From 945de95fd3a5c4a32881485d9d84033feb87a793 Mon Sep 17 00:00:00 2001 From: Connolly Date: Tue, 6 Oct 2026 23:36:18 -0500 Subject: [PATCH] docs: API-key path marked dead per prior-session evidence ses_eec320fe4ffehaMAn44U1nTKJU verified both real keys, all documented auth schemes, and two endpoints -> 401 unconditionally, with historical proof the same creds worked in 2024-2025 (13.5k bookmarks downloaded). Goal 2 is now 'plugin rides the webapp cookie path', with the cookie- rotation cost explicit (2-iii); the earlier DECISION POINT framing ('try a real key') contradicted that record and is removed. Generated-by: opencode (GLM) --- capsite-checklist.md | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/capsite-checklist.md b/capsite-checklist.md index 74a323e..c16176f 100644 --- a/capsite-checklist.md +++ b/capsite-checklist.md @@ -33,17 +33,21 @@ it has passed verification itself). Working notes live under each goal; - [ ] 1b-ii. Prod mint + handoff: deploy both, mint against prod, `wrangler secret put DIIGO_WEB_ID`, dump a page. - - [ ] **2. madmode collects real bookmarks** (the API-key path) - - [ ] 2-i. Real API key: fetch from - https://www.diigo.com/settings/api; put in - `madmode/.dev.vars` (placeholder now; 401s). + - [ ] **2. madmode collects real bookmarks via the webapp cookie path** + (API-key path is DEAD — verified in session + ses_eec320fe4ffehaMAn44U1nTKJU: both known real keys, all + documented schemes (key= param, key+user=, HTTP Basic), both + /api/v2/bookmarks and /api/v2/notes → 401 unconditionally, with + 2024–2025 historical proof the same creds once downloaded 13.5k + bookmarks. Diigo deprecated/revoked v2 key auth; the session- + cookie /interact_api channel is the one that works.) + - [ ] 2-i. Plugin rides the webapp DO: plugin's sync calls + diigo-dump's DiigoBridge (or the instance id directly); + cookie + host gate stay host-side. - [ ] 2-ii. Plugin "Sync now" succeeds: status 200, bookmarks stored (admin at /_emdash/admin → Diigo Sync). - - [ ] 2-iii. DECISION POINT: if the API-key path stays 401, - consider riding the plugin on the webapp cookie path - instead (plugin already declares the host gate; the DO - would hold the cookie). Prefer the API key if it works — - a static key beats a session cookie for cron. + - [ ] 2-iii. Cookie-expiry story for cron: rotation is manual + (re-mint via /_connect) unless we automate it later. - [ ] **3. `/bookmarks` renders real data** after a sync — titles/tags at http://localhost:4321/bookmarks. - [ ] **4. Cron sync** works locally without errors (`0 */6 * * *` in