@geekity/cms 0.12.0 → 0.14.0

package/dist/indieauth/consent.js

@@ -0,0 +1,185 @@
+import { findUserById, listUsers } from '../admin/accounts.js';
+import { ADMIN_PREFIX } from '../admin/session.js';
+import { effectiveBaseUrl, readSiteSettings } from '../admin/settings.js';
+import { ADMIN_TEMPLATES } from '../admin/templates.js';
+import { isPrivateHost } from '../webmention/public-address.js';
+import { fetchClientInformation, fetchClientLogo } from './client.js';
+import { AUTHORIZATION_PATH, authorizationServerMetadata } from './discovery.js';
+import { meForSignIn } from './identity.js';
+import { profileResponse, redeemCode, redemptionForm } from './redeem.js';
+import { parseAuthorizationRequest } from './request.js';
+/**
+ * Where the person approves or denies a sign-in. Under `/admin`, so the admin
+ * guard signs them in first and checks the form's CSRF token.
+ */
+export const CONSENT_PATH = `${ADMIN_PREFIX}/indieauth/consent`;
+/** What each scope lets a client learn or do, as the consent and connected apps screens say it. */
+export const SCOPE_LABELS = {
+    profile: 'Your name, URL and photo',
+    email: 'Your email address',
+    create: 'Create posts as you',
+    update: 'Edit your posts',
+    delete: 'Delete your posts',
+    media: 'Upload media to your site',
+};
+/**
+ * The authorization endpoint (TASK-158, TASK-159).
+ *
+ * A GET is the person arriving from a client, and is handed, query and all,
+ * to the consent screen. The screen is under `/admin` so that the admin's
+ * guard, login and headers apply to it; the endpoint is not, because a POST
+ * here is a client redeeming its code for the profile, with no admin session.
+ * No access token is issued on this path; that is the token endpoint's job.
+ * Not exempt from maintenance mode: the identity URLs that advertise it
+ * answer 503 then too.
+ */
+export function mountAuthorizationEndpoint(app) {
+    app.get(AUTHORIZATION_PATH, (c) => c.redirect(`${CONSENT_PATH}${new URL(c.req.url).search}`, 302));
+    app.post(AUTHORIZATION_PATH, async (c) => {
+        c.header('cache-control', 'no-store');
+        const { config } = c.var;
+        const form = redemptionForm(await c.req.parseBody());
+        const redeemed = redeemCode(c.var.indieauth.codes, form);
+        if (!redeemed.ok) {
+            return c.json({ error: redeemed.error, error_description: redeemed.description }, 400);
+        }
+        const { grant } = redeemed;
+        const user = findUserById(config.dataDir, grant.userId);
+        if (user === undefined) {
+            return c.json({ error: 'invalid_grant', error_description: 'The person who approved this is gone.' }, 400);
+        }
+        const baseUrl = effectiveBaseUrl(config, readSiteSettings(config.contentDir));
+        return c.json(profileResponse(grant, user, baseUrl));
+    });
+}
+/** Register the consent screen and the Approve and Deny buttons behind it. */
+export function mountConsentScreen(app, options) {
+    const { render } = options;
+    function refuse(c, message) {
+        c.status(400);
+        return render(c, ADMIN_TEMPLATES.indieauthRefused, { message });
+    }
+    app.get(CONSENT_PATH, async (c) => {
+        const { config } = c.var;
+        const user = signedInUser(c);
+        if (user === undefined)
+            return c.redirect(ADMIN_PREFIX, 302);
+        const settings = readSiteSettings(config.contentDir);
+        const baseUrl = effectiveBaseUrl(config, settings);
+        const parsed = parseAuthorizationRequest(new URL(c.req.url).searchParams, baseUrl);
+        if (parsed.kind === 'unredirectable')
+            return refuse(c, parsed.message);
+        const { clientId, redirectUri } = parsed.kind === 'valid' ? parsed.request : parsed;
+        const client = await clientInformation(c, clientId);
+        if (!mayRedirect(clientId, redirectUri, client)) {
+            return refuse(c, 'The app asked to send you back to an address it has not published as its own.');
+        }
+        if (parsed.kind === 'refused') {
+            return c.redirect(answer(redirectUri, baseUrl, {
+                error: parsed.error,
+                error_description: parsed.description,
+                state: parsed.state,
+            }), 302);
+        }
+        const { request } = parsed;
+        const me = meForSignIn(request.me, user, {
+            baseUrl,
+            users: listUsers(config.dataDir),
