Bring Micropub endpoint closer to the spec

- Detect form-encoded action=... requests, so form-encoded updates work
  and unhandled actions are no longer created as notes
- Default to h-entry when no type is given
- Read form-encoded photos from `photo` rather than `photos`
- Pass `category` through EntryData so bookmark tags are saved
- Accept single values for form-encoded multi-value properties
- Return 403 for insufficient_scope and 401 for invalid tokens
- Return 400 invalid_request for unsupported post types, update
  operations and models instead of reporting them as 500s

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Models/Bookmark.php

@@ -25,7 +25,7 @@ class Bookmark extends Model
         return $this->belongsToMany('App\Models\Tag');
     }
 
-    protected function uri(): Attribute
+    protected function localUri(): Attribute
     {
         return Attribute::get(
             get: fn () => config('app.url').'/bookmarks/'.$this->id,

app/Models/Like.php

@@ -18,13 +18,6 @@ class Like extends Model
     use FilterHtml;
     use HasFactory;
 
-    protected function uri(): Attribute
-    {
-        return Attribute::get(
-            get: fn () => config('app.url').'/likes/'.$this->id,
-        );
-    }
-
     protected function url(): Attribute
     {
         return Attribute::set(

app/Services/Micropub/Handlers/EntryHandler.php

@@ -35,7 +35,7 @@ class EntryHandler implements MicropubHandlerInterface
 
         $dataArray = $data->toArray();
         $location = match (true) {
-            isset($dataArray['like-of']) => resolve(LikeService::class)->create($dataArray)->uri,
+            isset($dataArray['like-of']) => resolve(LikeService::class)->create($dataArray)->url,
             isset($dataArray['bookmark-of']) => resolve(BookmarkService::class)->create($dataArray)->uri,
             isset($dataArray['name']) => resolve(ArticleService::class)->create($dataArray)->uri,
             default => resolve(NoteService::class)->create($dataArray)->uri,

database/migrations/2026_11_01_120000_drop_shorturl_from_notes_table.php

@@ -1,28 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\Schema;
-
-return new class extends Migration
-{
-    /**
-     * Run the migrations.
-     */
-    public function up(): void
-    {
-        Schema::table('notes', function (Blueprint $table) {
-            $table->dropColumn('shorturl');
-        });
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        Schema::table('notes', function (Blueprint $table) {
-            $table->string('shorturl', 20)->nullable();
-        });
-    }
-};

resources/views/templates/like.blade.php

@@ -20,7 +20,7 @@
             </blockquote>
         @endisset
         <div>
-            <a href="{{ $like->uri }}"><time class="dt-published" datetime="{{ $like->updated_at->toISO8601String() }}" title="{{ $like->updated_at->toISO8601String() }}">{{ $like->updated_at->diffForHumans() }}</time></a>
+            <a href="/likes/{{ $like->id }}"><time class="dt-published" datetime="{{ $like->updated_at->toISO8601String() }}" title="{{ $like->updated_at->toISO8601String() }}">{{ $like->updated_at->diffForHumans() }}</time></a>
         </div>
     </div>
 </div>

routes/web.php

@@ -211,14 +211,14 @@ Route::get('note/{id}', [NotesController::class, 'redirect']); // for legacy not
 // Likes
 Route::prefix('likes')->group(function () {
     Route::get('/', [LikesController::class, 'index']);
-    Route::get('/{like}', [LikesController::class, 'show'])->whereNumber('like');
+    Route::get('/{like}', [LikesController::class, 'show']);
 });
 
 // Bookmarks
 Route::prefix('bookmarks')->group(function () {
     Route::get('/', [BookmarksController::class, 'index']);
     Route::redirect('/tagged', '/bookmarks');
-    Route::get('/{bookmark}', [BookmarksController::class, 'show'])->whereNumber('bookmark');
+    Route::get('/{bookmark}', [BookmarksController::class, 'show']);
     Route::get('/tagged/{tag}', [BookmarksController::class, 'tagged']);
 });
 

tests/Feature/BookmarksTest.php

@@ -32,13 +32,6 @@ class BookmarksTest extends TestCase
         $response->assertViewIs('bookmarks.show');
     }
 
