Rework storage dashboard and fix authorization revocation

- One card per app (grouped by client_id) showing distinct device and
  category counts; the whole card opens the details modal (with hover and
  focus highlight) instead of a separate Details button
- Details modal: access list styled like the OAuth consent dialog via a
  shared RsScopeListComponent, plus per-token device, connected date and
  expiry, each with its own Revoke
- "folder" -> "category" in the card, modal, consent dialog and the
  auth-created notification
- Make revoke a real DELETE: it was a GET link that Turbo 8's
  prefetch-on-hover fired on its own, silently deleting authorizations.
  Missing or foreign authorizations now return 404 instead of 500.
- Move "Launch app" to the app level
  (GET /services/storage/apps/:client_id/launch); no token id in the URL

Part of #254

.env.example

@@ -87,7 +87,6 @@
 # NOSTR_PRIVATE_KEY='123456abcdef...'
 # NOSTR_PUBLIC_KEY='123456abcdef...'
 # NOSTR_RELAY_URL='wss://nostr.kosmos.org'
-# NOSTR_BLOSSOM_SERVER_URL='https://blossom.kosmos.org'
 
 # RS_STORAGE_URL='https://storage.kosmos.org'
 # RS_REDIS_URL='redis://localhost:6379/2'

AGENTS.md

@@ -7,13 +7,16 @@ ejabberd, Discourse, Mastodon, remoteStorage, Nostr, LNDHub, and BTCPay.
 ## Development environment
 
 Development runs in Docker Compose — run all commands against the `web` container.
-Start services: `docker compose up` (web, ldap, redis, minio, liquor-cabinet, strfry).
+Start services: `docker compose up` (web, ldap, redis, garage, liquor-cabinet, strfry).
 The `web` service runs `bin/dev` (foreman: Puma + Tailwind CSS watcher) and embeds
 Solid Queue workers (`SOLID_QUEUE_IN_PUMA=true`).
 
-First-time LDAP setup (after creating the 389ds backend once):
-`docker compose exec ldap dsconf localhost backend create --suffix="dc=kosmos,dc=org" --be_name="dev"`
-then `docker compose run web bin/rails ldap:setup`.
+First-time LDAP and database setup is automated: the `ldap-init` service
+creates the 389ds back-end, then the `web` entrypoint seeds LDAP and the
+databases on first start and runs `db:prepare` on every boot. Manual
+equivalents: `docker compose exec ldap dsconf localhost backend create
+--suffix="dc=kosmos,dc=org" --be-name="dev"` and `docker compose run --rm web
+bin/rails ldap:setup`.
 
 ## Common commands (prefix with `docker compose exec web`)
 

Gemfile

@@ -43,6 +43,7 @@ gem 'flipper-ui'
 gem 'gpgme', '~> 2.0.24'
 gem 'zbase32', '~> 0.1.1'
 gem 'kramdown'
+gem 'device_detector'
 
 # HTTP requests
 gem 'faraday'

Gemfile.lock

@@ -136,6 +136,7 @@ GEM
       database_cleaner-core (~> 2.0.0)
     database_cleaner-core (2.0.1)
     date (3.5.1)
+    device_detector (1.1.3)
     devise (5.0.4)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
@@ -543,6 +544,7 @@ DEPENDENCIES
   capybara
   cssbundling-rails
   database_cleaner
+  device_detector
   devise (~> 5.0)
   devise_ldap_authenticatable
   discourse_api

README.md

@@ -14,13 +14,14 @@ so:
 
 1. Make sure [Docker Compose is installed][1] and Docker is running (included in
    Docker Desktop)
-3. Run `docker compose up --build` and wait until all services have started
+2. Run `docker compose up --build` and wait until all services have started
    (389ds might take an extra minute to be ready). This will take a while when
    running for the first time, so you might want to do something else in the
    meantime.
-4. `docker-compose exec ldap dsconf localhost backend create --suffix="dc=kosmos,dc=org" --be-name="dev"`
-5. `docker compose run web rails ldap:setup`
-6. `docker compose run web rails db:setup`
+
+On the first start, the `ldap-init` service creates the 389ds back-end, and the
+`web` container then seeds the LDAP directory and the databases automatically.
+On every start, `web` also applies any pending database migrations.
 
 After these steps, you should have a working Rails app with a handful of test
 users running on [http://localhost:3000](http://localhost:3000).
@@ -71,15 +72,12 @@ containers you want to run to the `up` command, like so:
 
 #### LDAP server
 
-After creating the Docker container for the first time (or after deleting it),
-you need to run the following command once, in order to create the dirsrv
-back-end:
+On first start, the `ldap-init` service creates the dirsrv back-end
+automatically, and the `web` container then seeds it with development entries.
+To do either step manually (for example, after changing the setup), run:
 
-    docker-compose exec ldap dsconf localhost backend create --suffix="dc=kosmos,dc=org" --be-name="dev"
-
-Now you can seed the back-end with data using this Rails task:
-
-    bundle exec rails ldap:setup
+    docker compose exec ldap dsconf localhost backend create --suffix="dc=kosmos,dc=org" --be-name="dev"
+    docker compose run --rm web bin/rails ldap:setup
 
 The setup task will first delete any existing entries in the directory tree
 ("dc=kosmos,dc=org"), and then create our development entries.
@@ -88,20 +86,42 @@ Note that all 389ds data is stored in the `389ds-data` volume. So if you want
 to start over with a fresh installation, delete both that volume as well as the
 container.
 
-#### Minio / remoteStorage
+To reset the development environment completely, remove all volumes plus the
+generated database files and the first-run marker, then start over:
 
-If you want to run remoteStorage accounts locally, you will have to create the
-respective bucket first. With the `minio` container running (run by default
-when using Docker Compose), follow these steps:
+    docker compose down -v
+    rm -f db/*.sqlite3 tmp/.setup-complete
+    docker compose up --build
 
-* `docker compose up web redis minio liquor-cabinet`
-* Head to http://localhost:9001 and log in with user `minioadmin`, password
-  `minioadmin`
-* Create a new bucket called `remotestorage` (or whatever you
-  change the `S3_BUCKET` config to)
-* Create a new key with ID "dev-key" and secret "123456789" (or whatever you
-  change `S3_ACCESS_KEY` and `S3_SECRET_KEY` to). Leave the policy field empty,
-  as it will automatically allow access to the bucket you created.
+#### Garage / remoteStorage
+
+remoteStorage accounts use the `garage` S3-compatible object store. On first
+start, Garage automatically configures a single-node cluster and creates the
+`remotestorage` bucket together with a `dev-key1` access key (secret
+`1234567890123456`), so no manual setup is required.
+
+If you want to run remoteStorage accounts locally, the `garage` container is
+started by default when using Docker Compose. To run just the remoteStorage
+stack:
+
+* `docker compose up web redis garage liquor-cabinet`
+
+The S3 API is available at http://localhost:3900 (region `garage`). If you want
+to start over with a fresh storage, delete the `garage-data` volume as well as
+the container.
+
+#### Accessing remoteStorage from another machine
+
+remoteStorage clients force HTTPS for any host except `localhost`, and browsers
+block plain-HTTP requests to a LAN IP as mixed content. To connect to the dev
+remoteStorage from a browser on another machine (including production apps such
+as Inspektor), forward the ports over SSH and connect as `localhost`:
+
+    ssh -N -L 3000:localhost:3000 -L 4567:localhost:4567 <user>@<dev-host>
+
+Then use `<user>@localhost:3000` as the remoteStorage address in the client.
+WeFinger discovery and storage requests are served through the forwarded ports,
+so no TLS setup is needed.
 
 ### Adding npm modules to use with Stimulus controllers
 

app/components/form_elements/fieldset_component.html.erb

@@ -12,7 +12,7 @@
     </p>
     <% end %>
 
-    <%= tag.div class: "flex gap-x-1", data: {
+    <%= tag.p class: "flex gap-x-1", data: {
                 controller: @resettable ? "settings--resettable-field" : nil,
               } do %>
       <%= content %>

app/components/rs_auth_component.html.erb

@@ -1,27 +1,28 @@
-<div class="flex items-center gap-4">
-  <div class="h-16 w-16 flex-none">
-    <%= render AppCatalog::WebAppIconComponent.new(web_app: @web_app) %>
-  </div>
-  <div class="flex-grow">
-    <h4 class="mb-1 text-lg font-bold">
-      <%= @web_app&.name || @auth.app_name %>
-    </h4>
-    <p class="text-sm text-gray-500">
-      <%= @auth.client_id %>
-    </p>
-  </div>
-  <%= render DropdownComponent.new do %>
-    <%= render DropdownLinkComponent.new(
-          href: launch_app_services_storage_rs_auth_url(@auth),
-          open_in_new_tab: true
-        ) do %>
-      Launch app
-    <% end %>
-    <%= render DropdownLinkComponent.new(
-          href: revoke_services_storage_rs_auth_url(@auth),
-          separator: true, add_class: "text-red-700"
-        ) do %>
-      Revoke access
-    <% end %>
-  <% end %>
+<div class="h-full" data-controller="modal" data-action="keydown.esc->modal#close">
+  <button type="button"
+          class="rs-auth-card group flex h-full w-full items-center gap-4 rounded-lg border
+                 border-gray-200 bg-white p-5 text-left transition
+                 hover:border-gray-400 hover:bg-gray-50
+                 focus:outline-none focus-visible:ring-2 focus-visible:ring-blue-500"
+          data-action="click->modal#open">
+    <div class="h-14 w-14 flex-none">
+      <%= render AppCatalog::WebAppIconComponent.new(web_app: @web_app) %>
+    </div>
+
+    <div class="min-w-0 flex-grow">
+      <h4 class="text-lg font-bold truncate"><%= name %></h4>
+      <p class="text-sm text-gray-500 truncate"><%= @auth.client_id %></p>
+      <p class="mt-2 text-sm text-gray-600">
+        <%= device_summary %>
+        <span class="mx-1 text-gray-300">·</span>
+        <%= category_summary %>
+      </p>
+    </div>
+
+    <span class="flex-none text-gray-300 transition group-hover:text-gray-500" aria-hidden="true">
+      <%= render partial: "icons/chevron-right", locals: { custom_class: "h-5 w-5" } %>
+    </span>
+  </button>
+
+  <%= render RsAuthDetailsModalComponent.new(authorizations: @authorizations) %>
 </div>

app/components/rs_auth_component.rb

@@ -1,8 +1,34 @@
 # frozen_string_literal: true
 
 class RsAuthComponent < ViewComponent::Base
-  def initialize(auth:)
-    @auth = auth
-    @web_app = auth.web_app
+  include OauthHelper
+
+  def initialize(authorizations:)
+    @authorizations = authorizations
+    @auth = authorizations.first
+    @web_app = @auth.web_app
+  end
+
+  def name
+    @web_app&.name.presence || @auth.app_name.presence || @auth.client_id
+  end
+
+  def root_access?
+    (@auth.permissions & [":r", ":rw"]).any?
+  end
+
+  def category_summary
+    return "All categories and files" if root_access?
+
+    count = @auth.permissions.size
+    "#{count} #{'category'.pluralize(count)}"
+  end
+
+  def device_count
+    @authorizations.map { |auth| auth.device_name.presence || "Unknown device" }.uniq.size
+  end
+
+  def device_summary
+    "#{device_count} #{'device'.pluralize(device_count)}"
   end
 end

app/components/rs_auth_details_modal_component.html.erb

@@ -0,0 +1,42 @@
+<%= render ModalComponent.new do %>
+  <div class="flex items-center gap-4">
+    <div class="h-14 w-14 flex-none">
+      <%= render AppCatalog::WebAppIconComponent.new(web_app: @web_app) %>
+    </div>
+    <div class="min-w-0">
+      <h4 class="text-lg font-bold truncate"><%= name %></h4>
+      <p class="text-sm text-gray-500 truncate"><%= @auth.client_id %></p>
+    </div>
+  </div>
+
+  <h5 class="mt-6 mb-2 text-xs font-semibold uppercase tracking-wide text-gray-500">
+    Access
+  </h5>
+  <%= render RsScopeListComponent.new(scopes: @auth.permissions, root: root_access?) %>
+
+  <h5 class="mt-6 mb-2 text-xs font-semibold uppercase tracking-wide text-gray-500">
+    Connected devices
+  </h5>
+  <ul class="divide-y divide-gray-100 rounded border border-gray-200" data-turbo-prefetch="false">
+    <% @authorizations.each do |auth| %>
+      <li class="flex items-center justify-between gap-4 px-4 py-3">
+        <div class="min-w-0">
+          <p class="truncate text-sm font-medium text-gray-900"><%= device_name(auth) %></p>
+          <p class="truncate text-xs text-gray-500">
+            Connected <%= auth.created_at.strftime('%-d %b %Y') %>
+            <span class="mx-1">&middot;</span>
+            <span class="<%= "text-red-700" if auth.expired? %>"><%= status_label(auth) %></span>
+          </p>
+        </div>
+        <%= button_to "Revoke access", services_storage_rs_auth_path(auth), method: :delete,
+              form: { class: "flex-none" },
+              class: "whitespace-nowrap text-sm text-red-700 hover:underline bg-transparent border-0 p-0 cursor-pointer" %>
+      </li>
+    <% end %>
+  </ul>
+
+  <div class="mt-6 flex flex-col sm:flex-row gap-2 sm:justify-end">
+    <%= link_to "Launch app", launch_app_services_storage_path(@auth.client_id),
+          class: "btn-md btn-blue", target: "_blank", rel: "noopener", data: { turbo: false } %>
+  </div>
+<% end %>

app/components/rs_auth_details_modal_component.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+class RsAuthDetailsModalComponent < ViewComponent::Base
+  include OauthHelper
+
+  def initialize(authorizations:)
+    @authorizations = authorizations
+    @auth = authorizations.first
+    @web_app = @auth.web_app
+  end
+
+  def name
+    @web_app&.name.presence || @auth.app_name.presence || @auth.client_id
+  end
+
+  def root_access?
+    (@auth.permissions & [":r", ":rw"]).any?
+  end
+
+  def device_name(auth)
+    auth.device_name.presence || "Unknown device"
+  end
+
+  def status_label(auth)
+    return "Never expires" if auth.expire_at.blank?
+    return "Expired on #{auth.expire_at.strftime('%-d %b %Y')}" if auth.expired?
+
+    "Expires #{auth.expire_at.strftime('%-d %b %Y')}"
+  end
+end

app/components/rs_scope_list_component.html.erb

@@ -0,0 +1,25 @@
+<% if @root %>
+  <p class="scope text-lg">
+    <span class="text-red-700">
+      <%= render partial: "icons/alert-triangle",
+            locals: { custom_class: "inline-block align-bottom mr-1.5" } %>
+      All categories and files
+    </span>
+    <% if read_only? %>
+      <span class="text-sm text-gray-500">(read only)</span>
+    <% end %>
+  </p>
+<% else %>
+  <% @scopes.each do |scope| %>
+    <p class="scope text-gray-600">
+      <span class="text-lg">
+        <%= render partial: "icons/folder",
+              locals: { custom_class: "inline-block align-bottom mr-1.5" } %>
+        <%= scope_name(scope) %>
+      </span>
+      <% if scope_permissions(scope) == "r" %>
+        <span>(read only)</span>
+      <% end %>
+    </p>
+  <% end %>
+<% end %>

app/components/rs_scope_list_component.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+class RsScopeListComponent < ViewComponent::Base
+  include OauthHelper
+
+  def initialize(scopes:, root: false)
+    @scopes = scopes
+    @root = root
+  end
+
+  def read_only?
+    @scopes.include?(":r")
+  end
+end

