@oxy.so/federation 1.0.0 → 2.0.0

package/dist/cjs/networkIdentity.js

@@ -132,6 +132,8 @@ function parseUpstreamProfileUrl(candidateUrl, networks = Object.values(exports.
     }
     if (url.protocol !== 'https:' && url.protocol !== 'http:')
         return undefined;
+    if (url.username || url.password || url.port)
+        return undefined;
     const host = (0, apUri_1.canonicalFederationHost)(url.hostname);
     for (const network of networks) {
         if (!network.profileHosts.some((allowed) => (0, apUri_1.canonicalFederationHost)(allowed) === host))
@@ -188,6 +190,8 @@ function profileUrlHandle(href, allowedHosts, pathPrefix) {
     }
     if (url.protocol !== 'https:' && url.protocol !== 'http:')
         return undefined;
+    if (url.username || url.password || url.port)
+        return undefined;
     const host = (0, apUri_1.canonicalFederationHost)(url.hostname);
     if (!allowedHosts.some((allowed) => (0, apUri_1.canonicalFederationHost)(allowed) === host))
         return undefined;
@@ -201,8 +205,19 @@ function profileUrlHandle(href, allowedHosts, pathPrefix) {
     return decodeURIComponent(segments[pathPrefix.length]);
 }
 /** Every `href="…"` in a sanitized field value, in document order. */
-function fieldHrefs(value) {
+function fieldHrefs(value, requireRelMe = false) {
     const hrefs = [];
+    if (requireRelMe) {
+        for (const anchor of value.matchAll(/<a\b([^>]*)>/gi)) {
+            const rel = /\brel\s*=\s*(?:"([^"]*)"|'([^']*)')/i.exec(anchor[1]);
+            if (!(rel?.[1] ?? rel?.[2] ?? '').toLowerCase().split(/\s+/).includes('me'))
+                continue;
+            const href = /\bhref\s*=\s*(?:"([^"]*)"|'([^']*)')/i.exec(anchor[1]);
+            if (href)
+                hrefs.push(href[1] ?? href[2]);
+        }
+        return hrefs;
+    }
     const pattern = /href="([^"]*)"/gi;
     let match = pattern.exec(value);
     while (match !== null) {
@@ -221,16 +236,29 @@ function upstreamHandleFromProfileField(options) {
     const wanted = options.fieldName.toLowerCase();
     const prefix = options.pathPrefix ?? [];
     return (candidate) => {
+        const handles = new Map();
         for (const field of candidate.fields) {
             if (field.name.trim().toLowerCase() !== wanted)
                 continue;
-            for (const href of fieldHrefs(field.value)) {
-                const handle = profileUrlHandle(href, options.hosts, prefix);
+            for (const href of fieldHrefs(field.value, options.requireRelMe)) {
+                // Observed bird.makeup Official assertion, 2026-09-13:
+                // https://https://twitter.com/jordievole. Repair exactly one duplicated
+                // HTTPS prefix, then run the ordinary host/path/credential validation.
+                const candidateHref = options.repairRepeatedHttpsScheme && href.startsWith('https://https://')
+                    ? href.slice('https://'.length) : href;
+                let handle;
+                try {
+                    handle = profileUrlHandle(candidateHref, options.hosts, prefix);
+                }
+                catch {
+                    continue;
+                }
                 if (handle !== undefined && handle.length > 0)
-                    return handle;
+                    handles.set(handle.toLowerCase(), handle);
             }
         }
-        return undefined;
+        // Conflicting source assertions cannot be settled by document order.
+        return handles.size === 1 ? handles.values().next().value : undefined;
     };
 }
 /**

