Authorize app

${escapeHtml(q.client_id || \"unknown app\")} is requesting\nscope ${escapeHtml(q.scope || \"create\")}.

\n`);\n});\n\napp.post(\"/auth\", async (c) => {\n const fd = await c.req.formData();\n const get = (k: string) => (fd.get(k) as string) || \"\";\n if (!GARDEN_PASSWORD || get(\"password\") !== GARDEN_PASSWORD) {\n return c.text(\"Forbidden\", 403);\n }\n const redirectUri = get(\"redirect_uri\");\n if (!redirectUri) return c.text(\"Missing redirect_uri\", 400);\n\n const code = await signPayload({\n t: \"code\",\n jti: crypto.randomUUID(),\n client_id: get(\"client_id\"),\n redirect_uri: redirectUri,\n scope: get(\"scope\") || \"create\",\n me: get(\"me\") || SITE_URL,\n cc: get(\"code_challenge\"),\n ccm: get(\"code_challenge_method\"),\n exp: Math.floor(Date.now() / 1000) + 300,\n });\n\n const sep = redirectUri.includes(\"?\") ? \"&\" : \"?\";\n const state = get(\"state\");\n const location = `${redirectUri}${sep}code=${encodeURIComponent(code)}${\n state ? `&state=${encodeURIComponent(state)}` : \"\"\n }`;\n return c.body(null, 302, { Location: location });\n});\n\n// IndieAuth token endpoint: exchange a single-use auth code for an access token.\napp.post(\"/token\", async (c) => {\n const fd = await c.req.formData();\n const get = (k: string) => (fd.get(k) as string) || \"\";\n if (get(\"grant_type\") !== \"authorization_code\") {\n return c.json({ error: \"unsupported_grant_type\" }, 400);\n }\n const payload = await verifyPayload(get(\"code\"));\n if (!payload || payload.t !== \"code\") return c.json({ error: \"invalid_grant\" }, 400);\n if (payload.client_id !== get(\"client_id\") || payload.redirect_uri !== get(\"redirect_uri\")) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n // PKCE: verify code_verifier against the challenge bound to the code.\n if (payload.cc) {\n const verifier = get(\"code_verifier\");\n if (!verifier) return c.json({ error: \"invalid_grant\" }, 400);\n const challenge = payload.ccm === \"plain\" ? verifier : await sha256b64url(verifier);\n if (!timingSafeEqual(challenge, payload.cc)) return c.json({ error: \"invalid_grant\" }, 400);\n }\n if (await codeAlreadyUsed(payload.jti)) return c.json({ error: \"invalid_grant\" }, 400);\n await burnCode(payload.jti);\n\n const accessToken = await signPayload({\n t: \"token\",\n me: payload.me,\n scope: payload.scope,\n iat: Math.floor(Date.now() / 1000),\n exp: Math.floor(Date.now() / 1000) + 10 * 365 * 24 * 3600,\n });\n return c.json({\n access_token: accessToken,\n token_type: \"Bearer\",\n scope: payload.scope,\n me: payload.me,\n });\n});\n\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n","deleted","label",[114],"9abcdc73-3cc7-47a1-84b1-deac18486565","micropub.README.md","170e3d00-76e8-11f1-972e-1607ee4eb77e",4,["D",1783134560317],1,"# micropub\n\nA [Micropub](https://micropub.spec.indieweb.org/) endpoint that turns posts\nwritten in a phone Micropub client into commits on this repo. The site's\nexisting `optimize.yml` and `jekyll.yml` workflows then optimize images and\ndeploy — no separate publishing pipeline.\n\n## How it works\n\n```\nPhone client ──┬── GET /auth → approval page (password) → auth code\n ├── POST /token → exchange code (+PKCE) → access token\n ├── POST /media → commit to assets/images/, return URL\n └── POST / → build blog/_posts/-.md, commit\n ▲\n Bearer access token (or MICROPUB_TOKEN fallback)\n```\n\n- **Direct commit** (not the issue `/post` flow): the media endpoint commits the\n image first, so the created post references an in-repo path and never races\n the GitHub Pages deploy.\n- **Auth is self-hosted IndieAuth.** This val is its own identity provider: the\n authorization endpoint gates on a password (`GARDEN_PASSWORD`), then issues an\n HMAC-signed, single-use auth code; the token endpoint verifies it (with PKCE)\n and returns a long-lived HMAC-signed access token. No third-party service, no\n DB except a `std/blob` entry per code to enforce single use.