@rmdes/indiekit-endpoint-activitypub 3.5.2 → 3.5.4

package/lib/mastodon/routes/oauth.js

@@ -158,7 +158,7 @@ router.get("/.well-known/oauth-authorization-server", (req, res) => {
       "write:statuses",
     ],
     response_types_supported: ["code"],
-    grant_types_supported: ["authorization_code", "client_credentials"],
+    grant_types_supported: ["authorization_code", "client_credentials", "refresh_token"],
     token_endpoint_auth_methods_supported: [
       "client_secret_basic",
       "client_secret_post",
@@ -174,7 +174,7 @@ router.get("/.well-known/oauth-authorization-server", (req, res) => {
 
 router.get("/oauth/authorize", async (req, res, next) => {
   try {
-    const {
+    let {
       client_id,
       redirect_uri,
       response_type,
@@ -184,6 +184,21 @@ router.get("/oauth/authorize", async (req, res, next) => {
       force_login,
     } = req.query;
 
+    // Restore OAuth params from session after login redirect.
+    // Indiekit's login flow doesn't re-encode the redirect param, so query
+    // params with & are stripped during the /session/login → /session/auth
+    // round-trip. We store them in the session before redirecting.
+    if (!response_type && req.session?.pendingOAuth) {
+      const p = req.session.pendingOAuth;
+      delete req.session.pendingOAuth;
+      client_id = p.client_id;
+      redirect_uri = p.redirect_uri;
+      response_type = p.response_type;
+      scope = p.scope;
+      code_challenge = p.code_challenge;
+      code_challenge_method = p.code_challenge_method;
+    }
+
     if (response_type !== "code") {
       return res.status(400).json({
         error: "unsupported_response_type",
@@ -219,12 +234,14 @@ router.get("/oauth/authorize", async (req, res, next) => {
     // Check if user is logged in via IndieAuth session
     const session = req.session;
     if (!session?.access_token && !force_login) {
-      // Not logged in — redirect to Indiekit's login page, then back here.
-      // Indiekit uses /session/login?redirect=<path> (see indieauth.js authenticate()).
-      // The redirect value must be a local path (validated by regex in indieauth.js).
-      return res.redirect(
-        `/session/login?redirect=${encodeURIComponent(req.originalUrl)}`,
-      );
+      // Store OAuth params in session — they won't survive Indiekit's
+      // login redirect chain due to a re-encoding bug in indieauth.js.
+      req.session.pendingOAuth = {
+        client_id, redirect_uri, response_type, scope,
+        code_challenge, code_challenge_method,
+      };
+      // Redirect to Indiekit's login page with a simple return path.
+      return res.redirect("/session/login?redirect=/oauth/authorize");
     }
 
     // Render simple authorization page
@@ -406,10 +423,49 @@ router.post("/oauth/token", async (req, res, next) => {
       });
     }
 
+    // ─── Refresh token grant ──────────────────────────────────────────
+    if (grant_type === "refresh_token") {
+      const { refresh_token } = req.body;
+      if (!refresh_token) {
+        return res.status(400).json({
+          error: "invalid_request",
+          error_description: "Missing refresh_token",
+        });
+      }
+
+      const existing = await collections.ap_oauth_tokens.findOne({
+        refreshToken: refresh_token,
+        revokedAt: null,
+      });
+
+      if (!existing) {
+        return res.status(400).json({
+          error: "invalid_grant",
+          error_description: "Refresh token is invalid or revoked",
+        });
+      }
+
+      // Rotate: new access token + new refresh token
+      const newAccessToken = randomHex(64);
+      const newRefreshToken = randomHex(64);
+      await collections.ap_oauth_tokens.updateOne(
+        { _id: existing._id },
+        { $set: { accessToken: newAccessToken, refreshToken: newRefreshToken } },
+      );
+
+      return res.json({
+        access_token: newAccessToken,
+        token_type: "Bearer",
+        scope: existing.scopes.join(" "),
+        created_at: Math.floor(existing.createdAt.getTime() / 1000),
+        refresh_token: newRefreshToken,
+      });
+    }
+
     if (grant_type !== "authorization_code") {
       return res.status(400).json({
         error: "unsupported_grant_type",
-        error_description: "Only authorization_code and client_credentials are supported",
+        error_description: "Only authorization_code, client_credentials, and refresh_token are supported",
       });
     }
 
@@ -470,11 +526,13 @@ router.post("/oauth/token", async (req, res, next) => {
       }
     }
 
-    // Generate access token
+    // Generate access token and refresh token.
+    // Clear expiresAt — it was set for the auth code, not the access token.
     const accessToken = randomHex(64);
+    const refreshToken = randomHex(64);
     await collections.ap_oauth_tokens.updateOne(
       { _id: grant._id },
-      { $set: { accessToken } },
+      { $set: { accessToken, refreshToken, expiresAt: null } },
     );
 
     res.json({
@@ -482,6 +540,7 @@ router.post("/oauth/token", async (req, res, next) => {
       token_type: "Bearer",
       scope: grant.scopes.join(" "),
       created_at: Math.floor(grant.createdAt.getTime() / 1000),
+      refresh_token: refreshToken,
     });
   } catch (error) {
     next(error);
@@ -502,8 +561,9 @@ router.post("/oauth/revoke", async (req, res, next) => {
     }
 
     const collections = req.app.locals.mastodonCollections;
+    // Match by access token or refresh token
     await collections.ap_oauth_tokens.updateOne(
-      { accessToken: token },
+      { $or: [{ accessToken: token }, { refreshToken: token }] },
       { $set: { revokedAt: new Date() } },
     );
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.5.2",
+  "version": "3.5.4",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",