From 61cf0c0351cc7f8a267ec0887b97fa958e9efdae Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sat, 4 Nov 2023 03:59:36 +0000
Subject: [PATCH 01/20] Remove remote endpoint support

---
 includes/class-indieauth-remote-authorize.php | 167 ------------------
 indieauth.php                                 |  39 +---
 2 files changed, 8 insertions(+), 198 deletions(-)
 delete mode 100755 includes/class-indieauth-remote-authorize.php

diff --git a/includes/class-indieauth-remote-authorize.php b/includes/class-indieauth-remote-authorize.php
deleted file mode 100755
index 49f632e..0000000
--- a/includes/class-indieauth-remote-authorize.php
+++ /dev/null
@@ -1,167 +0,0 @@
-<?php
-
-/**
- * Micropub IndieAuth Authorization Class
- */
-class IndieAuth_Remote_Authorize extends IndieAuth_Authorize {
-
-
-	public function __construct( $load = true ) {
-		$this->register_settings();
-		// Load the hooks for this class only if true. This allows for debugging of the functions
-		if ( true === $load ) {
-			add_action( 'admin_init', array( get_called_class(), 'admin_init' ) );
-			$this->load();
-		}
-	}
-
-	public function register_settings() {
-		// Register Setting
-		register_setting(
-			'indieauth',
-			'indieauth_authorization_endpoint', // Setting Name
-			array(
-				'type'              => 'string',
-				'description'       => 'IndieAuth Authorization Endpoint',
-				'sanitize_callback' => 'esc_url',
-				'show_in_rest'      => true,
-			)
-		);
-		// Register Setting
-		register_setting(
-			'indieauth',
-			'indieauth_token_endpoint', // Setting Name
-			array(
-				'type'              => 'string',
-				'description'       => 'IndieAuth Token Endpoint',
-				'sanitize_callback' => 'esc_url',
-				'show_in_rest'      => true,
-			)
-		);
-	}
-
-	public static function admin_init() {
-		$cls  = get_called_class();
-		$page = 'indieauth';
-
-		add_settings_section(
-			'indieauth',
-			'Remote IndieAuth Endpoint Settings',
-			array( $cls, 'auth_settings' ),
-			$page
-		);
-		add_settings_field(
-			'indieauth_authorization_endpoint',
-			__( 'Authorization Endpoint', 'indieauth' ),
-			array( $cls, 'endpoint_field' ),
-			$page,
-			'indieauth',
-			array(
-				'label_for' => 'indieauth_authorization_endpoint',
-				'class'     => 'widefat',
-				'default'   => '',
-			)
-		);
-		add_settings_field(
-			'indieauth_token_endpoint',
-			__( 'Token Endpoint', 'indieauth' ),
-			array( $cls, 'endpoint_field' ),
-			$page,
-			'indieauth',
-			array(
-				'label_for' => 'indieauth_token_endpoint',
-				'class'     => 'widefat',
-				'default'   => '',
-			)
-		);
-	}
-
-	public static function endpoint_field( $args ) {
-		printf( '<label for="%1$s"><input id="%1$s" name="%1$s" type="url" value="%2$s" placeholder="%3$s" />', esc_attr( $args['label_for'] ), esc_url( get_option( $args['label_for'], $args['default'] ) ), esc_url( $args['default'] ) );
-	}
-
-	public static function auth_settings() {
-		esc_html_e( 'Please specify a remote indieauth authorization and token endpoint.', 'indieauth' );
-	}
-
-	public static function get_authorization_endpoint() {
-		return get_option( 'indieauth_authorization_endpoint', '' );
-	}
-
-	public static function get_token_endpoint() {
-		return get_option( 'indieauth_token_endpoint', '' );
-	}
-
-	public function verify_access_token( $token ) {
-		$resp = wp_remote_get(
-			$this->get_token_endpoint(),
-			array(
-				'headers' => array(
-					'Accept'        => 'application/json',
-					'Authorization' => 'Bearer ' . $token,
-				),
-			)
-		);
-		if ( is_wp_error( $resp ) ) {
-			return $resp;
-		}
-
-		$code   = (int) wp_remote_retrieve_response_code( $resp );
-		$body   = wp_remote_retrieve_body( $resp );
-		$params = json_decode( $body, true );
-
-		if ( ( $code / 100 ) !== 2 ) {
-			return new WP_OAuth_Response( 'invalid_request', 'invalid access token', 403 );
-		}
-
-		// look for a user with the same url as the token's `me` value.
-		$user = get_user_by_identifier( $params['me'] );
-		if ( $user instanceof WP_User ) {
-			$params['user'] = $user->ID;
-		} else {
-			return new WP_OAuth_Response( 'unauthorized', __( 'Unable to Find User', 'indieauth' ), 401 );
-		}
-		return $params;
-	}
-
-	public static function verify_authorization_code( $code ) {
-		$args  = array(
-			'headers' => array(
-				'Accept' => 'application/json',
-			),
-		);
-		$query = build_query(
-			array(
-				'code'         => rawurlencode( $code ),
-				'redirect_uri' => wp_login_url( $redirect_uri ),
-				'client_id'    => home_url(),
-			)
-		);
-		$resp  = wp_safe_remote_post( static::get_authorization_endpoint() . '?' . $query, $args );
-		if ( is_wp_error( $resp ) ) {
-			return wp_error_to_oauth_response( $resp );
-		}
-		$code   = wp_remote_retrieve_response_code( $resp );
-		$body   = wp_remote_retrieve_body( $resp );
-		$params = json_decode( $response, true );
-
-		// check if response was json or not
-		if ( ! is_array( $response ) ) {
-			return new WP_OAuth_Response( 'indieauth_response_error', __( 'IndieAuth.com seems to have some hiccups, please try it again later.', 'indieauth' ), 401 );
-		}
-
-		if ( 2 === (int) ( $code / 100 ) && isset( $params['me'] ) ) {
-			return $params;
-		}
-		if ( array_key_exists( 'error', $response ) ) {
-			return new WP_Error( 'indieauth_' . $response['error'], esc_html( $response['error_description'] ) );
-		}
-
-		return new WP_OAuth_Response(
-			'indieauth.invalid_access_token',
-			__( 'Supplied Token is Invalid', 'indieauth' ),
-			$code,
-			$response
-		);
-	}
-}
diff --git a/indieauth.php b/indieauth.php
index bb010f1..ee14c7c 100644
--- a/indieauth.php
+++ b/indieauth.php
@@ -12,13 +12,6 @@
  * Domain Path: /languages
  */
 
-
-/* If this is set then it will activate the remote mode for delegating your login to a remote endpoint */
-if ( ! defined( 'INDIEAUTH_REMOTE_MODE' ) ) {
-	define( 'INDIEAUTH_REMOTE_MODE', 0 );
-}
-
-
 /* If this is set then it will enable the experimental Ticket Endpoint */
 if ( ! defined( 'INDIEAUTH_TICKET_ENDPOINT' ) ) {
 	define( 'INDIEAUTH_TICKET_ENDPOINT', 0 );
@@ -130,30 +123,14 @@ public static function plugins_loaded() {
 			'class-indieauth-local-authorize.php',
 		);
 
-		// Classes Require for using a Remote Endpoint
-		$remotefiles = array(
-			'class-indieauth-remote-authorize.php',
-		);
-
-		// $load        = get_option( 'indieauth_config', 'local' );
-		$load = INDIEAUTH_REMOTE_MODE ? 'remote' : 'local';
-
-		switch ( $load ) {
-			case 'remote':
-				self::load( $remotefiles );
-				static::$indieauth = new IndieAuth_Remote_Authorize();
-				break;
-			default:
-				self::load( $localfiles );
-				new IndieAuth_Authorization_Endpoint();
-				new IndieAuth_Token_Endpoint();
-				static::$indieauth = new IndieAuth_Local_Authorize();
-				static::$metadata  = new IndieAuth_Metadata_Endpoint();
-				new IndieAuth_Revocation_Endpoint();
-				new IndieAuth_Introspection_Endpoint();
-				new IndieAuth_Userinfo_Endpoint();
-				break;
-		}
+		self::load( $localfiles );
+		new IndieAuth_Authorization_Endpoint();
+		new IndieAuth_Token_Endpoint();
+		static::$indieauth = new IndieAuth_Local_Authorize();
+		static::$metadata  = new IndieAuth_Metadata_Endpoint();
+		new IndieAuth_Revocation_Endpoint();
+		new IndieAuth_Introspection_Endpoint();
+		new IndieAuth_Userinfo_Endpoint();
 
 		if ( WP_DEBUG ) {
 			self::load( 'class-indieauth-debug.php' );

From 50285d5fd81c0925cb709afa278170abd12ddc64 Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sun, 5 Nov 2023 04:13:37 +0000
Subject: [PATCH 02/20] Serve the IndieAuth metadata header at the issuer URL

---
 .../class-indieauth-metadata-endpoint.php     | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/includes/class-indieauth-metadata-endpoint.php b/includes/class-indieauth-metadata-endpoint.php
index 02159e4..56a6e2a 100644
--- a/includes/class-indieauth-metadata-endpoint.php
+++ b/includes/class-indieauth-metadata-endpoint.php
@@ -5,6 +5,7 @@
 class IndieAuth_Metadata_Endpoint {
 
 	public function __construct() {
+		add_filter( 'rest_pre_serve_request', array( $this, 'serve_request' ), 11, 4 );
 		add_filter( 'rest_index', array( $this, 'register_index' ) );
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
 		add_action( 'wp_head', array( $this, 'html_header' ) );
@@ -18,6 +19,34 @@ public static function get_metadata_endpoint() {
 		return rest_url( '/indieauth/1.0/metadata' );
 	}
 
+
+	public static function get_issuer() {
+		return rest_url( '/indieauth/1.0' );
+	}
+
+	public static function set_http_header( $url, $rel, $replace = false ) {
+		header( sprintf( 'Link: <%s>; rel="%s"', $url, $rel ), $replace );
+	}
+
+	/**
+	 * Hooks into the REST API output to add a metadata header to the Issuer URL.
+ 	 *
+ 	 * @param bool                      $served  Whether the request has already been served.
+ 	 * @param WP_HTTP_ResponseInterface $result  Result to send to the client. Usually a WP_REST_Response.
+ 	 * @param WP_REST_Request           $request Request used to generate the response.
+ 	 * @param WP_REST_Server            $server  Server instance.
+	 *
+	 * @return true
+	 */
+	public static function serve_request( $served, $result, $request, $server ) {
+		if ( '/indieauth/1.0' !== $request->get_route() ) {
+			return $served;
+		}
+		static::set_http_header( static::get_metadata_endpoint(), 'indieauth-metadata' );
+
+		return $served;
+	}
+
 	/**
 	 * Add authentication information into the REST API Index
 	 *

From 8ca588fc7199fe98119e3d3c50050a1148ef3ef7 Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Mon, 6 Nov 2023 04:54:26 +0000
Subject: [PATCH 03/20] Have each endpoint handle its metadata

---
 ...class-indieauth-authorization-endpoint.php | 17 +++++++++
 ...class-indieauth-introspection-endpoint.php | 15 ++++++++
 .../class-indieauth-metadata-endpoint.php     | 37 ++++++++++---------
 .../class-indieauth-revocation-endpoint.php   | 15 ++++++++
 includes/class-indieauth-ticket-endpoint.php  | 18 +++++++--
 includes/class-indieauth-token-endpoint.php   | 16 ++++++++
 .../class-indieauth-userinfo-endpoint.php     | 11 ++++++
 indieauth.php                                 |  2 +-
 8 files changed, 109 insertions(+), 22 deletions(-)

diff --git a/includes/class-indieauth-authorization-endpoint.php b/includes/class-indieauth-authorization-endpoint.php
index 2767bbb..2ab5fa5 100644
--- a/includes/class-indieauth-authorization-endpoint.php
+++ b/includes/class-indieauth-authorization-endpoint.php
@@ -11,9 +11,26 @@ class IndieAuth_Authorization_Endpoint {
 	public function __construct() {
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
 		add_action( 'login_form_indieauth', array( $this, 'login_form_indieauth' ) );
+		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
 		$this->tokens = new Token_User( '_indieauth_code_' );
 	}
 
