@commonpub/layer 0.1.0

package/server/plugins/auto-admin.ts

@@ -0,0 +1,69 @@
+/**
+ * Admin bootstrap plugin.
+ *
+ * In development: promotes the first registered user to admin.
+ * In production: promotes ADMIN_BOOTSTRAP_USER (env var) if no admin exists.
+ *
+ * This solves the bootstrap problem where no admin exists to promote users.
+ * The production path only runs ONCE (when admin count is 0) and requires
+ * an explicit env var, so it's safe to leave enabled.
+ */
+import { users } from '@commonpub/schema';
+import { eq, asc, count } from 'drizzle-orm';
+
+export default defineNitroPlugin((nitro) => {
+  // Run after a short delay so the DB pool is ready
+  setTimeout(async () => {
+    try {
+      const db = useDB();
+
+      // Count admin users
+      const [adminCount] = await db
+        .select({ count: count() })
+        .from(users)
+        .where(eq(users.role, 'admin'));
+
+      if (adminCount && adminCount.count > 0) return;
+
+      // No admins exist — bootstrap one
+
+      // Production: promote specific user from env var
+      const bootstrapUsername = process.env.ADMIN_BOOTSTRAP_USER;
+      if (process.env.NODE_ENV === 'production' && !bootstrapUsername) return;
+
+      let targetUser: { id: string; username: string } | undefined;
+
+      if (bootstrapUsername) {
+        // Promote the specified user
+        const [found] = await db
+          .select({ id: users.id, username: users.username })
+          .from(users)
+          .where(eq(users.username, bootstrapUsername))
+          .limit(1);
+        targetUser = found;
+        if (!targetUser) {
+          console.warn(`[auto-admin] ADMIN_BOOTSTRAP_USER="${bootstrapUsername}" not found`);
+        }
+      } else {
+        // Dev mode: promote first registered user
+        const [firstUser] = await db
+          .select({ id: users.id, username: users.username })
+          .from(users)
+          .orderBy(asc(users.createdAt))
+          .limit(1);
+        targetUser = firstUser;
+      }
+
+      if (!targetUser) return;
+
+      await db
+        .update(users)
+        .set({ role: 'admin' })
+        .where(eq(users.id, targetUser.id));
+
+      console.log(`[auto-admin] Promoted "${targetUser.username}" to admin`);
+    } catch {
+      // DB not ready yet — safe to ignore, will work on next restart
+    }
+  }, 2000);
+});

