fix: disable Mastodon external like/repost status posts

Serve like/repost posts as Note objects for AP content negotiation.
Returning a bare Like/Announce activity broke Mastodon's
authorize_interaction because it expects a content object (Note/Article).
Now like posts are served as ❤️ Note and reposts as 🔁 Note.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

package.json

@@ -4,8 +4,8 @@
   "description": "",
   "main": "index.js",
   "scripts": {
-    "postinstall": "xattr -w com.apple.fileprovider.ignore#P 1 node_modules 2>/dev/null || true && node scripts/patch-lightningcss.mjs && node scripts/patch-endpoint-media-scope.mjs && node scripts/patch-endpoint-media-sharp-runtime.mjs && node scripts/patch-frontend-sharp-runtime.mjs && node scripts/patch-endpoint-files-upload-route.mjs && node scripts/patch-endpoint-files-upload-locales.mjs && node scripts/patch-endpoint-activitypub-locales.mjs && node scripts/patch-endpoint-activitypub-docloader-loglevel.mjs && node scripts/patch-endpoint-activitypub-private-url-docloader.mjs && node scripts/patch-endpoint-activitypub-migrate-alias-clear.mjs && node scripts/patch-endpoint-homepage-locales.mjs && node scripts/patch-endpoint-homepage-identity-defaults.mjs && node scripts/patch-federation-unlisted-guards.mjs && node scripts/patch-endpoint-micropub-where-note-visibility.mjs && node scripts/patch-endpoint-posts-ai-fields.mjs && node scripts/patch-endpoint-posts-ai-cleanup.mjs && node scripts/patch-endpoint-podroll-opml-upload.mjs && node scripts/patch-preset-eleventy-ai-frontmatter.mjs && node scripts/patch-micropub-ai-block-resync.mjs && node scripts/patch-frontend-serviceworker-file.mjs && node scripts/patch-endpoint-comments-locales.mjs && node scripts/patch-conversations-collection-guards.mjs && node scripts/patch-conversations-mastodon-disconnect.mjs && node scripts/patch-indiekit-routes-rate-limits.mjs && node scripts/patch-indiekit-error-production-stack.mjs && node scripts/patch-indieauth-devmode-guard.mjs && node scripts/patch-listening-endpoint-runtime-guards.mjs && node scripts/patch-endpoint-github-changelog-categories.mjs && node scripts/patch-endpoint-activitypub-like-boost-methods.mjs && node scripts/patch-microsub-reader-ap-dispatch.mjs",
+    "postinstall": "xattr -w com.apple.fileprovider.ignore#P 1 node_modules 2>/dev/null || true && node scripts/patch-lightningcss.mjs && node scripts/patch-endpoint-media-scope.mjs && node scripts/patch-endpoint-media-sharp-runtime.mjs && node scripts/patch-frontend-sharp-runtime.mjs && node scripts/patch-endpoint-files-upload-route.mjs && node scripts/patch-endpoint-files-upload-locales.mjs && node scripts/patch-endpoint-activitypub-locales.mjs && node scripts/patch-endpoint-activitypub-docloader-loglevel.mjs && node scripts/patch-endpoint-activitypub-private-url-docloader.mjs && node scripts/patch-endpoint-activitypub-migrate-alias-clear.mjs && node scripts/patch-endpoint-homepage-locales.mjs && node scripts/patch-endpoint-homepage-identity-defaults.mjs && node scripts/patch-federation-unlisted-guards.mjs && node scripts/patch-endpoint-micropub-where-note-visibility.mjs && node scripts/patch-endpoint-posts-ai-fields.mjs && node scripts/patch-endpoint-posts-ai-cleanup.mjs && node scripts/patch-endpoint-podroll-opml-upload.mjs && node scripts/patch-preset-eleventy-ai-frontmatter.mjs && node scripts/patch-micropub-ai-block-resync.mjs && node scripts/patch-frontend-serviceworker-file.mjs && node scripts/patch-endpoint-comments-locales.mjs && node scripts/patch-conversations-collection-guards.mjs && node scripts/patch-conversations-mastodon-disconnect.mjs && node scripts/patch-indiekit-routes-rate-limits.mjs && node scripts/patch-indiekit-error-production-stack.mjs && node scripts/patch-indieauth-devmode-guard.mjs && node scripts/patch-listening-endpoint-runtime-guards.mjs && node scripts/patch-endpoint-github-changelog-categories.mjs && node scripts/patch-endpoint-activitypub-like-boost-methods.mjs && node scripts/patch-microsub-reader-ap-dispatch.mjs && node scripts/patch-activitypub-like-repost-content-negotiation.mjs",
