Mastodon clients can sign in: OAuth with a persona per token

OpenIddict 7.7 (MongoDB stores, keys kept in Mongo so tokens survive
restarts) serves /oauth/authorize, /oauth/token, /oauth/revoke and the
discovery documents, including /.well-known/oauth-authorization-server:
- authorization code (PKCE optional) and client credentials, Mastodon's
  scopes including the granular ones, non-expiring reference tokens,
  `created_at` in the token response, and the urn:ietf:wg:oauth:2.0:oob
  page that shows the code;
- /oauth/login signs the private login into a fifteen-minute cookie that
  only /oauth sees (rate limited, antiforgery-protected); /oauth/authorize
  then asks which persona the application acts as. The token's subject
  is that persona's id and nothing else; no root id reaches a token, an
  authorization or a log line;
- the token exchange refuses a persona whose login is banned or deleted,
  and every API request checks the same.

/api/v1/apps registers applications dynamically, /api/v1/apps/
verify_credentials, /api/v1/instance (v1 and v2, "4.2.0 (compatible;
PrivaPub)") and verify_credentials answer in Mastodon's shapes: snake_case
with explicit nulls, Rails-style parameters from query, form or JSON,
{"error": ...} on failure, Link paging. CORS exposes Link.

/api goes to OpenIddict validation and everything else to the existing
JWT; the JWT failure handler no longer sends the exception and stack trace
to the client.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Api/Mastodon/Auth/TokenController.cs

@@ -0,0 +1,70 @@
+using Microsoft.AspNetCore;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.IdentityModel.Tokens;
+
+using OpenIddict.Abstractions;
+using OpenIddict.Server.AspNetCore;
+
+using PrivaPub.StaticServices;
+
+using System.Security.Claims;
+
+using static OpenIddict.Abstractions.OpenIddictConstants;
+
+namespace PrivaPub.Api.Mastodon.Auth
+{
+	[ApiController]
+	public class TokenController : ControllerBase
+	{
+		readonly DbEntities _dbEntities;
+
+		public TokenController(DbEntities dbEntities)
+		{
+			_dbEntities = dbEntities;
+		}
+
+		[HttpPost("/oauth/token"), IgnoreAntiforgeryToken, Produces("application/json")]
+		public async Task<IActionResult> Exchange(CancellationToken token)
+		{
+			var request = HttpContext.GetOpenIddictServerRequest();
+			if (request == default)
+				return BadRequest();
+
+			if (request.IsAuthorizationCodeGrantType())
+			{
+				var principal = (await HttpContext.AuthenticateAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)).Principal;
+				if (principal == default || !await Usable(principal.GetClaim(Claims.Subject), token))
+					return Refuse(Errors.InvalidGrant, "The persona can no longer be used.");
+				return SignIn(principal, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
+			}
+
+			if (request.IsClientCredentialsGrantType())
+			{
+				var identity = new ClaimsIdentity(TokenValidationParameters.DefaultAuthenticationType, Claims.Name, Claims.Role);
+				identity.SetClaim(Claims.Subject, "app:" + request.ClientId);
+				identity.SetScopes(MastodonScopes.Parse(request.Scope));
+				identity.SetDestinations(_ => new[] { Destinations.AccessToken });
+				return SignIn(new ClaimsPrincipal(identity), OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
+			}
+
+			return Refuse(Errors.UnsupportedGrantType, "The grant type is not supported.");
+		}
+
+		async Task<bool> Usable(string avatarId, CancellationToken token)
+		{
+			if (string.IsNullOrEmpty(avatarId))
+				return false;
+			var link = await _dbEntities.RootToAvatars.Match(r => r.AvatarId == avatarId).ExecuteFirstAsync(token);
+			var root = link == default ? default : await _dbEntities.RootUsers.MatchID(link.RootId).ExecuteFirstAsync(token);
+			var avatar = await _dbEntities.Avatars.MatchID(avatarId).ExecuteFirstAsync(token);
+			return root is { IsBanned: false, DeletedAt: null } && avatar is { DeletionAt: null };
+		}
+
+		ForbidResult Refuse(string error, string description) => Forbid(new AuthenticationProperties(new Dictionary<string, string>
+		{
+			[OpenIddictServerAspNetCoreConstants.Properties.Error] = error,
+			[OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = description
+		}), OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
+	}
+}