#dev 2020-08-08

2020-08-08 UTC
#
gRegorLove prologic, that /post request isn't showing a request body in IE11. Is that being built by JS?
[schmarty] joined the channel
#
[schmarty] Maybe trying to use FormData?
#
gRegorLove Seems something like that. The input elements are actually outside the <form></form>
jjuran joined the channel
#
[schmarty] Oh that certainly seems like it would cause issues 😂
#
gRegorLove Whoa, TIL on a form input, `form` attribute lets you specify the form id and then it doesn't have to be a descendent
#
gRegorLove But I'm willing to bet IE11 isn't handling that correctly, hah
#
gRegorLove https://developer.mozilla.org/en-US/docs/Web/HTML/Element/textarea#attr-form
[fluffy] and [tantek] joined the channel
#
[schmarty] woah that is new to me as well
#
prologic Hmm
#
prologic So does IE11 handle this at all?
#
prologic If not I will have to refactor that as well
#
prologic I'm gonna have to fire this guy (freelancer) that did this 🤣
justache and geoffo joined the channel
#
prologic https://stackoverflow.com/questions/20658402/internet-explorer-issue-with-html5-form-attribute-for-button-element
#
prologic I think this answers that:
#
prologic IE does not support HTML5 form attribute for <input> or <button> element yet.
#
prologic Does anyone know if nested <form>(s) are okay?
#
prologic I'll just put the <input> and <button> back inside the form
#
gRegorLove I was wrong about the empty request body, it's sending field `hash` but with no value. That's the only hidden form input inside the <form> id=twtForm
#
gRegorLove So it seems like #twtForm.submit() is not finding the outside <textarea> to submit in IE11
#
gRegorLove Yeah, personally my first idea would be to have all the inputs inside the form and use regular input type=submit if possible.
#
gRegorLove Don't think you can nest forms
#
gRegorLove I'd also try to use one form with multipart/form-data instead of separate forms
#
prologic Well I have to use separate forms I think?
#
prologic As the image upload is an out-of-band action
#
prologic it returns the URI for the uploaded image
#
prologic which then gets shoved into the textarea with a Markdown-style link
#
gRegorLove Ah, photo gets insert into the <textarea> so it can be edited before you post?
#
prologic But I don't have to nest forms here
#
prologic that's okay, its already handled by JS
#
gRegorLove I haven't played with the photo upload yet
#
prologic And that part works correctly
#
prologic Yeah it just gets inserted as a Markdown image link
#
gRegorLove Sorry to bring bad news, that doesn't seem to work in IE either :|
#
gRegorLove After I select a photo to uplaod I see an "Add" button beside it, nothing new in textarea
#
gRegorLove In Chrome the Add button inserts the Markdown. IE the Add button opens the file dialog again
#
gRegorLove Heading afk for a bit
#
prologic Hmm
#
prologic Let me fix this issue first re the form= atttrs
#
prologic And then if you can help me fix that too on IE I'd appreciate it
#
prologic gRegorLove okay when you're back I fixed everything just discussed
#
prologic I *hope* the image upload works on IE now
#
prologic :)
#
prologic as well as posting in general
#
gRegorLove Text post worked. After selecting a photo and clicking add it appended `![]()`
#
prologic well fuckety fuck fuck :)
#
prologic Any ideas why? :)
#
prologic Probably a JS bug or some JS compatibility
#
[schmarty] yeah sounds like it's trying to use APIs to get at the uploaded file and then drop a markdown image embed, but is missing the actual data. maybe with the FileUpload API which is probably not IE11. 😄
#
gRegorLove input name=media_file is still outside the form#uploadForm
#
gRegorLove It's inside the form#twtForm
#
gRegorLove The upload endpoint returns JSON with the media URL, it's blank. So it appears selected image isn't getting sent with the upload request
#
prologic Ahhh!
#
prologic I have to show that inside too?
