Summary
Add a shared OAuth 2.0 authorization and token exchange flow to JSS. This is the missing piece that unlocks three ecosystems:
What exists
- Solid-OIDC — full DPoP-bound token verification, JWKS caching, replay prevention (
src/auth/solid-oidc.js)
- Client registration —
POST /api/v1/apps with in-memory store (src/ap/routes/mastodon.js)
- Token extraction — supports DPoP, Bearer, Nostr NIP-98, WebID-TLS (
src/auth/token.js)
OIDC already provides 90% of the OAuth 2.0 foundation. The gap is small.
What's needed
1. Authorization endpoint — GET /oauth/authorize
GET /oauth/authorize
?client_id=<registered_client_id>
&redirect_uri=https://app.example.com/callback
&response_type=code
&scope=read+write
Shows consent dialog, redirects with authorization code.
2. Token endpoint — POST /oauth/token
POST /oauth/token
grant_type=authorization_code
&code=<auth_code>
&client_id=<client_id>
&client_secret=<client_secret>
&redirect_uri=https://app.example.com/callback
Returns Bearer token:
{
"access_token": "...",
"token_type": "Bearer",
"scope": "read write",
"created_at": 1710000000
}3. Bearer token validation in auth middleware
Add Bearer token verification to the existing token extraction pipeline in src/auth/token.js.
Consumers
| Consumer |
Flow |
Scope format |
| Mastodon clients |
Authorization code |
read, write, follow |
| remoteStorage apps |
Implicit (token) |
photos:rw, documents:r |
| losos panes |
Authorization code |
read, write |
Implementation notes
- Reuse existing OIDC session if user is already logged in (no double login)
- Store tokens with HMAC signature (like existing simple bearer in token.js)
- Auth skip already established for
/api/v1/* pattern — add /oauth/*
- Consent dialog can be minimal HTML (no React/framework needed)
References
Summary
Add a shared OAuth 2.0 authorization and token exchange flow to JSS. This is the missing piece that unlocks three ecosystems:
What exists
src/auth/solid-oidc.js)POST /api/v1/appswith in-memory store (src/ap/routes/mastodon.js)src/auth/token.js)OIDC already provides 90% of the OAuth 2.0 foundation. The gap is small.
What's needed
1. Authorization endpoint —
GET /oauth/authorizeShows consent dialog, redirects with authorization code.
2. Token endpoint —
POST /oauth/tokenReturns Bearer token:
{ "access_token": "...", "token_type": "Bearer", "scope": "read write", "created_at": 1710000000 }3. Bearer token validation in auth middleware
Add Bearer token verification to the existing token extraction pipeline in
src/auth/token.js.Consumers
read,write,followphotos:rw,documents:rread,writeImplementation notes
/api/v1/*pattern — add/oauth/*References