Skip to content

Commit

Permalink
code review changes
Browse files Browse the repository at this point in the history
  • Loading branch information
ThisIsMissEm committed Jun 19, 2024
1 parent 0fca5db commit 7623240
Show file tree
Hide file tree
Showing 5 changed files with 9 additions and 9 deletions.
4 changes: 2 additions & 2 deletions content/en/api/oauth-scopes.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ menu:

## OAuth Scopes

The API access is divided up into several OAuth scopes, these limit what an API client can do, based on the registered and requested scopes that the user has approved. The scopes in Mastodon are hierarchical, for example, if you have request the `read` scope, you automatically have access to `read:accounts`, however **it is recommended that you request the most limited scopes as possible for your application**, i.e., if you only need to access lists and the current user profile, you could use `profile read:lists` as your scopes, instead of `read`.
The API access is divided up into several OAuth scopes, these limit what an API client can do, based on the registered and requested scopes for the [Access Token]({{< relref "api/oauth-tokens" >}}). The scopes in Mastodon are hierarchical, for example, if you request the `read` scope, you automatically have access to `read:accounts`, however **we recommend that you request the most limited scopes as possible for your application**, i.e., if you only need read access to lists and the current user profile, then you should use `profile read:lists` as your scopes instead of `read`.

{{< hint style="info" >}}
To just retrieve the details of the currently authenticated user, use the `profile` scope, which can only access the [`GET /api/v1/accounts/verify_credentials`]({{< relref "methods/accounts#verify_credentials" >}}) endpoint.\
Expand All @@ -20,7 +20,7 @@ This scope was added in Mastodon 4.3, so we recommend using the "Discovering OAu

As of Mastodon 4.3.0, support for [RFC 8414](https://tools.ietf.org/html/rfc8414)'s `GET /.well-known/oauth-authorization-server` endpoint was added, allowing you to discover the scopes supported by the Mastodon server (as well as other OAuth related information such as the endpoints and grant flows).

It is recommended using this endpoint in order to support multiple versions of Mastodon for your OAuth Application.
We recommended using this endpoint in order to support multiple versions of Mastodon for your OAuth Application.

If you make a request to the `GET /.well-known/oauth-authorization-server` endpoint, and it returns a 404, then you can assume that the Mastodon server is running a version older than 4.3, in which case you'll need to look at the specific scopes your application needs and what the lowest common scopes are for the version range of Mastodon that you wish to support.

Expand Down
4 changes: 2 additions & 2 deletions content/en/client/authorized.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,9 @@ menu:

When we register our app and when we authorize our user, we need to define what exactly our generated token will have permission to do. This is done through the use of [OAuth Scopes]({{< relref "api/oauth-scopes" >}}). Each API method has an associated scope, and can only be called if the token being used for authorization has been generated with the corresponding scope.

When authorizing a user, the `scope` query parameter must be a subset of those we specified when we created our app, in our ongoing example, we specified `read write push`, however it is a better idea to only request what your app will actually need through [granular scopes]({{< relref "api/oauth-scopes#granular-scopes" >}}).
When authorizing a user, the `scope` query parameter must be a subset of those we specified when we created our app. In our ongoing example, we specified `read write push` as our scopes when we created our app, however it is a better idea to only request access to what your app will actually need through [granular scopes]({{< relref "api/oauth-scopes#granular-scopes" >}}).

See [OAuth Scopes]({{< relref "api/oauth-scopes" >}}) for a full list of scopes. Each API method's documentation will also specify the OAuth [token type]({{< relref "api/oauth-tokens" >}}) and the scopes required to call it. If an endpoint specifies `read:statuses` and you have `read` then you will be able to access that endpoint, since scopes are hierarchial.
See [OAuth Scopes]({{< relref "api/oauth-scopes" >}}) for a full list of scopes. Each API method's documentation will also specify the OAuth [token type]({{< relref "api/oauth-tokens" >}}) and the scopes required to call it. If an endpoint specifies `read:statuses` and you have `read` access, then you will be able to use that endpoint, since scopes are hierarchial.