+	public static function get_endpoint() {
+		return rest_url( '/indieauth/1.0/auth' );
+	}
+
+	public static function get_response_types() {
+		return array_unique( apply_filters( 'indieauth_response_types_supported', array( 'code' ) ) );
+	}
+
+	public function metadata( $metadata ) {
+		$metadata['authorization_endpoint'] = $this->get_endpoint();
+		$metadata['response_types_supported'] = $this->get_response_types();
+		$metadata['authorization_response_iss_parameter_supported'] = true;
+		return $metadata;
+	}
+
+
 	/**
 	 * Register the Route.
 	 */
diff --git a/includes/class-indieauth-introspection-endpoint.php b/includes/class-indieauth-introspection-endpoint.php
index d3f2d49..7cb7d7c 100644
--- a/includes/class-indieauth-introspection-endpoint.php
+++ b/includes/class-indieauth-introspection-endpoint.php
@@ -7,6 +7,21 @@ class IndieAuth_Introspection_Endpoint extends IndieAuth_Endpoint {
 	public function __construct() {
 		parent::__construct();
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
+		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
+	}
+
+	public static function get_endpoint() {
+		return rest_url( '/indieauth/1.0/introspection' );
+	}
+
+	public function auth_methods_supported() {
+		return array_unique( apply_filters( 'indieauth_introspection_auth_methods_supported', array( 'none' ) ) );
+	}
+
+	public function metadata( $metadata ) {
+		$metadata['introspection_endpoint'] = $this->get_endpoint();
+		$metadata['introspection_auth_methods_supported'] = $this->auth_methods_supported();
+		return $metadata;
 	}
 
 	/**
diff --git a/includes/class-indieauth-metadata-endpoint.php b/includes/class-indieauth-metadata-endpoint.php
index 56a6e2a..462c12c 100644
--- a/includes/class-indieauth-metadata-endpoint.php
+++ b/includes/class-indieauth-metadata-endpoint.php
@@ -24,10 +24,29 @@ public static function get_issuer() {
 		return rest_url( '/indieauth/1.0' );
 	}
 
+
+	/*
+	 * Outputs a marked up Http link header.
+	 * 
+	 * @param string $url URL for the link
+	 * @param string $rel Rel property for the link
+	 * @param boolean $replace Passes the value of replace through to the header PHP
+	 */
 	public static function set_http_header( $url, $rel, $replace = false ) {
 		header( sprintf( 'Link: <%s>; rel="%s"', $url, $rel ), $replace );
 	}
 
+	/*
+	 * Returns a marked up HTML link header.
+	 * 
+	 * @param string $url URL for the link
+	 * @param string $rel Rel property for the link
+	 * @return string Marked up HTML link to add to head
+	 */
+	public static function get_html_header( $url, $rel ) {
+		return sprintf( '<link rel="%s" href="%s" />' . PHP_EOL, $rel, $url );
+	}
+
 	/**
 	 * Hooks into the REST API output to add a metadata header to the Issuer URL.
  	 *
@@ -116,31 +135,13 @@ public function register_routes() {
 	 * @return Response to Return to the REST Server.
 	 **/
 	public function metadata( $request ) {
-		$grants = array( 'authorization_code', 'refresh_token' );
-		if ( class_exists( 'IndieAuth_Ticket_Endpoint' ) ) {
-			$grants[] = 'ticket';
-		}
-
 		$metadata = array(
 			'issuer'                                     => indieauth_get_issuer(),
-			'authorization_endpoint'                     => indieauth_get_authorization_endpoint(),
 			'scopes_supported'                           => IndieAuth_Plugin::$scopes->get_names(),
-			'response_types_supported'                   => array( 'code' ),
-			'grant_types_supported'                      => $grants,
 			'service_documentation'                      => 'https://indieauth.spec.indieweb.org',
-			'token_endpoint'                             => indieauth_get_token_endpoint(),
-			'revocation_endpoint'                        => rest_url( '/indieauth/1.0/revocation' ),
-			'revocation_endpoint_auth_methods_supported' => array( 'none' ),
-			'introspection_endpoint'                     => rest_url( '/indieauth/1.0/introspection' ),
-			'introspection_endpoint_auth_methods_supported' => array( 'none' ),
 			'code_challenge_methods_supported'           => array( 'S256' ),
-			'authorization_response_iss_parameter_supported' => true,
 		);
 
-		if ( class_exists( 'IndieAuth_Ticket_Endpoint' ) ) {
-			$metadata['ticket_endpoint'] = rest_url( 'indieauth/1.0/ticket' );
-		}
-
 		$metadata = apply_filters( 'indieauth_metadata', $metadata );
 		return new WP_REST_Response(
 			$metadata,
diff --git a/includes/class-indieauth-revocation-endpoint.php b/includes/class-indieauth-revocation-endpoint.php
index 82dddc8..0371225 100644
--- a/includes/class-indieauth-revocation-endpoint.php
+++ b/includes/class-indieauth-revocation-endpoint.php
@@ -6,6 +6,21 @@ class IndieAuth_Revocation_Endpoint extends IndieAuth_Endpoint {
 	public function __construct() {
 		parent::__construct();
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
+		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
+	}
+
+	public static function get_endpoint() {
+		return rest_url( '/indieauth/1.0/revocation' );
+	}
+
+	public function auth_methods_supported() {
+		return array_unique( apply_filters( 'indieauth_revocation_auth_methods_supported', array( 'none' ) ) );
+	}
+
+	public function metadata( $metadata ) {
+		$metadata['revocation_endpoint'] = $this->get_endpoint();
+		$metadata['revocation_auth_methods_supported'] = $this->auth_methods_supported();
+		return $metadata;
 	}
 
 	/**
diff --git a/includes/class-indieauth-ticket-endpoint.php b/includes/class-indieauth-ticket-endpoint.php
index b58c5be..6051eae 100644
--- a/includes/class-indieauth-ticket-endpoint.php
+++ b/includes/class-indieauth-ticket-endpoint.php
@@ -10,14 +10,26 @@ public function __construct() {
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
 		add_action( 'template_redirect', array( $this, 'http_header' ) );
 		add_action( 'wp_head', array( $this, 'html_header' ) );
+		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
+		add_filter( 'indieauth_grant_types_supported', array( $this, 'grant_types' ) );
 	}
 
-	public static function get_ticket_endpoint() {
+	public static function grant_types( $grants ) {
+		$grants[] = 'ticket';
+		return $grants;
+	}
+
+	public static function get_endpoint() {
 		return rest_url( '/indieauth/1.0/ticket' );
 	}
 
+	public function metadata( $metadata ) {
+		$metadata['ticket_endpoint'] = $this->get_endpoint();
+		return $metadata;
+	}
+
 	public function http_header() {
-		header( sprintf( 'Link: <%s>; rel="ticket_endpoint"', static::get_ticket_endpoint() ), false );
+		header( sprintf( 'Link: <%s>; rel="ticket_endpoint"', static::get_endpoint() ), false );
 	}
 	public static function html_header() {
 		$kses = array(
@@ -26,7 +38,7 @@ public static function html_header() {
 				'rel'  => array(),
 			),
 		);
-			echo wp_kses( sprintf( '<link rel="ticket_endpoint" href="%s" />' . PHP_EOL, static::get_ticket_endpoint() ), $kses );
+			echo wp_kses( sprintf( '<link rel="ticket_endpoint" href="%s" />' . PHP_EOL, static::get_endpoint() ), $kses );
 	}
 
 	/**
diff --git a/includes/class-indieauth-token-endpoint.php b/includes/class-indieauth-token-endpoint.php
index ac2d44d..cd6df99 100644
--- a/includes/class-indieauth-token-endpoint.php
+++ b/includes/class-indieauth-token-endpoint.php
@@ -10,8 +10,24 @@ class IndieAuth_Token_Endpoint extends IndieAuth_Endpoint {
 	public function __construct() {
 		parent::__construct();
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
+		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
 	}
 
+	public static function get_endpoint() {
+		return rest_url( '/indieauth/1.0/token' );
+	}
+
+	public static function get_grant_types() {
+		return array_unique( apply_filters( 'indieauth_grant_types_supported', array( 'authorization_code', 'refresh_token' ) ) );
+	}
+
+	public function metadata( $metadata ) {
+		$metadata['token_endpoint'] = $this->get_endpoint();
+		$metadata['grant_types_supported'] = $this->get_grant_types();
+		return $metadata;
+	}
+
+
 	/**
 	 * Register the Route.
 	 */
diff --git a/includes/class-indieauth-userinfo-endpoint.php b/includes/class-indieauth-userinfo-endpoint.php
index 5499759..a3e84cb 100644
--- a/includes/class-indieauth-userinfo-endpoint.php
+++ b/includes/class-indieauth-userinfo-endpoint.php
@@ -7,6 +7,17 @@ class IndieAuth_Userinfo_Endpoint extends IndieAuth_Endpoint {
 	public function __construct() {
 		parent::__construct();
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
+		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
+	}
+
+
+	public static function get_endpoint() {
+		return rest_url( '/indieauth/1.0/userinfo' );
+	}
+
+	public function metadata( $metadata ) {
+		$metadata['userinfo_endpoint'] = $this->get_endpoint();
+		return $metadata;
 	}
 
 	/**
diff --git a/indieauth.php b/indieauth.php
index ee14c7c..2fd4f3c 100644
--- a/indieauth.php
+++ b/indieauth.php
@@ -92,6 +92,7 @@ public static function plugins_loaded() {
 			array(
 				'functions.php', // Global Functions
 				'class-oauth-response.php', // OAuth REST Error Class
+				'class-indieauth-metadata-endpoint.php', // Metadata Endpoint
 				'class-token-generic.php', // Token Base Class
 				'class-token-user.php',
 				'class-indieauth-scope.php', // Scope Class
@@ -114,7 +115,6 @@ public static function plugins_loaded() {
 			'class-indieauth-endpoint.php', // Endpoint Base Class
 			'class-indieauth-token-endpoint.php', // Token Endpoint
 			'class-indieauth-authorization-endpoint.php', // Authorization Endpoint
-			'class-indieauth-metadata-endpoint.php', // Metadata Endpoint
 			'class-indieauth-revocation-endpoint.php', // Revocation Endpoint
 			'class-indieauth-introspection-endpoint.php', // Introspection Endpoint
 			'class-indieauth-userinfo-endpoint.php', // User Info Endpoint

From aab0d0255014e2fdf6505a39cd54cdf6fff46d63 Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Mon, 6 Nov 2023 12:13:24 +0000
Subject: [PATCH 04/20] Make all endpoints children of the endpoint class

---
 ...class-indieauth-authorization-endpoint.php | 22 +++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/includes/class-indieauth-authorization-endpoint.php b/includes/class-indieauth-authorization-endpoint.php
index 2ab5fa5..29a1d28 100644
--- a/includes/class-indieauth-authorization-endpoint.php
+++ b/includes/class-indieauth-authorization-endpoint.php
@@ -5,14 +5,14 @@
  * Implements IndieAuth Authorization Endpoint
  */
 