+            settings,
+        });
+        const pending = c.var.indieauth.consents.put({
+            request,
+            userId: user.id,
+            me,
+            ...(client.name === undefined ? {} : { clientName: client.name }),
+        });
+        const redirect = new URL(redirectUri);
+        const logo = client.logo === undefined
+            ? undefined
+            : await fetchClientLogo(client.logo, { lookup: config.hostLookup });
+        c.set('cspFormAction', formActionSource(redirect));
+        return render(c, ADMIN_TEMPLATES.indieauthConsent, {
+            consentUrl: CONSENT_PATH,
+            pending,
+            client: {
+                name: client.name ?? clientId,
+                id: clientId,
+                named: client.name !== undefined,
+                logo,
+            },
+            redirectHost: redirect.host === '' ? redirect.protocol : redirect.host,
+            loopback: redirect.hostname !== '' && isPrivateHost(redirect.hostname),
+            identity: me,
+            resource: request.resource,
+            scopes: request.scopes.map((scope) => ({ name: scope, label: SCOPE_LABELS[scope] })),
+        });
+    });
+    app.post(CONSENT_PATH, async (c) => {
+        const { config } = c.var;
+        const user = signedInUser(c);
+        if (user === undefined)
+            return c.redirect(ADMIN_PREFIX, 302);
+        const body = await c.req.parseBody({ all: true });
+        const pending = c.var.indieauth.consents.take(text(body['request']));
+        if (pending?.userId !== user.id) {
+            return refuse(c, 'This sign-in was already answered or has expired. Start again from the app.');
+        }
+        const { request } = pending;
+        const baseUrl = effectiveBaseUrl(config, readSiteSettings(config.contentDir));
+        if (text(body['decision']) !== 'approve') {
+            return c.redirect(answer(request.redirectUri, baseUrl, { error: 'access_denied', state: request.state }), 303);
+        }
+        const ticked = new Set([body['scope']].flat().map(text));
+        const code = c.var.indieauth.codes.put({
+            clientId: request.clientId,
+            ...(pending.clientName === undefined ? {} : { clientName: pending.clientName }),
+            redirectUri: request.redirectUri,
+            codeChallenge: request.codeChallenge,
+            userId: user.id,
+            me: pending.me,
+            scopes: request.scopes.filter((scope) => ticked.has(scope)),
+            ...(request.resource === undefined ? {} : { resource: request.resource }),
+        });
+        return c.redirect(answer(request.redirectUri, baseUrl, { code, state: request.state }), 303);
+    });
+}
+function signedInUser(c) {
+    const userId = c.var.session?.userId;
+    return userId == null ? undefined : findUserById(c.var.config.dataDir, userId);
+}
+/** What the client says about itself, or nothing when it could not be read. */
+async function clientInformation(c, clientId) {
+    const fetched = await fetchClientInformation(clientId, { lookup: c.var.config.hostLookup });
+    if (fetched.ok)
+        return fetched.client;
+    console.warn(`Could not read IndieAuth client ${clientId}: ${fetched.reason}`);
+    return { redirectUris: [] };
+}
+/**
+ * Whether a client may be sent back to `redirectUri`: always on its own
+ * origin, and elsewhere only when its metadata lists that exact URL.
+ */
+function mayRedirect(clientId, redirectUri, client) {
+    const target = new URL(redirectUri);
+    const sameOrigin = (target.protocol === 'https:' || target.protocol === 'http:') &&
+        target.origin === new URL(clientId).origin;
+    return sameOrigin || client.redirectUris.includes(redirectUri);
+}
+/** `redirectUri` with the answer and the issuer added to its query. */
+function answer(redirectUri, baseUrl, fields) {
+    const url = new URL(redirectUri);
+    for (const [name, value] of Object.entries(fields)) {
+        if (value !== undefined)
+            url.searchParams.set(name, value);
+    }
+    url.searchParams.set('iss', authorizationServerMetadata(baseUrl).issuer);
+    return url.href;
+}
+/** The CSP source that lets a form's redirect reach `url`. */
+function formActionSource(url) {
+    return url.protocol === 'https:' || url.protocol === 'http:' ? url.origin : url.protocol;
+}
+function text(value) {
+    return typeof value === 'string' ? value : '';
+}
+//# sourceMappingURL=consent.js.map

