An Opus code review of the branch caught two real bugs the test suite
structurally couldn't see:
- /revocation and /introspect were never added to bootstrap/app.php's
CSRF except list, so both were fully broken (403) for any real
external client, despite every feature test passing — CSRF
verification is short-circuited entirely while running tests.
Verified live against the running app before and after the fix, and
added a regression test that asserts against the actual configured
exemptions rather than relying on request-time behavior that tests
can't exercise.
- An array-shaped `token` param (e.g. token[]=a&token[]=b) crashed
both endpoints with a 500, since this app promotes PHP warnings
("Array to string conversion") to exceptions. Fixed at the shared
root, MicropubToken::findActive(), which also closes the same latent
hole in VerifyMicropubToken's access_token param that predates this
branch. Verified live and covered with regression tests.
Also applied the review's lower-severity findings: added the missing
introspection_endpoint Link header and metadata test assertions,
removed the now-dead is_string($scopes) array branch in the Micropub
handlers and media controller (scope is unconditionally a string from
the DB now, this guarded against a JWT-array-claim shape that can no
longer occur), dropped a redundant #[Table] model attribute, sized
token_hash to its actual 64-char length, and removed a one-off inline
style in the admin view.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L
Tokens now store a hashed row in micropub_tokens instead of being
self-contained signed JWTs, so a leaked or unwanted token can actually
be revoked. Since revocation already requires a DB lookup on every
request, JWT's stateless-verification benefit was gone anyway, so this
also drops the lcobucci/jwt dependency entirely.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L
Long brid.gy Bluesky source URLs exceed 255 characters, causing
SQLSTATE[22001] errors. Changed source and target from varchar(255)
to text (no performance impact in PostgreSQL).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
We don’t need the complexity of S3. Sepcifically the complexity of
managing my own AWS account, flysystem made the Laravel side easy.
A command is added to copy the the S3 files over to local storage.
- Add new SVG icons for the "reply", "like", and "repost" actions
- Update webmention info display in note template to include counts and icons for replies, likes, and reposts
- Add webmention counts to FrontPageController.php and modify queries in NotesController.php
- Modify WebMentionsTableSeeder.php to change URLs, commentable ID, and add new WebMentions
- Added a button for logging in with Passkeys in `login.blade.php`
- Refactored the `register` method and added the `login` method in `auth.js`
- Made various modifications and additions to the passkey functionality in `PasskeysController.php`
- Added event listener for login-passkey element in `app.js`
- Modified the passkeys table schema and made modifications to `Passkey.php`
- Changed the redirect route in the `login` method of `AuthController.php`
- Made modifications and additions to the routes in `web.php`
- Added `"web-auth/webauthn-lib": "^4.7"` to the list of required packages in `composer.json`
- Changed the redirect URL in `AdminTest.php`
- Update various factory files in the `database/factories` directory
- Remove unused imports and annotations in factory files
- Add or update comments and PHPDoc blocks for better understanding and readability
- Remove unused imports in controller and command files
- Remove commented out code in middleware file
* Re-publish Horizon assets
* Updated horizon config file
* Newest Horizon now works by using Laravel’s own auth
* For now, remove test for admin login
Squashed commit of the following:
commit 1701a33d313d0969b061c8a87734395312045d9a
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Sat Mar 16 18:44:29 2019 +0000
Try and get security checker working again
commit 2f81f28419304cad1678c6ee054eb3c8782fa082
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Sat Mar 16 18:38:41 2019 +0000
Make sure aaron's profile pic is saved
commit 8a78aeec9c648a647fcb5d778b3003df5c3f653e
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Sat Mar 16 18:16:16 2019 +0000
Lets push out the new style as is
commit a8015907d44370600ae3711605f96c4e3a637fca
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Fri Mar 15 21:31:19 2019 +0000
More design work
commit 12cb6e1bfc23ca9591e5348ebc6e49614d686722
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Sun Mar 10 16:00:30 2019 +0000
Updating CSS styles for design v2
Squashed commit of the following:
commit eb55e94ed89a1b8ccd1db10a36efd28d8896f316
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Thu Jan 24 18:45:00 2019 +0000
Remove un-needed use statments, fix tests now we have 2 articles
commit f1c12c1b43d071fe0484407a9692ee4184542437
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Wed Jan 23 19:39:56 2019 +0000
Remove prism files
commit 3a1d12d9181600f661593c662dbc18d152413b28
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Wed Jan 23 19:39:24 2019 +0000
Use the new css file in the search page
commit 119b6b5163c217a15770004a45b07bacdfb766f0
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Wed Jan 23 19:36:14 2019 +0000
Recompress assets
commit afae245d0211dd31fcc131cecb0fab4084895612
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Sun Jan 20 19:33:56 2019 +0000
Style codeblocks in articles as well
commit 53be0a2023755c2f16ba1560d88f9c66675b581d
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Sun Jan 20 19:23:25 2019 +0000
Styled codeblocks are now on the notes pages
commit 818add06f349874501cc44baf332dc63dfdcfab1
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Sun Jan 20 19:08:56 2019 +0000
Install spatie’s commonmark highlighter, use it for notes
commit fb69d98b2bd3bb56540854fe16200c027e5ef6b2
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Sun Jan 20 18:54:27 2019 +0000
Remove links to prism code in the notes pages
commit dc89fcd4711b25e8407be9b25b58cd4cd1e9980e
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Sun Jan 20 18:54:11 2019 +0000
Add a note to the seeder which has a code block
