An Opus code review of the branch caught two real bugs the test suite
structurally couldn't see:
- /revocation and /introspect were never added to bootstrap/app.php's
CSRF except list, so both were fully broken (403) for any real
external client, despite every feature test passing — CSRF
verification is short-circuited entirely while running tests.
Verified live against the running app before and after the fix, and
added a regression test that asserts against the actual configured
exemptions rather than relying on request-time behavior that tests
can't exercise.
- An array-shaped `token` param (e.g. token[]=a&token[]=b) crashed
both endpoints with a 500, since this app promotes PHP warnings
("Array to string conversion") to exceptions. Fixed at the shared
root, MicropubToken::findActive(), which also closes the same latent
hole in VerifyMicropubToken's access_token param that predates this
branch. Verified live and covered with regression tests.
Also applied the review's lower-severity findings: added the missing
introspection_endpoint Link header and metadata test assertions,
removed the now-dead is_string($scopes) array branch in the Micropub
handlers and media controller (scope is unconditionally a string from
the DB now, this guarded against a JWT-array-claim shape that can no
longer occur), dropped a redundant #[Table] model attribute, sized
token_hash to its actual 64-char length, and removed a one-off inline
style in the admin view.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L
Gives a way to actually use the revocation capability built up over
the last few commits from the admin side, not just self-service via
the client. Lists client_id/scope/issue time per token (never the raw
token itself, since only its hash is stored) with a revoke button for
active ones.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L
Swap the syntax highlighting library and its CSS theme (zenburn -> nord,
matching tempest's class names), add padding to code blocks, and commit
the missing compressed winter.js assets from the earlier asset rename.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Bridgy's Micropub endpoint required per-silo access tokens and posted
raw markdown content directly. Switch to Bridgy's webmention publish
endpoint instead: POST source/target to /publish/webmention and let
Bridgy re-fetch the note page, which now carries hidden verification
links for silos not yet syndicated. Removes the now-unused
config/bridgy.php and BRIDGY_MASTODON_TOKEN env var, and caps both
jobs to a single try since retries would send Bridgy a duplicate
publish webmention.
- prevent repeated IDs in mastodon icon SVG
- fix missing offset attribute in mastodon icon SVG
- remove un-needed role on <nav> element
- add empty alt attribute to some social icons
- Add new SVG icons for the "reply", "like", and "repost" actions
- Update webmention info display in note template to include counts and icons for replies, likes, and reposts
- Add webmention counts to FrontPageController.php and modify queries in NotesController.php
- Modify WebMentionsTableSeeder.php to change URLs, commentable ID, and add new WebMentions
- Modify `public/assets/app.css` with updates to CSS variables, grid templates, and class styles
- Add class `pagination` to `<nav>` element in `resources/views/templates/pagination.blade.php`
- Update `public/assets/app.css.br` with changes
- Add flex layout and margin styles to `.h-feed`, `.h-entry`, and `.pagination` classes in `resources/css/layout.css`
- Added a button for logging in with Passkeys in `login.blade.php`
- Refactored the `register` method and added the `login` method in `auth.js`
- Made various modifications and additions to the passkey functionality in `PasskeysController.php`
- Added event listener for login-passkey element in `app.js`
- Modified the passkeys table schema and made modifications to `Passkey.php`
- Changed the redirect route in the `login` method of `AuthController.php`
- Made modifications and additions to the routes in `web.php`
- Added `"web-auth/webauthn-lib": "^4.7"` to the list of required packages in `composer.json`
- Changed the redirect URL in `AdminTest.php`
- Improve webpack performance and configuration
- Delete unnecessary CSS and binary files
- Adjust ESLint ignored files list
- Update package.json with webpack mode for dev and prod scripts
- Move app.css to app.js in master.blade.php
