Authorize app

${escapeHtml(q.client_id || \"unknown app\")} is requesting\nscope ${escapeHtml(q.scope || \"create\")}.

\n`);\n});\n\napp.post(\"/auth\", async (c) => {\n const fd = await c.req.formData();\n const get = (k: string) => (fd.get(k) as string) || \"\";\n if (!GARDEN_PASSWORD || get(\"password\") !== GARDEN_PASSWORD) {\n return c.text(\"Forbidden\", 403);\n }\n const redirectUri = get(\"redirect_uri\");\n if (!redirectUri) return c.text(\"Missing redirect_uri\", 400);\n\n const code = await signPayload({\n t: \"code\",\n jti: crypto.randomUUID(),\n client_id: get(\"client_id\"),\n redirect_uri: redirectUri,\n scope: get(\"scope\") || \"create\",\n me: get(\"me\") || SITE_URL,\n cc: get(\"code_challenge\"),\n ccm: get(\"code_challenge_method\"),\n exp: Math.floor(Date.now() / 1000) + 300,\n });\n\n const sep = redirectUri.includes(\"?\") ? \"&\" : \"?\";\n const state = get(\"state\");\n const location = `${redirectUri}${sep}code=${encodeURIComponent(code)}${\n state ? `&state=${encodeURIComponent(state)}` : \"\"\n }`;\n return c.body(null, 302, { Location: location });\n});\n\n// IndieAuth token endpoint: exchange a single-use auth code for an access token.\napp.post(\"/token\", async (c) => {\n const fd = await c.req.formData();\n const get = (k: string) => (fd.get(k) as string) || \"\";\n if (get(\"grant_type\") !== \"authorization_code\") {\n return c.json({ error: \"unsupported_grant_type\" }, 400);\n }\n const payload = await verifyPayload(get(\"code\"));\n if (!payload || payload.t !== \"code\") return c.json({ error: \"invalid_grant\" }, 400);\n if (payload.client_id !== get(\"client_id\") || payload.redirect_uri !== get(\"redirect_uri\")) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n // PKCE: verify code_verifier against the challenge bound to the code.\n if (payload.cc) {\n const verifier = get(\"code_verifier\");\n if (!verifier) return c.json({ error: \"invalid_grant\" }, 400);\n const challenge = payload.ccm === \"plain\" ? verifier : await sha256b64url(verifier);\n if (!timingSafeEqual(challenge, payload.cc)) return c.json({ error: \"invalid_grant\" }, 400);\n }\n if (await codeAlreadyUsed(payload.jti)) return c.json({ error: \"invalid_grant\" }, 400);\n await burnCode(payload.jti);\n\n const accessToken = await signPayload({\n t: \"token\",\n me: payload.me,\n scope: payload.scope,\n iat: Math.floor(Date.now() / 1000),\n exp: Math.floor(Date.now() / 1000) + 10 * 365 * 24 * 3600,\n });\n return c.json({\n access_token: accessToken,\n token_type: \"Bearer\",\n scope: payload.scope,\n me: payload.me,\n });\n});\n\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n","label",[63],"9abcdc73-3cc7-47a1-84b1-deac18486565",["D",1783134560317],"# micropub\n\nA [Micropub](https://micropub.spec.indieweb.org/) endpoint that turns posts\nwritten in a phone Micropub client into commits on this repo. The site's\nexisting `optimize.yml` and `jekyll.yml` workflows then optimize images and\ndeploy — no separate publishing pipeline.\n\n## How it works\n\n```\nPhone client ──┬── GET /auth → approval page (password) → auth code\n ├── POST /token → exchange code (+PKCE) → access token\n ├── POST /media → commit to assets/images/, return URL\n └── POST / → build blog/_posts/-.md, commit\n ▲\n Bearer access token (or MICROPUB_TOKEN fallback)\n```\n\n- **Direct commit** (not the issue `/post` flow): the media endpoint commits the\n image first, so the created post references an in-repo path and never races\n the GitHub Pages deploy.\n- **Auth is self-hosted IndieAuth.** This val is its own identity provider: the\n authorization endpoint gates on a password (`GARDEN_PASSWORD`), then issues an\n HMAC-signed, single-use auth code; the token endpoint verifies it (with PKCE)\n and returns a long-lived HMAC-signed access token. No third-party service, no\n DB except a `std/blob` entry per code to enforce single use.