@evanp/activitypub-bot 0.38.4 → 0.39.1

package/lib/ratelimiter.js

@@ -11,7 +11,7 @@ export class RateLimiter {
     assert.strictEqual(typeof connection, 'object')
     assert.strictEqual(typeof logger, 'object')
     this.#connection = connection
-    this.#logger = logger
+    this.#logger = logger.child({ class: this.constructor.name })
   }
 
   async limit (host, maxWaitTime = 30000) {

package/lib/remoteobjectcache.js

@@ -15,7 +15,7 @@ export class RemoteObjectCache {
     assert.ok(connection)
     assert.ok(logger)
     this.#connection = connection
-    this.#logger = logger
+    this.#logger = logger.child({ class: this.constructor.name })
   }
 
   async get (id, username) {

package/lib/routes/collection.js

@@ -1,10 +1,10 @@
 import assert from 'node:assert'
 
 import express from 'express'
-import createHttpError from 'http-errors'
 
 import as2 from '../activitystreams.js'
 import BotMaker from '../botmaker.js'
+import { ProblemDetailsError, PrincipalNotAuthorizedError } from '../errors.js'
 
 const collections = ['outbox', 'liked', 'followers', 'following']
 const router = express.Router()
@@ -40,7 +40,7 @@ function collectionHandler (collection) {
     const { actorStorage, bots } = req.app.locals
     const bot = await BotMaker.makeBot(bots, username)
     if (!bot) {
-      return next(createHttpError(404, `User ${username} not found`))
+      return next(new ProblemDetailsError(404, `User ${username} not found`))
     }
     const coll = await actorStorage.getCollection(username, collection)
     res.status(200)
@@ -57,20 +57,20 @@ function collectionPageHandler (collection) {
     try {
       pageNo = parseInt(n)
     } catch (err) {
-      return next(createHttpError(400, `Invalid page ${n}`))
+      return next(new ProblemDetailsError(400, `Invalid page ${n}`))
     }
     const { actorStorage, bots, authorizer, objectStorage, formatter, client } = req.app.locals
     const bot = await BotMaker.makeBot(bots, username)
 
     if (!bot) {
-      return next(createHttpError(404, `User ${username} not found`))
+      return next(new ProblemDetailsError(404, `User ${username} not found`))
     }
 
     if (collection === 'inbox') {
-      return next(createHttpError(403, `No access to ${collection} collection`))
+      return next(new PrincipalNotAuthorizedError(`No access to ${collection} collection`, { resource: req.url }))
     }
     if (!await actorStorage.hasPage(username, collection, parseInt(n))) {
-      return next(createHttpError(404, `No such page ${n} for collection ${collection} for user ${username}`))
+      return next(new ProblemDetailsError(404, `No such page ${n} for collection ${collection} for user ${username}`))
     }
 
     let exported = null
@@ -113,7 +113,7 @@ function collectionPageHandler (collection) {
         { err: error, username, collection, n },
         'error loading collection page'
       )
-      return next(createHttpError(500, 'Error loading collection page'))
+      return next(new ProblemDetailsError(500, 'Error loading collection page'))
     }
     res.status(200)
     res.type(as2.mediaType)

package/lib/routes/health.js

@@ -1,5 +1,5 @@
 import express from 'express'
-import createHttpError from 'http-errors'
+import { ProblemDetailsError } from '../errors.js'
 
 const router = express.Router()
 
@@ -17,7 +17,7 @@ router.get('/readyz', async (req, res, next) => {
     res.type('text/plain')
     res.end('OK')
   } catch (err) {
-    return next(createHttpError(503, 'Service Unavailable'))
+    return next(new ProblemDetailsError(503, 'Service Unavailable'))
   }
 })
 

package/lib/routes/inbox.js

@@ -1,10 +1,17 @@
 import http from 'node:http'
 
 import express from 'express'
-import createHttpError from 'http-errors'
 
 import as2 from '../activitystreams.js'
 import BotMaker from '../botmaker.js'
+import {
+  ProblemDetailsError,
+  UnsupportedTypeError,
+  DuplicateDeliveryError,
+  PrincipalActorMismatchError,
+  ActorNotAuthorizedError,
+  PrincipalNotAuthorizedError
+} from '../errors.js'
 
 const router = express.Router()
 