-class IndieAuth_Authorization_Endpoint {
-	private $tokens;
-
+class IndieAuth_Authorization_Endpoint extends IndieAuth_Endpoint {
+	private $codes;
+	
 	public function __construct() {
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
 		add_action( 'login_form_indieauth', array( $this, 'login_form_indieauth' ) );
 		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
-		$this->tokens = new Token_User( '_indieauth_code_' );
+		$this->codes = new Token_User( '_indieauth_code_' );
 	}
 
 	public static function get_endpoint() {
@@ -289,19 +289,19 @@ public function code( $params ) {
 		return new WP_REST_Response( array( 'url' => $url ), 302, array( 'Location' => $url ) );
 	}
 
-	public function set_code( $user_id, $token ) {
-		$this->tokens->set_user( $user_id );
-		return $this->tokens->set( $token, 600 );
+	public function set_code( $user_id, $code ) {
+		$this->codes->set_user( $user_id );
+		return $this->codes->set( $code, 600 );
 	}
 
 	public function get_code( $code, $hash = true ) {
-		$token = $this->tokens->get( $code, $hash );
-		return $token;
+		$code = $this->codes->get( $code, $hash );
+		return $code;
 	}
 
 	public function delete_code( $code, $user_id = null ) {
-		$this->tokens->set_user( $user_id );
-		return $this->tokens->destroy( $code );
+		$this->codes->set_user( $user_id );
+		return $this->codes->destroy( $code );
 	}
 
 	/*

From cf7aa1a8c833003ffe5ddf766f40120ee232b5a2 Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Tue, 7 Nov 2023 13:52:23 +0000
Subject: [PATCH 05/20] Remove local authorize and move around functions to
 reflect what they are

---
 includes/class-indieauth-admin.php            |  54 ++++++++
 includes/class-indieauth-authorize.php        | 122 ++++++++---------
 includes/class-indieauth-endpoint.php         |  23 +++-
 includes/class-indieauth-local-authorize.php  | 125 ------------------
 .../class-indieauth-metadata-endpoint.php     |   1 +
 includes/functions.php                        |   9 --
 indieauth.php                                 |   3 +-
 templates/indieauth-settings.php              |  16 ---
 8 files changed, 131 insertions(+), 222 deletions(-)
 delete mode 100644 includes/class-indieauth-local-authorize.php

diff --git a/includes/class-indieauth-admin.php b/includes/class-indieauth-admin.php
index b95aac9..e603780 100644
--- a/includes/class-indieauth-admin.php
+++ b/includes/class-indieauth-admin.php
@@ -143,11 +143,65 @@ public function settings() {
 				'show_in_rest' => true,
 			)
 		);
+		register_setting(
+			'indieauth',
+			'indieauth_expires_in',
+			array(
+				'type'         => 'number',
+				'description'  => __( 'IndieAuth Default Expiry Time', 'indieauth' ),
+				'show_in_rest' => true,
+				'default'      => 1209600, // Two Weeks.
+			)
+		);
 	}
 
 
 	public function admin_init() {
 		add_settings_field( 'indieauth_general_settings', __( 'IndieAuth Settings', 'indieauth' ), array( $this, 'general_settings' ), 'general', 'default' );
+
+		add_settings_section(
+			'indieauth',
+			'IndieAuth Endpoint Settings',
+			array( $this, 'endpoint_settings' ),
+			'indieauth'
+		);
+		add_settings_field(
+			'indieauth_expires_in',
+			__( 'Default Token Expiration Time', 'indieauth' ),
+			array( $this, 'numeric_field' ),
+			'indieauth',
+			'indieauth',
+			array(
+				'label_for'   => 'indieauth_expires_in',
+				'class'       => 'widefat',
+				'description' => __( 'Set the Number of Seconds until a Token expires (Default is Two Weeks). 0 to Disable Expiration.', 'indieauth' ),
+				'default'     => '',
+				'min'         => 0,
+			)
+		);
+	}
+
+	public static function endpoint_settings() {
+		esc_html_e( 'These settings control the behavior of the endpoints', 'indieauth' );
+	}
+
+
+	public static function numeric_field( $args ) {
+		$props = array();
+		if ( array_key_exists( 'min', $args ) && is_numeric( $args['min'] ) ) {
+			$props[] = 'min=' . $args['min'];
+		}
+		if ( array_key_exists( 'max', $args ) && is_numeric( $args['max'] ) ) {
+			$props[] = 'max=' . $args['max'];
+		}
+		if ( array_key_exists( 'step', $args ) && is_numeric( $args['step'] ) ) {
+			$props[] = 'step=' . $args['step'];
+		}
+		$props = implode( ' ', $props );
+		printf( '<label for="%1$s"><input id="%1$s" name="%1$s" type="number" value="%2$s" %3$s />', esc_attr( $args['label_for'] ), esc_attr( get_option( $args['label_for'], $args['default'] ) ), esc_html( $props ) );
+		if ( array_key_exists( 'description', $args ) && ! empty( $args['description'] ) ) {
+			printf( '<p>%1$s</p>', esc_html( $args['description'] ) );
+		}
 	}
 
 	/**
diff --git a/includes/class-indieauth-authorize.php b/includes/class-indieauth-authorize.php
index 1bd595a..0b038e4 100644
--- a/includes/class-indieauth-authorize.php
+++ b/includes/class-indieauth-authorize.php
@@ -1,9 +1,8 @@
 <?php
 /**
- * Authorize base class
- * Helper functions for extracting tokens from the WP-API team Oauth2 plugin
+ * Authorize class
  */
-abstract class IndieAuth_Authorize {
+class IndieAuth_Authorize {
 
 	public $error    = null;
 	public $scopes   = array();
@@ -20,9 +19,6 @@ public function load() {
 		add_filter( 'determine_current_user', array( $this, 'determine_current_user' ), 15 );
 		add_filter( 'rest_authentication_errors', array( $this, 'rest_authentication_errors' ) );
 
-		add_action( 'template_redirect', array( $this, 'http_header' ) );
-		add_action( 'wp_head', array( $this, 'html_header' ) );
-
 		add_filter( 'indieauth_scopes', array( $this, 'get_indieauth_scopes' ), 9 );
 		add_filter( 'indieauth_response', array( $this, 'get_indieauth_response' ), 9 );
 		add_filter( 'wp_rest_server_class', array( $this, 'wp_rest_server_class' ) );
@@ -44,22 +40,6 @@ public static function return_oauth_error( $response, $handler, $request ) {
 		return $response;
 	}
 
-
-	/**
-	 * Returns the URL for the authorization endpoint.
-	 *
-	 * @return string Authorization Endpoint.
-	 **/
-	abstract public static function get_authorization_endpoint();
-
-	/**
-	 * Returns the URL for the token endpoint.
-	 *
-	 * @return string Token Endpoint.
-	 **/
-	abstract public static function get_token_endpoint();
-
-
 	/**
 	 * Prevent caching of unauthenticated status.  See comment below.
 	 *
@@ -90,35 +70,6 @@ public function get_indieauth_response( $response ) {
 		return $response ? $response : $this->response;
 	}
 
-	public function http_header() {
-		$auth  = static::get_authorization_endpoint();
-		$token = static::get_token_endpoint();
-		if ( empty( $auth ) || empty( $token ) ) {
-			return;
-		}
-		if ( is_author() || is_front_page() ) {
-			header( sprintf( 'Link: <%s>; rel="authorization_endpoint"', static::get_authorization_endpoint() ), false );
-			header( sprintf( 'Link: <%s>; rel="token_endpoint"', static::get_token_endpoint() ), false );
-		}
-	}
-	public static function html_header() {
-		$auth  = static::get_authorization_endpoint();
-		$token = static::get_token_endpoint();
-		$kses  = array(
-			'link' => array(
-				'href' => array(),
-				'rel'  => array(),
-			),
-		);
-		if ( empty( $auth ) || empty( $token ) ) {
-			return;
-		}
-		if ( is_author() || is_front_page() ) {
-			echo wp_kses( sprintf( '<link rel="authorization_endpoint" href="%s" />' . PHP_EOL, $auth ), $kses );
-			echo wp_kses( sprintf( '<link rel="token_endpoint" href="%s" />' . PHP_EOL, $token ), $kses );
-		}
-	}
-
 	/**
 	 * Report our errors, if we have any.
 	 *
@@ -190,24 +141,6 @@ public function determine_current_user( $user_id ) {
 		return $user_id;
 	}
 
-	/**
-	 * Verifies Access Token
-	 *
-	 * @param string $token The token to verify
-	 *
-	 * @return array|WP_OAuth_Response Return either the token information or an OAuth Error Object
-	 **/
-	abstract public function verify_access_token( $token );
-
-	/**
-	 * Verifies authorixation code.
-	 *
-	 * @param string $code Authorization Code
-	 *
-	 * @return array|WP_OAuth_Response Return either the code information or an OAuth Error object
-	 **/
-	abstract public static function verify_authorization_code( $code );
-
 	/**
 	 * Get the authorization header
 	 *
@@ -289,4 +222,55 @@ public function get_token_from_request() {
 		}
 		return null;
 	}
+
+	/**
+	 * Verifies Access Token
+	 *
+	 * @param string $token The token to verify
+	 *
+	 * @return array|WP_OAuth_Response Return either the token information or an OAuth Error Object
+	 **/
+	public function verify_access_token( $token ) {
+		$tokens = new Token_User( '_indieauth_token_' );
+		$return = $tokens->get( $token );
+		if ( empty( $return ) ) {
+			return new WP_OAuth_Response(
+				'invalid_token',
+				__( 'Invalid access token', 'indieauth' ),
+				401
+			);
+		}
+		if ( is_oauth_error( $return ) ) {
+			return $return;
+		}
+		$return['last_accessed'] = time();
+		$return['last_ip']       = $_SERVER['REMOTE_ADDR'];
+		$tokens->update( $token, $return );
+		if ( array_key_exists( 'exp', $return ) ) {
+			$return['expires_in'] = $return['exp'] - time();
+		}
+		return $return;
+	}
+
+	/**
+	 * Verifies authorixation code.
+	 *
+	 * @param string $code Authorization Code
+	 *
+	 * @return array|WP_OAuth_Response Return either the code information or an OAuth Error object
+	 **/
+	public static function verify_authorization_code( $code ) {
+		$tokens = new Token_User( '_indieauth_code_' );
+		$return = $tokens->get( $code );
+		if ( empty( $return ) ) {
+			return new WP_OAuth_Response(
+				'invalid_code',
+				__( 'Invalid authorization code', 'indieauth' ),
+				401
+			);
+		}
+		// Once the code is verified destroy it
+		$tokens->destroy( $code );
+		return $return;
+	}
 }
diff --git a/includes/class-indieauth-endpoint.php b/includes/class-indieauth-endpoint.php
index 53011ab..e38868c 100644
--- a/includes/class-indieauth-endpoint.php
+++ b/includes/class-indieauth-endpoint.php
@@ -5,7 +5,7 @@
  * Implements Endpoint Functionality
  */
 
-class IndieAuth_Endpoint {
+abstract class IndieAuth_Endpoint {
 	protected $tokens;
 	protected $refresh_tokens;
 	public function __construct() {
@@ -13,6 +13,27 @@ public function __construct() {
 		$this->refresh_tokens = new Token_User( '_indieauth_refresh_' );
 	}
 
+	/*
+	 * Outputs a marked up Http link header.
+	 * 
+	 * @param string $url URL for the link
+	 * @param string $rel Rel property for the link
+	 * @param boolean $replace Passes the value of replace through to the header PHP
+	 */
+	public static function set_http_header( $url, $rel, $replace = false ) {
+		header( sprintf( 'Link: <%s>; rel="%s"', $url, $rel ), $replace );
+	}
+
+	/*
+	 * Returns a marked up HTML link header.
+	 * 
+	 * @param string $url URL for the link
+	 * @param string $rel Rel property for the link
+	 * @return string Marked up HTML link to add to head
+	 */
+	public static function get_html_header( $url, $rel ) {
+		return sprintf( '<link rel="%s" href="%s" />' . PHP_EOL, $rel, $url );
+	}
 
