@de-otio/trellis 0.4.0

package/dist/lib/activitypub/audience-service.js

@@ -0,0 +1,245 @@
+"use strict";
+/**
+ * ActivityPub Custom Audience Service
+ *
+ * Handles creation and management of custom audiences for fine-grained post targeting.
+ * Custom audiences are ActivityStreams OrderedCollections that can be used in post `to` fields.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CustomAudienceService = void 0;
+const fedify_1 = require("@fedify/fedify");
+const context_1 = require("./fedify/context");
+const user_actor_1 = require("./dispatchers/user-actor");
+/**
+ * Service for managing custom audiences
+ */
+class CustomAudienceService {
+    /**
+     * Generate collection URI for a custom audience
+     */
+    static generateCollectionUri(audienceId, env, requestUrl) {
+        const baseUrl = (0, context_1.getActivityPubBaseUrl)(env, requestUrl);
+        return `${baseUrl}/audiences/${audienceId}`;
+    }
+    /**
+     * Create a custom audience
+     */
+    static async createAudience(prisma, creator, name, memberIds, env, requestUrl) {
+        // Verify creator has ActivityPub fields
+        if (!creator.actorUri || !creator.publicKey) {
+            throw new Error("Creator does not have ActivityPub fields set");
+        }
+        // Validate name
+        if (!name || name.trim().length === 0) {
+            throw new Error("Audience name is required");
+        }
+        if (name.length > 100) {
+            throw new Error("Audience name must be 100 characters or less");
+        }
+        // Validate member IDs
+        if (memberIds.length === 0) {
+            throw new Error("Audience must have at least one member");
+        }
+        if (memberIds.length > 1000) {
+            throw new Error("Audience cannot have more than 1000 members");
+        }
+        // Verify all members exist and have ActivityPub fields
+        const members = await prisma.user.findMany({
+            where: {
+                id: { in: memberIds },
+                actorUri: { not: null },
+                publicKey: { not: null },
+                suspended: false,
+                deletionConfirmedAt: null, // User not deleted
+            },
+            select: {
+                id: true,
+            },
+        });
+        if (members.length !== memberIds.length) {
+            throw new Error("Some members not found or not configured for ActivityPub");
+        }
+        // Create audience
+        const audience = await prisma.customAudience.create({
+            data: {
+                name: name.trim(),
+                creatorId: creator.id,
+                collectionId: "", // Will be set after creation
+            },
+        });
+        // Generate collection URI
+        const collectionId = this.generateCollectionUri(audience.id, env, requestUrl);
+        // Update with collection ID
+        const updatedAudience = await prisma.customAudience.update({
+            where: { id: audience.id },
+            data: { collectionId },
+        });
+        // Add members
+        if (memberIds.length > 0) {
+            await prisma.customAudienceMember.createMany({
+                data: memberIds.map((memberId) => ({
+                    audienceId: audience.id,
+                    memberId,
+                })),
+                skipDuplicates: true,
+            });
+        }
+        return {
+            id: updatedAudience.id,
+            name: updatedAudience.name,
+            creatorId: updatedAudience.creatorId,
+            collectionId: updatedAudience.collectionId,
+            createdAt: updatedAudience.createdAt,
+            updatedAt: updatedAudience.updatedAt,
+        };
+    }
+    /**
+     * Get audience members (as actor URIs)
+     */
+    static async getMembers(prisma, audienceId, env, requestUrl) {
+        const audience = await prisma.customAudience.findUnique({
+            where: { id: audienceId },
+            include: {
+                members: {
+                    include: {
+                        member: {
+                            select: {
+                                id: true,
+                                actorUri: true,
+                                username: true,
+                            },
+                        },
+                    },
+                },
+            },
+        });
+        if (!audience) {
+            return [];
+        }
+        // Convert member IDs to actor URIs
+        return audience.members
+            .map((m) => {