package/dist/indieauth/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/indieauth/consent.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAG/D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAGzD;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,YAAY,oBAAoB,CAAC;AAEhE,mGAAmG;AACnG,MAAM,CAAC,MAAM,YAAY,GAAoC;IAC3D,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,oBAAoB;IAC3B,MAAM,EAAE,qBAAqB;IAC7B,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,mBAAmB;IAC3B,KAAK,EAAE,2BAA2B;CACnC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAqB;IAC9D,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAChC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAC/D,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QACzB,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;QAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,uCAAuC,EAAE,EACtF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,GAAqB,EAAE,OAAgC;IACxF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE3B,SAAS,MAAM,CAAC,CAAsB,EAAE,OAAe;QACrD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,MAAM,CAAC,CAAC,EAAE,eAAe,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnF,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACpF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CACX,CAAC,EACD,+EAA+E,CAChF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,QAAQ,CACf,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE;gBAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,iBAAiB,EAAE,MAAM,CAAC,WAAW;gBACrC,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,EACF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE;YACvC,OAAO;YACP,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;YAChC,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC3C,OAAO;YACP,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,EAAE;YACF,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;SAClE,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAExE,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,CAAC,EAAE,eAAe,CAAC,gBAAgB,EAAE;YACjD,UAAU,EAAE,YAAY;YACxB,OAAO;YACP,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ;gBAC7B,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS;gBAChC,IAAI;aACL;YACD,YAAY,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI;YACtE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KAAK,EAAE,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtE,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACrF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAElD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YAChC,OAAO,MAAM,CACX,CAAC,EACD,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAC5B,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9E,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,CAAC,QAAQ,CACf,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,EACtF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC;YACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/E,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3D,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;SAC1E,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,CAAsB;IAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;IACrC,OAAO,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACjF,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,iBAAiB,CAC9B,CAAsB,EACtB,QAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5F,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,mCAAmC,QAAQ,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,WAAmB,EAAE,MAAyB;IACnF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,UAAU,GACd,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;QAC7D,MAAM,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,UAAU,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjE,CAAC;AAED,uEAAuE;AACvE,SAAS,MAAM,CACb,WAAmB,EACnB,OAAe,EACf,MAA0C;IAE1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,2BAA2B,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,8DAA8D;AAC9D,SAAS,gBAAgB,CAAC,GAAQ;IAChC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC3F,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC"}

