jonny/jonnybarnes.uk
Watch
1
0
Fork
You've already forked jonnybarnes.uk
 0
Code Issues 7 Pull requests Projects Releases 33 Packages Wiki Activity Actions

Add manual Micropub token generation for non-PKCE clients #132

Merged
jonny merged 1 commit from feature/manual-micropub-tokens into develop 2026-09-13 12:31:57 +02:00
Conversation 0 Commits 1 Files changed 12 +190 -2
jonny commented 2026-09-13 12:30:33 +02:00
Owner
Copy link

Summary

  • iA Writer's IndieAuth client predates PKCE support in the spec, so it can't complete the normal /auth authorization flow (rejected with "code_challenge is required").
  • Adds an admin-only form (/admin/tokens/create) to mint a Micropub token directly, reusing the existing TokenService, so it can be pasted into clients that support manual token entry instead of the IndieAuth flow.
  • The raw token is only ever shown once, immediately after generation, via a flashed session value — only its sha256 hash is persisted, matching the existing IndieAuth-issued token behaviour.

Test plan

  • ./vendor/bin/sail test — full suite passes (376 tests), including 5 new tests for create/store in tests/Feature/Admin/TokensTest.php
  • ./vendor/bin/sail pint --test — clean
  • npm run build (eslint/stylelint/lightningcss/esbuild) — clean
  • Manually exercised via Safari against local Sail: logged in, generated a token with create update scope, confirmed it's shown once and not on reload, confirmed curl -H "Authorization: Bearer <token>" /api/post returns 200 with the correct me/scope/client_id, and confirmed revoke still works

🤖 Generated with Claude Code

https://claude.ai/code/session_017USyUg8PwuoDcHP8pv5xjy

## Summary - iA Writer's IndieAuth client predates PKCE support in the spec, so it can't complete the normal `/auth` authorization flow (rejected with "code_challenge is required"). - Adds an admin-only form (`/admin/tokens/create`) to mint a Micropub token directly, reusing the existing `TokenService`, so it can be pasted into clients that support manual token entry instead of the IndieAuth flow. - The raw token is only ever shown once, immediately after generation, via a flashed session value — only its sha256 hash is persisted, matching the existing IndieAuth-issued token behaviour. ## Test plan - [x] `./vendor/bin/sail test` — full suite passes (376 tests), including 5 new tests for `create`/`store` in `tests/Feature/Admin/TokensTest.php` - [x] `./vendor/bin/sail pint --test` — clean - [x] `npm run build` (eslint/stylelint/lightningcss/esbuild) — clean - [x] Manually exercised via Safari against local Sail: logged in, generated a token with `create update` scope, confirmed it's shown once and not on reload, confirmed `curl -H "Authorization: Bearer <token>" /api/post` returns 200 with the correct `me`/`scope`/`client_id`, and confirmed revoke still works 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017USyUg8PwuoDcHP8pv5xjy 
iA Writer's IndieAuth client predates PKCE support in the spec, so it
can't complete the normal authorization flow. Add an admin form to
mint a token directly (reusing the existing TokenService), so it can
be pasted into clients that support manual token setup instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017USyUg8PwuoDcHP8pv5xjy
jonny merged commit 568ae78864 into develop 2026-09-13 12:31:57 +02:00
jonny deleted branch feature/manual-micropub-tokens 2026-09-13 12:31:57 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jonny/jonnybarnes.uk!132
No description provided.