\n- **`MICROPUB_TOKEN`** remains a shared-secret fallback for curl/scripts.\n- **Frontmatter override**: if the post content starts with a `---` YAML block,\n it overrides Micropub properties and defaults (`category`, `published`,\n `slug`, `tags`, `title`, `date`, `image`, `description`) — the same mental\n model as the site's issue-based posting.\n\n## Property mapping\n\n| Micropub | Post |\n|---|---|\n| `name` | `title` (required unless set in frontmatter) |\n| `content` | body (leading `---` frontmatter block is parsed as overrides) |\n| `category[]` | `tags` |\n| `photo[]` (URL or uploaded file) | inlined `![](…)` + frontmatter `image` |\n| `published` (datetime) | `date` |\n| `mp-slug` | `slug` |\n| — (defaults to `blog`) | Jekyll category, override via frontmatter `category:` |\n\n## Deploy\n\nFrom this directory:\n\n```sh\nvt create micropub # or: vt push, if already linked\n```\n\nSet env vars on the val:\n\n| Var | Required | Default |\n|---|---|---|\n| `GITHUB_TOKEN` | yes | — (fine-grained PAT with Contents: read/write on this repo) |\n| `INDIEAUTH_SECRET` | yes | — (random string; signs auth codes + access tokens) |\n| `GARDEN_PASSWORD` | yes | — (the password you enter on the approval page) |\n| `MICROPUB_TOKEN` | no | — (optional shared-secret fallback for curl/scripts) |\n| `GITHUB_REPO` | no | `joshbeckman/notes` |\n| `GIT_BRANCH` | no | `master` |\n| `SITE_URL` | no | `https://www.joshbeckman.org` |\n| `SITE_TZ` | no | `America/Chicago` |\n| `GIT_COMMITTER_NAME` | no | `micropub-val` |\n| `GIT_COMMITTER_EMAIL` | no | `josh@joshbeckman.org` |\n\nThe `` in `_includes/head.html` points clients here:\n`https://joshbeckman--1708dc0c76e811f1be5b1607ee4eb77e.web.val.run`.\n\n## Client setup\n\n1. Sign in with your site URL `https://www.joshbeckman.org` (the client\n discovers the micropub/authorization/token endpoints from the page head).\n2. You're redirected to the approval page — enter `GARDEN_PASSWORD` and approve.\n3. The client stores its own token; write, attach photos, publish.\n\nWorks with [Quill](https://quill.p3k.io/) (web), iA Writer, and Indigenous — all\nspeak IndieAuth, so none need a raw token pasted in.\n\n## Test without a client\n\nUses the optional `MICROPUB_TOKEN` shared-secret fallback (IndieAuth is for GUI\nclients; curl skips it).\n\n```sh\nTOKEN=your-micropub-token\nURL=https://joshbeckman--1708dc0c76e811f1be5b1607ee4eb77e.web.val.run\n\n# config\ncurl \"$URL/?q=config\" -H \"Authorization: Bearer $TOKEN\"\n\n# create a post\ncurl -i \"$URL/\" -H \"Authorization: Bearer $TOKEN\" \\\n -d h=entry -d name=\"Hello from the phone\" \\\n -d content=\"A first micropub post.\" \\\n --data-urlencode \"category[]=publishing\"\n```\n",[131],"pulls","forks","envVars",{"_144":133,"_146":52},"connections",{"_144":52,"_145":52},"count","unfilledCount","emptyCount",{"_20":130,"_13":131,"_115":132,"_117":-5,"_118":21,"_119":133,"_120":106,"_22":153,"_29":135,"_123":99,"_125":136,"_127":38,"_128":-5,"_150":154,"_88":155},{"_20":113,"_13":114,"_115":116,"_117":-5,"_118":21,"_119":30,"_120":106,"_22":149,"_29":122,"_123":124,"_125":126,"_127":38,"_128":-5,"_150":151,"_88":152},["D",1783262312145],"children",[],[114],["D",1783134560317],[],[131],["D",1783087461183],{"_11":12,"_86":82},{"_11":12,"_80":-5,"_81":82,"_45":46,"_83":84,"_85":38},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_75":-5,"_76":-5,"_77":-5,"_78":14,"_79":12},"ctx",{"_68":-5,"_108":193,"_194":195,"_196":197,"_198":38,"_199":38,"_200":38,"_201":106,"_202":-5,"_203":-7,"_204":-7,"_205":52,"_206":38,"_207":38,"_208":-5,"_209":38,"_210":38,"_211":38,"_212":-5},"ENV",{"_164":165,"_166":167,"_168":26,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches1

Branches
1