@@ -16,15 +23,15 @@ router.post('/user/:username/inbox', async (req, res, next) => {
 
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `User ${username} not found`))
+    return next(new ProblemDetailsError(404, `User ${username} not found`))
   }
 
   if (!subject) {
-    return next(createHttpError(401, 'Unauthorized'))
+    return next(new ProblemDetailsError(401, 'Unauthorized'))
   }
 
   if (!req.body) {
-    return next(createHttpError(400, 'No request body provided'))
+    return next(new ProblemDetailsError(400, 'No request body provided'))
   }
 
   let activity
@@ -34,37 +41,37 @@ router.post('/user/:username/inbox', async (req, res, next) => {
   } catch (err) {
     logger.warn({ reqId: req.id, err }, 'Failed to import activity')
     logger.debug({ reqId: req.id, body: req.body }, 'Request body')
-    return next(createHttpError(400, 'Invalid request body'))
+    return next(new ProblemDetailsError(400, 'Invalid request body'))
   }
 
   if (!activity.isActivity()) {
-    return next(createHttpError(400, 'Request body is not an activity'))
+    return next(new UnsupportedTypeError('Request body is not an activity', { objectType: activity.type }))
   }
 
   const actor = deliverer.getActor(activity)
 
   if (!actor) {
-    return next(createHttpError(400, 'No actor found in activity'))
+    return next(new ProblemDetailsError(400, 'No actor found in activity'))
   }
 
   if (!actor.id) {
-    return next(createHttpError(400, 'No actor id found in activity'))
+    return next(new ProblemDetailsError(400, 'No actor id found in activity'))
   }
 
   if (actor.id !== subject && !(await bot.actorOK(subject, activity))) {
-    return next(createHttpError(403, `${subject} is not the actor ${actor.id}`))
+    return next(new PrincipalActorMismatchError(`${subject} is not the actor ${actor.id}`, { principal: subject, actor: actor.id }))
   }
 
   if (await actorStorage.isInCollection(username, 'blocked', actor)) {
-    return next(createHttpError(403, 'Forbidden'))
+    return next(new ActorNotAuthorizedError('Blocked actor', { actor: actor.id, resource: req.url }))
   }
 
   if (!activity.id) {
-    return next(createHttpError(400, 'No activity id found in activity'))
+    return next(new ProblemDetailsError(400, 'No activity id found in activity'))
   }
 
   if (await actorStorage.isInCollection(bot.username, 'inbox', activity)) {
-    return next(createHttpError(400, 'Activity already delivered'))
+    return next(new DuplicateDeliveryError('Activity already delivered', { id: activity.id }))
   }
 
   logger.info(
@@ -84,11 +91,11 @@ router.post('/user/:username/inbox', async (req, res, next) => {
 })
 
 router.get('/user/:username/inbox', async (req, res, next) => {
-  return next(createHttpError(403, 'No access to inbox collection'))
+  return next(new PrincipalNotAuthorizedError('No access to inbox collection', { resource: req.url }))
 })
 
 router.get('/user/:username/inbox/:n', async (req, res, next) => {
-  return next(createHttpError(403, 'No access to inbox collection'))
+  return next(new PrincipalNotAuthorizedError('No access to inbox collection', { resource: req.url }))
 })
 
 export default router

package/lib/routes/object.js

@@ -1,7 +1,7 @@
 import express from 'express'
-import createHttpError from 'http-errors'
 
 import as2 from '../activitystreams.js'
+import { ProblemDetailsError, PrincipalNotAuthorizedError } from '../errors.js'
 
 const router = express.Router()
 