app/components/settings/nostr_edit_profile_component.html.erb

@@ -1,156 +0,0 @@
-<div class="w-[72vw] md:w-[500px]">
-  <header class="absolute z-10 h-36 sm:h-44 inset-x-1 top-1 rounded-t
-                 bg-cover bg-center bg-gray-50"
-          style="background-image: url('<%= @profile["banner"]%>');">
-    <div class="inline-block z-20 size-28 sm:size-32 ml-4 mt-16 sm:mt-20">
-    <% if @profile["picture"].present? %>
-      <img src="<%= @profile["picture"] %>"
-           class="inline-block size:28 sm:size-32 rounded-full border-2 border-white" />
-    <% else %>
-      <span class="inline-block size:28 sm:size-32 overflow-hidden rounded-full border-2 border-white bg-gray-100">
-        <svg class="size-full text-gray-300" fill="currentColor" viewBox="0 0 24 24">
-          <path d="M24 20.993V24H0v-2.996A14.977 14.977 0 0112.004 15c4.904 0 9.26 2.354 11.996 5.993zM16.002 8.999a4 4 0 11-8 0 4 4 0 018 0z" />
-        </svg>
-      </span>
-    <% end %>
-    </div>
-  </header>
-  <main class="mt-44 sm:mt-52">
-    <%= form_for(@user, url: setting_path(:nostr), html: { :method => :put }) do |f| %>
-      <%= render FormElements::FieldsetComponent.new(tag: "div", title: "Display name") do %>
-        <%= f.text_field :display_name, value: @display_name, class: "w-full sm:w-3/5" %>
-        <% if @validation_errors.present? && @validation_errors[:display_name].present? %>
-          <p class="error-msg mt-2"><%= @validation_errors[:display_name].first %></p>
-        <% end %>
-      <% end %>
-      <%= render FormElements::FieldsetComponent.new(tag: "div", title: "Nostr address (NIP-05)") do %>
-        <% if @nip05_state[:status] == :added %>
-          <div class="w-full sm:w-3/5 flex flex-col" data-controller="field-suggestion"
-               data-field-suggestion-added-value-value="<%= @user.address %>">
-            <div class="relative">
-              <%= f.text_field :nip05_address, value: @nip05_state[:value],
-                    data: {
-                      :'field-suggestion-target' => "input",
-                      action: "input->field-suggestion#checkAdded"
-                    },
-                    class: "w-full pr-16 border-emerald-500 ring-1 ring-emerald-500 focus:border-emerald-500 focus:ring-emerald-500 bg-emerald-50/20" %>
-              <span class="absolute inset-y-0 right-2.5 flex items-center pointer-events-none"
-                    data-field-suggestion-target="badge">
-                <span class="rounded-full bg-emerald-100 px-2 py-0.5 text-xs font-semibold text-emerald-800">
-                  added
-                </span>
-              </span>
-            </div>
-            <div class="mt-1.5 flex items-center justify-between text-xs text-amber-800 bg-amber-50 rounded px-2.5 py-1.5 border border-amber-200 hidden"
-                 data-field-suggestion-target="suggestion">
-              <span>Account address: <strong><%= @user.address %></strong></span>
-              <button type="button" class="font-semibold text-blue-600 hover:text-blue-800 underline ml-2"
-                      data-action="click->field-suggestion#apply"
-                      data-field-suggestion-value-param="<%= @user.address %>">
-                Use this
-              </button>
-            </div>
-          </div>
-        <% elsif @nip05_state[:status] == :different %>
-          <div class="w-full sm:w-3/5 flex flex-col" data-controller="field-suggestion"
-               data-field-suggestion-added-value-value="<%= @nip05_state[:suggested] %>">
-            <div class="relative">
-              <%= f.text_field :nip05_address, value: @nip05_state[:value],
-                    data: {
-                      :'field-suggestion-target' => "input",
-                      action: "input->field-suggestion#checkAdded"
-                    },
-                    class: "w-full pr-20 border-amber-400 ring-1 ring-amber-400 focus:border-amber-400 focus:ring-amber-400" %>
-              <span class="absolute inset-y-0 right-2.5 flex items-center pointer-events-none"
-                    data-field-suggestion-target="badge">
-                <span class="rounded-full bg-amber-100 px-2 py-0.5 text-xs font-semibold text-amber-800">
-                  different
-                </span>
-              </span>
-            </div>
-            <div class="mt-1.5 flex items-center justify-between text-xs text-amber-800 bg-amber-50 rounded px-2.5 py-1.5 border border-amber-200"
-                 data-field-suggestion-target="suggestion">
-              <span>Account address: <strong><%= @nip05_state[:suggested] %></strong></span>
-              <button type="button" class="font-semibold text-blue-600 hover:text-blue-800 underline ml-2"
-                      data-action="click->field-suggestion#apply"
-                      data-field-suggestion-value-param="<%= @nip05_state[:suggested] %>">
-                Use this
-              </button>
-            </div>
-          </div>
-        <% else %>
-          <%= f.text_field :nip05_address, value: @nip05_state[:value], class: "w-full sm:w-3/5" %>
-        <% end %>
-        <% if @validation_errors.present? && @validation_errors[:nip05_address].present? %>
-          <p class="error-msg mt-2"><%= @validation_errors[:nip05_address].first %></p>
-        <% end %>
-      <% end %>
-      <%= render FormElements::FieldsetComponent.new(tag: "div", title: "Lightning address for Zaps") do %>
-        <% if @lud16_state[:status] == :added %>
-          <div class="w-full sm:w-3/5 flex flex-col" data-controller="field-suggestion"
-               data-field-suggestion-added-value-value="<%= @user.address %>">
-            <div class="relative">
-              <%= f.text_field :lud16_address, value: @lud16_state[:value],
-                    data: {
-                      :'field-suggestion-target' => "input",
-                      action: "input->field-suggestion#checkAdded"
-                    },
-                    class: "w-full pr-16 border-emerald-500 ring-1 ring-emerald-500 focus:border-emerald-500 focus:ring-emerald-500 bg-emerald-50/20" %>
-              <span class="absolute inset-y-0 right-2.5 flex items-center pointer-events-none"
-                    data-field-suggestion-target="badge">
-                <span class="rounded-full bg-emerald-100 px-2 py-0.5 text-xs font-semibold text-emerald-800">
-                  added
-                </span>
-              </span>
-            </div>
-            <div class="mt-1.5 flex items-center justify-between text-xs text-amber-800 bg-amber-50 rounded px-2.5 py-1.5 border border-amber-200 hidden"
-                 data-field-suggestion-target="suggestion">
-              <span>Account address: <strong><%= @user.address %></strong></span>
-              <button type="button" class="font-semibold text-blue-600 hover:text-blue-800 underline ml-2"
-                      data-action="click->field-suggestion#apply"
-                      data-field-suggestion-value-param="<%= @user.address %>">
-                Use this
-              </button>
-            </div>
-          </div>
-        <% elsif @lud16_state[:status] == :different %>
-          <div class="w-full sm:w-3/5 flex flex-col" data-controller="field-suggestion"
-               data-field-suggestion-added-value-value="<%= @lud16_state[:suggested] %>">
-            <div class="relative">
-              <%= f.text_field :lud16_address, value: @lud16_state[:value],
-                    data: {
-                      :'field-suggestion-target' => "input",
-                      action: "input->field-suggestion#checkAdded"
-                    },
-                    class: "w-full pr-20 border-amber-400 ring-1 ring-amber-400 focus:border-amber-400 focus:ring-amber-400" %>
-              <span class="absolute inset-y-0 right-2.5 flex items-center pointer-events-none"
-                    data-field-suggestion-target="badge">
-                <span class="rounded-full bg-amber-100 px-2 py-0.5 text-xs font-semibold text-amber-800">
-                  different
-                </span>
-              </span>
-            </div>
-            <div class="mt-1.5 flex items-center justify-between text-xs text-amber-800 bg-amber-50 rounded px-2.5 py-1.5 border border-amber-200"
-                 data-field-suggestion-target="suggestion">
-              <span>Account address: <strong><%= @lud16_state[:suggested] %></strong></span>
-              <button type="button" class="font-semibold text-blue-600 hover:text-blue-800 underline ml-2"
-                      data-action="click->field-suggestion#apply"
-                      data-field-suggestion-value-param="<%= @lud16_state[:suggested] %>">
-                Use this
-              </button>
-            </div>
-          </div>
-        <% else %>
-          <%= f.text_field :lud16_address, value: @lud16_state[:value], class: "w-full sm:w-3/5" %>
-        <% end %>
-        <% if @validation_errors.present? && @validation_errors[:lud16_address].present? %>
-          <p class="error-msg mt-2"><%= @validation_errors[:lud16_address].first %></p>
-        <% end %>
-      <% end %>
-    <% end %>
-  </main>
-  <footer>
-    <%# <%= @profile.inspect %>
-    <%# <%= @profile_event.inspect %>
-  </footer>
-</div>

app/components/settings/nostr_edit_profile_component.rb

@@ -1,39 +0,0 @@
-# frozen_string_literal: true
-
-module Settings
-  class NostrEditProfileComponent < ViewComponent::Base
-    attr_reader :user, :profile, :profile_event, :display_name, :nip05_state, :lud16_state
-
-    def initialize(user:, profile_event: nil, validation_errors: nil)
-      @user = user
-      @profile_event = profile_event
-      @validation_errors = validation_errors
-      @profile = {}
-      @display_name = nil
-
-      if profile_event.present? && profile_event["content"].present?
-        @profile = JSON.parse(profile_event["content"]) rescue {}
-        @display_name = @profile["display_name"] || @profile["displayName"]
-      end
-
-      @display_name ||= @user.display_name
-
-      @nip05_state = compute_field_state(@profile["nip05"])
-      @lud16_state = compute_field_state(@profile["lud16"])
-    end
-
-    private
-
-    def compute_field_state(current_value)
-      target_value = @user.address
-
-      if current_value.blank?
-        { status: :added, value: target_value, suggested: nil }
-      elsif current_value == target_value
-        { status: :matched, value: current_value, suggested: nil }
-      else
-        { status: :different, value: current_value, suggested: target_value }
-      end
-    end
-  end
-end

app/components/settings/nostr_edit_relays_component.html.erb

@@ -1,62 +0,0 @@
-<div class="w-[72vw] md:w-[500px]">
-  <h3 class="mb-6">Edit relays</h3>
-  <%= form_with url: "#", local: true,
-        html: { data: { controller: "relay-list-editor" } } do |f| %>
-    <ul data-relay-list-editor-target="list" class="mb-4 space-y-2">
-      <% @relays.each do |relay| %>
-        <li class="flex gap-x-2 items-center">
-          <div class="relative grow">
-            <% if relay[:added] %>
-              <input type="text" name="relay_urls[]" value="<%= relay[:url] %>"
-                     data-added-value="<%= relay[:url] %>"
-                     data-action="input->relay-list-editor#checkAdded"
-                     class="w-full pr-16 border-emerald-500 ring-1 ring-emerald-500 focus:border-emerald-500 focus:ring-emerald-500 bg-emerald-50/20" />
-              <span class="absolute inset-y-0 right-2.5 flex items-center pointer-events-none"
-                    data-relay-list-editor-target="addedBadge">
-                <span class="rounded-full bg-emerald-100 px-2 py-0.5 text-xs font-semibold text-emerald-800">
-                  added
-                </span>
-              </span>
-            <% else %>
-              <input type="text" name="relay_urls[]" value="<%= relay[:url] %>" class="w-full" />
-            <% end %>
-          </div>
-          <select name="relay_markers[]" class="shrink-0 w-36 sm:w-40">
-            <option value=""<%= %( selected="selected") if relay[:marker].nil? %>>Read & write</option>
-            <option value="read"<%= %( selected="selected") if relay[:marker] == "read" %>>Read only</option>
-            <option value="write"<%= %( selected="selected") if relay[:marker] == "write" %>>Write only</option>
-          </select>
-          <button type="button" class="btn-md btn-icon btn-outline text-red-700 shrink-0"
-                  data-action="click->relay-list-editor#remove" title="Remove relay">
-            <%= render partial: "icons/trash-2", locals: { custom_class: "h-4 w-4" } %>
-          </button>
-        </li>
-      <% end %>
-    </ul>
-
-    <template data-relay-list-editor-target="template">
-      <li class="flex gap-x-2 items-center">
-        <div class="relative grow">
-          <input type="text" name="relay_urls[]" value="" class="w-full" />
-        </div>
-        <select name="relay_markers[]" class="shrink-0 w-36 sm:w-40">
-          <option value="">Read & write</option>
-          <option value="read">Read only</option>
-          <option value="write">Write only</option>
-        </select>
-        <button type="button" class="btn-md btn-icon btn-outline text-red-700 shrink-0"
-                data-action="click->relay-list-editor#remove" title="Remove relay">
-          <%= render partial: "icons/trash-2", locals: { custom_class: "h-4 w-4" } %>
-        </button>
-      </li>
-    </template>
-
-    <button type="button" class="btn-md btn-gray w-full mb-6"
-            data-action="click->relay-list-editor#add">
-      <%= render partial: "icons/plus", locals: { custom_class: "h-4 w-4 inline mr-1" } %>
-      Add relay
-    </button>
-
-    <%= f.submit "Save relay list", class: "btn-md btn-blue w-full" %>
-  <% end %>
-</div>

app/components/settings/nostr_edit_relays_component.rb

@@ -1,34 +0,0 @@
-# frozen_string_literal: true
-
-module Settings
-  class NostrEditRelaysComponent < ViewComponent::Base
-    def initialize(nip65_event: nil)
-      @nip65_event = nip65_event
-      @relays = build_relays
-    end
-
-    private
-
-    def build_relays
-      site_relay = Setting.nostr_relay_url
-
-      if @nip65_event.blank?
-        relays = Setting.nostr_discovery_relays.map { |url| { url: url, marker: nil, added: true } }
-        if site_relay.present?
-          relays.reject! { |r| r[:url] == site_relay }
-          relays.unshift({ url: site_relay, marker: nil, added: true })
-        end
-        relays
-      else
-        existing = @nip65_event["tags"]
-          .select { |t| t[0] == "r" }
-          .map { |t| { url: t[1], marker: t[2], added: false } }
-
-        if site_relay.present? && existing.none? { |r| r[:url] == site_relay }
-          existing.unshift({ url: site_relay, marker: nil, added: true })
-        end
-        existing
-      end
-    end
-  end
-end

app/components/settings/nostr_profile_status_component.html.erb

@@ -1,21 +0,0 @@
-<% @statuses.each do |status| %>
-  <%= render StatusTextComponent.new(
-    text: status[:text],
-    icon_name: status[:icon_name],
-    icon_color: status[:icon_color]
-  ) %>
-<% end %>
-
-<% if @status == 1 %>
-  <p class="mt-8">
-    <button class="btn-md btn-blue">
-      Edit my profile
-    </button>
-  </p>
-<% elsif @status == 2 %>
-  <p class="mt-8">
-    <button class="btn-md btn-blue">
-      Create my profile
-    </button>
-  </p>
-<% end %>

app/components/settings/nostr_profile_status_component.rb

@@ -1,53 +0,0 @@
-# frozen_string_literal: true
-
-module Settings
-  class NostrProfileStatusComponent < ViewComponent::Base
-    def initialize(profile_event:, user_address:)
-      @statuses = []
-
-      if profile_event.present?
-        profile = JSON.parse(profile_event["content"])
-
-        @statuses.push({
-          text: "You have a public Nostr profile",
-          icon_name: "check-circle",
-          icon_color: "emerald-500"
-        })
-
-        if profile["nip05"].present? && profile["nip05"] == user_address
-          @statuses.push({
-            text: "Your profile's Nostr address is set to <strong>#{ user_address }</strong>",
-            icon_name: "check-circle",
-            icon_color: "emerald-500"
-          })
-        else
-          @statuses.push({
-            text: "Your profile's Nostr address is not set to <strong>#{ user_address }</strong> yet",
-            icon_name: "alert-octagon",
-            icon_color: "amber-500"
-          })
-        end
-
-        if profile["lud16"].present? && profile["lud16"] == user_address
-          @statuses.push({
-            text: "Your profile's Lightning address is set to <strong>#{ user_address }</strong>",
-            icon_name: "check-circle",
-            icon_color: "emerald-500"
-          })
-        else
-          @statuses.push({
-            text: "Your profile's Lightning address is not set to <strong>#{ user_address }</strong> yet",
-            icon_name: "alert-octagon",
-            icon_color: "amber-500"
-          })
-        end
-      else
-        @statuses.push({
-          text: "We could not find a profile for your public key",
-          icon_name: "alert-octagon",
-          icon_color: "amber-500"
-        })
-      end
-    end
-  end
-end

app/components/settings/nostr_relay_status_component.html.erb

@@ -1,18 +0,0 @@
-<% @statuses.each do |status| %>
-  <%= render StatusTextComponent.new(
-    text: status[:text],
-    icon_name: status[:icon_name],
-    icon_color: status[:icon_color]
-  ) %>
-<% end %>
-
-<div class="mt-8" data-controller="modal" data-action="keydown.esc->modal#close">
-  <button data-action="click->modal#open" class="btn-md btn-blue w-full sm:w-auto">
-    <%= @button_text %>
-  </button>
-  <%= render ModalComponent.new(show_close_button: false) do %>
-    <%= render Settings::NostrEditRelaysComponent.new(
-      nip65_event: @nip65_event
-    ) %>
-  <% end %>
-</div>

app/components/settings/nostr_relay_status_component.rb

@@ -1,48 +0,0 @@
-# frozen_string_literal: true
-
-module Settings
-  class NostrRelayStatusComponent < ViewComponent::Base
-    def initialize(nip65_event:, relay_url: Setting.nostr_relay_url)
-      @nip65_event = nip65_event
-      @relay_url = relay_url
-      @relay_host = relay_url.present? ? URI.parse(relay_url).host : nil
-      @statuses = []
-
-      if nip65_event.present?
-        @statuses.push({
-          text: "You have a relay list configured",
-          icon_name: "check-circle",
-          icon_color: "emerald-500"
-        })
-
-        if relay_urls(nip65_event).include?(@relay_url)
-          @statuses.push({
-            text: "The <strong>#{@relay_host}</strong> relay is part of your relay list",
-            icon_name: "check-circle",
-            icon_color: "emerald-500"
-          })
-        else
-          @statuses.push({
-            text: "<strong>#{@relay_host}</strong> is missing from your relay list",
-            icon_name: "alert-octagon",
-            icon_color: "amber-500"
-          })
-        end
-      else
-        @statuses.push({
-          text: "We could not find a relay list for your public key",
-          icon_name: "alert-octagon",
-          icon_color: "amber-500"
-        })
-      end
-
-      @button_text = (nip65_event.present? ? "Edit relays" : "Set up relays")
-    end
-
-    private
-
-    def relay_urls(nip65_event)
-      nip65_event["tags"].select { |t| t[0] == "r" }.map { |t| t[1] }
-    end
-  end
-end

app/components/status_text_component.html.erb

@@ -1,8 +0,0 @@
-<p class="flex gap-x-4 items-center">
-  <span class="inline-block h-6 w-6 grow-0 text-<%= @icon_color %>">
-    <%= render "icons/#{@icon_name}" %>
-  </span>
-  <span>
-    <%= raw @text %>
-  </span>
-</p>

app/components/status_text_component.rb

@@ -1,7 +0,0 @@
-class StatusTextComponent < ViewComponent::Base
-  def initialize(text:, icon_name:, icon_color:)
-    @text = text
-    @icon_name = icon_name
-    @icon_color = icon_color
-  end
-end

app/controllers/rs/oauth_controller.rb

@@ -1,7 +1,10 @@
 class Rs::OauthController < ApplicationController
+  skip_before_action :verify_authenticity_token, only: :token
+
   prepend_before_action :assert_redirect_uri, only: [:new, :create]
   before_action :require_signed_in_with_username, only: :new
   before_action :authenticate_user!, only: :create
+  before_action :set_cors_headers, only: :token
 
   def new
     @user          = User.where(cn: params[:username].downcase, ou: Setting.primary_domain).first
@@ -9,9 +12,12 @@ class Rs::OauthController < ApplicationController
     @redirect_uri  = params[:redirect_uri]
     @client_id     = params[:client_id]
     @state         = params[:state]
+    @response_type = params[:response_type].presence || "token"
+    @code_challenge = params[:code_challenge]
+    @code_challenge_method = params[:code_challenge_method].presence || "S256"
     @root_access_requested = (@scopes & [":r",":rw"]).any?
 