-    "serve": "export NODE_ENV=${NODE_ENV:-production} INDIEKIT_DEBUG=${INDIEKIT_DEBUG:-0} && node scripts/preflight-production-security.mjs && node scripts/preflight-mongo-connection.mjs && node scripts/preflight-activitypub-rsa-key.mjs && node scripts/preflight-activitypub-profile-urls.mjs && node scripts/patch-lightningcss.mjs && node scripts/patch-endpoint-media-scope.mjs && node scripts/patch-endpoint-media-sharp-runtime.mjs && node scripts/patch-frontend-sharp-runtime.mjs && node scripts/patch-endpoint-files-upload-route.mjs && node scripts/patch-endpoint-files-upload-locales.mjs && node scripts/patch-endpoint-activitypub-locales.mjs && node scripts/patch-endpoint-activitypub-docloader-loglevel.mjs && node scripts/patch-endpoint-activitypub-private-url-docloader.mjs && node scripts/patch-endpoint-activitypub-migrate-alias-clear.mjs && node scripts/patch-endpoint-homepage-locales.mjs && node scripts/patch-endpoint-homepage-identity-defaults.mjs && node scripts/patch-federation-unlisted-guards.mjs && node scripts/patch-endpoint-micropub-where-note-visibility.mjs && node scripts/patch-endpoint-posts-ai-fields.mjs && node scripts/patch-endpoint-posts-ai-cleanup.mjs && node scripts/patch-endpoint-podroll-opml-upload.mjs && node scripts/patch-preset-eleventy-ai-frontmatter.mjs && node scripts/patch-micropub-ai-block-resync.mjs && node scripts/patch-frontend-serviceworker-file.mjs && node scripts/patch-endpoint-comments-locales.mjs && node scripts/patch-conversations-collection-guards.mjs && node scripts/patch-conversations-mastodon-disconnect.mjs && node scripts/patch-indiekit-routes-rate-limits.mjs && node scripts/patch-indiekit-error-production-stack.mjs && node scripts/patch-indieauth-devmode-guard.mjs && node scripts/patch-listening-endpoint-runtime-guards.mjs && node scripts/patch-endpoint-github-changelog-categories.mjs && node scripts/patch-endpoint-activitypub-like-boost-methods.mjs && node scripts/patch-microsub-reader-ap-dispatch.mjs && node node_modules/@indiekit/indiekit/bin/cli.js serve --config indiekit.config.mjs",
+    "serve": "export NODE_ENV=${NODE_ENV:-production} INDIEKIT_DEBUG=${INDIEKIT_DEBUG:-0} && node scripts/preflight-production-security.mjs && node scripts/preflight-mongo-connection.mjs && node scripts/preflight-activitypub-rsa-key.mjs && node scripts/preflight-activitypub-profile-urls.mjs && node scripts/patch-lightningcss.mjs && node scripts/patch-endpoint-media-scope.mjs && node scripts/patch-endpoint-media-sharp-runtime.mjs && node scripts/patch-frontend-sharp-runtime.mjs && node scripts/patch-endpoint-files-upload-route.mjs && node scripts/patch-endpoint-files-upload-locales.mjs && node scripts/patch-endpoint-activitypub-locales.mjs && node scripts/patch-endpoint-activitypub-docloader-loglevel.mjs && node scripts/patch-endpoint-activitypub-private-url-docloader.mjs && node scripts/patch-endpoint-activitypub-migrate-alias-clear.mjs && node scripts/patch-endpoint-homepage-locales.mjs && node scripts/patch-endpoint-homepage-identity-defaults.mjs && node scripts/patch-federation-unlisted-guards.mjs && node scripts/patch-endpoint-micropub-where-note-visibility.mjs && node scripts/patch-endpoint-posts-ai-fields.mjs && node scripts/patch-endpoint-posts-ai-cleanup.mjs && node scripts/patch-endpoint-podroll-opml-upload.mjs && node scripts/patch-preset-eleventy-ai-frontmatter.mjs && node scripts/patch-micropub-ai-block-resync.mjs && node scripts/patch-frontend-serviceworker-file.mjs && node scripts/patch-endpoint-comments-locales.mjs && node scripts/patch-conversations-collection-guards.mjs && node scripts/patch-conversations-mastodon-disconnect.mjs && node scripts/patch-indiekit-routes-rate-limits.mjs && node scripts/patch-indiekit-error-production-stack.mjs && node scripts/patch-indieauth-devmode-guard.mjs && node scripts/patch-listening-endpoint-runtime-guards.mjs && node scripts/patch-endpoint-github-changelog-categories.mjs && node scripts/patch-endpoint-activitypub-like-boost-methods.mjs && node scripts/patch-microsub-reader-ap-dispatch.mjs && node scripts/patch-activitypub-like-repost-content-negotiation.mjs && node node_modules/@indiekit/indiekit/bin/cli.js serve --config indiekit.config.mjs",
     "test": "echo \"Error: no test specified\" && exit 1"
   },
   "keywords": [],