@@ -10,17 +10,17 @@ export default router
 router.get('/user/:username/:type/:nanoid', async (req, res, next) => {
   const { username, type, nanoid } = req.params
   if (!nanoid.match(/^[A-Za-z0-9_\\-]{21}$/)) {
-    return next(createHttpError(400, `Invalid nanoid ${nanoid}`))
+    return next(new ProblemDetailsError(400, `Invalid nanoid ${nanoid}`))
   }
   const { objectStorage, formatter, authorizer } = req.app.locals
   const id = formatter.format({ username, type, nanoid })
   const object = await objectStorage.read(id)
   if (!object) {
-    return next(createHttpError(404, `Object ${id} not found`))
+    return next(new ProblemDetailsError(404, `Object ${id} not found`))
   }
   const remote = (req.auth?.subject) ? await as2.import({ id: req.auth.subject }) : null
   if (!await authorizer.canRead(remote, object)) {
-    return next(createHttpError(403, `Forbidden to read object ${id}`))
+    return next(new PrincipalNotAuthorizedError('Forbidden to read object', { id }))
   }
   res.status(200)
   res.type(as2.mediaType)
@@ -30,20 +30,20 @@ router.get('/user/:username/:type/:nanoid', async (req, res, next) => {
 router.get('/user/:username/:type/:nanoid/:collection', async (req, res, next) => {
   const { objectStorage, formatter, authorizer } = req.app.locals
   if (!['replies', 'likes', 'shares', 'thread'].includes(req.params.collection)) {
-    return next(createHttpError(404, 'Not Found'))
+    return next(new ProblemDetailsError(404, 'Not Found'))
   }
   const { username, type, nanoid } = req.params
   if (!nanoid.match(/^[A-Za-z0-9_\\-]{21}$/)) {
-    return next(createHttpError(400, `Invalid nanoid ${nanoid}`))
+    return next(new ProblemDetailsError(400, `Invalid nanoid ${nanoid}`))
   }
   const id = formatter.format({ username, type, nanoid })
   const object = await objectStorage.read(id)
   if (!object) {
-    return next(createHttpError(404, 'Not Found'))
+    return next(new ProblemDetailsError(404, 'Not Found'))
   }
   const remote = (req.auth?.subject) ? await as2.import({ id: req.auth.subject }) : null
   if (!await authorizer.canRead(remote, object)) {
-    return next(createHttpError(403, 'Forbidden'))
+    return next(new ProblemDetailsError(403, 'Forbidden'))
   }
   const collection = await objectStorage.getCollection(id, req.params.collection)
   res.status(200)
@@ -57,23 +57,23 @@ router.get('/user/:username/:type/:nanoid/:collection/:n', async (req, res, next
   try {
     pageNo = parseInt(n)
   } catch (err) {
-    return next(createHttpError(400, `Invalid page ${n}`))
+    return next(new ProblemDetailsError(400, `Invalid page ${n}`))
   }
   if (!nanoid.match(/^[A-Za-z0-9_\\-]{21}$/)) {
-    return next(createHttpError(400, `Invalid nanoid ${nanoid}`))
+    return next(new ProblemDetailsError(400, `Invalid nanoid ${nanoid}`))
   }
   const { objectStorage, formatter, authorizer } = req.app.locals
   if (!['replies', 'likes', 'shares', 'thread'].includes(req.params.collection)) {
-    return next(createHttpError(404, 'Not Found'))
+    return next(new ProblemDetailsError(404, 'Not Found'))
   }
   const id = formatter.format({ username, type, nanoid })
   const object = await objectStorage.read(id)
   if (!object) {
-    return next(createHttpError(404, 'Not Found'))
+    return next(new ProblemDetailsError(404, 'Not Found'))
   }
   const remote = (req.auth?.subject) ? await as2.import({ id: req.auth.subject }) : null
   if (!await authorizer.canRead(remote, object)) {
-    return next(createHttpError(403, 'Forbidden'))
+    return next(new ProblemDetailsError(403, 'Forbidden'))
   }
   const collectionPage = await objectStorage.getCollectionPage(
     id,

package/lib/routes/profile.js

@@ -1,5 +1,5 @@
 import express from 'express'
-import createHttpError from 'http-errors'
+import { ProblemDetailsError } from '../errors.js'
 import BotMaker from '../botmaker.js'
 
 const router = express.Router()
@@ -9,7 +9,7 @@ router.get('/profile/:username', async (req, res, next) => {
   const { profileFileName, bots } = req.app.locals
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `User ${username} not found`))
+    return next(new ProblemDetailsError(404, `User ${username} not found`))
   }
   res.type('html')
   res.sendFile(profileFileName)

package/lib/routes/proxy.js

@@ -1,7 +1,7 @@
 import express from 'express'
 
 import as2 from '../activitystreams.js'
-import createHttpError from 'http-errors'
+import { ProblemDetailsError } from '../errors.js'
 
 const router = express.Router()
 
