joetjen.net
EN DE
Application

Journeys

Lictor’s journeys, in the order a user meets them, and where each stands. As of 19 October 2026.

In development · v0.2

Where it stands

  • DoneM35, Lictor serves its site — Lictor 0.1.0 with Praxis v0.62.0, 13 October. The page at / names Lictor; anything else is a 404. Nothing in WebGlue was missing; two defects below it were found and fixed in their own layers.
  • DoneM36, registration by invite link — Lictor 0.2.0 with Praxis v0.63.0, 19 October, released with WebGlue 0.8.0 (form bodies, CSRF, Tailwind), shibboleth 0.1.0, posthorn 0.1.0 and prx 0.43.0.
  • In progressM37, login and staying logged in — in progress. Merged but not released: Base32 in the standard library, a second factor in shibboleth (TOTP and recovery codes), and WebGlue’s OAuth2 token server and authorization server with PKCE. Lictor itself has not changed yet.
  • PlannedM38, linking a Twitch account — through twitchy, the Twitch client, ported to Praxis as the journeys pull its endpoints.
  • PlannedM39, choosing a channel to moderate. M40, the moderation view: live chat. M41, acting on it.
  • PlannedM42, history and notes. M43, moderating as a team.
  • PlannedM44, enough of a plugin runtime to prove it, and with it M44a, Logos in Praxis — as much as M44 pulls.
  • PlannedM45, production-ready: every requirement of scope one met, and the security and operational requirements passing.

The next journey: login

Agreed on 19 October. A login is a username and a password, never an email address, followed by a second factor that is mandatory for every direct login.

  • OAuth2 now, not later: the site is a client of Lictor’s own authorization server, by authorization code with PKCE, and the token server issues the tokens. Staying logged in is a refresh token, rotated on use. Third-party clients, client credentials, dynamic registration and OIDC are left out.
  • The second factor is TOTP, set up at the first login with ten single-use recovery codes shown once and kept hashed. No SMS; WebAuthn later, beside it.
  • An access token lives 15 minutes; “keep me logged in” keeps a refresh token for 30 days, renewed on use. Repeated failures slow a login down, doubling up to an hour, and never lock an account out.
  • The tokens stay on the server: the browser holds only the site’s session cookie, and no token is ever readable by a page’s script.

Trying it

Not yet. Lictor needs the Praxis toolchain, which is not published, and its repository is private. The beta will be invite-only and free.