package/server/plugins/federation-delivery.ts

@@ -0,0 +1,74 @@
+/**
+ * Federation activity delivery worker.
+ * Runs on a configurable interval to deliver pending outbound AP activities.
+ * Also runs daily cleanup of old delivered activities.
+ */
+import { deliverPendingActivities, cleanupDeliveredActivities } from '@commonpub/server';
+
+export default defineNitroPlugin((nitro) => {
+  if (process.env.NODE_ENV === 'test') return;
+
+  let interval: ReturnType<typeof setInterval> | null = null;
+  let cleanupCounter = 0;
+
+  const startupTimer = setTimeout(() => {
+    try {
+      const config = useConfig();
+      if (!config.features.federation) {
+        console.log('[federation] Federation disabled — delivery worker not started');
+        return;
+      }
+
+      const runtimeConfig = useRuntimeConfig();
+      const siteUrl = (runtimeConfig.public?.siteUrl as string) || `https://${config.instance.domain}`;
+      const domain = siteUrl.replace(/^https?:\/\//, '').replace(/[:/].*$/, '');
+
+      const fedConfig = config.federation ?? {};
+      const intervalMs = fedConfig.deliveryIntervalMs ?? 30_000;
+      const batchSize = fedConfig.deliveryBatchSize ?? 20;
+      const maxRetries = fedConfig.maxDeliveryRetries ?? 6;
+      const retentionDays = fedConfig.activityRetentionDays ?? 90;
+
+      console.log(`[federation] Activity delivery worker started (domain: ${domain}, interval: ${intervalMs}ms, batch: ${batchSize})`);
+
+      runDelivery(domain, batchSize, maxRetries, retentionDays);
+
+      interval = setInterval(() => runDelivery(domain, batchSize, maxRetries, retentionDays), intervalMs);
+    } catch (err) {
+      console.error('[federation] Delivery worker failed to start:', err instanceof Error ? err.message : err);
+    }
+  }, 5_000);
+
+  async function runDelivery(domain: string, batchSize: number, maxRetries: number, retentionDays: number) {
+    try {
+      const db = useDB();
+      const result = await deliverPendingActivities(db, domain, { batchSize, maxRetries });
+      if (result.delivered > 0 || result.failed > 0) {
+        console.log(`[federation] Delivered: ${result.delivered}, Failed: ${result.failed}`);
+      }
+      if (result.errors.length > 0) {
+        console.warn('[federation] Delivery errors:', result.errors.slice(0, 3).join('; '));
+      }
+
+      cleanupCounter++;
+      const cleanupEvery = Math.max(1, Math.round((24 * 60 * 60 * 1000) / (30_000)));
+      if (cleanupCounter >= cleanupEvery) {
+        cleanupCounter = 0;
+        const deleted = await cleanupDeliveredActivities(db, retentionDays);
+        if (deleted > 0) {
+          console.log(`[federation] Cleaned up ${deleted} old delivered activities`);
+        }
+      }
+    } catch (err) {
+      console.error('[federation] Delivery worker error:', err instanceof Error ? err.message : err);
+    }
+  }
+
+  nitro.hooks.hook('close', () => {
+    clearTimeout(startupTimer);
+    if (interval) {
+      clearInterval(interval);
+      interval = null;
+    }
+  });
+});

package/server/routes/.well-known/nodeinfo.ts

@@ -0,0 +1,15 @@
+// NodeInfo discovery endpoint
+// Returns links to the NodeInfo document
+
+export default defineEventHandler((event) => {
+  const origin = getRequestURL(event).origin;
+
+  return {
+    links: [
+      {
+        rel: 'http://nodeinfo.diaspora.software/ns/schema/2.1',
+        href: `${origin}/nodeinfo/2.1`,
+      },
+    ],
+  };
+});

package/server/routes/.well-known/webfinger.ts

@@ -0,0 +1,86 @@
+// WebFinger endpoint — RFC 7033
+import { parseWebFingerResource, buildWebFingerResponse } from '@commonpub/protocol';
+import { getUserByUsername, getHubBySlug } from '@commonpub/server';
+
+export default defineEventHandler(async (event) => {
+  const query = getQuery(event);
+  const resource = query.resource as string | undefined;
+
+  if (!resource) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: 'Missing resource parameter',
+    });
+  }
+
+  const parsed = parseWebFingerResource(resource);
+  if (!parsed) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: 'Invalid resource format. Expected acct:user@domain',
+    });
+  }
+
+  const requestUrl = getRequestURL(event);
+  const instanceDomain = requestUrl.host;
+
+  if (parsed.domain !== instanceDomain) {
+    throw createError({
+      statusCode: 404,
+      statusMessage: 'Resource not found on this instance',
+    });
+  }
+
+  const config = useConfig();
+
+  // CORS — WebFinger must be accessible from browser-based AP clients
+  setResponseHeader(event, 'access-control-allow-origin', '*');
+
+  // Instance actor lookup: acct:domain@domain → /actor Service
+  if (parsed.username === instanceDomain || parsed.username === config.instance.domain) {
+    const actorUri = `https://${instanceDomain}/actor`;
+    setResponseHeader(event, 'content-type', 'application/jrd+json');
+    return buildWebFingerResponse({
+      username: instanceDomain,
+      domain: instanceDomain,
+      actorUri,
+      oauthEndpoint: `https://${instanceDomain}/api/auth/oauth2/authorize`,
+    });
+  }
+
+  // Look up user in database
+  const db = useDB();
+  const profile = await getUserByUsername(db, parsed.username);
+
+  // If not a user, try hub lookup (Group actor)
+  if (!profile && config.features.federation && config.features.federateHubs) {
+    const hub = await getHubBySlug(db, parsed.username);
+    if (hub) {
+      const hubActorUri = `https://${instanceDomain}/hubs/${parsed.username}`;
+      setResponseHeader(event, 'content-type', 'application/jrd+json');
+      return buildWebFingerResponse({
+        username: parsed.username,
+        domain: instanceDomain,
+        actorUri: hubActorUri,
+      });
+    }
+  }
+
+  if (!profile) {
+    throw createError({
+      statusCode: 404,
+      statusMessage: 'User not found',
+    });
+  }
+
+  const actorUri = `https://${instanceDomain}/users/${parsed.username}`;
+
+  setResponseHeader(event, 'content-type', 'application/jrd+json');
+
+  return buildWebFingerResponse({
+    username: parsed.username,
+    domain: instanceDomain,
+    actorUri,
+    oauthEndpoint: `https://${instanceDomain}/api/auth/oauth2/authorize`,
+  });
+});