+            if (!m.member.actorUri || !m.member.username)
+                return null;
+            return user_actor_1.UserActorDispatcher.generateActorUri(m.member.username, env);
+        })
+            .filter((uri) => uri !== null);
+    }
+    /**
+     * Add member to audience
+     */
+    static async addMember(prisma, audienceId, memberId) {
+        // Verify member exists and has ActivityPub fields
+        const member = await prisma.user.findUnique({
+            where: { id: memberId },
+            select: {
+                id: true,
+                actorUri: true,
+                publicKey: true,
+                suspended: true,
+                deletionConfirmedAt: true,
+            },
+        });
+        if (!member || !member.actorUri || !member.publicKey) {
+            throw new Error("Member not found or not configured for ActivityPub");
+        }
+        if (member.suspended || member.deletionConfirmedAt) {
+            throw new Error("Cannot add suspended or deleted user to audience");
+        }
+        // Add member (skip if already exists)
+        await prisma.customAudienceMember
+            .create({
+            data: {
+                audienceId,
+                memberId,
+            },
+        })
+            .catch((error) => {
+            // Ignore unique constraint violation (member already in audience)
+            if (error.code !== "P2002") {
+                throw error;
+            }
+        });
+    }
+    /**
+     * Remove member from audience
+     */
+    static async removeMember(prisma, audienceId, memberId) {
+        await prisma.customAudienceMember.deleteMany({
+            where: {
+                audienceId,
+                memberId,
+            },
+        });
+    }
+    /**
+     * Create Fedify OrderedCollection for a custom audience
+     */
+    static async createOrderedCollection(prisma, audienceId, env, requestUrl, page = 1, limit = 50) {
+        const audience = await prisma.customAudience.findUnique({
+            where: { id: audienceId },
+            include: {
+                members: {
+                    include: {
+                        member: {
+                            select: {
+                                id: true,
+                                actorUri: true,
+                                username: true,
+                            },
+                        },
+                    },
+                    orderBy: { addedAt: "asc" },
+                    skip: (page - 1) * limit,
+                    take: limit + 1,
+                },
+            },
+        });
+        if (!audience || !audience.collectionId) {
+            throw new Error("Audience not found");
+        }
+        const totalItems = await prisma.customAudienceMember.count({
+            where: { audienceId },
+        });
+        // Get member actor URIs
+        const hasMore = audience.members.length > limit;
+        const items = hasMore ? audience.members.slice(0, limit) : audience.members;
+        const orderedItems = items
+            .map((m) => {
+            if (!m.member.actorUri || !m.member.username)
+                return null;
+            return new URL(user_actor_1.UserActorDispatcher.generateActorUri(m.member.username, env));
+        })
+            .filter((uri) => uri !== null);
+        // Create Fedify OrderedCollection
+        const collection = new fedify_1.OrderedCollection({
+            id: new URL(audience.collectionId),
+            totalItems,
+        });
+        // Add ordered items
+        collection.orderedItems = orderedItems;
+        // Add pagination if needed
+        if (totalItems > limit) {
+            const firstPageUrl = new URL(audience.collectionId);
+            firstPageUrl.searchParams.set("page", "1");
+            collection.first = firstPageUrl;
+        }
+        return collection;
+    }
+    /**
+     * Resolve audience collection URI to member actor URIs
+     * Used by DeliveryService to deliver posts to custom audiences
+     */
+    static async resolveCollection(prisma, collectionUri, env, requestUrl) {
+        // Extract audience ID from URI
+        const match = collectionUri.match(/\/audiences\/([^\/\?]+)/);
+        if (!match) {
+            return [];
+        }
+        const audienceId = match[1];
+        // Get all members (no pagination for delivery)
+        return this.getMembers(prisma, audienceId, env, requestUrl);
+    }
+}
+exports.CustomAudienceService = CustomAudienceService;
+//# sourceMappingURL=audience-service.js.map

