publisher/internal/api/ at main · geofox.org/publisher · Tangled

geofox.org / publisher

0

A small go app to cross-post/publish to various social platforms.

0

publisher / internal / api /

at main 31 files

Geoffrey Richard feat(api): poster_url plumbing through specs, drafts and assembly 6w ago

feat(api): poster_url plumbing through specs, drafts and assembly

1 month ago

feat(api): raise image cap to 10, request body cap to 128MB

1 month ago

assemble_images_test.go

fix(api): bound combined fresh+blossom image count at the cap

1 month ago

feat: OIDC authentication (Relying Party) + API tokens (#9) * build: add go-oidc and x/oauth2 deps * feat(store): add users, sessions, api_tokens tables * feat(store): users upsert/lookup * feat(store): server-side sessions with hashed ids + sweep * feat(store): api_tokens create/lookup/list/revoke * refactor(store): RevokeAPIToken reports ErrNoRows; drop dead scan var * feat(auth): OIDC RP authenticator + allowlist * feat(config): OIDC RP settings with group validation * feat(api): OIDC login/callback/logout handlers + cookies * feat(api): requireSession (page/XHR) + requireAPIToken middleware * feat(api): token management + /api/me handlers * feat(api): path-based session/token gating behind OIDC feature flag * test(api): OIDC callback happy-path integration * harden(api): path.Clean gate matching, session cookie MaxAge, gate-on test * feat(cmd): wire OIDC authenticator + session sweep when enabled * feat(web): access-token management view + user chip/sign-out * docs: document OIDC auth, API tokens, and new env vars * fix(web): invalid string literals broke tokens.js module parse; harden cookie-clear flags - tokens.js: escaped inner quotes on lines 54/150 — the juxtaposed string literals were a SyntaxError that broke SPA module boot when OIDC is enabled (plain `node --check <path>` misses ESM syntax errors; use --input-type=module). - auth.go: login-state and session cookie deletions now carry HttpOnly/Secure/ SameSite, matching the set path (CodeQL alerts 3-6).

1 month ago

feat: OIDC authentication (Relying Party) + API tokens (#9) * build: add go-oidc and x/oauth2 deps * feat(store): add users, sessions, api_tokens tables * feat(store): users upsert/lookup * feat(store): server-side sessions with hashed ids + sweep * feat(store): api_tokens create/lookup/list/revoke * refactor(store): RevokeAPIToken reports ErrNoRows; drop dead scan var * feat(auth): OIDC RP authenticator + allowlist * feat(config): OIDC RP settings with group validation * feat(api): OIDC login/callback/logout handlers + cookies * feat(api): requireSession (page/XHR) + requireAPIToken middleware * feat(api): token management + /api/me handlers * feat(api): path-based session/token gating behind OIDC feature flag * test(api): OIDC callback happy-path integration * harden(api): path.Clean gate matching, session cookie MaxAge, gate-on test * feat(cmd): wire OIDC authenticator + session sweep when enabled * feat(web): access-token management view + user chip/sign-out * docs: document OIDC auth, API tokens, and new env vars * fix(web): invalid string literals broke tokens.js module parse; harden cookie-clear flags - tokens.js: escaped inner quotes on lines 54/150 — the juxtaposed string literals were a SyntaxError that broke SPA module boot when OIDC is enabled (plain `node --check <path>` misses ESM syntax errors; use --input-type=module). - auth.go: login-state and session cookie deletions now carry HttpOnly/Secure/ SameSite, matching the set path (CodeQL alerts 3-6).

