Jonny Barnes
9c9a6392c8
Implements the current IndieAuth spec's dedicated /revocation endpoint so clients can self-revoke a token (e.g. on user sign-out), rather than only supporting revocation via the admin side. Always responds 200 per spec, whether the token was found or not, so callers can't use it to probe token validity. Skips the legacy action=revoke-on-/token fallback the spec mentions for older clients, since the only real client here is already being updated to use the current endpoint. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L
26 lines
1,020 B
PHP
26 lines
1,020 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests\Feature;
|
|
|
|
use PHPUnit\Framework\Attributes\Test;
|
|
use Tests\TestCase;
|
|
|
|
class HeaderLinkTest extends TestCase
|
|
{
|
|
#[Test]
|
|
public function it_should_see_the_indieweb_related_link_headers(): void
|
|
{
|
|
$response = $this->get('/');
|
|
|
|
$linkHeaders = $response->headers->allPreserveCaseWithoutCookies()['Link'];
|
|
|
|
$this->assertSame('<'.config('app.url').'/.well-known/indieauth-server>; rel="indieauth-metadata"', $linkHeaders[0]);
|
|
$this->assertSame('<'.config('app.url').'/auth>; rel="authorization_endpoint"', $linkHeaders[1]);
|
|
$this->assertSame('<'.config('app.url').'/token>; rel="token_endpoint"', $linkHeaders[2]);
|
|
$this->assertSame('<'.config('app.url').'/revocation>; rel="revocation_endpoint"', $linkHeaders[3]);
|
|
$this->assertSame('<'.config('app.url').'/api/post>; rel="micropub"', $linkHeaders[4]);
|
|
$this->assertSame('<'.config('app.url').'/webmention>; rel="webmention"', $linkHeaders[5]);
|
|
}
|
|
}
|