package/dist/indieauth/discovery.d.ts

@@ -0,0 +1,87 @@
+import type { Hono, MiddlewareHandler } from 'hono';
+import type { GeekityEnv } from '../env.ts';
+/** Where the authorization server metadata document is published. */
+export declare const INDIEAUTH_METADATA_PATH = "/_geekity/indieauth/metadata";
+/** RFC 8414's well-known location for the same document. */
+export declare const OAUTH_METADATA_WELL_KNOWN_PATH = "/.well-known/oauth-authorization-server";
+/** Where a client sends the person to approve a sign-in (TASK-158). */
+export declare const AUTHORIZATION_PATH = "/_geekity/indieauth/auth";
+/** Where a client redeems a code for an access token (TASK-160). */
+export declare const TOKEN_PATH = "/_geekity/indieauth/token";
+/** Where a resource server asks what a token is good for (TASK-161). */
+export declare const INTROSPECTION_PATH = "/_geekity/indieauth/introspect";
+/** Where a client hands a token back to end it (TASK-161). */
+export declare const REVOCATION_PATH = "/_geekity/indieauth/revoke";
+/** Where a client asks for the profile a token was approved to see (TASK-161). */
+export declare const USERINFO_PATH = "/_geekity/indieauth/userinfo";
+/**
+ * RFC 9728's well-known location for the protected resource metadata, which
+ * an MCP client reads to learn where to sign in (TASK-161).
+ */
+export declare const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+/**
+ * The scopes a client may ask for: the profile ones (TASK-158) and the
+ * Micropub ones a token is issued for (TASK-160).
+ */
+export declare const SCOPES: readonly ['profile', 'email', 'create', 'update', 'delete', 'media'];
+/** RFC 8414 authorization server metadata, as the IndieAuth spec profiles it. */
+export interface AuthorizationServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    introspection_endpoint: string;
+    revocation_endpoint: string;
+    userinfo_endpoint: string;
+    response_types_supported: readonly string[];
+    grant_types_supported: readonly string[];
+    code_challenge_methods_supported: readonly string[];
+    scopes_supported: readonly string[];
+    authorization_response_iss_parameter_supported: boolean;
+    /**
+     * That a client may use the URL of a JSON client metadata document as its
+     * client_id, which the MCP authorization spec asks for (TASK-158).
+     */
+    client_id_metadata_document_supported: boolean;
+}
+/**
+ * The metadata for a site at `baseUrl`.
+ *
+ * The issuer is the base URL with no trailing slash: RFC 8414 builds the
+ * well-known URL by putting `/.well-known/oauth-authorization-server` between
+ * the issuer's host and its path, so an issuer with no path is the one whose
+ * document lives at exactly that URL, and a client that checks the two agree
+ * finds they do.
+ */
+export declare function authorizationServerMetadata(baseUrl: string): AuthorizationServerMetadata;
+/** RFC 9728 protected resource metadata. */
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: readonly string[];
+    scopes_supported: readonly string[];
+    bearer_methods_supported: readonly string[];
+}
+/**
+ * The protected resource metadata for a site at `baseUrl`: the site is the
+ * resource, and its own authorization server is the one to sign in at. A
+ * token may come in the header or, as Micropub allows, in a form body.
+ */
+export declare function protectedResourceMetadata(baseUrl: string): ProtectedResourceMetadata;
+/** The site's base URL as every absolute URL it hands out is built from. */
+export declare function siteBaseUrl(c: {
+    var: Pick<GeekityEnv['Variables'], 'config'>;
+}): string;
+/**
+ * Mount the authorization server metadata at its own path and at the
+ * well-known one, and the protected resource metadata at its well-known one.
+ */
+export declare function mountIndieAuthDiscovery(app: Hono<GeekityEnv>): void;
+/**
+ * Point every identity URL at the metadata, with a `Link` header and a
+ * `<link>` before `</head>` (TASK-157).
+ *
+ * Added to the response rather than left to the layouts so that every theme
+ * carries it, a custom one that replaces the packaged base layout included. A
+ * 404 for a username nobody has is left alone: it is nobody's identity.
+ */
+export declare const advertiseIndieAuthMetadata: MiddlewareHandler<GeekityEnv>;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/indieauth/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/indieauth/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAI5C,qEAAqE;AACrE,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE,4DAA4D;AAC5D,eAAO,MAAM,8BAA8B,4CAA4C,CAAC;AAExF,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAE7D,oEAAoE;AACpE,eAAO,MAAM,UAAU,8BAA8B,CAAC;AAEtD,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AAEnE,8DAA8D;AAC9D,eAAO,MAAM,eAAe,+BAA+B,CAAC;AAE5D,kFAAkF;AAClF,eAAO,MAAM,aAAa,iCAAiC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,gCAAgC,0CAA0C,CAAC;AAExF;;;GAGG;AACH,eAAO,MAAM,MAAM,YAAI,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAC;AAE3F,iFAAiF;AACjF,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,gCAAgC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,8CAA8C,EAAE,OAAO,CAAC;IACxD;;;OAGG;IACH,qCAAqC,EAAE,OAAO,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,2BAA2B,CAexF;AAED,4CAA4C;AAC5C,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,yBAAyB,CAOpF;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,CAAC,EAAE;IAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAA;CAAE,GAAG,MAAM,CAGvF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAOnE;AAeD;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,iBAAiB,CAAC,UAAU,CAiBpE,CAAC"}