#
gRegorLove (Not entirely blank; the JSON is there but it doesn't have a media URL)
#
prologic *nods*
#
prologic I _thought_ I polyfilled everything required
#
gRegorLove I'm not sure, I'm kinda turned around with these forms and trying to read the JS
#
prologic maybe I missed an element, lemme see
#
gRegorLove upload response is `{"Type":"mediaURI","Path":""}`
#
prologic L125: // Polyfill the #uploadForm so things work correctly across all browsers (IE)
#
prologic L126 u("#uploadForm").append(u("#uploadMedia"))
#
gRegorLove twtxt.js? I'm just using Chrome prettify, but it's only 115 lines XD
#
prologic Haha
#
prologic But of course :)
#
gRegorLove I don't see a line like that in there
#
prologic https://github.com/prologic/twtxt/blob/master/internal/static/js/twtxt.js
#
prologic Maybe this helps :)
#
gRegorLove oh hey
#
gRegorLove cool
#
gRegorLove (I also hadn't refreshed Chrome, oops)
#
prologic Oh :)
#
prologic Yeah caching is hard
#
prologic We busy the cache with Commit hashses
#
prologic But I think browsers are sometimes stupid?
#
prologic 🤣
#
gRegorLove I'm not familiar with the polyfille being used here or Twix, so might be about the end of how much I can help unfortunately
#
gRegorLove The request's Content-Length is 198 so photo definitely isn't getting uploaded
#
gRegorLove `u("#uploadForm").first()` returns the form element itself; not the #uploadMedia file input
#
prologic And you're not getting an error?
#
prologic What image/* are you testing with ?
#
prologic An image/jpeg or something else?
#
gRegorLove #uploadForm has no child elements, so I *think* it's literally trying to upload the form element, which is empty
#
gRegorLove jpeg
#
prologic Hmm
#
prologic u("#uuploadForm").first() should return the entire form
#
prologic Its part of UmbrellaJS's API which returns the first matching element
#
prologic rather than UmbrellaJS's object
#
gRegorLove It does, but IE doesn't have any inputs in that form
#
prologic despite the lines above .append()'ing it in?
#
gRegorLove I mean, neither browser does... I'm not sure how Chrome is finding it
#
prologic Oh wait I think I found a bug
#
prologic u("#uploadForm").append(u("#uploadMedia"))
#
prologic That should probably be:
#
prologic u("#uploadForm").append(u("#uploadMedia").first())
#
gRegorLove That looks right. `u("#uploadMedia").first()` gives me the file input
#
prologic https://umbrellajs.com/documentation#append
#
prologic according to the docs though it should work just fine
#
gRegorLove Learning a new JS framework by trial and error over here :)
#
prologic :D
#
prologic So adding .first() is the fix here?
geoffo joined the channel
#
prologic still works in CHrome so *meh* :)
#
gRegorLove It makes sense to me at least trying it out in the console. Without .first I just get an [object Object]. With it I get the actual file input
jimpick and mitchell joined the channel
#
prologic Okay redeployed
#
prologic Let's hope this is the fix :)
#
gRegorLove Aside, the UI doesn't show the photo I've selected, so I was a bit confused at first, didn't realize I needed to click Add to insert the photo
#
gRegorLove *fingers crossed* refreshes to try again
#
prologic Yeah something to improve upon
#
prologic add a little thumbnail of it next to the add butotn
#
prologic Maybe even with a little X (nah changed my mind) type of thing
#
prologic even though its already been uploaded!
#
prologic NB: I suck at UI/UX :)
#
prologic Not my foré
#
prologic forté*
mattl and myfreeweb joined the channel
#
gRegorLove Hm, still didn't work.
#
gRegorLove Content-Length: 198
zootella joined the channel
#
gRegorLove Man, IE makes it difficult to inspect JS to see if I've got the latest version. Did hard refresh a couple times though.
#
prologic Hmm
#
prologic Okay where are those f'n IE VMs
#
prologic Must be something non-obvious we're missing here
#
prologic What if I don't polyfill this crap at all
#
prologic hmm that might be quite ahrd acually
#
prologic yeah this idea doesn't work
[tb] joined the channel
#
gRegorLove Can the #uploadMedia be put inside that form so you don't have to do any appending?
#
prologic And make the /post handler do two things?
#
gRegorLove No, #uploadMedia inside #uploadForm
#
gRegorLove #twtForm is the one handled by /post
#
prologic OH yes that's what I was just trying
#
prologic But I couldn't figure out a way to activate the mediaUpload type=file input field from JS
#
prologic Seems like a security issue?
jimpick joined the channel
#
prologic I tried stuff like u("#uploadMedia").trigger("change") and u("#uploadMedia").trigger("click"), etc
#
gRegorLove It's activated when you click "Add" I thought?
