@evanp/activitypub-bot 0.47.1 → 0.48.1

package/CHANGELOG.md

@@ -9,6 +9,19 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [0.48.1] - 2026-05-28
+
+- 401 Unauthorized for authentication errors
+- 401 Unauthorized when actor has been
+  deleted
+
+## [0.48.0] - 2026-05-28
+
+### Added
+
+- /favicon.ico with a little robot head emoji
+- very permissive /robots.txt
+
 ## [0.47.1] - 2026-05-28
 
 ### Fixed

package/lib/app.js

@@ -34,6 +34,8 @@ import sharedInboxRouter from './routes/sharedinbox.js'
 import profileRouter from './routes/profile.js'
 import proxyRouter from './routes/proxy.js'
 import nodeinfoRouter from './routes/nodeinfo.js'
+import robotsTxtRouter from './routes/robotstxt.js'
+import faviconRouter from './routes/favicon.js'
 import { BotContext } from './botcontext.js'
 import { Transformer } from './microsyntax.js'
 import { HTTPSignatureAuthenticator } from './httpsignatureauthenticator.js'
@@ -329,6 +331,8 @@ export async function makeApp ({ databaseUrl, origin, bots, logLevel = 'silent',
   app.use('/', webfingerRouter)
   app.use('/', proxyRouter)
   app.use('/', nodeinfoRouter)
+  app.use('/', robotsTxtRouter)
+  app.use('/', faviconRouter)
 
   // These should check HTTP Signature if provided
 

package/lib/httpsignatureauthenticator.js

@@ -77,21 +77,21 @@ export class HTTPSignatureAuthenticator {
     this.#logger.debug({ reqId: req.id, signature }, 'Got signed request')
     const date = req.get('Date')
     if (!date) {
-      throw new ProblemDetailsError(400, 'No date provided')
+      throw new ProblemDetailsError(401, 'No date provided')
     }
     if (Math.abs(Date.parse(date) - Date.now()) >
         HTTPSignatureAuthenticator.#maxDateDiff) {
-      throw new ProblemDetailsError(400, 'Time skew too large')
+      throw new ProblemDetailsError(401, 'Time skew too large')
     }
     if (req.rawBodyText && req.rawBodyText.length > 0) {
       const digest = req.get('Digest')
       if (!digest) {
-        throw new ProblemDetailsError(400, 'No digest provided')
+        throw new ProblemDetailsError(401, 'No digest provided')
       }
       const calculated = await this.#digester.digest(req.rawBodyText)
       if (!this.#digester.equals(digest, calculated)) {
         this.#logger.debug({ reqId: req.id, calculated, digest }, 'Digest mismatch')
-        throw new ProblemDetailsError(400, 'Digest mismatch')
+        throw new ProblemDetailsError(401, 'Digest mismatch')
       }
     }
     const { method, headers } = req
@@ -100,7 +100,7 @@ export class HTTPSignatureAuthenticator {
     this.#logger.debug({ reqId: req.id, keyId }, 'Signed with keyId')
     const ok = await this.#remoteKeyStorage.getPublicKey(keyId)
     if (!ok) {
-      throw new ProblemDetailsError(400, 'public key not found')
+      throw new ProblemDetailsError(401, 'public key not found')
     }
     let owner = ok.owner
     let publicKeyPem = ok.publicKeyPem
@@ -137,25 +137,25 @@ export class HTTPSignatureAuthenticator {
     const date = req.get('Date')
     if (date && Math.abs(Date.parse(date) - Date.now()) >
         HTTPSignatureAuthenticator.#maxDateDiff) {
-      throw new ProblemDetailsError(400, 'Time skew too large')
+      throw new ProblemDetailsError(401, 'Time skew too large')
     }
     if (req.rawBodyText && req.rawBodyText.length > 0) {
       const digest = req.get('Content-Digest')
       if (!digest) {
-        throw new ProblemDetailsError(400, 'No digest provided')
+        throw new ProblemDetailsError(401, 'No digest provided')
       }
       const calculated = await this.#digester.contentDigest(req.rawBodyText)
       if (!this.#digester.equals(digest, calculated)) {
         this.#logger.debug({ reqId: req.id, calculated, digest }, 'Digest mismatch')
-        throw new ProblemDetailsError(400, 'Digest mismatch')
+        throw new ProblemDetailsError(401, 'Digest mismatch')
       }
     }
     const created = this.#messageSigner.created(signatureInput)
     if (!created) {
-      throw new ProblemDetailsError(400, 'No created timestamp provided')
+      throw new ProblemDetailsError(401, 'No created timestamp provided')
     }
     if (Math.abs(Date.now() - created * 1000) > HTTPSignatureAuthenticator.#maxDateDiff) {
-      throw new ProblemDetailsError(400, 'Time skew too large')
+      throw new ProblemDetailsError(401, 'Time skew too large')
     }
     const { method, headers } = req
     const { origin } = req.app.locals
@@ -163,12 +163,12 @@ export class HTTPSignatureAuthenticator {
 
     const keyId = this.#messageSigner.keyId(signatureInput)
     if (!keyId) {
-      throw new ProblemDetailsError(400, 'no public key provided')
+      throw new ProblemDetailsError(401, 'no public key provided')
     }
     this.#logger.debug({ reqId: req.id, keyId }, 'Signed with keyId')
     const ok = await this.#remoteKeyStorage.getPublicKey(keyId)
     if (!ok) {
-      throw new ProblemDetailsError(400, 'public key not found')
+      throw new ProblemDetailsError(401, 'public key not found')
     }
     let owner = ok.owner
     let publicKeyPem = ok.publicKeyPem

package/lib/remotekeystorage.js

@@ -31,7 +31,10 @@ export class RemoteKeyStorage {
       return null
     }
     if (!await this.#confirmPublicKey(remote.owner, id)) {
-      this.#logger.warn({ owner: remote.owner, id }, 'Mismatched owner and key')
+      this.#logger.warn(
+        { owner: remote.owner, id },
+        'Cannot confirm match between owner and public key'
+      )
       return null
     }
     await this.#cachePublicKey(id, remote.owner, remote.publicKeyPem)
@@ -58,7 +61,14 @@ export class RemoteKeyStorage {
 
   async #getRemotePublicKey (id) {
     this.debug(`#getRemotePublicKey(${id})`)
-    const response = await this.#client.getKey(id)
+    let response
+    try {
+      response = await this.#client.getKey(id)
+    } catch (err) {
+      this.#logger.warn({ id, err }, 'error getting key')
+      return null
+    }
+
     if (!response) {
       return null
     }

package/lib/routes/favicon.js

@@ -0,0 +1,16 @@
+import { Router } from 'express'
+
+const router = Router()
+
+const FAVICON_ICO =
+`<svg
+xmlns="http://www.w3.org/2000/svg"
+viewBox="0 0 100 100">
+<text y=".9em" font-size="90">🤖</text>
+</svg>`
+
+router.get('/favicon.ico', async (req, res, next) => {
+  res.status(200).type('image/svg+xml').end(FAVICON_ICO)
+})
+
+export default router

package/lib/routes/robotstxt.js

@@ -0,0 +1,15 @@
+import { Router } from 'express'
+
+const router = Router()
+
+const ROBOTS_TXT =
+`# We are all bots here
+User-agent: *
+Disallow:
+`
+
+router.get('/robots.txt', async (req, res, next) => {
+  res.status(200).type('text/plain').end(ROBOTS_TXT)
+})
+
+export default router

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.47.1",
+  "version": "0.48.1",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",