Problem
WebFinger (/.well-known/webfinger) and OAuth (/oauth/authorize, /oauth/token) are currently registered inside activityPubPlugin, which only runs with --activitypub. This means:
- remoteStorage discovery doesn't work without
--activitypub
- OAuth-based auth (for RS apps, third-party panes) requires
--activitypub
- The WebFinger endpoint is tightly coupled to AP even though it serves multiple protocols
Proposed solution
Extract into two standalone plugins that are always on:
- WebFinger plugin —
/.well-known/webfinger with extensible link relations. AP, RS, and future protocols register their own links.
- OAuth plugin —
/oauth/authorize, /oauth/token. Shared by Mastodon clients, RS apps, and third-party panes.
The AP plugin would then just add its link relations to WebFinger rather than owning the endpoint.
Current workaround
Use --activitypub flag to enable RS discovery and OAuth.
Related
Problem
WebFinger (
/.well-known/webfinger) and OAuth (/oauth/authorize,/oauth/token) are currently registered insideactivityPubPlugin, which only runs with--activitypub. This means:--activitypub--activitypubProposed solution
Extract into two standalone plugins that are always on:
/.well-known/webfingerwith extensible link relations. AP, RS, and future protocols register their own links./oauth/authorize,/oauth/token. Shared by Mastodon clients, RS apps, and third-party panes.The AP plugin would then just add its link relations to WebFinger rather than owning the endpoint.
Current workaround
Use
--activitypubflag to enable RS discovery and OAuth.Related