[pfefferle]

Fixes #

Proposed changes:

• The rewrite rules for /.well-known/webfinger, /.well-known/nodeinfo and /.well-known/oauth-authorization-server were not anchored, so they matched every path starting with that prefix. The plugin answered /.well-known/oauth-authorization-server/wp-api/indieauth/1.0 with its own metadata, but under RFC 8414 §3.1 that URL belongs to an issuer with the path /wp-api/indieauth/1.0, here the IndieAuth plugin. Because of this, indieauth.rocks test S117 fails.
• The rules now only match the bare path (with an optional trailing slash). The OAuth issuer is always home_url() without a path, so the bare path is all the plugin owns.
• The dot is escaped as well, it matched any character before.
• Paths like /.well-known/nodeinfo/2.0 or /.well-known/webfinger/foo returned the discovery document or the WebFinger response before, and now fall through to WordPress (404). Nothing in the plugin links to them, the NodeInfo discovery document points to the REST URLs, and WebFinger uses ?resource=, which is not part of the rewrite match.
• Existing sites get the new rules through the rewrite flush that runs on every plugin update.

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

• Run npm run env-test -- --filter Test_Router.
• With pretty permalinks, open /.well-known/oauth-authorization-server, it should return the ActivityPub metadata.
• Open /.well-known/oauth-authorization-server/wp-api/indieauth/1.0, it should return a 404 (or the IndieAuth metadata, if the plugin is active and registers that path).
• Open /.well-known/webfinger?resource=acct:admin@your-site and /.well-known/nodeinfo, both should work as before.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message