Connolly
126aab5cbe
Port of mm-diigo/projects/diigo-bak/diigo-dump.mjs as a Cloudflare Worker: one page-number field + button, GET interact_api/load_user_items (sort=updated, count=24) with DIIGO_COOKIE as a Worker secret. GET / is inert; dumps happen only on POST submit. Manual integration testing (local wrangler dev, port 8788, 2026-10-06) shows it works: status 200, total 1674 bookmarks, page-1 items returned. The browser-session-cookie path authenticates; the static API-key path (diigo-ping worker, EmDash plugin) is still rejected by Diigo (401). Also: project checklist (capsite-checklist.md) with step results, and a .gitignore for local artifacts (.dev.vars, node_modules, wrangler state). Generated-by: opencode (GLM)
60 lines
3.0 KiB
Markdown
60 lines
3.0 KiB
Markdown
# capsite checklist
|
|
|
|
Goal ladder toward "EmDash site collecting diigo.com bookmarks with the API key
|
|
held by the host, never inside the plugin" (see capsite-notes.md).
|
|
Start small; each step must pass before moving down.
|
|
|
|
- [x] **1. Plain worker ping** (`diigo-ping/`): a Cloudflare Worker with one
|
|
ping button that calls `https://www.diigo.com/api/v2/bookmarks` with HTTP
|
|
Basic auth (`username:apiKey`) and shows the raw result in a `<pre>`.
|
|
Secrets from `.dev.vars` locally / `wrangler secret put` deployed.
|
|
**Win:** page shows `status: 200 ok` and real bookmark JSON.
|
|
**Result (2026-10-06):** worker runs; Diigo returns 401 with the current
|
|
key/username pair — API-key path not yet authenticated.
|
|
- [x] **1b. Cookie-path dump worker** (`diigo-dump/`): port of
|
|
`mm-diigo/projects/diigo-bak/diigo-dump.mjs` — one page-number field +
|
|
button, GET `interact_api/load_user_items?sort=updated&count=24&page_num=N`
|
|
with the browser session cookie (`DIIGO_COOKIE` secret).
|
|
**Result (2026-10-06):** manual integration test PASSES —
|
|
status 200, `total: 1674`, page-1 items returned. GET / is inert; dump
|
|
only on POST submit. The session-cookie / interact_api path works while
|
|
the API-key path is rejected.
|
|
- [ ] **2. Real credentials in madmode/.dev.vars**: replace the placeholder
|
|
`DIIGO_API_KEY="dckc-madmode"` with a key from
|
|
https://www.diigo.com/settings/api; confirm the EmDash plugin's
|
|
"Sync now" returns success (status 200, bookmarks stored).
|
|
- [ ] **3. `/bookmarks` page renders real data** after a sync — titles/tags
|
|
visible at `http://localhost:4321/bookmarks`.
|
|
- [ ] **4. Cron sync works** locally without errors (`0 */6 * * *` task in
|
|
`_emdash_cron_tasks`).
|
|
- [ ] **5. Deploy**: madmode to Workers `pnpm wrangler deploy`, secrets via
|
|
`wrangler secret put`; ping page then plugin "Sync now" against prod.
|
|
- [ ] **6. bib sync #195**: repeat the pattern for the next read-access need.
|
|
|
|
## Step 1 how-to: diigo-ping
|
|
|
|
```bash
|
|
cd diigo-ping
|
|
printf 'DIIGO_API_KEY="dckc-madmode"\nDIIGO_USERNAME="6edadc55c0329434"\n' > .dev.vars
|
|
npx wrangler dev # → http://localhost:8787
|
|
```
|
|
|
|
Click the button; expected right now (same credentials as the plugin):
|
|
Diigo `401 ... "HTTP Basic: Access denied"`. If even the standalone worker
|
|
can't authenticate, the credentials are wrong, not the plugin wiring.
|
|
|
|
Note: Diigo 301s `secure.diigo.com` → `www.diigo.com`; fetch follows the
|
|
redirect, and the Authorization header survives host-to-host here — if Diigo
|
|
ever strips it, switch the URL to `www.diigo.com` explicitly.
|
|
|
|
## Step 1b how-to: diigo-dump (session-cookie path)
|
|
|
|
```bash
|
|
cd diigo-dump
|
|
# .dev.vars: DIIGO_COOKIE="<paste Cookie header from diigo.com devtools>"
|
|
npx wrangler dev --port 8788 # → http://localhost:8788
|
|
wrangler restarts pick up .dev.vars edits only at startup
|
|
```
|
|
|
|
Enter a page number, click dump → status + `total` + JSON items. GET `/` is
|
|
inert (no accidental fetches); dumps happen only on POST submits. |