package/dist/lib/activitypub/audience-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience-service.js","sourceRoot":"","sources":["../../../src/lib/activitypub/audience-service.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAKH,2CAAmD;AAEnD,8CAAyD;AACzD,yDAA+D;AAE/D;;GAEG;AACH,MAAa,qBAAqB;IAChC;;OAEG;IACH,MAAM,CAAC,qBAAqB,CAC1B,UAAkB,EAClB,GAAQ,EACR,UAAmB;QAEnB,MAAM,OAAO,GAAG,IAAA,+BAAqB,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACvD,OAAO,GAAG,OAAO,cAAc,UAAU,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,cAAc,CACzB,MAAoB,EACpB,OAAa,EACb,IAAY,EACZ,SAAmB,EACnB,GAAQ,EACR,UAAmB;QASnB,wCAAwC;QACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,gBAAgB;QAChB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,sBAAsB;QACtB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,uDAAuD;QACvD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YACzC,KAAK,EAAE;gBACL,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;gBACrB,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;gBACvB,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;gBACxB,SAAS,EAAE,KAAK;gBAChB,mBAAmB,EAAE,IAAI,EAAE,mBAAmB;aAC/C;YACD,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;aACT;SACF,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QAED,kBAAkB;QAClB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC;YAClD,IAAI,EAAE;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;gBACjB,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,YAAY,EAAE,EAAE,EAAE,6BAA6B;aAChD;SACF,CAAC,CAAC;QAEH,0BAA0B;QAC1B,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,CAC7C,QAAQ,CAAC,EAAE,EACX,GAAG,EACH,UAAU,CACX,CAAC;QAEF,4BAA4B;QAC5B,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC;YACzD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;YAC1B,IAAI,EAAE,EAAE,YAAY,EAAE;SACvB,CAAC,CAAC;QAEH,cAAc;QACd,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,MAAM,CAAC,oBAAoB,CAAC,UAAU,CAAC;gBAC3C,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;oBACjC,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,QAAQ;iBACT,CAAC,CAAC;gBACH,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,EAAE,EAAE,eAAe,CAAC,EAAE;YACtB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,SAAS,EAAE,eAAe,CAAC,SAAS;YACpC,YAAY,EAAE,eAAe,CAAC,YAAY;YAC1C,SAAS,EAAE,eAAe,CAAC,SAAS;YACpC,SAAS,EAAE,eAAe,CAAC,SAAS;SACrC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CACrB,MAAoB,EACpB,UAAkB,EAClB,GAAQ,EACR,UAAmB;QAEnB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC;YACtD,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;YACzB,OAAO,EAAE;gBACP,OAAO,EAAE;oBACP,OAAO,EAAE;wBACP,MAAM,EAAE;4BACN,MAAM,EAAE;gCACN,EAAE,EAAE,IAAI;gCACR,QAAQ,EAAE,IAAI;gCACd,QAAQ,EAAE,IAAI;6BACf;yBACF;qBACF;iBACF;aACF;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,mCAAmC;QACnC,OAAO,QAAQ,CAAC,OAAO;aACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1D,OAAO,gCAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,CACpB,MAAoB,EACpB,UAAkB,EAClB,QAAgB;QAEhB,kDAAkD;QAClD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACvB,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,IAAI;gBACf,mBAAmB,EAAE,IAAI;aAC1B;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,sCAAsC;QACtC,MAAM,MAAM,CAAC,oBAAoB;aAC9B,MAAM,CAAC;YACN,IAAI,EAAE;gBACJ,UAAU;gBACV,QAAQ;aACT;SACF,CAAC;aACD,KAAK,CAAC,CAAC,KAAU,EAAE,EAAE;YACpB,kEAAkE;YAClE,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC3B,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,YAAY,CACvB,MAAoB,EACpB,UAAkB,EAClB,QAAgB;QAEhB,MAAM,MAAM,CAAC,oBAAoB,CAAC,UAAU,CAAC;YAC3C,KAAK,EAAE;gBACL,UAAU;gBACV,QAAQ;aACT;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAClC,MAAoB,EACpB,UAAkB,EAClB,GAAQ,EACR,UAAmB,EACnB,OAAe,CAAC,EAChB,QAAgB,EAAE;QAElB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC;YACtD,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;YACzB,OAAO,EAAE;gBACP,OAAO,EAAE;oBACP,OAAO,EAAE;wBACP,MAAM,EAAE;4BACN,MAAM,EAAE;gCACN,EAAE,EAAE,IAAI;gCACR,QAAQ,EAAE,IAAI;gCACd,QAAQ,EAAE,IAAI;6BACf;yBACF;qBACF;oBACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;oBAC3B,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK;oBACxB,IAAI,EAAE,KAAK,GAAG,CAAC;iBAChB;aACF;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC;YACzD,KAAK,EAAE,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,wBAAwB;QACxB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC5E,MAAM,YAAY,GAAG,KAAK;aACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1D,OAAO,IAAI,GAAG,CACZ,gCAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAC7D,CAAC;QACJ,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,GAAG,EAAc,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QAE7C,kCAAkC;QAClC,MAAM,UAAU,GAAG,IAAI,0BAAiB,CAAC;YACvC,EAAE,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;YAClC,UAAU;SACX,CAAC,CAAC;QAEH,oBAAoB;QACnB,UAAkB,CAAC,YAAY,GAAG,YAAY,CAAC;QAEhD,2BAA2B;QAC3B,IAAI,UAAU,GAAG,KAAK,EAAE,CAAC;YACvB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YACpD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC1C,UAAkB,CAAC,KAAK,GAAG,YAAY,CAAC;QAC3C,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAC5B,MAAoB,EACpB,aAAqB,EACrB,GAAQ,EACR,UAAmB;QAEnB,+BAA+B;QAC/B,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAE5B,+CAA+C;QAC/C,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;CACF;AAnTD,sDAmTC"}