 	/**
 	 * Extracts the token from the given authorization header.
diff --git a/includes/class-indieauth-local-authorize.php b/includes/class-indieauth-local-authorize.php
deleted file mode 100644
index 293b5c0..0000000
--- a/includes/class-indieauth-local-authorize.php
+++ /dev/null
@@ -1,125 +0,0 @@
-<?php
-/**
- * Authorize class
- * Helper functions for extracting tokens from the WP-API team Oauth2 plugin
- */
-class IndieAuth_Local_Authorize extends IndieAuth_Authorize {
-
-	public function __construct( $load = true ) {
-		$this->register_settings();
-		// Load the hooks for this class only if true. This allows for debugging of the functions
-		if ( true === $load ) {
-			add_action( 'admin_init', array( get_called_class(), 'admin_init' ) );
-			$this->load();
-		}
-	}
-
-	public function register_settings() {
-		register_setting(
-			'indieauth',
-			'indieauth_expires_in',
-			array(
-				'type'         => 'number',
-				'description'  => __( 'IndieAuth Default Expiry Time', 'indieauth' ),
-				'show_in_rest' => true,
-				'default'      => 1209600, // Two Weeks.
-			)
-		);
-	}
-
-	public static function admin_init() {
-		$cls  = get_called_class();
-		$page = 'indieauth';
-
-		add_settings_section(
-			'indieauth',
-			'IndieAuth Endpoint Settings',
-			array( $cls, 'endpoint_settings' ),
-			$page
-		);
-		add_settings_field(
-			'indieauth_expires_in',
-			__( 'Default Token Expiration Time', 'indieauth' ),
-			array( $cls, 'numeric_field' ),
-			$page,
-			'indieauth',
-			array(
-				'label_for'   => 'indieauth_expires_in',
-				'class'       => 'widefat',
-				'description' => __( 'Set the Number of Seconds until a Token expires (Default is Two Weeks). 0 to Disable Expiration.', 'indieauth' ),
-				'default'     => '',
-				'min'         => 0,
-			)
-		);
-	}
-
-
-	public static function endpoint_settings() {
-		esc_html_e( 'These settings control the behavior of the endpoints', 'indieauth' );
-	}
-
-
-	public static function numeric_field( $args ) {
-		$props = array();
-		if ( array_key_exists( 'min', $args ) && is_numeric( $args['min'] ) ) {
-			$props[] = 'min=' . $args['min'];
-		}
-		if ( array_key_exists( 'max', $args ) && is_numeric( $args['max'] ) ) {
-			$props[] = 'max=' . $args['max'];
-		}
-		if ( array_key_exists( 'step', $args ) && is_numeric( $args['step'] ) ) {
-			$props[] = 'step=' . $args['step'];
-		}
-		$props = implode( ' ', $props );
-		printf( '<label for="%1$s"><input id="%1$s" name="%1$s" type="number" value="%2$s" %3$s />', esc_attr( $args['label_for'] ), esc_attr( get_option( $args['label_for'], $args['default'] ) ), esc_html( $props ) );
-		if ( array_key_exists( 'description', $args ) && ! empty( $args['description'] ) ) {
-			printf( '<p>%1$s</p>', esc_html( $args['description'] ) );
-		}
-	}
-
-	public static function get_authorization_endpoint() {
-		return rest_url( '/indieauth/1.0/auth' );
-	}
-
-	public static function get_token_endpoint() {
-		return rest_url( '/indieauth/1.0/token' );
-	}
-
-
-	public function verify_access_token( $token ) {
-		$tokens = new Token_User( '_indieauth_token_' );
-		$return = $tokens->get( $token );
-		if ( empty( $return ) ) {
-			return new WP_OAuth_Response(
-				'invalid_token',
-				__( 'Invalid access token', 'indieauth' ),
-				401
-			);
-		}
-		if ( is_oauth_error( $return ) ) {
-			return $return;
-		}
-		$return['last_accessed'] = time();
-		$return['last_ip']       = $_SERVER['REMOTE_ADDR'];
-		$tokens->update( $token, $return );
-		if ( array_key_exists( 'exp', $return ) ) {
-			$return['expires_in'] = $return['exp'] - time();
-		}
-		return $return;
-	}
-
-	public static function verify_authorization_code( $code ) {
-		$tokens = new Token_User( '_indieauth_code_' );
-		$return = $tokens->get( $code );
-		if ( empty( $return ) ) {
-			return new WP_OAuth_Response(
-				'invalid_code',
-				__( 'Invalid authorization code', 'indieauth' ),
-				401
-			);
-		}
-		// Once the code is verified destroy it
-		$tokens->destroy( $code );
-		return $return;
-	}
-}
diff --git a/includes/class-indieauth-metadata-endpoint.php b/includes/class-indieauth-metadata-endpoint.php
index 462c12c..5116573 100644
--- a/includes/class-indieauth-metadata-endpoint.php
+++ b/includes/class-indieauth-metadata-endpoint.php
@@ -93,6 +93,7 @@ public function register_index( WP_REST_Response $response ) {
 		return $response;
 	}
 
+
 	public function http_header() {
 		if ( is_author() || is_front_page() ) {
 			header( sprintf( 'Link: <%s>; rel="indieauth-metadata"', static::get_metadata_endpoint() ), false );
diff --git a/includes/functions.php b/includes/functions.php
index 88a9f7d..1b63801 100644
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -577,15 +577,6 @@ function indieauth_verify_local_authorization_code( $args ) {
 	return $return;
 }
 
-function indieauth_get_authorization_endpoint() {
-	return IndieAuth_Plugin::$indieauth->get_authorization_endpoint();
-}
-
-
-function indieauth_get_token_endpoint() {
-	return IndieAuth_Plugin::$indieauth->get_token_endpoint();
-}
-
 function indieauth_get_metadata_endpoint() {
 	return IndieAuth_Plugin::$metadata->get_metadata_endpoint();
 }
diff --git a/indieauth.php b/indieauth.php
index 2fd4f3c..6dc6e68 100644
--- a/indieauth.php
+++ b/indieauth.php
@@ -120,13 +120,12 @@ public static function plugins_loaded() {
 			'class-indieauth-userinfo-endpoint.php', // User Info Endpoint
 			'class-token-list-table.php', // Token Management UI
 			'class-indieauth-token-ui.php',
-			'class-indieauth-local-authorize.php',
 		);
 
 		self::load( $localfiles );
 		new IndieAuth_Authorization_Endpoint();
 		new IndieAuth_Token_Endpoint();
-		static::$indieauth = new IndieAuth_Local_Authorize();
+		static::$indieauth = new IndieAuth_Authorize();
 		static::$metadata  = new IndieAuth_Metadata_Endpoint();
 		new IndieAuth_Revocation_Endpoint();
 		new IndieAuth_Introspection_Endpoint();
diff --git a/templates/indieauth-settings.php b/templates/indieauth-settings.php
index ed994ed..be4c1d1 100644
--- a/templates/indieauth-settings.php
+++ b/templates/indieauth-settings.php
@@ -17,22 +17,6 @@
 
 		<table class="form-table">
 			<tbody>
-
-				<tr>
-					<th>
-						<?php esc_html_e( 'Endpoints', 'indieauth' ); ?>
-					</th>
-					<td>
-						<p>
-							<?php esc_html_e( 'Authorization Endpoint:', 'indieauth' ); ?><br />
-							<code><?php echo esc_url( indieauth_get_authorization_endpoint() ); ?></code>
-						</p>
-						<p>
-							<?php esc_html_e( 'Token Endpoint:', 'indieauth' ); ?><br />
-							<code><?php echo esc_url( indieauth_get_token_endpoint() ); ?></code>
-						</p>
-					</td>
-				</tr>
 				<tr>
 					<th>
 						<?php esc_html_e( 'Set User to Represent Site URL', 'indieauth' ); ?>

From ab1550f8a261d25471d5be4e314b6f500e146e82 Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sat, 11 Nov 2023 14:41:44 +0000
Subject: [PATCH 06/20] Add filters to allow for custom actions and grant types
 for the token endpoint

---
 includes/class-indieauth-token-endpoint.php | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/includes/class-indieauth-token-endpoint.php b/includes/class-indieauth-token-endpoint.php
index cd6df99..f5fbc2d 100644
--- a/includes/class-indieauth-token-endpoint.php
+++ b/includes/class-indieauth-token-endpoint.php
@@ -130,6 +130,8 @@ public function post( $request ) {
 			return WP_OAuth_Response( 'invalid_request', __( 'Please choose either an action or a grant_type', 'indieauth' ) );
 		}
 
+		$resp = new WP_OAuth_Response( 'invalid_request', __( 'Invalid Request', 'indieauth' ), 400 );
+
 		// Action Handler
 		if ( isset( $params['action'] ) ) {
 			switch ( $params['action'] ) {
@@ -142,8 +144,11 @@ public function post( $request ) {
 						return new WP_OAuth_Response( 'invalid_request', __( 'Revoke is Missing Required Parameter token', 'indieauth' ), 400 );
 					}
 				default:
-					return new WP_OAuth_Response( 'unsupported_action', __( 'Unsupported Action', 'indieauth' ), 400 );
+					$resp = new WP_OAuth_Response( 'unsupported_action', __( 'Unsupported Action', 'indieauth' ), 400 );
 			}
+
+			// Allows for adding custom actions.
+			$resp = apply_filters( 'indieauth_token_action_handler', $resp, $params );
 		}
 
 		// Grant Type Handler.
@@ -155,12 +160,14 @@ public function post( $request ) {
 				case 'refresh_token':
 					return $this->refresh_token( $params );
 				default:
-					return new WP_OAuth_Response( 'unsupported_grant_type', __( 'Unsupported grant_type.', 'indieauth' ), 400 );
+					$resp = new WP_OAuth_Response( 'unsupported_grant_type', __( 'Unsupported grant_type.', 'indieauth' ), 400 );
 			}
+			// Allows for adding custom grant type handling.
+			$resp = apply_filters( 'indieauth_token_grant_type_handler', $resp, $params );
 		}
 
 		// Everything Failed
-		return new WP_OAuth_Response( 'invalid_request', __( 'Invalid Request', 'indieauth' ), 400 );
+		return $resp;
 	}
 
 

From ad4a5cba5b55965427cbd877292248a014233d54 Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sat, 11 Nov 2023 14:50:52 +0000
Subject: [PATCH 07/20] Move header adding to the endpoint that needs the
 header

---
 .../class-indieauth-authorization-endpoint.php   | 16 ++++++++++++++++
 includes/class-indieauth-token-endpoint.php      | 15 +++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/includes/class-indieauth-authorization-endpoint.php b/includes/class-indieauth-authorization-endpoint.php
index 29a1d28..76d909e 100644
--- a/includes/class-indieauth-authorization-endpoint.php
+++ b/includes/class-indieauth-authorization-endpoint.php
@@ -12,9 +12,25 @@ public function __construct() {
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
 		add_action( 'login_form_indieauth', array( $this, 'login_form_indieauth' ) );
 		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
+		
+		add_action( 'wp_head', array( $this, 'html_header' ) );
+		add_action( 'template_redirect', array( $this, 'http_header' ) );
+
 		$this->codes = new Token_User( '_indieauth_code_' );
 	}
 
