fix(endpoint-auth): limit missing response_type to indieauth.com

A request without `response_type` is rejected again, as the
specification requires, except when `client_id` is indieauth.com — the
one widely-used client that omits it, and one carrying a deprecation
notice pointing at indielogin.com, which sends a conforming request.

The exception is a single commented block. Deleting it and restoring
`request.query.response_type` in the two places below returns the
endpoint to strict behaviour.

The value is threaded as a local rather than written back to
`request.query`: the application sets Express's query parser to
`simple`, which re-parses on every access, so an assignment there is
discarded before it can be read.

Tests cover both sides of the exception: a request from any other
client still reports the missing parameter, one from indieauth.com
redirects to the consent form.

Author: rmdes

packages/endpoint-auth/lib/controllers/authorization.js

@@ -1,5 +1,5 @@
 import { IndiekitError } from "@indiekit/error";
-import { getCanonicalUrl } from "@indiekit/util";
+import { getCanonicalUrl, isSameOrigin } from "@indiekit/util";
 
 import { getClientInformation } from "../client.js";
 import { createRequestUri } from "../pushed-authorization-request.js";
@@ -24,22 +24,37 @@ export const authorizationController = {
         return next(true);
       }
 
+      // Deprecated exception for indieauth.com
+      // indieauth.com omits `response_type`, the pre-specification form of an
+      // authentication-only request (`id`). Its replacement, indielogin.com,
+      // sends `response_type=code` and needs none of this. `client_id` is not
+      // yet known to be a URL, so it is checked before being compared.
+      // @see {@link https://github.com/aaronpk/IndieAuth.com/blob/main/controllers/auth-web.rb#L518}
+      const clientId = String(request.query.client_id);
+      const isDeprecatedClient =
+        URL.canParse(clientId) &&
+        isSameOrigin(clientId, "https://indieauth.com");
+      const responseType =
+        request.query.response_type ?? (isDeprecatedClient ? "id" : undefined);
+
       // Validate presence of required parameters
-      for (const parameter of [
-        "client_id",
-        "redirect_uri",
-        "response_type",
-        "state",
-      ]) {
-        if (!Object.hasOwn(request.query, parameter)) {
+      const requiredParameters = {
+        client_id: request.query.client_id,
+        redirect_uri: request.query.redirect_uri,
+        response_type: responseType,
+        state: request.query.state,
+      };
+
+      for (const [parameter, value] of Object.entries(requiredParameters)) {
+        if (value === undefined) {
           throw IndiekitError.badRequest(
             response.locals.__("BadRequestError.missingParameter", parameter),
           );
         }
       }
 
       // `response_type` must be `code` (or deprecated `id`)
-      if (!/^(code|id)$/.test(String(request.query.response_type))) {
+      if (!/^(code|id)$/.test(String(responseType))) {
         throw IndiekitError.badRequest(
           response.locals.__("BadRequestError.invalidValue", "response_type"),
         );

packages/endpoint-auth/test/integration/200-authorization-no-response-type.js

@@ -10,11 +10,15 @@ const server = await testServer();
 const request = supertest.agent(server);
 
 describe("endpoint-auth GET /auth", () => {
-  it("Returns documentation with no `response_type` error", async () => {
+  it("Rejects a request with no `response_type`", async () => {
+    // Clients predating the current specification omit `response_type` for
+    // authentication-only requests, sending an empty `scope` alongside it.
+    // indieauth.com still signs users in this way.
     const result = await request
       .get("/auth")
       .query({ client_id: "https://auth-endpoint.example" })
       .query({ redirect_uri: "https://auth-endpoint.example/redirect" })
+      .query({ scope: "" })
       .query({ state: "12345" });
 
     assert.equal(result.status, 200);

packages/endpoint-auth/test/integration/302-authorization-indieauth-com.js

@@ -0,0 +1,29 @@
+import { strict as assert } from "node:assert";
+import { after, describe, it } from "node:test";
+
+import { mockAgent } from "@indiekit-test/mock-agent";
+import { testServer } from "@indiekit-test/server";
+import supertest from "supertest";
+
+await mockAgent("endpoint-auth");
+const server = await testServer();
+const request = supertest.agent(server);
+
+describe("endpoint-auth GET /auth", () => {
+  it("Accepts a indieauth.com request with no `response_type`", async () => {
+    // indieauth.com predates the current specification, omitting
+    // `response_type` for authentication-only requests and sending an empty
+    // value for `scope`.
+    const result = await request
+      .get("/auth")
+      .query({ client_id: "https://indieauth.com" })
+      .query({ redirect_uri: "https://indieauth.com/redirect" })
+      .query({ scope: "" })
+      .query({ state: "12345" });
+
+    assert.equal(result.status, 302);
+    assert.match(result.headers.location, /request_uri=/);
+  });
+
+  after(() => server.close());
+});