package/server/routes/actor/followers.ts

@@ -0,0 +1,34 @@
+import { getFollowers } from '@commonpub/server';
+
+/**
+ * Instance actor followers collection.
+ * Returns remote actors that follow this instance (for mirroring).
+ */
+export default defineEventHandler(async (event) => {
+  const config = useConfig();
+  if (!config.features.federation) {
+    throw createError({ statusCode: 404, statusMessage: 'Not Found' });
+  }
+
+  const db = useDB();
+  const domain = config.instance.domain;
+  const actorUri = `https://${domain}/actor`;
+
+  let followers: string[] = [];
+  try {
+    const result = await getFollowers(db, actorUri);
+    followers = result.map((f) => f.followerActorUri);
+  } catch {
+    // Federation tables may not exist yet
+  }
+
+  setResponseHeader(event, 'content-type', 'application/activity+json');
+
+  return {
+    '@context': 'https://www.w3.org/ns/activitystreams',
+    id: `${actorUri}/followers`,
+    type: 'OrderedCollection',
+    totalItems: followers.length,
+    orderedItems: followers,
+  };
+});

package/server/routes/actor/following.ts

@@ -0,0 +1,34 @@
+import { getFollowing } from '@commonpub/server';
+
+/**
+ * Instance actor following collection.
+ * Returns remote actors that this instance follows (mirrors).
+ */
+export default defineEventHandler(async (event) => {
+  const config = useConfig();
+  if (!config.features.federation) {
+    throw createError({ statusCode: 404, statusMessage: 'Not Found' });
+  }
+
+  const db = useDB();
+  const domain = config.instance.domain;
+  const actorUri = `https://${domain}/actor`;
+
+  let following: string[] = [];
+  try {
+    const result = await getFollowing(db, actorUri);
+    following = result.map((f) => f.followingActorUri);
+  } catch {
+    // Federation tables may not exist yet
+  }
+
+  setResponseHeader(event, 'content-type', 'application/activity+json');
+
+  return {
+    '@context': 'https://www.w3.org/ns/activitystreams',
+    id: `${actorUri}/following`,
+    type: 'OrderedCollection',
+    totalItems: following.length,
+    orderedItems: following,
+  };
+});

package/server/routes/actor/outbox.ts

@@ -0,0 +1,31 @@
+import { generateOutboxCollection, generateOutboxPage } from '@commonpub/protocol';
+import { countInstanceOutboxItems, getInstanceOutboxPage } from '@commonpub/server';
+
+const PAGE_SIZE = 20;
+
+/**
+ * Instance actor outbox — serves paginated outbound Create activities
+ * from all users on this instance. Used by backfill crawlers.
+ */
+export default defineEventHandler(async (event) => {
+  const config = useConfig();
+  if (!config.features.federation) {
+    throw createError({ statusCode: 404, statusMessage: 'Not Found' });
+  }
+
+  const db = useDB();
+  const domain = config.instance.domain;
+  const query = getQuery(event);
+  const page = query.page ? parseInt(String(query.page), 10) : 0;
+
+  setResponseHeader(event, 'content-type', 'application/activity+json');
+
+  const totalItems = await countInstanceOutboxItems(db, domain);
+
+  if (!page || isNaN(page)) {
+    return generateOutboxCollection(totalItems, domain, null);
+  }
+
+  const items = await getInstanceOutboxPage(db, domain, page, PAGE_SIZE);
+  return generateOutboxPage(items as never[], domain, null, page, PAGE_SIZE, totalItems);
+});