package/dist/lib/activitypub/crypto.d.ts

@@ -0,0 +1,42 @@
+/**
+ * ActivityPub Cryptographic Key Management
+ *
+ * Handles RSA key pair generation and encryption for ActivityPub actors.
+ * Private keys are encrypted at rest for security.
+ */
+import type { Env } from "../../env";
+/**
+ * Service for managing cryptographic keys for ActivityPub actors
+ */
+export declare class KeyPairService {
+    /**
+     * Generate RSA key pair for ActivityPub actor
+     * Uses 2048-bit keys as per ActivityPub best practices
+     */
+    static generateKeyPair(): {
+        publicKey: string;
+        privateKey: string;
+    };
+    /**
+     * Encrypt private key for storage using AES-256-GCM
+     *
+     * @param privateKey - Private key in PEM format
+     * @param env - Environment object containing encryption key
+     * @returns Encrypted private key (base64 encoded)
+     */
+    static encryptPrivateKey(privateKey: string, env: Env): string;
+    /**
+     * Decrypt private key from storage
+     *
+     * @param encryptedKey - Encrypted private key (JSON string with iv, authTag, encrypted)
+     * @param env - Environment object containing encryption key
+     * @returns Decrypted private key in PEM format
+     */
+    static decryptPrivateKey(encryptedKey: string, env: Env): string;
+    /**
+     * Get encryption key from environment
+     * Falls back to SESSION_SECRET if ACTIVITYPUB_KEY_ENCRYPTION_KEY is not set
+     */
+    private static getEncryptionKey;
+}
+//# sourceMappingURL=crypto.d.ts.map

package/dist/lib/activitypub/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../src/lib/activitypub/crypto.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGrC;;GAEG;AACH,qBAAa,cAAc;IACzB;;;OAGG;IACH,MAAM,CAAC,eAAe,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAgBnE;;;;;;OAMG;IACH,MAAM,CAAC,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM;IAoB9D;;;;;;OAMG;IACH,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM;IAiBhE;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;CAmBhC"}

