Authl v0.5.2 is now out.
Changes:
I’ve just released v0.5.1 of Authl. The only functional change is adding support for actually parsing IndieAuth server response profiles (rather than just requesting one and only using the h-card), now that there’s implementations in the wild, meaning that egg has hatched into a chicken.
There were also some minor documentation cleanups since v0.5.0.
Big new releases for Publ and Authl!
Publ changes:
Authl changes:
Wow, it’s been a while since I’ve worked on this stuff, huh?
Anyway, IndieAuth validation rules have changed for the better, so Authl has been updated accordingly.
There’s a few other changes as well:
p-pronoun is treated as a fallback for p-pronounsrel="nofollow" in some appropriate placesSome pretty big new features added. First, in Authl:
And in Publ:
<figure> and <figcaption> instead of ad-hoc <div>s for its layout, and the overall HTML semantic has been greatly improvedAuthl v0.4.2 is out. Mostly infrastructural changes, but a few other changes too:
force_ssl to the more-accurate force_httpsIn theory there will now be docs visible at authl.readthedocs.io, although I’m still having trouble getting some of it to actually appear.
But, speaking of appearing, somehow the hostname for this site stopped resolving, so hopefully by the time this site comes back, the readthedocs stuff will be working too!
Authl 0.4.1 is out. Changes below:
I’ve just released new versions of Publ and Authl.
Publ v0.6.6 changes:
WWW-Authenticate headers weren’t being cached properlyAuthl v0.4.0 changes:
Some fresh new versions of things.
Changes to Publ:
category.subcatsconfig.secret_key; now this should be configured on the application object per Flask standardshref and src to contain image renditionsDouble-whammy release today.
Just a tiny fix in this; it works around an inconsistency between the IndieAuth spec and IndieAuth.com’s implementation. Normally I’d just be all, “this is a bug in IndieAuth.com” but that’s the most popular IndieAuth endpoint right now so I decided it was prudent to make a compromise. And really it’s a good idea to always specify an Accept: header anyway.
Thanks to Colin for bringing this to my attention.
I’ve now released v0.3.2 of Authl, which adds the following changes:
As an experiment I’ve enabled Twitter login on this site, so now you should be able to use it to look at protected entries.
So, both Publ and Authl had a pretty naïve issue with the identity verification step of the IndieAuth flow; it simply accepted whatever the authorization endpoint said the user’s identity was. This made it very simple to spoof one’s identity and log in as anyone on any Publ or Authl site.
Authl 0.3.1 fixes the problem with the IndieAuth login flow, and Publ 0.5.8 fixes the problem with the Bearer token flow.
I just released Authl v0.3.0; minor version bump because of a public API change, to better facilitate stateless storage.
Which is to say I converted most of the handlers to be stateless, which hopefully fixes the issues with running on Heroku.
Unfortunately Twitter couldn’t be fixed easily but I wasn’t running the Twitter handler on this site anyway. I do have some ideas but they’re fairly involved and will have to come later, and not when I’m up way past my bedtime.
Also, there still seems to be some cache-related issue that’s making it necessary to shift-reload the page after logging in or out, sometimes.
I’ve released updates to both Publ and Authl.
On the Authl side:
disposition.Error so that can be preserved correctlydisposition.Error.redirrender_login_funcOn the Publ side:
For both:
These changes help to keep sites more secure from eavesdroppers, while also hopefully improving the user experience!
I’ve released Authl v0.2.0. Changes since v0.1.8:
And changes from v0.1.7 to v0.1.8 (which I didn’t bother to post an announcement about):
client_secret was leaking but in the context of Mastodon that couldn’t really be used for anything anyway)I’ve released Authl v0.1.7, which now adds direct support for IndieAuth (rather than requiring IndieLogin.com as a broker). This means that now folks who have an IndieAuth identity can log in using that; previously I was expecting IndieLogin.com to eventually open up client registrations to make that a useful authentication path, but for various reasons Aaron hasn’t opened it up to the general public.
Part of this update was to also refactor how OAuth is handled, so it’ll be a lot easier for me to add more OAuth-based providers in the future; hopefully I’ll have direct support for Twitter, GitHub, and maybe even Facebook in the near-ish future. But for now, between Mastodon, email, and IndieAuth, I think I have all of my own personal needs taken care of.
Feel free to make suggestions for other identity providers in the Authl issue tracker, though!
Oh gosh I seem to be on a roll with these updates again. Here’s what changed in Publ:
logout.html template to support that. (Also made the default unauthorized.html use Authl’s default CSS.)entry.authorized available, rather than just documented. Also gave it a better name while I was at it.view.entries can now take an optional argument for inlining unauthorized entries, improving its usage within feeds.view.unauthorized can now take an optional argument for limiting the unauthorized view count, which helps performance and makes it a bit more predictablecategory.subcats(recurse=True) and also added some actual tests for the sort ordering. They pass.And the Authl changes (which were actually released before Publ 0.5.0 but I didn’t bother announcing them until I had them tested “in the wild”):
url_forAnyway, I of course updated the sample beesbuzz.biz templates to reflect the new functionality.
Wow, Publ’s feeling like it’s actually kinda pretty good at stuff now. I hope someone else ever wants to actually, like, use it or something.
Updated some packages.
Main things with Publ since the last release:
The only Authl change is that email identities are now given as a full mailto: URL; going forward all identity strings will be full URLs. This simplifies the UX for admin dashboards, in particular, and removes some ambiguity.
I’ve released a mini-update of Publ to fix an authentication problem (the config parser was “helpfully” sanitizing things that didn’t want to be sanitized), and also some refactoring/improvements/bugfixes to Authl.
The big changes to Authl are that the email handler generates shorter/nicer links, and it also puts an anti-abuse timeout into email login attempts to prevent people from spamming themselves or others with spurious email notifications. There’s also a bunch of small bugfixes to Authl’s login flow, and Flask apps can specify that sessions should not be made permanent.