@@ -301,6 +326,36 @@ router.post("/oauth/authorize", async (req, res, next) => {
decision,
} = req.body;
+ // Validate CSRF token
+ if (!validateCsrf(req)) {
+ return res.status(403).json({
+ error: "invalid_request",
+ error_description: "Invalid or missing CSRF token",
+ });
+ }
+
+ const collections = req.app.locals.mastodonCollections;
+
+ // Re-validate redirect_uri against registered app URIs.
+ // The GET handler validates this, but POST body can be tampered.
+ const app = await collections.ap_oauth_apps.findOne({ clientId: client_id });
+ if (!app) {
+ return res.status(400).json({
+ error: "invalid_client",
+ error_description: "Client application not found",
+ });
+ }
+ if (
+ redirect_uri &&
+ redirect_uri !== "urn:ietf:wg:oauth:2.0:oob" &&
+ !app.redirectUris.includes(redirect_uri)
+ ) {
+ return res.status(400).json({
+ error: "invalid_redirect_uri",
+ error_description: "Redirect URI not registered for this application",
+ });
+ }
+
// User denied
if (decision === "deny") {
if (redirect_uri && redirect_uri !== "urn:ietf:wg:oauth:2.0:oob") {
@@ -320,7 +375,6 @@ router.post("/oauth/authorize", async (req, res, next) => {
// Generate authorization code
const code = randomHex(32);
- const collections = req.app.locals.mastodonCollections;
// Note: accessToken is NOT set here — it's added later during token exchange.
// The sparse unique index on accessToken skips documents where the field is
@@ -354,7 +408,7 @@ router.post("/oauth/authorize", async (req, res, next) => {
Authorization Code
Copy this code and paste it into the application:
-
${code}
+
${escapeHtml(code)}
`);
}
@@ -390,7 +444,7 @@ router.post("/oauth/token", async (req, res, next) => {
const app = await collections.ap_oauth_apps.findOne({
clientId,
- clientSecret,
+ clientSecretHash: hashSecret(clientSecret),
confidential: true,
});
@@ -410,6 +464,7 @@ router.post("/oauth/token", async (req, res, next) => {
accessToken,
createdAt: new Date(),
grantType: "client_credentials",
+ expiresAt: new Date(Date.now() + 3600 * 1000),
});
return res.json({
@@ -417,6 +472,7 @@ router.post("/oauth/token", async (req, res, next) => {
token_type: "Bearer",
scope: "read",
created_at: Math.floor(Date.now() / 1000),
+ expires_in: 3600,
});
}
@@ -447,7 +503,14 @@ router.post("/oauth/token", async (req, res, next) => {
const newRefreshToken = randomHex(64);
await collections.ap_oauth_tokens.updateOne(
{ _id: existing._id },
- { $set: { accessToken: newAccessToken, refreshToken: newRefreshToken } },
+ {
+ $set: {
+ accessToken: newAccessToken,
+ refreshToken: newRefreshToken,
+ expiresAt: new Date(Date.now() + 3600 * 1000),
+ refreshExpiresAt: new Date(Date.now() + 90 * 24 * 3600 * 1000),
+ },
+ },
);
return res.json({
@@ -456,6 +519,7 @@ router.post("/oauth/token", async (req, res, next) => {
scope: existing.scopes.join(" "),
created_at: Math.floor(existing.createdAt.getTime() / 1000),
refresh_token: newRefreshToken,
+ expires_in: 3600,
});
}
@@ -523,13 +587,21 @@ router.post("/oauth/token", async (req, res, next) => {
}
}
- // Generate access token and refresh token.
- // Clear expiresAt — it was set for the auth code, not the access token.
+ // Generate access token and refresh token with expiry.
+ const ACCESS_TOKEN_TTL = 3600 * 1000; // 1 hour
+ const REFRESH_TOKEN_TTL = 90 * 24 * 3600 * 1000; // 90 days
const accessToken = randomHex(64);
const refreshToken = randomHex(64);
await collections.ap_oauth_tokens.updateOne(
{ _id: grant._id },
- { $set: { accessToken, refreshToken, expiresAt: null } },
+ {
+ $set: {
+ accessToken,
+ refreshToken,
+ expiresAt: new Date(Date.now() + ACCESS_TOKEN_TTL),
+ refreshExpiresAt: new Date(Date.now() + REFRESH_TOKEN_TTL),
+ },
+ },
);
res.json({
@@ -538,6 +610,7 @@ router.post("/oauth/token", async (req, res, next) => {
scope: grant.scopes.join(" "),
created_at: Math.floor(grant.createdAt.getTime() / 1000),
refresh_token: refreshToken,
+ expires_in: 3600,
});
} catch (error) {
next(error);
@@ -622,7 +695,7 @@ function redirectToUri(res, originalUri, fullUrl) {
-
+
Redirecting…
diff --git a/lib/mastodon/routes/search.js b/lib/mastodon/routes/search.js
index 6c4a259..9f41887 100644
--- a/lib/mastodon/routes/search.js
+++ b/lib/mastodon/routes/search.js
@@ -8,12 +8,14 @@ import { serializeStatus } from "../entities/status.js";
import { serializeAccount } from "../entities/account.js";
import { parseLimit } from "../helpers/pagination.js";
import { resolveRemoteAccount } from "../helpers/resolve-account.js";
+import { tokenRequired } from "../middleware/token-required.js";
+import { scopeRequired } from "../middleware/scope-required.js";
const router = express.Router(); // eslint-disable-line new-cap
// ─── GET /api/v2/search ─────────────────────────────────────────────────────
-router.get("/api/v2/search", async (req, res, next) => {
+router.get("/api/v2/search", tokenRequired, scopeRequired("read", "read:search"), async (req, res, next) => {
try {
const collections = req.app.locals.mastodonCollections;
const baseUrl = `${req.protocol}://${req.get("host")}`;
diff --git a/lib/mastodon/routes/statuses.js b/lib/mastodon/routes/statuses.js
index 7d39aa4..ce374ad 100644
--- a/lib/mastodon/routes/statuses.js
+++ b/lib/mastodon/routes/statuses.js
@@ -29,12 +29,14 @@ import {
import { addTimelineItem } from "../../storage/timeline.js";
import { lookupWithSecurity } from "../../lookup-helpers.js";
import { addNotification } from "../../storage/notifications.js";
+import { tokenRequired } from "../middleware/token-required.js";
+import { scopeRequired } from "../middleware/scope-required.js";
const router = express.Router(); // eslint-disable-line new-cap
// ─── GET /api/v1/statuses/:id ───────────────────────────────────────────────
-router.get("/api/v1/statuses/:id", async (req, res, next) => {
+router.get("/api/v1/statuses/:id", tokenRequired, scopeRequired("read", "read:statuses"), async (req, res, next) => {
try {
const { id } = req.params;
const collections = req.app.locals.mastodonCollections;
@@ -58,7 +60,7 @@ router.get("/api/v1/statuses/:id", async (req, res, next) => {
// ─── GET /api/v1/statuses/:id/context ───────────────────────────────────────
-router.get("/api/v1/statuses/:id/context", async (req, res, next) => {
+router.get("/api/v1/statuses/:id/context", tokenRequired, scopeRequired("read", "read:statuses"), async (req, res, next) => {
try {
const { id } = req.params;
const collections = req.app.locals.mastodonCollections;
@@ -137,13 +139,8 @@ router.get("/api/v1/statuses/:id/context", async (req, res, next) => {
// Creates a post via the Micropub pipeline so it goes through the full flow:
// Micropub → content file → Eleventy build → syndication → AP federation.
-router.post("/api/v1/statuses", async (req, res, next) => {
+router.post("/api/v1/statuses", tokenRequired, scopeRequired("write", "write:statuses"), async (req, res, next) => {
try {
- const token = req.mastodonToken;
- if (!token) {
- return res.status(401).json({ error: "The access token is invalid" });
- }
-
const { application, publication } = req.app.locals;
const collections = req.app.locals.mastodonCollections;
const pluginOptions = req.app.locals.mastodonPluginOptions || {};
@@ -172,32 +169,42 @@ router.post("/api/v1/statuses", async (req, res, next) => {
}
}
- // Build JF2 properties for the Micropub pipeline
+ // Build JF2 properties for the Micropub pipeline.
+ // Provide both text and html — linkify URLs since Micropub's markdown-it
+ // doesn't have linkify enabled. Mentions are preserved as plain text;
+ // the AP syndicator resolves them via WebFinger for federation delivery.
