An Opus code review of the branch caught two real bugs the test suite
structurally couldn't see:
- /revocation and /introspect were never added to bootstrap/app.php's
CSRF except list, so both were fully broken (403) for any real
external client, despite every feature test passing — CSRF
verification is short-circuited entirely while running tests.
Verified live against the running app before and after the fix, and
added a regression test that asserts against the actual configured
exemptions rather than relying on request-time behavior that tests
can't exercise.
- An array-shaped `token` param (e.g. token[]=a&token[]=b) crashed
both endpoints with a 500, since this app promotes PHP warnings
("Array to string conversion") to exceptions. Fixed at the shared
root, MicropubToken::findActive(), which also closes the same latent
hole in VerifyMicropubToken's access_token param that predates this
branch. Verified live and covered with regression tests.
Also applied the review's lower-severity findings: added the missing
introspection_endpoint Link header and metadata test assertions,
removed the now-dead is_string($scopes) array branch in the Micropub
handlers and media controller (scope is unconditionally a string from
the DB now, this guarded against a JWT-array-claim shape that can no
longer occur), dropped a redundant #[Table] model attribute, sized
token_hash to its actual 64-char length, and removed a one-off inline
style in the admin view.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L
Trying to organise the code better. It now temporarily doesn’t support
update requests. Thought the spec defines them as SHOULD features and
not MUST features. So safe for now :)
Squashed commit of the following:
commit 070f46bbacd91855730d467cc2806183441791ae
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Mon Sep 4 18:06:04 2017 +0100
Now we now how the laravel IoC conatiner works, no need to be newing class dependencies
commit 57eeacdef178532a681f774f8c6738950d40c964
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Mon Sep 4 17:59:28 2017 +0100
Get json test working again
commit 81c3cfc9b432241d8a4df7f1e0511a50ea4f9b90
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Mon Sep 4 14:38:10 2017 +0100
Can’t use RefreshDatabase yet
commit 4ba5ff724d50ca86b3fa90c7bb4e71ad9e4dad79
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Mon Sep 4 14:10:33 2017 +0100
Initial attempt at updating to Laravel 5.5
