fluffy-critter
commented
4 years ago As of https://github.com/indieweb/indieauth/issues/44, the resource token_endpoint stuff has been deprecated from the spec with no plans to replace it (even with an extension), and with the community abandonment of AutoAuth there's no reason for the WWW-Authenticate header injection anymore anyway. Without AutoAuth the main reason to keep this around was for micropub support, but that wasn't actually handled correctly by this flow anyway.
At this point I'm not sure how the micropub flow is supposed to work, but the access token verification request is probably part of it. Presumably it'll be something like:
- The category's index.html (or whatever) links to the micropub_endpoint
- The micropub endpoint does an access token verification to verify the authorized identity of the micropub client
- Said endpoint then checks to see if the user has permission to do the thing, and if so, does the thing
From the current specification it's completely unclear to me as to whether there's a way of separating out the user profile from the micropub target, though, and micropub might not actually make sense for the intended use case of a shared community blog or the like. This might be yet another case of trying to shove a square peg into a round hole...
Expected Behavior
Add supportfor MicroPub
Context
The IndieWeb ecoystem is getting pretty good now, and having MicroPub support would make a lot of tools work really well with Publ. For example it'd be great to have the ability to make and edit posts via Indigenous.
Possible implementation reference: https://github.com/voxpelli/webpage-micropub-to-github
It would probably make sense to do this as a separate project that can be imported into a Publ pipenv, and also support a number of metadata formats (Publ, Jekyll, etc.) so that it can work with other site engines as well.