feat(endpoint-auth): support profile scope and add userinfo endpoint - #938
Merged
Merged
Conversation
Return profile information (name, url, photo) with the profile URL and access token responses when the profile scope is granted, and from a new userinfo endpoint. Values come from the plug-in’s profile option first, with anything missing discovered from the representative h-card on the user’s site. Announce the endpoint in server metadata. Closes #885
rmdes
force-pushed
the
feat/endpoint-auth-profile-scope
branch
from
September 13, 2026 11:01
6578789 to
0751857
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #885, following what we agreed there: configuration first, discovery as the fallback,
emailuntouched,/userinfoin the same PR and re-discovering on each request.What changes
profileoption on@indiekit/endpoint-auth:{ name, url, photo }, each key optional. Configured values are used as-is; anything missing is discovered from the h-card on the user’s site (lib/profile.js): the h-card whoseu-urlis the profile URL, else the first one. No h-card and nothing configured means the scope yields nothing, as today. A site that can’t be fetched, or an address that isn’t a domain name (same guard as client discovery), falls back to the configured values.profilescope is now supported (scope.js), so it appears enabled on the consent form.profilewhen the granted scope containsprofile. Only JSON responses carry it; the specification defines profile information for JSON only, so form-encoded responses are unchanged.GET /auth/userinforeturns the same object for a bearer token grantedprofile, discovering afresh each time. A token withoutprofilegetsinsufficient_scope(403); an invalid tokenunauthorized(401). Announced asuserinfo_endpointin server metadata and set onapplication.userinfoEndpointlike the other endpoints.authorizationControllerandtokenControllerbecome factories taking the plug-in options, so the configured profile reaches them without going through application state.Tests
test/unit/profile.js): discovery, configured-first merge, fetch failure, no h-card, non-domain address./userinfowith configured value overriding a discovered one, 403 without scope, 401 with an invalid token,userinfo_endpointin metadata.helpers/fixtures/html/profile.htmland mock-agent intercepts for the user’s site;testConfigpasses@indiekit/endpoint-authoptions through.Verified locally:
node --test packages/endpoint-auth/test/**/*.js79/79,packages/indiekitintegration 33/33, eslint and prettier clean.Caching of discovered values is deliberately left out; tracked separately as #939.