#
prologic Chrome didn't like any of that and did nothing
#
prologic Yes but I couldn't bring up the "file selection" dialog I mean
[tantek] joined the channel
#
gRegorLove Sure, the file input and the add button would need to be inside the same form
#
prologic Ahh I see
#
prologic But then we have a style / UI/UX problem
#
prologic That I'm not I'm capable of solving :)
mattl joined the channel
#
prologic Okay that seems to work out okay
#
prologic now the camera icon is at the top of the textarea
#
prologic onbviously
#
prologic But now I have to think about how to make this generally better
#
prologic maybe stick a row of buttons along the top <B> <I> <Ccamera> etc
#
prologic Okay I'm going to deploy and push this out
#
prologic LMK if it works (give me a few mins)
#
prologic Okay deployed
#
gRegorLove Worked!
#
prologic Nice
#
prologic Now I'm going to improve this sucky UI :)
#
prologic Assuming I can!
#
prologic I really am not that good at CSS
nickodd joined the channel
#
prologic gRegorLove wannt try it one more time?
#
prologic its now just a single button :)
#
GWG I tried to outline possible topics for a Microformats 2 session https://indieweb.org/2020/Pop-up/Sessions#Agenda
#
prologic I'm _going_ to try to actually create a toolbar of sorts
#
prologic Okay I now have a VM with IE in it :)
#
prologic So I know the image upload with single button UI/UX works
#
gRegorLove Coo, prologic. Might take a look at Quill for UI ideas, I know it has a photo upload.
#
gRegorLove Using CSS Grid or flexbox, you could probably put the upload stuff beside the textarea on the right or something
#
prologic Ahh yeah
#
prologic I'll have a fiddle :)
#
prologic Thanks for help btw!
#
gRegorLove You're welcome!
#
gRegorLove Ok to delete the posts I made?
[chrisaldrich] joined the channel
#
prologic If you wish :)
#
prologic https://imgur.com/a/qJiUIom
#
prologic How do I fix the positioning of this form?
#
prologic its coming from the <input type="file"> element
#
prologic it has some space around it I don't understand where that's coming from
#
Loqi gRegorLove has 13 karma in this channel over the last year (79 in all channels)
#
[chrisaldrich] gRegorLove++ for troubleshooting IE
#
prologic hah
#
prologic I think I fixed it :)
#
prologic gRegorLove++ for helping me with my side project https://twtxt.net/ Thank you!
#
Loqi gRegorLove has 14 karma in this channel over the last year (80 in all channels)
[jeremycherfas] joined the channel
#
prologic In Markdown or even HTML
#
prologic What do you call the ** __ prefix/suffix strings
#
prologic do they have a name?
tomasparks joined the channel
#
prologic Well despite the fact I can't code my way out of a paper bad when it comes to UI/UX and CSS
#
prologic I think I did a pretty good job with the new toolbar on https://twtxt.net/ just deployed :)
#
prologic We have very basic B I link, image and upload buttons
#
prologic And yes I made sure they also work in IE :)
dckc, jjuran, moppy, gRegorLove, [chrisaldrich], jeremy and [mapkyca] joined the channel; prologic left the channel
#
Zegnat !tell prologic,gRegorLove just saw your discussions on IE compatibility. Specifically re "Edge uses Chromium now, right?" The answer is yes AND NO. Officially there are 2 stable versions of Edge, one running Chromium and one running EdgeHTML. We ran into problems with that at work recently, because we support Edge and *thought* we were testing Edge. Turned out we were not testing both Edge.
#
Loqi Ok, I'll tell them that when I see them next
dhanesh95, leg and [grantcodes] joined the channel
#
[grantcodes] The old edge is only supported for enterprise I think though. TBH I wouldn't bother with ie or old edge unless the project has a specific reason to support them.
[jeremycherfas] and jamietanna joined the channel
#
jamietanna Something I thought about the other day, but forgot to share, off the back of the Micropub Pop-Up a couple of weeks ago is post-type-discovery for Pages opposed to Posts. I was thinking that, at least on my site, I'd only expect to see a dt-updated on a page, whereas a post may have dt-published and dt-updated
#
Loqi jamietanna: craftyphotons left you a message 1 week, 2 days ago: Aha gotcha! This is something I really love about IndieWeb so far, the broad range of architectures/system designs from individual to individual and the attitude that there's no such thing as One True Architecture
#
Zegnat [grantcodes]: for us the problem was mostly that we would tell people we support Edge, and then you get people calling the support line saying the product does not work even though they are using Edge.