+ const contentText = statusText || "";
+ const contentHtml = contentText
+ .replace(/&/g, "&")
+ .replace(//g, ">")
+ .replace(/(https?:\/\/[^\s<>&"')\]]+)/g, '
$1')
+ .replace(/\n/g, "
");
+
const jf2 = {
type: "entry",
- content: statusText || "",
+ content: { text: contentText, html: `
${contentHtml}
` },
};
if (inReplyTo) {
jf2["in-reply-to"] = inReplyTo;
}
- if (spoilerText) {
- jf2.summary = spoilerText;
- }
-
- if (sensitive === true || sensitive === "true") {
- jf2.sensitive = "true";
- }
-
if (visibility && visibility !== "public" && visibility !== "direct") {
jf2.visibility = visibility;
}
+ // Use content-warning (not summary) to match native reader behavior
+ if (spoilerText) {
+ jf2["content-warning"] = spoilerText;
+ jf2.sensitive = "true";
+ }
+
if (language) {
jf2["mp-language"] = language;
}
+
// ── Direct messages: bypass Micropub, send via native AP DM path ──────────
// Mastodon clients send visibility="direct" for DMs. These must NOT create
// a public blog post — instead send a Create/Note activity directly to the
@@ -358,101 +365,70 @@ router.post("/api/v1/statuses", async (req, res, next) => {
// Syndicate to AP only — posts from Mastodon clients belong to the fediverse.
// Never cross-post to Bluesky (conversations stay in their protocol).
// The publication URL is the AP syndicator's uid.
+
const publicationUrl = pluginOptions.publicationUrl || baseUrl;
jf2["mp-syndicate-to"] = [publicationUrl.replace(/\/$/, "") + "/"];
- // Create post via Micropub pipeline (same functions the Micropub endpoint uses)
- // postData.create() handles: normalization, post type detection, path rendering,
- // mp-syndicate-to validated against configured syndicators, MongoDB posts collection
+ // Create post via Micropub pipeline (same internal functions)
const { postData } = await import("@indiekit/endpoint-micropub/lib/post-data.js");
const { postContent } = await import("@indiekit/endpoint-micropub/lib/post-content.js");
const data = await postData.create(application, publication, jf2);
- // postContent.create() handles: template rendering, file creation in store
await postContent.create(publication, data);
const postUrl = data.properties.url;
console.info(`[Mastodon API] Created post via Micropub: ${postUrl}`);
- // Add to ap_timeline so the post is visible in the Mastodon Client API
+ // Return a minimal status to the Mastodon client.
+ // No timeline entry is created here — the post will appear in the timeline
+ // after the normal flow: Eleventy rebuild → syndication webhook → AP delivery.
const profile = await collections.ap_profile.findOne({});
const handle = pluginOptions.handle || "user";
- const actorUrl = profile?.url || `${publicationUrl}/users/${handle}`;
- // Extract hashtags from status text and merge with any Micropub categories
- const categories = data.properties.category || [];
- const inlineHashtags = (statusText || "").match(/(?:^|\s)#([a-zA-Z_]\w*)/g);
- if (inlineHashtags) {
- const existing = new Set(categories.map((c) => c.toLowerCase()));
- for (const match of inlineHashtags) {
- const tag = match.trim().slice(1).toLowerCase();
- if (!existing.has(tag)) {
- existing.add(tag);
- categories.push(tag);
- }
- }
- }
-
- // Resolve relative media URLs to absolute
- const resolveMedia = (items) => {
- if (!items || !items.length) return [];
- return items.map((item) => {
- if (typeof item === "string") {
- return item.startsWith("http") ? item : `${publicationUrl.replace(/\/$/, "")}/${item.replace(/^\//, "")}`;
- }
- if (item?.url && !item.url.startsWith("http")) {
- return { ...item, url: `${publicationUrl.replace(/\/$/, "")}/${item.url.replace(/^\//, "")}` };
- }
- return item;
- });
- };
-
- // Process content: linkify URLs and extract @mentions
- const rawContent = data.properties.content || { text: statusText || "", html: "" };
- const processedContent = processStatusContent(rawContent, statusText || "");
- const mentions = extractMentions(statusText || "");
-
- const now = new Date().toISOString();
- const timelineItem = await addTimelineItem(collections, {
- uid: postUrl,
+ res.json({
+ id: String(Date.now()),
+ created_at: new Date().toISOString(),
+ content: `
${contentHtml}
`,
url: postUrl,
- type: data.properties["post-type"] || "note",
- content: processedContent,
- summary: spoilerText || "",
- sensitive: sensitive === true || sensitive === "true",
+ uri: postUrl,
visibility: visibility || "public",
+ sensitive: sensitive === true || sensitive === "true",
+ spoiler_text: spoilerText || "",
+ in_reply_to_id: inReplyToId || null,
+ in_reply_to_account_id: null,
language: language || null,
- inReplyTo,
- published: data.properties.published || now,
- createdAt: now,
- author: {
- name: profile?.name || handle,
+ replies_count: 0,
+ reblogs_count: 0,
+ favourites_count: 0,
+ favourited: false,
+ reblogged: false,
+ bookmarked: false,
+ account: {
+ id: "owner",
+ username: handle,
+ acct: handle,
+ display_name: profile?.name || handle,
url: profile?.url || publicationUrl,
- photo: profile?.icon || "",
- handle: `@${handle}`,
+ avatar: profile?.icon || "",
+ avatar_static: profile?.icon || "",
+ header: "",
+ header_static: "",
+ followers_count: 0,
+ following_count: 0,
+ statuses_count: 0,
emojis: [],
- bot: false,
+ fields: [],
},
- photo: resolveMedia(data.properties.photo || []),
- video: resolveMedia(data.properties.video || []),
- audio: resolveMedia(data.properties.audio || []),
- category: categories,
- counts: { replies: 0, boosts: 0, likes: 0 },
- linkPreviews: [],
- mentions,
+ media_attachments: [],
+ mentions: extractMentions(contentText).map(m => ({
+ id: "0",
+ username: m.name.split("@")[1] || m.name,
+ acct: m.name.replace(/^@/, ""),
+ url: m.url,
+ })),
+ tags: [],
emojis: [],
});
-
- // Serialize and return
- const serialized = serializeStatus(timelineItem, {
- baseUrl,
- favouritedIds: new Set(),
- rebloggedIds: new Set(),
- bookmarkedIds: new Set(),
- pinnedIds: new Set(),
- });
-
- res.json(serialized);
} catch (error) {
next(error);
}
@@ -462,13 +438,8 @@ router.post("/api/v1/statuses", async (req, res, next) => {
// Deletes via Micropub pipeline (removes content file + MongoDB post) and
// cleans up the ap_timeline entry.
