fix(endpoint-auth): limit missing response_type to indieauth.com

A request without `response_type` is rejected again, as the
specification requires, except when `client_id` is indieauth.com — the
one widely-used client that omits it, and one carrying a deprecation
notice pointing at indielogin.com, which sends a conforming request.

The exception is a single commented block. Deleting it and restoring
`request.query.response_type` in the two places below returns the
endpoint to strict behaviour.

The value is threaded as a local rather than written back to
`request.query`: the application sets Express's query parser to
`simple`, which re-parses on every access, so an assignment there is
discarded before it can be read.

Tests cover both sides of the exception: a request from any other
client still reports the missing parameter, one from indieauth.com
redirects to the consent form.

Author: rmdes

packages/endpoint-auth/lib/controllers/authorization.js

@@ -1,5 +1,5 @@
 import { IndiekitError } from "@indiekit/error";
-import { getCanonicalUrl } from "@indiekit/util";
+import { getCanonicalUrl, isSameOrigin } from "@indiekit/util";
 
 import { getClientInformation } from "../client.js";
 import { createRequestUri } from "../pushed-authorization-request.js";
@@ -24,22 +24,37 @@ export const authorizationController = {
         return next(true);
       }
 
+      // Deprecated exception, delete this block and restore
+      // `request.query.response_type` below: indieauth.com omits
+      // `response_type`, the pre-specification form of an authentication-only
+      // request (`id`). Its replacement, indielogin.com, sends
+      // `response_type=code` and needs none of this. `client_id` is not yet
+      // known to be a URL, so it is checked before being compared.
+      // @see {@link https://github.com/aaronpk/IndieAuth.com/blob/main/controllers/auth-web.rb#L518}
+      const clientId = String(request.query.client_id);
+      const isDeprecatedClient =
+        URL.canParse(clientId) &&
+        isSameOrigin(clientId, "https://indieauth.com");
+      const responseType =
+        request.query.response_type ?? (isDeprecatedClient ? "id" : undefined);
+
       // Validate presence of required parameters
-      for (const parameter of ["client_id", "redirect_uri", "state"]) {
-        if (!Object.hasOwn(request.query, parameter)) {
+      const requiredParameters = {
+        client_id: request.query.client_id,
+        redirect_uri: request.query.redirect_uri,
+        response_type: responseType,
+        state: request.query.state,
+      };
+
+      for (const [parameter, value] of Object.entries(requiredParameters)) {
+        if (value === undefined) {
           throw IndiekitError.badRequest(
             response.locals.__("BadRequestError.missingParameter", parameter),
           );
         }
       }
 
-      // `response_type` must be `code` (or deprecated `id`). Clients predating
-      // the current specification omit it entirely for authentication-only
-      // requests, which is what indieauth.com sends, so treat a missing value
-      // as `id` rather than rejecting the request. Nothing downstream branches
-      // on it: whether an access token is issued depends on the requested
-      // scope.
-      const responseType = request.query.response_type ?? "id";
+      // `response_type` must be `code` (or deprecated `id`)
       if (!/^(code|id)$/.test(String(responseType))) {
         throw IndiekitError.badRequest(
           response.locals.__("BadRequestError.invalidValue", "response_type"),

packages/endpoint-auth/test/integration/200-authorization-no-response-type.js

@@ -0,0 +1,28 @@
+import { strict as assert } from "node:assert";
+import { after, describe, it } from "node:test";
+
+import { mockAgent } from "@indiekit-test/mock-agent";
+import { testServer } from "@indiekit-test/server";
+import supertest from "supertest";
+
+await mockAgent("endpoint-auth");
+const server = await testServer();
+const request = supertest.agent(server);
+
+describe("endpoint-auth GET /auth", () => {
+  it("Returns documentation with no `response_type` error", async () => {
+    const result = await request
+      .get("/auth")
+      .query({ client_id: "https://auth-endpoint.example" })
+      .query({ redirect_uri: "https://auth-endpoint.example/redirect" })
+      .query({ state: "12345" });
+
+    assert.equal(result.status, 200);
+    assert.equal(
+      result.text.includes("Missing parameter: <code>response_type</code>"),
+      true,
+    );
+  });
+
+  after(() => server.close());
+});

packages/endpoint-auth/test/integration/302-authorization-no-response-type.js

@@ -10,14 +10,14 @@ const server = await testServer();
 const request = supertest.agent(server);
 
 describe("endpoint-auth GET /auth", () => {
-  it("Accepts a request with no `response_type`", async () => {
-    // Clients predating the current specification omit `response_type` for
-    // authentication-only requests, sending an empty `scope` alongside it.
-    // indieauth.com still signs users in this way.
+  it("Accepts a request from indieauth.com with no `response_type`", async () => {
+    // indieauth.com omits `response_type` for authentication-only requests,
+    // sending an empty `scope` alongside it. Every other client is still
+    // required to send it, covered by 200-authorization-no-response-type.
     const result = await request
       .get("/auth")
-      .query({ client_id: "https://auth-endpoint.example" })
-      .query({ redirect_uri: "https://auth-endpoint.example/redirect" })
+      .query({ client_id: "https://indieauth.com/" })
+      .query({ redirect_uri: "https://indieauth.com/auth/redirect" })
       .query({ scope: "" })
       .query({ state: "12345" });