feat(endpoint-microsub): PR 1 - Core Microsub server with channels and timeline

[rmdes]

Part one of seven: the core Microsub server — channels and the timeline. Scoped deliberately small so it is reviewable; the remaining six are written and follow behind it.

+3511 / −0 across 32 files, all new. No existing behaviour is touched.

What it adds

lib/controllers/microsub.js    action dispatch for the Microsub endpoint
lib/controllers/channels.js    channels: list, create, update, delete, order
lib/controllers/timeline.js    timeline reads, marking read/unread, removal
lib/storage/channels.js        channel persistence
lib/storage/items.js           item persistence, using getObjectId from @indiekit/util
lib/utils/auth.js              token verification and scope checks
lib/utils/pagination.js        cursor-based paging
lib/utils/uid.js               channel and item identifiers
lib/utils/validation.js        request validation
locales/en.json                strings

17 test files cover them.

Verification

Green: 895 tests, 894 pass, 0 fail on the full monorepo suite, endpoint-microsub included.

Worth stating plainly because it was not true until today. This is the successor to #829, which had carried a red check since February for two reasons, neither in this code:

• it was opened from a fork, so CI could not read the Localazy readKey secret; the linter step failed and install, lint and the entire test suite were skipped
• feat/microsub sat at ba8e19a7, the commit that introduced the failing prettier . --check on packages/endpoint-share/README.md (style(endpoint-share): format share-url example #910), and never received the fix from style(endpoint-share): keep the share-url example on one line #914

Both are now cleared — this branches from this repo, and feat/microsub carries #914's fix as of e4c2821, byte-identical to main. So the six parts that follow will not inherit a red check either.

One open question

Should this target main rather than feat/microsub? I asked on #829 in August and it got lost in the write-access thread. feat/microsub is 32 commits behind main and, apart from that one backported fix, has no commits of its own — so if all seven parts land there it will keep drifting. Happy either way; it just needs deciding once rather than seven times.

Notes for review

• @indiekit/util's getObjectId is used throughout rather than the plug-in declaring mongodb itself, per your note on feat(endpoint-microsub): PR 1 - Core Microsub server with channels and timeline #829 — there is no mongodb dependency here, so nothing to drift when the host's version moves.
• Running the suite locally needs PASSWORD_SECRET set alongside SECRET, as build.yml does. Without it the session-backed tests redirect rather than fail cleanly, which is not obvious from the output.

[rmdes]

Correcting my comment I had the shape of this right but missed the history, which matters for how it gets fixed.

feat/microsub is at ba8e19a7, which is the commit that introduced the Prettier failure (#910: "has failed on packages/endpoint-share/README.md since ba8e19a, when the rel="share-url" example was added"). So the branch was pinned at the break and had received neither fix.

More importantly, the fix on main is not "run Prettier". #910 did that and you pushed back:

We should stick to one line and avoid the non-self-closing tag. Prettier's HTML linting is a bit suspect, and we disable it in .prettierignore … Let's use <!-- prettier-ignore --> instead.

#914 then did it your way. The branch already had the one-line, non-self-closing form you asked for — all it lacked was the marker, so anyone clearing this with prettier --write would have reintroduced the split, self-closing version you rejected.

Now fixed on feat/microsub in 2d7579e, which takes main's version of the file wholesale — a one-line addition, byte-identical to main. Not a reformat.

That said, the retarget question still stands on its own merits: feat/microsub is 32 commits behind main with no commits of its own beyond that one, so if the seven Microsub parts are going to land there it will keep drifting. Happy either way — just say which.

[rmdes]

Finally !! damned this was convoluted to make it work but now we're good to go !

[paulrobertlloyd]

@rmdes I’ve rebased this against main; once this PR is approved, let’s merge it into main, and release this feature piecemeal. Two remaining things to address, I think:

• It’d be good if the Microsub endpoint could use shared pagination cursor methods. That’d no doubt need some tweaking to our existing methods, but perhaps less so once Paginate by properties.uid #975 lands?
• It’d also be good to ensure we update the Microsub section of the Supported IndieWeb specifications page on the website. Might you be able to list all the constituent components of the specification, and mark those that this PR ticks off (much like for Micropub on the same page)

I’d like to get this into the next beta release, Beta 30, if possible.

[rmdes]

Docs PR for the specifications page: #978.

[rmdes]

Both done in this PR now. Timeline items carry an id, a UUIDv7 stamped with their published date, and page through util's getCursor like posts and media since #975. getCursor takes a filter and a key for it; defaults unchanged. The endpoint's own cursor code is gone. Clients see that id as the Microsub _id. The specifications page is #978.

Your review is addressed in 8332296: localisable error strings, uuidv7At shared from util, one collections module, channels referenced by uid with no ObjectId left, and the user is publication.me. Every thread has a note on what changed.

[paulrobertlloyd]

Sorry, just a few more issues! 😬

[paulrobertlloyd]

Thanks for much for (the first part of) this contribution @rmdes – we got there eventually! I’ll release this in Beta 30, with the following PRs to be included in future beta releases. 🚀