\n- **`MICROPUB_TOKEN`** remains a shared-secret fallback for curl/scripts.\n- **Frontmatter override**: if the post content starts with a `---` YAML block,\n it overrides Micropub properties and defaults (`category`, `published`,\n `slug`, `tags`, `title`, `date`, `image`, `description`) — the same mental\n model as the site's issue-based posting.\n\n## Property mapping\n\n| Micropub | Post |\n|---|---|\n| `name` | `title` (required unless set in frontmatter) |\n| `content` | body (leading `---` frontmatter block is parsed as overrides) |\n| `category[]` | `tags` |\n| `photo[]` (URL or uploaded file) | inlined `![](…)` + frontmatter `image` |\n| `published` (datetime) | `date` |\n| `mp-slug` | `slug` |\n| — (defaults to `blog`) | Jekyll category, override via frontmatter `category:` |\n\n## Deploy\n\nFrom this directory:\n\n```sh\nvt create micropub # or: vt push, if already linked\n```\n\nSet env vars on the val:\n\n| Var | Required | Default |\n|---|---|---|\n| `GITHUB_TOKEN` | yes | — (fine-grained PAT with Contents: read/write on this repo) |\n| `INDIEAUTH_SECRET` | yes | — (random string; signs auth codes + access tokens) |\n| `GARDEN_PASSWORD` | yes | — (the password you enter on the approval page) |\n| `MICROPUB_TOKEN` | no | — (optional shared-secret fallback for curl/scripts) |\n| `GITHUB_REPO` | no | `joshbeckman/notes` |\n| `GIT_BRANCH` | no | `master` |\n| `SITE_URL` | no | `https://www.joshbeckman.org` |\n| `SITE_TZ` | no | `America/Chicago` |\n| `GIT_COMMITTER_NAME` | no | `micropub-val` |\n| `GIT_COMMITTER_EMAIL` | no | `josh@joshbeckman.org` |\n\nThe `` in `_includes/head.html` points clients here:\n`https://joshbeckman--1708dc0c76e811f1be5b1607ee4eb77e.web.val.run`.\n\n## Client setup\n\n1. Sign in with your site URL `https://www.joshbeckman.org` (the client\n discovers the micropub/authorization/token endpoints from the page head).\n2. You're redirected to the approval page — enter `GARDEN_PASSWORD` and approve.\n3. The client stores its own token; write, attach photos, publish.\n\nWorks with [Quill](https://quill.p3k.io/) (web), iA Writer, and Indigenous — all\nspeak IndieAuth, so none need a raw token pasted in.\n\n## Test without a client\n\nUses the optional `MICROPUB_TOKEN` shared-secret fallback (IndieAuth is for GUI\nclients; curl skips it).\n\n```sh\nTOKEN=your-micropub-token\nURL=https://joshbeckman--1708dc0c76e811f1be5b1607ee4eb77e.web.val.run\n\n# config\ncurl \"$URL/?q=config\" -H \"Authorization: Bearer $TOKEN\"\n\n# create a post\ncurl -i \"$URL/\" -H \"Authorization: Bearer $TOKEN\" \\\n -d h=entry -d name=\"Hello from the phone\" \\\n -d content=\"A first micropub post.\" \\\n --data-urlencode \"category[]=publishing\"\n```\n",[78],"pulls","branches","forks","envVars",{"_198":89,"_200":20},"connections",{"_198":20,"_199":20},"count","unfilledCount","emptyCount",{"_32":187,"_13":78,"_61":77,"_42":-5,"_34":35,"_180":89,"_181":172,"_36":207,"_38":39,"_64":52,"_183":189,"_66":24,"_185":-5,"_204":208,"_155":209},{"_32":179,"_13":63,"_61":62,"_42":-5,"_34":35,"_180":103,"_181":172,"_36":203,"_38":81,"_64":86,"_183":184,"_66":24,"_185":-5,"_204":205,"_155":206},["D",1783262312145],"children",[],[63],["D",1783134560317],[],[78],["D",1783087461183],{"_11":12,"_154":69},{"_11":12,"_150":-5,"_68":69,"_25":67,"_151":152,"_153":24},{"_38":103,"_13":16,"_32":35,"_142":108,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":-5,"_148":14,"_149":12},"ctx",{"_50":-5,"_174":247,"_248":249,"_250":251,"_252":24,"_253":24,"_254":24,"_255":172,"_256":-5,"_257":-7,"_258":-7,"_259":20,"_260":24,"_261":24,"_262":-5,"_263":24,"_264":24,"_265":24,"_266":-5},"ENV",{"_218":219,"_220":221,"_222":16,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236,"_237":238,"_239":240,"_241":242,"_243":244,"_245":246},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History