-    @denial_url = url_with_state("#{@redirect_uri}#error=access_denied", @state)
+    @denial_url = error_url(@redirect_uri, "error=access_denied", @state)
 
     @expire_at_dates = [["Never", nil],
                         ["In 1 month", 1.month.from_now],
@@ -20,35 +26,41 @@ class Rs::OauthController < ApplicationController
     unless current_user == @user
       sign_out :user
 
-      redirect_to new_rs_oauth_url(@user.cn,
-                                   scope: params[:scope],
-                                   redirect_uri: params[:redirect_uri],
-                                   client_id: params[:client_id],
-                                   state: params[:state])
+      redirect_params = {
+        scope: params[:scope],
+        redirect_uri: params[:redirect_uri],
+        client_id: params[:client_id],
+        state: params[:state]
+      }
+
+      if @response_type == "code"
+        redirect_params[:response_type] = "code"
+        redirect_params[:code_challenge] = @code_challenge
+        redirect_params[:code_challenge_method] = @code_challenge_method
+      end
+
+      redirect_to new_rs_oauth_url(@user.cn, redirect_params)
       return
     end
 
     unless @client_id.present?
-      redirect_to(url_with_state("#{@redirect_uri}#error=invalid_request", @state),
-                  allow_other_host: true) and return
+      error_redirect(@redirect_uri, "error=invalid_request", @state) and return
     end
 
     if @scopes.empty?
-      redirect_to(url_with_state("#{@redirect_uri}#error=invalid_scope", @state),
-                  allow_other_host: true) and return
+      error_redirect(@redirect_uri, "error=invalid_scope", @state) and return
     end
 
     unless hostname_of(@client_id) == hostname_of(@redirect_uri)
-      redirect_to(url_with_state("#{@redirect_uri}#error=invalid_client", @state),
-                  allow_other_host: true) and return
+      error_redirect(@redirect_uri, "error=invalid_client", @state) and return
+    end
+
+    if @response_type == "code" &&
+       (@code_challenge.blank? || @code_challenge_method != "S256")
+      error_redirect(@redirect_uri, "error=invalid_request", @state) and return
     end
 
     @client_id.gsub!(/http(s)?:\/\//, "")
-
-    if auth = current_user.remote_storage_authorizations.valid.where(permissions: @scopes, client_id: @client_id).first
-      redirect_to(url_with_state("#{@redirect_uri}#access_token=#{auth.token}", @state),
-                  allow_other_host: true) and return
-    end
   end
 
   def create
@@ -57,6 +69,7 @@ class Rs::OauthController < ApplicationController
       http_status :forbidden and return
     end
 
+    response_type = params[:response_type].presence || "token"
     permissions  = parse_scopes params[:scope]
     redirect_uri = params[:redirect_uri].presence
     client_id    = params[:client_id].presence
@@ -64,32 +77,73 @@ class Rs::OauthController < ApplicationController
     expire_at    = params[:expire_at].presence
 
     if permissions.empty?
-      redirect_to(url_with_state("#{redirect_uri}#error=invalid_scope", state),
-                  allow_other_host: true) and return
+      error_redirect(redirect_uri, "error=invalid_scope", state, response_type) and return
     end
 
     unless client_id.present?
-      redirect_to(url_with_state("#{redirect_uri}#error=invalid_request", state),
-                  allow_other_host: true) and return
+      error_redirect(redirect_uri, "error=invalid_request", state, response_type) and return
     end
 
     unless hostname_of(client_id) == hostname_of(redirect_uri)
-      redirect_to(url_with_state("#{redirect_uri}#error=invalid_client", state),
-                  allow_other_host: true) and return
+      error_redirect(redirect_uri, "error=invalid_client", state, response_type) and return
     end
 
     client_id.gsub!(/http(s)?:\/\//, "")
 
-    auth = current_user.remote_storage_authorizations.create!(
-      permissions: permissions,
-      client_id: client_id,
-      redirect_uri: redirect_uri,
-      app_name: client_id,
-      expire_at: expire_at
+    if response_type == "code"
+      challenge = params[:code_challenge].presence
+      method = params[:code_challenge_method].presence || "S256"
+
+      if challenge.blank? || method != "S256"
+        error_redirect(redirect_uri, "error=invalid_request", state, response_type) and return
+      end
+
+      code = RsOauthManager::IssueCode.call(
+        user: current_user,
+        client_id: client_id,
+        redirect_uri: redirect_uri,
+        permissions: permissions,
+        expire_at: expire_at,
+        user_agent: request.user_agent,
+        code_challenge: challenge,
+        code_challenge_method: method
+      )
+
+      redirect_to url_with_state("#{redirect_uri}?code=#{CGI.escape(code.code)}", state),
+                  allow_other_host: true
+    else
+      auth = current_user.remote_storage_authorizations.create!(
+        permissions: permissions,
+        client_id: client_id,
+        redirect_uri: redirect_uri,
+        app_name: client_id,
+        expire_at: expire_at,
+        user_agent: request.user_agent
+      )
+
+      redirect_to url_with_state("#{redirect_uri}#access_token=#{auth.token}", state),
+                  allow_other_host: true
+    end
+  end
+
+  def token
+    return head :ok if request.options?
+
+    unless params[:grant_type] == "authorization_code"
+      return render json: { error: "unsupported_grant_type" }, status: :bad_request
+    end
+
+    auth = RsOauthManager::ExchangeCode.call(
+      code: params[:code],
+      client_id: params[:client_id],
+      redirect_uri: params[:redirect_uri],
+      code_verifier: params[:code_verifier]
     )
 
-    redirect_to url_with_state("#{redirect_uri}#access_token=#{auth.token}", state),
-                allow_other_host: true
+    response.headers["Cache-Control"] = "no-store"
+    render json: token_response(auth)
+  rescue RsOauthManagerService::InvalidGrant
+    render json: { error: "invalid_grant" }, status: :bad_request
   end
 
   private
@@ -105,24 +159,42 @@ class Rs::OauthController < ApplicationController
     end
   end
 
+  def set_cors_headers
+    headers["Access-Control-Allow-Origin"] = "*"
+    headers["Access-Control-Allow-Methods"] = "POST, OPTIONS"
+    headers["Access-Control-Allow-Headers"] = "Content-Type"
+  end
+
+  def token_response(auth)
+    body = {
+      access_token: auth.token,
+      token_type: "bearer",
+      scope: auth.permissions.join(" ")
+    }
+
+    if auth.expire_at.present?
+      body[:expires_in] = (auth.expire_at - Time.current).to_i
+    end
+
+    body
+  end
+
   def hostname_of(uri)
-    uri.gsub(/http(s)?:\/\//, "").split(":")[0].split("/")[0]
+    RsOauthManagerService.hostname_of(uri)
   end
 
   def parse_scopes(scope_string)
-    return [] if scope_string.blank?
+    RsOauthManagerService.parse_scopes(scope_string)
+  end
 
-    scopes = scope_string.
-      gsub(/\[|\]/, "").
-      gsub(/\,/, " ").
-      gsub(/\/:/, ":").
-      split(/\s/).map(&:strip).
-      reject(&:empty?)
+  def error_redirect(redirect_uri, error, state, response_type = @response_type)
+    redirect_to error_url(redirect_uri, error, state, response_type),
+                allow_other_host: true
+  end
 
-    scopes = [":r"] if scopes.include?("*:r")
-    scopes = [":rw"] if scopes.include?("*:rw")
-
-    scopes
+  def error_url(redirect_uri, error, state, response_type = @response_type)
+    separator = response_type == "code" ? "?" : "#"
+    url_with_state("#{redirect_uri}#{separator}#{error}", state)
   end
 
   def url_with_state(url, state)

app/controllers/services/remotestorage_controller.rb

@@ -1,7 +1,7 @@
 class Services::RemotestorageController < Services::BaseController
   before_action :authenticate_user!
   before_action :require_service_available
-  before_action :require_feature_enabled
+  before_action :require_service_enabled
 
   # Dashboard
   def show
@@ -17,8 +17,8 @@ class Services::RemotestorageController < Services::BaseController
       http_status :not_found unless Setting.remotestorage_enabled?
     end
 
-    def require_feature_enabled
-      unless Flipper.enabled?(:remotestorage, current_user)
+    def require_service_enabled
+      unless current_user.service_enabled?(:remotestorage)
         http_status :forbidden
       end
     end

app/controllers/services/rs_auths_controller.rb

@@ -1,13 +1,16 @@
 class Services::RsAuthsController < Services::BaseController
   before_action :authenticate_user!
-  before_action :require_feature_enabled
+  before_action :require_service_enabled
   before_action :require_service_available
-  # before_action :require_service_enabled
-  before_action :find_rs_auth, only: [:destroy, :launch_app]
+  before_action :find_rs_auth, only: [:destroy]
 
   def index
-    @rs_auths = current_user.remote_storage_authorizations
-    # TODO sort by app name?
+    @rs_apps = current_user.remote_storage_authorizations
+                           .includes(:web_app)
+                           .group_by(&:client_id)
+                           .values
+                           .map { |auths| auths.sort_by(&:created_at).reverse }
+                           .sort_by { |auths| app_name_for(auths.first).downcase }
   end
 
   def destroy
@@ -23,19 +26,34 @@ class Services::RsAuthsController < Services::BaseController
   end
 
   def launch_app
-    user_address = Rails.env.development? ?
-      "#{current_user.cn}@localhost:3000" :
-      current_user.address
+    auth = current_user.remote_storage_authorizations
+                       .where(client_id: params[:client_id])
+                       .order(created_at: :desc)
+                       .first
+    http_status(:not_found) and return unless auth
 
-    launch_url = "#{@auth.launch_url}#remotestorage=#{user_address}"
+    user_address =
+      if Rails.env.development?
+        "#{current_user.cn}@#{request.host_with_port}"
+      else
+        current_user.address
+      end
+
+    # Storage-first bearer token issuance (remoteStorage spec §11): the app
+    # receives the address and runs the application-first flow itself.
+    launch_url = "#{auth.launch_url}#remotestorage=#{user_address}"
 
     redirect_to launch_url, allow_other_host: true
   end
 
   private
 
-    def require_feature_enabled
-      unless Flipper.enabled?(:remotestorage, current_user)
+    def app_name_for(auth)
+      auth.web_app&.name.presence || auth.app_name.presence || auth.client_id
+    end
+
+    def require_service_enabled
+      unless current_user.service_enabled?(:remotestorage)
         http_status :forbidden
       end
     end
@@ -45,7 +63,7 @@ class Services::RsAuthsController < Services::BaseController
     end
 
     def find_rs_auth
-      @auth = current_user.remote_storage_authorizations.find(params[:id])
-      http_status :not_found unless @auth.present?
+      @auth = current_user.remote_storage_authorizations.find_by(id: params[:id])
+      http_status :not_found unless @auth
     end
 end

app/controllers/settings_controller.rb

@@ -4,13 +4,8 @@ require "bcrypt"
 class SettingsController < ApplicationController
   before_action :authenticate_user!
   before_action :set_main_nav_section
-  before_action :set_settings_section, only: [
-    :show, :update, :update_email, :reset_email_password
-  ]
-  before_action :set_user, only: [
-    :show, :update, :update_email, :reset_email_password,
-    :fetch_nostr_metadata
-  ]
+  before_action :set_settings_section, only: [:show, :update, :update_email, :reset_email_password]
+  before_action :set_user, only: [:show, :update, :update_email, :reset_email_password]
 
   def index
     redirect_to setting_path(:profile)
@@ -148,63 +143,12 @@ class SettingsController < ApplicationController
     }
   end
 
-  def fetch_nostr_metadata
-    return render plain: "no pubkey", status: :bad_request if @user.nostr_pubkey.blank?
-
-    cache_key = "nostr_metadata:#{@user.id}"
-
-    case params[:step]
-    when "relays"
-      nip65_event = NostrManager::DiscoverUserRelays.call(pubkey: @user.nostr_pubkey)
-      write_relays = nip65_event ? extract_write_relays(nip65_event) : []
-
-      if nip65_event && write_relays.any? && stale?(nip65_event)
-        auth_event = NostrManager::DiscoverUserRelays.call(
-          pubkey: @user.nostr_pubkey, relays: write_relays
-        )
-        nip65_event = auth_event if auth_event
-        write_relays = extract_write_relays(nip65_event) if auth_event
-      end
-
-      Rails.cache.write("#{cache_key}:nip65", nip65_event, expires_in: 5.minutes)
-      Rails.cache.write("#{cache_key}:write_relays", write_relays, expires_in: 5.minutes)
-      render json: { next: "profile" }
-
-    when "profile"
-      write_relays = Rails.cache.read("#{cache_key}:write_relays") || []
-      relays = write_relays.any? ? write_relays : nil
-      profile = NostrManager::DiscoverUserProfile.call(
-        pubkey: @user.nostr_pubkey, relays: relays
-      )
-      Rails.cache.write("#{cache_key}:profile", profile, expires_in: 5.minutes)
-      render json: { next: "render" }
-
-    when "render", nil
-      @nip65_event = Rails.cache.read("#{cache_key}:nip65")
-      @profile     = Rails.cache.read("#{cache_key}:profile")
-      render partial: "nostr_metadata", formats: :html
-
-    else
-      render plain: "invalid step", status: :bad_request
-    end
-  end
-
   private
 
     def set_main_nav_section
       @current_section = :settings
     end
 
-    def extract_write_relays(nip65_event)
-      nip65_event["tags"]
-        .select { |t| t[0] == "r" && t[2] != "read" }
-        .map { |t| t[1] }
-    end
-
-    def stale?(event, threshold = 30.minutes)
-      Time.at(event["created_at"]) < threshold.ago
-    end
-
     def set_settings_section
       @settings_section = params[:section]
       allowed_sections = [

app/controllers/webfinger_controller.rb

@@ -88,19 +88,42 @@ class WebfingerController < WellKnownController
   end
 
   def remotestorage_link
-    auth_url = new_rs_oauth_url(@username, host: Setting.rs_accounts_domain)
-    storage_url = "#{Setting.rs_storage_url}/#{@username}"
+    auth_url =
+      if Rails.env.development?
+        new_rs_oauth_url(@username)
+      else
+        new_rs_oauth_url(@username, host: Setting.rs_accounts_domain)
+      end
+
+    storage_url = "#{remotestorage_storage_base_url}/#{@username}"
 
