Loosen the checks on IndieAuth parameters so that generic OAuth 2.0 clients like Paw.app can be used

lemonauth/views/indie.py

@@ -29,7 +29,7 @@ def canonical(url):
 @method_decorator(csrf_exempt, name='dispatch')
 class IndieView(TemplateView):
     template_name = 'lemonauth/indie.html'
-    required_params = ('me', 'client_id', 'redirect_uri')
+    required_params = ('client_id', 'redirect_uri')
 
     @method_decorator(login_required)
     @method_decorator(render_to(template_name))
@@ -43,9 +43,8 @@ class IndieView(TemplateView):
                     'parameter {0} is required'.format(param)
                 )
 
-        me = canonical(params['me'])
+        me = request.user.full_url
-        user = urljoin(utils.origin(request), request.user.url)
+        if 'me' in params and me != canonical(params['me']):
-        if user != me:
             return utils.forbid(
                 'you are logged in but not as {0}'.format(me)
             )

lemonauth/views/token.py

@@ -34,12 +34,12 @@ class TokenView(View):
             return utils.bad_req(
                 'this endpoint only supports response_type=code'
             )
-        if code.client_id != post.get('client_id'):
+        if 'client_id' in post and code.client_id != post['client_id']:
             return utils.forbid('client id did not match')
         if code.redirect_uri != post.get('redirect_uri'):
             return utils.forbid('redirect uri did not match')
 
-        if code.me != post.get('me'):
+        if 'me' in post and code.me != post['me']:
             return utils.forbid('me did not match')
 
         return utils.choose_type(req, {