    /// is the user premium?
+    /// Gets the name of the user.
     /// </summary>
-    public bool IsPremium;
+    public required string Name { get; init; }
 
     /// <summary>
-    /// is the user a supporter (e.g. formerly premium)?
+    /// Gets the premium status of the user.
     /// </summary>
-    public bool IsSupporter;
+    public required bool IsPremium { get; init; }
 
     /// <summary>
-    /// Uri of the user's avatar
+    /// Gets the avatar url of the user.
     /// </summary>
-    public Uri? Avatar { get; set; }
+    public required Uri? AvatarUrl { get; init; }
 }
diff --git a/src/NexusMods.Common/CachedObject.cs b/src/NexusMods.Common/CachedObject.cs
index 51acfedcb0..51c32398c0 100644
--- a/src/NexusMods.Common/CachedObject.cs
+++ b/src/NexusMods.Common/CachedObject.cs
@@ -55,4 +55,13 @@ public void Store(T? obj)
         _object = obj;
         _expiredAt = DateTimeOffset.UtcNow + _lifetime;
     }
+
+    /// <summary>
+    /// Immediately expires the current cache.
+    /// </summary>
+    public void Evict()
+    {
+        _object = null;
+        _expiredAt = DateTimeOffset.UtcNow;
+    }
 }

From 96f95b3aac3af213fda12bcd654d8a1bbfc65654 Mon Sep 17 00:00:00 2001
From: erri120 <erri120@protonmail.com>
Date: Mon, 25 Sep 2023 15:41:55 +0200
Subject: [PATCH 12/15] Update OAuth scopes

---
 src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth.cs | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth.cs b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth.cs
index e0e781ec91..716ad720a2 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/OAuth.cs
@@ -1,10 +1,8 @@
-using System.Net;
 using System.Reactive.Linq;
 using System.Security.Cryptography;
 using System.Text;
 using System.Text.Encodings.Web;
 using System.Text.Json;
-using System.Web;
 using Microsoft.Extensions.Logging;
 using NexusMods.Common;
 using NexusMods.Common.OSInterop;
@@ -138,7 +136,7 @@ internal static Uri GenerateAuthorizeUrl(string challenge, string state)
         var request = new Dictionary<string, string>
         {
             { "response_type", "code" },
-            { "scope", "public openid profile email" },
+            { "scope", "openid profile email" },
             { "code_challenge_method", "S256" },
             { "client_id", OAuthClientId },
             { "redirect_uri",  OAuthRedirectUrl },

From d2a6be0feb067ed2ec53e7d685a0212a39fd5fb5 Mon Sep 17 00:00:00 2001
From: erri120 <erri120@protonmail.com>
Date: Mon, 25 Sep 2023 15:44:38 +0200
Subject: [PATCH 13/15] Fix build issue

---
 .../NexusMods.Networking.NexusWebApi/Verbs/NexusApiVerify.cs   | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/Networking/NexusMods.Networking.NexusWebApi/Verbs/NexusApiVerify.cs b/src/Networking/NexusMods.Networking.NexusWebApi/Verbs/NexusApiVerify.cs
index b83648c750..5782430eee 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi/Verbs/NexusApiVerify.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi/Verbs/NexusApiVerify.cs
@@ -26,14 +26,13 @@ public NexusApiVerify(Client client, IAuthenticatingMessageFactory messageFactor
     public async Task<int> Run(CancellationToken token)
     {
         var userInfo = await _messageFactory.Verify(_client, token);
-        await Renderer.Render(new Table(new[] { "Name", "Premium", "Supporter" },
+        await Renderer.Render(new Table(new[] { "Name", "Premium" },
             new[]
             {
                 new object[]
                 {
                     userInfo?.Name ?? "<Not logged in>",
                     userInfo?.IsPremium ?? false,
-                    userInfo?.IsSupporter ?? false,
                 }
             }));
 

From 967b650c0ce39b7267d3d2b1896ca370962dc79e Mon Sep 17 00:00:00 2001
From: erri120 <erri120@protonmail.com>
Date: Mon, 25 Sep 2023 15:56:32 +0200
Subject: [PATCH 14/15] Update locking

---
 .../LoginManager.cs                                   |  5 +++--
 src/NexusMods.Common/SemaphoreSlimWaiter.cs           | 11 +++++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs
index 4d016575fb..e4b91c3433 100644
--- a/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs
+++ b/src/Networking/NexusMods.Networking.NexusWebApi.NMA/LoginManager.cs
@@ -76,8 +76,9 @@ public LoginManager(Client client,
         var cachedValue = _cachedUserInfo.Get();
         if (cachedValue is not null) return cachedValue;
 