+	public function http_header() {
+		if ( is_author() || is_front_page() ) {
+			$this->set_http_header( $this->get_endpoint(), 'authorization_endpoint' );
+		}
+	}
+
+	public function html_header() {
+		if ( is_author() || is_front_page() ) {
+			echo $this->get_html_header( $this->get_endpoint(), 'authorization_endpoint' );
+		}
+	}
+
 	public static function get_endpoint() {
 		return rest_url( '/indieauth/1.0/auth' );
 	}
diff --git a/includes/class-indieauth-token-endpoint.php b/includes/class-indieauth-token-endpoint.php
index f5fbc2d..f38277a 100644
--- a/includes/class-indieauth-token-endpoint.php
+++ b/includes/class-indieauth-token-endpoint.php
@@ -11,12 +11,27 @@ public function __construct() {
 		parent::__construct();
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
 		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
+
+		add_action( 'wp_head', array( $this, 'html_header' ) );
+		add_action( 'template_redirect', array( $this, 'http_header' ) );
 	}
 
 	public static function get_endpoint() {
 		return rest_url( '/indieauth/1.0/token' );
 	}
 
+	public function http_header() {
+		if ( is_author() || is_front_page() ) {
+			$this->set_http_header( $this->get_endpoint(), 'token_endpoint' );
+		}
+	}
+
+	public function html_header() {
+		if ( is_author() || is_front_page() ) {
+			echo $this->get_html_header( $this->get_endpoint(), 'token_endpoint' );
+		}
+	}
+
 	public static function get_grant_types() {
 		return array_unique( apply_filters( 'indieauth_grant_types_supported', array( 'authorization_code', 'refresh_token' ) ) );
 	}

From 049985f9642ab4e1582f8decc90f1223ece75005 Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sat, 11 Nov 2023 14:53:34 +0000
Subject: [PATCH 08/20] Standardize function for generating endpoint

---
 includes/class-indieauth-metadata-endpoint.php | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/includes/class-indieauth-metadata-endpoint.php b/includes/class-indieauth-metadata-endpoint.php
index 5116573..b3b5503 100644
--- a/includes/class-indieauth-metadata-endpoint.php
+++ b/includes/class-indieauth-metadata-endpoint.php
@@ -96,18 +96,12 @@ public function register_index( WP_REST_Response $response ) {
 
 	public function http_header() {
 		if ( is_author() || is_front_page() ) {
-			header( sprintf( 'Link: <%s>; rel="indieauth-metadata"', static::get_metadata_endpoint() ), false );
+			$this->set_http_header( static::get_metadata_endpoint(), 'indieauth-metadata' );
 		}
 	}
-	public static function html_header() {
-		$kses = array(
-			'link' => array(
-				'href' => array(),
-				'rel'  => array(),
-			),
-		);
+	public function html_header() {
 		if ( is_author() || is_front_page() ) {
-			echo wp_kses( sprintf( '<link rel="indieauth-metadata" href="%s" />' . PHP_EOL, static::get_metadata_endpoint() ), $kses );
+			echo $this->get_html_header( static::get_metadata_endpoint(), 'indieauth-metadata' );
 		}
 	}
 

From b194644e65a85fece8d5bd5979ca06c960f9add8 Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sat, 11 Nov 2023 15:01:24 +0000
Subject: [PATCH 09/20] Further standardize how headers are generated in
 endpoints

---
 .../class-indieauth-authorization-endpoint.php  | 17 ++++++++++++-----
 includes/class-indieauth-metadata-endpoint.php  |  9 ++++++++-
 includes/class-indieauth-ticket-endpoint.php    |  8 ++++----
 includes/class-indieauth-token-endpoint.php     | 11 +++++++++--
 4 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/includes/class-indieauth-authorization-endpoint.php b/includes/class-indieauth-authorization-endpoint.php
index 76d909e..a3ff590 100644
--- a/includes/class-indieauth-authorization-endpoint.php
+++ b/includes/class-indieauth-authorization-endpoint.php
@@ -7,12 +7,12 @@
 
 class IndieAuth_Authorization_Endpoint extends IndieAuth_Endpoint {
 	private $codes;
-	
+
 	public function __construct() {
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
 		add_action( 'login_form_indieauth', array( $this, 'login_form_indieauth' ) );
 		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
-		
+
 		add_action( 'wp_head', array( $this, 'html_header' ) );
 		add_action( 'template_redirect', array( $this, 'http_header' ) );
 
@@ -26,8 +26,15 @@ public function http_header() {
 	}
 
 	public function html_header() {
+		$kses = array(
+			'link' => array(
+				'href' => array(),
+				'rel'  => array(),
+			),
+		);
+
 		if ( is_author() || is_front_page() ) {
-			echo $this->get_html_header( $this->get_endpoint(), 'authorization_endpoint' );
+			echo wp_kses( $this->get_html_header( $this->get_endpoint(), 'authorization_endpoint' ), $kses );
 		}
 	}
 
@@ -40,8 +47,8 @@ public static function get_response_types() {
 	}
 
 	public function metadata( $metadata ) {
-		$metadata['authorization_endpoint'] = $this->get_endpoint();
-		$metadata['response_types_supported'] = $this->get_response_types();
+		$metadata['authorization_endpoint']                         = $this->get_endpoint();
+		$metadata['response_types_supported']                       = $this->get_response_types();
 		$metadata['authorization_response_iss_parameter_supported'] = true;
 		return $metadata;
 	}
diff --git a/includes/class-indieauth-metadata-endpoint.php b/includes/class-indieauth-metadata-endpoint.php
index b3b5503..0244884 100644
--- a/includes/class-indieauth-metadata-endpoint.php
+++ b/includes/class-indieauth-metadata-endpoint.php
@@ -100,8 +100,15 @@ public function http_header() {
 		}
 	}
 	public function html_header() {
+		$kses = array(
+			'link' => array(
+				'href' => array(),
+				'rel'  => array(),
+			),
+		);
+
 		if ( is_author() || is_front_page() ) {
-			echo $this->get_html_header( static::get_metadata_endpoint(), 'indieauth-metadata' );
+			echo wp_kses( $this->get_html_header( static::get_metadata_endpoint(), 'indieauth-metadata' ), $kses );
 		}
 	}
 
diff --git a/includes/class-indieauth-ticket-endpoint.php b/includes/class-indieauth-ticket-endpoint.php
index 6051eae..f1a2216 100644
--- a/includes/class-indieauth-ticket-endpoint.php
+++ b/includes/class-indieauth-ticket-endpoint.php
@@ -5,7 +5,7 @@
  * Implements IndieAuth Ticket Endpoint
  */
 
-class IndieAuth_Ticket_Endpoint {
+class IndieAuth_Ticket_Endpoint extends IndieAuth_Endpoint {
 	public function __construct() {
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
 		add_action( 'template_redirect', array( $this, 'http_header' ) );
@@ -29,16 +29,16 @@ public function metadata( $metadata ) {
 	}
 
 	public function http_header() {
-		header( sprintf( 'Link: <%s>; rel="ticket_endpoint"', static::get_endpoint() ), false );
+		$this->set_http_header( static::get_endpoint(), 'ticket_endpoint' );
 	}
-	public static function html_header() {
+	public function html_header() {
 		$kses = array(
 			'link' => array(
 				'href' => array(),
 				'rel'  => array(),
 			),
 		);
-			echo wp_kses( sprintf( '<link rel="ticket_endpoint" href="%s" />' . PHP_EOL, static::get_endpoint() ), $kses );
+		echo wp_kses( $this->get_html_header( static::get_endpoint(), 'ticket_endpoint' ), $kses );
 	}
 
 	/**
diff --git a/includes/class-indieauth-token-endpoint.php b/includes/class-indieauth-token-endpoint.php
index f38277a..6f8dfa1 100644
--- a/includes/class-indieauth-token-endpoint.php
+++ b/includes/class-indieauth-token-endpoint.php
@@ -27,8 +27,15 @@ public function http_header() {
 	}
 
 	public function html_header() {
+		$kses = array(
+			'link' => array(
+				'href' => array(),
+				'rel'  => array(),
+			),
+		);
+
 		if ( is_author() || is_front_page() ) {
-			echo $this->get_html_header( $this->get_endpoint(), 'token_endpoint' );
+			echo wp_kses( $this->get_html_header( $this->get_endpoint(), 'token_endpoint' ), $kses );
 		}
 	}
 
@@ -37,7 +44,7 @@ public static function get_grant_types() {
 	}
 
 	public function metadata( $metadata ) {
-		$metadata['token_endpoint'] = $this->get_endpoint();
+		$metadata['token_endpoint']        = $this->get_endpoint();
 		$metadata['grant_types_supported'] = $this->get_grant_types();
 		return $metadata;
 	}

From 88a978b04593d65025b492293d22a73761841183 Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sat, 11 Nov 2023 15:10:43 +0000
Subject: [PATCH 10/20] Allow each endpoint to register its rest index entry

---
 .../class-indieauth-authorization-endpoint.php   |  8 +++++++-
 .../class-indieauth-introspection-endpoint.php   |  8 +++++++-
 includes/class-indieauth-metadata-endpoint.php   | 16 ++++++----------
 includes/class-indieauth-revocation-endpoint.php |  9 ++++++++-
 includes/class-indieauth-token-endpoint.php      |  8 +++++++-
 includes/class-indieauth-userinfo-endpoint.php   |  8 +++++++-
 6 files changed, 42 insertions(+), 15 deletions(-)

diff --git a/includes/class-indieauth-authorization-endpoint.php b/includes/class-indieauth-authorization-endpoint.php
index a3ff590..8827252 100644
--- a/includes/class-indieauth-authorization-endpoint.php
+++ b/includes/class-indieauth-authorization-endpoint.php
@@ -11,7 +11,8 @@ class IndieAuth_Authorization_Endpoint extends IndieAuth_Endpoint {
 	public function __construct() {
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
 		add_action( 'login_form_indieauth', array( $this, 'login_form_indieauth' ) );
-		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
+		add_filter( 'indieauth_metadata', array( $this, 'metadata' ) );
+		add_filter( 'rest_index_indieauth_endpoints', array( $this, 'rest_index' ) );
 
 		add_action( 'wp_head', array( $this, 'html_header' ) );
 		add_action( 'template_redirect', array( $this, 'http_header' ) );
@@ -46,6 +47,11 @@ public static function get_response_types() {
 		return array_unique( apply_filters( 'indieauth_response_types_supported', array( 'code' ) ) );
 	}
 
+	public function rest_index( $index ) {
+		$index['authorization'] = $this->get_endpoint();
+		return $index;
+	}
+
 	public function metadata( $metadata ) {
 		$metadata['authorization_endpoint']                         = $this->get_endpoint();
 		$metadata['response_types_supported']                       = $this->get_response_types();
diff --git a/includes/class-indieauth-introspection-endpoint.php b/includes/class-indieauth-introspection-endpoint.php
index 7cb7d7c..fe5c905 100644
--- a/includes/class-indieauth-introspection-endpoint.php
+++ b/includes/class-indieauth-introspection-endpoint.php
@@ -7,7 +7,8 @@ class IndieAuth_Introspection_Endpoint extends IndieAuth_Endpoint {
 	public function __construct() {
 		parent::__construct();
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
-		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
+		add_filter( 'indieauth_metadata', array( $this, 'metadata' ) );
+		add_filter( 'rest_index_indieauth_endpoints', array( $this, 'rest_index' ) );
 	}
 
 	public static function get_endpoint() {
@@ -24,6 +25,11 @@ public function metadata( $metadata ) {
 		return $metadata;
 	}
 
