  Magnus Hedemarkandfactory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
|
cc7e61ed30
|
docs(ghost): thicken Admin API skill
Full lastfm-model rebuild of the ghost skill against current docs.ghost.org
research:
- Fix JWT signer correctness: hex-decode the secret half before HMAC-SHA256
signing (official contract; literal-hex signing produced invalid tokens),
document HS256 + kid header + aud /admin/ + 5-minute token window, add
admin_api_audience() derivation and Ghost-scheme error handling with
researched signatures (409 UPDATE_COLLISION, 404 non-public guidance,
INVALID_AUTH_HEADER hint, 204 delete tolerance).
- Extend CLI surface: get-post, update-post (updated_at collision guard),
delete-post, create-page, create-tag, posts pagination (--page/--order,
meta.pagination surfaced), scheduled posting with --published-at guard;
dry-run now previews method/URL/payload exactly as executed.
- Add 5 cited reference files (auth/basics, content-vs-admin split incl.
draft-visibility asymmetry, endpoint guide, worked recipes, gotchas).
- Add scripts/test_ghost.py: 28 offline tests incl. fixed-vector JWT
known-answer checks and jq-executed pipeline-consumability chains.
- Add evals/evals.json (6 cases incl. npm ghost-cli negative probe).
- Rewrite SKILL.md (155-line body) and README in lastfm model.
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
|
2026-08-26 21:24:20 -04:00 |
|