package/server/routes/actor.ts

@@ -0,0 +1,30 @@
+import { getOrCreateInstanceKeypair, buildInstanceActor } from '@commonpub/server';
+
+/**
+ * Instance actor endpoint — returns the AP Service object for this instance.
+ * Used by other instances for mirroring (Follow the instance actor to receive all content).
+ * Content-negotiated: AP clients get JSON-LD, browsers get redirected to /about.
+ */
+export default defineEventHandler(async (event) => {
+  const config = useConfig();
+  if (!config.features.federation) {
+    throw createError({ statusCode: 404, statusMessage: 'Not Found' });
+  }
+
+  const accept = getRequestHeader(event, 'accept') ?? '';
+  const isAPRequest =
+    accept.includes('application/activity+json') ||
+    accept.includes('application/ld+json');
+
+  if (!isAPRequest) {
+    // Browser request — redirect to about page
+    return sendRedirect(event, '/about', 302);
+  }
+
+  const db = useDB();
+  const { publicKeyPem } = await getOrCreateInstanceKeypair(db);
+  const actor = buildInstanceActor(config.instance.domain, publicKeyPem);
+
+  setResponseHeader(event, 'content-type', 'application/activity+json');
+  return actor;
+});

package/server/routes/feed.xml.ts

@@ -0,0 +1,59 @@
+import { listContent } from '@commonpub/server';
+
+function escapeXml(str: string): string {
+  return str
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;');
+}
+
+export default defineEventHandler(async (event) => {
+  const db = useDB();
+  const config = useRuntimeConfig();
+  const siteUrl = config.public.siteUrl as string;
+  const siteName = config.public.siteName as string;
+  const siteDescription = config.public.siteDescription as string;
+
+  const { items } = await listContent(db, {
+    status: 'published',
+    sort: 'recent',
+    limit: 50,
+  });
+
+  const lastBuildDate = items.length > 0
+    ? new Date(items[0].publishedAt ?? items[0].createdAt).toUTCString()
+    : new Date().toUTCString();
+
+  const rssItems = items.map((item) => {
+    const link = `${siteUrl}/${item.type}/${item.slug}`;
+    const pubDate = new Date(item.publishedAt ?? item.createdAt).toUTCString();
+    return `    <item>
+      <title>${escapeXml(item.title)}</title>
+      <link>${escapeXml(link)}</link>
+      <guid isPermaLink="true">${escapeXml(link)}</guid>
+      <pubDate>${pubDate}</pubDate>
+      <description>${escapeXml(item.description ?? '')}</description>
+      <author>${escapeXml(item.author.displayName ?? item.author.username)}</author>
+      <category>${escapeXml(item.type)}</category>
+    </item>`;
+  });
+
+  const xml = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
+  <channel>
+    <title>${escapeXml(siteName)}</title>
+    <link>${escapeXml(siteUrl)}</link>
+    <description>${escapeXml(siteDescription)}</description>
+    <language>en</language>
+    <lastBuildDate>${lastBuildDate}</lastBuildDate>
+    <atom:link href="${escapeXml(siteUrl)}/feed.xml" rel="self" type="application/rss+xml"/>
+${rssItems.join('\n')}
+  </channel>
+</rss>`;
+
+  setResponseHeader(event, 'Content-Type', 'application/rss+xml; charset=utf-8');
+  setResponseHeader(event, 'Cache-Control', 'public, max-age=600, stale-while-revalidate=300');
+  return xml;
+});