     {
       rel: "http://tools.ietf.org/id/draft-dejong-remotestorage",
       href: storage_url,
       properties: {
-        "http://remotestorage.io/spec/version" => "draft-dejong-remotestorage-13",
+        "http://remotestorage.io/spec/version" => "draft-dejong-remotestorage-27",
         "http://tools.ietf.org/html/rfc6749#section-4.2" => auth_url,
+        "http://tools.ietf.org/html/rfc6749#section-3.1" => auth_url,
+        "http://tools.ietf.org/html/rfc6749#section-3.2" => token_endpoint_url,
+        "http://tools.ietf.org/html/rfc7636" => "S256",
         "http://tools.ietf.org/html/rfc6750#section-2.3" => nil, # access token via a HTTP query parameter
         "http://tools.ietf.org/html/rfc7233": "GET", # content range requests
         "http://remotestorage.io/spec/web-authoring": nil
       }
     }
   end
+
+  def token_endpoint_url
+    return rs_oauth_token_url if Rails.env.development?
+
+    rs_oauth_token_url(host: Setting.rs_accounts_domain)
+  end
+
+  def remotestorage_storage_base_url
+    return Setting.rs_storage_url unless Rails.env.development?
+
+    uri = URI.parse(Setting.rs_storage_url)
+    uri.host = request.host
+    uri.to_s
+  end
 end

app/javascript/controllers/field_suggestion_controller.js

@@ -1,63 +0,0 @@
-import { Controller } from "@hotwired/stimulus"
-
-export default class extends Controller {
-  static targets = [ "input", "badge", "suggestion" ]
-  static values  = { addedValue: String }
-
-  apply (event) {
-    event.preventDefault()
-    const value = event.params.value ?? this.addedValueValue
-
-    if (this.hasInputTarget && value !== undefined) {
-      this.inputTarget.value = value
-      this.checkAdded()
-    }
-  }
-
-  checkAdded () {
-    if (!this.hasInputTarget) return
-
-    const addedValue = this.hasAddedValueValue ? this.addedValueValue : null
-    if (!addedValue) return
-
-    const isMatch = (this.inputTarget.value.trim() === addedValue.trim())
-
-    const emeraldClasses = [
-      "border-emerald-500", "ring-1", "ring-emerald-500",
-      "focus:border-emerald-500", "focus:ring-emerald-500",
-      "bg-emerald-50/20"
-    ]
-    const amberClasses = [
-      "border-amber-400", "ring-1", "ring-amber-400",
-      "focus:border-amber-400", "focus:ring-amber-400"
-    ]
-
-    if (isMatch) {
-      this.inputTarget.classList.remove(...amberClasses)
-      this.inputTarget.classList.add(...emeraldClasses)
-
-      if (this.hasBadgeTarget) {
-        this.badgeTarget.innerHTML = `
-          <span class="rounded-full bg-emerald-100 px-2 py-0.5 text-xs font-semibold text-emerald-800">
-            added
-          </span>
-        `.trim()
-        this.badgeTarget.classList.remove("hidden")
-      }
-
-      if (this.hasSuggestionTarget) {
-        this.suggestionTarget.classList.add("hidden")
-      }
-    } else {
-      this.inputTarget.classList.remove(...emeraldClasses)
-
-      if (this.hasBadgeTarget) {
-        this.badgeTarget.classList.add("hidden")
-      }
-
-      if (this.hasSuggestionTarget) {
-        this.suggestionTarget.classList.remove("hidden")
-      }
-    }
-  }
-}

app/javascript/controllers/nostr_metadata_controller.js

@@ -1,50 +0,0 @@
-import { Controller } from "@hotwired/stimulus"
-
-export default class extends Controller {
-  static targets = [ "status", "loading", "content" ]
-  static values  = { url: String }
-
-  connect () {
-    this.runStep("relays")
-  }
-
-  async runStep (step) {
-    const messages = {
-      relays:  "Looking up your relay list…",
-      profile: "Fetching your profile…",
-      blossom: "Fetching your media server list…",
-      render:  null
-    }
-
-    if (messages[step]) {
-      this.statusTarget.textContent = messages[step]
-    }
-
-    try {
-      const headers = (step === "render")
-        ? { "Accept": "text/html" }
-        : { "Accept": "application/json" }
-
-      const res = await fetch(`${this.urlValue}?step=${step}`, { headers })
-
-      if (!res.ok) {
-        throw new Error(`HTTP ${res.status}`)
-      }
-
-      if (step === "render") {
-        const html = await res.text()
-        this.loadingTarget.classList.add("hidden")
-        this.contentTarget.classList.remove("hidden")
-        this.contentTarget.innerHTML = html
-      } else {
-        const data = await res.json()
-        if (data.next) {
-          this.runStep(data.next)
-        }
-      }
-    } catch (error) {
-      console.warn("Nostr metadata fetch failed:", error.message)
-      this.statusTarget.textContent = "Something went wrong. Please reload."
-    }
-  }
-}

app/javascript/controllers/relay_list_editor_controller.js

@@ -1,40 +0,0 @@
-import { Controller } from "@hotwired/stimulus"
-
-export default class extends Controller {
-  static targets = [ "list", "template", "addedBadge" ]
-
-  add (event) {
-    event.preventDefault()
-    const row = this.templateTarget.content.cloneNode(true)
-    this.listTarget.appendChild(row)
-  }
-
-  remove (event) {
-    event.preventDefault()
-    const row = event.target.closest("li")
-    row.remove()
-  }
-
-  checkAdded (event) {
-    const input = event.target
-    const addedValue = input.dataset.addedValue
-    if (!addedValue) return
-
-    const container = input.closest(".relative")
-    const badge = container?.querySelector("[data-relay-list-editor-target='addedBadge']")
-
-    const addedClasses = [
-      "border-emerald-500", "ring-1", "ring-emerald-500",
-      "focus:border-emerald-500", "focus:ring-emerald-500",
-      "bg-emerald-50/20"
-    ]
-
-    if (input.value.trim() === addedValue.trim()) {
-      input.classList.add(...addedClasses)
-      if (badge) badge.classList.remove("hidden")
-    } else {
-      input.classList.remove(...addedClasses)
-      if (badge) badge.classList.add("hidden")
-    }
-  }
-}

app/mailers/notification_mailer.rb

@@ -11,7 +11,7 @@ class NotificationMailer < ApplicationMailer
     @auth = params[:auth]
     @permissions = @auth.permissions.map do |p|
       access = p.split(":")[1] == 'r' ? 'read' : 'read/write'
-      directory = p.split(':')[0] == '' ? 'all folders and files' : p.split(':')[0]
+      directory = p.split(':')[0] == '' ? 'all categories and files' : p.split(':')[0]
       "#{access} #{directory}"
     end
     @subject = "New app connected to your storage"

app/models/concerns/settings/nostr_settings.rb

@@ -18,24 +18,8 @@ module Settings
       field :nostr_relay_url, type: :string,
         default: ENV["NOSTR_RELAY_URL"].presence
 
-      field :nostr_blossom_server_url, type: :string,
-        default: ENV["NOSTR_BLOSSOM_SERVER_URL"].presence
-
       field :nostr_zaps_relay_limit, type: :integer,
         default: 12
-
-      field :nostr_discovery_relays, type: :array, default: %w[
-        wss://nostr.kosmos.org
-        wss://nos.lol
-        wss://relay.snort.social
-        wss://relay.primal.net
-        wss://relay.damus.io
-      ]
-
-      def self.nostr_relay_url_http
-        self.nostr_relay_url.gsub(/^ws:/, "http:")
-                            .gsub(/^wss:/, "https:")
-      end
     end
   end
 end

app/models/remote_storage_authorization.rb

@@ -40,6 +40,26 @@ class RemoteStorageAuthorization < ApplicationRecord
     end
   end
 
+  def expired?
+    expire_at.present? && expire_at.past?
+  end
+
+  def device_name
+    return nil if user_agent.blank?
+
+    client = DeviceDetector.new(user_agent)
+    name = client.name.presence
+    os = client.os_name.presence
+    os = "Linux" if os == "GNU/Linux"
+    os = "macOS" if os == "Mac"
+
+    # Safari never runs on Linux. A WebKit "Safari" user agent on Linux is a
+    # WebKitGTK browser (e.g. GNOME Web), which sends a Safari-compatible UA.
+    name = "WebKit" if name == "Safari" && os == "Linux"
+
+    [name, os].compact.join(" on ").presence
+  end
+
   def delete_token_from_redis
     key = "authorizations:#{user.cn}:#{token}"
     redis.srem? key, redis.smembers(key)

app/models/rs_authorization_code.rb

@@ -0,0 +1,37 @@
+class RsAuthorizationCode < ApplicationRecord
+  belongs_to :user
+
+  CODE_TTL = 60.seconds
+
+  serialize :permissions, coder: YAML
+
+  attr_accessor :code
+
+  before_validation :generate_code
+
+  scope :active, -> { where(expires_at: Time.current..) }
+
+  def self.find_by_code(raw_code)
+    return nil if raw_code.blank?
+
+    find_by(code_digest: Digest::SHA256.hexdigest(raw_code))
+  end
+
+  def expired?
+    expires_at <= Time.current
+  end
+
+  def consume!
+    destroy!
+  end
+
+  private
+
+    def generate_code
+      return if code_digest.present?
+
+      self.code = SecureRandom.urlsafe_base64(32)
+      self.code_digest = Digest::SHA256.hexdigest(code)
+      self.expires_at ||= CODE_TTL.from_now
+    end
+end

app/services/nostr_manager/discover_user_profile.rb

@@ -1,21 +0,0 @@
-module NostrManager
-  class DiscoverUserProfile < NostrManagerService
-    def initialize(pubkey:, relays: nil)
-      @pubkey = pubkey
-      @relays = relays.present? ? relays : Setting.nostr_discovery_relays
-    end
-
-    def call
-      filter = Nostr::Filter.new(
-        authors: [@pubkey],
-        kinds: [0],
-        limit: 1,
-      )
-
-      NostrManager::FetchLatestEvent.call(
-        relays: @relays,
-        filter: filter
-      )
-    end
-  end
-end

app/services/nostr_manager/discover_user_relays.rb

@@ -1,21 +0,0 @@
-module NostrManager
-  class DiscoverUserRelays < NostrManagerService
-    def initialize(pubkey:, relays: nil)
-      @pubkey = pubkey
-      @relays = relays.present? ? relays : Setting.nostr_discovery_relays
-    end
-
-    def call
-      filter = Nostr::Filter.new(
-        authors: [@pubkey],
-        kinds: [10002],
-        limit: 1,
-      )
-
-      NostrManager::FetchLatestEvent.call(
-        relays: @relays,
-        filter: filter
-      )
-    end
-  end
-end

app/services/nostr_manager/fetch_event.rb

@@ -1,61 +0,0 @@
-module NostrManager
-  class FetchEvent < NostrManagerService
-    TIMEOUT = 10
-
-    def initialize(filter:, relay_url:)
-      @filter = filter
-      @relay = new_relay(relay_url)
-      @client = Nostr::Client.new
-    end
-
-    def call
-      filter, client, relay = @filter, @client, @relay
-      event = nil
-      mutex = Mutex.new
-      received_event = ConditionVariable.new
-      log_prefix = "[nostr][#{@relay.name}]"
-
-      thread = Thread.new do
-        client.on :connect do
-          client.subscribe(filter: filter)
-        end
-
-        client.on :error do |e|
-          Rails.logger.info "#{log_prefix} Error: #{e}"
-          Thread.current.exit
-        end
-
-        client.on :message do |m|
-          msg = JSON.parse(m) rescue nil
-          if msg && msg[0] == "EVENT" && msg[2]
-            Rails.logger.debug "#{log_prefix} Event received: #{msg[2]["id"]}"
-            mutex.synchronize do
-              event = msg[2]
-              received_event.signal
-            end
-          elsif msg && msg[0] == "EOSE"
-            mutex.synchronize do
-              received_event.signal
-            end
-          end
-        end
-
-        client.connect relay
-      end
-
-      begin
-        Timeout.timeout(TIMEOUT) do
-          mutex.synchronize do
-            received_event.wait(mutex) if event.nil?
-          end
-        end
-      rescue Timeout::Error
-        Rails.logger.debug "#{log_prefix} Timeout: No event received within #{TIMEOUT} seconds"
-      ensure
-        thread.exit
-      end
-
-      event
-    end
-  end
-end

app/services/nostr_manager/fetch_latest_event.rb

@@ -1,32 +0,0 @@
-module NostrManager
-  class FetchLatestEvent < NostrManagerService
-    TIMEOUT = 20
-
-    def initialize(relays:, filter:, max_events: 2)
-      @relays = relays
-      @filter = filter
-      @max_events = max_events
-    end
-
-    def call
-      events = []
-
-      begin
-        Timeout.timeout(TIMEOUT) do
-          @relays.each do |url|
-            event = NostrManager::FetchEvent.call(filter: @filter, relay_url: url)
-
-            if event.present? && events.none? { |e| e["id"] == event["id"] }
-              events << event
-              break if events.size >= @max_events
-            end
-          end
-        end
-      rescue Timeout::Error
-        Rails.logger.debug "[nostr] Timeout after #{TIMEOUT}s, found #{events.size} events"
-      end
-
-      events.max_by { |e| e["created_at"] }
-    end
-  end
-end

app/services/nostr_manager/publish_event.rb

@@ -19,28 +19,28 @@ module NostrManager
 
       thread = Thread.new do
         client.on :connect do
-          Rails.logger.debug "#{log_prefix} Publishing #{event.id}..."
+          puts "#{log_prefix} Publishing #{event.id}..."
           client.publish event
         end
 
         client.on :error do |e|
-          Rails.logger.debug "#{log_prefix} Error: #{e}"
-          Rails.logger.debug "#{log_prefix} Closing thread..."
+          puts "#{log_prefix} Error: #{e}"
+          puts "#{log_prefix} Closing thread..."
           thread.exit
         end
 
         client.on :message do |m|
-          Rails.logger.debug "#{log_prefix} Message: #{m}"
+          puts "#{log_prefix} Message: #{m}"
           msg = JSON.parse(m) rescue []
           if msg[0] == "OK" && msg[1] == event.id && msg[2]
-            Rails.logger.debug "#{log_prefix} Event published. Closing thread..."
+            puts "#{log_prefix} Event published. Closing thread..."
           else
-            Rails.logger.debug "#{log_prefix} Unexpected message from relay. Closing thread..."
+            puts "#{log_prefix} Unexpected message from relay. Closing thread..."
           end
           thread.exit
         end
 
-        Rails.logger.debug "#{log_prefix} Connecting to #{relay.url}..."
+        puts "#{log_prefix} Connecting to #{relay.url}..."
         client.connect relay
       end
 

app/services/nostr_manager_service.rb

@@ -3,7 +3,6 @@ require "nostr"
 class NostrManagerService < ApplicationService
   def parse_tags(tags)
     out = {}
-    # TODO support more than 1 item for each tag type
     tags.each do |tag|
       out[tag[0].to_sym] = tag[1, tag.length]
     end
@@ -20,8 +19,4 @@ class NostrManagerService < ApplicationService
   def site_user
     Nostr::User.new(keypair: site_keypair)
   end
-
-  def new_relay(url)
-    Nostr::Relay.new(url: url, name: URI.parse(url).host)
-  end
 end

app/services/rs_oauth_manager/exchange_code.rb

@@ -0,0 +1,36 @@
+module RsOauthManager
+  class ExchangeCode < RsOauthManagerService
+    def initialize(code:, client_id:, redirect_uri:, code_verifier:)
+      @code = code
+      @client_id = client_id
+      @redirect_uri = redirect_uri
+      @code_verifier = code_verifier
+    end
+
+    def call
+      auth_code = RsAuthorizationCode.find_by_code(@code)
+      raise InvalidGrant if auth_code.nil? || auth_code.expired?
+
+      raise InvalidGrant unless hostname_of(@client_id) == hostname_of(@redirect_uri)
+      raise InvalidGrant unless @redirect_uri == auth_code.redirect_uri
+
+      raise InvalidGrant unless VerifyPkce.call(
+        code_challenge: auth_code.code_challenge,
+        code_challenge_method: auth_code.code_challenge_method,
+        code_verifier: @code_verifier
+      )
+
+      auth = auth_code.user.remote_storage_authorizations.create!(
+        permissions: auth_code.permissions,
+        client_id: auth_code.client_id,
+        redirect_uri: auth_code.redirect_uri,
+        app_name: auth_code.client_id,
+        expire_at: auth_code.permission_expire_at,
+        user_agent: auth_code.user_agent
+      )
+
+      auth_code.consume!
+      auth
+    end
+  end
+end

app/services/rs_oauth_manager/issue_code.rb

@@ -0,0 +1,29 @@
+module RsOauthManager
+  class IssueCode < RsOauthManagerService
+    def initialize(user:, client_id:, redirect_uri:, permissions:,
+                   code_challenge:, code_challenge_method: "S256",
+                   expire_at: nil, user_agent: nil)
+      @user = user
+      @client_id = client_id
+      @redirect_uri = redirect_uri
+      @permissions = permissions
+      @code_challenge = code_challenge
+      @code_challenge_method = code_challenge_method
+      @expire_at = expire_at
+      @user_agent = user_agent
+    end
+
+    def call
+      RsAuthorizationCode.create!(
+        user: @user,
+        client_id: @client_id,
+        redirect_uri: @redirect_uri,
+        permissions: @permissions,
+        permission_expire_at: @expire_at,
+        user_agent: @user_agent,
+        code_challenge: @code_challenge,
+        code_challenge_method: @code_challenge_method
+      )
+    end
+  end
+end