@@ -17,7 +17,7 @@ router.post('/shared/proxy', async (req, res, next) => {
   const { id } = req.body
 
   if (!id) {
-    return next(createHttpError(400, 'Missing id parameter'))
+    return next(new ProblemDetailsError(400, 'Missing id parameter'))
   }
 
   let url
@@ -25,11 +25,11 @@ router.post('/shared/proxy', async (req, res, next) => {
   try {
     url = new URL(id)
   } catch (error) {
-    return next(createHttpError(400, 'id must be an URL'))
+    return next(new ProblemDetailsError(400, 'id must be an URL'))
   }
 
   if (url.protocol !== 'https:') {
-    return next(createHttpError(400, 'id must be an https: URL'))
+    return next(new ProblemDetailsError(400, 'id must be an https: URL'))
   }
 
   let obj
@@ -38,7 +38,7 @@ router.post('/shared/proxy', async (req, res, next) => {
     obj = await client.get(id)
   } catch (err) {
     logger.warn({ reqId: req.id, err, id }, 'Error fetching object in proxy')
-    return next(createHttpError(400, `Error fetching object ${id}`))
+    return next(new ProblemDetailsError(400, `Error fetching object ${id}`))
   }
 
   res.status(200)

package/lib/routes/sharedinbox.js

@@ -1,9 +1,13 @@
 import http from 'node:http'
 
 import express from 'express'
-import createHttpError from 'http-errors'
 
 import as2 from '../activitystreams.js'
+import {
+  ProblemDetailsError,
+  UnsupportedTypeError,
+  PrincipalActorMismatchError
+} from '../errors.js'
 
 const router = express.Router()
 
@@ -28,11 +32,11 @@ router.post('/shared/inbox', async (req, res, next) => {
   const { subject } = req.auth
 
   if (!subject) {
-    return next(createHttpError(401, 'Unauthorized'))
+    return next(new ProblemDetailsError(401, 'Unauthorized'))
   }
 
   if (!req.body) {
-    return next(createHttpError(400, 'No request body provided'))
+    return next(new ProblemDetailsError(400, 'No request body provided'))
   }
 
   let activity
@@ -42,29 +46,29 @@ router.post('/shared/inbox', async (req, res, next) => {
   } catch (err) {
     logger.warn({ reqId: req.id, err }, 'Failed to import activity')
     logger.debug({ reqId: req.id, body: req.body }, 'Request body')
-    return next(createHttpError(400, 'Invalid request body'))
+    return next(new ProblemDetailsError(400, 'Invalid request body'))
   }
 
   if (!activity.isActivity()) {
-    return next(createHttpError(400, 'Request body is not an activity'))
+    return next(new UnsupportedTypeError('Request body is not an activity', { objectType: activity.type }))
   }
 
   const actor = deliverer.getActor(activity)
 
   if (!actor) {
-    return next(createHttpError(400, 'No actor found in activity'))
+    return next(new ProblemDetailsError(400, 'No actor found in activity'))
   }
 
   if (!actor.id) {
-    return next(createHttpError(400, 'No actor id found in activity'))
+    return next(new ProblemDetailsError(400, 'No actor id found in activity'))
   }
 
   if (actor.id !== subject && !(await actorOK(subject, activity, bots))) {
-    return next(createHttpError(403, `${subject} is not the actor ${actor.id}`))
+    return next(new PrincipalActorMismatchError(`${subject} is not the actor ${actor.id}`, { principal: subject, actor: actor.id }))
   }
 
   if (!activity.id) {
-    return next(createHttpError(400, 'No activity id found in activity'))
+    return next(new ProblemDetailsError(400, 'No activity id found in activity'))
   }
 
   logger.info(

package/lib/routes/user.js

@@ -1,7 +1,7 @@
 import { fileURLToPath } from 'node:url'
 import express from 'express'
 import as2 from '../activitystreams.js'
-import createHttpError from 'http-errors'
+import { ProblemDetailsError } from '../errors.js'
 import BotMaker from '../botmaker.js'
 
