dckc/captoys

0 Fork 0

Files

T

Connolly 126aab5cbe feat(diigo-dump): session-cookie dump worker, manual test passing

Port of mm-diigo/projects/diigo-bak/diigo-dump.mjs as a Cloudflare Worker:
one page-number field + button, GET interact_api/load_user_items
(sort=updated, count=24) with DIIGO_COOKIE as a Worker secret.
GET / is inert; dumps happen only on POST submit.

Manual integration testing (local wrangler dev, port 8788, 2026-10-06)
shows it works: status 200, total 1674 bookmarks, page-1 items returned.
The browser-session-cookie path authenticates; the static API-key path
(diigo-ping worker, EmDash plugin) is still rejected by Diigo (401).

Also: project checklist (capsite-checklist.md) with step results, and a
.gitignore for local artifacts (.dev.vars, node_modules, wrangler state).

Generated-by: opencode (GLM)

2026-10-06 21:33:25 -05:00

3.0 KiB

Raw Blame History

capsite checklist

Goal ladder toward "EmDash site collecting diigo.com bookmarks with the API key held by the host, never inside the plugin" (see capsite-notes.md). Start small; each step must pass before moving down.

1. Plain worker ping (diigo-ping/): a Cloudflare Worker with one ping button that calls https://www.diigo.com/api/v2/bookmarks with HTTP Basic auth (username:apiKey) and shows the raw result in a <pre>. Secrets from .dev.vars locally / wrangler secret put deployed. Win: page shows status: 200 ok and real bookmark JSON. Result (2026-10-06): worker runs; Diigo returns 401 with the current key/username pair — API-key path not yet authenticated.
1b. Cookie-path dump worker (diigo-dump/): port of mm-diigo/projects/diigo-bak/diigo-dump.mjs — one page-number field + button, GET interact_api/load_user_items?sort=updated&count=24&page_num=N with the browser session cookie (DIIGO_COOKIE secret). Result (2026-10-06): manual integration test PASSES — status 200, total: 1674, page-1 items returned. GET / is inert; dump only on POST submit. The session-cookie / interact_api path works while the API-key path is rejected.
2. Real credentials in madmode/.dev.vars: replace the placeholder DIIGO_API_KEY="dckc-madmode" with a key from https://www.diigo.com/settings/api; confirm the EmDash plugin's "Sync now" returns success (status 200, bookmarks stored).
3. /bookmarks page renders real data after a sync — titles/tags visible at http://localhost:4321/bookmarks.
4. Cron sync works locally without errors (0 */6 * * * task in _emdash_cron_tasks).
5. Deploy: madmode to Workers pnpm wrangler deploy, secrets via wrangler secret put; ping page then plugin "Sync now" against prod.
6. bib sync #195: repeat the pattern for the next read-access need.

Step 1 how-to: diigo-ping

cd diigo-ping
printf 'DIIGO_API_KEY="dckc-madmode"\nDIIGO_USERNAME="6edadc55c0329434"\n' > .dev.vars
npx wrangler dev            # → http://localhost:8787

Click the button; expected right now (same credentials as the plugin): Diigo 401 ... "HTTP Basic: Access denied". If even the standalone worker can't authenticate, the credentials are wrong, not the plugin wiring.

Note: Diigo 301s secure.diigo.com → www.diigo.com; fetch follows the redirect, and the Authorization header survives host-to-host here — if Diigo ever strips it, switch the URL to www.diigo.com explicitly.

cd diigo-dump
# .dev.vars: DIIGO_COOKIE="<paste Cookie header from diigo.com devtools>"
npx wrangler dev --port 8788   # → http://localhost:8788
wrangler restarts pick up .dev.vars edits only at startup

Enter a page number, click dump → status + total + JSON items. GET / is inert (no accidental fetches); dumps happen only on POST submits.

3.0 KiB Raw Blame History

capsite checklist

Step 1 how-to: diigo-ping

Step 1b how-to: diigo-dump (session-cookie path)

3.0 KiB

Raw Blame History