package/dist/lib/activitypub/crypto.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * ActivityPub Cryptographic Key Management
+ *
+ * Handles RSA key pair generation and encryption for ActivityPub actors.
+ * Private keys are encrypted at rest for security.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyPairService = void 0;
+const crypto = __importStar(require("crypto"));
+const secret_resolver_1 = require("../secret-resolver");
+/**
+ * Service for managing cryptographic keys for ActivityPub actors
+ */
+class KeyPairService {
+    /**
+     * Generate RSA key pair for ActivityPub actor
+     * Uses 2048-bit keys as per ActivityPub best practices
+     */
+    static generateKeyPair() {
+        const { publicKey, privateKey } = crypto.generateKeyPairSync("rsa", {
+            modulusLength: 2048,
+            publicKeyEncoding: {
+                type: "spki",
+                format: "pem",
+            },
+            privateKeyEncoding: {
+                type: "pkcs8",
+                format: "pem",
+            },
+        });
+        return { publicKey, privateKey };
+    }
+    /**
+     * Encrypt private key for storage using AES-256-GCM
+     *
+     * @param privateKey - Private key in PEM format
+     * @param env - Environment object containing encryption key
+     * @returns Encrypted private key (base64 encoded)
+     */
+    static encryptPrivateKey(privateKey, env) {
+        const encryptionKey = this.getEncryptionKey(env);
+        const iv = crypto.randomBytes(16);
+        const cipher = crypto.createCipheriv("aes-256-gcm", encryptionKey, iv);
+        let encrypted = cipher.update(privateKey, "utf8", "base64");
+        encrypted += cipher.final("base64");
+        const authTag = cipher.getAuthTag();
+        // Combine IV, auth tag, and encrypted data
+        const combined = {
+            iv: iv.toString("base64"),
+            authTag: authTag.toString("base64"),
+            encrypted,
+        };
+        return JSON.stringify(combined);
+    }
+    /**
+     * Decrypt private key from storage
+     *
+     * @param encryptedKey - Encrypted private key (JSON string with iv, authTag, encrypted)
+     * @param env - Environment object containing encryption key
+     * @returns Decrypted private key in PEM format
+     */
+    static decryptPrivateKey(encryptedKey, env) {
+        const encryptionKey = this.getEncryptionKey(env);
+        const combined = JSON.parse(encryptedKey);
+        const iv = Buffer.from(combined.iv, "base64");
+        const authTag = Buffer.from(combined.authTag, "base64");
+        const encrypted = combined.encrypted;
+        const decipher = crypto.createDecipheriv("aes-256-gcm", encryptionKey, iv);
+        decipher.setAuthTag(authTag);
+        let decrypted = decipher.update(encrypted, "base64", "utf8");
+        decrypted += decipher.final("utf8");
+        return decrypted;
+    }
+    /**
+     * Get encryption key from environment
+     * Falls back to SESSION_SECRET if ACTIVITYPUB_KEY_ENCRYPTION_KEY is not set
+     */
+    static getEncryptionKey(env) {
+        // Try to get dedicated encryption key for ActivityPub
+        const activityPubKey = env.ACTIVITYPUB_KEY_ENCRYPTION_KEY;
+        if (activityPubKey && typeof activityPubKey === "string") {
+            // Derive 32-byte key from the provided key using SHA-256
+            return crypto.createHash("sha256").update(activityPubKey).digest();
+        }
+        // Fall back to session secret (which is already 32+ bytes)
+        const sessionSecret = secret_resolver_1.Secrets.getSessionSecret(env);
+        if (!sessionSecret) {
+            throw new Error("No encryption key available. Set ACTIVITYPUB_KEY_ENCRYPTION_KEY or SESSION_SECRET");
+        }
+        // Derive 32-byte key from session secret
+        return crypto.createHash("sha256").update(sessionSecret).digest();
+    }
+}
+exports.KeyPairService = KeyPairService;
+//# sourceMappingURL=crypto.js.map

package/dist/lib/activitypub/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../src/lib/activitypub/crypto.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,+CAAiC;AAEjC,wDAA6C;AAE7C;;GAEG;AACH,MAAa,cAAc;IACzB;;;OAGG;IACH,MAAM,CAAC,eAAe;QACpB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;YAClE,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE;gBACjB,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,KAAK;aACd;YACD,kBAAkB,EAAE;gBAClB,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,KAAK;aACd;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,iBAAiB,CAAC,UAAkB,EAAE,GAAQ;QACnD,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAEvE,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC5D,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEpC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,2CAA2C;QAC3C,MAAM,QAAQ,GAAG;YACf,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnC,SAAS;SACV,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,iBAAiB,CAAC,YAAoB,EAAE,GAAQ;QACrD,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAE1C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QAErC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC3E,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,gBAAgB,CAAC,GAAQ;QACtC,sDAAsD;QACtD,MAAM,cAAc,GAAI,GAAW,CAAC,8BAA8B,CAAC;QACnE,IAAI,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;YACzD,yDAAyD;YACzD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC;QACrE,CAAC;QAED,2DAA2D;QAC3D,MAAM,aAAa,GAAG,yBAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC;IACpE,CAAC;CACF;AA/FD,wCA+FC"}