app/services/rs_oauth_manager/verify_pkce.rb

@@ -0,0 +1,21 @@
+module RsOauthManager
+  class VerifyPkce < RsOauthManagerService
+    def initialize(code_challenge:, code_challenge_method:, code_verifier:)
+      @code_challenge = code_challenge
+      @code_challenge_method = code_challenge_method
+      @code_verifier = code_verifier.to_s
+    end
+
+    def call
+      return false unless @code_challenge_method == "S256"
+
+      expected = Base64.urlsafe_encode64(
+        Digest::SHA256.digest(@code_verifier), padding: false
+      )
+
+      ActiveSupport::SecurityUtils.secure_compare(
+        expected, @code_challenge.to_s
+      )
+    end
+  end
+end

app/services/rs_oauth_manager_service.rb

@@ -0,0 +1,27 @@
+class RsOauthManagerService < ApplicationService
+  InvalidGrant = Class.new(StandardError)
+
+  def self.parse_scopes(scope_string)
+    return [] if scope_string.blank?
+
+    scopes = scope_string.
+      gsub(/\[|\]/, "").
+      gsub(/\,/, " ").
+      gsub(/\/:/, ":").
+      split(/\s/).map(&:strip).
+      reject(&:empty?)
+
+    scopes = [":r"] if scopes.include?("*:r")
+    scopes = [":rw"] if scopes.include?("*:rw")
+
+    scopes
+  end
+
+  def self.hostname_of(uri)
+    uri.to_s.gsub(/http(s)?:\/\//, "").split(":")[0].split("/")[0]
+  end
+
+  def hostname_of(uri)
+    self.class.hostname_of(uri)
+  end
+end

app/views/admin/settings/services/_nostr.html.erb

@@ -29,35 +29,15 @@
         title: "Relay URL",
         description: "Websockets URL of a relay associated with #{Setting.primary_domain}"
       ) %>
-  <%= render FormElements::FieldsetResettableSettingComponent.new(
-        key: :nostr_blossom_server_url,
-        title: "Blossom server URL",
-        description: "HTTP URL of the Blossom media server to add to users' server lists during onboarding"
-      ) %>
 </ul>
 </section>
-
 <section>
 <h3>Zaps</h3>
 <ul role="list">
   <%= render FormElements::FieldsetResettableSettingComponent.new(
         key: :nostr_zaps_relay_limit,
         title: "Relay limit",
-        description: "The maximum number of sender-defined relays to try to publish zap receipts to"
+        description: "The maximum number of relays to publish zap receipts to"
       ) %>
 </ul>
-</section>
-
-<section>
-<h3>Onboarding</h3>
-<ul role="list">
-  <%= render FormElements::FieldsetComponent.new(
-        title: "Discovery relays",
-        description: "Used to discover a user's published relay list and/or profile"
-      ) do %>
-    <%= f.text_area :nostr_discovery_relays,
-      value: Setting.nostr_discovery_relays.join("\n"),
-      class: "h-44 w-80" %>
-  <% end %>
-</ul>
 <% end %>

app/views/admin/users/show.html.erb

@@ -305,7 +305,7 @@
           <td>remoteStorage</td>
           <td>
             <%= render FormElements::ToggleComponent.new(
-              enabled: Flipper.enabled?(:remotestorage, current_user) && @services_enabled.include?("remotestorage"),
+              enabled: @services_enabled.include?("remotestorage"),
               input_enabled: false
             ) %>
           </td>

app/views/dashboard/index.html.erb

@@ -43,8 +43,7 @@
           <% end %>
         </div>
       <% end %>
-      <% if Setting.remotestorage_enabled? &&
-            Flipper.enabled?(:remotestorage, current_user) %>
+      <% if Setting.remotestorage_enabled? %>
         <div class="border border-gray-300 rounded-md hover:border-gray-400
                     bg-[length:80%] bg-[center_top_-156px] bg-no-repeat
                     bg-[url(/img/logos/icon_remotestorage.svg)]">

app/views/rs/oauth/new.html.erb

@@ -5,34 +5,10 @@
     <p class="mb-8">
       The app on
       <%= link_to @client_id, "https://#{@client_id}" %>
-      is asking for access to these folders:
+      is asking for access to these categories:
     </p>
 
-    <% if @root_access_requested %>
-    <p class="scope text-lg">
-      <span class="text-red-700">
-        <%= render partial: "icons/alert-triangle",
-              locals: { custom_class: "inline-block align-bottom mr-1.5" } %>
-        All files and directories
-      </span>
-      <% if (@scopes & [":r"]).any? %>
-        <span class="text-sm text-gray-500">(read only)</span>
-      <% end %>
-    </p>
-    <% else %>
-      <% @scopes.each do |scope| %>
-      <p class="scope text-gray-600">
-        <span class="text-lg">
-          <%= render partial: "icons/folder",
-            locals: { custom_class: "inline-block align-bottom mr-1.5" } %>
-          <%= scope_name(scope) %>
-        </span>
-        <% if scope_permissions(scope) == "r" %>
-          <span>(read only)</span>
-        <% end %>
-      </p>
-      <% end %>
-    <% end %>
+    <%= render RsScopeListComponent.new(scopes: @scopes, root: @root_access_requested) %>
 
     <%= form_with(url: rs_oauth_path, method: :post, data: { turbo: false }) do |f| %>
       <%= f.hidden_field :redirect_uri, value: @redirect_uri %>
@@ -40,6 +16,9 @@
       <%= f.hidden_field :user_id, value: @user.id %>
       <%= f.hidden_field :client_id, value: @client_id %>
       <%= f.hidden_field :state, value: @state %>
+      <%= f.hidden_field :response_type, value: @response_type %>
+      <%= f.hidden_field :code_challenge, value: @code_challenge %>
+      <%= f.hidden_field :code_challenge_method, value: @code_challenge_method %>
       <p class="mt-8 mb-6">
         <%= f.label :expire_at, "Permission expires:", class: "mr-1.5" %>
         <%= f.select :expire_at, options_for_select(@expire_at_dates) %>

app/views/services/rs_auths/index.html.erb

@@ -10,10 +10,10 @@
   <%= render partial: "shared/tabnav_remotestorage" %>
 
   <section>
-    <% if @rs_auths.any? %>
-      <div class="w-full grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-y-10 gap-x-12 mt-4">
-      <% @rs_auths.each do |auth| %>
-        <%= render RsAuthComponent.new(auth: auth) %>
+    <% if @rs_apps.any? %>
+      <div class="w-full grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-6 mt-4">
+      <% @rs_apps.each do |authorizations| %>
+        <%= render RsAuthComponent.new(authorizations: authorizations) %>
       <% end %>
     </div>
     <% else %>

app/views/settings/_nostr.html.erb

@@ -1,46 +1,47 @@
-<div data-controller="settings--nostr-pubkey"
-     data-settings--nostr-pubkey-user-address-value="<%= current_user.address %>"
-     data-settings--nostr-pubkey-site-value="<%= Setting.accounts_domain %>"
-     data-settings--nostr-pubkey-shared-secret-value="<%= session[:shared_secret] %>"
-     data-settings--nostr-pubkey-pubkey-hex-value="<%= current_user.nostr_pubkey %>">
-  <section class="mb-8 sm:mb-12">
-    <h3>Nostr</h3>
-    <h4 class="mb-0">
-      Public Key
-    </h4>
-    <p class="<%= current_user.nostr_pubkey.present? ? '' : 'hidden' %> mt-2 flex gap-x-1">
+<section>
+  <h3>Nostr</h3>
+  <h4 class="mb-0">Public Key</h4>
+  <div data-controller="settings--nostr-pubkey"
+       data-settings--nostr-pubkey-user-address-value="<%= current_user.address %>"
+       data-settings--nostr-pubkey-site-value="<%= Setting.accounts_domain %>"
+       data-settings--nostr-pubkey-shared-secret-value="<%= session[:shared_secret] %>"
+       data-settings--nostr-pubkey-pubkey-hex-value="<%= current_user.nostr_pubkey %>">
+
+    <p class="<%= current_user.nostr_pubkey.present? ? '' : 'hidden' %> mt-2 flex gap-1">
       <input type="text" value="<%= current_user.nostr_pubkey_bech32 %>" disabled
              data-settings--nostr-pubkey-target="pubkeyBech32Input"
-             name="nostr_public_key" class="w-full" />
+             name="nostr_public_key" class="relative grow" />
       <%= link_to nostr_pubkey_settings_path,
-            class: 'btn-md btn-outline relative grow-0 shrink-0 text-red-700',
+            class: 'btn-md btn-outline text-red-700 relative shrink-0',
             data: { turbo_method: :delete, turbo_confirm: 'Are you sure?' } do %>
         Remove
       <% end %>
     </p>
 
     <% if current_user.nostr_pubkey.present? %>
-    <!-- <div> -->
-    <!--   Pubkey present -->
-    <!-- </div> -->
+    <div class="rounded-md bg-blue-50 p-4">
+      <div class="flex">
+        <div class="flex-shrink-0">
+          <svg class="h-5 w-5 text-blue-400" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
+            <path fill-rule="evenodd" d="M18 10a8 8 0 11-16 0 8 8 0 0116 0zm-7-4a1 1 0 11-2 0 1 1 0 012 0zM9 9a.75.75 0 000 1.5h.253a.25.25 0 01.244.304l-.459 2.066A1.75 1.75 0 0010.747 15H11a.75.75 0 000-1.5h-.253a.25.25 0 01-.244-.304l.459-2.066A1.75 1.75 0 009.253 9H9z" clip-rule="evenodd" />
+          </svg>
+        </div>
+        <div class="ml-3 flex-1">
+          <p class="text-sm text-blue-800">
+            Your user address <strong><%= current_user.address %></strong> is
+            also a Nostr address now. Use your favorite Nostr app, or for
+            example <a href="http://metadata.nostr.com" target="_blank"
+              class="underline">metadata.nostr.com</a>, to add this
+            <strong>NIP-05</strong> address to your public profile.
+          </p>
+        </div>
+      </div>
+    </div>
     <% else %>
     <p class="my-4">
-      Verify your Nostr public key with us in order to enable Nostr-specific
-      features for your account:
+      If you use any apps on the Nostr network, you can verify your public key
+      with us in order to enable Nostr-specific features for your account.
     </p>
-    <ul class="list-disc list-inside">
-      <li>Log in with Nostr (no password needed)</li>
-      <li>Verified Nostr address</li>
-      <% if Setting.lndhub_enabled? %>
-      <li>Receive zaps in your Lightning account</li>
-      <% end %>
-      <% if Setting.nostr_relay_url.present? %>
-      <li>Publish notes and other stuff on our Nostr relay</li>
-      <% end %>
-      <% if Setting.nostr_blossom_server_url.present? %>
-      <li>Publish media files on our Nostr media server</li>
-      <% end %>
-    </ul>
     <% end %>
 
     <div data-settings--nostr-pubkey-target="noExtension"
@@ -57,8 +58,8 @@
           </h3>
           <div class="mt-2 mb-0 text-sm text-blue-800">
             <p>
-              We recommend Alby, which you can also use a wallet for your
-              Lightning account.
+              We recommend Alby, which you can also use for your Lightning
+              Wallet.
             </p>
           </div>
           <div class="mt-4">
@@ -85,18 +86,5 @@
       </button>
     </p>
     <% end %>
-  </section>
-
-  <% if current_user.nostr_pubkey.present? %>
-    <div data-controller="nostr-metadata"
-         data-nostr-metadata-url-value="<%= nostr_metadata_settings_path %>">
-      <div data-nostr-metadata-target="loading"
-           class="flex flex-col items-center justify-center py-16">
-        <div class="mb-4 h-12 w-12"></div>
-        <p data-nostr-metadata-target="status"
-           class="text-gray-500 animate-pulse">Loading…</p>
-      </div>
-      <div data-nostr-metadata-target="content" class="hidden"></div>
-    </div>
-  <% end %>
-</div>
+  </div>
+</section>

app/views/settings/_nostr_metadata.html.erb

@@ -1,25 +0,0 @@
-<section class="">
-  <h3>Profile</h3>
-  <%= render Settings::NostrProfileStatusComponent.new(
-    profile_event: @profile,
-    user_address: current_user.address
-  ) %>
-  <div class="mt-8" data-controller="modal" data-action="keydown.esc->modal#close">
-    <button data-action="click->modal#open" class="btn-md btn-blue w-full sm:w-auto">
-      Edit profile
-    </button>
-    <%= render ModalComponent.new(show_close_button: false) do %>
-      <%= render Settings::NostrEditProfileComponent.new(
-        user: current_user,
-        profile_event: @profile
-      ) %>
-    <% end %>
-  </div>
-</section>
-
-<section class="mb-8 sm:mb-12">
-  <h3>Relays</h3>
-  <%= render Settings::NostrRelayStatusComponent.new(
-    nip65_event: @nip65_event
-  ) %>
-</section>

app/views/shared/_sidenav_settings.html.erb

@@ -19,19 +19,18 @@
   active: @settings_section.to_s == "email"
 ) %>
 <% end %>
-<% if Setting.remotestorage_enabled? &&
-      Flipper.enabled?(:remotestorage, current_user) %>
-<%= render SidenavLinkComponent.new(
-  name: "Storage", path: setting_path(:remotestorage), icon: "remotestorage",
-  active: @settings_section.to_s == "remotestorage"
-) %>
-<% end %>
 <% if Setting.lndhub_enabled %>
 <%= render SidenavLinkComponent.new(
   name: "Lightning", path: setting_path(:lightning), icon: "zap",
   active: @settings_section.to_s == "lightning"
 ) %>
 <% end %>
+<% if Setting.remotestorage_enabled? %>
+<%= render SidenavLinkComponent.new(
+  name: "Storage", path: setting_path(:remotestorage), icon: "remotestorage",
+  active: @settings_section.to_s == "remotestorage"
+) %>
+<% end %>
 <% if Setting.nostr_enabled %>
 <%= render SidenavLinkComponent.new(
   name: "Nostr", path: setting_path(:nostr), icon: "nostrich-head",

app/views/shared/nostr/_edit_user_profile.html.erb

@@ -1,3 +0,0 @@
-<div>
-  <%= profile.inspect %>
-</div>

config/environments/development.rb

@@ -24,7 +24,7 @@ Rails.application.configure do
   else
     config.action_controller.perform_caching = false
 
-    config.cache_store = :memory_store
+    config.cache_store = :null_store
   end
 
   # Don't care if the mailer can't send.

config/routes.rb

@@ -52,12 +52,9 @@ Rails.application.routes.draw do
 
     resource :storage, controller: 'remotestorage', only: [:show] do
       get :apps, to: "rs_auths#index"
-      resources :rs_auths, only: [:index, :destroy] do
-        member do
-          get :revoke, to: 'rs_auths#destroy'
-          get :launch_app
-        end
-      end
+      get "apps/:client_id/launch", to: "rs_auths#launch_app", as: :launch_app,
+          constraints: { client_id: /[^\/]+/ }
+      resources :rs_auths, only: [:index, :destroy]
     end
   end
 
@@ -68,7 +65,6 @@ Rails.application.routes.draw do
       post 'reset_email_password'
       post 'set_nostr_pubkey'
       delete 'nostr_pubkey', to: 'settings#remove_nostr_pubkey'
-      get 'fetch_nostr_metadata', as: 'nostr_metadata'
     end
   end
 
@@ -116,6 +112,8 @@ Rails.application.routes.draw do
   end
 
   namespace :rs do
+    post  'oauth/token', to: 'oauth#token', as: :oauth_token
+    match 'oauth/token', to: 'oauth#token', via: :options
     resource :oauth, only: [:new, :create], path_names: {
       new: ':username', create: ':username'
     }, controller: 'oauth'

db/migrate/20261102120000_create_rs_authorization_codes.rb

@@ -0,0 +1,19 @@
+class CreateRsAuthorizationCodes < ActiveRecord::Migration[8.1]
+  def change
+    create_table :rs_authorization_codes do |t|
+      t.references :user, null: false, foreign_key: true
+      t.string   :client_id,             null: false
+      t.string   :redirect_uri,          null: false
+      t.text     :permissions,           default: [].to_yaml
+      t.datetime :permission_expire_at
+      t.string   :code_digest,           null: false
+      t.string   :code_challenge,        null: false
+      t.string   :code_challenge_method, null: false, default: "S256"
+      t.datetime :expires_at,            null: false
+
+      t.timestamps
+    end
+
+    add_index :rs_authorization_codes, :code_digest, unique: true
+  end
+end

db/migrate/20261102130000_add_user_agent_to_rs_authorizations.rb

@@ -0,0 +1,6 @@
+class AddUserAgentToRsAuthorizations < ActiveRecord::Migration[8.1]
+  def change
+    add_column :remote_storage_authorizations, :user_agent, :string
+    add_column :rs_authorization_codes, :user_agent, :string
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.1].define(version: 2025_05_28_092931) do
+ActiveRecord::Schema[8.1].define(version: 2026_11_02_130000) do
   create_table "active_storage_attachments", force: :cascade do |t|
     t.bigint "blob_id", null: false
     t.datetime "created_at", null: false
@@ -110,6 +110,7 @@ ActiveRecord::Schema[8.1].define(version: 2025_05_28_092931) do
     t.string "redirect_uri"
     t.string "token"
     t.datetime "updated_at", null: false
+    t.string "user_agent"
     t.integer "user_id", null: false
     t.integer "web_app_id"
     t.index ["permissions"], name: "index_remote_storage_authorizations_on_permissions"
@@ -117,6 +118,23 @@ ActiveRecord::Schema[8.1].define(version: 2025_05_28_092931) do
     t.index ["web_app_id"], name: "index_remote_storage_authorizations_on_web_app_id"
   end
 
