From f03f9050d97f7879e8a22c905f05a11a41ce8b96 Mon Sep 17 00:00:00 2001
From: svemagie <869694+svemagie@users.noreply.github.com>
Date: Sat, 25 Apr 2026 21:16:07 +0200
Subject: [PATCH] fix(federation): wire baseUrl through createFedifyMiddleware
 to fromExpressRequest
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The function was called with publicationUrl as 3rd arg (ap-base-url patch)
but never accepted it — Fedify saw localhost:3000 instead of blog.giersig.eu,
causing webfinger hostname check to fail and return onNotFound → next() →
indieauth.authenticate() → 302 redirect for all public federation endpoints.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 lib/federation-bridge.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/federation-bridge.js b/lib/federation-bridge.js
index a910b2f..1191ce9 100644
--- a/lib/federation-bridge.js
+++ b/lib/federation-bridge.js
@@ -143,7 +143,7 @@ async function sendFedifyResponse(res, response, request) {
  * @param {Function} contextDataFactory - (req) => contextData
  * @returns {import("express").RequestHandler}
  */
-export function createFedifyMiddleware(federation, contextDataFactory) {
+export function createFedifyMiddleware(federation, contextDataFactory, baseUrl) { // ap-base-url patch
   return async (req, res, next) => {
     try {
       // Buffer application/activity+json and ld+json request bodies ourselves —
@@ -180,7 +180,7 @@ export function createFedifyMiddleware(federation, contextDataFactory) {
         return res.status(200).end();
       }
 
-      const request = fromExpressRequest(req);
+      const request = fromExpressRequest(req, baseUrl); // ap-base-url patch
       const contextData = await Promise.resolve(contextDataFactory(req));
 
       let notFound = false;