#
Zegnat And suddenly you end up in situations where you need to try and explain that you do not support Edge 44, even if someones computer says there is no newer version available and Microsoft labels it as a stable release, and really want people to update to Edge 84.
nickodd and [tantek] joined the channel
#
jacky jamietanna: very interesting point
#
jacky I leaned into h-page because of the need to separate how pages are not semantically timeless (like comparing a page in a book to a page in a journal or diary - leaning on the "weblog" part of things)
#
jacky this might be a step after resolving for an article
#
jacky in the post type discovery tbh
#
jacky what is pt
#
Loqi It looks like we don't have a page for "pt" yet. Would you like to create it? (Or just say "pt is ____", a sentence describing the term)
#
jacky what is ptd
#
Loqi Post Type Discovery specifies an algorithm for consuming code to determine the type of a post by its content properties and their values rather than an explicit “post type” property, thus better matched to modern post creation UIs that allow combining text, media, etc in a variety of ways without burdening users with any notion of what kind of post they are creating https://indieweb.org/PTD
#
jacky tbh
#
jacky lol I hope the work that [manton] put into h-page isn't too much
#
jacky but the thing is how do you remove the published date of something that's ... published into the world?
#
jacky I guess that plays into why `post-status: published` is a thing
#
jamietanna jacky I was thinking this could be true with h-page, too. Or does Post Type Discovery only relate to h-entry?
#
jacky well as it stands, post type discovery only has been used for h-entry, it doesn't seem to make sense for things like h-entry or h-card (those semantic differences are also why I was inclined to go the h-page route)
#
aaronpk no h-event is one of the outputs of PTD
[schmarty] joined the channel
#
jacky wat
#
aaronpk oh it's "under consideration"
#
aaronpk wait no it's in there
#
jacky I was about to freak out - thinking I didn't implement it correctly
#
aaronpk first thing http://ptd.spec.indieweb.org/#algorithm
#
jacky jamietanna: https://indieweb.org/post-type-discovery#Entry_only_or_events_too
#
jacky ooh my fault jamietanna
#
jacky ah okay
#
jacky so aaronpk from that, parsing by the `type` key is a thing
#
aaronpk yes, and h-event is first in the list because there's no way for an h-entry to be an event
#
jacky funny enough there's a Page object in AS2 https://www.w3.org/TR/activitystreams-vocabulary/#dfn-page
#
aaronpk if recipe were to be added then h-recipe would also come before all the h-entry ones
#
jacky tbh I think that could be optimized out a bit (if the `type` key matches a known microformats, begin parsing under that format's rules (entry, event, etc))
#
jacky (but that's further along)
#
aaronpk right now the algorithm is a flat list, i'm not sure turning it into a hierarchy actually buys anything
#
jacky nothing immediately
#
jacky is looking at https://www.w3.org/TR/activitystreams-vocabulary/ and wasn't aware of all of the explicit actions expressed by it
#
Loqi [James M Snell] Activity Vocabulary
#
jacky like group management is more-or-less baked in (the raw parts of it at least)
#
aaronpk yeah but "built in" doesn't mean anyone actually implemented it
#
aaronpk i would describe it more as prematurely prescribed
#
aaronpk the danger of specifying things that nobody has built yet is it's quite possible the model is wrong and you won't know until you try to start shoehorning things into the prescribed model
#
jamietanna ah my bad, so similarly for post-dype-discovery, if it received an h-page, it'd be a page
[manton] joined the channel
#
[manton] I did roll back all my h-page stuff, by the way. Micro.blog uses the new channels proposal in Micropub, and everything is an h-entry.
[grantcodes] joined the channel
#
[grantcodes] I added any h-type that's not entry to my ptd
#
sknebel I seem to have missed the previous discussion - any hints on how consumers would treat pages and entries differently?
#
sknebel (is there an archived pad or something from a session?)
#
aaronpk i think so far the discussion is mostly around authoring
#
aaronpk micropub clients creating and editing pages vs posts
#
sknebel guess ptd can play a role there too, true
#
jacky yeah I had to think on it and it's definitely more of an authoring thing
#
jacky my case for it is for having the ability to build things like a contact page or have my 'now' page be dynamically editable
#
jacky like I don't see how I'd make a page like this cleanly (in my site at least) using micropub https://jacky.wtf/library.html
#
jacky or https://jacky.wtf/live.html
#
jacky needs to wipe that schedule lol
#
Zegnat jacky++ for using https://jacky.wtf/twitch/ to link to your Twitch page, now that is really keeping things to your own domain!