1 month ago

compress_test.go

feat(api): stateless on-demand media compress endpoint

1 month ago

feat(api): poster_url plumbing through specs, drafts and assembly

1 month ago

drafts: persistent scratchpad in Compose sidebar (v0.8.0) (#4) * docs: drafts feature design Approved design for a Compose-tab drafts sidebar: SQLite-backed drafts + draft_media tables, /api/drafts CRUD + translate, publish consumes via optional draft_id on /api/post, free-form tags with AND filter, manual save with localStorage recovery autosave. Also adds .superpowers/ to .gitignore for visual-brainstorm scratch. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs: drafts implementation plan 21-task TDD plan covering the store layer (drafts + draft_media), media-pipeline sha256 dedup, /api/drafts CRUD + translate, the /api/post draft_id consume hook, and the Compose-tab sidebar UI with tags, filters, recovery banner, and mobile toggle. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * drafts: add drafts and draft_media schema Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * drafts: group new indexes with existing ones for consistency * drafts: Draft model + tag/title normalization helpers Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * drafts: CreateDraft and GetDraft * drafts: UpdateDraft and DeleteDraft with media cascade * drafts: ListDraftsFiltered with query and tag-AND filter Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * media: dedup uploads via sha256 lookup across posts and drafts Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * drafts: GET/POST /api/drafts handlers Wire six draft routes in Routes(), implement handleListDrafts and handleCreateDraft (with multipart+media-pipeline buildDraftFromRequest), and stub the remaining four handlers as 501. Tests pass. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * drafts: GET/PUT/DELETE /api/drafts/{id} Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * drafts: POST /api/drafts/{id}/translate via DeepL Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * drafts: /api/post consumes draft via draft_id on success Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * drafts: state.activeDraftId, dirty flag, localStorage recovery Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * web: drafts sidebar + toolbar markup and CSS Wraps <section id="compose"> in a .compose-layout flex container with a .drafts-sidebar <aside> and .compose-main div; prepends compose-toolbar, recovery-banner, and tags-input-row inside .compose-main. Adds all supporting CSS including a new .primary/.primary.sm button variant. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * drafts: sidebar list rendering and load-into-Compose Wire the drafts sidebar to the backend: installDraftsSidebar() fetches and renders the draft list with search/tag filters and click-to-load; loadDraft() generalised to accept both the legacy {text,lang} translate flow and the full draft spec shape; buildSpec() emits dual image entries (ref for new uploads, blossom_url for already-uploaded) and includes draft_id when active. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * drafts: save/new actions with dirty tracking and Ctrl+S Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * drafts: delete-active button with confirm Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * drafts: tag chip input in editor Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * drafts: translate-to-new-draft action Add populateTranslateMenu() to drafts.js that wires the #draft-translate dropdown; POSTs to /api/drafts/{id}/translate and loads the returned draft into Compose. Called from installDraftsSidebar() and again explicitly in main.js init() after /api/config resolves (idempotent). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * drafts: recovery banner on boot when localStorage has unsaved work Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * drafts: publish consumes active draft on success Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * drafts: mobile sidebar toggle * docs: document /api/drafts endpoints - list/get/create/update/delete + translate - multipart shape with ref/blossom_url image entries - /api/post draft_id consume hook - sha256-based Blossom dedup across posts and drafts Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * drafts: fix recovery banner + langs round-trip from saved spec Two issues surfaced during iPad smoke testing: 1. .recovery-banner { display: flex } in CSS overrode the [hidden] HTML attribute (same specificity, class rule loaded later) — so the banner was always visible. Added .recovery-banner[hidden] { display: none }. 2. buildSpec serializes bluesky.langs as an array, but the editor expects it as a comma-separated string. Round-tripping a saved draft through loadDraft → state.ov → buildSpec broke at ovFor's .split() call. Convert back to string in loadDraft after Object.assign, and make ovFor defensive (accept either type) so a stale stored spec doesn't crash. Also switched the recovery banner's Restore/Discard wiring from .onclick= to addEventListener("click", ...) for consistency with the rest of the file. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * drafts: move save/tags into sidebar, fix mobile overlay iPad smoke test feedback: - Move Save / Translate / Delete toolbar and Draft tags input from the Compose form into the sidebar (just under the "Drafts" title), so all draft-related controls live together. The 📋 Drafts mobile toggle stays in the Compose pane so the sidebar can be opened from mobile. - Rename "Tags" label to "Draft tags" to disambiguate from per-post hashtags. - On mobile, the sidebar overlay now starts 75px below the viewport top so it sits below the sticky topbar (was hidden behind it). Bumped z-index to 15 (still below the topbar's 20). - Add a ✕ close button to the sidebar header (mobile-only) and auto-close the overlay when a draft row is tapped — otherwise there was no way back to the composer on mobile. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2 months ago

hardening_test.go

fix(api): accept Origin matching AppBaseURL so proxied sign-out isn't CSRF-blocked (v1.5.1) Behind a reverse proxy r.Host is the internal upstream host, never the public Origin the browser sends, so the CSRF guard 403'd every same-origin POST. Sign-out only made it visible (full-page form nav renders the raw JSON; SPA fetch POSTs swallow it). Validate Origin against the configured public origin (AppBaseURL, from OIDC_REDIRECT_URL) in addition to r.Host. AppBaseURL is server-set, not client-spoofable; foreign origins still 403.