-router.delete("/api/v1/statuses/:id", async (req, res, next) => {
+router.delete("/api/v1/statuses/:id", tokenRequired, scopeRequired("write", "write:statuses"), async (req, res, next) => {
try {
- const token = req.mastodonToken;
- if (!token) {
- return res.status(401).json({ error: "The access token is invalid" });
- }
-
const { application, publication } = req.app.locals;
const { id } = req.params;
const collections = req.app.locals.mastodonCollections;
@@ -650,27 +621,22 @@ router.put("/api/v1/statuses/:id", async (req, res, next) => {
// ─── GET /api/v1/statuses/:id/favourited_by ─────────────────────────────────
-router.get("/api/v1/statuses/:id/favourited_by", async (req, res) => {
+router.get("/api/v1/statuses/:id/favourited_by", tokenRequired, scopeRequired("read", "read:statuses"), async (req, res) => {
// Stub — we don't track who favourited remotely
res.json([]);
});
// ─── GET /api/v1/statuses/:id/reblogged_by ──────────────────────────────────
-router.get("/api/v1/statuses/:id/reblogged_by", async (req, res) => {
+router.get("/api/v1/statuses/:id/reblogged_by", tokenRequired, scopeRequired("read", "read:statuses"), async (req, res) => {
// Stub — we don't track who boosted remotely
res.json([]);
});
// ─── POST /api/v1/statuses/:id/favourite ────────────────────────────────────
-router.post("/api/v1/statuses/:id/favourite", async (req, res, next) => {
+router.post("/api/v1/statuses/:id/favourite", tokenRequired, scopeRequired("write", "write:favourites"), async (req, res, next) => {
try {
- const token = req.mastodonToken;
- if (!token) {
- return res.status(401).json({ error: "The access token is invalid" });
- }
-
const { item, collections, baseUrl } = await resolveStatusForInteraction(req);
if (!item) {
return res.status(404).json({ error: "Record not found" });
@@ -695,13 +661,8 @@ router.post("/api/v1/statuses/:id/favourite", async (req, res, next) => {
// ─── POST /api/v1/statuses/:id/unfavourite ──────────────────────────────────
-router.post("/api/v1/statuses/:id/unfavourite", async (req, res, next) => {
+router.post("/api/v1/statuses/:id/unfavourite", tokenRequired, scopeRequired("write", "write:favourites"), async (req, res, next) => {
try {
- const token = req.mastodonToken;
- if (!token) {
- return res.status(401).json({ error: "The access token is invalid" });
- }
-
const { item, collections, baseUrl } = await resolveStatusForInteraction(req);
if (!item) {
return res.status(404).json({ error: "Record not found" });
@@ -725,13 +686,8 @@ router.post("/api/v1/statuses/:id/unfavourite", async (req, res, next) => {
// ─── POST /api/v1/statuses/:id/reblog ───────────────────────────────────────
-router.post("/api/v1/statuses/:id/reblog", async (req, res, next) => {
+router.post("/api/v1/statuses/:id/reblog", tokenRequired, scopeRequired("write", "write:statuses"), async (req, res, next) => {
try {
- const token = req.mastodonToken;
- if (!token) {
- return res.status(401).json({ error: "The access token is invalid" });
- }
-
const { item, collections, baseUrl } = await resolveStatusForInteraction(req);
if (!item) {
return res.status(404).json({ error: "Record not found" });
@@ -755,13 +711,8 @@ router.post("/api/v1/statuses/:id/reblog", async (req, res, next) => {
// ─── POST /api/v1/statuses/:id/unreblog ─────────────────────────────────────
-router.post("/api/v1/statuses/:id/unreblog", async (req, res, next) => {
+router.post("/api/v1/statuses/:id/unreblog", tokenRequired, scopeRequired("write", "write:statuses"), async (req, res, next) => {
try {
- const token = req.mastodonToken;
- if (!token) {
- return res.status(401).json({ error: "The access token is invalid" });
- }
-
const { item, collections, baseUrl } = await resolveStatusForInteraction(req);
if (!item) {
return res.status(404).json({ error: "Record not found" });
@@ -785,13 +736,8 @@ router.post("/api/v1/statuses/:id/unreblog", async (req, res, next) => {
// ─── POST /api/v1/statuses/:id/bookmark ─────────────────────────────────────
-router.post("/api/v1/statuses/:id/bookmark", async (req, res, next) => {
+router.post("/api/v1/statuses/:id/bookmark", tokenRequired, scopeRequired("write", "write:bookmarks"), async (req, res, next) => {
try {
- const token = req.mastodonToken;
- if (!token) {
- return res.status(401).json({ error: "The access token is invalid" });
- }
-
const { item, collections, baseUrl } = await resolveStatusForInteraction(req);
if (!item) {
return res.status(404).json({ error: "Record not found" });
@@ -813,13 +759,8 @@ router.post("/api/v1/statuses/:id/bookmark", async (req, res, next) => {
// ─── POST /api/v1/statuses/:id/unbookmark ───────────────────────────────────
-router.post("/api/v1/statuses/:id/unbookmark", async (req, res, next) => {
+router.post("/api/v1/statuses/:id/unbookmark", tokenRequired, scopeRequired("write", "write:bookmarks"), async (req, res, next) => {
try {
- const token = req.mastodonToken;
- if (!token) {
- return res.status(401).json({ error: "The access token is invalid" });
- }
-
const { item, collections, baseUrl } = await resolveStatusForInteraction(req);
if (!item) {
return res.status(404).json({ error: "Record not found" });
@@ -1048,6 +989,7 @@ async function loadItemInteractions(collections, item) {
}
/**
+
* Process status content: linkify bare URLs and convert @mentions to links.
*
* Mastodon clients send plain text — the server is responsible for
@@ -1091,6 +1033,7 @@ function processStatusContent(content, rawText) {
}
/**
+
* Extract @user@domain mentions from text into mention objects.
*
* @param {string} text - Status text
diff --git a/lib/mastodon/routes/timelines.js b/lib/mastodon/routes/timelines.js
index 5e628e5..991565e 100644
--- a/lib/mastodon/routes/timelines.js
+++ b/lib/mastodon/routes/timelines.js
@@ -10,18 +10,15 @@ import { serializeStatus } from "../entities/status.js";
import { buildPaginationQuery, parseLimit, setPaginationHeaders } from "../helpers/pagination.js";
import { loadModerationData, applyModerationFilters } from "../../item-processing.js";
import { enrichAccountStats } from "../helpers/enrich-accounts.js";
+import { tokenRequired } from "../middleware/token-required.js";
+import { scopeRequired } from "../middleware/scope-required.js";
const router = express.Router(); // eslint-disable-line new-cap
// ─── GET /api/v1/timelines/home ─────────────────────────────────────────────
-router.get("/api/v1/timelines/home", async (req, res, next) => {
+router.get("/api/v1/timelines/home", tokenRequired, scopeRequired("read", "read:statuses"), async (req, res, next) => {
try {
- const token = req.mastodonToken;
- if (!token) {
- return res.status(401).json({ error: "The access token is invalid" });
- }
-
const collections = req.app.locals.mastodonCollections;
const baseUrl = `${req.protocol}://${req.get("host")}`;
const limit = parseLimit(req.query.limit);
diff --git a/lib/og-unfurl.js b/lib/og-unfurl.js
index a3505c0..6d514f3 100644
--- a/lib/og-unfurl.js
+++ b/lib/og-unfurl.js
@@ -3,6 +3,8 @@
* @module og-unfurl
*/
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
import { unfurl } from "unfurl.js";
import { extractObjectData } from "./timeline-store.js";
import { lookupWithSecurity } from "./lookup-helpers.js";
@@ -45,45 +47,58 @@ function extractDomain(url) {
}
/**
- * Check if a URL points to a private/reserved IP or localhost (SSRF protection)
- * @param {string} url - URL to check
- * @returns {boolean} True if URL targets a private network
+ * Check if an IP address is in a private/reserved range.
+ * @param {string} ip - IPv4 or IPv6 address
+ * @returns {boolean} True if private/reserved
*/
-function isPrivateUrl(url) {
+function isPrivateIP(ip) {
+ if (isIP(ip) === 4) {
+ const parts = ip.split(".").map(Number);
+ const [a, b] = parts;
+ if (a === 10) return true; // 10.0.0.0/8
+ if (a === 172 && b >= 16 && b <= 31) return true; // 172.16.0.0/12
+ if (a === 192 && b === 168) return true; // 192.168.0.0/16
+ if (a === 169 && b === 254) return true; // 169.254.0.0/16 (link-local)
+ if (a === 127) return true; // 127.0.0.0/8
+ if (a === 0) return true; // 0.0.0.0/8
+ }
+ if (isIP(ip) === 6) {
+ const lower = ip.toLowerCase();
+ if (lower.startsWith("fc") || lower.startsWith("fd")) return true; // ULA
+ if (lower.startsWith("fe80")) return true; // link-local
+ if (lower === "::1") return true; // loopback
+ }
+ return false;
+}
+
+/**
+ * Check if a URL resolves to a private/reserved IP (SSRF protection).
+ * Performs DNS resolution to defeat DNS rebinding attacks.