scripts/patch-activitypub-like-repost-content-negotiation.mjs

@@ -0,0 +1,113 @@
+import { access, readFile, writeFile } from "node:fs/promises";
+
+const patchSpecs = [
+  {
+    name: "activitypub-like-repost-content-negotiation-as-note",
+    candidates: [
+      "node_modules/@rmdes/indiekit-endpoint-activitypub/lib/jf2-to-as2.js",
+    ],
+    replacements: [
+      {
+        // Serve like/repost posts as Note objects for content negotiation.
+        // Returning a bare Like/Announce activity breaks Mastodon's
+        // authorize_interaction because it expects a content object (Note/Article).
+        oldSnippet: [
+          "  if (postType === \"like\") {",
+          "    return {",
+          "      \"@context\": \"https://www.w3.org/ns/activitystreams\",",
+          "      type: \"Like\",",
+          "      actor: actorUrl,",
+          "      object: properties[\"like-of\"],",
+          "    };",
+          "  }",
+          "",
+          "  if (postType === \"repost\") {",
+          "    return {",
+          "      \"@context\": \"https://www.w3.org/ns/activitystreams\",",
+          "      type: \"Announce\",",
+          "      actor: actorUrl,",
+          "      object: properties[\"repost-of\"],",
+          "    };",
+          "  }",
+        ].join("\n"),
+        newSnippet: [
+          "  if (postType === \"like\") {",
+          "    // Serve like posts as Note objects for AP content negotiation.",
+          "    // Returning a bare Like activity breaks Mastodon's authorize_interaction",
+          "    // flow because it expects a content object (Note/Article), not an activity.",
+          "    const likeOf = properties[\"like-of\"];",
+          "    const postUrl = resolvePostUrl(properties.url, publicationUrl);",
+          "    return {",
+          '      "@context": "https://www.w3.org/ns/activitystreams",',
+          '      type: "Note",',
+          "      id: postUrl,",
+          "      attributedTo: actorUrl,",
+          "      published: properties.published,",
+          "      url: postUrl,",
+          '      to: ["https://www.w3.org/ns/activitystreams#Public"],',
+          '      cc: [`${actorUrl.replace(/\\/$/, "")}/followers`],',
+          '      content: `\\u2764\\uFE0F <a href="${likeOf}">${likeOf}</a>`,',
+          "    };",
+          "  }",
+          "",
+          "  if (postType === \"repost\") {",
+          "    // Same rationale as like — serve as Note for content negotiation.",
+          "    const repostOf = properties[\"repost-of\"];",
+          "    const postUrl = resolvePostUrl(properties.url, publicationUrl);",
+          "    return {",
+          '      "@context": "https://www.w3.org/ns/activitystreams",',
+          '      type: "Note",',
+          "      id: postUrl,",
+          "      attributedTo: actorUrl,",
+          "      published: properties.published,",
+          "      url: postUrl,",
+          '      to: ["https://www.w3.org/ns/activitystreams#Public"],',
+          '      cc: [`${actorUrl.replace(/\\/$/, "")}/followers`],',
+          '      content: `\\u{1F501} <a href="${repostOf}">${repostOf}</a>`,',
+          "    };",
+          "  }",
+        ].join("\n"),
+      },
+    ],
+  },
+];
+
+async function applyPatch(spec) {
+  let filePath = null;
+  for (const candidate of spec.candidates) {
+    try {
+      await access(candidate);
+      filePath = candidate;
+      break;
+    } catch {
+      // try next
+    }
+  }
+
+  if (!filePath) {
+    console.warn(`[postinstall] ${spec.name}: no candidate file found, skipping`);
+    return;
+  }
+
+  let content = await readFile(filePath, "utf8");
+
+  for (const { oldSnippet, newSnippet } of spec.replacements) {
+    if (content.includes(newSnippet)) {
+      continue; // already applied
+    }
+    if (!content.includes(oldSnippet)) {
+      console.warn(`[postinstall] ${spec.name}: expected snippet not found in ${filePath}`);
+      continue;
+    }
+    content = content.replace(oldSnippet, newSnippet);
+  }
+
+  await writeFile(filePath, content, "utf8");
+  console.log(`[postinstall] ${spec.name} patch applied to ${filePath}`);
+}
+
+(async () => {
+  for (const spec of patchSpecs) {
+    await applyPatch(spec);
+  }
+})();