@evanp/activitypub-bot 0.52.1 → 0.53.0

package/.dockerignore

@@ -0,0 +1,8 @@
+.git
+.cache
+.claude
+.vscode
+node_modules
+**/.DS_Store
+.env
+.env.*

package/CHANGELOG.md

@@ -9,6 +9,31 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [0.53.0] - 2026-10-08
+
+### Changed
+
+- Upgrade activitypub-webfinger to 0.3.0 and add BotContext tests for forward
+  and reverse discovery with non-ASCII usernames and domains (#282).
+
+### Fixed
+
+- Linkify mentions with non-ASCII usernames and domains or ASCII punctuation
+  in usernames, preserving HTML escaping and URL fragments; add regression
+  tests for Unicode handles and username punctuation (#282).
+- Normalize server origins to support Unicode domains; add regression tests
+  for discovery, actor and collection endpoints, and OKBot replies (#282).
+- Support Unicode local usernames by encoding URL paths and acct: URIs and
+  decoding usernames during URL parsing and WebFinger lookup; return 400 for
+  malformed WebFinger username escapes and add regression tests (#282).
+
+## [0.52.2] - 2026-10-05
+
+### Fixed
+
+- Build Docker images from the local package instead of waiting for the new
+  release to become available on npm.
+
 ## [0.52.1] - 2026-10-05
 
 ### Changed
@@ -1688,7 +1713,9 @@ Hot patch on the `stable` branch.
 - Docker multi-platform build workflow.
 - Dependabot configuration.
 
-[Unreleased]: https://github.com/evanp/activitypub-bot/compare/v0.52.1...HEAD
+[Unreleased]: https://github.com/evanp/activitypub-bot/compare/v0.53.0...HEAD
+[0.53.0]: https://github.com/evanp/activitypub-bot/compare/v0.52.2...v0.53.0
+[0.52.2]: https://github.com/evanp/activitypub-bot/compare/v0.52.1...v0.52.2
 [0.52.1]: https://github.com/evanp/activitypub-bot/compare/v0.52.0...v0.52.1
 [0.52.0]: https://github.com/evanp/activitypub-bot/compare/v0.51.4...v0.52.0
 [0.51.4]: https://github.com/evanp/activitypub-bot/compare/v0.51.3...v0.51.4

package/lib/app.js

@@ -72,6 +72,8 @@ function createWorkers (logger, count, WorkerClass, ...args) {
 }
 
 export async function makeApp ({ databaseUrl, origin, bots, logLevel = 'silent', deliveryWorkerCount = 2, distributionWorkerCount = 8, fanoutWorkerCount = 4, intakeWorkerCount = 2, indexFileName = DEFAULT_INDEX_FILENAME, profileFileName = DEFAULT_PROFILE_FILENAME, allowPrivateNetworkRequests = false, redisUrl, trustProxy, domainBlockFileName }) {
+  // normalize the origin, including Unicode -> punycode
+  origin = (new URL(origin)).origin
   const logger = Logger({
     level: logLevel
   })

package/lib/microsyntax.js

@@ -30,8 +30,8 @@ export class Transformer {
     let html = this.#escape(text)
     let tag = [];
     ({ html, tag } = this.#replaceUrls(html, tag));
-    ({ html, tag } = this.#replaceHashtags(html, tag));
-    ({ html, tag } = await this.#replaceMentions(html, tag))
+    ({ html, tag } = await this.#replaceMentions(html, tag));
+    ({ html, tag } = this.#replaceHashtags(html, tag))
     html = `<p>${html}</p>`
     return { html, tag }
   }
@@ -67,36 +67,19 @@ export class Transformer {
   }
 
   async #replaceMentions (html, tag) {
-    const self = this
-    const webfinger = /@[a-zA-Z0-9_]+([a-zA-Z0-9_.-]+[a-zA-Z0-9_]+)?@[a-zA-Z0-9_.-]+/g
     const segments = this.#segment(html)
     for (const i in segments) {
-      const segment = segments[i]
-      if (this.#isLink(segment)) continue
-      segments[i] = await this.#replaceAsync(segments[i], webfinger, async (match) => {
-        const href = await self.#homePage(match.slice(1))
-        if (!href) return match
-        let url
-        try {
-          url = new URL(href)
-        } catch (err) {
-          return match
-        }
-        if (url.protocol !== 'https:') {
-          return match
-        }
-        tag.push({ type: 'Mention', name: match, href: url.href })
-        const escaped = this.#escape(url.href)
-        const escapedMatch = this.#escape(match)
-        return `<a href="${escaped}">${escapedMatch}</a>`
-      })
+      if (this.#isLink(segments[i])) continue
+      segments[i] = await this.#replaceMention(this.#unescape(segments[i]), tag)
     }
     return { html: segments.join(''), tag }
   }
 
   async #homePage (webfinger) {
     if (!this.#client) return null
-    const [username, domain] = webfinger.split('@')
+    const delimiter = webfinger.lastIndexOf('@')
+    const username = webfinger.slice(0, delimiter)
+    const domain = webfinger.slice(delimiter + 1)
     if (domain.toLowerCase() === this.#formatter.hostname) {
       return this.#formatter.format({ username, type: 'profile' })
     }
@@ -136,18 +119,43 @@ export class Transformer {
     return html.split(/(<[^>]+>[^<]+<\/[^>]+>)/)
   }
 