+ * @param {string} url - URL to check
+ * @returns {Promise
} True if URL targets a private network
+ */
+async function isPrivateResolved(url) {
try {
const urlObj = new URL(url);
- const hostname = urlObj.hostname.toLowerCase();
// Block non-http(s) schemes
if (urlObj.protocol !== "http:" && urlObj.protocol !== "https:") {
return true;
}
- // Block localhost variants
- if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]") {
- return true;
- }
+ const hostname = urlObj.hostname.toLowerCase().replace(/^\[|\]$/g, "");
- // Block private IPv4 ranges
- const ipv4Match = hostname.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
- if (ipv4Match) {
- const [, a, b] = ipv4Match.map(Number);
- if (a === 10) return true; // 10.0.0.0/8
- if (a === 172 && b >= 16 && b <= 31) return true; // 172.16.0.0/12
- if (a === 192 && b === 168) return true; // 192.168.0.0/16
- if (a === 169 && b === 254) return true; // 169.254.0.0/16 (link-local / cloud metadata)
- if (a === 127) return true; // 127.0.0.0/8
- if (a === 0) return true; // 0.0.0.0/8
- }
+ // Block obvious localhost variants
+ if (hostname === "localhost") return true;
- // Block IPv6 private ranges (basic check)
- if (hostname.startsWith("[fc") || hostname.startsWith("[fd") || hostname.startsWith("[fe80")) {
- return true;
- }
+ // If hostname is already an IP, check directly (no DNS needed)
+ if (isIP(hostname)) return isPrivateIP(hostname);
- return false;
+ // DNS resolution — check the resolved IP
+ const { address } = await lookup(hostname);
+ return isPrivateIP(address);
} catch {
- return true; // Invalid URL, treat as private
+ return true; // DNS failure or invalid URL — treat as private
}
}
@@ -115,14 +130,14 @@ function extractLinks(html) {
/**
* Check if URL is likely an ActivityPub object or media file
* @param {string} url - URL to check
- * @returns {boolean} True if URL should be skipped
+ * @returns {Promise} True if URL should be skipped
*/
-function shouldSkipUrl(url) {
+async function shouldSkipUrl(url) {
try {
const urlObj = new URL(url);
// SSRF protection — skip private/internal URLs
- if (isPrivateUrl(url)) {
+ if (await isPrivateResolved(url)) {
return true;
}
@@ -158,9 +173,9 @@ export async function fetchLinkPreviews(html) {
const links = extractLinks(html);
- // Filter links
- const urlsToFetch = links
- .filter((link) => {
+ // Filter links — async because shouldSkipUrl performs DNS resolution
+ const filterResults = await Promise.all(
+ links.map(async (link) => {
// Skip mention links (class="mention")
if (link.classes.includes("mention")) return false;
@@ -168,10 +183,14 @@ export async function fetchLinkPreviews(html) {
if (link.classes.includes("hashtag")) return false;
// Skip AP object URLs and media files
- if (shouldSkipUrl(link.url)) return false;
+ if (await shouldSkipUrl(link.url)) return false;
return true;
- })
+ }),
+ );
+
+ const urlsToFetch = links
+ .filter((_, index) => filterResults[index])
.map((link) => link.url)
.filter((url, index, self) => self.indexOf(url) === index) // Dedupe
.slice(0, MAX_PREVIEWS); // Cap at max
diff --git a/lib/storage/moderation.js b/lib/storage/moderation.js
index f30dcec..91f693d 100644
--- a/lib/storage/moderation.js
+++ b/lib/storage/moderation.js
@@ -3,6 +3,8 @@
* @module storage/moderation
*/
+import { invalidateModerationCache } from "../item-processing.js";
+
/**
* Add a muted URL or keyword
* @param {object} collections - MongoDB collections
@@ -32,6 +34,7 @@ export async function addMuted(collections, { url, keyword }) {
const filter = url ? { url } : { keyword };
await ap_muted.updateOne(filter, { $setOnInsert: entry }, { upsert: true });
+ invalidateModerationCache();
return await ap_muted.findOne(filter);
}
@@ -55,7 +58,9 @@ export async function removeMuted(collections, { url, keyword }) {
throw new Error("Either url or keyword must be provided");
}
- return await ap_muted.deleteOne(filter);
+ const result = await ap_muted.deleteOne(filter);
+ invalidateModerationCache();
+ return result;
}
/**
@@ -122,6 +127,7 @@ export async function addBlocked(collections, url) {
// Upsert to avoid duplicates
await ap_blocked.updateOne({ url }, { $setOnInsert: entry }, { upsert: true });
+ invalidateModerationCache();
return await ap_blocked.findOne({ url });
}
@@ -133,7 +139,9 @@ export async function addBlocked(collections, url) {
*/
export async function removeBlocked(collections, url) {
const { ap_blocked } = collections;
- return await ap_blocked.deleteOne({ url });
+ const result = await ap_blocked.deleteOne({ url });
+ invalidateModerationCache();
+ return result;
}
/**
@@ -204,4 +212,5 @@ export async function setFilterMode(collections, mode) {
if (!ap_profile) return;
const valid = mode === "warn" ? "warn" : "hide";
await ap_profile.updateOne({}, { $set: { moderationFilterMode: valid } });
+ invalidateModerationCache();
}
diff --git a/lib/storage/tombstones.js b/lib/storage/tombstones.js
new file mode 100644
index 0000000..79d6cfe
--- /dev/null
+++ b/lib/storage/tombstones.js
@@ -0,0 +1,52 @@
+/**
+ * Tombstone storage for soft-deleted posts (FEP-4f05).
+ * When a post is deleted, a tombstone record is created so remote servers
+ * fetching the URL get a proper Tombstone response instead of 404.
+ * @module storage/tombstones
+ */
+
+/**
+ * Record a tombstone for a deleted post.
+ * @param {object} collections - MongoDB collections
+ * @param {object} data - { url, formerType, published, deleted }
+ */
+export async function addTombstone(collections, { url, formerType, published, deleted }) {
+ const { ap_tombstones } = collections;
+ if (!ap_tombstones) return;
+
+ await ap_tombstones.updateOne(
+ { url },
+ {
+ $set: {
+ url,
+ formerType: formerType || "Note",
+ published: published || null,
+ deleted: deleted || new Date().toISOString(),
+ },
+ },
+ { upsert: true },
+ );
+}
+
+/**
+ * Remove a tombstone (post re-published).
+ * @param {object} collections - MongoDB collections
+ * @param {string} url - Post URL
+ */
+export async function removeTombstone(collections, url) {
+ const { ap_tombstones } = collections;
+ if (!ap_tombstones) return;
+ await ap_tombstones.deleteOne({ url });
+}
+
+/**
+ * Look up a tombstone by URL.
+ * @param {object} collections - MongoDB collections
+ * @param {string} url - Post URL
+ * @returns {Promise} Tombstone record or null
+ */
+export async function getTombstone(collections, url) {
+ const { ap_tombstones } = collections;
+ if (!ap_tombstones) return null;
+ return ap_tombstones.findOne({ url });
+}
diff --git a/lib/syndicator.js b/lib/syndicator.js
new file mode 100644
index 0000000..94108d5
--- /dev/null
+++ b/lib/syndicator.js
@@ -0,0 +1,282 @@
+/**
+ * ActivityPub syndicator — delivers posts to followers via Fedify.
+ * @module syndicator
+ */
+import {
+ jf2ToAS2Activity,
+ parseMentions,
+} from "./jf2-to-as2.js";
+import { lookupWithSecurity } from "./lookup-helpers.js";
+import { logActivity } from "./activity-log.js";
+import { addTimelineItem } from "./storage/timeline.js";
+
+/**
+ * Create the ActivityPub syndicator object.
