@evanp/activitypub-bot 0.45.16 → 0.45.17

package/CHANGELOG.md

@@ -9,6 +9,19 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [0.45.17] - 2026-05-11
+
+### Changed
+
+- Bumped activitypub-nock.
+
+### Fixed
+
+- Look up id in results body even if the the id is not a fragment; fixes
+  problems with gotosocial keys.
+- Retry signature code on more HTTP status
+results, for servers that use (wrong, bad) 400, 404 and 410 results for bad signatures.
+
 ## [0.45.16] - 2026-05-11
 
 ### Changed

package/lib/activitypubclient.js

@@ -24,6 +24,8 @@ const COLLECTION_TYPES = [
   `${NS}OrderedCollection`
 ]
 
+const SIG_ERROR_STATUS = [400, 401, 403, 404, 410]
+
 function normalizeHeaders (headers) {
   if (!headers) {
     return headers
@@ -120,7 +122,7 @@ export class ActivityPubClient {
     try {
       obj = await this.#get(url, this.#urlFormatter.hostname, false, false)
     } catch (err) {
-      if (err.status && [401, 403, 404].includes(err.status)) {
+      if (err.status && SIG_ERROR_STATUS.includes(err.status)) {
         obj = await this.#get(url, this.#urlFormatter.hostname, true, false)
       } else {
         throw err
@@ -205,7 +207,7 @@ export class ActivityPubClient {
       }
     )
     this.#logger.debug({ hostname, status: res.status }, 'response received')
-    if ([400, 401, 403].includes(res.status) &&
+    if (SIG_ERROR_STATUS.includes(res.status) &&
         sign &&
         lastPolicy === SignaturePolicyStorage.RFC9421) {
       const errBody = await res.text()
@@ -279,7 +281,9 @@ export class ActivityPubClient {
       this.#logger.warn({ url: baseUrl, json }, 'Error importing JSON as AS2')
       throw err
     }
-    const resolved = (parsed.hash)
+    // NB: should only test for fragments,
+    // but e.g. gotosocial has this.
+    const resolved = (obj.id !== url)
       ? this.#resolveObject(obj, url)
       : obj
     return resolved
@@ -345,7 +349,7 @@ export class ActivityPubClient {
         body
       }
     )
-    if ([400, 401, 403].includes(res.status) &&
+    if (SIG_ERROR_STATUS.includes(res.status) &&
         lastPolicy === SignaturePolicyStorage.RFC9421) {
       const errBody = await res.text()
       this.#logger.debug(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.45.16",
+  "version": "0.45.17",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",
@@ -45,7 +45,7 @@
     "sequelize": "^6.37.7"
   },
   "devDependencies": {
-    "@evanp/activitypub-nock": "^0.9.4",
+    "@evanp/activitypub-nock": "^0.9.5",
     "eslint": "^8.57.1",
     "eslint-config-standard": "^17.1.0",
     "eslint-plugin-import": "^2.29.1",