package/dist/indieauth/discovery.js

@@ -0,0 +1,127 @@
+import { effectiveBaseUrl, readSiteSettings } from '../admin/settings.js';
+import { parseAuthorPath } from '../web/authors.js';
+import { requestPath } from '../web/routes.js';
+/** Where the authorization server metadata document is published. */
+export const INDIEAUTH_METADATA_PATH = '/_geekity/indieauth/metadata';
+/** RFC 8414's well-known location for the same document. */
+export const OAUTH_METADATA_WELL_KNOWN_PATH = '/.well-known/oauth-authorization-server';
+/** Where a client sends the person to approve a sign-in (TASK-158). */
+export const AUTHORIZATION_PATH = '/_geekity/indieauth/auth';
+/** Where a client redeems a code for an access token (TASK-160). */
+export const TOKEN_PATH = '/_geekity/indieauth/token';
+/** Where a resource server asks what a token is good for (TASK-161). */
+export const INTROSPECTION_PATH = '/_geekity/indieauth/introspect';
+/** Where a client hands a token back to end it (TASK-161). */
+export const REVOCATION_PATH = '/_geekity/indieauth/revoke';
+/** Where a client asks for the profile a token was approved to see (TASK-161). */
+export const USERINFO_PATH = '/_geekity/indieauth/userinfo';
+/**
+ * RFC 9728's well-known location for the protected resource metadata, which
+ * an MCP client reads to learn where to sign in (TASK-161).
+ */
+export const PROTECTED_RESOURCE_METADATA_PATH = '/.well-known/oauth-protected-resource';
+/**
+ * The scopes a client may ask for: the profile ones (TASK-158) and the
+ * Micropub ones a token is issued for (TASK-160).
+ */
+export const SCOPES = ['profile', 'email', 'create', 'update', 'delete', 'media'];
+/**
+ * The metadata for a site at `baseUrl`.
+ *
+ * The issuer is the base URL with no trailing slash: RFC 8414 builds the
+ * well-known URL by putting `/.well-known/oauth-authorization-server` between
+ * the issuer's host and its path, so an issuer with no path is the one whose
+ * document lives at exactly that URL, and a client that checks the two agree
+ * finds they do.
+ */
+export function authorizationServerMetadata(baseUrl) {
+    return {
+        issuer: baseUrl,
+        authorization_endpoint: `${baseUrl}${AUTHORIZATION_PATH}`,
+        token_endpoint: `${baseUrl}${TOKEN_PATH}`,
+        introspection_endpoint: `${baseUrl}${INTROSPECTION_PATH}`,
+        revocation_endpoint: `${baseUrl}${REVOCATION_PATH}`,
+        userinfo_endpoint: `${baseUrl}${USERINFO_PATH}`,
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code', 'refresh_token'],
+        code_challenge_methods_supported: ['S256'],
+        scopes_supported: SCOPES,
+        authorization_response_iss_parameter_supported: true,
+        client_id_metadata_document_supported: true,
+    };
+}
+/**
+ * The protected resource metadata for a site at `baseUrl`: the site is the
+ * resource, and its own authorization server is the one to sign in at. A
+ * token may come in the header or, as Micropub allows, in a form body.
+ */
+export function protectedResourceMetadata(baseUrl) {
+    return {
+        resource: baseUrl,
+        authorization_servers: [authorizationServerMetadata(baseUrl).issuer],
+        scopes_supported: SCOPES,
+        bearer_methods_supported: ['header', 'body'],
+    };
+}
+/** The site's base URL as every absolute URL it hands out is built from. */
+export function siteBaseUrl(c) {
+    const { config } = c.var;
+    return effectiveBaseUrl(config, readSiteSettings(config.contentDir));
+}
+/**
+ * Mount the authorization server metadata at its own path and at the
+ * well-known one, and the protected resource metadata at its well-known one.
+ */
+export function mountIndieAuthDiscovery(app) {
+    for (const pathname of [INDIEAUTH_METADATA_PATH, OAUTH_METADATA_WELL_KNOWN_PATH]) {
+        app.get(pathname, (c) => c.json(authorizationServerMetadata(siteBaseUrl(c))));
+    }
+    app.get(PROTECTED_RESOURCE_METADATA_PATH, (c) => c.json(protectedResourceMetadata(siteBaseUrl(c))));
+}
+/**
+ * Whether a path is an identity URL a person may type into a sign-in form:
+ * the root, and every author archive's first page (decision-23).
+ *
+ * The root is advertised on a multi-author site too, where it names nobody: a
+ * person who types it still reaches this server, signs in as whoever they log
+ * in as, and the client is handed that user's author URL, which shares the
+ * host and advertises the same server.
+ */
+function isIdentityPath(pathname) {
+    return pathname === '/' || parseAuthorPath(pathname)?.pageNumber === 0;
+}
+/**
+ * Point every identity URL at the metadata, with a `Link` header and a
+ * `<link>` before `</head>` (TASK-157).
+ *
+ * Added to the response rather than left to the layouts so that every theme
+ * carries it, a custom one that replaces the packaged base layout included. A
+ * 404 for a username nobody has is left alone: it is nobody's identity.
+ */
+export const advertiseIndieAuthMetadata = async (c, next) => {
+    await next();
+    if (!isIdentityPath(requestPath(c)))
+        return;
+    const { status } = c.res;
+    if (status !== 304 && (status < 200 || status >= 300))
+        return;
+    const href = `${siteBaseUrl(c)}${INDIEAUTH_METADATA_PATH}`;
+    c.res.headers.append('link', `<${href}>; rel="indieauth-metadata"`);
+    if (status === 304 || !(c.res.headers.get('content-type') ?? '').startsWith('text/html'))
+        return;
+    const headers = new Headers(c.res.headers);
+    headers.delete('content-length');
+    const body = withHeadLink(await c.res.text(), `<link rel="indieauth-metadata" href="${href}">`);
+    // Cleared first, because assigning over a response copies its headers onto
+    // the new one.
+    c.res = undefined;
+    c.res = new Response(body, { status, headers });
+};
+/** `html` with `link` just before its `</head>`, or unchanged when it has none. */
+function withHeadLink(html, link) {
+    const head = /<\/head\s*>/i.exec(html);
+    if (head === null)
+        return html;
+    return `${html.slice(0, head.index)}${link}${html.slice(head.index)}`;
+}
+//# sourceMappingURL=discovery.js.map