+ * @param {object} plugin - ActivityPubEndpoint instance
+ * @returns {object} Syndicator compatible with Indiekit's syndicator API
+ */
+export function createSyndicator(plugin) {
+ return {
+ name: "ActivityPub syndicator",
+ options: { checked: plugin.options.checked },
+
+ get info() {
+ const hostname = plugin._publicationUrl
+ ? new URL(plugin._publicationUrl).hostname
+ : "example.com";
+ return {
+ checked: plugin.options.checked,
+ name: `@${plugin.options.actor.handle}@${hostname}`,
+ uid: plugin._publicationUrl || "https://example.com/",
+ service: {
+ name: "ActivityPub (Fediverse)",
+ photo: "/assets/@rmdes-indiekit-endpoint-activitypub/icon.svg",
+ url: plugin._publicationUrl || "https://example.com/",
+ },
+ };
+ },
+
+ async syndicate(properties) {
+ if (!plugin._federation) {
+ return undefined;
+ }
+
+ try {
+ const actorUrl = plugin._getActorUrl();
+ const handle = plugin.options.actor.handle;
+
+ const ctx = plugin._federation.createContext(
+ new URL(plugin._publicationUrl),
+ { handle, publicationUrl: plugin._publicationUrl },
+ );
+
+ // For replies, resolve the original post author for proper
+ // addressing (CC) and direct inbox delivery
+ let replyToActor = null;
+ if (properties["in-reply-to"]) {
+ try {
+ const remoteObject = await lookupWithSecurity(ctx,
+ new URL(properties["in-reply-to"]),
+ );
+ if (remoteObject && typeof remoteObject.getAttributedTo === "function") {
+ const author = await remoteObject.getAttributedTo();
+ const authorActor = Array.isArray(author) ? author[0] : author;
+ if (authorActor?.id) {
+ replyToActor = {
+ url: authorActor.id.href,
+ handle: authorActor.preferredUsername || null,
+ recipient: authorActor,
+ };
+ console.info(
+ `[ActivityPub] Reply to ${properties["in-reply-to"]} — resolved author: ${replyToActor.url}`,
+ );
+ }
+ }
+ } catch (error) {
+ console.warn(
+ `[ActivityPub] Could not resolve reply-to author for ${properties["in-reply-to"]}: ${error.message}`,
+ );
+ }
+ }
+
+ // Resolve @user@domain mentions in content via WebFinger
+ const contentText = properties.content?.html || properties.content || "";
+ const mentionHandles = parseMentions(contentText);
+ const resolvedMentions = [];
+ const mentionRecipients = [];
+
+ for (const { handle } of mentionHandles) {
+ try {
+ const mentionedActor = await lookupWithSecurity(ctx,
+ new URL(`acct:${handle}`),
+ );
+ if (mentionedActor?.id) {
+ resolvedMentions.push({
+ handle,
+ actorUrl: mentionedActor.id.href,
+ profileUrl: mentionedActor.url?.href || null,
+ });
+ mentionRecipients.push({
+ handle,
+ actorUrl: mentionedActor.id.href,
+ actor: mentionedActor,
+ });
+ console.info(
+ `[ActivityPub] Resolved mention @${handle} → ${mentionedActor.id.href}`,
+ );
+ }
+ } catch (error) {
+ console.warn(
+ `[ActivityPub] Could not resolve mention @${handle}: ${error.message}`,
+ );
+ // Still add with no actorUrl so it gets a fallback link
+ resolvedMentions.push({ handle, actorUrl: null });
+ }
+ }
+
+ const activity = await jf2ToAS2Activity(
+ properties,
+ actorUrl,
+ plugin._publicationUrl,
+ {
+ replyToActorUrl: replyToActor?.url,
+ replyToActorHandle: replyToActor?.handle,
+ visibility: plugin.options.defaultVisibility,
+ mentions: resolvedMentions,
+ },
+ );
+
+ if (!activity) {
+ await logActivity(plugin._collections.ap_activities, {
+ direction: "outbound",
+ type: "Syndicate",
+ actorUrl: plugin._publicationUrl,
+ objectUrl: properties.url,
+ summary: `Syndication skipped: could not convert post to AS2`,
+ });
+ return undefined;
+ }
+
+ // Count followers for logging
+ const followerCount =
+ await plugin._collections.ap_followers.countDocuments();
+
+ console.info(
+ `[ActivityPub] Sending ${activity.constructor?.name || "activity"} for ${properties.url} to ${followerCount} followers`,
+ );
+
+ // Send to followers via shared inboxes with collection sync (FEP-8fcf)
+ await ctx.sendActivity(
+ { identifier: handle },
+ "followers",
+ activity,
+ {
+ preferSharedInbox: true,
+ syncCollection: true,
+ orderingKey: properties.url,
+ },
+ );
+
+ // For replies, also deliver to the original post author's inbox
+ // so their server can thread the reply under the original post
+ if (replyToActor?.recipient) {
+ try {
+ await ctx.sendActivity(
+ { identifier: handle },
+ replyToActor.recipient,
+ activity,
+ { orderingKey: properties.url },
+ );
+ console.info(
+ `[ActivityPub] Reply delivered to author: ${replyToActor.url}`,
+ );
+ } catch (error) {
+ console.warn(
+ `[ActivityPub] Failed to deliver reply to ${replyToActor.url}: ${error.message}`,
+ );
+ }
+ }
+
+ // Deliver to mentioned actors' inboxes (skip reply-to author, already delivered above)
+ for (const { handle: mHandle, actorUrl: mUrl, actor: mActor } of mentionRecipients) {
+ if (replyToActor?.url === mUrl) continue;
+ try {
+ await ctx.sendActivity(
+ { identifier: handle },
+ mActor,
+ activity,
+ { orderingKey: properties.url },
+ );
+ console.info(
+ `[ActivityPub] Mention delivered to @${mHandle}: ${mUrl}`,
+ );
+ } catch (error) {
+ console.warn(
+ `[ActivityPub] Failed to deliver mention to @${mHandle}: ${error.message}`,
+ );
+ }
+ }
+
+ // Determine activity type name
+ const typeName =
+ activity.constructor?.name || "Create";
+ const replyNote = replyToActor
+ ? ` (reply to ${replyToActor.url})`
+ : "";
+ const mentionNote = mentionRecipients.length > 0
+ ? ` (mentions: ${mentionRecipients.map(m => `@${m.handle}`).join(", ")})`
+ : "";
+
+ await logActivity(plugin._collections.ap_activities, {
+ direction: "outbound",
+ type: typeName,
+ actorUrl: plugin._publicationUrl,
+ objectUrl: properties.url,
+ targetUrl: properties["in-reply-to"] || undefined,
+ summary: `Sent ${typeName} for ${properties.url} to ${followerCount} followers${replyNote}${mentionNote}`,
+ });
+
+ console.info(
+ `[ActivityPub] Syndication queued: ${typeName} for ${properties.url}${replyNote}`,
+ );
+
+ // Mirror own Micropub-created posts into ap_timeline so the Mastodon
+ // Client API (context, statuses, etc.) can find them by ID.
+ if (typeName === "Create" && properties.url) {
+ try {
+ const rawHtml = properties.content?.html || (typeof properties.content === "string" ? properties.content : "") || "";
+ const now = new Date().toISOString();
+ const postType = properties["post-type"] || "note";
+ const asArray = (v) => Array.isArray(v) ? v : v ? [v] : [];
+ await addTimelineItem(plugin._collections, {
+ uid: properties.url,
+ url: properties.url,
+ type: postType,
+ content: { html: rawHtml, text: rawHtml.replace(/<[^>]*>/g, "") },
+ summary: properties["content-warning"] || properties.summary || "",
+ sensitive: !!(properties.sensitive || properties["content-warning"]),
+ visibility: properties.visibility || plugin.options.defaultVisibility || "public",
+ language: properties.lang || properties.language || null,
+ inReplyTo: properties["in-reply-to"] || null,
+ published: properties.published || now,
+ createdAt: now,
+ author: {
+ name: plugin.options.actor.name || handle,
+ url: actorUrl,
+ photo: plugin.options.actor.icon || "",
+ handle: `@${handle}`,
+ emojis: [],
+ bot: false,
+ },
+ photo: asArray(properties.photo),
+ video: asArray(properties.video),
+ audio: asArray(properties.audio),
+ category: asArray(properties.category),
+ counts: { replies: 0, boosts: 0, likes: 0 },
+ linkPreviews: [],
+ mentions: [],
+ emojis: [],
+ });
+ } catch (timelineError) {
+ console.warn("[ActivityPub] Failed to mirror syndicated post to ap_timeline:", timelineError.message);
+ }
+ }
+
+ return properties.url || undefined;
+ } catch (error) {
+ console.error("[ActivityPub] Syndication failed:", error.message);
+ await logActivity(plugin._collections.ap_activities, {
+ direction: "outbound",
+ type: "Syndicate",
+ actorUrl: plugin._publicationUrl,
+ objectUrl: properties.url,
+ summary: `Syndication failed: ${error.message}`,
+ }).catch(() => {});
+ return undefined;
+ }
+ },
+
+ delete: async (url) => plugin.delete(url),
+ update: async (properties) => plugin.update(properties),
+ };
+}
diff --git a/lib/timeline-store.js b/lib/timeline-store.js
index 69ca29c..c2ab108 100644
--- a/lib/timeline-store.js
+++ b/lib/timeline-store.js
@@ -28,7 +28,7 @@ export function sanitizeContent(html) {
},
allowedSchemes: ["http", "https", "mailto"],
allowedSchemesByTag: {
- img: ["http", "https", "data"]
+ img: ["http", "https"]
}
});
}
@@ -46,11 +46,16 @@ export function replaceCustomEmoji(html, emojis) {
if (!emojis?.length || !html) return html;
let result = html;
for (const { shortcode, url } of emojis) {
+ // Validate URL is HTTP(S) only — reject data:, javascript:, etc.