#
Loqi jacky has 31 karma in this channel over the last year (115 in all channels)
deathrow1 joined the channel
#
jacky haha own your links!
#
Zegnat hits follow on jacky's Twitch
#
jacky it's almost always shorter to use my URL links versus silo links
#
jacky that's mainly because I use my whole name as a username
#
jacky damn now I'm really thinking harder about this h-page versus ptd resolution within h-entry thing
#
Zegnat jacky: my URL is my whole name, so that one is pretty easy to beat, haha
#
Zegnat Although I recently got just my first name as domain, when my mum spotted it on sale. So I may need to switch to that as a redirect-hub. Mmmmm. Weekend project.
#
jacky yup yup!
#
Zegnat adds task: copy jacky
#
GWG Zegnat: Your mother is hunting for new domain names for you?
#
Zegnat Apparently, GWG
#
GWG I'll tell mine.
#
jacky ha
#
Zegnat Basically what happened was she came up to me and told me some Swedish domain seller was having a sale on dot-se domains, and that she had checked my name for availability, urging me to get it because I could always not renew and the price was super low for the first year anyways
prologic joined the channel
#
prologic Hey 👋 If anyone is looking for something to and loves Go/Golang, simple HTML/JS/CSS come help me out over at https://github.com/prologic/twtxt/issues there are loads of issues we need to get done! :D
#
Loqi prologic: Zegnat left you a message 5 hours, 7 minutes ago: just saw your discussions on IE compatibility. Specifically re "Edge uses Chromium now, right?" The answer is yes AND NO. Officially there are 2 stable versions of Edge, one running Chromium and one running EdgeHTML. We ran into problems with that at work recently, because we support Edge and *thought* we were testing Edge. Turned out we were not testing both Edge.
#
aaronpk is getting set up for the indieauth session
#
Zegnat Same here. That is: I am making sure I have something to drink
#
sknebel hopes the lawn-mowing neighbor is done by then...
#
prologic aaronpk you going to submit a PR for that?
#
prologic That would be awesome :)
#
aaronpk i don't think you want me writing any Go
#
aaronpk i was talking about https://events.indieweb.org/2020/08/indieauth-1-1-identity-protocol-standards-session-6xlxgeCEMgv8
#
prologic Oh
#
prologic rats :)
#
prologic here's to hoping for more contributors :)
[tantek] and [Rose] joined the channel
#
[tantek] is this the chat channel for the IndieAuth pop-up?
#
GWG [tantek]: I think it should be. It's a very devvy topic. But not sure
#
aaronpk https://etherpad.indieweb.org/IndieAuth-Popup
#
jacky hmm looks like I'm waiting to enter
#
jacky might be because I'm not signed in
#
sknebel aaronpk: ^^^
#
aaronpk sorry the meeting has the waiting room enabled and it was on my other screen
#
@jackyalcine Currently at https://events.indieweb.org/2020/08/indieauth-1-1-identity-protocol-standards-session-6xlxgeCEMgv8 talking shop about http://indieauth.spec.indieweb.org/. (https://v2.jacky.wtf/post/79cd622f-7ae5-47cd-a94e-e15bfaf6b4b1) (twitter.com/_/status/1292142270859411457)
#
@vaughnhannon Round 4 of the US Go Congress Open is happening. My game here: https://online-go.com/game/26012444 Also on: * http://online-go.com * http://brid.gy ### _Related_ (twitter.com/_/status/1292146247793610752)
#
[tantek] is in the waiting room for IndieAuth 🛎
[chrisaldrich] joined the channel
#
[chrisaldrich] 👋 tantek; which also reminds me aaronpk should do a photo at the break before we lose others. I think Rose and one or two others have left already
#
[Rose] My internet keeps dropping out and I have to grab some food.
#
aaronpk [Rose]: do you have time for a photo after this issue?
[jgmac1106] and [schmarty] joined the channel
#
[Rose] I’m literally sitting down to dinner I’m afraid
#
[tantek] yeah let's wait for [Rose] to do a photo! Good suggestion [chrisaldrich]++
#
Loqi [chrisaldrich] has 11 karma in this channel over the last year (66 in all channels)
#
[Rose] I might not be able to come back, I’m at my parents’ hosue.