+  create_table "rs_authorization_codes", force: :cascade do |t|
+    t.string "client_id", null: false
+    t.string "code_challenge", null: false
+    t.string "code_challenge_method", default: "S256", null: false
+    t.string "code_digest", null: false
+    t.datetime "created_at", null: false
+    t.datetime "expires_at", null: false
+    t.datetime "permission_expire_at"
+    t.text "permissions", default: "--- []\n"
+    t.string "redirect_uri", null: false
+    t.datetime "updated_at", null: false
+    t.string "user_agent"
+    t.integer "user_id", null: false
+    t.index ["code_digest"], name: "index_rs_authorization_codes_on_code_digest", unique: true
+    t.index ["user_id"], name: "index_rs_authorization_codes_on_user_id"
+  end
+
   create_table "settings", force: :cascade do |t|
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
@@ -164,5 +182,6 @@ ActiveRecord::Schema[8.1].define(version: 2025_05_28_092931) do
   add_foreign_key "active_storage_variant_records", "active_storage_blobs", column: "blob_id"
   add_foreign_key "remote_storage_authorizations", "app_catalog_web_apps", column: "web_app_id"
   add_foreign_key "remote_storage_authorizations", "users"
+  add_foreign_key "rs_authorization_codes", "users"
   add_foreign_key "zaps", "users"
 end

db/seeds.rb

@@ -1,8 +1,9 @@
-require 'sidekiq/testing'
-
 ldap = LdapService.new
 
-Sidekiq::Testing.inline! do
+original_queue_adapter = ActiveJob::Base.queue_adapter
+ActiveJob::Base.queue_adapter = :inline
+
+begin
   ldap.delete_all_users!
 
   puts "Create user: admin"
@@ -25,4 +26,6 @@ Sidekiq::Testing.inline! do
       password: "user is user", confirmed: true
     })
   end
+ensure
+  ActiveJob::Base.queue_adapter = original_queue_adapter
 end

docker-compose.yml

@@ -1,6 +1,7 @@
 services:
   ldap:
     image: 4teamwork/389ds:latest
+    platform: linux/amd64
     volumes:
       - 389ds-data:/data
     networks:
@@ -12,6 +13,21 @@ services:
       DS_DM_PASSWORD: passthebutter
       SUFFIX_NAME: "dc=kosmos,dc=org"
 
+  ldap-init:
+    image: 4teamwork/389ds:latest
+    platform: linux/amd64
+    networks:
+      - internal_network
+    volumes:
+      - ./docker/ldap-init.sh:/ldap-init.sh:ro
+    environment:
+      LDAP_ADMIN_PASSWORD: passthebutter
+      LDAP_SUFFIX: "dc=kosmos,dc=org"
+    depends_on:
+      ldap:
+        condition: service_healthy
+    command: ["/bin/sh", "/ldap-init.sh"]
+
   redis:
     restart: always
     image: redis:7-alpine
@@ -26,7 +42,7 @@ services:
   web:
     build: .
     tty: true
-    command: bash -c "rm -f /akkounts/tmp/pids/server.pid; bin/dev"
+    command: ["bash", "docker/web-entrypoint.sh"]
     volumes:
       - .:/akkounts
       - /akkounts/node_modules
@@ -57,20 +73,28 @@ services:
       NOSTR_PRIVATE_KEY: 7c3ef7e448505f0615137af38569d01807d3b05b5005d5ecf8aaafcd40323cea
       NOSTR_RELAY_URL: ws://strfry:7777
     depends_on:
-      - ldap
-      - redis
+      ldap:
+        condition: service_started
+      ldap-init:
+        condition: service_completed_successfully
+      redis:
+        condition: service_started
 
-  minio:
-    image: quay.io/minio/minio:latest
-    command: "server /data --console-address ':9001'"
+  garage:
+    image: dxflrs/garage:v2.4.1
+    command: ["/garage", "server", "--single-node", "--default-bucket"]
     networks:
       - external_network
       - internal_network
     ports:
-      - "9000:9000"
-      - "9001:9001"
+      - "3900:3900"
     volumes:
-      - minio-data:/data
+      - ./docker/garage/garage.toml:/etc/garage.toml:ro
+      - garage-data:/var/lib/garage
+    environment:
+      GARAGE_DEFAULT_ACCESS_KEY: dev-key1
+      GARAGE_DEFAULT_SECRET_KEY: "1234567890123456"
+      GARAGE_DEFAULT_BUCKET: remotestorage
 
   liquor-cabinet:
     image: gitea.kosmos.org/5apps/liquor-cabinet:2.0.0-rc.1
@@ -79,17 +103,21 @@ services:
       - internal_network
     ports:
       - "4567:4567"
+    volumes:
+      - ./docker/liquor-cabinet/rainbows.conf.rb:/etc/liquor-cabinet/rainbows.conf.rb:ro
+    command: ["bundle", "exec", "rainbows", "-c", "/etc/liquor-cabinet/rainbows.conf.rb", "--listen", "0.0.0.0:4567"]
     environment:
       RACK_ENV: staging
       REDIS_HOST: redis
       REDIS_PORT: 6379
       REDIS_DB: 1
-      S3_ENDPOINT: http://minio:9000
-      S3_ACCESS_KEY: dev-key
-      S3_SECRET_KEY: 123456789
+      S3_ENDPOINT: http://garage:3900
+      S3_REGION: garage
+      S3_ACCESS_KEY: dev-key1
+      S3_SECRET_KEY: "1234567890123456"
       S3_BUCKET: remotestorage
     depends_on:
-      - minio
+      - garage
       - redis
 
   strfry:
@@ -127,7 +155,7 @@ networks:
 volumes:
   389ds-data:
     driver: local
-  minio-data:
+  garage-data:
     driver: local
   redis-data:
     driver: local

docker/garage/garage.toml

@@ -0,0 +1,14 @@
+metadata_dir = "/var/lib/garage/meta"
+data_dir = "/var/lib/garage/data"
+db_engine = "sqlite"
+
+replication_factor = 1
+
+rpc_bind_addr = "[::]:3901"
+rpc_public_addr = "127.0.0.1:3901"
+rpc_secret = "1799bccfd7411eddcf9ebd316bc1f5287ad12a68094e1c6ac6abde7e6feae1ec"
+
+[s3_api]
+s3_region = "garage"
+api_bind_addr = "[::]:3900"
+root_domain = ".s3.garage.localhost"

docker/ldap-init.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+set -e
+
+SUFFIX="${LDAP_SUFFIX:-dc=kosmos,dc=org}"
+URI="ldap://ldap:3389"
+
+if dsconf -D "cn=Directory Manager" -w "$LDAP_ADMIN_PASSWORD" "$URI" \
+     backend suffix list --suffix 2>/dev/null | grep -Fqx "$SUFFIX"; then
+  echo "LDAP backend for $SUFFIX already exists, skipping."
+else
+  echo "Creating LDAP backend for $SUFFIX..."
+  dsconf -D "cn=Directory Manager" -w "$LDAP_ADMIN_PASSWORD" "$URI" \
+    backend create --suffix "$SUFFIX" --be-name dev
+fi

docker/liquor-cabinet/rainbows.conf.rb

@@ -0,0 +1,5 @@
+Rainbows! do
+  use :ThreadPool
+  worker_connections 16
+  client_max_body_size 100 * 1024 * 1024
+end

docker/web-entrypoint.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -e
+
+if [ ! -f tmp/.setup-complete ]; then
+  echo "First start: setting up LDAP entries and databases..."
+  bin/rails ldap:setup
+  bin/rails db:setup
+  touch tmp/.setup-complete
+else
+  bin/rails db:prepare
+fi
+
+rm -f tmp/pids/server.pid
+exec bin/dev

spec/components/form_elements/fieldset_component_spec.rb

@@ -1,22 +0,0 @@
-# frozen_string_literal: true
-
-require "rails_helper"
-
-RSpec.describe FormElements::FieldsetComponent, type: :component do
-  it "renders a div with flex gap-x-1 for vertical positioning" do
-    rendered = render_inline(described_class.new(title: "Username")) do
-      "<input type='text' name='username' />".html_safe
-    end
-
-    expect(rendered.css("label.block > div.flex.gap-x-1")).to be_present
-    expect(rendered.css("label.block > p.flex")).not_to be_present
-  end
-
-  it "renders a div for horizontal positioning" do
-    rendered = render_inline(described_class.new(positioning: :horizontal, title: "Enable notifications")) do
-      "<input type='checkbox' />".html_safe
-    end
-
-    expect(rendered.css("label.block > div.relative")).to be_present
-  end
-end

spec/components/settings/nostr_edit_profile_component_spec.rb

@@ -1,86 +0,0 @@
-# frozen_string_literal: true
-
-require "rails_helper"
-
-RSpec.describe Settings::NostrEditProfileComponent, type: :component do
-  let(:user) { build(:user, cn: "alice") }
-
-  before do
-    allow(user).to receive(:address).and_return("alice@kosmos.org")
-    allow(user).to receive(:display_name).and_return("Alice Wonderland")
-  end
-
-  describe "when profile event is missing or fields are empty" do
-    it "prefills NIP-05 and Lightning addresses with user address and marks them as added" do
-      rendered = render_inline(described_class.new(user: user, profile_event: nil))
-
-      nip05_input = rendered.css("input[name='user[nip05_address]']").first
-      expect(nip05_input["value"]).to eq("alice@kosmos.org")
-      expect(nip05_input["class"]).to include("border-emerald-500")
-      expect(nip05_input["data-action"]).to include("input->field-suggestion#checkAdded")
-
-      lud16_input = rendered.css("input[name='user[lud16_address]']").first
-      expect(lud16_input["value"]).to eq("alice@kosmos.org")
-      expect(lud16_input["class"]).to include("border-emerald-500")
-      expect(lud16_input["data-action"]).to include("input->field-suggestion#checkAdded")
-
-      badges = rendered.css("span.rounded-full").select { |el| el.text.strip == "added" }
-      expect(badges.size).to eq(2)
-    end
-  end
-
-  describe "when profile has different NIP-05 and Lightning addresses" do
-    let(:profile_event) do
-      {
-        "content" => {
-          "nip05" => "alice@other.org",
-          "lud16" => "alice@getalby.com",
-          "display_name" => "Alice External"
-        }.to_json
-      }
-    end
-
-    it "shows current values with different badges and suggestion strips" do
-      rendered = render_inline(described_class.new(user: user, profile_event: profile_event))
-
-      nip05_input = rendered.css("input[name='user[nip05_address]']").first
-      expect(nip05_input["value"]).to eq("alice@other.org")
-      expect(nip05_input["class"]).to include("border-amber-400")
-
-      lud16_input = rendered.css("input[name='user[lud16_address]']").first
-      expect(lud16_input["value"]).to eq("alice@getalby.com")
-      expect(lud16_input["class"]).to include("border-amber-400")
-
-      different_badges = rendered.css("span.rounded-full").select { |el| el.text.strip == "different" }
-      expect(different_badges.size).to eq(2)
-
-      suggestion_buttons = rendered.css("button[data-action='click->field-suggestion#apply']")
-      expect(suggestion_buttons.size).to eq(2)
-      expect(suggestion_buttons.first["data-field-suggestion-value-param"]).to eq("alice@kosmos.org")
-    end
-  end
-
-  describe "when profile addresses match user address" do
-    let(:profile_event) do
-      {
-        "content" => {
-          "nip05" => "alice@kosmos.org",
-          "lud16" => "alice@kosmos.org",
-          "display_name" => "Alice Wonderland"
-        }.to_json
-      }
-    end
-
-    it "renders standard inputs without added or different badges" do
-      rendered = render_inline(described_class.new(user: user, profile_event: profile_event))
-
-      nip05_input = rendered.css("input[name='user[nip05_address]']").first
-      expect(nip05_input["value"]).to eq("alice@kosmos.org")
-      expect(nip05_input["class"]).not_to include("border-emerald-500")
-      expect(nip05_input["class"]).not_to include("border-amber-400")
-
-      badges = rendered.css("span.rounded-full").select { |el| %w[added different].include?(el.text.strip) }
-      expect(badges).to be_empty
-    end
-  end
-end

spec/components/settings/nostr_edit_relays_component_spec.rb

@@ -1,79 +0,0 @@
-# frozen_string_literal: true
-
-require "rails_helper"
-
-RSpec.describe Settings::NostrEditRelaysComponent, type: :component do
-  before do
-    allow(Setting).to receive(:nostr_relay_url).and_return("wss://nostr.kosmos.org")
-    allow(Setting).to receive(:nostr_discovery_relays).and_return([
-      "wss://nos.lol",
-      "wss://relay.damus.io"
-    ])
-  end
-
-  describe "when user has no relay list (nip65_event is nil)" do
-    it "renders all relays with added status and badges" do
-      rendered = render_inline(described_class.new(nip65_event: nil))
-
-      expect(rendered.css("input[value='wss://nostr.kosmos.org']")).to be_present
-      expect(rendered.css("input[value='wss://nos.lol']")).to be_present
-      expect(rendered.css("input[value='wss://relay.damus.io']")).to be_present
-
-      badges = rendered.css("span.rounded-full").select { |el| el.text.strip == "added" }
-      expect(badges.size).to eq(3)
-    end
-  end
-
-  describe "when user has an existing relay list without site relay" do
-    let(:nip65_event) do
-      {
-        "kind" => 10002,
-        "tags" => [
-          ["r", "wss://nos.lol"],
-          ["r", "wss://relay.damus.io", "read"]
-        ]
-      }
-    end
-
-    it "prepends the site relay marked as added, while existing relays are not added" do
-      rendered = render_inline(described_class.new(nip65_event: nip65_event))
-
-      relay_inputs = rendered.css("input[name='relay_urls[]']").map { |el| el["value"] }
-      expect(relay_inputs.first).to eq("wss://nostr.kosmos.org")
-
-      badges = rendered.css("span.rounded-full").select { |el| el.text.strip == "added" }
-      expect(badges.size).to eq(1)
-
-      site_input = rendered.css("input[value='wss://nostr.kosmos.org']").first
-      expect(site_input["class"]).to include("border-emerald-500")
-      expect(site_input["data-added-value"]).to eq("wss://nostr.kosmos.org")
-      expect(site_input["data-action"]).to include("input->relay-list-editor#checkAdded")
-
-      other_input = rendered.css("input[value='wss://nos.lol']").first
-      expect(other_input["class"]).not_to include("border-emerald-500")
-      expect(other_input["data-added-value"]).to be_nil
-
-      select = rendered.css("select[name='relay_markers[]']").first
-      expect(select["class"]).to include("w-36")
-    end
-  end
-
-  describe "when user already has site relay in their relay list" do
-    let(:nip65_event) do
-      {
-        "kind" => 10002,
-        "tags" => [
-          ["r", "wss://nostr.kosmos.org"],
-          ["r", "wss://nos.lol"]
-        ]
-      }
-    end
-
-    it "renders relays without any added badges" do
-      rendered = render_inline(described_class.new(nip65_event: nip65_event))
-
-      badges = rendered.css("span.rounded-full").select { |el| el.text.strip == "added" }
-      expect(badges).to be_empty
-    end
-  end
-end

spec/controllers/rs/oauth_controller_spec.rb

@@ -128,8 +128,8 @@ RSpec.describe Rs::OauthController, type: :controller do
             }
           end
 
-          it "redirects to the redirect_uri with the existing token" do
-            expect(response).to redirect_to("https://example.com#access_token=#{@auth.token}")
+          it "does not reuse the existing token (renders the consent dialog)" do
+            expect(response.response_code).to eq(200)
           end
         end
 
@@ -147,36 +147,66 @@ RSpec.describe Rs::OauthController, type: :controller do
             expect(response).to redirect_to("https://app.example.com#error=invalid_client")
           end
         end
+      end
 
-        context "with different redirect_uri" do
-          before do
-            get :new, params: {
-              username: user.cn,
-              scope: "documents,[photos], contacts:rw videos:r tasks/work/:r",
-              redirect_uri: "https://example.com/a_new_route",
-              client_id: "https://example.com"
-            }
-          end
-
-          it "redirects to the new redirect_uri" do
-            expect(response).to redirect_to("https://example.com/a_new_route#access_token=#{@auth.token}")
-          end
+      context "when response_type is code" do
+        before do
+          get :new, params: {
+            username: user.cn,
+            redirect_uri: "https://example.com",
+            client_id: "example.com",
+            scope: "documents",
+            response_type: "code",
+            code_challenge: "challenge123",
+            code_challenge_method: "S256",
+            state: "foobar123"
+          }
         end
 