+ if (!url || (!url.startsWith("https://") && !url.startsWith("http://"))) continue;
+ // Escape HTML special characters in URL and shortcode to prevent attribute injection
+ const safeUrl = url.replace(/&/g, "&").replace(/"/g, """).replace(//g, ">");
+ const safeShortcode = shortcode.replace(/&/g, "&").replace(/"/g, """).replace(//g, ">");
const escaped = shortcode.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
const pattern = new RegExp(`:${escaped}:`, "g");
result = result.replace(
pattern,
- `
`,
+ `
`,
);
}
return result;
@@ -349,20 +354,11 @@ export async function extractObjectData(object, options = {}) {
// Quote URL — Fedify reads quoteUrl / _misskey_quote / quoteUri
const quoteUrl = object.quoteUrl?.href || "";
- // Interaction counts — extract from AP Collection objects
+ // Interaction counts — not fetched at ingest time. The three collection
+ // fetches (getReplies, getLikes, getShares) each trigger an HTTP round-trip
+ // for counts that are ephemeral and stale moments after fetching. Removed
+ // per audit M11 to save 3 network calls per inbound activity.
const counts = { replies: null, boosts: null, likes: null };
- try {
- const replies = await object.getReplies?.(loaderOpts);
- if (replies?.totalItems != null) counts.replies = replies.totalItems;
- } catch { /* ignore — collection may not exist */ }
- try {
- const likes = await object.getLikes?.(loaderOpts);
- if (likes?.totalItems != null) counts.likes = likes.totalItems;
- } catch { /* ignore */ }
- try {
- const shares = await object.getShares?.(loaderOpts);
- if (shares?.totalItems != null) counts.boosts = shares.totalItems;
- } catch { /* ignore */ }
// Replace custom emoji :shortcode: in content with inline ![]()
tags.
// Applied after sanitization — these are trusted emoji from the post's tags.
diff --git a/package-lock.json b/package-lock.json
index 91815f4..72fe5a0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,19 +1,20 @@
{
"name": "@rmdes/indiekit-endpoint-activitypub",
- "version": "2.1.2",
+ "version": "3.9.4",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "@rmdes/indiekit-endpoint-activitypub",
- "version": "2.1.2",
+ "version": "3.9.4",
"license": "MIT",
"dependencies": {
- "@fedify/debugger": "^2.0.0",
- "@fedify/fedify": "^2.0.0",
- "@fedify/redis": "^2.0.0",
+ "@fedify/debugger": "^2.1.0",
+ "@fedify/fedify": "^2.1.0",
+ "@fedify/redis": "^2.1.0",
"@js-temporal/polyfill": "^0.5.0",
"express": "^5.0.0",
+ "express-rate-limit": "^7.5.1",
"ioredis": "^5.9.3",
"sanitize-html": "^2.13.1",
"unfurl.js": "^6.4.0"
@@ -22,6 +23,7 @@
"node": ">=22"
},
"peerDependencies": {
+ "@indiekit/endpoint-micropub": "^1.0.0-beta.25",
"@indiekit/error": "^1.0.0-beta.25",
"@indiekit/frontend": "^1.0.0-beta.25"
}
@@ -513,12 +515,12 @@
}
},
"node_modules/@fedify/debugger": {
- "version": "2.0.0",
- "resolved": "https://registry.npmjs.org/@fedify/debugger/-/debugger-2.0.0.tgz",
- "integrity": "sha512-2ZGXKQa+BqAO9F+tuZcDiLHDr193cUqKlnX1Z7yDn1ICPL1gPxxwgKAa1b540pBBWSfDCXBSrJlZ3DYK9f52GA==",
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/@fedify/debugger/-/debugger-2.1.0.tgz",
+ "integrity": "sha512-4s3L3/NkofZCUXR1jADq5ukSbWybpWqgqF4TEg3PHxlXkC3bT/LI4as8zFxTpkkCvM5fE6tXCi5z56rJ9tXzag==",
"dependencies": {
"@js-temporal/polyfill": "^0.5.1",
- "@logtape/logtape": "^2.0.0",
+ "@logtape/logtape": "^2.0.5",
"@opentelemetry/api": "^1.9.0",
"@opentelemetry/context-async-hooks": "^2.5.0",
"@opentelemetry/core": "^2.5.0",
@@ -526,24 +528,24 @@
"hono": "^4.0.0"
},
"peerDependencies": {
- "@fedify/fedify": "^2.0.0"
+ "@fedify/fedify": "^2.1.0"
}
},
"node_modules/@fedify/fedify": {
- "version": "2.0.0",
- "resolved": "https://registry.npmjs.org/@fedify/fedify/-/fedify-2.0.0.tgz",
- "integrity": "sha512-ZejBFXfILViuIHYhI1BWEk1Pewt9hNO70u6GVaWYKWwU3IVc1/HEsGA/kK9IxJKYZBPqLcCtoI2BZfeOg8I/Hg==",
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/@fedify/fedify/-/fedify-2.1.0.tgz",
+ "integrity": "sha512-CMGlL9HEaqyuQL4Ma0Jv+9/QgtLjj+HLmjNrg1e/WUQrEwZg9p5WYKk4iNKXF4aIG3XJkAv5UGJlHKF09HifNA==",
"funding": [
"https://opencollective.com/fedify",
"https://github.com/sponsors/dahlia"
],
"license": "MIT",
"dependencies": {
- "@fedify/vocab": "2.0.0",
- "@fedify/vocab-runtime": "2.0.0",
- "@fedify/webfinger": "2.0.0",
+ "@fedify/vocab": "2.1.0",
+ "@fedify/vocab-runtime": "2.1.0",
+ "@fedify/webfinger": "2.1.0",
"@js-temporal/polyfill": "^0.5.1",
- "@logtape/logtape": "^2.0.0",
+ "@logtape/logtape": "^2.0.5",
"@opentelemetry/api": "^1.9.0",
"@opentelemetry/core": "^2.5.0",
"@opentelemetry/sdk-trace-base": "^2.5.0",
@@ -552,7 +554,6 @@
"es-toolkit": "1.43.0",
"json-canon": "^1.0.1",
"jsonld": "^9.0.0",
- "multicodec": "^3.2.1",
"structured-field-values": "^2.0.4",
"uri-template-router": "^1.0.0",
"url-template": "^3.1.1",
@@ -565,9 +566,9 @@
}
},
"node_modules/@fedify/redis": {
- "version": "2.0.0",
- "resolved": "https://registry.npmjs.org/@fedify/redis/-/redis-2.0.0.tgz",
- "integrity": "sha512-WHUhEHZ0BAbcmITgDTdspeolfl4bHpRx+BlmdVRsGScaoQODvvohBfRcTCGbMz2RfQmkhz4l297Nk8Nlqyvg7Q==",
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/@fedify/redis/-/redis-2.1.0.tgz",
+ "integrity": "sha512-Fqud46FIEBFXDFad029rS46ZlVlWZU2zT6yhBs63jtat7QwMIHDSisizvoVyky4a41TX0ItBNqiAdYELLv/0NQ==",
"funding": [
"https://opencollective.com/fedify",
"https://github.com/sponsors/dahlia"
@@ -575,34 +576,33 @@
"license": "MIT",
"dependencies": {
"@js-temporal/polyfill": "^0.5.1",
- "@logtape/logtape": "^2.0.0"
+ "@logtape/logtape": "^2.0.5"
},
"peerDependencies": {
- "@fedify/fedify": "^2.0.0",
+ "@fedify/fedify": "^2.1.0",
"ioredis": "^5.8.2"
}
},
"node_modules/@fedify/vocab": {
- "version": "2.0.0",
- "resolved": "https://registry.npmjs.org/@fedify/vocab/-/vocab-2.0.0.tgz",
- "integrity": "sha512-sjw51UltqefhGPxkcSrnwdmBHO5Zm3hOlOHFvzsLg1pbl53KKETcJ8TG6OcMaD0ZiaUqFVKkGAlpDG3FD9O4nw==",
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/@fedify/vocab/-/vocab-2.1.0.tgz",
+ "integrity": "sha512-tGCgo8kCj6Zwf1JxYsXtEwReujzgitndf59Pdo1BY21UgpAlAe0daY8vdpRM+NybZ4JbOBtM4bH473LVtJlVEA==",
"funding": [
"https://opencollective.com/fedify",
"https://github.com/sponsors/dahlia"
],
"license": "MIT",
"dependencies": {
- "@fedify/vocab-runtime": "2.0.0",
- "@fedify/vocab-tools": "2.0.0",
- "@fedify/webfinger": "2.0.0",
+ "@fedify/vocab-runtime": "2.1.0",
+ "@fedify/vocab-tools": "2.1.0",