#
[Rose] Don’t wait for me
leg joined the channel
#
@aswath ↩️ My rec is use of indieauth since it allows for users to bring their own id, which can be even an email id. See https://blog.enthinnai.com/2020/07/21/defining-id-authenticators-and-approaches-to-federation-for-webrtc-based-systems/ for more details. /3. (twitter.com/_/status/1292166330288873475)
#
[tantek] nice
#
voxpelli Regarding how to rewrite headers with Cloudfront Workers: https://developers.cloudflare.com/workers/templates/pages/modify_req_props/
geoffo joined the channel
#
[schmarty] gonna head out! thanks everyone! learned a lot and excited that progress was made today!!
#
aaronpk byeeee
#
[chrisaldrich] aaronpk++ for prep, leadership, and volunteer work on IndieAuth session
#
Loqi aaronpk has 67 karma in this channel over the last year (245 in all channels)
#
Zegnat So this is going to give me some selfauth stuff that is now going to need revising sooner than later, I guess :)
#
jacky buhbye
#
jacky also do we dump those notes onto the wiki?
#
jacky got this question re: the micropub one
#
GWG jacky: Yes?
#
jacky https://toot.cafe/@zack/104655019436538810
#
Loqi [Zack] @jalcine You went to a micropub session a while back, right? Did anything interesting come out of that? On a side note: do the indieweb events have minutes published or is it up to the individual attendees to post about it?
#
jacky is there a particular category for it? the micropub event didn't have it linked https://events.indieweb.org/2020/07/micropub-pop-up-session-kGMIMOXFUdBn
#
GWG jacky: You are wrong. We did post it to the wiki on the popup page
#
GWG And there is a video
#
Zegnat jacky: this? https://indieweb.org/2020/Pop-ups/Micropub
#
jacky oh that link is _not_ clear
#
GWG The link doesn't show that it's to a page, not the root
#
jacky it says 'indieweb.org', I would have not suspected that it was the result
#
GWG I think that may be a Meetable issue worth filing
#
GWG I still want to talk expiring tokens at some point
#
GWG I just want to talk about things
#
Zegnat Also wondering if we maybe should not be hiding past popups under See Also? https://indieweb.org/2020/Pop-ups#See_Also
#
Zegnat Is there a GitHub issue for it, GWG?
#
GWG FYI, Zegnat, I made a list of potential Mf2 topics.
#
GWG Zegnat: https://github.com/indieweb/micropub-extensions/issues/17
#
Loqi [EdwardHinkle] #17 Dealing with Expiring Tokens
#
Zegnat Aah, I thought maybe it was a topic on IndieAuth spec
#
GWG The issue is that we haven't had anyone implementing them, so there is no expected behavior except that the client would suddenly stop working
#
GWG I'd like a client to look for the expires_in parameter and address it
#
jacky Zegnat: I agree, should be made into an index
#
jacky _or_ leaning into MediaWiki and making it into a category
#
jacky let the software organize stuff for us lol
#
GWG I thought we had a category
[tb] joined the channel
#
Zegnat https://indieweb.org/Category:IndieWebCamp_Pop-ups_2020 ?
#
GWG I think we just have a general popups category
#
Zegnat Aah, and then I guess the sub category https://indieweb.org/Category:IWC_Pop-ups_2020_Sessions is for sessions that have a date decided and/or have already been had?
#
Zegnat A little hard to find if I am being honest
#
Zegnat GWG: gotcha on the expiring token thing. I am just thinking how much of that needs to be specified, and how much of it should be pointing at OAuth RFCs simply because the bearer token could be any OAuth bearer token...
#
Zegnat [tb]++ for going to quickly from "I will implement" to "it is implemented" on the IndieAuth/OAuth stuff!
#
Loqi [tb] has 1 karma in this channel over the last year (2 in all channels)
#
Zegnat I am going to have to have a think about what all of this means for Selfauth. It may mean it needs to drop authorization again and only support authentication.
#
[tb] Hehe thanks [Zegnat], blame it all on the excellent Doorkeeper library — I think extracting what I've built in Singulus into something reusable as a Doorkeeper extension gem might be my first contribution back to the IndieAuth ecosystem
#
[tb] Guess I can go remove the `me` verification stuff I was doing in my authorization flow now
nickodd left the channel
#
Zegnat Yeah. It has always been one of these things that you never really needed as long as you had a way to internally resolve the `code` in such a way that the token would always be granted for the correct `me`.
#
Zegnat Because the `me` you get submitted is untrusted anyway.
