Files
Ricardo 40eb2f8f09 fix: audit fixes for account ID, update_credentials, interactions, edit payload
- Account ID: use URL-based hash for all accounts (local+remote) so
  verify_credentials and status serialization produce matching IDs.
  Clients can now show edit/delete buttons on own posts.
- update_credentials: pass handle+counts instead of collections to
  serializeCredentialAccount, add broadcastActorUpdate for federation
- favourited_by/reblogged_by: query ap_notifications (incoming) instead
  of ap_interactions (outgoing local) for who liked/boosted a post
- Status edit: send content-warning and sensitive in Micropub replace
  payload alongside content
2026-04-01 15:12:27 +02:00

32 lines
1.1 KiB
JavaScript

/**
* Deterministic ID mapping for Mastodon Client API.
*
* All accounts (local and remote) use sha256(actorUrl).slice(0, 24)
* for stable, consistent IDs. This ensures verify_credentials and
* status serialization produce the same ID for the local user,
* even though the profile doc has _id but timeline author objects don't.
*/
import crypto from "node:crypto";
/**
* Generate a deterministic ID for an actor URL.
* @param {string} actorUrl - The actor's URL
* @returns {string} 24-character hex ID
*/
export function remoteActorId(actorUrl) {
return crypto.createHash("sha256").update(actorUrl).digest("hex").slice(0, 24);
}
/**
* Get the Mastodon API ID for an account.
* Uses URL-based hash for all accounts (local and remote) so the ID
* is consistent regardless of whether the actor object has a MongoDB _id.
* @param {object} actor - Actor object (local profile or remote author)
* @param {boolean} _isLocal - Unused (kept for API compatibility)
* @returns {string}
*/
export function accountId(actor, _isLocal = false) {
const url = actor.url || actor.actorUrl || "";
return url ? remoteActorId(url) : "0";
}