@commonpub/layer 0.15.5 → 0.15.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonpub/layer",
-  "version": "0.15.5",
+  "version": "0.15.7",
   "type": "module",
   "main": "./nuxt.config.ts",
   "files": [
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1010.0",
-    "@commonpub/explainer": "^0.7.11",
+    "@commonpub/explainer": "^0.7.12",
     "@commonpub/schema": "^0.13.0",
     "@commonpub/server": "^2.43.0",
     "@tiptap/core": "^2.11.0",
@@ -53,12 +53,12 @@
     "vue": "^3.4.0",
     "vue-router": "^4.3.0",
     "zod": "^4.3.6",
-    "@commonpub/docs": "0.6.2",
-    "@commonpub/config": "0.10.0",
     "@commonpub/auth": "0.5.1",
+    "@commonpub/config": "0.10.0",
+    "@commonpub/docs": "0.6.2",
     "@commonpub/editor": "0.7.9",
-    "@commonpub/protocol": "0.9.9",
     "@commonpub/learning": "0.5.0",
+    "@commonpub/protocol": "0.9.9",
     "@commonpub/ui": "0.8.5"
   },
   "devDependencies": {

package/pages/[type]/index.vue

@@ -1,10 +1,19 @@
 <script setup lang="ts">
 import type { Serialized, ContentListItem, PaginatedResponse } from '@commonpub/server';
+import type { ContentType } from '../../composables/useContentTypes';
 
 const route = useRoute();
 const contentType = computed(() => route.params.type as string);
 const siteName = useSiteName();
 const { user } = useAuth();
+const { isTypeEnabled } = useContentTypes();
+
+// Hard 404 for any path that isn't an enabled content type — this catch-all
+// route would otherwise match /foo, /@username, /wp-admin, /.env, etc. and
+// render a broken empty listing with the URL segment as the "type".
+if (!isTypeEnabled(contentType.value as ContentType)) {
+  throw createError({ statusCode: 404, statusMessage: 'Not Found' });
+}
 
 useSeoMeta({
   title: () => `${contentType.value} — ${siteName}`,

package/server/middleware/hub-post-ap.ts

@@ -21,7 +21,10 @@ export default defineEventHandler(async (event) => {
   if (!isAPRequest) return;
 
   const path = getRequestURL(event).pathname;
-  const match = path.match(/^\/hubs\/([a-z0-9][a-z0-9_-]*)\/posts\/([a-zA-Z0-9_-]+)$/);
+  // postId must be a UUID — anything else short-circuits before the drizzle
+  // query, which would otherwise throw on invalid UUID input and 500 for
+  // federation peers that probe bad URIs.
+  const match = path.match(/^\/hubs\/([a-z0-9][a-z0-9_-]*)\/posts\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/);
   if (!match) return;
 
   const config = useConfig();

package/server/middleware/mastodon-alias-redirect.ts

@@ -0,0 +1,45 @@
+import { users, hubs } from '@commonpub/schema';
+import { eq, and, isNull } from 'drizzle-orm';
+
+/**
+ * Redirect /@handle → canonical profile URL.
+ *
+ * WebFinger advertises `/@username` as the `profile-page` (Mastodon/Fediverse
+ * convention) — without this middleware, that URL falls through to the
+ * `[type]/index.vue` catchall and renders a broken content listing for
+ * "@usernames". Federated users clicking a CommonPub member's profile from
+ * Mastodon end up on a broken page.
+ *
+ * Matches /@{handle} exactly (no sub-paths). Looks up users first, then hubs
+ * (both are advertised via WebFinger). Misses 404.
+ */
+export default defineEventHandler(async (event) => {
+  const path = getRequestURL(event).pathname;
+  const match = path.match(/^\/@([a-zA-Z0-9._-]+)$/);
+  if (!match) return;
+
+  const handle = match[1]!;
+  const db = useDB();
+
+  const [user] = await db
+    .select({ username: users.username })
+    .from(users)
+    .where(and(eq(users.username, handle), isNull(users.deletedAt)))
+    .limit(1);
+
+  if (user) {
+    return sendRedirect(event, `/u/${user.username}`, 301);
+  }
+
+  const [hub] = await db
+    .select({ slug: hubs.slug })
+    .from(hubs)
+    .where(and(eq(hubs.slug, handle), isNull(hubs.deletedAt)))
+    .limit(1);
+
+  if (hub) {
+    return sendRedirect(event, `/hubs/${hub.slug}`, 301);
+  }
+
+  throw createError({ statusCode: 404, statusMessage: 'Not Found' });
+});

package/server/routes/content/[slug].ts

@@ -3,12 +3,15 @@ import { contentItems, users } from '@commonpub/schema';
 import { eq, and, isNull } from 'drizzle-orm';
 
 /**
- * Content AP Article endpoint.
- * Serves Article JSON-LD when requested with AP Accept header.
- * Remote instances dereference this URI when processing:
- * - Create activities (content federation)
- * - Announce activities (hub share federation)
- * - Like/Boost activities targeting content
+ * Legacy content URI: /content/:slug
+ *
+ * AP clients (Accept: application/activity+json) get Article JSON-LD —
+ * remote instances still dereference this legacy URI when processing old
+ * Create/Announce/Like activities created before the URL restructure.
+ *
+ * Browsers get a 301 redirect to the canonical /u/:author/:type/:slug URL.
+ * Anything else would be a dead 204 (this is a server route, not middleware,
+ * and there's no Nuxt page at /content/:slug to fall through to).
  */
 export default defineEventHandler(async (event) => {
   const accept = getRequestHeader(event, 'accept') ?? '';
@@ -16,14 +19,12 @@ export default defineEventHandler(async (event) => {
     accept.includes('application/activity+json') ||
     accept.includes('application/ld+json');
 
-  if (!isAPRequest) return;
-
-  const config = useConfig();
-  if (!config.features.federation) return;
-
   const slug = getRouterParam(event, 'slug');
-  if (!slug) return;
+  if (!slug) {
+    throw createError({ statusCode: 404, statusMessage: 'Not Found' });
+  }
 
+  const config = useConfig();
   const db = useDB();
   const domain = config.instance.domain;
 
@@ -44,12 +45,23 @@ export default defineEventHandler(async (event) => {
     ))
     .limit(1);
 
-  if (!row) return;
+  if (!row) {
+    throw createError({ statusCode: 404, statusMessage: 'Content not found' });
+  }
+
+  // Browser: redirect to canonical URL.
+  if (!isAPRequest) {
+    return sendRedirect(event, `/u/${row.author.username}/${row.content.type}/${row.content.slug}`, 301);
+  }
+
+  // AP: serve Article JSON-LD.
+  if (!config.features.federation) {
+    throw createError({ statusCode: 404, statusMessage: 'Federation disabled' });
+  }
 
   setResponseHeader(event, 'content-type', 'application/activity+json');
 
-  // Render the content as an AP Article with all CommonPub extensions
-  const article = contentToArticle(
+  return contentToArticle(
     {
       id: row.content.id,
       type: row.content.type,
@@ -66,6 +78,4 @@ export default defineEventHandler(async (event) => {
     { username: row.author.username, displayName: row.author.displayName ?? row.author.username },
     domain,
   );
-
-  return article;
 });