#
[tb] So what I've been doing is I have a `profile_urls` column on my `users` table, and if the `me` param doesn't match one of the values in there for whoever the logged in user is it won't even let you authorize the request
#
[tb] Which in hindsight I think I just did because it felt like the correct paranoid thing to do
#
[tb] But there really would've been no consequence to anything if I'd just let any `me` value in anyway
#
Zegnat Yeah, that matches the minimal implementation we have kinda seen around. It is used for an additional verification layer. But that is it. And if we really look at what that verification is protecting against we seem to come up empty handed.
#
GWG Zegnat: Re the bearer token...is that something you can elaborate on
#
Zegnat GWG: re Micropub, I meant that Micropub spec does not actually specify where the token is coming from. Only that it is something that matches the OAuth RFC 6750.
#
Zegnat So the question to me is whether it would be enough for Micropub spec to just say "expiry of these tokens is handled through RFC ####" and leave it at that
#
GWG Maybe I could talk swentel into working on it
#
GWG I need a client buddy
#
Zegnat I guess I am just trying to ascertain whether refresh tokens are a feature of the IndieAuth spec, the Micropub spec, or something that is completely outside of these specs and should just be left to OAuth RFCs ....
[snarfed] joined the channel
#
aaronpk I can't think of any functionality of refresh tokens that is unique to IndieAuth
geoffo joined the channel
#
Zegnat Neither can I. So I guess the question is more one of: should be inform Micropub client makers that refresh tokens are a thing they may want to consider?
#
Zegnat Hmm. I guess selfauth can get half a PKCE implementation. It can only support it for authentication requests, because it has no way to communicate the verifier to a token endpoint 🤔
#
[schmarty] seems to me in the split-endpoint case that the token endpoint would be expected to pass along the code_verifier to the auth endpoint.
#
Zegnat I will have to whiteboard it, I think, to see if it makes sense to implement that or not.
#
Zegnat Also then raises the question, what if selfauth adds the thing, and the client supports it, but the token endpoint does not? Suddenly it is no longer a progressive enhancement either between 2 parties, as there are now 3 parties
#
Zegnat If client and selfauth support PKCE, but token endpoint does not, will selfauth just not accept any calls from the token endpoint because they cannot be verified? Tricky....
#
Zegnat (This may just lead to me merging selfauth into mintoken so there is just the one integrated solution.)
gRegorLove joined the channel
#
aaronpk alright, now to work on some of the things i just promised to do
#
GWG aaronpk: Keep us posted
#
GWG I'm going to read the oauth document you cited
#
aaronpk which?
#
aaronpk i cited several :)
#
GWG The 2.1 document dated 30jul
#
aaronpk aha yes
#
GWG I figured it might have something worth knowing
#
aaronpk nobody took notes on prompt=login?
geoffo joined the channel
#
Zegnat Hmm. I did not. I was still trying to figure out what / if any / of it could be condensed into points re IndieAuth
#
GWG I'm thinking of next steps I can do
#
Zegnat Adding PKCE?
#
GWG Zegnat: That would be redundant
#
GWG Who do you think aaronpk added it to Quill for?
#
Zegnat ah, ha!
#
Zegnat Guess you are all IndieAuth'd up already then ;)
#
GWG I also have profile support, but not scope
#
GWG Wondering if I should add an error_uri to my error return to tell people how to fix the authorization header problem
#
aaronpk that's exactly the intended use of error_uri!
#
GWG aaronpk: Yes, but if it isn't commonly done.. will people notice it?
#
GWG The people who have that problem
#
Zegnat I guess that would be up to clients to show.
#
GWG Can't hurt, I guess
#
aaronpk hmm should we move https://github.com/tantek/post-type-discovery to the indieweb org?
#
Loqi [tantek] post-type-discovery: Post Type Discovery editor's draft
#
aaronpk also i realized it's not on spec.indieweb.org
#
GWG I think so.
[chrisaldrich] joined the channel
#
aaronpk it feels good to delete large parts of a spec
#
[tantek] oh dear
[tw2113] joined the channel
#
[tantek] aaronpk, maybe not urgent since https://ptd.spec.indieweb.org/ does work?
#
Loqi [Tantek Çelik] Post Type Discovery
#
aaronpk ah hm
#
[tantek] feel free to file an issue though about moving it to the indieweb org: https://github.com/tantek/post-type-discovery/issues
#
[tantek] that's a serious request to be clear, not a dismissal