package/dist/indieauth/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/indieauth/discovery.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE1E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,qEAAqE;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAEtE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,8BAA8B,GAAG,yCAAyC,CAAC;AAExF,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAE7D,oEAAoE;AACpE,MAAM,CAAC,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAEtD,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAEnE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAE5D,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAG,8BAA8B,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAExF;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAC;AAsB3F;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAe;IACzD,OAAO;QACL,MAAM,EAAE,OAAO;QACf,sBAAsB,EAAE,GAAG,OAAO,GAAG,kBAAkB,EAAE;QACzD,cAAc,EAAE,GAAG,OAAO,GAAG,UAAU,EAAE;QACzC,sBAAsB,EAAE,GAAG,OAAO,GAAG,kBAAkB,EAAE;QACzD,mBAAmB,EAAE,GAAG,OAAO,GAAG,eAAe,EAAE;QACnD,iBAAiB,EAAE,GAAG,OAAO,GAAG,aAAa,EAAE;QAC/C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,gBAAgB,EAAE,MAAM;QACxB,8CAA8C,EAAE,IAAI;QACpD,qCAAqC,EAAE,IAAI;KAC5C,CAAC;AACJ,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,qBAAqB,EAAE,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QACpE,gBAAgB,EAAE,MAAM;QACxB,wBAAwB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,CAAmD;IAC7E,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IACzB,OAAO,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAqB;IAC3D,KAAK,MAAM,QAAQ,IAAI,CAAC,uBAAuB,EAAE,8BAA8B,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,gCAAgC,EAAE,CAAC,CAAC,EAAE,EAAE,CAC9C,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAClD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,UAAU,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACzF,MAAM,IAAI,EAAE,CAAC;IACb,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO;IAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IACzB,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;QAAE,OAAO;IAE9D,MAAM,IAAI,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,uBAAuB,EAAE,CAAC;IAC3D,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,6BAA6B,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO;IAEjG,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,wCAAwC,IAAI,IAAI,CAAC,CAAC;IAChG,2EAA2E;IAC3E,eAAe;IACf,CAAC,CAAC,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC,CAAC,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,mFAAmF;AACnF,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACxE,CAAC"}

package/dist/indieauth/grants.d.ts

@@ -0,0 +1,57 @@
+import type { Clock } from '../content/store.ts';
+import type { AuthorizationRequest, Scope } from './request.ts';
+/**
+ * What an authorization code stands for: who approved what, for which client,
+ * and the PKCE challenge the client must answer to redeem it (TASK-159,
+ * TASK-160).
+ */
+export interface AuthorizationCode {
+    readonly clientId: string;
+    /** What the client called itself, for the connected apps screen. */
+    readonly clientName?: string;
+    readonly redirectUri: string;
+    readonly codeChallenge: string;
+    readonly userId: number;
+    /** The canonical me URL the client is handed back. */
+    readonly me: string;
+    /** The scopes the person left ticked. */
+    readonly scopes: readonly Scope[];
+    /** The RFC 8707 resource the token is to be issued for. */
+    readonly resource?: string;
+}
+/** A request on the consent screen, waiting for the person to decide. */
+export interface PendingConsent {
+    readonly request: AuthorizationRequest;
+    /** Who was shown the screen. Nobody else may answer it. */
+    readonly userId: number;
+    /** The me URL the screen named. */
+    readonly me: string;
+    /** What the client called itself on the screen, when it said. */
+    readonly clientName?: string;
+}
+/** Values kept for a while under an unguessable key, each taken at most once. */
+export interface ExpiringStore<T> {
+    /** Keep `value` and answer the key it is kept under. */
+    put(value: T): string;
+    /** The value under `key`, removed as it is read, or `undefined` once it has expired. */
+    take(key: string): T | undefined;
+}
+/** How long a code may wait to be redeemed. The IndieAuth spec says at most ten minutes. */
+export declare const CODE_LIFETIME_MS: number;
+/** How long a consent screen may sit before its answer is refused. */
+export declare const CONSENT_LIFETIME_MS: number;
+/**
+ * The authorization server's short-lived state: codes and the consent screens
+ * they come from.
+ *
+ * Held in memory rather than in `data/`. Decision-9 asks files for state a
+ * restart must not lose, and these live for minutes: a restart costs whoever
+ * was mid-sign-in one more try, which is less than writing every sign-in to
+ * disk and sweeping it after.
+ */
+export interface IndieAuthState {
+    readonly codes: ExpiringStore<AuthorizationCode>;
+    readonly consents: ExpiringStore<PendingConsent>;
+}
+export declare function createIndieAuthState(now: Clock): IndieAuthState;
+//# sourceMappingURL=grants.d.ts.map

