| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Note: this requires a reindex of the media database. For the default
CAS backend, use the following:
```bash
for i in */*/*/*/*.json; do
etag="$(echo $i | sed -e 's/\///g' -e 's/\.json$//')";
mv "$i" "$i.bak"
cat "$i.bak" | jq '. + { "etag": '\""$etag"\"'}' > "$i"
rm "$i.bak"
done
```
This change is backwards compatible, but caching headers won't be
emitted without etags present in the metadata.
Actual etags are backend-specific and might differ from backend to
backend.
|
|
|
|
|
|
| |
I don't know how worthwhile that was, given that LibreJS developers
themselves don't care to properly declare licenses on the Bazaar
frontend they use to host the extension's source code on the Web 🤡
|
|
|
|
|
| |
This is a naive implementation that doesn't have some security
checks. It's ok tho, should work fine... can refine it later
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
| |
This neccesitates installing TypeScript to build Kittybox, but
thankfully Nix actually takes care of that. Build Kittybox with Nix
and you won't have problems.
Also now I can safely do stuff.
|
|
|
|
| |
AAAAAAAAAAAAAAAAAAAAAAAAA
|
| |
|
| |
|
|
|
|
|
|
|
| |
It looks like some badly-behaved apps require "scope" even though it
is optional according to OAuth2. Additionally, both of these fields
are not present in the IndieAuth spec (this is an error in the spec,
tracked here: https://github.com/indieweb/indieauth/issues/116
|
|
|
|
| |
JavaScript is a hellpit i want out of it please help me
|
| |
|
| |
|
| |
|
|
|
|
|
|
| |
There is a possibility of refactoring some of the companion code to
act as a generic embedded asset framework and put it in the `util`
crate.
|
|
|
|
|
|
|
|
|
|
| |
Working:
- Tokens and codes
- Authenticating with a password
Not working:
- Setting the password (need to patch onboarding)
- WebAuthn (the JavaScript is too complicated)
|
|
|
|
|
| |
Sometimes it is needed, for example, to construct an HTML form
pre-filled with the request data.
|
| |
|
| |
|
|
|
|
| |
Wiremock doesn't require external C dependencies.
|
| |
|
|
|
|
|
| |
Kittybox now uses tracing instead of log. Why would I keep an
unneccesary dependency in my Cargo.lock?
|
|
|
|
|
|
| |
Fetching profiles is now fully implemented. The only missing pieces
are the frontend template and the persistent store for tokens and
codes.
|
| |
|
| |
|
|
|
|
| |
I am procrastinating very hard right now.
|
|
|
|
| |
Some responses need to set Cache-Control and Pragma: no-cache headers according to RFC 6749.
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
content_type is now optional; if not specified, it will remain
empty. `application/octet-stream` will be put on read in the
frontend.
Length is now represented as NonZeroUsize - why would you upload a
zero-byte file when you can just conjure one from the void whenever
you need one? This should save me a little bit of memory.
Representing content_type as a typed MIME value would be the next
logical step.
|
|
|
|
|
| |
It turns out that BufWriter requires calling `flush()` manually and
doesn't do it on `drop()`. I forgot about that.
|
| |
|
|
|
|
|
|
| |
This requires the `axum` feature to be enabled, to prevent unwanted
dependencies (e.g. in client apps or when using a different framework,
since the library doesn't concern itself with I/O)
|
|
|
|
|
| |
Client ID and the redirect URI must match those that were used to
create the grant.
|
|
|
|
|
| |
This may help non-IndieAuth-aware clients to integrate better into the
flow.
|
|
|
|
|
|
|
| |
`kittybox_indieauth::Error` now represents errors in the IndieAuth
process itself. `IndieAuthError` got renamed to `ResourceErrorKind` to
reflect errors that a resource server (i.e. IndieAuth consumer) might
return to a client who somehow didn't authorize themselves properly.
|
|
|
|
|
|
|
|
|
| |
This will allow to display a prettier error page in the future.
There is a possibility of instantiating the panic handler per-module
to allow for custom panic messages expressed in the same form the
module itself gives error messages (e.g. pretty HTML for frontend,
MicropubError for Micropub messages etc.)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This is the living, breathing proof that Kittybox can be split into
independent components without sacrificing any functionality. Just
make sure all neccesary backing storage components are available to
the modules that need them.
Also the Micropub client was split into several files, because it's
about to get much bigger and more full-featured.
Yes, I am going to write it in vanilla JavaScript. I don't trust
anything from NPM to run on my computer. Not anymore. Not after the
node-ipc malware fiasco. And I am definitely not going to spin up a VM
or a Docker container (who uses Docker containers as a security
measure?) to hack on my own code.
Cargo can at least be sandboxed inside Nix, where it can't do much
harm. NPM basically requires unrestricted network access to download
dependencies, and it runs arbitrary code upon **downloading**
them. Cargo and rust-analyzer, on the other hand, can be configured to
not trust the source code and its dependencies (for example, Cargo
doesn't execute code on fetching dependencies - only on building, and
rust-analyzer's proc-macro expansion support can be sacrificed for
more security).
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Some kittybox-indieauth crate bugs were fixed
- Things should mostly work...
- ...if you somehow supply your own backend store
- YES I MADE IT MODULAR AGAIN
- NO I AM NOT SORRY
- YOU WILL THANK ME LATER
- DO NOT DENY THE HEAVENLY GIFT OF GENERICS IN RUST
- Retrieving profiles doesn't work for now because I am unsure how to
implement it best
|
|
|
|
|
|
| |
Really, it should be `Either<AuthorizationRequest, GrantRequest>` but
either serde or axum got iffy about me deserializing it from a
form. Not sure which one.
|
|
|
|
|
|
|
|
|
| |
This makes converting Option<TokenData> into a response and vice versa
a breeze, and hide the complexity of TokenIntrospectionResponse forced
upon this library by the IndieAuth standard.
Really, this type should've been represented as Option<TokenData>, I
just don't know how to add the "active" field to it properly.
|
|
|
|
| |
It looks like buffering reads can double my performance. Nice.
|
| |
|
| |
|
| |
|
|
|
|
|
| |
Turns out it was comparing the list of required scopes
with **itself**. Oops, that's a major security issue.
|
|
|
|
|
|
|
|
|
|
| |
This crate is the base framework-agnostic implementation of all data
structures and methods required for IndieAuth protocol. Anything that
can deserialize HTTP request payloads with serde can utilize this
crate.
This is a good candidate to independently release on crates.io when
the interface becomes stable enough.
|
|
|
|
|
| |
I'm afraid this might've caused me to do some weird stuff with the
tempdir. Better do it like this.
|
|
|
|
| |
On query parsing error, this will return a MicropubError.
|