package/dist/lib/activitypub/delivery-service.d.ts

@@ -0,0 +1,44 @@
+/**
+ * ActivityPub Delivery Service
+ *
+ * Handles delivery of activities to actor inboxes using Fedify.
+ */
+import type { Post, PrismaClient, User } from "@prisma/client";
+import type { Env } from "../../env";
+import { type ActivityStreamsActivity } from "./activity-service";
+import { Logger } from "../logger";
+/**
+ * Service for delivering ActivityPub activities to recipients
+ */
+export declare class DeliveryService {
+    /**
+     * Get followers of a user (for followers-only posts)
+     */
+    static getFollowers(prisma: PrismaClient, userId: string): Promise<User[]>;
+    /**
+     * Get friends of a user (for friends-only posts)
+     */
+    static getFriends(prisma: PrismaClient, userId: string): Promise<User[]>;
+    /**
+     * Get members of a group (for group posts)
+     */
+    static getGroupMembers(prisma: PrismaClient, groupId: string): Promise<User[]>;
+    /**
+     * Get recipients for a post based on audience targeting
+     */
+    static getRecipients(prisma: PrismaClient, post: Post, author: User, env: Env, requestUrl?: string): Promise<User[]>;
+    /**
+     * Resolve actor URI to User
+     * Returns null if actor is remote or not found
+     */
+    static resolveActorUri(prisma: PrismaClient, actorUri: string, env: Env): Promise<User | null>;
+    /**
+     * Deliver activity to a recipient's inbox
+     */
+    static deliverToInbox(prisma: PrismaClient, activity: ActivityStreamsActivity, recipient: User, env: Env, senderActorUri: string, logger?: ReturnType<typeof Logger.getInstance>): Promise<void>;
+    /**
+     * Deliver post activity to all recipients
+     */
+    static deliverPost(prisma: PrismaClient, activity: ActivityStreamsActivity, post: Post, author: User, env: Env, requestUrl?: string, logger?: ReturnType<typeof Logger.getInstance>): Promise<void>;
+}
+//# sourceMappingURL=delivery-service.d.ts.map

package/dist/lib/activitypub/delivery-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-service.d.ts","sourceRoot":"","sources":["../../../src/lib/activitypub/delivery-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAIlE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGnC;;GAEG;AACH,qBAAa,eAAe;IAC1B;;OAEG;WACU,YAAY,CACvB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,EAAE,CAAC;IAKlB;;OAEG;WACU,UAAU,CACrB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,EAAE,CAAC;IAelB;;OAEG;WACU,eAAe,CAC1B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,EAAE,CAAC;IAwBlB;;OAEG;WACU,aAAa,CACxB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,IAAI,EACZ,GAAG,EAAE,GAAG,EACR,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,EAAE,CAAC;IA+FlB;;;OAGG;WACU,eAAe,CAC1B,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA4CvB;;OAEG;WACU,cAAc,CACzB,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,uBAAuB,EACjC,SAAS,EAAE,IAAI,EACf,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,UAAU,CAAC,OAAO,MAAM,CAAC,WAAW,CAAC,GAC7C,OAAO,CAAC,IAAI,CAAC;IAyBhB;;OAEG;WACU,WAAW,CACtB,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,uBAAuB,EACjC,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,IAAI,EACZ,GAAG,EAAE,GAAG,EACR,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,UAAU,CAAC,OAAO,MAAM,CAAC,WAAW,CAAC,GAC7C,OAAO,CAAC,IAAI,CAAC;CAyCjB"}