Authorize app

${escapeHtml(q.client_id || \"unknown app\")} is requesting\nscope ${escapeHtml(q.scope || \"create\")}.

\n`);\n});\n\napp.post(\"/auth\", async (c) => {\n const fd = await c.req.formData();\n const get = (k: string) => (fd.get(k) as string) || \"\";\n if (!GARDEN_PASSWORD || get(\"password\") !== GARDEN_PASSWORD) {\n return c.text(\"Forbidden\", 403);\n }\n const redirectUri = get(\"redirect_uri\");\n if (!redirectUri) return c.text(\"Missing redirect_uri\", 400);\n\n const code = await signPayload({\n t: \"code\",\n jti: crypto.randomUUID(),\n client_id: get(\"client_id\"),\n redirect_uri: redirectUri,\n scope: get(\"scope\") || \"create\",\n me: get(\"me\") || SITE_URL,\n cc: get(\"code_challenge\"),\n ccm: get(\"code_challenge_method\"),\n exp: Math.floor(Date.now() / 1000) + 300,\n });\n\n const sep = redirectUri.includes(\"?\") ? \"&\" : \"?\";\n const state = get(\"state\");\n const location = `${redirectUri}${sep}code=${encodeURIComponent(code)}${\n state ? `&state=${encodeURIComponent(state)}` : \"\"\n }`;\n return c.body(null, 302, { Location: location });\n});\n\n// IndieAuth token endpoint: exchange a single-use auth code for an access token.\napp.post(\"/token\", async (c) => {\n const fd = await c.req.formData();\n const get = (k: string) => (fd.get(k) as string) || \"\";\n if (get(\"grant_type\") !== \"authorization_code\") {\n return c.json({ error: \"unsupported_grant_type\" }, 400);\n }\n const payload = await verifyPayload(get(\"code\"));\n if (!payload || payload.t !== \"code\") return c.json({ error: \"invalid_grant\" }, 400);\n if (payload.client_id !== get(\"client_id\") || payload.redirect_uri !== get(\"redirect_uri\")) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n // PKCE: verify code_verifier against the challenge bound to the code.\n if (payload.cc) {\n const verifier = get(\"code_verifier\");\n if (!verifier) return c.json({ error: \"invalid_grant\" }, 400);\n const challenge = payload.ccm === \"plain\" ? verifier : await sha256b64url(verifier);\n if (!timingSafeEqual(challenge, payload.cc)) return c.json({ error: \"invalid_grant\" }, 400);\n }\n if (await codeAlreadyUsed(payload.jti)) return c.json({ error: \"invalid_grant\" }, 400);\n await burnCode(payload.jti);\n\n const accessToken = await signPayload({\n t: \"token\",\n me: payload.me,\n scope: payload.scope,\n iat: Math.floor(Date.now() / 1000),\n exp: Math.floor(Date.now() / 1000) + 10 * 365 * 24 * 3600,\n });\n return c.json({\n access_token: accessToken,\n token_type: \"Bearer\",\n scope: payload.scope,\n me: payload.me,\n });\n});\n\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n","deleted","label","children",[],"path",[42],"9abcdc73-3cc7-47a1-84b1-deac18486565","micropub.README.md","170e3d00-76e8-11f1-972e-1607ee4eb77e",4,["D",1783134560317],1,"file","# micropub\n\nA [Micropub](https://micropub.spec.indieweb.org/) endpoint that turns posts\nwritten in a phone Micropub client into commits on this repo. The site's\nexisting `optimize.yml` and `jekyll.yml` workflows then optimize images and\ndeploy — no separate publishing pipeline.\n\n## How it works\n\n```\nPhone client ──┬── GET /auth → approval page (password) → auth code\n ├── POST /token → exchange code (+PKCE) → access token\n ├── POST /media → commit to assets/images/, return URL\n └── POST / → build blog/_posts/-.md, commit\n ▲\n Bearer access token (or MICROPUB_TOKEN fallback)\n```\n\n- **Direct commit** (not the issue `/post` flow): the media endpoint commits the\n image first, so the created post references an in-repo path and never races\n the GitHub Pages deploy.\n- **Auth is self-hosted IndieAuth.** This val is its own identity provider: the\n authorization endpoint gates on a password (`GARDEN_PASSWORD`), then issues an\n HMAC-signed, single-use auth code; the token endpoint verifies it (with PKCE)\n and returns a long-lived HMAC-signed access token. No third-party service, no\n DB except a `std/blob` entry per code to enforce single use.\n- **`MICROPUB_TOKEN`** remains a shared-secret fallback for curl/scripts.\n- **Frontmatter override**: if the post content starts with a `---` YAML block,\n it overrides Micropub properties and defaults (`category`, `published`,\n `slug`, `tags`, `title`, `date`, `image`, `description`) — the same mental\n model as the site's issue-based posting.