 const router = express.Router()
@@ -28,7 +28,7 @@ router.get('/user/:username', async (req, res, next) => {
   const { actorStorage, keyStorage, formatter, bots, origin } = req.app.locals
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `User ${username} not found`))
+    return next(new ProblemDetailsError(404, `User ${username} not found`))
   }
   const publicKeyPem = await keyStorage.getPublicKey(username)
   const acct = formatter.acct(username)
@@ -73,7 +73,7 @@ router.get('/user/:username/publickey', async (req, res, next) => {
   const { formatter, keyStorage, bots } = req.app.locals
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `User ${username} not found`))
+    return next(new ProblemDetailsError(404, `User ${username} not found`))
   }
   const publicKeyPem = await keyStorage.getPublicKey(username)
   const publicKey = await as2.import({
@@ -100,14 +100,14 @@ router.get('/user/:username/icon', async (req, res, next) => {
   const { bots } = req.app.locals
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `User ${username} not found`))
+    return next(new ProblemDetailsError(404, `User ${username} not found`))
   }
   if (!bot.icon) {
-    return next(createHttpError(404, `No icon for ${username} found`))
+    return next(new ProblemDetailsError(404, `No icon for ${username} found`))
   }
 
   if (typeof bot.icon !== 'object' || !(bot.icon instanceof URL)) {
-    return next(createHttpError(500, 'Incorrect image format from bot'))
+    return next(new ProblemDetailsError(500, 'Incorrect image format from bot'))
   }
 
   if (bot.icon.protocol === 'file:') {
@@ -122,14 +122,14 @@ router.get('/user/:username/image', async (req, res, next) => {
   const { bots } = req.app.locals
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `User ${username} not found`))
+    return next(new ProblemDetailsError(404, `User ${username} not found`))
   }
   if (!bot.image) {
-    return next(createHttpError(404, `No image for ${username} found`))
+    return next(new ProblemDetailsError(404, `No image for ${username} found`))
   }
 
   if (typeof bot.image !== 'object' || !(bot.image instanceof URL)) {
-    return next(createHttpError(500, 'Incorrect image format from bot'))
+    return next(new ProblemDetailsError(500, 'Incorrect image format from bot'))
   }
 
   if (bot.image.protocol === 'file:') {

package/lib/routes/webfinger.js

@@ -1,7 +1,7 @@
 import assert from 'node:assert'
 
 import { Router } from 'express'
-import createHttpError from 'http-errors'
+import { ProblemDetailsError } from '../errors.js'
 
 import BotMaker from '../botmaker.js'
 
@@ -11,7 +11,7 @@ async function botWebfinger (username, req, res, next) {
   const { formatter, bots } = req.app.locals
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `No such bot '${username}'`))
+    return next(new ProblemDetailsError(404, `No such bot '${username}'`))
   }
   res.status(200)
   res.type('application/jrd+json')
@@ -37,7 +37,7 @@ async function profileWebfinger (username, profileUrl, req, res, next) {
   const { formatter, bots } = req.app.locals
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `No such bot '${username}'`))
+    return next(new ProblemDetailsError(404, `No such bot '${username}'`))
   }
   res.status(200)
   res.type('application/jrd+json')
@@ -57,7 +57,7 @@ async function httpsWebfinger (resource, req, res, next) {
   const { formatter } = req.app.locals
   assert.ok(formatter)
   if (!formatter.isLocal(resource)) {
-    return next(createHttpError(400, 'Only local URLs'))
+    return next(new ProblemDetailsError(400, 'Only local URLs'))
   }
   const parts = formatter.unformat(resource)
   if (parts.username && !parts.type && !parts.collection) {
@@ -65,18 +65,18 @@ async function httpsWebfinger (resource, req, res, next) {
   } else if (parts.username && parts.type === 'profile') {
     return await profileWebfinger(parts.username, resource, req, res, next)
   } else {
-    return next(createHttpError(400, `No webfinger lookup for url ${resource}`))
+    return next(new ProblemDetailsError(400, `No webfinger lookup for url ${resource}`))
   }
 }
 