+ "@fedify/webfinger": "2.1.0",
"@js-temporal/polyfill": "^0.5.1",
- "@logtape/logtape": "^2.0.0",
+ "@logtape/logtape": "^2.0.5",
"@multiformats/base-x": "^4.0.1",
"@opentelemetry/api": "^1.9.0",
"asn1js": "^3.0.6",
"es-toolkit": "1.43.0",
"jsonld": "^9.0.0",
- "multicodec": "^3.2.1",
"pkijs": "^3.3.3"
},
"engines": {
@@ -612,21 +612,21 @@
}
},
"node_modules/@fedify/vocab-runtime": {
- "version": "2.0.0",
- "resolved": "https://registry.npmjs.org/@fedify/vocab-runtime/-/vocab-runtime-2.0.0.tgz",
- "integrity": "sha512-Cdcbhki75kBi20Eq0Dkpf1XXXVKVwnOzK4O/b4MKH6kmUPEcVyNVb9L3+ZZElViE+kAZ0bmYLlFNp42E7mjjLQ==",
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/@fedify/vocab-runtime/-/vocab-runtime-2.1.0.tgz",
+ "integrity": "sha512-rISQFJbuRrt1OX9yG+xVUn7DwBTajpOOvy5jdx2ZuRUMvtlD7bgDEUSSS5a7pFuYliKVbR5ZFk6BPAkJC1OnAw==",
"funding": [
"https://opencollective.com/fedify",
"https://github.com/sponsors/dahlia"
],
"license": "MIT",
"dependencies": {
- "@logtape/logtape": "^2.0.0",
+ "@logtape/logtape": "^2.0.5",
"@multiformats/base-x": "^4.0.1",
"@opentelemetry/api": "^1.9.0",
"asn1js": "^3.0.6",
"byte-encodings": "^1.0.11",
- "multicodec": "^3.2.1",
+ "jsonld": "^9.0.0",
"pkijs": "^3.3.3"
},
"engines": {
@@ -636,9 +636,9 @@
}
},
"node_modules/@fedify/vocab-tools": {
- "version": "2.0.0",
- "resolved": "https://registry.npmjs.org/@fedify/vocab-tools/-/vocab-tools-2.0.0.tgz",
- "integrity": "sha512-AQ1zjGt4wjaTjTOHCgDroNITiSeZ1z99ygNEkmukg5EwgjF7+DVoPV+OTrmVVW/2A6t1blJzfOS0wrlzsn5lqQ==",
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/@fedify/vocab-tools/-/vocab-tools-2.1.0.tgz",
+ "integrity": "sha512-Gn07LbMoDRVDjklDZH9y/fZ2nwH7ryjillgLpw8qsbjUeVaTViR1Oz/oG2N7S13UqyKttYPzK8hH/utKr1LbXg==",
"funding": [
"https://opencollective.com/fedify",
"https://github.com/sponsors/dahlia"
@@ -657,17 +657,17 @@
}
},
"node_modules/@fedify/webfinger": {
- "version": "2.0.0",
- "resolved": "https://registry.npmjs.org/@fedify/webfinger/-/webfinger-2.0.0.tgz",
- "integrity": "sha512-D66ZdyUUM9BNQU7OGEWmNLU+FIHApUiYnEogOa5oNj9fy0vjOfxm9hynA+0SCm3emrKrLt6Gm120Re+T5Us5Yg==",
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/@fedify/webfinger/-/webfinger-2.1.0.tgz",
+ "integrity": "sha512-G5yrCPw1oWijvkGOMjWZFOWohmljQ4pmHgK7BuESshcAizpKRU0t5GcOGMyPzcNrO4+diaddGNg48GFzZ9mK/g==",
"funding": [
"https://opencollective.com/fedify",
"https://github.com/sponsors/dahlia"
],
"license": "MIT",
"dependencies": {
- "@fedify/vocab-runtime": "2.0.0",
- "@logtape/logtape": "^2.0.0",
+ "@fedify/vocab-runtime": "2.1.0",
+ "@logtape/logtape": "^2.0.5",
"@opentelemetry/api": "^1.9.0",
"es-toolkit": "1.43.0"
},
@@ -1167,10 +1167,31 @@
"url": "https://opencollective.com/libvips"
}
},
+ "node_modules/@indiekit/endpoint-micropub": {
+ "version": "1.0.0-beta.27",
+ "resolved": "https://registry.npmjs.org/@indiekit/endpoint-micropub/-/endpoint-micropub-1.0.0-beta.27.tgz",
+ "integrity": "sha512-0NAiAYte5u+w3kh2dDAXbzA9b8Hujoiue59OHEen8/w1ZHyOI/Zp1ctlErrakFBqElPx6ZyfDbbrBXpaCudXbQ==",
+ "license": "MIT",
+ "peer": true,
+ "dependencies": {
+ "@indiekit/error": "^1.0.0-beta.27",
+ "@indiekit/util": "^1.0.0-beta.25",
+ "@paulrobertlloyd/mf2tojf2": "^3.0.0",
+ "debug": "^4.3.2",
+ "express": "^5.0.0",
+ "lodash": "^4.17.21",
+ "markdown-it": "^14.0.0",
+ "newbase60": "^1.3.1",
+ "turndown": "^7.1.1"
+ },
+ "engines": {
+ "node": ">=20"
+ }
+ },
"node_modules/@indiekit/error": {
- "version": "1.0.0-beta.25",
- "resolved": "https://registry.npmjs.org/@indiekit/error/-/error-1.0.0-beta.25.tgz",
- "integrity": "sha512-ZDM6cyC4qPaosv4Ji1gGObSYpOlHNMqys9v428E7/XvK1qT3uW5S8mAeqGu7ErbWdMZINe0ua0fuZwBlGmSPLg==",
+ "version": "1.0.0-beta.27",
+ "resolved": "https://registry.npmjs.org/@indiekit/error/-/error-1.0.0-beta.27.tgz",
+ "integrity": "sha512-Y0XIM1fptHf3i4cfxcIMqueMtqEJ6rOn2qtiYCmJcreiuG72CwaOjXtTW7CELpW/o4B0aZ9pUTEr8ef2+qvRIQ==",
"license": "MIT",
"peer": true,
"engines": {
@@ -1241,14 +1262,21 @@
}
},
"node_modules/@logtape/logtape": {
- "version": "2.0.2",
- "resolved": "https://registry.npmjs.org/@logtape/logtape/-/logtape-2.0.2.tgz",
- "integrity": "sha512-cveUBLbCMFkvkLycP/2vNWvywl47JcJbazHIju94/QNGboZ/jyYAgZIm0ZXezAOx3eIz8OG1EOZ5CuQP3+2FQg==",
+ "version": "2.0.5",
+ "resolved": "https://registry.npmjs.org/@logtape/logtape/-/logtape-2.0.5.tgz",
+ "integrity": "sha512-UizDkh20ZPJVOddRxG1F77WhHdlNl/sbQgoO8T534R7XvUBMAJ9En9f35u+meW2tRsNLvjz6R87Zanwf53tspQ==",
"funding": [
"https://github.com/sponsors/dahlia"
],
"license": "MIT"
},
+ "node_modules/@mixmark-io/domino": {
+ "version": "2.2.0",
+ "resolved": "https://registry.npmjs.org/@mixmark-io/domino/-/domino-2.2.0.tgz",
+ "integrity": "sha512-Y28PR25bHXUg88kCV7nivXrP2Nj2RueZ3/l/jdx6J9f8J4nsEGcgX0Qe6lt7Pa+J79+kPiJU3LguR6O/6zrLOw==",
+ "license": "BSD-2-Clause",
+ "peer": true
+ },
"node_modules/@mongodb-js/saslprep": {
"version": "1.4.6",
"resolved": "https://registry.npmjs.org/@mongodb-js/saslprep/-/saslprep-1.4.6.tgz",
@@ -1355,6 +1383,19 @@
"node": ">=14"
}
},
+ "node_modules/@paulrobertlloyd/mf2tojf2": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/@paulrobertlloyd/mf2tojf2/-/mf2tojf2-3.0.0.tgz",
+ "integrity": "sha512-R94UVfQ1RrJSvVEco7jk3yeACLCtEixLm6sPnBNjEPpvYr9IitOh9xSFWTT5eFSjT9qYEpBz9SYv3N/g7LK3Dg==",
+ "license": "MIT",
+ "peer": true,
+ "dependencies": {
+ "microformats-parser": "^2.0.0"
+ },
+ "engines": {
+ "node": ">=22"
+ }
+ },
"node_modules/@sindresorhus/slugify": {
"version": "3.0.0",
"resolved": "https://registry.npmjs.org/@sindresorhus/slugify/-/slugify-3.0.0.tgz",
@@ -2046,6 +2087,21 @@
"url": "https://opencollective.com/express"
}
},
+ "node_modules/express-rate-limit": {
+ "version": "7.5.1",
+ "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-7.5.1.tgz",
+ "integrity": "sha512-7iN8iPMDzOMHPUYllBEsQdWVB6fPDMPqwjBaFrgr4Jgr/+okjvzAy+UHlYYL/Vs0OsOrMkwS6PJDkFlJwoxUnw==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/express-rate-limit"
+ },
+ "peerDependencies": {
+ "express": ">= 4.11"
+ }
+ },
"node_modules/finalhandler": {
"version": "2.1.1",
"resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz",
@@ -2770,6 +2826,19 @@
"url": "https://github.com/sponsors/sindresorhus"
}
},
+ "node_modules/microformats-parser": {
+ "version": "2.0.4",
+ "resolved": "https://registry.npmjs.org/microformats-parser/-/microformats-parser-2.0.4.tgz",
