From cc843d34c5cacf6bbbbb98161506a67248c36919 Mon Sep 17 00:00:00 2001
From: Sven <sgiersig@icloud.com>
Date: Tue, 28 Apr 2026 15:58:26 +0200
Subject: [PATCH] fix: remove endpoint-auth well-known handler; Mastodon router
 wins

/.well-known/oauth-authorization-server was returning IndieAuth metadata
(/auth endpoint) instead of Mastodon OAuth metadata (/oauth/authorize).
Removing the conflicting endpoint-auth registration lets the Mastodon
router serve the correct metadata for clients like Mona.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 scripts/patch-mastodon-well-known.mjs | 32 +++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 scripts/patch-mastodon-well-known.mjs

diff --git a/scripts/patch-mastodon-well-known.mjs b/scripts/patch-mastodon-well-known.mjs
new file mode 100644
index 00000000..09d63551
--- /dev/null
+++ b/scripts/patch-mastodon-well-known.mjs
@@ -0,0 +1,32 @@
+/**
+ * Patch @indiekit/endpoint-auth to remove its /.well-known/oauth-authorization-server
+ * handler so the Mastodon router's handler (with correct /oauth/authorize endpoint)
+ * takes precedence. endpoint-auth registers first in Express, winning over the
+ * Mastodon router — this removes the conflicting registration.
+ */
+
+import { readFileSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { join, dirname } from "node:path";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const pkg = join(__dirname, "../node_modules/@indiekit/endpoint-auth/index.js");
+let src = readFileSync(pkg, "utf-8");
+
+const MARKER = "// patch-mastodon-well-known: removed";
+if (src.includes(MARKER)) {
+  console.log("[patch-mastodon-well-known] Already applied");
+  process.exit(0);
+}
+
+const OLD = `router.get("/oauth-authorization-server", metadataController);`;
+const NEW = `${MARKER}`;
+
+if (!src.includes(OLD)) {
+  console.error("[patch-mastodon-well-known] Target line not found — check endpoint-auth version");
+  process.exit(1);
+}
+
+src = src.replace(OLD, NEW);
+writeFileSync(pkg, src, "utf-8");
+console.log("[patch-mastodon-well-known] Removed endpoint-auth well-known handler; Mastodon router takes over");