Bring Micropub endpoint closer to the spec

- Detect form-encoded action=... requests, so form-encoded updates work
  and unhandled actions are no longer created as notes
- Default to h-entry when no type is given
- Read form-encoded photos from `photo` rather than `photos`
- Pass `category` through EntryData so bookmark tags are saved
- Accept single values for form-encoded multi-value properties
- Return 403 for insufficient_scope and 401 for invalid tokens
- Return 400 invalid_request for unsupported post types, update
  operations and models instead of reporting them as 500s

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Models/Bookmark.php

@@ -25,7 +25,7 @@ class Bookmark extends Model
         return $this->belongsToMany('App\Models\Tag');
     }
 
-    protected function localUri(): Attribute
+    protected function uri(): Attribute
     {
         return Attribute::get(
             get: fn () => config('app.url').'/bookmarks/'.$this->id,

app/Models/Like.php

@@ -18,6 +18,13 @@ class Like extends Model
     use FilterHtml;
     use HasFactory;
 
+    protected function uri(): Attribute
+    {
+        return Attribute::get(
+            get: fn () => config('app.url').'/likes/'.$this->id,
+        );
+    }
+
     protected function url(): Attribute
     {
         return Attribute::set(

app/Services/Micropub/Handlers/EntryHandler.php

@@ -35,7 +35,7 @@ class EntryHandler implements MicropubHandlerInterface
 
         $dataArray = $data->toArray();
         $location = match (true) {
-            isset($dataArray['like-of']) => resolve(LikeService::class)->create($dataArray)->url,
+            isset($dataArray['like-of']) => resolve(LikeService::class)->create($dataArray)->uri,
             isset($dataArray['bookmark-of']) => resolve(BookmarkService::class)->create($dataArray)->uri,
             isset($dataArray['name']) => resolve(ArticleService::class)->create($dataArray)->uri,
             default => resolve(NoteService::class)->create($dataArray)->uri,

database/migrations/2026_11_01_120000_drop_shorturl_from_notes_table.php

@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('notes', function (Blueprint $table) {
+            $table->dropColumn('shorturl');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('notes', function (Blueprint $table) {
+            $table->string('shorturl', 20)->nullable();
+        });
+    }
+};

resources/views/templates/like.blade.php

@@ -20,7 +20,7 @@
             </blockquote>
         @endisset
         <div>
-            <a href="/likes/{{ $like->id }}"><time class="dt-published" datetime="{{ $like->updated_at->toISO8601String() }}" title="{{ $like->updated_at->toISO8601String() }}">{{ $like->updated_at->diffForHumans() }}</time></a>
+            <a href="{{ $like->uri }}"><time class="dt-published" datetime="{{ $like->updated_at->toISO8601String() }}" title="{{ $like->updated_at->toISO8601String() }}">{{ $like->updated_at->diffForHumans() }}</time></a>
         </div>
     </div>
 </div>

routes/web.php

@@ -211,14 +211,14 @@ Route::get('note/{id}', [NotesController::class, 'redirect']); // for legacy not
 // Likes
 Route::prefix('likes')->group(function () {
     Route::get('/', [LikesController::class, 'index']);
-    Route::get('/{like}', [LikesController::class, 'show']);
+    Route::get('/{like}', [LikesController::class, 'show'])->whereNumber('like');
 });
 
 // Bookmarks
 Route::prefix('bookmarks')->group(function () {
     Route::get('/', [BookmarksController::class, 'index']);
     Route::redirect('/tagged', '/bookmarks');
-    Route::get('/{bookmark}', [BookmarksController::class, 'show']);
+    Route::get('/{bookmark}', [BookmarksController::class, 'show'])->whereNumber('bookmark');
     Route::get('/tagged/{tag}', [BookmarksController::class, 'tagged']);
 });
 

tests/Feature/BookmarksTest.php

@@ -32,6 +32,13 @@ class BookmarksTest extends TestCase
         $response->assertViewIs('bookmarks.show');
     }
 
