[MTM] Micropub improvements and other fixes #152

Merged

jonny merged 9 commits from develop into main

2026-11-07 16:17:46 +01:00

jonny commented

2026-11-07 16:17:30 +01:00

Owner

The main piece of work here is improving compliance with the Micorpub spec.

We have improved the permalinks for likes and bookmarks.

The theme selector now stores ths selected theme across page loads.

The main piece of work here is improving compliance with the Micorpub spec. We have improved the permalinks for likes and bookmarks. The theme selector now stores ths selected theme across page loads.

jonny added 9 commits

2026-11-07 16:17:30 +01:00

Persist the theme selector choice across page loads c3cf597950

Save an explicit light/dark choice to localStorage and clear it when
switching back to system. An inline head script applies the saved
colour scheme before first paint to avoid a flash of the system theme.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Return 404 for non-numeric like and bookmark IDs 7ce256baa5

Constrain the likes/{like} and bookmarks/{bookmark} routes to numeric
IDs. Previously a junk URL such as /likes/twcamp^share|twsrc^ios was
passed to route model binding, and Postgres rejected the text-vs-integer
comparison with a QueryException, returning a 500 instead of a 404.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Use uri for the like and bookmark permalinks 5481956d78

`uri` is the attribute every other postable model uses for its absolute
permalink on this site. Add it to Like, which had none, and rename
Bookmark's `local_uri` to match. `url` stays as the thing being liked or
bookmarked.

Refs #148

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Return our permalink in the Micropub Location header for likes e8f2535cd1

Likes returned `url`, which is the liked post rather than our page. Use
`uri` instead. Bookmarks already asked for `uri`, which didn't exist until
the previous commit, so their Location header was empty.

Neither case had a test, so assert the header value for both.

Refs #148

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Link to likes through the uri attribute in the like template 73b9668088

Refs #148

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Drop the unused notes.shorturl column cc2ff2b2a2

The short domain is gone and nothing reads or writes this column any more.

Refs #148

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Bring Micropub endpoint closer to the spec 6e96ca8304

- Detect form-encoded action=... requests, so form-encoded updates work
  and unhandled actions are no longer created as notes
- Default to h-entry when no type is given
- Read form-encoded photos from `photo` rather than `photos`
- Pass `category` through EntryData so bookmark tags are saved
- Accept single values for form-encoded multi-value properties
- Return 403 for insufficient_scope and 401 for invalid tokens
- Return 400 invalid_request for unsupported post types, update
  operations and models instead of reporting them as 500s

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Add Micropub q=source and reject malformed requests 3dce7d3a60

Servers supporting updates must support the source content query. It
was falling through to the token response, so clients got a 200 with no
post in it. Return the raw note as microformats2 JSON, honouring
properties[].

Malformed requests could cause a 500 or worse. A replace value sent as a
string overwrote the note with its first character, because $value[0]
indexes the string. Validate update operations before applying any of
them, and return invalid_request for wrongly shaped properties, unknown
or malformed q values, and missing update URLs.

Share URL resolution between updates and q=source in NoteResolver, which
also rejects URLs on other hosts and invalid note IDs. Those IDs used to
decode to a real note because invalid characters were skipped.

Allow photo objects without alt text, and parse the published date
before saving so that an invalid date doesn't leave a stray note behind.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Reject Micropub updates that would do nothing 5483712e29

Updating a property we don't support returned a 200 with no change, so
clients believed the update had worked. Return invalid_request instead,
and apply nothing if any part of the request is unsupported.

This also covers empty operations, syndication URLs we have nowhere to
store, and photos added without an https URL, all of which were being
silently ignored.

Mastodon and Bluesky URLs can now be added and deleted through updates,
as they are our active syndication targets and q=source returns them.
Mastodon can be on any host, so accept the instances we have syndication
targets for rather than hard-coding one.

Stop reading instagram_url in q=source, as notes have no such column.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

jonny changed title from ~~[MTM] Micoprub improvements and other fixes~~ to [MTM] Micropub improvements and other fixes

2026-11-07 16:17:40 +01:00

jonny merged commit 4b26624b39 into main

2026-11-07 16:17:46 +01:00

jonny referenced this pull request from a commit

2026-11-07 16:17:48 +01:00

Merge pull request '[MTM] Micropub improvements and other fixes' (#152) from develop into main