[aciccarello]

What

When signing the authorization code in consent.post, always use publication.me as the me value instead of the client-supplied me parameter.

Why

The IndieAuth spec allows clients to optionally pass a me parameter in the authorization request. Indiekit was signing whatever value the client sent directly into the authorization code and subsequent access token. If that URL differed from the configured publication.me (e.g. because it was a redirect to the canonical URL), verifyTokenValues would reject the token at query time, causing authentication to silently fail.

The IndieAuth spec explicitly permits this approach: section 5.2 says the authorization endpoint *MAY* ignore the client-supplied me entirely, and sections 5.3.2 and 5.3.3 note the returned me *MAY* differ from the URL the client provided, giving the server an opportunity to canonicalize it.

The client-supplied me is still echoed in the redirect response for backwards compatibility with older clients.

Changes

• packages/endpoint-auth/lib/controllers/consent.js: use publication.me when signing the authorization code
• packages/endpoint-auth/test/integration/302-consent-submit-authenticate-with-me.js: updated to use a mismatched me value and assert publication.me is in the signed code
• packages/endpoint-auth/test/integration/302-consent-submit-authenticate.js: updated to assert publication.me is used when no me param is supplied

Fixes #911

[aciccarello]

Created this as a draft because I still need to test this locally but my brain needs sleep...

[aciccarello]

Okay, I tested this and confirmed that the access token and json response contain the value from publication.me. Sparkles was able to post successfully (though it shows the original rello.me as the logged in value). Quill was able to login and shows www.ciccarello.me as the logged in user.

My only remaining question is if there could be a problem if someone else set up their publication.me slightly differently (e.g. with a trailing slash) would that cause their Indiekit to stop posting and cause confusion? I wonder if this PR should get the canonical URL before setting the me value.

[paulrobertlloyd]

@aciccarello If you want to rebase this PR with the latest changes in main, I’d love to get this into the next beta release.

[aciccarello]

Looks like there is some kind of build permissions issue that is preventing the localization secrets to be loaded. My build logs show:

Run localazy/download@v1
  with:
    config_file: localazy.json

While passing builds show

Run localazy/download@v1
  with:
    read_key: ***
    write_key: ***
    config_file: localazy.json

[paulrobertlloyd]

@aciccarello Does the merger of #977 fix this for you?

[aciccarello]

Looks like it does!