-  async #replaceAsync (str, regex, asyncFn) {
+  async #transformMention (match, tag) {
+    const escapedMatch = this.#escape(match)
+    const href = await this.#homePage(match.slice(1))
+    if (!href) return escapedMatch
+    let url
+    try {
+      url = new URL(href)
+    } catch (err) {
+      return escapedMatch
+    }
+    if (url.protocol !== 'https:') {
+      return escapedMatch
+    }
+    tag.push({ type: 'Mention', name: match, href: url.href })
+    const escaped = this.#escape(url.href)
+    return `<a href="${escaped}">${escapedMatch}</a>`
+  }
+
+  async #replaceMention (str, tag) {
+    const webfinger = /(@[\x21-\x7E\p{L}\p{Nd}\p{M}]+@[\p{L}\p{Nd}](?:[\p{L}\p{Nd}\p{M}-]*[\p{L}\p{Nd}\p{M}])?(?:\.[\p{L}\p{Nd}](?:[\p{L}\p{Nd}\p{M}-]*[\p{L}\p{Nd}\p{M}])?)*)/ug
+
+    const parts = str.split(webfinger)
+
     const promises = []
-    str.replace(regex, (match, ...args) => {
-      // Add a promise for each match
-      promises.push(asyncFn(match, ...args))
-    })
+
+    for (const i in parts) {
+      promises[i] = (i % 2 === 0)
+        ? new Promise((resolve, reject) => {
+          resolve(this.#escape(parts[i]))
+        })
+        : this.#transformMention(parts[i], tag)
+    }
 
     // Wait for all async replacements to resolve
     const replacements = await Promise.all(promises)
 
-    // Replace the matches with their respective replacements
-    return str.replace(regex, () => replacements.shift())
+    return replacements.join('')
   }
 
   #escape (text) {
@@ -158,4 +166,13 @@ export class Transformer {
       .replace(/"/g, '&quot;')
       .replace(/'/g, '&apos;')
   }
+
+  #unescape (text) {
+    return text
+      .replace(/&lt;/g, '<')
+      .replace(/&gt;/g, '>')
+      .replace(/&quot;/g, '"')
+      .replace(/&apos;/g, '\'')
+      .replace(/&amp;/g, '&')
+  }
 }

package/lib/routes/webfinger.js

@@ -70,15 +70,24 @@ async function httpsWebfinger (resource, req, res, next) {
 }
 
 async function acctWebfinger (resource, req, res, next) {
-  const [username, domain] = resource.substring(5).split('@')
-  if (!username || !domain) {
+  const address = resource.substring(5)
+  const delimiter = address.lastIndexOf('@')
+  if (delimiter <= 0 || delimiter === address.length - 1) {
     return next(new ProblemDetailsError(400, `Invalid resource parameter ${resource}`))
   }
+  const username = address.slice(0, delimiter)
+  const domain = address.slice(delimiter + 1)
   const { host } = new URL(req.app.locals.origin)
   if (domain !== host) {
     return next(new ProblemDetailsError(400, `Invalid domain ${domain} in resource parameter`))
   }
-  return await botWebfinger(username, req, res, next)
+  let decoded
+  try {
+    decoded = decodeURIComponent(username)
+  } catch (err) {
+    return next(new ProblemDetailsError(400, `Invalid percent-encoded username ${username} in resource parameter`))
+  }
+  return await botWebfinger(decoded, req, res, next)
 }
 
 router.get('/.well-known/webfinger', async (req, res, next) => {

package/lib/urlformatter.js

@@ -16,9 +16,9 @@ export class UrlFormatter {
     if (server) {
       return this.format({ username: this.#hostname, type, nanoid, collection, page, server: false })
     } else if (username && type && type === 'profile') {
-      return `${this.#origin}/profile/${username}`
+      return `${this.#origin}/profile/${encodeURIComponent(username)}`
     } else if (username) {
-      base = `${this.#origin}/user/${username}`
+      base = `${this.#origin}/user/${encodeURIComponent(username)}`
     } else {
       throw new Error('Cannot format URL without username or server')
     }
@@ -67,11 +67,11 @@ export class UrlFormatter {
     }
     let pathParts = parsed.pathname.slice(1).split('/')
     if (pathParts.length > 0 && pathParts[0] === 'user') {
-      parts.username = pathParts[1]
+      parts.username = decodeURIComponent(pathParts[1])
       pathParts = pathParts.slice(2)
       parts.server = (parts.username === this.#hostname)
     } else if (pathParts.length > 0 && pathParts[0] === 'profile') {
-      parts.username = pathParts[1]
+      parts.username = decodeURIComponent(pathParts[1])
       parts.type = 'profile'
       return parts
     }
@@ -108,7 +108,7 @@ export class UrlFormatter {
 
   acct (username = null) {
     return (username)
-      ? `acct:${username}@${this.#hostname}`
+      ? `acct:${encodeURIComponent(username)}@${this.#hostname}`
       : `acct:${this.#hostname}@${this.#hostname}`
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.52.1",
+  "version": "0.53.0",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",
@@ -32,7 +32,7 @@
   "dependencies": {
     "@isaacs/ttlcache": "^2.1.4",
     "@socialwebfoundation/ap-components": "^1.4.2",
-    "activitypub-webfinger": "^0.2.1",
+    "activitypub-webfinger": "^0.3.0",
     "activitystrea.ms": "^4.0.1",
     "csv-parse": "^7.0.0",
     "express": "^5.2.1",