javascript-solid-server 0.0.127 → 0.0.128

package/.claude/settings.local.json

@@ -338,7 +338,11 @@
       "Bash(sed -i 's|// Settings folder|// settings folder|' src/handlers/container.js)",
       "WebFetch(domain:www.x402.org)",
       "Bash(jss start:*)",
-      "Read(//tmp/**)"
+      "Read(//tmp/**)",
+      "Bash(sed -i 's/\"currency\": \"sats\"/\"currency\": \"tbtc4\"/g' /home/melvin/articles/solid-402.html /home/melvin/articles/solid-pay.html /home/melvin/articles/solid-balance.html)",
+      "Bash(sed -i 's/\"currency\":\"sats\"/\"currency\":\"tbtc4\"/g' /home/melvin/articles/solid-402.html /home/melvin/articles/solid-pay.html /home/melvin/articles/solid-balance.html)",
+      "WebFetch(domain:lists.w3.org)",
+      "Bash(git:*)"
     ]
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "javascript-solid-server",
-  "version": "0.0.127",
+  "version": "0.0.128",
   "description": "A minimal, fast Solid server",
   "main": "src/index.js",
   "type": "module",

package/src/ap/routes/oauth.js

@@ -123,7 +123,7 @@ export function createAuthorizePostHandler () {
     // Implicit grant (response_type=token) — return token directly in fragment (RFC 6749 §4.2.2)
     // Used by remoteStorage clients
     if (response_type === 'token') {
-      const accessToken = createToken(account.webId)
+      const accessToken = createToken(account.webId, 3600)
 
       // Handle OOB — display token
       if (redirect_uri === OOB_REDIRECT) {
@@ -208,7 +208,7 @@ export function createTokenHandler () {
     }
 
     // Generate Bearer token using existing token infrastructure
-    const accessToken = createToken(authCode.webId)
+    const accessToken = createToken(authCode.webId, 3600)
 
     return reply.send({
       access_token: accessToken,

package/src/auth/token.js

@@ -39,15 +39,17 @@ const SECRET = getSecret();
 /**
  * Create a simple token for a WebID
  * @param {string} webId - The WebID to create token for
- * @param {number} expiresIn - Expiration time in seconds (default 1 hour)
+ * @param {number} [expiresIn] - Expiration time in seconds (default: no expiry)
  * @returns {string} Token string
  */
-export function createToken(webId, expiresIn = 3600) {
+export function createToken(webId, expiresIn) {
   const payload = {
     webId,
     iat: Math.floor(Date.now() / 1000),
-    exp: Math.floor(Date.now() / 1000) + expiresIn
   };
+  if (expiresIn !== undefined && expiresIn > 0) {
+    payload.exp = Math.floor(Date.now() / 1000) + expiresIn;
+  }
 
   const data = Buffer.from(JSON.stringify(payload)).toString('base64url');
   const signature = crypto
@@ -65,7 +67,7 @@ export function createToken(webId, expiresIn = 3600) {
  * JWT tokens (3-part) require async verification via verifyTokenAsync().
  *
  * @param {string} token - The token to verify
- * @returns {{webId: string, iat: number, exp: number} | null} Decoded payload or null
+ * @returns {{webId: string, iat: number, exp?: number} | null} Decoded payload or null
  */
 export function verifyToken(token) {
   if (!token || typeof token !== 'string') {

package/src/handlers/container.js

@@ -310,16 +310,18 @@ export async function handleCreatePod(request, reply) {
 
   Object.entries(headers).forEach(([k, v]) => reply.header(k, v));
 
-  // If IdP is enabled, create account instead of simple token
+  // If IdP is enabled, create account and return token + login URL
   if (idpEnabled) {
     try {
       const { createAccount } = await import('../idp/accounts.js');
       await createAccount({ username: name, email, password, webId, podName: name });
 
+      const token = createToken(webId);
       return reply.code(201).send({
         name,
         webId,
         podUri,
+        token,
         idpIssuer: issuer,
         loginUrl: `${baseUri}/idp/auth`,
       });

package/test/idp.test.js

@@ -130,8 +130,14 @@ describe('Identity Provider', () => {
       assert.ok(body.podUri.includes(`idpuser${uniqueId}`));
       assert.ok(body.idpIssuer, 'should include IdP issuer');
       assert.ok(body.loginUrl, 'should include login URL');
-      // Should NOT have simple token when IdP is enabled
-      assert.ok(!body.token, 'should not have simple token');
+      // Should also return a token for curl-based workflows
+      assert.ok(body.token, 'should include token');
+
+      // Token should work for authenticated requests
+      const privateRes = await fetch(`${baseUrl}/${body.name}/private/`, {
+        headers: { 'Authorization': `Bearer ${body.token}` },
+      });
+      assert.strictEqual(privateRes.status, 200, 'token should authenticate to private folder');
     });
 
     it('should reject duplicate email', async () => {