+	public function rest_index( $index ) {
+		$index['introspection'] = $this->get_endpoint();
+		return $index;
+	}
+
 	/**
 	 * Register the Route.
 	 */
diff --git a/includes/class-indieauth-metadata-endpoint.php b/includes/class-indieauth-metadata-endpoint.php
index 0244884..ea188c1 100644
--- a/includes/class-indieauth-metadata-endpoint.php
+++ b/includes/class-indieauth-metadata-endpoint.php
@@ -15,7 +15,7 @@ public function __construct() {
 	/*
 	 * Returns the URL for the metadata endpoint.
 	 */
-	public static function get_metadata_endpoint() {
+	public static function get_endpoint() {
 		return rest_url( '/indieauth/1.0/metadata' );
 	}
 
@@ -61,7 +61,7 @@ public static function serve_request( $served, $result, $request, $server ) {
 		if ( '/indieauth/1.0' !== $request->get_route() ) {
 			return $served;
 		}
-		static::set_http_header( static::get_metadata_endpoint(), 'indieauth-metadata' );
+		static::set_http_header( static::get_endpoint(), 'indieauth-metadata' );
 
 		return $served;
 	}
@@ -76,18 +76,14 @@ public static function serve_request( $served, $result, $request, $server ) {
 	public function register_index( WP_REST_Response $response ) {
 		$data      = $response->get_data();
 		$endpoints = array(
-			'authorization' => indieauth_get_authorization_endpoint(),
-			'token'         => indieauth_get_token_endpoint(),
-			'metadata'      => indieauth_get_metadata_endpoint(),
-			'revocation'    => rest_url( 'indieauth/1.0/revocation' ),
-			'introspection' => rest_url( 'indieauth/1.0/introspection' ),
+			'metadata'      => $this->get_endpoint(),
 		);
 		$endpoints = array_filter( $endpoints );
 		if ( empty( $endpoints ) ) {
 			return $response;
 		}
 		$data['authentication']['indieauth'] = array(
-			'endpoints' => $endpoints,
+			'endpoints' => apply_filters( 'rest_index_indieauth_endpoints', $endpoints )
 		);
 		$response->set_data( $data );
 		return $response;
@@ -96,7 +92,7 @@ public function register_index( WP_REST_Response $response ) {
 
 	public function http_header() {
 		if ( is_author() || is_front_page() ) {
-			$this->set_http_header( static::get_metadata_endpoint(), 'indieauth-metadata' );
+			$this->set_http_header( static::get_endpoint(), 'indieauth-metadata' );
 		}
 	}
 	public function html_header() {
@@ -108,7 +104,7 @@ public function html_header() {
 		);
 
 		if ( is_author() || is_front_page() ) {
-			echo wp_kses( $this->get_html_header( static::get_metadata_endpoint(), 'indieauth-metadata' ), $kses );
+			echo wp_kses( $this->get_html_header( static::get_endpoint(), 'indieauth-metadata' ), $kses );
 		}
 	}
 
diff --git a/includes/class-indieauth-revocation-endpoint.php b/includes/class-indieauth-revocation-endpoint.php
index 0371225..21188a9 100644
--- a/includes/class-indieauth-revocation-endpoint.php
+++ b/includes/class-indieauth-revocation-endpoint.php
@@ -6,7 +6,8 @@ class IndieAuth_Revocation_Endpoint extends IndieAuth_Endpoint {
 	public function __construct() {
 		parent::__construct();
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
-		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
+		add_filter( 'indieauth_metadata', array( $this, 'metadata' ) );
+		add_filter( 'rest_index_indieauth_endpoints', array( $this, 'rest_index' ) );
 	}
 
 	public static function get_endpoint() {
@@ -23,6 +24,12 @@ public function metadata( $metadata ) {
 		return $metadata;
 	}
 
+
+	public function rest_index( $index ) {
+		$index['revocation'] = $this->get_endpoint();
+		return $index;
+	}
+
 	/**
 	 * Register the Route.
 	 */
diff --git a/includes/class-indieauth-token-endpoint.php b/includes/class-indieauth-token-endpoint.php
index 6f8dfa1..d42e3c4 100644
--- a/includes/class-indieauth-token-endpoint.php
+++ b/includes/class-indieauth-token-endpoint.php
@@ -10,7 +10,8 @@ class IndieAuth_Token_Endpoint extends IndieAuth_Endpoint {
 	public function __construct() {
 		parent::__construct();
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
-		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
+		add_filter( 'indieauth_metadata', array( $this, 'metadata' ) );
+		add_filter( 'rest_index_indieauth_endpoints', array( $this, 'rest_index' ) );
 
 		add_action( 'wp_head', array( $this, 'html_header' ) );
 		add_action( 'template_redirect', array( $this, 'http_header' ) );
@@ -39,6 +40,11 @@ public function html_header() {
 		}
 	}
 
+	public function rest_index( $index ) {
+		$index['token'] = $this->get_endpoint();
+		return $index;
+	}
+
 	public static function get_grant_types() {
 		return array_unique( apply_filters( 'indieauth_grant_types_supported', array( 'authorization_code', 'refresh_token' ) ) );
 	}
diff --git a/includes/class-indieauth-userinfo-endpoint.php b/includes/class-indieauth-userinfo-endpoint.php
index a3e84cb..cac0c65 100644
--- a/includes/class-indieauth-userinfo-endpoint.php
+++ b/includes/class-indieauth-userinfo-endpoint.php
@@ -7,7 +7,8 @@ class IndieAuth_Userinfo_Endpoint extends IndieAuth_Endpoint {
 	public function __construct() {
 		parent::__construct();
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
-		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
+		add_filter( 'indieauth_metadata', array( $this, 'metadata' ) );
+		add_filter( 'rest_index_indieauth_endpoints', array( $this, 'rest_index' ) );
 	}
 
 
@@ -20,6 +21,11 @@ public function metadata( $metadata ) {
 		return $metadata;
 	}
 
+	public function rest_index( $index ) {
+		$index['userinfo'] = $this->get_endpoint();
+		return $index;
+	}
+
 	/**
 	 * Register the Route.
 	 */

From ed51231f5d1c663ee886f944c77defb0db2ac9bd Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sat, 11 Nov 2023 15:28:17 +0000
Subject: [PATCH 11/20] ticket grant type is not supported yet

---
 includes/class-indieauth-ticket-endpoint.php | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/includes/class-indieauth-ticket-endpoint.php b/includes/class-indieauth-ticket-endpoint.php
index f1a2216..282a8d2 100644
--- a/includes/class-indieauth-ticket-endpoint.php
+++ b/includes/class-indieauth-ticket-endpoint.php
@@ -11,12 +11,6 @@ public function __construct() {
 		add_action( 'template_redirect', array( $this, 'http_header' ) );
 		add_action( 'wp_head', array( $this, 'html_header' ) );
 		add_action( 'indieauth_metadata', array( $this, 'metadata' ) );
-		add_filter( 'indieauth_grant_types_supported', array( $this, 'grant_types' ) );
-	}
-
-	public static function grant_types( $grants ) {
-		$grants[] = 'ticket';
-		return $grants;
 	}
 
 	public static function get_endpoint() {

From 24577958be98c2a87153401fd5bd4596a960157e Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sat, 11 Nov 2023 17:18:47 +0000
Subject: [PATCH 12/20] Expand serving of metadata header to all endpoints
 under the indieauth route.

---
 .../class-indieauth-metadata-endpoint.php     |  2 +-
 indieauth.php                                 |  6 ++---
 readme.md                                     | 23 +++++++++++++------
 readme.txt                                    | 23 +++++++++++++------
 4 files changed, 36 insertions(+), 18 deletions(-)

diff --git a/includes/class-indieauth-metadata-endpoint.php b/includes/class-indieauth-metadata-endpoint.php
index ea188c1..9e424a7 100644
--- a/includes/class-indieauth-metadata-endpoint.php
+++ b/includes/class-indieauth-metadata-endpoint.php
@@ -58,7 +58,7 @@ public static function get_html_header( $url, $rel ) {
 	 * @return true
 	 */
 	public static function serve_request( $served, $result, $request, $server ) {
-		if ( '/indieauth/1.0' !== $request->get_route() ) {
+		if ( ! str_contains( $request->get_route(), '/indieauth/1.0' ) ) {
 			return $served;
 		}
 		static::set_http_header( static::get_endpoint(), 'indieauth-metadata' );
diff --git a/indieauth.php b/indieauth.php
index 6dc6e68..59d0d5a 100644
--- a/indieauth.php
+++ b/indieauth.php
@@ -3,7 +3,7 @@
  * Plugin Name: IndieAuth
  * Plugin URI: https://github.com/indieweb/wordpress-indieauth/
  * Description: IndieAuth is a way to allow users to use their own domain to sign into other websites and services
- * Version: 4.3.0
+ * Version: 4.4.0
  * Author: IndieWebCamp WordPress Outreach Club
  * Author URI: https://indieweb.org/WordPress_Outreach_Club
  * License: MIT
@@ -123,10 +123,10 @@ public static function plugins_loaded() {
 		);
 
 		self::load( $localfiles );
-		new IndieAuth_Authorization_Endpoint();
-		new IndieAuth_Token_Endpoint();
 		static::$indieauth = new IndieAuth_Authorize();
 		static::$metadata  = new IndieAuth_Metadata_Endpoint();
+		new IndieAuth_Authorization_Endpoint();
+		new IndieAuth_Token_Endpoint();
 		new IndieAuth_Revocation_Endpoint();
 		new IndieAuth_Introspection_Endpoint();
 		new IndieAuth_Userinfo_Endpoint();
diff --git a/readme.md b/readme.md
index 3ebb5da..dd6d6f9 100644
--- a/readme.md
+++ b/readme.md
@@ -3,8 +3,8 @@
 **Tags:** IndieAuth, IndieWeb, IndieWebCamp, login  
 **Requires at least:** 4.9.9  
 **Requires PHP:** 5.6  
-**Tested up to:** 6.3  
-**Stable tag:** 4.3.0  
+**Tested up to:** 6.4  
+**Stable tag:** 4.4.0  
 **License:** MIT  
 **License URI:** http://opensource.org/licenses/MIT  
 **Donate link:** https://opencollective.com/indieweb  
@@ -43,7 +43,7 @@ You can read the [specification](https://indieauth.spec.indieweb.org/) for imple
 
 The goals of OpenID and Web Sign In are similar. Both encourage you to sign in to a website using your own domain name. However, OpenID has failed to gain wide adoption. Web sign-in prompts a user to enter a URL to sign on. Upon submission, it tries to discover the URL's authorization endpoint, and authenticate to that. If none is found, it falls back on other options.
 
-This plugin only supports searching an external site for an authorization endpoint, allowing you to log into one site with the credentials of another site. This functionality may be split off in future into its own plugin.
+This plugin only supports searching an external site for an authorization endpoint, allowing you to log into one site with the credentials of another site if that site is listed as the website URL in your user profile.
 
 ### What is IndieAuth.com? ###
 
@@ -70,9 +70,9 @@ We recommend your site uses HTTPS to ensure your credentials are not sent in cle
 
 ### What is a token endpoint? ###
 
-Once you have proven your identity, the token endpoint issues a token, which applications can use to authenticate as you to your site. The plugin does offer an expert mode to allow you to use an external token endpoint if you want, but by having it built into your WordPress site, it is under your control.
+Once you have proven your identity, the token endpoint issues a token, which applications can use to authenticate as you to your site.
 
-You can manage and revoke tokens under User->Manage Tokens if you are using the local configuration only. You will only see tokens for the currently logged in user.
+You can manage and revoke tokens under User->Manage Tokens. You will only see tokens for the currently logged in user.
 
