#dev 2021-04-14

2021-04-14 UTC
astralbijection joined the channel
#
[raph_l] I might be misunderstanding something, but i'm imagining a flow where:
#
[raph_l] 1. I get redirected to my auth endpoint from the requesting app
#
[raph_l] 3. I get redirected to the consent screen
#
[raph_l] 2. I sign in, or my auth endpoint sees that I'm already signed in
#
[raph_l] and it's step 3 you're thinking about
#
jacky it's a mix of step 2 and 3 - the tool I have (Sele) doesn't have a means of 'confirming' the identity of the user signing in
#
jacky so what I've done right now is store requests internally as unapproved
#
jacky I was thinking about having another endpoint that pushes state changes for requests so when the client attempts to redeem the code, it'll eventually approve it
#
jacky there's an error state 'authorization_pending' that could be used here
#
jacky but it's conventionally used in the OAuth2 Device flow (IIRC)
#
jacky wants this endpoint to be a bit of a backing service for a IndieAuth provider and also something people can use to run on their own
#
[raph_l] I'm finding "sele + auth/ software / oauth" unexpectedly hard to google
#
jacky ooof sorry hold on
#
jacky https://git.jacky.wtf/indieweb/sele is the project
#
jacky I'm following https://indieauth.spec.indieweb.org/ + https://oauth.net/2/device-flow/ (namely https://developer.okta.com/blog/2019/02/19/add-oauth-device-flow-to-any-server)
#
[raph_l] interesting, I haven't looked at device flow before
[tantek] joined the channel
#
[tantek] Was this already shared here? https://blog.steren.fr/2020/my-stack-will-outlive-yours/ feels very IndieWeb
__minoru__shirae joined the channel
#
aaronpk i just logged in to iA Writer on my mac and discovered a minor UX thing I need to change on my indieauth server
#
aaronpk because the "redirect" back to the app launches the app, the browser is just left there on the consent screen
#
aaronpk so ideally I'd use some javascript to watch for the button press on "authorize" and then clear out that screen to show a message like "great, you'll be taken back to the app" before actually doing that redirect
[tw2113_Slack_], GWG, paramdeo and shoesNsocks joined the channel
#
maxwelljoslyn test
maxwelljoslyn joined the channel
#
maxwelljoslyn Oh no. meetable does not support <s>
#
aaronpk oops! it should support <strike> tho
paramdeo and astralbijectio joined the channel
#
astralbijectio I'm having a little bit of a design dillema with my website right now
#
astralbijectio Essentially, I have articles, but not notes, and I want to add a note functionality that can be POSSE'd to places like Twitter
#
aaronpk a note is just an article with no title
#
KartikPrabhu "just"
#
aaronpk :D
#
astralbijectio Well, that part isn't too hard, but the POSSEing is the slightly bigger issue lol
#
KartikPrabhu you can use Bridgy publish to POSSE to twitter
#
KartikPrabhu that is what I do
#
astralbijectio Well, it's a static site that stores its stuff in the filesystem
#
astralbijectio But there's also an API that backs its comments and a few other things
#
KartikPrabhu you can use Bridgy publish as long as you have a URL for the note
#
KartikPrabhu it is semi-manual POSSE
#
astralbijectio Well, I could do that, but I'm trying to do it automatically ;)
#
astralbijectio with my own code
#
KartikPrabhu ok so the issue is automatic POSSE not notes
#
astralbijectio yeah, pretty much
[snarfed] joined the channel
#
[snarfed] bridgy publish can be fully automatic. https://brid.gy/about#webmentions
#
astralbijectio My idea was kinda like having a package-lock, except for notes
#
astralbijectio and having my ssg edit and commit that file
#
astralbijectio Hmm, maybe I could use bridgy, though I'm kinda wanting to make a DIY solution
#
KartikPrabhu you can start by doing it manually, and then build up from there
[Joshua_Sim] and [KevinMarks] joined the channel
#
[KevinMarks] you can send them through to twitter if you have an api key
#
[KevinMarks] I have a node project that does it on glitch https://glitch.com/edit/#!/it-me-web
#
astralbijectio Honestly, at this point, I'm starting to wonder if it's even worth having my site be static anymore lol
#
astralbijectio It seems like there's a lot of conflicting stuff that I want, I may need to think about it a bit more
#
astralbijectio Like, I want to code my own dynamic functionality, yet I also want a static site so that it loads quickly, but then I also want to store everything in a git repo as plaintext rather than a database
#
astralbijectio And then, I also don't want to switch away from React because I have 7k lines of that now, but it takes a bit of time to build statically
sknebel joined the channel
#
aaronpk we really need some more indieauth servers!
#
aaronpk also wooooow it's kind of magical to publish to my website from iA Writer
#
aaronpk alright step 1
#
aaronpk is done
#
aaronpk https://aaronparecki.com/2021/04/13/26/indieauth
#
Loqi [Aaron Parecki] How to Sign Users In with IndieAuth
#
aaronpk next up is the other half: how to build an indieauth provider
#
GWG aaronpk: I wrote one. I even won a free book.
#
aaronpk GWG++
#
Loqi GWG has 16 karma in this channel over the last year (129 in all channels)
#
GWG aaronpk: Provider being?
#
GWG I understand client and server, where is provider?
#
aaronpk Do you mean I didn't define provider?
#
GWG aaronpk: Did you and I missed it?