-        context "with state param given" do
-          before do
-            get :new, params: {
-              username: user.cn,
-              scope: "documents,[photos], contacts:rw videos:r tasks/work/:r",
-              redirect_uri: "https://example.com",
-              client_id: "https://example.com",
-              state: "foobar123"
-            }
-          end
+        it "renders the consent dialog and exposes the code challenge" do
+          expect(response.response_code).to eq(200)
+          expect(assigns["response_type"]).to eq("code")
+          expect(assigns["code_challenge"]).to eq("challenge123")
+          expect(assigns["code_challenge_method"]).to eq("S256")
+        end
 
-          it "redirects to the redirect_uri with token and state" do
-            expect(response).to redirect_to("https://example.com#access_token=#{@auth.token}&state=foobar123")
-          end
+        it "uses a query-based denial url" do
+          expect(assigns["denial_url"]).to eq("https://example.com?error=access_denied&state=foobar123")
+        end
+      end
+
+      context "when response_type is code without a code_challenge" do
+        before do
+          get :new, params: {
+            username: user.cn,
+            redirect_uri: "https://example.com",
+            client_id: "example.com",
+            scope: "documents",
+            response_type: "code",
+            state: "foobar123"
+          }
+        end
+
+        it "redirects with invalid_request using a query param" do
+          expect(response).to redirect_to("https://example.com?error=invalid_request&state=foobar123")
+        end
+      end
+
+      context "when response_type is code with the plain method" do
+        before do
+          get :new, params: {
+            username: user.cn,
+            redirect_uri: "https://example.com",
+            client_id: "example.com",
+            scope: "documents",
+            response_type: "code",
+            code_challenge: "challenge123",
+            code_challenge_method: "plain"
+          }
+        end
+
+        it "redirects with invalid_request" do
+          expect(response).to redirect_to("https://example.com?error=invalid_request")
         end
       end
 
@@ -280,10 +310,12 @@ RSpec.describe Rs::OauthController, type: :controller do
     context "when user is signed in" do
       before do
         sign_in user
+        request.user_agent = "RSpec Device"
       end
 
       after do
         user.remote_storage_authorizations.destroy_all
+        RsAuthorizationCode.destroy_all
       end
 
       context "when no valid token exists" do
@@ -303,6 +335,10 @@ RSpec.describe Rs::OauthController, type: :controller do
           expect(@auth.permissions).to eq(%w(documents photos contacts:rw videos:r tasks/work:r))
         end
 
+        it "stores the device's user agent" do
+          expect(@auth.user_agent).to eq("RSpec Device")
+        end
+
         it "redirects to the redirect_uri" do
           expect(response).to redirect_to("https://example.com#access_token=#{@auth.token}&state=foobar123")
         end
@@ -412,6 +448,64 @@ RSpec.describe Rs::OauthController, type: :controller do
         end
       end
 
+      context "with response_type=code" do
+        before do
+          post :create, params: {
+            user_id: user.id,
+            scope: "documents,[photos], contacts:rw",
+            redirect_uri: "https://example.com",
+            client_id: "example.com",
+            state: "foobar123",
+            response_type: "code",
+            code_challenge: "challenge123",
+            code_challenge_method: "S256",
+            expire_at: 1.month.from_now
+          }
+          @code = RsAuthorizationCode.last
+        end
+
+        it "creates an authorization code" do
+          expect(@code.permissions).to eq(%w(documents photos contacts:rw))
+          expect(@code.code_challenge).to eq("challenge123")
+          expect(@code.code_challenge_method).to eq("S256")
+          expect(@code.user_agent).to eq("RSpec Device")
+        end
+
+        it "does not create a remote storage authorization" do
+          expect(user.reload.remote_storage_authorizations.count).to eq(0)
+        end
+
+        it "redirects with the code in the query string" do
+          location = response.location
+          expect(location).to match(%r{\Ahttps://example\.com\?code=.+&state=foobar123\z})
+
+          raw_code = CGI.parse(URI.parse(location).query)["code"].first
+          expect(RsAuthorizationCode.find_by_code(raw_code)).to eq(@code)
+        end
+      end
+
+      context "with response_type=code but no code_challenge" do
+        before do
+          post :create, params: {
+            user_id: user.id,
+            scope: "documents",
+            redirect_uri: "https://example.com",
+            client_id: "example.com",
+            state: "foobar123",
+            response_type: "code",
+            expire_at: 1.month.from_now
+          }
+        end
+
+        it "redirects with invalid_request using a query param" do
+          expect(response).to redirect_to("https://example.com?error=invalid_request&state=foobar123")
+        end
+
+        it "does not create an authorization code" do
+          expect(RsAuthorizationCode.count).to eq(0)
+        end
+      end
+
       context "when the user_id is different from the signed in user" do
         before do
           post :create, params: {
@@ -451,4 +545,81 @@ RSpec.describe Rs::OauthController, type: :controller do
       end
     end
   end
+
+  describe "POST /rs/oauth/token" do
+    # Example values from RFC 7636, Appendix B
+    let(:code_verifier)  { "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" }
+    let(:code_challenge) { "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" }
+
+    def issue_code
+      RsOauthManager::IssueCode.call(
+        user: user,
+        client_id: "example.com",
+        redirect_uri: "https://example.com",
+        permissions: %w(documents:rw),
+        code_challenge: code_challenge,
+        code_challenge_method: "S256"
+      )
+    end
+
+    def token_params(code, **overrides)
+      {
+        grant_type: "authorization_code",
+        code: code.code,
+        client_id: "https://example.com",
+        redirect_uri: "https://example.com",
+        code_verifier: code_verifier
+      }.merge(overrides)
+    end
+
+    after do
+      user.remote_storage_authorizations.destroy_all
+      RsAuthorizationCode.destroy_all
+    end
+
+    context "with a valid code" do
+      before do
+        @code = issue_code
+        post :token, params: token_params(@code)
+      end
+
+      it "returns an access token" do
+        expect(response.response_code).to eq(200)
+
+        json = JSON.parse(response.body)
+        expect(json["access_token"]).to be_present
+        expect(json["token_type"]).to eq("bearer")
+        expect(json["scope"]).to eq("documents:rw")
+      end
+
+      it "does not cache the response" do
+        expect(response.headers["Cache-Control"]).to eq("no-store")
+      end
+
+      it "sets CORS headers" do
+        expect(response.headers["Access-Control-Allow-Origin"]).to eq("*")
+      end
+    end
+
+    context "with a bad code_verifier" do
+      before do
+        @code = issue_code
+        post :token, params: token_params(@code, code_verifier: "wrong-verifier")
+      end
+
+      it "returns invalid_grant" do
+        expect(response.response_code).to eq(400)
+        expect(JSON.parse(response.body)["error"]).to eq("invalid_grant")
+      end
+    end
+
+    context "with an unsupported grant_type" do
+      before { post :token, params: { grant_type: "password" } }
+
+      it "returns unsupported_grant_type" do
+        expect(response.response_code).to eq(400)
+        expect(JSON.parse(response.body)["error"]).to eq("unsupported_grant_type")
+      end
+    end
+  end
 end

spec/controllers/services/rs_auths_controller_spec.rb

@@ -6,16 +6,18 @@ RSpec.describe Services::RsAuthsController, type: :controller do
   before do
     allow_any_instance_of(AppCatalog::WebApp).to receive(:update_metadata).and_return(true)
     allow_any_instance_of(RemoteStorageAuthorization).to receive(:remove_token_expiry_job).and_return(nil)
-    allow_any_instance_of(Flipper).to receive(:enabled?).and_return(true)
+    allow_any_instance_of(LdapService).to receive(:fetch_users).and_return([
+      { services_enabled: ["remotestorage"] }
+    ])
   end
 
-  describe "GET /services/storage/rs_auths/:id/launch_app" do
+  describe "GET /services/storage/apps/:client_id/launch (storage-first)" do
     context "when user is signed in" do
       before do
         sign_in user
       end
 
-      context "token exists" do
+      context "authorization exists" do
         before do
           @auth = user.remote_storage_authorizations.create!(
             permissions: %w(documents), client_id: "app.example.com",
@@ -23,17 +25,83 @@ RSpec.describe Services::RsAuthsController, type: :controller do
             expire_at: 2.days.from_now
           )
 
-          get :launch_app, params: { id: @auth.id }
+          get :launch_app, params: { client_id: @auth.client_id }
         end
 
         after do
           @auth.destroy
         end
 
-        it "redirects to the given URL with the correct RS URL fragment params" do
+        it "hands the app the user address in the URL fragment" do
           launch_url = "https://app.example.com#remotestorage=#{user.address}"
           expect(response).to redirect_to(launch_url)
         end
+
+        it "does not hand over an access token" do
+          expect(response.location).not_to include("access_token")
+        end
+      end
+
+      context "when remoteStorage is not enabled for the user" do
+        before do
+          allow_any_instance_of(LdapService).to receive(:fetch_users).and_return([
+            { services_enabled: [] }
+          ])
+
+          get :launch_app, params: { client_id: "app.example.com" }
+        end
+
+        it "responds with forbidden" do
+          expect(response).to have_http_status(:forbidden)
+        end
+      end
+    end
+  end
+
+  describe "GET /services/storage/apps/:client_id/launch for an unknown app" do
+    before { sign_in user }
+
+    it "returns 404 instead of raising" do
+      get :launch_app, params: { client_id: "nonexistent.example.com" }
+
+      expect(response).to have_http_status(:not_found)
+    end
+  end
+
+  describe "DELETE /services/storage/rs_auths/:id" do
+    context "when user is signed in" do
+      before { sign_in user }
+
+      it "revokes the authorization" do
+        auth = user.remote_storage_authorizations.create!(
+          permissions: %w(documents), client_id: "app.example.com",
+          redirect_uri: "https://app.example.com", expire_at: 2.days.from_now
+        )
+
+        expect {
+          delete :destroy, params: { id: auth.id }
+        }.to change(RemoteStorageAuthorization, :count).by(-1)
+
+        expect(response).to redirect_to(apps_services_storage_url)
+      end
+
+      it "returns 404 for an unknown authorization" do
+        delete :destroy, params: { id: 0 }
+
+        expect(response).to have_http_status(:not_found)
+      end
+
+      it "returns 404 for another user's authorization" do
+        other = create :user, id: 99, cn: "otheruser", email: "other@example.com"
+        auth = other.remote_storage_authorizations.create!(
+          permissions: %w(documents), client_id: "app.example.com",
+          redirect_uri: "https://app.example.com"
+        )
+
+        delete :destroy, params: { id: auth.id }
+
+        expect(response).to have_http_status(:not_found)
+        expect(RemoteStorageAuthorization.exists?(auth.id)).to be(true)
       end
     end
   end

spec/features/rs/oauth_spec.rb

@@ -44,11 +44,29 @@ RSpec.describe 'remoteStorage OAuth Dialog', type: :feature do
 
         it "shows a special permission for all files and dirs" do
           within ".scope" do
-            expect(page).to have_content("All files and directories")
+            expect(page).to have_content("All categories and files")
           end
         end
       end
     end
+
+    context "with PKCE parameters" do
+      before do
+        visit new_rs_oauth_path(username: user.cn,
+                                redirect_uri: "http://example.com",
+                                client_id: "http://example.com",
+                                scope: "documents:rw",
+                                response_type: "code",
+                                code_challenge: "challenge123",
+                                code_challenge_method: "S256")
+      end
+
+      it "includes the PKCE parameters in the consent form" do
+        expect(page).to have_selector("input[name='response_type'][value='code']", visible: false)
+        expect(page).to have_selector("input[name='code_challenge'][value='challenge123']", visible: false)
+        expect(page).to have_selector("input[name='code_challenge_method'][value='S256']", visible: false)
+      end
+    end
   end
 
   context "when signed out" do

spec/features/services/rs_auths_spec.rb

@@ -0,0 +1,122 @@
+require 'rails_helper'
+
+RSpec.describe "Storage connected apps", type: :feature do
+  let(:user) { create :user }
+
+  let(:firefox_ua) do
+    "Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0"
+  end
+
+  let(:chrome_ua) do
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 " \
+    "(KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
+  end
+
+  before do
+    allow_any_instance_of(AppCatalog::WebApp).to receive(:update_metadata).and_return(true)
+    allow_any_instance_of(RemoteStorageAuthorization).to receive(:remove_token_expiry_job).and_return(nil)
+    allow_any_instance_of(User).to receive(:ldap_entry).and_return(
+      uid: user.cn, ou: user.ou, mail: user.email, admin: nil,
+      services_enabled: ["remotestorage"]
+    )
+    login_as user, scope: :user
+  end
+
+  def create_auth(client:, device:, permissions: %w(documents:rw))
+    user.remote_storage_authorizations.create!(
+      permissions: permissions,
+      client_id: client,
+      redirect_uri: "https://#{client}",
+      expire_at: 1.month.from_now,
+      user_agent: device
+    )
+  end
+
+  context "with a connected app" do
+    before do
+      AppCatalog::WebApp.create!(url: "https://notes.example.com", name: "Notes", metadata: {})
+    end
+
+    let!(:auth) do
+      create_auth(client: "notes.example.com", device: firefox_ua,
+                  permissions: %w(documents:rw photos:r))
+    end
+
+    after { auth.destroy }
+
+    it "shows the app with device and category counts" do
+      visit apps_services_storage_path
+
+      within ".rs-auth-card" do
+        expect(page).to have_content("Notes")
+        expect(page).to have_content("notes.example.com")
+        expect(page).to have_content("1 device")
+        expect(page).to have_content("2 categories")
+      end
+    end
+
+    it "does not show the permission expiry on the card" do
+      visit apps_services_storage_path
+
+      within ".rs-auth-card" do
+        expect(page).not_to have_content("Expires")
+      end
+    end
+
+    it "renders access and per-token details in the modal" do
+      visit apps_services_storage_path
+
+      expect(page).to have_selector("p.scope", text: "documents", visible: false)
+      expect(page).to have_selector("p.scope", text: "photos", visible: false)
+      expect(page).to have_selector("h5", text: "Connected devices", visible: false)
+      expect(page).to have_selector("p", text: "Firefox on Linux", visible: false)
+      expect(page).to have_selector("p", text: /Expires/, visible: false)
+      expect(page).to have_button("Revoke access", visible: false)
+      expect(page).to have_link("Launch app", visible: false)
+    end
+  end
+
+  context "with multiple apps" do
+    let!(:notes)  { create_auth(client: "notes.example.com", device: firefox_ua) }
+    let!(:photos) { create_auth(client: "photos.example.com", device: firefox_ua) }
+
+    after do
+      notes.destroy
+      photos.destroy
+    end
+
+    it "shows one card per app" do
+      visit apps_services_storage_path
+
+      expect(page).to have_selector(".rs-auth-card", count: 2)
+    end
+  end
+
+  context "with one app on multiple devices" do
+    let!(:laptop) { create_auth(client: "notes.example.com", device: firefox_ua) }
+    let!(:phone)  { create_auth(client: "notes.example.com", device: chrome_ua) }
+
+    after do
+      laptop.destroy
+      phone.destroy
+    end
+
+    it "shows a single card with the device count" do
+      visit apps_services_storage_path
+
+      expect(page).to have_selector(".rs-auth-card", count: 1)
+
+      within ".rs-auth-card" do
+        expect(page).to have_content("2 devices")
+      end
+    end
+  end
+
+  context "without connected apps" do
+    it "shows the empty state" do
+      visit apps_services_storage_path
+
+      expect(page).to have_content("No apps connected")
+    end
+  end
+end

spec/models/remote_storage_authorization_spec.rb

@@ -12,7 +12,6 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
 
   describe "#create" do
     after(:each) { clear_enqueued_jobs }
-    after(:all)  { redis_rs_delete_keys("authorizations:*") }
 
     let(:auth) do
       user.remote_storage_authorizations.create!(
@@ -27,10 +26,9 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
     end
 
     it "stores a token in redis" do
-      user_auth_keys = redis_rs.keys("authorizations:#{user.cn}:*")
-      expect(user_auth_keys.length).to eq(1)
+      auth
 
-      authorizations = redis_rs.smembers(user_auth_keys.first)
+      authorizations = redis_rs.smembers("authorizations:#{user.cn}:#{auth.token}")
       expect(authorizations.sort).to eq(%w(documents photos contacts:rw videos:r tasks/work:r).sort)
     end
 
@@ -49,7 +47,6 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
 
   describe "#destroy" do
     after(:each) { clear_enqueued_jobs }
-    after(:all)  { redis_rs_delete_keys("authorizations:*") }
 
     it "removes the token from redis" do
       auth = user.remote_storage_authorizations.create!(
@@ -59,7 +56,7 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
              )
       auth.destroy!
 