+    #[Test]
+    public function non_numeric_bookmark_id_gives_not_found_response(): void
+    {
+        $response = $this->get('/bookmarks/twcamp^share|twsrc^ios');
+        $response->assertNotFound();
+    }
+
     #[Test]
     public function when_bookmark_is_added_using_http_syntax_check_job_to_take_screenshot_is_invoked(): void
     {
@@ -85,10 +92,10 @@ class BookmarksTest extends TestCase
     }
 
     #[Test]
-    public function bookmark_local_uri_attribute_returns_correct_url(): void
+    public function bookmark_uri_attribute_returns_correct_url(): void
     {
         $bookmark = Bookmark::factory()->create();
-        $this->assertEquals(config('app.url').'/bookmarks/'.$bookmark->id, $bookmark->local_uri);
+        $this->assertEquals(config('app.url').'/bookmarks/'.$bookmark->id, $bookmark->uri);
     }
 
     #[Test]

tests/Feature/LikesTest.php

@@ -178,4 +178,11 @@ class LikesTest extends TestCase
         $response = $this->get('/likes/202');
         $response->assertNotFound();
     }
+
+    #[Test]
+    public function non_numeric_like_id_gives_not_found_response(): void
+    {
+        $response = $this->get('/likes/twcamp^share|twsrc^ios');
+        $response->assertNotFound();
+    }
 }

tests/Feature/MicropubControllerTest.php

@@ -8,6 +8,8 @@ use App\Jobs\SendWebMentions;
 use App\Jobs\SyndicateNoteToBluesky;
 use App\Jobs\SyndicateNoteToMastodon;
 use App\Models\Article;
+use App\Models\Bookmark;
+use App\Models\Like;
 use App\Models\Media;
 use App\Models\Note;
 use App\Models\Place;
@@ -879,6 +881,50 @@ class MicropubControllerTest extends TestCase
         $this->assertStringStartsWith(config('app.url').'/blog/', $response->headers->get('Location'));
     }
 
+    #[Test]
+    public function micropub_client_api_request_for_a_like_returns_our_permalink_in_the_location_header(): void
+    {
+        Queue::fake();
+
+        $response = $this->postJson(
+            '/api/post',
+            [
+                'type' => ['h-entry'],
+                'properties' => [
+                    'like-of' => ['https://example.org/liked-post'],
+                ],
+            ],
+            ['HTTP_Authorization' => 'Bearer '.$this->getToken()]
+        );
+
+        $like = Like::where('url', 'https://example.org/liked-post')->sole();
+        $response
+            ->assertStatus(201)
+            ->assertHeader('Location', config('app.url').'/likes/'.$like->id);
+    }
+
+    #[Test]
+    public function micropub_client_api_request_for_a_bookmark_returns_our_permalink_in_the_location_header(): void
+    {
+        Queue::fake();
+
+        $response = $this->postJson(
+            '/api/post',
+            [
+                'type' => ['h-entry'],
+                'properties' => [
+                    'bookmark-of' => ['https://example.org/bookmarked-page'],
+                ],
+            ],
+            ['HTTP_Authorization' => 'Bearer '.$this->getToken()]
+        );
+
+        $bookmark = Bookmark::where('url', 'https://example.org/bookmarked-page')->sole();
+        $response
+            ->assertStatus(201)
+            ->assertHeader('Location', config('app.url').'/bookmarks/'.$bookmark->id);
+    }
+
     #[Test]
     public function micropub_client_api_request_creates_an_unpublished_article_when_post_status_is_draft(): void
     {

tests/Unit/LikesTest.php

@@ -13,6 +13,14 @@ class LikesTest extends TestCase
 {
     use RefreshDatabase;
 
+    #[Test]
+    public function like_uri_attribute_returns_our_permalink(): void
+    {
+        $like = Like::factory()->create();
+
+        $this->assertEquals(config('app.url').'/likes/'.$like->id, $like->uri);
+    }
+
     #[Test]
     public function we_can_set_the_author_url(): void
     {