1 month ago

history_test.go

Import publisher application from geofox/server Extracted from geofox/server (Dockerfiles/nostr-publisher). Adds tag-driven CI (test + GHCR publish) and a refreshed README with a self-hosting guide.

2 months ago

interact_post_test.go

feat(api): detached dispatch returns post_id; wire progress registry Add PostWithID/InteractWithID to Dispatcher (and the interface), extend handleAPIPost and handleInteract to launch a detached goroutine when Progress is set—returning {"post_id","status":"running"} immediately so the browser can subscribe to SSE—while preserving the synchronous fallback path. Wire progress.NewRegistry into cmd/publisher/main.go.

1 month ago

list_filter_test.go

Automated failure recovery (Retrier) + observability + compose auto-grow (v1.2.0) (#7) * docs: design for automated failure recovery (Retrier) + observability Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: implementation plan for automated failure recovery (Retrier) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * dispatch: exponential backoff helper for auto-retry * dispatch: guard backoff against int64 overflow; clarify doc For large attempt counts (~63+) the old d *= 2 could overflow int64 to a negative value, causing the >= max check to never fire and returning a negative duration. Introduce a next variable and bail early when next <= 0 (overflow) or next >= max. Add a regression test case (attempt=100) and reword the doc comment to avoid "attempt-th attempt". Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * config: AUTO_RETRY_* and RETRIER_TICK settings (auto-retry on by default) * store: gave_up_at + relay retry_count columns; load last_attempt_at in GetPost * store: PostsNeedingRetry + MarkTargetGaveUp/MarkRelayGaveUp * store: clear gave_up_at on success; bump relay retry_count on rebroadcast * store: status=attention filter + AttentionCount * dispatch: Retrier worker — platform-level auto-retry with backoff Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * dispatch: log mark-gave-up errors; use strings.Join in retrier Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * dispatch: test Retrier give-up + alert-once * dispatch: Retrier relay-level auto-retry + give-up; load relay attempted_at Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * dispatch: relay loop style + relay not-due skip test Replace `for ti := range post.Targets { t := post.Targets[ti] }` with `for _, t := range post.Targets` in processPost's relay block to match the platform loop's style above it (t is only read, never addressed). Add TestRetrierRelayLevelSkipsNotDue: mirrors TestRetrierRelayLevelRetry but sets now() only 30s after seed (< 2m base backoff), verifying the relayDue gate holds and the down relay stays "failed" rather than being retried. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * dispatch: alert on immediate post delivery failure/partial Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * api: GET /api/posts/attention/count for the attention badge * main: start the Retrier and wire the dispatcher alerter Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * web: History attention filter chip + live count badge * web: per-target auto-retry status line in history detail Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: document automatic failure recovery + AUTO_RETRY_* settings * retrier/web: nil-guard give-up alert, clarify relay cap, refresh badge after manual retry Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * web: auto-expand the compose field with content (capped, then scroll) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

1 month ago

media_reattach_test.go

feat(api): poster_url plumbing through specs, drafts and assembly

1 month ago

metrics_route_test.go

Observability: Prometheus metrics + post_id log correlation (v1.3.0) (#8) Prometheus Core metrics + /metrics endpoint, post_id log correlation, and build-version stamping. Paired with geofox/server stack wiring.

1 month ago

middleware_auth.go

feat: OIDC authentication (Relying Party) + API tokens (#9) * build: add go-oidc and x/oauth2 deps * feat(store): add users, sessions, api_tokens tables * feat(store): users upsert/lookup * feat(store): server-side sessions with hashed ids + sweep * feat(store): api_tokens create/lookup/list/revoke * refactor(store): RevokeAPIToken reports ErrNoRows; drop dead scan var * feat(auth): OIDC RP authenticator + allowlist * feat(config): OIDC RP settings with group validation * feat(api): OIDC login/callback/logout handlers + cookies * feat(api): requireSession (page/XHR) + requireAPIToken middleware * feat(api): token management + /api/me handlers * feat(api): path-based session/token gating behind OIDC feature flag * test(api): OIDC callback happy-path integration * harden(api): path.Clean gate matching, session cookie MaxAge, gate-on test * feat(cmd): wire OIDC authenticator + session sweep when enabled * feat(web): access-token management view + user chip/sign-out * docs: document OIDC auth, API tokens, and new env vars * fix(web): invalid string literals broke tokens.js module parse; harden cookie-clear flags - tokens.js: escaped inner quotes on lines 54/150 — the juxtaposed string literals were a SyntaxError that broke SPA module boot when OIDC is enabled (plain `node --check <path>` misses ESM syntax errors; use --input-type=module). - auth.go: login-state and session cookie deletions now carry HttpOnly/Secure/ SameSite, matching the set path (CodeQL alerts 3-6).