[jeremycherfas] joined the channel
#
aaronpk I was trying to understand the question
#
aaronpk "provider" is hinted at, but maybe not explicit, in the intro section. I can try to rephrase it tho
peterrother, stacktrust_, ludovicchabant, themaxdavitt, jbove, __minoru__shirae, [grantcodes], [Rose], [KevinMarks] and tomlarkworthy joined the channel
#
tomlarkworthy OK first round of building my auth server is complete: https://observablehq.com/@endpointservices/auth. it can issue IndieAuth compliant tokens
#
tomlarkworthy only supports github though, does not scan for authoerization_endpoint so its not more relmeauth than indieauth ATM
#
tomlarkworthy I look at indieauth implementation and I see GPG challange keys, this is outside of indieauth spec. To support indie auth "all" I need to do is scan for user supplied authoerization endpoints
#
tomlarkworthy So I think adding indie auth is not so hard now, I do need login with google though, any ideas how I might do that? If its a well known provider like google I think I can scan its for backlinks even thoguh they are not annotated correctly
#
beko wow. still wrapping my head around this but I spotted a fun typo tomlarkworthy that for some reason made me laugh: "configurured"
#
beko there are more but I really like the guru one :)
__minoru__shirae joined the channel
#
tomlarkworthy Ahh yeah, there is no spell check on Observable its very annoying. Even the code controls manage to suppress the browser one somehow.
#
beko happens all the time to me :)
#
tomlarkworthy Its a bit manual but someone else made a spell checker I will run it over it https://observablehq.com/@mootari/typo
#
tomlarkworthy though the prose is definately not finished I would like to cross reference the spec better
#
tomlarkworthy (spell checked now, sorry about that)
[tantek], [Rose], [KevinMarks] and __minoru__shirae joined the channel
#
[tantek] yesterday in XKCD 927. devs, if you find yourself saying "I'm working on a platform that leverages all the above in their various capacities under one platform", no you're not, you're having a delusion of grandeur. Step back and build something useful to yourself today.
[Murray] and [snarfed] joined the channel
#
[snarfed] tantek++
#
Loqi tantek has 20 karma in this channel over the last year (77 in all channels)
[Rose], gbmor, [KevinMarks] and dansup joined the channel
#
jacky okay so I did figure out the thing I wanted yesterday
[schmarty] joined the channel
#
[schmarty] jacky: indieauth provider without a UI??
#
jacky going to have a PSK be a 'master' key to allow for initial bootstrapping and then attach 'devices' using the device flow that require a particular scope
#
jacky [schmarty]: lol kinda but it'll require a bit of cURLing
#
jacky which I think is okay for something like this (like I can also look into making a CLI tool to go with it)
[tw2113_Slack_] joined the channel
#
[tantek] jacky, as much as I feel dumb for suggesting this (folks hopefully already know I'm not that afraid of appearing dumb), would 'primary' or 'start' key convey the same meaning that you're looking for?
#
jacky I can see the term 'primary' key being used
#
jacky it's truthfully an API key that has like super 'admin' privileges (the ability to grant devices access to manipulate other auth requests, for example)
[Ana_Rodrigues] joined the channel
#
jacky lol the last step in https://aaronparecki.com/2021/04/13/26/indieauth is what I'm trying not to do
#
Loqi [Aaron Parecki] How to Sign Users In with IndieAuth
[jgmac1106] and tomlarkworthy joined the channel
#
tomlarkworthy is code_challenge manditory? The spec does not have it https://www.w3.org/TR/indieauth/#authorization-response
#
tomlarkworthy Oh WTF THERE ARE 2 SPECS https://indieauth.spec.indieweb.org/#authorization-request
#
tomlarkworthy PKCE is mandatory, that seems a little excessive
#
tomlarkworthy ok well it is what it is, probably a good idea too
#
tomlarkworthy not so good having two specs floating around coz I jsut google for "IndieAuth spec" and get an out dated document
#
tomlarkworthy ok here is what I should be reading https://aaronparecki.com/2020/12/03/1/indieauth-2020
#
GWG tomlarkworthy: You are looking at the original versus current
#
Loqi [Aaron Parecki] IndieAuth Spec Updates 2020
#
GWG The W3C version was superseded by the latest revision
#
GWG We had a two part meeting
#
GWG It was recorded if you want to watch it
gRegorLove joined the channel
#
tomlarkworthy actually that spec update doc is great, they are good upgrades, I have never implemented PKCE so that will be fin!
#
tomlarkworthy fun
#
GWG tomlarkworthy: Have you subscribed to the issue tracker?
#
GWG https://github.com/indieweb/indieauth
#
GWG We have a place to discuss issues on the spec
#
Loqi [indieweb] indieauth: IndieAuth Specification
#
[tantek] aaronpk, would be interesting for you to ask, e.g. in the # social channel, how can the Social CG update the W3C IndieAuth note with the latest revision
#
[tantek] might be something we can ask W3C staff to do
__minoru__shirae and [schmarty] joined the channel
#
tomlarkworthy I have now, thanks
#
tomlarkworthy GWG++
#
Loqi GWG has 17 karma in this channel over the last year (130 in all channels)
[KevinMarks], [aciccarello], koddsson, [fluffy] and [Jeff_Hawkins] joined the channel
#
jacky now I have to think up how to design a consent screen for this flow, lol
#
jacky the self-hosted, single-user flow
#
jacky this flow == the one outlined by Sele (being a 'headless' IndieAuth server)
KartikPrabhu joined the channel
#
jacky this is all I have lol https://roan-bedecked-chungkingosaurus.glitch.me/
#
jacky I think it's a good start