-        using var waiter = _verifySemaphore.CustomWait(timeout: TimeSpan.FromSeconds(30), cancellationToken);
-        if (!waiter.HasEntered) return null;
+        using var waiter = _verifySemaphore.CustomWait(cancellationToken);
+        cachedValue = _cachedUserInfo.Get();
+        if (cachedValue is not null) return cachedValue;
 
         var isAuthenticated = await _msgFactory.IsAuthenticated();
         if (!isAuthenticated) return null;
diff --git a/src/NexusMods.Common/SemaphoreSlimWaiter.cs b/src/NexusMods.Common/SemaphoreSlimWaiter.cs
index 532e443bbf..87c6f2fddb 100644
--- a/src/NexusMods.Common/SemaphoreSlimWaiter.cs
+++ b/src/NexusMods.Common/SemaphoreSlimWaiter.cs
@@ -47,4 +47,15 @@ public static SemaphoreSlimWaiter CustomWait(
         var entered = semaphoreSlim.Wait(timeout, cancellationToken);
         return new SemaphoreSlimWaiter(semaphoreSlim, entered);
     }
+
+    /// <summary>
+    /// Custom wait infinitely using <see cref="SemaphoreSlimWaiter"/>.
+    /// </summary>
+    public static SemaphoreSlimWaiter CustomWait(
+        this SemaphoreSlim semaphoreSlim,
+        CancellationToken cancellationToken = default)
+    {
+        semaphoreSlim.Wait(cancellationToken);
+        return new SemaphoreSlimWaiter(semaphoreSlim, entered: true);
+    }
 }

From 36b2ecd6a351ed6ab41da01495c98b28a7c2f6ae Mon Sep 17 00:00:00 2001
From: erri120 <erri120@protonmail.com>
Date: Tue, 26 Sep 2023 11:00:48 +0200
Subject: [PATCH 15/15] Update tests

---
 .../OAuth2MessageFactoryTests.cs              | 113 ------------------
 .../OAuthTests.cs                             |   4 +-
 2 files changed, 2 insertions(+), 115 deletions(-)
 delete mode 100644 tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuth2MessageFactoryTests.cs