1 month ago

oidc_mock_test.go

feat: OIDC authentication (Relying Party) + API tokens (#9) * build: add go-oidc and x/oauth2 deps * feat(store): add users, sessions, api_tokens tables * feat(store): users upsert/lookup * feat(store): server-side sessions with hashed ids + sweep * feat(store): api_tokens create/lookup/list/revoke * refactor(store): RevokeAPIToken reports ErrNoRows; drop dead scan var * feat(auth): OIDC RP authenticator + allowlist * feat(config): OIDC RP settings with group validation * feat(api): OIDC login/callback/logout handlers + cookies * feat(api): requireSession (page/XHR) + requireAPIToken middleware * feat(api): token management + /api/me handlers * feat(api): path-based session/token gating behind OIDC feature flag * test(api): OIDC callback happy-path integration * harden(api): path.Clean gate matching, session cookie MaxAge, gate-on test * feat(cmd): wire OIDC authenticator + session sweep when enabled * feat(web): access-token management view + user chip/sign-out * docs: document OIDC auth, API tokens, and new env vars * fix(web): invalid string literals broke tokens.js module parse; harden cookie-clear flags - tokens.js: escaped inner quotes on lines 54/150 — the juxtaposed string literals were a SyntaxError that broke SPA module boot when OIDC is enabled (plain `node --check <path>` misses ESM syntax errors; use --input-type=module). - auth.go: login-state and session cookie deletions now carry HttpOnly/Secure/ SameSite, matching the set path (CodeQL alerts 3-6).

1 month ago

post_consume_test.go

feat(api): detached dispatch returns post_id; wire progress registry Add PostWithID/InteractWithID to Dispatcher (and the interface), extend handleAPIPost and handleInteract to launch a detached goroutine when Progress is set—returning {"post_id","status":"running"} immediately so the browser can subscribe to SSE—while preserving the synchronous fallback path. Wire progress.NewRegistry into cmd/publisher/main.go.

1 month ago

progress_post_test.go

feat(api): detached dispatch returns post_id; wire progress registry Add PostWithID/InteractWithID to Dispatcher (and the interface), extend handleAPIPost and handleInteract to launch a detached goroutine when Progress is set—returning {"post_id","status":"running"} immediately so the browser can subscribe to SSE—while preserving the synchronous fallback path. Wire progress.NewRegistry into cmd/publisher/main.go.

1 month ago

progress_sse_test.go

feat(api): SSE progress endpoint (stream in-flight, replay finished)

1 month ago

public_feed_test.go

feed: public homepage feed API + publish webhook (v0.9.0) (#5) Read-only GET /api/public/feed (token-gated) returning the latest public master posts as JSON, plus a signal-only publish webhook gated by the shared feed.Eligible predicate. Privacy filtering hides non-public Mastodon copies and drops link-less posts; partial-but-live Nostr notes are included. published_at is first-live time, stable across retries. See docs/superpowers/specs/2026-05-28-public-feed-api-design.md.

1 month ago

relay_retry_test.go

feat(api): detached dispatch returns post_id; wire progress registry Add PostWithID/InteractWithID to Dispatcher (and the interface), extend handleAPIPost and handleInteract to launch a detached goroutine when Progress is set—returning {"post_id","status":"running"} immediately so the browser can subscribe to SSE—while preserving the synchronous fallback path. Wire progress.NewRegistry into cmd/publisher/main.go.

1 month ago

resolve_test.go

Add quote/reply/repost of existing posts (Interact tab) Paste a post URL (Bluesky/Mastodon) or a Nostr identifier into the new Interact tab to reply to, repost, or quote an existing post. Publisher resolves the source, previews it, detects what the post allows (reply/quote restrictions), and performs the action — with a "try anyway" override. - internal/resolve: URL/identifier → platform detection → SourceRef with a preview and per-action capabilities. Bluesky via getPosts (viewer flags), Mastodon via search-resolve (quote_approval/visibility), Nostr via relay fetch (open protocol; NIP-70 note). Threads is preview-excluded (no URL→id API) but is a valid quote fan-out target. - Client primitives: Bluesky repost record / quote embed / reply-root; Mastodon reblog + native quote (4.5+); Nostr NIP-10 external-author replies, NIP-18 reposts (kind 6/16) and quote (q-tag + nostr: mention). - dispatch.Interact reuses the post/target/history/retry model. Reply and repost act only on the source platform; quote does a native quote there plus a link-quote (commentary + URL; njump.me for Nostr) to each selected fan-out platform. New POST /api/resolve and POST /api/interact. - store: additive interaction descriptor; history shows a reply/quote/repost badge linking to the source. Existing posting and auto-threading paths are unchanged (additive only).

