@rmdes/indiekit-endpoint-activitypub 3.5.2 → 3.5.3

package/lib/mastodon/routes/oauth.js

@@ -174,7 +174,7 @@ router.get("/.well-known/oauth-authorization-server", (req, res) => {
 
 router.get("/oauth/authorize", async (req, res, next) => {
   try {
-    const {
+    let {
       client_id,
       redirect_uri,
       response_type,
@@ -184,6 +184,21 @@ router.get("/oauth/authorize", async (req, res, next) => {
       force_login,
     } = req.query;
 
+    // Restore OAuth params from session after login redirect.
+    // Indiekit's login flow doesn't re-encode the redirect param, so query
+    // params with & are stripped during the /session/login → /session/auth
+    // round-trip. We store them in the session before redirecting.
+    if (!response_type && req.session?.pendingOAuth) {
+      const p = req.session.pendingOAuth;
+      delete req.session.pendingOAuth;
+      client_id = p.client_id;
+      redirect_uri = p.redirect_uri;
+      response_type = p.response_type;
+      scope = p.scope;
+      code_challenge = p.code_challenge;
+      code_challenge_method = p.code_challenge_method;
+    }
+
     if (response_type !== "code") {
       return res.status(400).json({
         error: "unsupported_response_type",
@@ -219,12 +234,14 @@ router.get("/oauth/authorize", async (req, res, next) => {
     // Check if user is logged in via IndieAuth session
     const session = req.session;
     if (!session?.access_token && !force_login) {
-      // Not logged in — redirect to Indiekit's login page, then back here.
-      // Indiekit uses /session/login?redirect=<path> (see indieauth.js authenticate()).
-      // The redirect value must be a local path (validated by regex in indieauth.js).
-      return res.redirect(
-        `/session/login?redirect=${encodeURIComponent(req.originalUrl)}`,
-      );
+      // Store OAuth params in session — they won't survive Indiekit's
+      // login redirect chain due to a re-encoding bug in indieauth.js.
+      req.session.pendingOAuth = {
+        client_id, redirect_uri, response_type, scope,
+        code_challenge, code_challenge_method,
+      };
+      // Redirect to Indiekit's login page with a simple return path.
+      return res.redirect("/session/login?redirect=/oauth/authorize");
     }
 
     // Render simple authorization page

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.5.2",
+  "version": "3.5.3",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",