source: Klonkt/package.json@ 520e477

main
Last change on this file since 520e477 was d49b60b, checked in by Robin <roboburr@…>, 7 weeks ago

Feature: OAuth 2.0 for ActivityPub C2S (phase 1 — auth handshake)

First half of AP Client-to-Server: the auth layer native/web clients (Shaer)
need before they can drive a Klonkt account. The AP spec's own C2S half is what
keeps this inside-spec instead of cloning Mastodon's REST API.

  • OAuthService: public-client OAuth (RFC 8252), PKCE S256 REQUIRED, no secrets. Dynamic registration (RFC 7591 subset) with strict redirect_uri validation (https / loopback http / reverse-DNS custom scheme). Single-use 10-min codes; tokens stored sha256-hashed; a token is scoped to one user + one site.
  • routes/oauth.js: /oauth/register, /oauth/authorize (session-authed consent screen picking the site), /oauth/token, and RFC 8414 server metadata at /.well-known/oauth-authorization-server. Redirect params are appended to the registered URI verbatim (no new URL() round-trip that would mangle a native custom scheme). Pre-redirect validation errors never bounce to an unvalidated URI (open-redirect guard).
  • Actor doc advertises oauthAuthorizationEndpoint/oauthTokenEndpoint/uploadMedia in endpoints{} — all AP-spec terms, added to the AS2 conformance allowlist — so clients discover paths instead of hardcoding them (Klonkt's /ap/users/:slug differs from the daemon's /actors/:name; discovery makes that irrelevant).
  • oauth_clients/oauth_codes/oauth_tokens tables (additive).
  • i18n NL/EN/DE for the consent screen.

7 new OAuth tests (PKCE round-trip, replay protection, wrong-verifier reject,
bearer resolution incl. revoke, redirect-uri validation); 73 green. Verified
the full HTTP flow end to end (register → consent → code → token → bearer) and
that the raw Location header preserves the native redirect URI exactly. Beads:
klonkt-demo-srr. Next: klonkt-demo-1w4 (POST outbox accepts the activities).

Co-Authored-By: Claude Opus 4.8 <noreply@…>
  • Property mode set to 100644
File size: 1.1 KB
RevLine 
[7bc636b]1{
[7007d4c]2 "name": "klonkt",
[d49b60b]3 "version": "1.6.0-dev",
[5a4c0b0]4 "description": "Klonkt — self-hosted multi-site music & blog platform (solo, hub or circles). Node + SQLite + htmx.",
5 "license": "AGPL-3.0-or-later",
[7bc636b]6 "type": "module",
7 "main": "src/server.js",
8 "scripts": {
9 "start": "node src/server.js",
10 "dev": "node --watch src/server.js",
[8398935]11 "test": "node --test",
[9e27d64]12 "migrate": "node src/db/migrate.js",
[3e86f1c]13 "reset-admin": "node scripts/reset-admin.mjs",
14 "backfill:durations": "node scripts/backfill-durations.mjs"
[7bc636b]15 },
16 "dependencies": {
[69815b2]17 "@resvg/resvg-js": "^2.6.2",
[7bc636b]18 "bcryptjs": "^2.4.3",
19 "better-sqlite3": "^11.3.0",
20 "body-parser": "^1.20.2",
21 "dotenv": "^16.3.1",
22 "ejs": "^3.1.9",
23 "express": "^4.18.2",
24 "express-rate-limit": "^7.4.1",
25 "express-session": "^1.17.3",
26 "ffmpeg-static": "^5.2.0",
27 "fluent-ffmpeg": "^2.1.3",
28 "helmet": "^7.1.0",
29 "htmx.org": "1.9.12",
30 "marked": "^11.1.1",
31 "multer": "^1.4.5-lts.1",
[ecbfa41]32 "node-webpmux": "^3.2.1",
[9e27d64]33 "nodemailer": "^6.9.15",
[7bc636b]34 "sanitize-html": "^2.17.3",
[5f483e3]35 "uuid": "^9.0.1"
[7bc636b]36 },
37 "engines": {
38 "node": ">=20"
39 }
40}
Note: See TracBrowser for help on using the repository browser.