{{< page-relref ref="api/oauth-scopes" caption="OAuth Scopes" >}}

Expand Down
4 changes: 2 additions & 2 deletions content/en/client/token.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,10 +34,10 @@ In the above example, we specify the client name and website, which will be show
You can also create applications by POSTing a JSON body to the same endpoint, as documented in [POST /api/v1/apps]({{< relref "methods/apps#create-request-example" >}}).

{{< hint style="info" >}}
As of Mastodon 4.3.0, you can make a request to [`/.well-known/oauth-authorization-server`]({{< relref "spec/oauth#authorization-server-metadata" >}}) to discover what `scopes` the server supports. In older versions of Mastodon, this endpoint will be a 404, so you should decide a "minimum version supported" for the Mastodon server that your application is interacting with.
As of Mastodon 4.3.0, you can make a request to [`/.well-known/oauth-authorization-server`]({{< relref "spec/oauth#authorization-server-metadata" >}}) to discover which `scopes` the server supports. In older versions of Mastodon, this endpoint will return a 404 not found error, indicating that you should decide on a minimum version of Mastodon to support, and using the scopes supported by that version.
{{< /hint >}}

We should see an [CredentialApplication]({{< relref "entities/application#CredentialApplication" >}}) entity returned, but for now, we only care about `client_id` and `client_secret`.
We should see a [CredentialApplication]({{< relref "entities/application#CredentialApplication" >}}) entity returned, but for now, we only care about `client_id` and `client_secret`.

{{< hint style="warning" >}}
Treat the `client_id` and `client_secret` properties as if they are passwords. We recommend you encrypt these when storing in your cache, to prevent accidental credential exposure.
Expand Down
2 changes: 1 addition & 1 deletion content/en/methods/filters.md
Original file line number Diff line number Diff line change
Expand Up @@ -1251,7 +1251,7 @@ Replaces a filter's parameters in-place.
**Version history:**\
2.4.3 - added\
3.1.0 - added `account` context to filter in profile views\
4.0.0 - deprecated. or compatibility purposes, now returns a V1::Filter representing one FilterKeyword (with the `keyword` being presented in the `phrase` attribute). This method will return an error if you attempt to change `expires_in`, `irreversible`, or `context` for a filter with multiple keywords. Changing `phrase` and `whole_word` is always safe.
4.0.0 - deprecated. For compatibility purposes, now returns a V1::Filter representing one FilterKeyword (with the `keyword` being presented in the `phrase` attribute). This method will return an error if you attempt to change `expires_in`, `irreversible`, or `context` for a filter with multiple keywords. Changing `phrase` and `whole_word` is always safe.

#### Request

Expand Down
4 changes: 2 additions & 2 deletions content/en/methods/oauth.md
Original file line number Diff line number Diff line change
Expand Up @@ -306,9 +306,9 @@ The properties exposed by this endpoint can help you better integrate with the M

On Mastodon versions before 4.3.0, requesting this endpoint will result in a `404 Not Found` error.

This is a good indication that the server is running Mastodon older than 4.3.0 and cannot use features added in 4.3.0 and later versions. Instead, you will need to "guess" what that server supports, instead of discovering supported OAuth 2 endpoints, grant flows & scopes dynamically.
Instead, you will need to "guess" what that server supports, instead of discovering supported OAuth 2 endpoints, grant flows & scopes dynamically.

You may want to fallback to the [Instance Metadata endpoint]({{% relref ref="methods/instance#v2" %}}) to try to discover what Mastodon version the server is running by parsing the `version` field, however, this is very brittle and not recommended.
You may want to fallback to the [Instance Metadata endpoint]({{% relref ref="methods/instance#v2" %}}) to try to discover what Mastodon version the server is running by parsing the `version` field; however, this is very brittle and not recommended.

---

Expand Down

0 comments on commit 7623240

Please sign in to comment.