From 2ddb1f5e0b8404ba140455d897682242273a7ee5 Mon Sep 17 00:00:00 2001 From: Leon Kunze Date: Sat, 24 Oct 2026 20:52:43 +0200 Subject: [PATCH] fix: send guests approving the app to GitHub The app opens the approval page for a device, and an unsigned-in visitor was sent to the log. Send that page through GitHub so they return and approve the device. Co-authored-by: Cursor --- KNOWLEDGE_BASE.md | 2 +- bootstrap/app.php | 6 +++++- .../Controllers/MobileAuthorizationControllerTest.php | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/KNOWLEDGE_BASE.md b/KNOWLEDGE_BASE.md index 894c7a17c..9dd66ccf0 100644 --- a/KNOWLEDGE_BASE.md +++ b/KNOWLEDGE_BASE.md @@ -462,7 +462,7 @@ Sources: [API routes](routes/api.php), [API controllers](app/Http/Controllers/Ap ### Signed API and devices -An app can use the same `/api/v1` for you with signed requests. It keeps an SSH key on the device and signs every request with it; there are no passwords or API tokens. To sign in, the app opens `/mobile/authorize` on the web: sign in with GitHub if needed, check the key's fingerprint, and approve it. The key then becomes one of your devices, and it does not need to be on your GitHub account. A key that is only on GitHub, such as a GitHub Actions key, cannot use the signed API. +An app can use the same `/api/v1` for you with signed requests. It keeps an SSH key on the device and signs every request with it; there are no passwords or API tokens. To sign in, the app opens `/mobile/authorize` on the web. A guest goes straight to GitHub and returns to that page; someone already signed in checks the key's fingerprint and approves it. The key then becomes one of your devices, and it does not need to be on your GitHub account. A key that is only on GitHub, such as a GitHub Actions key, cannot use the signed API. A signed request sees what the web shows you, such as your own pending commits. It can also, with the web's validation, moderation, and rate limits: diff --git a/bootstrap/app.php b/bootstrap/app.php index 7d89b2908..b9885e462 100644 --- a/bootstrap/app.php +++ b/bootstrap/app.php @@ -43,7 +43,11 @@ $middleware->encryptCookies(except: ['appearance', 'sidebar_state', 'who_to_follow', 'who_to_follow_round', 'lane_dimming', 'replies_per_page']); - $middleware->redirectGuestsTo(fn (): string => route('home')); + // Approving the app is the one page a guest should leave for GitHub, then return to. Every other page + // they open while signed out stays the log. Locally, sign-in is the modal on that log. + $middleware->redirectGuestsTo(fn (Request $request): string => $request->routeIs('mobile-authorization.show') && ! app()->isLocal() + ? route('login') + : route('home')); $middleware->redirectUsersTo(fn (Request $request): string => route('log.show', $request->user()->log ?? Log::Following)); // Rate limits apply to the user authenticated by their SSH signature... diff --git a/tests/Feature/Controllers/MobileAuthorizationControllerTest.php b/tests/Feature/Controllers/MobileAuthorizationControllerTest.php index 2fc04f408..ec0025179 100644 --- a/tests/Feature/Controllers/MobileAuthorizationControllerTest.php +++ b/tests/Feature/Controllers/MobileAuthorizationControllerTest.php @@ -51,7 +51,7 @@ Queue::fake(); fakeGitHubSponsorsListing(); - $this->get(route('mobile-authorization.show', $this->parameters))->assertRedirectToRoute('home'); + $this->get(route('mobile-authorization.show', $this->parameters))->assertRedirectToRoute('login'); $user = User::factory()->create(['github_id' => '583231']);