package/server/routes/hubs/[slug]/followers.ts

@@ -0,0 +1,39 @@
+import { getHubBySlug, getHubFederatedFollowers, getHubActorUri } from '@commonpub/server';
+
+/**
+ * Hub Group actor followers collection.
+ * Returns an OrderedCollection of remote actors following this hub.
+ */
+export default defineEventHandler(async (event) => {
+  const config = useConfig();
+  if (!config.features.federation || !config.features.federateHubs) {
+    throw createError({ statusCode: 404, statusMessage: 'Not Found' });
+  }
+
+  const slug = getRouterParam(event, 'slug');
+  if (!slug) {
+    throw createError({ statusCode: 404, statusMessage: 'Not Found' });
+  }
+
+  const db = useDB();
+  const domain = config.instance.domain;
+
+  const hub = await getHubBySlug(db, slug);
+  if (!hub) {
+    throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+  }
+
+  const hubActorUri = getHubActorUri(domain, slug);
+  const followers = await getHubFederatedFollowers(db, hub.id);
+  const followerUris = followers.map((f) => f.followerActorUri);
+
+  setResponseHeader(event, 'content-type', 'application/activity+json');
+
+  return {
+    '@context': 'https://www.w3.org/ns/activitystreams',
+    id: `${hubActorUri}/followers`,
+    type: 'OrderedCollection',
+    totalItems: followerUris.length,
+    orderedItems: followerUris,
+  };
+});

package/server/routes/hubs/[slug]/inbox.ts

@@ -0,0 +1,35 @@
+import { processInboxActivity } from '@commonpub/protocol';
+import { createInboxHandlers } from '@commonpub/server';
+import { verifyInboxRequest } from '../../../utils/inbox';
+
+/**
+ * Hub-specific inbox endpoint (FEP-1b12).
+ * Receives activities directed at the hub Group actor.
+ * Delegates to the same inbox handlers as the shared inbox.
+ */
+export default defineEventHandler(async (event) => {
+  const config = useConfig();
+  if (!config.features.federation || !config.features.federateHubs) {
+    throw createError({ statusCode: 404, statusMessage: 'Not Found' });
+  }
+
+  if (event.method !== 'POST') {
+    throw createError({ statusCode: 405, statusMessage: 'Method Not Allowed' });
+  }
+
+  // Verify signature, domain, date freshness, body size
+  const { body } = await verifyInboxRequest(event, 'hub-inbox');
+
+  const db = useDB();
+  const domain = config.instance.domain;
+  const slug = getRouterParam(event, 'slug');
+  const handlers = createInboxHandlers({ db, domain, hubContext: slug ? { hubSlug: slug } : undefined });
+
+  try {
+    await processInboxActivity(body, handlers);
+    return { status: 'accepted' };
+  } catch (err) {
+    console.error('[hub-inbox] Activity processing error:', err);
+    throw createError({ statusCode: 400, statusMessage: 'Activity processing failed' });
+  }
+});

package/server/routes/hubs/[slug]/outbox.ts

@@ -0,0 +1,43 @@
+import { generateOutboxCollection, generateOutboxPage } from '@commonpub/protocol';
+import { getHubBySlug, countHubOutboxItems, getHubOutboxPage, getHubActorUri } from '@commonpub/server';
+
+const PAGE_SIZE = 20;
+
+/**
+ * Hub Group actor outbox — serves paginated outbound Announce activities.
+ */
+export default defineEventHandler(async (event) => {
+  const config = useConfig();
+  if (!config.features.federation || !config.features.federateHubs) {
+    throw createError({ statusCode: 404, statusMessage: 'Not Found' });
+  }
+
+  const slug = getRouterParam(event, 'slug');
+  if (!slug) {
+    throw createError({ statusCode: 404, statusMessage: 'Not Found' });
+  }
+
+  const db = useDB();
+  const domain = config.instance.domain;
+
+  const hub = await getHubBySlug(db, slug);
+  if (!hub) {
+    throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+  }
+
+  const hubActorUri = getHubActorUri(domain, slug);
+  const outboxUri = `${hubActorUri}/outbox`;
+  const query = getQuery(event);
+  const page = query.page ? parseInt(String(query.page), 10) : 0;
+
+  setResponseHeader(event, 'content-type', 'application/activity+json');
+
+  const totalItems = await countHubOutboxItems(db, hubActorUri);
+
+  if (!page || isNaN(page)) {
+    return generateOutboxCollection(totalItems, domain, null, outboxUri);
+  }
+
+  const items = await getHubOutboxPage(db, hubActorUri, page, PAGE_SIZE);
+  return generateOutboxPage(items as never[], domain, null, page, PAGE_SIZE, totalItems, outboxUri);
+});