-      expect(redis_rs.keys("authorizations:#{user.address}:*")).to be_empty
+      expect(redis_rs.exists?("authorizations:#{user.cn}:#{auth.token}")).to be(false)
     end
 
     context "with expiry set" do
@@ -79,8 +76,6 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
 
   describe "#find_or_create_web_app" do
     context "with origin that looks hosted" do
-      after(:all)  { redis_rs_delete_keys("authorizations:*") }
-
       let(:auth) do
         user.remote_storage_authorizations.create!(
           permissions: %w(documents:rw),
@@ -173,8 +168,6 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
   end
 
   describe "#launch_url" do
-    after(:all) { redis_rs_delete_keys("authorizations:*") }
-
     context "without start URL" do
       before do
         AppCatalog::WebApp.create!(
@@ -250,7 +243,6 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
     include ActiveJob::TestHelper
 
     after(:each) { clear_enqueued_jobs }
-    after(:all)  { redis_rs_delete_keys("authorizations:*") }
 
     before { allow(user).to receive(:display_name).and_return("Jimmy") }
 
@@ -311,4 +303,73 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
       end
     end
   end
+  describe "#expired?" do
+    def auth_with_expiry(expire_at)
+      RemoteStorageAuthorization.new(
+        user: user, permissions: %w(documents:rw), client_id: "example.com",
+        redirect_uri: "https://example.com", expire_at: expire_at
+      )
+    end
+
+    it "is false without an expiry" do
+      expect(auth_with_expiry(nil)).not_to be_expired
+    end
+
+    it "is false before the expiry" do
+      expect(auth_with_expiry(1.day.from_now)).not_to be_expired
+    end
+
+    it "is true after the expiry" do
+      expect(auth_with_expiry(1.day.ago)).to be_expired
+    end
+  end
+
+  describe "#device_name" do
+    def auth_with_user_agent(user_agent)
+      RemoteStorageAuthorization.new(user: user, user_agent: user_agent)
+    end
+
+    it "returns nil without a user agent" do
+      expect(auth_with_user_agent(nil).device_name).to be_nil
+    end
+
+    it "recognizes Firefox on Linux" do
+      ua = "Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0"
+      expect(auth_with_user_agent(ua).device_name).to eq("Firefox on Linux")
+    end
+
+    it "recognizes Chrome on macOS" do
+      ua = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 " \
+           "(KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
+      expect(auth_with_user_agent(ua).device_name).to eq("Chrome on macOS")
+    end
+
+    it "recognizes Mobile Safari on iOS" do
+      ua = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) " \
+           "AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1"
+      expect(auth_with_user_agent(ua).device_name).to eq("Mobile Safari on iOS")
+    end
+
+    it "recognizes GNOME Web on Linux (Epiphany's Safari-like user agent)" do
+      ua = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/605.1.15 (KHTML, like Gecko) " \
+           "Version/16.0 Safari/605.1.15 Epiphany/45.0"
+      expect(auth_with_user_agent(ua).device_name).to eq("GNOME Web on Linux")
+    end
+
+    it "treats a WebKit Safari user agent on Linux as WebKit (WebKitGTK)" do
+      ua = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/605.1.15 (KHTML, like Gecko) " \
+           "Version/60.5 Safari/605.1.15"
+      expect(auth_with_user_agent(ua).device_name).to eq("WebKit on Linux")
+    end
+
+    it "keeps Safari on macOS as Safari" do
+      ua = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 " \
+           "(KHTML, like Gecko) Version/17.1 Safari/605.1.15"
+      expect(auth_with_user_agent(ua).device_name).to eq("Safari on macOS")
+    end
+
+    it "falls back to the browser when the OS is unknown" do
+      expect(auth_with_user_agent("Firefox/120.0").device_name).to eq("Firefox")
+    end
+  end
 end

spec/models/rs_authorization_code_spec.rb

@@ -0,0 +1,65 @@
+require 'rails_helper'
+
+RSpec.describe RsAuthorizationCode, type: :model do
+  let(:user) { create :user }
+
+  def build_code(**attrs)
+    RsAuthorizationCode.create!(
+      user: user,
+      client_id: "example.com",
+      redirect_uri: "https://example.com",
+      permissions: %w(documents:rw),
+      code_challenge: "challenge",
+      **attrs
+    )
+  end
+
+  describe "#create" do
+    it "generates a raw code and stores only its digest" do
+      code = build_code
+
+      expect(code.code).to be_present
+      expect(code.code_digest).to eq(Digest::SHA256.hexdigest(code.code))
+    end
+
+    it "sets a short expiry" do
+      code = build_code
+
+      expect(code.expires_at).to be_within(5.seconds).of(60.seconds.from_now)
+    end
+  end
+
+  describe ".find_by_code" do
+    it "finds a code by its raw value" do
+      code = build_code
+
+      expect(RsAuthorizationCode.find_by_code(code.code)).to eq(code)
+    end
+
+    it "returns nil for an unknown code" do
+      expect(RsAuthorizationCode.find_by_code("does-not-exist")).to be_nil
+    end
+
+    it "returns nil for a blank code" do
+      expect(RsAuthorizationCode.find_by_code(nil)).to be_nil
+    end
+  end
+
+  describe "#expired?" do
+    it "is false before the expiry" do
+      expect(build_code).not_to be_expired
+    end
+
+    it "is true after the expiry" do
+      expect(build_code(expires_at: 1.minute.ago)).to be_expired
+    end
+  end
+
+  describe "#consume!" do
+    it "destroys the record" do
+      code = build_code
+
+      expect { code.consume! }.to change(RsAuthorizationCode, :count).by(-1)
+    end
+  end
+end

spec/requests/rs/oauth_spec.rb

@@ -0,0 +1,57 @@
+require 'rails_helper'
+
+RSpec.describe "remoteStorage OAuth token endpoint", type: :request do
+  let(:user) { create :user }
+
+  # Example values from RFC 7636, Appendix B
+  let(:code_verifier)  { "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" }
+  let(:code_challenge) { "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" }
+
+  before do
+    allow_any_instance_of(AppCatalog::WebApp).to receive(:update_metadata).and_return(true)
+    allow_any_instance_of(RemoteStorageAuthorization).to receive(:remove_token_expiry_job).and_return(nil)
+  end
+
+  after do
+    user.remote_storage_authorizations.destroy_all
+    RsAuthorizationCode.destroy_all
+  end
+
+  def issue_code
+    RsOauthManager::IssueCode.call(
+      user: user,
+      client_id: "example.com",
+      redirect_uri: "https://example.com",
+      permissions: %w(documents:rw),
+      code_challenge: code_challenge,
+      code_challenge_method: "S256"
+    )
+  end
+
+  it "exchanges a code for an access token without a session" do
+    code = issue_code
+
+    post "/rs/oauth/token", params: {
+      grant_type: "authorization_code",
+      code: code.code,
+      client_id: "https://example.com",
+      redirect_uri: "https://example.com",
+      code_verifier: code_verifier
+    }
+
+    expect(response).to have_http_status(:ok)
+    expect(response.media_type).to eq("application/json")
+
+    json = JSON.parse(response.body)
+    expect(json["access_token"]).to be_present
+    expect(json["token_type"]).to eq("bearer")
+    expect(response.headers["Access-Control-Allow-Origin"]).to eq("*")
+  end
+
+  it "answers CORS preflight requests" do
+    options "/rs/oauth/token"
+
+    expect(response).to have_http_status(:ok)
+    expect(response.headers["Access-Control-Allow-Methods"]).to include("POST")
+  end
+end

spec/requests/webfinger_spec.rb

@@ -133,6 +133,15 @@ RSpec.describe "WebFinger", type: :request do
 
           oauth_url = rs_link["properties"]["http://tools.ietf.org/html/rfc6749#section-4.2"]
           expect(oauth_url).to eql("http://localhost/rs/oauth/tony")
+
+          authorization_url = rs_link["properties"]["http://tools.ietf.org/html/rfc6749#section-3.1"]
+          expect(authorization_url).to eql("http://localhost/rs/oauth/tony")
+
+          token_url = rs_link["properties"]["http://tools.ietf.org/html/rfc6749#section-3.2"]
+          expect(token_url).to eql("http://localhost/rs/oauth/token")
+
+          expect(rs_link["properties"]["http://tools.ietf.org/html/rfc7636"]).to eql("S256")
+          expect(rs_link["properties"]["http://remotestorage.io/spec/version"]).to eql("draft-dejong-remotestorage-27")
         end
 
         it "returns CORS headers" do

spec/services/nostr_manager/fetch_latest_event_spec.rb

@@ -1,88 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe NostrManager::FetchLatestEvent, type: :model do
-  let(:filter) { Nostr::Filter.new(authors: ["pubkey"], kinds: [0], limit: 1) }
-  let(:event_v1) { { "id" => "aaa", "created_at" => 1000, "content" => "v1" } }
-  let(:event_v2) { { "id" => "bbb", "created_at" => 2000, "content" => "v2" } }
-
-  describe "with no events found" do
-    it "returns nil" do
-      allow(NostrManager::FetchEvent).to receive(:call).and_return(nil)
-
-      result = described_class.call(relays: ["wss://a", "wss://b"], filter: filter)
-      expect(result).to be_nil
-    end
-  end
-
-  describe "with event on 1 relay only" do
-    it "returns the event" do
-      allow(NostrManager::FetchEvent).to receive(:call) do |args|
-        case args[:relay_url]
-        when "wss://a" then event_v1
-        else nil
-        end
-      end
-
-      result = described_class.call(
-        relays: ["wss://a", "wss://b", "wss://c"], filter: filter
-      )
-      expect(result).to eq(event_v1)
-    end
-  end
-
-  describe "with events on 2 relays, different versions" do
-    it "returns the latest event (max created_at)" do
-      allow(NostrManager::FetchEvent).to receive(:call) do |args|
-        case args[:relay_url]
-        when "wss://a" then event_v1
-        when "wss://b" then event_v2
-        end
-      end
-
-      result = described_class.call(relays: ["wss://a", "wss://b"], filter: filter)
-      expect(result).to eq(event_v2)
-    end
-  end
-
-  describe "with duplicate events (same ID) on 2 relays" do
-    it "returns the single event without double-counting" do
-      allow(NostrManager::FetchEvent).to receive(:call).and_return(event_v1)
-
-      result = described_class.call(relays: ["wss://a", "wss://b"], filter: filter)
-      expect(result).to eq(event_v1)
-    end
-  end
-
-  describe "with timeout after finding 1 event" do
-    it "still returns the found event" do
-      allow(NostrManager::FetchEvent).to receive(:call) do |args|
-        case args[:relay_url]
-        when "wss://a" then event_v1
-        when "wss://b" then raise Timeout::Error
-        end
-      end
-
-      result = described_class.call(relays: ["wss://a", "wss://b"], filter: filter)
-      expect(result).to eq(event_v1)
-    end
-  end
-
-  describe "with max_events reached" do
-    it "stops querying further relays" do
-      call_count = 0
-      allow(NostrManager::FetchEvent).to receive(:call) do |args|
-        call_count += 1
-        raise "should not query wss://c" if args[:relay_url] == "wss://c"
-        case args[:relay_url]
-        when "wss://a" then event_v1
-        when "wss://b" then event_v2
-        end
-      end
-
-      described_class.call(
-        relays: ["wss://a", "wss://b", "wss://c"], filter: filter
-      )
-      expect(call_count).to eq(2)
-    end
-  end
-end

spec/services/rs_oauth_manager/exchange_code_spec.rb

@@ -0,0 +1,105 @@
+require 'rails_helper'
+
+RSpec.describe RsOauthManager::ExchangeCode do
+  let(:user) { create :user }
+
+  # Example values from RFC 7636, Appendix B
+  let(:code_verifier)  { "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" }
+  let(:code_challenge) { "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" }
+
+  before do
+    allow_any_instance_of(AppCatalog::WebApp).to receive(:update_metadata).and_return(true)
+    allow_any_instance_of(RemoteStorageAuthorization).to receive(:remove_token_expiry_job).and_return(nil)
+  end
+
+  def issue_code(**overrides)
+    RsOauthManager::IssueCode.call(
+      user: user,
+      client_id: "example.com",
+      redirect_uri: "https://example.com",
+      permissions: %w(documents:rw),
+      code_challenge: code_challenge,
+      code_challenge_method: "S256",
+      user_agent: "RSpec Device",
+      **overrides
+    )
+  end
+
+  def exchange(code, **overrides)
+    described_class.call(
+      code: code.code,
+      client_id: "https://example.com",
+      redirect_uri: "https://example.com",
+      code_verifier: code_verifier,
+      **overrides
+    )
+  end
+
+  it "creates an authorization and consumes the code" do
+    code = issue_code
+    auth = nil
+
+    expect { auth = exchange(code) }.to change(RemoteStorageAuthorization, :count).by(1)
+
+    expect(auth.permissions).to eq(%w(documents:rw))
+    expect(auth.client_id).to eq("example.com")
+    expect(auth.token).to be_present
+    expect(auth.user_agent).to eq("RSpec Device")
+    expect(RsAuthorizationCode.exists?(code.id)).to be(false)
+  end
+
+  it "carries over the permission expiry" do
+    expire_at = 1.month.from_now
+    code = issue_code(expire_at: expire_at)
+
+    auth = exchange(code)
+
+    expect(auth.expire_at).to be_within(1.second).of(expire_at)
+  end
+
+  it "rejects an unknown code" do
+    expect do
+      described_class.call(
+        code: "unknown",
+        client_id: "https://example.com",
+        redirect_uri: "https://example.com",
+        code_verifier: code_verifier
+      )
+    end.to raise_error(RsOauthManagerService::InvalidGrant)
+  end
+
+  it "rejects a reused code" do
+    code = issue_code
+    exchange(code)
+
+    expect { exchange(code) }.to raise_error(RsOauthManagerService::InvalidGrant)
+  end
+
+  it "rejects an expired code" do
+    code = issue_code
+    code.update_columns(expires_at: 1.minute.ago)
+
+    expect { exchange(code) }.to raise_error(RsOauthManagerService::InvalidGrant)
+  end
+
+  it "rejects a mismatching redirect_uri" do
+    code = issue_code
+
+    expect { exchange(code, redirect_uri: "https://example.com/other") }
+      .to raise_error(RsOauthManagerService::InvalidGrant)
+  end
+
+  it "rejects a mismatching client_id host" do
+    code = issue_code
+
+    expect { exchange(code, client_id: "https://evil.example.org") }
+      .to raise_error(RsOauthManagerService::InvalidGrant)
+  end
+
+  it "rejects a bad code_verifier" do
+    code = issue_code
+
+    expect { exchange(code, code_verifier: "wrong-verifier") }
+      .to raise_error(RsOauthManagerService::InvalidGrant)
+  end
+end

spec/services/rs_oauth_manager/issue_code_spec.rb

@@ -0,0 +1,31 @@
+require 'rails_helper'
+
+RSpec.describe RsOauthManager::IssueCode do
+  let(:user) { create :user }
+
+  subject do
+    described_class.call(
+      user: user,
+      client_id: "example.com",
+      redirect_uri: "https://example.com",
+      permissions: %w(documents:rw),
+      code_challenge: "challenge",
+      code_challenge_method: "S256",
+      expire_at: 1.month.from_now,
+      user_agent: "RSpec Device"
+    )
+  end
+
+  it "creates a short-lived authorization code" do
+    expect { subject }.to change(RsAuthorizationCode, :count).by(1)
+    expect(subject.code).to be_present
+    expect(subject.client_id).to eq("example.com")
+    expect(subject.permissions).to eq(%w(documents:rw))
+    expect(subject.code_challenge).to eq("challenge")
+    expect(subject.user_agent).to eq("RSpec Device")
+  end
+
+  it "does not create a remote storage authorization" do
+    expect { subject }.not_to change(RemoteStorageAuthorization, :count)
+  end
+end

spec/services/rs_oauth_manager/verify_pkce_spec.rb

@@ -0,0 +1,41 @@
+require 'rails_helper'
+
+RSpec.describe RsOauthManager::VerifyPkce do
+  # Example values from RFC 7636, Appendix B
+  let(:code_verifier)  { "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" }
+  let(:code_challenge) { "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" }
+
+  subject do
+    described_class.call(
+      code_challenge: code_challenge,
+      code_challenge_method: code_challenge_method,
+      code_verifier: code_verifier
+    )
+  end
+
+  context "with the S256 method" do
+    let(:code_challenge_method) { "S256" }
+
+    it "accepts a matching verifier" do
+      expect(subject).to be(true)
+    end
+
+    it "rejects a non-matching verifier" do
+      expect(
+        described_class.call(
+          code_challenge: code_challenge,
+          code_challenge_method: "S256",
+          code_verifier: "wrong-verifier"
+        )
+      ).to be(false)
+    end
+  end
+
+  context "with an unsupported method" do
+    let(:code_challenge_method) { "plain" }
+
+    it "rejects the verifier" do
+      expect(subject).to be(false)
+    end
+  end
+end

spec/support/helpers/redis_helper.rb

@@ -1,8 +1,3 @@
 def redis_rs
   @redis_rs ||= Redis.new(url: Setting.rs_redis_url)
 end
-
-def redis_rs_delete_keys(pattern)
-  keys = redis_rs.keys(pattern)
-  redis_rs.del(*keys)
-end