Files

Phil Skentelbery 01e66a063e feat: Add detailed IndieAuth logging with security-aware token redaction

- Add logging helper functions with automatic token redaction
- Implement comprehensive logging throughout auth flow
- Add production warning for DEBUG logging
- Add 14 new tests for logging functionality
- Update version to v0.7.0

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

2025-11-19 14:51:30 -07:00

4.0 KiB

Raw Blame History

IndieAuth Authentication Fix - Quick Summary

Status: Solution Identified, Ready for Implementation Priority: CRITICAL Estimated Fix Time: 1-2 hours Confidence: 95%

The Problem

IndieLogin.com rejects authentication with:

This client_id is not registered (https://starpunk.thesatelliteoflove.com)

Root Cause

StarPunk is using an outdated client discovery approach. The IndieAuth specification evolved in 2022 from HTML microformats (h-app) to JSON metadata documents. IndieLogin.com now requires the modern JSON approach.

What we have: h-app microformats in HTML footer What IndieLogin expects: JSON metadata document at a well-known URL

The Solution

Implement OAuth Client ID Metadata Document endpoint.

Quick Implementation

Add new route in your Flask app:

@app.route('/.well-known/oauth-authorization-server')
def oauth_client_metadata():
    """OAuth Client ID Metadata Document for IndieAuth discovery."""
    metadata = {
        'issuer': current_app.config['SITE_URL'],
        'client_id': current_app.config['SITE_URL'],
        'client_name': 'StarPunk',
        'client_uri': current_app.config['SITE_URL'],
        'redirect_uris': [
            f"{current_app.config['SITE_URL']}/auth/callback"
        ],
        'grant_types_supported': ['authorization_code'],
        'response_types_supported': ['code'],
        'code_challenge_methods_supported': ['S256'],
        'token_endpoint_auth_methods_supported': ['none']
    }

    response = jsonify(metadata)
    response.cache_control.max_age = 86400  # Cache 24 hours
    response.cache_control.public = True
    return response

Add discovery link to templates/base.html in <head>:

<link rel="indieauth-metadata" href="/.well-known/oauth-authorization-server">

Keep existing h-app in footer for backward compatibility

Testing

# Test endpoint exists and returns JSON
curl -s https://starpunk.thesatelliteoflove.com/.well-known/oauth-authorization-server | jq .

# Verify client_id matches URL (should return: true)
curl -s https://starpunk.thesatelliteoflove.com/.well-known/oauth-authorization-server | \
  jq '.client_id == "https://starpunk.thesatelliteoflove.com"'

Critical Requirements

client_id field MUST exactly match the URL where document is served
Use current_app.config['SITE_URL'] - never hardcode URLs
redirect_uris must be an array, not a string
Return Content-Type: application/json (jsonify does this automatically)

Why This Will Work

Specification Compliant: Implements current IndieAuth spec (2022+) exactly
Matches Error Behavior: IndieLogin.com is checking for client registration/metadata
Industry Standard: All modern IndieAuth clients use this approach
Low Risk: Purely additive, no breaking changes
Observable: Can verify endpoint before testing auth flow

What Changed in IndieAuth

Version	Method	Status
2020	h-app microformats	Legacy (supported for compatibility)
2022+	JSON metadata document	Current standard

IndieAuth spec now says servers "SHOULD" fetch metadata document and "SHOULD abort if fetching fails" - this explains the rejection.

Documentation

Full details in:

/home/phil/Projects/starpunk/docs/reports/indieauth-client-discovery-root-cause-analysis.md (comprehensive analysis)
/home/phil/Projects/starpunk/docs/decisions/ADR-017-oauth-client-metadata-document.md (architecture decision)

Next Steps

Implement the JSON metadata endpoint
Add discovery link to HTML
Deploy to production
Test authentication flow with IndieLogin.com
Verify successful login
Update version to v0.6.2
Update CHANGELOG

Rollback Plan

If this doesn't work (unlikely):

Contact IndieLogin.com for clarification
Consider alternative IndieAuth provider
Implement self-hosted IndieAuth server

Analysis Date: 2025-11-19 Architect: StarPunk Architect Agent Reviewed: IndieAuth spec, OAuth spec, IndieLogin.com behavior

4.0 KiB Raw Blame History