Implements the current IndieAuth spec's dedicated /revocation endpoint
so clients can self-revoke a token (e.g. on user sign-out), rather than
only supporting revocation via the admin side. Always responds 200 per
spec, whether the token was found or not, so callers can't use it to
probe token validity. Skips the legacy action=revoke-on-/token fallback
the spec mentions for older clients, since the only real client here is
already being updated to use the current endpoint.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L
Tokens now store a hashed row in micropub_tokens instead of being
self-contained signed JWTs, so a leaked or unwanted token can actually
be revoked. Since revocation already requires a DB lookup on every
request, JWT's stateless-verification benefit was gone anyway, so this
also drops the lcobucci/jwt dependency entirely.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L
Replaces every raw GuzzleHttp\Client usage (Nominatim, web.archive.org,
webmention fetch/discover/send, Bridgy syndication, IndieAuth client_id
lookup, contact avatar/h-card fetch, profile image download, and the
CloudConvert screenshot pipeline) with Illuminate\Support\Facades\Http,
and enables Http::preventStrayRequests() globally in tests so any
un-faked outbound call now fails loudly instead of silently hitting the
network.
The CloudConvert retry-until-finished middleware in AppServiceProvider
is replaced by a plain polling loop in SaveScreenshot, which also fixes
a latent bug where the old middleware decoded a response object instead
of its body. Bridgy syndication jobs keep their tries=1/no-retry
semantics unchanged to avoid duplicate publishes. Guzzle's PSR-7 helpers
(Header, UriResolver, Utils) stay in SendWebMentions since Http has no
equivalent for them.
Every affected test file's Guzzle MockHandler/HandlerStack boilerplate
is replaced with Http::fake()/Http::sequence().
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P8j7cJhCiYDsGUgB7obKNQ
Bridgy's Micropub endpoint required per-silo access tokens and posted
raw markdown content directly. Switch to Bridgy's webmention publish
endpoint instead: POST source/target to /publish/webmention and let
Bridgy re-fetch the note page, which now carries hidden verification
links for silos not yet syndicated. Removes the now-unused
config/bridgy.php and BRIDGY_MASTODON_TOKEN env var, and caps both
jobs to a single try since retries would send Bridgy a duplicate
publish webmention.
ProcessMedia was using resize(), which distorts images that aren't the
target aspect ratio; scale() preserves it. Existing medium/small
variants generated before this fix need regenerating, so add an
artisan command (with --dry-run) to do that, plus feature tests.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
OwnYourSwarm sends content as an array of objects with `value` and `html`
keys per the Micropub spec. The handler now handles both forms: plain
strings and rich objects, preferring `html` over `value`.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Real OwnYourSwarm requests send the checkin h-card inside
properties.checkin (as an array), not at the top level. The code
was reading from the top-level key so no Place was ever created,
leaving checkin notes blank.
Update tests to match the real request format.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Each DTO now owns its own parsing logic via fromRequest(), removing
the normalization layer from MicropubRequest entirely. UpdateHandler
gains delete support and allows replace/add/delete to compose in a
single request rather than being mutually exclusive.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add MicropubUnsupportedModelException for non-note update attempts
- Refactor UpdateHandler to throw exceptions instead of returning JsonResponse objects; extract applySyndication() to DRY up duplicated syndication URL mapping
- Fix MicropubController: InvalidTokenScopeException now returns 401 + insufficient_scope; add catches for ModelNotFoundException (404) and MicropubUnsupportedModelException (500); updates return 200 not 201
- Slim MicropubRequest.normalizeMicropubJson() to branch on action type, keeping update and create fields cleanly separated
- Update tests to match corrected status codes and error keys; remove markTestSkipped() from all update tests
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Trying to organise the code better. It now temporarily doesn’t support
update requests. Thought the spec defines them as SHOULD features and
not MUST features. So safe for now :)
We don’t need the complexity of S3. Sepcifically the complexity of
managing my own AWS account, flysystem made the Laravel side easy.
A command is added to copy the the S3 files over to local storage.
- Added a button for logging in with Passkeys in `login.blade.php`
- Refactored the `register` method and added the `login` method in `auth.js`
- Made various modifications and additions to the passkey functionality in `PasskeysController.php`
- Added event listener for login-passkey element in `app.js`
- Modified the passkeys table schema and made modifications to `Passkey.php`
- Changed the redirect route in the `login` method of `AuthController.php`
- Made modifications and additions to the routes in `web.php`
- Added `"web-auth/webauthn-lib": "^4.7"` to the list of required packages in `composer.json`
- Changed the redirect URL in `AdminTest.php`
- Update regular expressions for two routes in `routes/web.php` to match specific numeral values
- Add new test for incorrect URL parsing in `tests/Feature/ArticlesTest.php`
- Remove activity stream related code and files
- Update configuration for HtmlSanitizer and RetryGuzzle
- Add `paginate` macro for `Collection`
- Remove unused code for `Codebird`
- Simplify `FrontPageController` and `NotesController` methods