package/dist/indieauth/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/indieauth/grants.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAEhE;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,wDAAwD;IACxD,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC;IACtB,wFAAwF;IACxF,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CAClC;AAED,4FAA4F;AAC5F,eAAO,MAAM,gBAAgB,QAAgB,CAAC;AAE9C,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,QAAiB,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CAClD;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,KAAK,GAAG,cAAc,CAK/D"}

package/dist/indieauth/grants.js

@@ -0,0 +1,35 @@
+import { randomBytes } from 'node:crypto';
+/** How long a code may wait to be redeemed. The IndieAuth spec says at most ten minutes. */
+export const CODE_LIFETIME_MS = 5 * 60 * 1000;
+/** How long a consent screen may sit before its answer is refused. */
+export const CONSENT_LIFETIME_MS = 30 * 60 * 1000;
+export function createIndieAuthState(now) {
+    return {
+        codes: expiringStore(CODE_LIFETIME_MS, now),
+        consents: expiringStore(CONSENT_LIFETIME_MS, now),
+    };
+}
+function expiringStore(lifetimeMs, now) {
+    const entries = new Map();
+    return {
+        put(value) {
+            const at = now().getTime();
+            // Swept on every put, so nothing outlives its lifetime by more than the
+            // gap to the next sign-in.
+            for (const [key, entry] of entries)
+                if (entry.expiresAt <= at)
+                    entries.delete(key);
+            const key = randomBytes(32).toString('base64url');
+            entries.set(key, { value, expiresAt: at + lifetimeMs });
+            return key;
+        },
+        take(key) {
+            const entry = entries.get(key);
+            entries.delete(key);
+            if (entry === undefined || entry.expiresAt <= now().getTime())
+                return undefined;
+            return entry.value;
+        },
+    };
+}
+//# sourceMappingURL=grants.js.map

package/dist/indieauth/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/indieauth/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4C1C,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAgBlD,MAAM,UAAU,oBAAoB,CAAC,GAAU;IAC7C,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,gBAAgB,EAAE,GAAG,CAAC;QAC3C,QAAQ,EAAE,aAAa,CAAC,mBAAmB,EAAE,GAAG,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAI,UAAkB,EAAE,GAAU;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAC;IAEnE,OAAO;QACL,GAAG,CAAC,KAAK;YACP,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YAC3B,wEAAwE;YACxE,2BAA2B;YAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO;gBAAE,IAAI,KAAK,CAAC,SAAS,IAAI,EAAE;oBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnF,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;YACxD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,CAAC,GAAG;YACN,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE;gBAAE,OAAO,SAAS,CAAC;YAChF,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/indieauth/identity.d.ts

