* Add REST API for creating an account
The method is available to apps with a token obtained via the client
credentials grant. It creates a user and account records, as well as
an access token for the app that initiated the request. The user is
unconfirmed, and an e-mail is sent as usual.
The method returns the access token, which the app should save for
later. The REST API is not available to users with unconfirmed
accounts, so the app must be smart to wait for the user to click a
link in their e-mail inbox.
The method is rate-limited by IP to 5 requests per 30 minutes.
* Redirect users back to app from confirmation if they were created with an app
* Add tests
* Return 403 on the method if registrations are not open
* Require agreement param to be true in the API when creating an account
This allowed you to brick your system when running that command, because the accounts would continue to advertise the old public key, but sign things with the new one
Just the color is not enough change since not everyone uses colored
terminals.
Touching the account makes it so that the account is not in the
threshold window in case of running again
Leave `tootctl accounts cull` to simply check removed accounts from
live domains, and skip temporarily unavailable domains, while listing
them in the final output for further action.
Add `tootctl domains purge DOMAIN` to be able to purge a domain from
that list manually
* Move more tasks to tootctl
- tootctl feeds build
- tootctl feeds clear
- tootctl accounts refresh
Clean up exit codes and help messages
* Move user modifying to tootctl
* Improve user modification through CLI, rename commands
add -> create
mod -> modify
del -> delete
To remove ambiguity
* Fix code style issues
* Fix not being able to unset admin/mod role
* If an Update is signed with known key, skip re-following procedure
Because it means the remote actor did *not* lose their database
* Add CLI method for rotating keys
bin/tootctl accounts rotate [USERNAME]
Generates a new RSA key per account and sends out an Update activity
signed with the old key.
* Key rotation: Space out Update fan-outs every 5 minutes per 1000 accounts
* Skip suspended accounts in key rotation
Eugen Rochko