 ### How do I incorporate this into my plugin? ###
 
@@ -128,9 +128,9 @@ If that doesn't work either, you may need to ask your hosting provider to whitel
 
 Some hosting providers filter this out using mod_security. For one user, they needed [Rule 340162](https://wiki.atomicorp.com/wiki/index.php/WAF_340162) whitelisted as it detects the use of a URL as an argument.
 
-### What is Ticket Auth and how do I enable it? ###
+### What is the Ticketing extension and how do I enable it? ###
 
-[Ticket Auth](https://indieweb.org/IndieAuth_Ticket_Auth) is a developing extension to OAuth2/IndieAuth. It creates a ticket endpoint on your site where other sites can send you a ticket, which can be redeemed
+[Ticketing for IndieAuth](https://indieweb.org/Ticketing_for_IndieAuth) is a developing extension to OAuth2/IndieAuth. It creates a ticket endpoint on your site where other sites can send you a ticket, which can be redeemed
 for a token to access private resources on that other site. You can enable the experimental endpoint functionality by adding the below to your wp-config.php. If this becomes more established, it will be added
 in the settings page.
 
@@ -143,6 +143,10 @@ Since the extension is developing, there is currently not a specified way to tra
 
 ## Upgrade Notice ##
 
+### 4.4.0 ###
+
+4.4.0 removes the remote endpoint functionality, which will be archived as a separate plugin in future. It was already disabled by default.
+
 ### 4.3.0 ###
 
 4.3.0 changes the storage of client application data from being embedded in every token to being stored in a hidden taxonomy. Older tokens will not be automatically updated. It also sideloads the application icon
@@ -181,6 +185,11 @@ In version 2.0, we added an IndieAuth endpoint to this plugin, which previously
 
 Project and support maintained on github at [indieweb/wordpress-indieauth](https://github.com/indieweb/wordpress-indieauth).
 
+### 4.4.0 ###
+* Remove remote endpoint functionality already disabled
+* Rearrange so each endpoint is more independent and registers its own parameters
+* Add way to register new grant types.
+
 ### 4.3.0 ###
 
 * Introduce Client Taxonomy to store client data so it is not stored individually
diff --git a/readme.txt b/readme.txt
index 397a56a..57d42ce 100644
--- a/readme.txt
+++ b/readme.txt
@@ -3,8 +3,8 @@ Contributors: indieweb, pfefferle, dshanske
 Tags: IndieAuth, IndieWeb, IndieWebCamp, login
 Requires at least: 4.9.9
 Requires PHP: 5.6
-Tested up to: 6.3
-Stable tag: 4.3.0
+Tested up to: 6.4
+Stable tag: 4.4.0
 License: MIT
 License URI: http://opensource.org/licenses/MIT
 Donate link: https://opencollective.com/indieweb
@@ -43,7 +43,7 @@ You can read the [specification](https://indieauth.spec.indieweb.org/) for imple
 
 The goals of OpenID and Web Sign In are similar. Both encourage you to sign in to a website using your own domain name. However, OpenID has failed to gain wide adoption. Web sign-in prompts a user to enter a URL to sign on. Upon submission, it tries to discover the URL's authorization endpoint, and authenticate to that. If none is found, it falls back on other options.
 
-This plugin only supports searching an external site for an authorization endpoint, allowing you to log into one site with the credentials of another site. This functionality may be split off in future into its own plugin.
+This plugin only supports searching an external site for an authorization endpoint, allowing you to log into one site with the credentials of another site if that site is listed as the website URL in your user profile.
 
 = What is IndieAuth.com? =
 
@@ -70,9 +70,9 @@ We recommend your site uses HTTPS to ensure your credentials are not sent in cle
 
 = What is a token endpoint? =
 
-Once you have proven your identity, the token endpoint issues a token, which applications can use to authenticate as you to your site. The plugin does offer an expert mode to allow you to use an external token endpoint if you want, but by having it built into your WordPress site, it is under your control.
+Once you have proven your identity, the token endpoint issues a token, which applications can use to authenticate as you to your site.
 
-You can manage and revoke tokens under User->Manage Tokens if you are using the local configuration only. You will only see tokens for the currently logged in user.
+You can manage and revoke tokens under User->Manage Tokens. You will only see tokens for the currently logged in user.
 
 = How do I incorporate this into my plugin? =
 
@@ -128,9 +128,9 @@ If that doesn't work either, you may need to ask your hosting provider to whitel
 
 Some hosting providers filter this out using mod_security. For one user, they needed [Rule 340162](https://wiki.atomicorp.com/wiki/index.php/WAF_340162) whitelisted as it detects the use of a URL as an argument.
 
-= What is Ticket Auth and how do I enable it? =
+= What is the Ticketing extension and how do I enable it? =
 
-[Ticket Auth](https://indieweb.org/IndieAuth_Ticket_Auth) is a developing extension to OAuth2/IndieAuth. It creates a ticket endpoint on your site where other sites can send you a ticket, which can be redeemed
+[Ticketing for IndieAuth](https://indieweb.org/Ticketing_for_IndieAuth) is a developing extension to OAuth2/IndieAuth. It creates a ticket endpoint on your site where other sites can send you a ticket, which can be redeemed
 for a token to access private resources on that other site. You can enable the experimental endpoint functionality by adding the below to your wp-config.php. If this becomes more established, it will be added
 in the settings page.
 
@@ -143,6 +143,10 @@ Since the extension is developing, there is currently not a specified way to tra
 
 == Upgrade Notice ==
 
+= 4.4.0 =
+
+4.4.0 removes the remote endpoint functionality, which will be archived as a separate plugin in future. It was already disabled by default.
+
 = 4.3.0 =
 
 4.3.0 changes the storage of client application data from being embedded in every token to being stored in a hidden taxonomy. Older tokens will not be automatically updated. It also sideloads the application icon
@@ -181,6 +185,11 @@ In version 2.0, we added an IndieAuth endpoint to this plugin, which previously
 
 Project and support maintained on github at [indieweb/wordpress-indieauth](https://github.com/indieweb/wordpress-indieauth).
 
+= 4.4.0 =
+* Remove remote endpoint functionality already disabled
+* Rearrange so each endpoint is more independent and registers its own parameters
+* Add way to register new grant types.
+
 = 4.3.0 =
 
 * Introduce Client Taxonomy to store client data so it is not stored individually

From ad57c91dde5469bf80a05fa0ae52c7eec80db7ad Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sat, 11 Nov 2023 17:21:02 +0000
Subject: [PATCH 13/20] Have metadata global functions call class functions

---
 includes/functions.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/functions.php b/includes/functions.php
index 1b63801..054531c 100644
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -578,9 +578,9 @@ function indieauth_verify_local_authorization_code( $args ) {
 }
 
 function indieauth_get_metadata_endpoint() {
-	return IndieAuth_Plugin::$metadata->get_metadata_endpoint();
+	return IndieAuth_Plugin::$metadata->get_endpoint();
 }
 
 function indieauth_get_issuer() {
-	return rest_url( '/indieauth/1.0' );
+	return IndieAuth_Plugin::$metadata->get_issuer();
 }

From c477f4e332daa18993644293f7332368e3778e16 Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sat, 11 Nov 2023 17:26:28 +0000
Subject: [PATCH 14/20] Move function only used by token endpoint out of global
 scope.

---
 includes/class-indieauth-token-endpoint.php | 26 ++++++++++++++++++++-
 includes/functions.php                      | 23 ------------------
 2 files changed, 25 insertions(+), 24 deletions(-)

diff --git a/includes/class-indieauth-token-endpoint.php b/includes/class-indieauth-token-endpoint.php
index d42e3c4..2f61698 100644
--- a/includes/class-indieauth-token-endpoint.php
+++ b/includes/class-indieauth-token-endpoint.php
@@ -231,7 +231,7 @@ public function authorization_code( $params ) {
 				'code_verifier' => isset( $params['code_verifier'] ) ? $params['code_verifier'] : null,
 			)
 		);
-		$response = indieauth_verify_local_authorization_code( $args );
+		$response = $this->verify_local_authorization_code( $args );
 
 		$error = get_oauth_error( $response );
 		if ( $error ) {
@@ -322,4 +322,28 @@ public function generate_token_response( $response ) {
 		}
 		return new WP_OAuth_Response( 'server_error', __( 'There was an error in response.', 'indieauth' ), 500 );
 	}
+
+	public function verify_local_authorization_code( $args ) {
+		$codes = new Token_User( '_indieauth_code_' );
+		$return = $codes->get( $args['code'] );
+		if ( ! $return ) {
+			return new WP_OAuth_Response( 'invalid_code', __( 'Invalid authorization code', 'indieauth' ), 401 );
+		}
+		if ( isset( $return['code_challenge'] ) ) {
+			if ( ! isset( $args['code_verifier'] ) ) {
+				$tokens->destroy( $post_args['code'] );
+				return new WP_OAuth_Response( 'invalid_grant', __( 'Failed PKCE Validation', 'indieauth' ), 400 );
+			}
+			if ( ! pkce_verifier( $return['code_challenge'], $args['code_verifier'], $return['code_challenge_method'] ) ) {
+				$tokens->destroy( $args['code'] );
+				return new WP_OAuth_Response( 'invalid_grant', __( 'Failed PKCE Validation', 'indieauth' ), 400 );
+			}
+			unset( $return['code_challenge'] );
+			unset( $return['code_challenge_method'] );
+		}
+
+		$codes->destroy( $args['code'] );
+		return $return;
+	}
+
 }
diff --git a/includes/functions.php b/includes/functions.php
index 054531c..154e565 100644
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -554,29 +554,6 @@ function indieauth_get_root_user() {
 	return $single;
 }
 
-function indieauth_verify_local_authorization_code( $args ) {
-	$tokens = new Token_User( '_indieauth_code_' );
-	$return = $tokens->get( $args['code'] );
-	if ( ! $return ) {
-		return new WP_OAuth_Response( 'invalid_code', __( 'Invalid authorization code', 'indieauth' ), 401 );
-	}
-	if ( isset( $return['code_challenge'] ) ) {
-		if ( ! isset( $args['code_verifier'] ) ) {
-			$tokens->destroy( $post_args['code'] );
-			return new WP_OAuth_Response( 'invalid_grant', __( 'Failed PKCE Validation', 'indieauth' ), 400 );
-		}
-		if ( ! pkce_verifier( $return['code_challenge'], $args['code_verifier'], $return['code_challenge_method'] ) ) {
-			$tokens->destroy( $args['code'] );
-			return new WP_OAuth_Response( 'invalid_grant', __( 'Failed PKCE Validation', 'indieauth' ), 400 );
-		}
-		unset( $return['code_challenge'] );
-		unset( $return['code_challenge_method'] );
-	}
-
-	$tokens->destroy( $args['code'] );
-	return $return;
-}
-
 function indieauth_get_metadata_endpoint() {
 	return IndieAuth_Plugin::$metadata->get_endpoint();
 }

From 992568017d5812942a0f7aa1f2ea18a304a65787 Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sat, 11 Nov 2023 17:31:18 +0000
Subject: [PATCH 15/20] PHPCS Fixes

---
 includes/class-indieauth-endpoint.php         |  4 +--
 ...class-indieauth-introspection-endpoint.php |  2 +-
 .../class-indieauth-metadata-endpoint.php     | 26 +++++++++----------
 .../class-indieauth-revocation-endpoint.php   |  2 +-
 includes/class-indieauth-token-endpoint.php   |  2 +-
 5 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/includes/class-indieauth-endpoint.php b/includes/class-indieauth-endpoint.php
index e38868c..f102e3f 100644
--- a/includes/class-indieauth-endpoint.php
+++ b/includes/class-indieauth-endpoint.php
@@ -15,7 +15,7 @@ public function __construct() {
 