+ "integrity": "sha512-DA2yt3uz2JjupBGoNvaG9ngBP5vSTI1ky2yhxBai/RnQrlzo+gEzuCdvwIIjj2nh3uVPDybTP5u7uua7pOa6LA==",
+ "license": "MIT",
+ "peer": true,
+ "dependencies": {
+ "parse5": "^7.1.2"
+ },
+ "engines": {
+ "node": ">=18"
+ }
+ },
"node_modules/mime-db": {
"version": "1.54.0",
"resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
@@ -2899,23 +2968,6 @@
"integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
"license": "MIT"
},
- "node_modules/multicodec": {
- "version": "3.2.1",
- "resolved": "https://registry.npmjs.org/multicodec/-/multicodec-3.2.1.tgz",
- "integrity": "sha512-+expTPftro8VAW8kfvcuNNNBgb9gPeNYV9dn+z1kJRWF2vih+/S79f2RVeIwmrJBUJ6NT9IUPWnZDQvegEh5pw==",
- "deprecated": "This module has been superseded by the multiformats module",
- "license": "MIT",
- "dependencies": {
- "uint8arrays": "^3.0.0",
- "varint": "^6.0.0"
- }
- },
- "node_modules/multiformats": {
- "version": "9.9.0",
- "resolved": "https://registry.npmjs.org/multiformats/-/multiformats-9.9.0.tgz",
- "integrity": "sha512-HoMUjhH9T8DDBNT+6xzkrd9ga/XiBI4xLr58LJACwK6G3HTOPeMz4nB4KJs33L2BelrIJa7P0VuNaVF3hMYfjg==",
- "license": "(Apache-2.0 AND MIT)"
- },
"node_modules/nanoid": {
"version": "3.3.11",
"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
@@ -2943,6 +2995,12 @@
"node": ">= 0.6"
}
},
+ "node_modules/newbase60": {
+ "version": "1.3.1",
+ "resolved": "https://registry.npmjs.org/newbase60/-/newbase60-1.3.1.tgz",
+ "integrity": "sha512-2bjwvv8ytc4YQXXnV7lSz7yzQv01eYcdhhX/lo3OWkXgRSxfbbQb922s+6uiC4i5HbNlNu8Vtu9mSZ/xKRaTkg==",
+ "peer": true
+ },
"node_modules/node-fetch": {
"version": "2.7.0",
"resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
@@ -3028,6 +3086,32 @@
"integrity": "sha512-/2qh0lav6CmI15FzA3i/2Bzk2zCgQhGMkvhOhKNcBVQ1ldgpbfiNTVslmooUmWJcADi1f1kIeynbDRVzNlfR6Q==",
"license": "MIT"
},
+ "node_modules/parse5": {
+ "version": "7.3.0",
+ "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.3.0.tgz",
+ "integrity": "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==",
+ "license": "MIT",
+ "peer": true,
+ "dependencies": {
+ "entities": "^6.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/inikulin/parse5?sponsor=1"
+ }
+ },
+ "node_modules/parse5/node_modules/entities": {
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
+ "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==",
+ "license": "BSD-2-Clause",
+ "peer": true,
+ "engines": {
+ "node": ">=0.12"
+ },
+ "funding": {
+ "url": "https://github.com/fb55/entities?sponsor=1"
+ }
+ },
"node_modules/parseurl": {
"version": "1.3.3",
"resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
@@ -3054,9 +3138,9 @@
"license": "ISC"
},
"node_modules/pkijs": {
- "version": "3.3.3",
- "resolved": "https://registry.npmjs.org/pkijs/-/pkijs-3.3.3.tgz",
- "integrity": "sha512-+KD8hJtqQMYoTuL1bbGOqxb4z+nZkTAwVdNtWwe8Tc2xNbEmdJYIYoc6Qt0uF55e6YW6KuTHw1DjQ18gMhzepw==",
+ "version": "3.4.0",
+ "resolved": "https://registry.npmjs.org/pkijs/-/pkijs-3.4.0.tgz",
+ "integrity": "sha512-emEcLuomt2j03vxD54giVB4SxTjnsqkU692xZOZXHDVoYyypEm+b3jpiTcc+Cf+myooc+/Ly0z01jqeNHVgJGw==",
"license": "BSD-3-Clause",
"dependencies": {
"@noble/hashes": "1.4.0",
@@ -3515,6 +3599,16 @@
"integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
"license": "0BSD"
},
+ "node_modules/turndown": {
+ "version": "7.2.2",
+ "resolved": "https://registry.npmjs.org/turndown/-/turndown-7.2.2.tgz",
+ "integrity": "sha512-1F7db8BiExOKxjSMU2b7if62D/XOyQyZbPKq/nUwopfgnHlqXHqQ0lvfUTeUIr1lZJzOPFn43dODyMSIfvWRKQ==",
+ "license": "MIT",
+ "peer": true,
+ "dependencies": {
+ "@mixmark-io/domino": "^2.2.0"
+ }
+ },
"node_modules/type-is": {
"version": "2.0.1",
"resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.1.tgz",
@@ -3543,19 +3637,10 @@
"license": "MIT",
"peer": true
},
- "node_modules/uint8arrays": {
- "version": "3.1.1",
- "resolved": "https://registry.npmjs.org/uint8arrays/-/uint8arrays-3.1.1.tgz",
- "integrity": "sha512-+QJa8QRnbdXVpHYjLoTpJIdCTiw9Ir62nocClWuXIq2JIh4Uta0cQsTSpFL678p2CN8B+XSApwcU+pQEqVpKWg==",
- "license": "MIT",
- "dependencies": {
- "multiformats": "^9.4.2"
- }
- },
"node_modules/undici": {
- "version": "6.23.0",
- "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
- "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+ "version": "6.24.1",
+ "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
+ "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==",
"license": "MIT",
"engines": {
"node": ">=18.17"
@@ -3628,12 +3713,6 @@
"integrity": "sha512-IGjKp/o0NL3Bso1PymYURCJxMPNAf/ILOpendP9f5B6e1rTJgdgiOvgfoT8VxCAdY+Wisb9uhGaJJf3yZ2V9nw==",
"license": "MIT"
},
- "node_modules/varint": {
- "version": "6.0.0",
- "resolved": "https://registry.npmjs.org/varint/-/varint-6.0.0.tgz",
- "integrity": "sha512-cXEIW6cfr15lFv563k4GuVuW/fiwjknytD37jIOLSdSWuOI6WnO/oKwmP2FQTU2l01LP8/M5TSAJpzUaGe3uWg==",
- "license": "MIT"
- },
"node_modules/vary": {
"version": "1.1.2",
"resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
@@ -3672,9 +3751,9 @@
"license": "ISC"
},
"node_modules/yaml": {
- "version": "2.8.2",
- "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.2.tgz",
- "integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==",
+ "version": "2.8.3",
+ "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+ "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
"license": "ISC",
"bin": {
"yaml": "bin.mjs"
diff --git a/package.json b/package.json
index f29b3e3..b560a14 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "@rmdes/indiekit-endpoint-activitypub",
- "version": "3.8.5",
+ "version": "3.10.0",
"description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
"keywords": [
"indiekit",
@@ -37,11 +37,12 @@
"url": "https://github.com/rmdes/indiekit-endpoint-activitypub/issues"
},
"dependencies": {
- "@fedify/debugger": "^2.0.0",
- "@fedify/fedify": "^2.0.0",
- "@fedify/redis": "^2.0.0",
+ "@fedify/debugger": "^2.1.0",
+ "@fedify/fedify": "^2.1.0",
+ "@fedify/redis": "^2.1.0",
"@js-temporal/polyfill": "^0.5.0",
"express": "^5.0.0",
+ "express-rate-limit": "^7.5.1",
"ioredis": "^5.9.3",
"sanitize-html": "^2.13.1",
"unfurl.js": "^6.4.0"
diff --git a/views/activitypub-federation-mgmt.njk b/views/activitypub-federation-mgmt.njk
index d76b37e..d2eca50 100644
--- a/views/activitypub-federation-mgmt.njk
+++ b/views/activitypub-federation-mgmt.njk
@@ -34,7 +34,7 @@
{% endif %}
-