\n\n## Property mapping\n\n| Micropub | Post |\n|---|---|\n| `name` | `title` (required unless set in frontmatter) |\n| `content` | body (leading `---` frontmatter block is parsed as overrides) |\n| `category[]` | `tags` |\n| `photo[]` (URL or uploaded file) | inlined `![](…)` + frontmatter `image` |\n| `published` (datetime) | `date` |\n| `mp-slug` | `slug` |\n| — (defaults to `blog`) | Jekyll category, override via frontmatter `category:` |\n\n## Deploy\n\nFrom this directory:\n\n```sh\nvt create micropub # or: vt push, if already linked\n```\n\nSet env vars on the val:\n\n| Var | Required | Default |\n|---|---|---|\n| `GITHUB_TOKEN` | yes | — (fine-grained PAT with Contents: read/write on this repo) |\n| `INDIEAUTH_SECRET` | yes | — (random string; signs auth codes + access tokens) |\n| `GARDEN_PASSWORD` | yes | — (the password you enter on the approval page) |\n| `MICROPUB_TOKEN` | no | — (optional shared-secret fallback for curl/scripts) |\n| `GITHUB_REPO` | no | `joshbeckman/notes` |\n| `GIT_BRANCH` | no | `master` |\n| `SITE_URL` | no | `https://www.joshbeckman.org` |\n| `SITE_TZ` | no | `America/Chicago` |\n| `GIT_COMMITTER_NAME` | no | `micropub-val` |\n| `GIT_COMMITTER_EMAIL` | no | `josh@joshbeckman.org` |\n\nThe `` in `_includes/head.html` points clients here:\n`https://joshbeckman--1708dc0c76e811f1be5b1607ee4eb77e.web.val.run`.\n\n## Client setup\n\n1. Sign in with your site URL `https://www.joshbeckman.org` (the client\n discovers the micropub/authorization/token endpoints from the page head).\n2. You're redirected to the approval page — enter `GARDEN_PASSWORD` and approve.\n3. The client stores its own token; write, attach photos, publish.\n\nWorks with [Quill](https://quill.p3k.io/) (web), iA Writer, and Indigenous — all\nspeak IndieAuth, so none need a raw token pasted in.\n\n## Test without a client\n\nUses the optional `MICROPUB_TOKEN` shared-secret fallback (IndieAuth is for GUI\nclients; curl skips it).\n\n```sh\nTOKEN=your-micropub-token\nURL=https://joshbeckman--1708dc0c76e811f1be5b1607ee4eb77e.web.val.run\n\n# config\ncurl \"$URL/?q=config\" -H \"Authorization: Bearer $TOKEN\"\n\n# create a post\ncurl -i \"$URL/\" -H \"Authorization: Bearer $TOKEN\" \\\n -d h=entry -d name=\"Hello from the phone\" \\\n -d content=\"A first micropub post.\" \\\n --data-urlencode \"category[]=publishing\"\n```\n",[],[65],{"_40":64,"_13":65,"_43":66,"_45":-5,"_46":47,"_48":67,"_50":34,"_51":78,"_16":69,"_54":70,"_56":71,"_58":36,"_59":-5,"_62":79},{"_40":41,"_13":42,"_43":44,"_45":-5,"_46":47,"_48":49,"_50":34,"_51":76,"_16":53,"_54":55,"_56":57,"_58":36,"_59":-5,"_62":77},["D",1783262312145],[42],["D",1783134560317],[65],"pulls",0,"branches","forks","envVars",{"_88":67,"_90":81},"connections",{"_88":81,"_89":81},"count","unfilledCount","emptyCount","aee488a9-e6df-4a32-84a4-811c1705df2c",["D",1783087461183],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","f8d90ec1-81be-4efc-b861-a032f3f5b85f","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","b1ec36cc-9d04-4938-872f-34bf39599d6a","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_145":141},"org",{"_11":12,"_139":-5,"_140":141,"_101":102,"_142":143,"_144":36},"branch",{"_16":49,"_13":130,"_40":47,"_131":91,"_132":-5,"_133":-5,"_134":-5,"_135":-5,"_136":-5,"_137":14,"_138":12},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzJTZm1HaHJGdDFmQ2s5ME05RW9lT1JGbHZPYyIsImluaXRpYWxzIjoiSkIifQ","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_40":91,"_13":14,"_51":175,"_93":-5,"_94":36,"_95":96,"_97":96,"_98":99,"_100":-5,"_101":102,"_103":-5,"_104":36,"_105":-5,"_106":-5,"_107":81,"_108":109,"_110":-5,"_111":-5,"_112":-5,"_113":-5,"_114":115,"_116":115,"_117":118,"_119":118,"_120":118,"_121":115,"_122":115,"_123":176,"_125":177,"_127":178,"_129":36},"tree",[169,170],[169,170],{"_80":81,"_82":69,"_83":81,"_84":167,"_86":168},[163,164],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_40":64,"_13":65,"_43":66,"_45":-5,"_46":47,"_48":67,"_50":34,"_51":78,"_16":69,"_54":70,"_56":71,"_58":36,"_59":-5,"_62":166},{"_40":41,"_13":42,"_43":44,"_45":-5,"_46":47,"_48":49,"_50":34,"_51":76,"_16":53,"_54":55,"_56":57,"_58":36,"_59":-5,"_62":165},[42],[65],{"_88":67,"_90":81},{"_88":81,"_89":81},{"_40":64,"_13":65,"_43":66,"_45":-5,"_46":47,"_48":67,"_50":34,"_51":68,"_16":69,"_54":70,"_56":71,"_58":36,"_59":-5,"_60":173,"_62":174},{"_40":41,"_13":42,"_43":44,"_45":-5,"_46":47,"_48":49,"_50":34,"_51":52,"_16":53,"_54":55,"_56":57,"_58":36,"_59":-5,"_60":171,"_62":172},[],[42],[],[65],["D",1783087461183],{"_11":12,"_145":141},{"_11":12,"_139":-5,"_140":141,"_101":102,"_142":143,"_144":36},{"_16":49,"_13":130,"_40":47,"_131":91,"_132":-5,"_133":-5,"_134":-5,"_135":-5,"_136":-5,"_137":14,"_138":12},"ctx",{"_123":-5,"_160":212,"_213":214,"_215":216,"_217":36,"_218":36,"_219":36,"_220":34,"_221":-5,"_222":-7,"_223":-7,"_224":81,"_225":36,"_226":36,"_227":-5,"_228":36,"_229":36,"_230":36,"_231":-5},"ENV",{"_183":184,"_185":186,"_187":130,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]