 	/*
 	 * Outputs a marked up Http link header.
-	 * 
+	 *
 	 * @param string $url URL for the link
 	 * @param string $rel Rel property for the link
 	 * @param boolean $replace Passes the value of replace through to the header PHP
@@ -26,7 +26,7 @@ public static function set_http_header( $url, $rel, $replace = false ) {
 
 	/*
 	 * Returns a marked up HTML link header.
-	 * 
+	 *
 	 * @param string $url URL for the link
 	 * @param string $rel Rel property for the link
 	 * @return string Marked up HTML link to add to head
diff --git a/includes/class-indieauth-introspection-endpoint.php b/includes/class-indieauth-introspection-endpoint.php
index fe5c905..8aaed31 100644
--- a/includes/class-indieauth-introspection-endpoint.php
+++ b/includes/class-indieauth-introspection-endpoint.php
@@ -20,7 +20,7 @@ public function auth_methods_supported() {
 	}
 
 	public function metadata( $metadata ) {
-		$metadata['introspection_endpoint'] = $this->get_endpoint();
+		$metadata['introspection_endpoint']               = $this->get_endpoint();
 		$metadata['introspection_auth_methods_supported'] = $this->auth_methods_supported();
 		return $metadata;
 	}
diff --git a/includes/class-indieauth-metadata-endpoint.php b/includes/class-indieauth-metadata-endpoint.php
index 9e424a7..ef3557a 100644
--- a/includes/class-indieauth-metadata-endpoint.php
+++ b/includes/class-indieauth-metadata-endpoint.php
@@ -27,7 +27,7 @@ public static function get_issuer() {
 
 	/*
 	 * Outputs a marked up Http link header.
-	 * 
+	 *
 	 * @param string $url URL for the link
 	 * @param string $rel Rel property for the link
 	 * @param boolean $replace Passes the value of replace through to the header PHP
@@ -38,7 +38,7 @@ public static function set_http_header( $url, $rel, $replace = false ) {
 
 	/*
 	 * Returns a marked up HTML link header.
-	 * 
+	 *
 	 * @param string $url URL for the link
 	 * @param string $rel Rel property for the link
 	 * @return string Marked up HTML link to add to head
@@ -49,11 +49,11 @@ public static function get_html_header( $url, $rel ) {
 
 	/**
 	 * Hooks into the REST API output to add a metadata header to the Issuer URL.
- 	 *
- 	 * @param bool                      $served  Whether the request has already been served.
- 	 * @param WP_HTTP_ResponseInterface $result  Result to send to the client. Usually a WP_REST_Response.
- 	 * @param WP_REST_Request           $request Request used to generate the response.
- 	 * @param WP_REST_Server            $server  Server instance.
+	 *
+	 * @param bool                      $served  Whether the request has already been served.
+	 * @param WP_HTTP_ResponseInterface $result  Result to send to the client. Usually a WP_REST_Response.
+	 * @param WP_REST_Request           $request Request used to generate the response.
+	 * @param WP_REST_Server            $server  Server instance.
 	 *
 	 * @return true
 	 */
@@ -76,14 +76,14 @@ public static function serve_request( $served, $result, $request, $server ) {
 	public function register_index( WP_REST_Response $response ) {
 		$data      = $response->get_data();
 		$endpoints = array(
-			'metadata'      => $this->get_endpoint(),
+			'metadata' => $this->get_endpoint(),
 		);
 		$endpoints = array_filter( $endpoints );
 		if ( empty( $endpoints ) ) {
 			return $response;
 		}
 		$data['authentication']['indieauth'] = array(
-			'endpoints' => apply_filters( 'rest_index_indieauth_endpoints', $endpoints )
+			'endpoints' => apply_filters( 'rest_index_indieauth_endpoints', $endpoints ),
 		);
 		$response->set_data( $data );
 		return $response;
@@ -134,10 +134,10 @@ public function register_routes() {
 	 **/
 	public function metadata( $request ) {
 		$metadata = array(
-			'issuer'                                     => indieauth_get_issuer(),
-			'scopes_supported'                           => IndieAuth_Plugin::$scopes->get_names(),
-			'service_documentation'                      => 'https://indieauth.spec.indieweb.org',
-			'code_challenge_methods_supported'           => array( 'S256' ),
+			'issuer'                           => indieauth_get_issuer(),
+			'scopes_supported'                 => IndieAuth_Plugin::$scopes->get_names(),
+			'service_documentation'            => 'https://indieauth.spec.indieweb.org',
+			'code_challenge_methods_supported' => array( 'S256' ),
 		);
 
 		$metadata = apply_filters( 'indieauth_metadata', $metadata );
diff --git a/includes/class-indieauth-revocation-endpoint.php b/includes/class-indieauth-revocation-endpoint.php
index 21188a9..2fe4ab7 100644
--- a/includes/class-indieauth-revocation-endpoint.php
+++ b/includes/class-indieauth-revocation-endpoint.php
@@ -19,7 +19,7 @@ public function auth_methods_supported() {
 	}
 
 	public function metadata( $metadata ) {
-		$metadata['revocation_endpoint'] = $this->get_endpoint();
+		$metadata['revocation_endpoint']               = $this->get_endpoint();
 		$metadata['revocation_auth_methods_supported'] = $this->auth_methods_supported();
 		return $metadata;
 	}
diff --git a/includes/class-indieauth-token-endpoint.php b/includes/class-indieauth-token-endpoint.php
index 2f61698..90e85fa 100644
--- a/includes/class-indieauth-token-endpoint.php
+++ b/includes/class-indieauth-token-endpoint.php
@@ -324,7 +324,7 @@ public function generate_token_response( $response ) {
 	}
 
 	public function verify_local_authorization_code( $args ) {
-		$codes = new Token_User( '_indieauth_code_' );
+		$codes  = new Token_User( '_indieauth_code_' );
 		$return = $codes->get( $args['code'] );
 		if ( ! $return ) {
 			return new WP_OAuth_Response( 'invalid_code', __( 'Invalid authorization code', 'indieauth' ), 401 );

From eb7eb83451e2d8f5b05c050967606b4b24f142df Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sat, 11 Nov 2023 17:42:09 +0000
Subject: [PATCH 16/20] Forgot to load the combined class

---
 includes/class-indieauth-authorize.php | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/includes/class-indieauth-authorize.php b/includes/class-indieauth-authorize.php
index 0b038e4..b66732b 100644
--- a/includes/class-indieauth-authorize.php
+++ b/includes/class-indieauth-authorize.php
@@ -8,6 +8,15 @@ class IndieAuth_Authorize {
 	public $scopes   = array();
 	public $response = array();
 
+
+	public function __construct( $load = true ) {
+		// Load the hooks for this class only if true. This allows for debugging of the functions
+		if ( true === $load ) {
+			add_action( 'admin_init', array( get_called_class(), 'admin_init' ) );
+			$this->load();
+		}
+	}
+
 	public function load() {
 		// do not call in CLI environment
 		if ( defined( 'WP_CLI' ) ) {

From 8818b769c524665fd1f72fd30dc63aac40e17cdf Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sat, 11 Nov 2023 17:46:09 +0000
Subject: [PATCH 17/20] Fix reference to old class

---
 tests/test-authorize.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/test-authorize.php b/tests/test-authorize.php
index 2235ff4..24fcf48 100644
--- a/tests/test-authorize.php
+++ b/tests/test-authorize.php
@@ -59,7 +59,7 @@ public function test_authorize_bearer() {
 		$token = self::set_token();
 		$_REQUEST['micropub']       = 'endpoint';
 		$_SERVER['HTTP_AUTHORIZATION'] = 'Bearer ' . $token;
-		$authorize = new Indieauth_Local_Authorize();
+		$authorize = new Indieauth_Authorize();
 		$authorize->load();
 		$user_id = apply_filters( 'determine_current_user', false );
 		$this->assertEquals( $user_id, self::$author_id );

From 2552ca9e8898553fd236e76c56652a0d11b3e5f5 Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sat, 11 Nov 2023 17:48:12 +0000
Subject: [PATCH 18/20] Additional references

---
 tests/test-authorize.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/test-authorize.php b/tests/test-authorize.php
index 24fcf48..b145574 100644
--- a/tests/test-authorize.php
+++ b/tests/test-authorize.php
@@ -50,7 +50,7 @@ public function test_authorize() {
 		$token = self::set_token();
 		$_REQUEST['micropub']       = 'endpoint';
 		$_POST['access_token'] = $token;
-		$authorize = new Indieauth_Local_Authorize();
+		$authorize = new Indieauth_Authorize();
 		$user_id = $authorize->determine_current_user( false );
 		$this->assertEquals( $user_id, self::$author_id );
 	}
@@ -76,7 +76,7 @@ public function test_authorize_bearer_other_non_matching_provider() {
 		} );
 		$_REQUEST['micropub']       = 'endpoint';
 		$_SERVER['HTTP_AUTHORIZATION'] = 'Bearer ' . $token;
-		$authorize = new Indieauth_Local_Authorize();
+		$authorize = new Indieauth_Authorize();
 		$authorize->load();
 		$user_id = apply_filters( 'determine_current_user', false );
 		$this->assertEquals( $user_id, self::$author_id );
@@ -92,7 +92,7 @@ public function test_authorize_bearer_other_provider() {
 		} );
 		$_REQUEST['micropub']       = 'endpoint';
 		$_SERVER['HTTP_AUTHORIZATION'] = 'Bearer other-valid-token';
-		$authorize = new Indieauth_Local_Authorize();
+		$authorize = new Indieauth_Authorize();
 		$authorize->load();
 		$user_id = apply_filters( 'determine_current_user', false );
 		$this->assertEquals( $user_id, self::$author_id );
@@ -108,7 +108,7 @@ public function test_authorize_bearer_no_valid_token_other_provider() {
 		} );
 		$_REQUEST['micropub']       = 'endpoint';
 		$_SERVER['HTTP_AUTHORIZATION'] = 'Bearer other-invalid-token';
-		$authorize = new Indieauth_Local_Authorize();
+		$authorize = new Indieauth_Authorize();
 		$authorize->load();
 		$user_id = apply_filters( 'determine_current_user', false );
 		$this->assertFalse( $user_id );

From e160793a3aef014c7051f47811c99fe9d306cf83 Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sat, 11 Nov 2023 17:49:45 +0000
Subject: [PATCH 19/20] Remove extra line break

---
 includes/class-indieauth-token-endpoint.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/includes/class-indieauth-token-endpoint.php b/includes/class-indieauth-token-endpoint.php
index 90e85fa..9d26bb9 100644
--- a/includes/class-indieauth-token-endpoint.php
+++ b/includes/class-indieauth-token-endpoint.php
@@ -345,5 +345,4 @@ public function verify_local_authorization_code( $args ) {
 		$codes->destroy( $args['code'] );
 		return $return;
 	}
-
 }

From 7a7aef5b9646f868e689b2a2d9f878e153a9a712 Mon Sep 17 00:00:00 2001
From: David Shanske <david@shanske.com>
Date: Sun, 12 Nov 2023 03:49:36 +0000
Subject: [PATCH 20/20] Remove load that is no longer needed.

---
 includes/class-indieauth-authorize.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/includes/class-indieauth-authorize.php b/includes/class-indieauth-authorize.php
index b66732b..1dfc5bd 100644
--- a/includes/class-indieauth-authorize.php
+++ b/includes/class-indieauth-authorize.php
@@ -12,7 +12,6 @@ class IndieAuth_Authorize {
 	public function __construct( $load = true ) {
 		// Load the hooks for this class only if true. This allows for debugging of the functions
 		if ( true === $load ) {
-			add_action( 'admin_init', array( get_called_class(), 'admin_init' ) );
 			$this->load();
 		}
 	}