@@ -0,0 +1,36 @@
+import type { User } from '../admin/accounts.ts';
+import type { SiteSettings } from '../admin/settings.ts';
+/** What resolving a me URL needs to know about the site. */
+export interface IdentitySite {
+    /** The site's base URL, which every identity URL is under. */
+    baseUrl: string;
+    users: readonly User[];
+    settings: Pick<SiteSettings, 'author'>;
+}
+/**
+ * The one user a me URL names, or `undefined` when it names nobody
+ * (decision-23).
+ *
+ * `/author/{username}/` names that user. The root names the user the author
+ * setting names, which makes it a solo author site (TASK-192); on a site with
+ * several authors it is nobody's. Anything else names nobody, a query or a fragment
+ * included.
+ *
+ * A URL that differs from the site's only in http or https, a `www.` prefix
+ * on either side, the case of its scheme and host, or a missing trailing slash
+ * is the same URL: those are the spellings a person types and a client's
+ * redirects pass through, and the me handed back is always the canonical one.
+ */
+export declare function userForMe(me: string, site: IdentitySite): User | undefined;
+/**
+ * The me a sign-in hands back for `user`, who has just approved it
+ * (decision-23).
+ *
+ * The URL the person typed when it names them, spelled canonically: the root
+ * for the solo author who typed it, their author URL otherwise. A typed URL
+ * that names somebody else, or nobody, is ignored, and the answer is the
+ * signed-in user's own author URL: a person can only ever sign in as
+ * themselves.
+ */
+export declare function meForSignIn(typed: string | undefined, user: User, site: IdentitySite): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/indieauth/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/indieauth/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD,4DAA4D;AAC5D,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IACvB,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;CACxC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,CAE1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,GAAG,MAAM,CAK7F"}

package/dist/indieauth/identity.js

@@ -0,0 +1,77 @@
+import { authorHref, parseAuthorPath, userForAuthor } from '../web/authors.js';
+/**
+ * The one user a me URL names, or `undefined` when it names nobody
+ * (decision-23).
+ *
+ * `/author/{username}/` names that user. The root names the user the author
+ * setting names, which makes it a solo author site (TASK-192); on a site with
+ * several authors it is nobody's. Anything else names nobody, a query or a fragment
+ * included.
+ *
+ * A URL that differs from the site's only in http or https, a `www.` prefix
+ * on either side, the case of its scheme and host, or a missing trailing slash
+ * is the same URL: those are the spellings a person types and a client's
+ * redirects pass through, and the me handed back is always the canonical one.
+ */
+export function userForMe(me, site) {
+    return identityNamed(me, site)?.user;
+}
+/**
+ * The me a sign-in hands back for `user`, who has just approved it
+ * (decision-23).
+ *
+ * The URL the person typed when it names them, spelled canonically: the root
+ * for the solo author who typed it, their author URL otherwise. A typed URL
+ * that names somebody else, or nobody, is ignored, and the answer is the
+ * signed-in user's own author URL: a person can only ever sign in as
+ * themselves.
+ */
+export function meForSignIn(typed, user, site) {
+    const named = typed === undefined ? undefined : identityNamed(typed, site);
+    const base = site.baseUrl.replace(/\/$/, '');
+    if (named?.user.id === user.id && named.root)
+        return `${base}/`;
+    return `${base}${authorHref(user.username)}`;
+}
+/** The user a me URL names, and whether it named them by the site root. */
+function identityNamed(me, site) {
+    const typed = URL.parse(me);
+    const base = URL.parse(site.baseUrl);
+    if (typed === null || base === null)
+        return undefined;
+    if (typed.protocol !== 'https:' && typed.protocol !== 'http:')
+        return undefined;
+    if (typed.username !== '' || typed.password !== '')
+        return undefined;
+    if (typed.search !== '' || typed.hash !== '' || me.includes('#') || me.includes('?')) {
+        return undefined;
+    }
+    if (withoutWww(typed.hostname) !== withoutWww(base.hostname))
+        return undefined;
+    if (typed.port !== base.port)
+        return undefined;
+    const root = withSlash(base.pathname);
+    const pathname = withSlash(typed.pathname);
+    if (!pathname.startsWith(root))
+        return undefined;
+    const local = `/${pathname.slice(root.length)}`;
+    // The author setting holds a username, or in a file written before the
+    // Site author select a display name, which the homepage's bio reads the same
+    // way; an author path holds a username, matched exactly.
+    if (local === '/') {
+        const author = userForAuthor(site.users, site.settings.author);
+        return author === undefined ? undefined : { user: author, root: true };
+    }
+    const author = parseAuthorPath(local);
+    if (author?.pageNumber !== 0)
+        return undefined;
+    const user = site.users.find((candidate) => candidate.username === author.username);
+    return user === undefined ? undefined : { user, root: false };
+}
+function withoutWww(hostname) {
+    return hostname.startsWith('www.') ? hostname.slice(4) : hostname;
+}
+function withSlash(pathname) {
+    return pathname.endsWith('/') ? pathname : `${pathname}/`;
+}
+//# sourceMappingURL=identity.js.map