 async function acctWebfinger (resource, req, res, next) {
   const [username, domain] = resource.substring(5).split('@')
   if (!username || !domain) {
-    return next(createHttpError(400, `Invalid resource parameter ${resource}`))
+    return next(new ProblemDetailsError(400, `Invalid resource parameter ${resource}`))
   }
   const { host } = new URL(req.app.locals.origin)
   if (domain !== host) {
-    return next(createHttpError(400, `Invalid domain ${domain} in resource parameter`))
+    return next(new ProblemDetailsError(400, `Invalid domain ${domain} in resource parameter`))
   }
   return await botWebfinger(username, req, res, next)
 }
@@ -84,7 +84,7 @@ async function acctWebfinger (resource, req, res, next) {
 router.get('/.well-known/webfinger', async (req, res, next) => {
   const { resource } = req.query
   if (!resource) {
-    return next(createHttpError(400, 'resource parameter is required'))
+    return next(new ProblemDetailsError(400, 'resource parameter is required'))
   }
   const colon = resource.indexOf(':')
   const protocol = resource.slice(0, colon)
@@ -96,7 +96,7 @@ router.get('/.well-known/webfinger', async (req, res, next) => {
       return await httpsWebfinger(resource, req, res, next)
     default:
       return next(
-        createHttpError(400, `Unsupported resource protocol '${protocol}'`)
+        new ProblemDetailsError(400, `Unsupported resource protocol '${protocol}'`)
       )
   }
 })

package/lib/signaturepolicystorage.js

@@ -0,0 +1,61 @@
+import assert from 'node:assert'
+
+export class SignaturePolicyStorage {
+  static RFC9421 = 'rfc9421'
+  static DRAFT_CAVAGE_12 = 'draft-cavage-12'
+  static #policies = [
+    SignaturePolicyStorage.RFC9421,
+    SignaturePolicyStorage.DRAFT_CAVAGE_12
+  ]
+
+  static #EXPIRY_OFFSET = 30 * 24 * 60 * 60 * 1000
+
+  #connection
+  #logger
+  constructor (connection, logger) {
+    assert.ok(connection)
+    assert.strictEqual(typeof connection, 'object')
+    assert.ok(logger)
+    assert.strictEqual(typeof logger, 'object')
+    this.#connection = connection
+    this.#logger = logger.child({ class: this.constructor.name })
+  }
+
+  async get (origin) {
+    assert.ok(origin)
+    assert.strictEqual(typeof origin, 'string')
+    const [rows] = await this.#connection.query(
+      'SELECT policy, expiry FROM signature_policy WHERE origin = ?',
+      { replacements: [origin] }
+    )
+    if (rows.length === 0) {
+      return null
+    }
+    const { policy, expiry } = rows[0]
+    return ((new Date(expiry)) > (new Date()))
+      ? policy
+      : null
+  }
+
+  async set (origin, policy) {
+    assert.ok(origin)
+    assert.strictEqual(typeof origin, 'string')
+    assert.ok(policy)
+    assert.strictEqual(typeof policy, 'string')
+    assert.ok(SignaturePolicyStorage.#policies.includes(policy))
+
+    const expiry = new Date(
+      Date.now() + SignaturePolicyStorage.#EXPIRY_OFFSET
+    )
+
+    await this.#connection.query(
+      `INSERT INTO signature_policy (origin, policy, expiry)
+       VALUES (?, ?, ?)
+       ON CONFLICT (origin) DO UPDATE
+       SET policy = EXCLUDED.policy,
+           expiry = EXCLUDED.expiry,
+           updated_at = CURRENT_TIMESTAMP`,
+      { replacements: [origin, policy, expiry] }
+    )
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.38.4",
+  "version": "0.39.1",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",
@@ -32,7 +32,6 @@
     "@isaacs/ttlcache": "^2.1.4",
     "activitystrea.ms": "^3.3.0",
     "express": "^5.2.1",
-    "http-errors": "^2.0.0",
     "humanhash": "^1.0.4",
     "lru-cache": "^11.1.0",
     "nanoid": "^5.1.5",

package/web/profile.html

@@ -45,14 +45,18 @@
         const u = new URL(url)
         if (u.origin == page.origin) {
           return await fetch(u, options)
-        } else {
+        }
+
+        try {
+          return await fetch(u, options)
+        } catch (err) {
           return await fetch('/shared/proxy', {
-              method: "POST",
-              headers: {
-                "Content-Type": "application/x-www-form-urlencoded"
-              },
-              body: new URLSearchParams({ id: url }),
-            });
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/x-www-form-urlencoded'
+            },
+            body: new URLSearchParams({ id: url })
+          })
         }
       }
 
@@ -69,4 +73,4 @@
   </script>
 </body>
 
-</html>
+</html>