package/server/routes/hubs/[slug]/posts/[postId].ts

@@ -0,0 +1,63 @@
+import { getHubBySlug, getHubActorUri, getHubPostNoteUri } from '@commonpub/server';
+import { AP_CONTEXT, AP_PUBLIC, escapeHtmlForAP } from '@commonpub/protocol';
+import { hubPosts, users } from '@commonpub/schema';
+import { eq } from 'drizzle-orm';
+
+/**
+ * Hub post AP Note endpoint.
+ * Serves the Note JSON-LD when requested with AP Accept header.
+ * Remote instances dereference this URI when processing Announce activities.
+ */
+export default defineEventHandler(async (event) => {
+  const accept = getRequestHeader(event, 'accept') ?? '';
+  const isAPRequest =
+    accept.includes('application/activity+json') ||
+    accept.includes('application/ld+json');
+
+  if (!isAPRequest) return;
+
+  const config = useConfig();
+  if (!config.features.federation || !config.features.federateHubs) return;
+
+  const slug = getRouterParam(event, 'slug');
+  const postId = getRouterParam(event, 'postId');
+  if (!slug || !postId) return;
+
+  const db = useDB();
+  const domain = config.instance.domain;
+
+  const hub = await getHubBySlug(db, slug);
+  if (!hub) return;
+
+  const [post] = await db
+    .select({
+      id: hubPosts.id,
+      content: hubPosts.content,
+      createdAt: hubPosts.createdAt,
+      authorUsername: users.username,
+    })
+    .from(hubPosts)
+    .innerJoin(users, eq(hubPosts.authorId, users.id))
+    .where(eq(hubPosts.id, postId))
+    .limit(1);
+
+  if (!post) return;
+
+  const hubActorUri = getHubActorUri(domain, slug);
+  const noteUri = getHubPostNoteUri(domain, slug, postId);
+  const actorUri = `https://${domain}/users/${post.authorUsername}`;
+
+  setResponseHeader(event, 'content-type', 'application/activity+json');
+
+  return {
+    '@context': AP_CONTEXT,
+    type: 'Note',
+    id: noteUri,
+    attributedTo: actorUri,
+    content: escapeHtmlForAP(post.content),
+    published: post.createdAt.toISOString(),
+    to: [AP_PUBLIC],
+    cc: [`${hubActorUri}/followers`],
+    context: hubActorUri,
+  };
+});

package/server/routes/hubs/[slug].ts

@@ -0,0 +1,29 @@
+import { buildHubGroupActor } from '@commonpub/server';
+
+/**
+ * Hub Group actor endpoint. Returns AP Group JSON-LD for federation.
+ * Only responds to ActivityPub clients (Accept: application/activity+json).
+ * Browser requests pass through to the Nuxt page handler.
+ */
+export default defineEventHandler(async (event) => {
+  const accept = getRequestHeader(event, 'accept') ?? '';
+  const isAPRequest =
+    accept.includes('application/activity+json') ||
+    accept.includes('application/ld+json');
+
+  // Only handle AP requests — let browser requests fall through to the page handler
+  if (!isAPRequest) return;
+
+  const config = useConfig();
+  if (!config.features.federation || !config.features.federateHubs) return;
+
+  const slug = getRouterParam(event, 'slug');
+  if (!slug) return;
+
+  const db = useDB();
+  const actor = await buildHubGroupActor(db, slug, config.instance.domain);
+  if (!actor) return;
+
+  setResponseHeader(event, 'content-type', 'application/activity+json');
+  return actor;
+});