2 months ago

feat(api): detached dispatch returns post_id; wire progress registry Add PostWithID/InteractWithID to Dispatcher (and the interface), extend handleAPIPost and handleInteract to launch a detached goroutine when Progress is set—returning {"post_id","status":"running"} immediately so the browser can subscribe to SSE—while preserving the synchronous fallback path. Wire progress.NewRegistry into cmd/publisher/main.go.

1 month ago

scheduled_test.go

feat(api): detached dispatch returns post_id; wire progress registry Add PostWithID/InteractWithID to Dispatcher (and the interface), extend handleAPIPost and handleInteract to launch a detached goroutine when Progress is set—returning {"post_id","status":"running"} immediately so the browser can subscribe to SSE—while preserving the synchronous fallback path. Wire progress.NewRegistry into cmd/publisher/main.go.

1 month ago

Import publisher application from geofox/server Extracted from geofox/server (Dockerfiles/nostr-publisher). Adds tag-driven CI (test + GHCR publish) and a refreshed README with a self-hosting guide.

2 months ago

thread_post_test.go

feat(api): detached dispatch returns post_id; wire progress registry Add PostWithID/InteractWithID to Dispatcher (and the interface), extend handleAPIPost and handleInteract to launch a detached goroutine when Progress is set—returning {"post_id","status":"running"} immediately so the browser can subscribe to SSE—while preserving the synchronous fallback path. Wire progress.NewRegistry into cmd/publisher/main.go.

1 month ago

thread_preview_card_test.go

feat(api): thread-preview video gate notes

1 month ago

thread_preview_test.go

feat(api): thread-preview computes per-segment image distribution

1 month ago

feat: OIDC authentication (Relying Party) + API tokens (#9) * build: add go-oidc and x/oauth2 deps * feat(store): add users, sessions, api_tokens tables * feat(store): users upsert/lookup * feat(store): server-side sessions with hashed ids + sweep * feat(store): api_tokens create/lookup/list/revoke * refactor(store): RevokeAPIToken reports ErrNoRows; drop dead scan var * feat(auth): OIDC RP authenticator + allowlist * feat(config): OIDC RP settings with group validation * feat(api): OIDC login/callback/logout handlers + cookies * feat(api): requireSession (page/XHR) + requireAPIToken middleware * feat(api): token management + /api/me handlers * feat(api): path-based session/token gating behind OIDC feature flag * test(api): OIDC callback happy-path integration * harden(api): path.Clean gate matching, session cookie MaxAge, gate-on test * feat(cmd): wire OIDC authenticator + session sweep when enabled * feat(web): access-token management view + user chip/sign-out * docs: document OIDC auth, API tokens, and new env vars * fix(web): invalid string literals broke tokens.js module parse; harden cookie-clear flags - tokens.js: escaped inner quotes on lines 54/150 — the juxtaposed string literals were a SyntaxError that broke SPA module boot when OIDC is enabled (plain `node --check <path>` misses ESM syntax errors; use --input-type=module). - auth.go: login-state and session cookie deletions now carry HttpOnly/Secure/ SameSite, matching the set path (CodeQL alerts 3-6).

1 month ago

Add signature verification for Nostr, Bluesky, Mastodon, and Threads Credential-free /api/verify endpoint and web "verify" tab reporting whether a post is authentically signed by the claimed author: - Nostr: offline event id + Schnorr signature check - Bluesky: repo commit signature + MST inclusion proof (indigo atproto SDK) - Mastodon: ActivityPub origin authority + FEP-8b32 (eddsa-jcs-2022) proof - Threads: ActivityPub origin authority (gated by Meta; reported honestly) Tri-state verdicts (verified/failed/error) with assurance levels (cryptographic/origin), optional expected-identity matching, and an SSRF-guarded HTTP client for all outbound fetches. Requires Go 1.26.

2 months ago

feat(api): poster_url plumbing through specs, drafts and assembly

1 month ago