diff --git a/tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuth2MessageFactoryTests.cs b/tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuth2MessageFactoryTests.cs
deleted file mode 100644
index 59423d2491..0000000000
--- a/tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuth2MessageFactoryTests.cs
+++ /dev/null
@@ -1,113 +0,0 @@
-using Microsoft.Extensions.Logging;
-using NexusMods.Common;
-using System.Net;
-using NexusMods.DataModel.Interprocess;
-using NexusMods.DataModel.Abstractions;
-using FluentAssertions;
-using System.Text.Json;
-using NexusMods.Common.OSInterop;
-using NexusMods.DataModel.Interprocess.Jobs;
-using NexusMods.Networking.NexusWebApi.DTOs.OAuth;
-using NexusMods.Networking.NexusWebApi.NMA;
-using NexusMods.Networking.NexusWebApi.NMA.Messages;
-using NSubstitute;
-
-namespace NexusMods.Networking.NexusWebApi.Tests;
-
-public class OAuth2MessageFactoryTests
-{
-    private readonly OAuth2MessageFactory _factory;
-    private readonly IDataStore _store;
-    private readonly MockHttpMessageHandler _handler;
-
-    public OAuth2MessageFactoryTests(
-        ILoggerFactory loggerFactory,
-        IMessageConsumer<NXMUrlMessage> consumer,
-        IInterprocessJobManager jobManager)
-    {
-        _store = Substitute.For<IDataStore>();
-
-        _handler = Substitute.ForPartsOf<MockHttpMessageHandler>();
-        var httpClient = new HttpClient(_handler);
-
-        var idGen = Substitute.For<IIDGenerator>();
-        var os = Substitute.For<IOSInterop>();
-
-        var auth = new OAuth(loggerFactory.CreateLogger<OAuth>(), httpClient, idGen, os, consumer, jobManager);
-        _factory = new OAuth2MessageFactory(_store, auth);
-    }
-
-    [Fact]
-    public async void AddsHeaderToRequest()
-    {
-        _store
-            .Get<JWTTokenEntity>(JWTTokenEntity.StoreId, canCache: false)
-            .Returns(_ => new JWTTokenEntity
-            {
-                AccessToken = "access_token",
-                RefreshToken = "refresh_token",
-                ExpiresAt = DateTimeOffset.UtcNow
-            });
-
-        var request = await _factory.Create(HttpMethod.Get, new Uri("test://foobar"));
-
-        request.Headers.Authorization.Should().NotBeNull();
-        request.Headers.Authorization!.ToString().Should().Be("Bearer access_token");
-    }
-
-    [Fact()]
-    public async void ThrowsIfMissingToken()
-    {
-        Func<Task<HttpRequestMessage>> func = async () => await _factory.Create(HttpMethod.Get, new Uri("test://foobar"));
-
-        await func.Should().ThrowAsync<Exception>();
-    }
-
-    [Fact()]
-    public async void ForwardsUnrelatedErrors()
-    {
-        var msg = new HttpRequestMessage(HttpMethod.Get, "test://foobar");
-        var ex = new HttpRequestException();
-        var res = await _factory.HandleError(msg, ex, CancellationToken.None);
-        res.Should().BeNull();
-    }
-
-    [Fact()]
-    public async void RequestsRefreshOnTokenExpired()
-    {
-        _store
-            .Get<JWTTokenEntity>(JWTTokenEntity.StoreId, canCache: false)
-            .Returns(_ => new JWTTokenEntity
-            {
-                AccessToken = "access_token",
-                RefreshToken = "refresh_token",
-                ExpiresAt = DateTimeOffset.UtcNow
-            });
-
-        _handler
-            .SendMock(Arg.Any<HttpRequestMessage>(), Arg.Any<CancellationToken>())
-            .Returns(Task.FromResult(new HttpResponseMessage
-            {
-                StatusCode = HttpStatusCode.OK,
-                Content = new StringContent(JsonSerializer.Serialize(RefreshToken))
-            }));
-
-        var msg = new HttpRequestMessage(HttpMethod.Get, "test://foobar");
-        var ex = new HttpRequestException("Token has expired", null, HttpStatusCode.Unauthorized);
-        var res = await _factory.HandleError(msg, ex, CancellationToken.None);
-        res.Should().NotBeNull();
-        res!.Headers.Authorization!.Should().NotBeNull();
-        res.Headers.Authorization!.ToString().Should().Be("Bearer refreshed_access_token");
-    }
-
-    private static readonly JwtTokenReply RefreshToken =
-        new()
-        {
-            AccessToken = "refreshed_access_token",
-            RefreshToken = "refresh_token",
-            Scope = "public",
-            Type = "Bearer",
-            CreatedAt = 1677143380,
-            ExpiresIn = 21600,
-        };
-}
diff --git a/tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuthTests.cs b/tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuthTests.cs
index 81ad83c024..c518101505 100644
--- a/tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuthTests.cs
+++ b/tests/Networking/NexusMods.Networking.NexusWebApi.Tests/OAuthTests.cs
@@ -180,12 +180,12 @@ public async void AuthorizationCanBeCanceled()
         };
 
     // ReSharper disable once InconsistentNaming
-    private readonly Uri ExpectedAuthURL = new("https://users.nexusmods.com/oauth/authorize?response_type=code&scope=public&code_challenge_method=S256&client_id=vortex&redirect_uri=nxm%3A%2F%2Foauth%2Fcallback&code_challenge=-pSOp5xdZffKD0gc1lb5JALgN_ZtE9X573ib3yS8BT4&state=00000000-0000-0000-0000-000000000000");
+    private readonly Uri ExpectedAuthURL = new("https://users.nexusmods.com/oauth/authorize?response_type=code&scope=openid profile email&code_challenge_method=S256&client_id=nma&redirect_uri=nxm%3A%2F%2Foauth%2Fcallback&code_challenge=QMZ4D7BLeehAXINE9NZ8dho2i5AYVTbfqJ8PhQ4eUrE&state=00000000-0000-0000-0000-000000000000");
 
     [Fact]
     public void Test_GenerateAuthorizeUrl()
     {
-        var res = OAuth.GenerateAuthorizeUrl("-pSOp5xdZffKD0gc1lb5JALgN_ZtE9X573ib3yS8BT4", "00000000-0000-0000-0000-000000000000");
+        var res = OAuth.GenerateAuthorizeUrl("QMZ4D7BLeehAXINE9NZ8dho2i5AYVTbfqJ8PhQ4eUrE", "00000000-0000-0000-0000-000000000000");
         res.Should().Be(ExpectedAuthURL);
     }
 }