-    #[Test]
-    public function non_numeric_bookmark_id_gives_not_found_response(): void
-    {
-        $response = $this->get('/bookmarks/twcamp^share|twsrc^ios');
-        $response->assertNotFound();
-    }
-
     #[Test]
     public function when_bookmark_is_added_using_http_syntax_check_job_to_take_screenshot_is_invoked(): void
     {
@@ -92,10 +85,10 @@ class BookmarksTest extends TestCase
     }
 
     #[Test]
-    public function bookmark_uri_attribute_returns_correct_url(): void
+    public function bookmark_local_uri_attribute_returns_correct_url(): void
     {
         $bookmark = Bookmark::factory()->create();
-        $this->assertEquals(config('app.url').'/bookmarks/'.$bookmark->id, $bookmark->uri);
+        $this->assertEquals(config('app.url').'/bookmarks/'.$bookmark->id, $bookmark->local_uri);
     }
 
     #[Test]

tests/Feature/LikesTest.php

@@ -178,11 +178,4 @@ class LikesTest extends TestCase
         $response = $this->get('/likes/202');
         $response->assertNotFound();
     }
-
-    #[Test]
-    public function non_numeric_like_id_gives_not_found_response(): void
-    {
-        $response = $this->get('/likes/twcamp^share|twsrc^ios');
-        $response->assertNotFound();
-    }
 }

tests/Feature/MicropubControllerTest.php

@@ -8,8 +8,6 @@ use App\Jobs\SendWebMentions;
 use App\Jobs\SyndicateNoteToBluesky;
 use App\Jobs\SyndicateNoteToMastodon;
 use App\Models\Article;
-use App\Models\Bookmark;
-use App\Models\Like;
 use App\Models\Media;
 use App\Models\Note;
 use App\Models\Place;
@@ -881,50 +879,6 @@ class MicropubControllerTest extends TestCase
         $this->assertStringStartsWith(config('app.url').'/blog/', $response->headers->get('Location'));
     }
 
-    #[Test]
-    public function micropub_client_api_request_for_a_like_returns_our_permalink_in_the_location_header(): void
-    {
-        Queue::fake();
-
-        $response = $this->postJson(
-            '/api/post',
-            [
-                'type' => ['h-entry'],
-                'properties' => [
-                    'like-of' => ['https://example.org/liked-post'],
-                ],
-            ],
-            ['HTTP_Authorization' => 'Bearer '.$this->getToken()]
-        );
-
-        $like = Like::where('url', 'https://example.org/liked-post')->sole();
-        $response
-            ->assertStatus(201)
-            ->assertHeader('Location', config('app.url').'/likes/'.$like->id);
-    }
-
-    #[Test]
-    public function micropub_client_api_request_for_a_bookmark_returns_our_permalink_in_the_location_header(): void
-    {
-        Queue::fake();
-
-        $response = $this->postJson(
-            '/api/post',
-            [
-                'type' => ['h-entry'],
-                'properties' => [
-                    'bookmark-of' => ['https://example.org/bookmarked-page'],
-                ],
-            ],
-            ['HTTP_Authorization' => 'Bearer '.$this->getToken()]
-        );
-
-        $bookmark = Bookmark::where('url', 'https://example.org/bookmarked-page')->sole();
-        $response
-            ->assertStatus(201)
-            ->assertHeader('Location', config('app.url').'/bookmarks/'.$bookmark->id);
-    }
-
     #[Test]
     public function micropub_client_api_request_creates_an_unpublished_article_when_post_status_is_draft(): void
     {

tests/Unit/LikesTest.php

@@ -13,14 +13,6 @@ class LikesTest extends TestCase
 {
     use RefreshDatabase;
 
-    #[Test]
-    public function like_uri_attribute_returns_our_permalink(): void
-    {
-        $like = Like::factory()->create();
-
-        $this->assertEquals(config('app.url').'/likes/'.$like->id, $like->uri);
-    }
-
     #[Test]
     public function we_can_set_the_author_url(): void
     {