package/dist/cjs/node/actorResolver.js

@@ -36,6 +36,12 @@ const AP_CONTENT_TYPE = 'application/activity+json';
 /** Maximum decompressed response sizes accepted from untrusted federation hosts. */
 const ACTOR_BODY_MAX_BYTES = 1024 * 1024;
 const COLLECTION_BODY_MAX_BYTES = 64 * 1024;
+/**
+ * Collection responses that DEFINITIVELY withhold the count: the owner hid the
+ * collection (401/403) or it no longer exists (404/410). Anything else non-2xx
+ * is a failed attempt, not an answer.
+ */
+const COLLECTION_WITHHELD_STATUSES = new Set([401, 403, 404, 410]);
 const ERROR_BODY_MAX_BYTES = 4 * 1024;
 async function readBoundedResponseBody(res, maxBytes) {
     const contentLength = res.headers.get('content-length');
@@ -393,9 +399,11 @@ class ActorResolver {
                 alsoKnownAs,
                 networkAcct: networkIdentity?.federatedUsername,
                 remoteCreatedAt: typeof actor.published === 'string' ? new Date(actor.published) : undefined,
-                followersCount,
-                followingCount,
-                postsCount,
+                // Omitted, not written as `undefined`, when this refresh could not tell:
+                // an absent key is what tells the store to keep the value it has.
+                ...(followersCount !== undefined && { followersCount }),
+                ...(followingCount !== undefined && { followingCount }),
+                ...(postsCount !== undefined && { postsCount }),
                 lastFetchedAt: new Date(),
             };
             const fedActor = await this.config.store.upsertActor(actorId, update);
@@ -427,9 +435,11 @@ class ActorResolver {
                         // string away made both of those unrepresentable, so the stale text
                         // survived every later refresh with nothing in the logs.
                         bio: identityBio,
-                        followersCount,
-                        followingCount,
-                        postsCount,
+                        // The identity bridge takes a number or nothing; an unknown count is
+                        // sent as nothing rather than as a zero it would store.
+                        followersCount: followersCount ?? undefined,
+                        followingCount: followingCount ?? undefined,
+                        postsCount: postsCount ?? undefined,
                         oxyUserId: fedActor.oxyUserId ?? undefined,
                     };
                     const oxyId = await this.config.identity.resolveExternalUser(normalized, { forceAvatarRefresh });
@@ -507,19 +517,36 @@ class ActorResolver {
             this.config.logger.warn(`[FedSync] failed to tombstone gone actor ${actorUri}:`, err);
         }
     }
-    /** Fetch the totalItems count from an ActivityPub collection URL. */
+    /**
+     * Read an ActivityPub collection's `totalItems`.
+     *
+     * Every failure used to come back as `0`, so a follower count the remote HID,
+     * or one a timeout kept us from reading, was stored and shown as a real
+     * "0 followers" — indistinguishable from an account nobody follows. A failure
+     * now says which kind it is (see {@link CollectionCount}):
+     *
+     * - `null` when the answer is definitive: no collection advertised, 401/403
+     *   (the owner hid it), 404/410 (it is gone), or a readable collection with no
+     *   usable `totalItems` (the server does not publish the count).
+     * - `undefined` when this attempt simply failed — a thrown fetch (timeout,
+     *   network, SSRF refusal), any other non-2xx (429, 5xx), or a body that could
+     *   not be read as a JSON object. The next refresh may well succeed, so the
+     *   caller keeps whatever it last knew rather than forgetting it.
+     */
     async fetchCollectionCount(url) {
         if (!url)
-            return 0;
+            return null;
         try {
             const res = await this.config.signedFetch(url, AP_CONTENT_TYPE);
-            if (!res.ok)
-                return 0;
+            if (!res.ok) {
+                return COLLECTION_WITHHELD_STATUSES.has(res.status) ? null : undefined;
+            }
             const col = await readBoundedJson(res, COLLECTION_BODY_MAX_BYTES);
-            return typeof col.totalItems === 'number' ? col.totalItems : 0;
+            const total = col.totalItems;
+            return typeof total === 'number' && Number.isSafeInteger(total) && total >= 0 ? total : null;
         }
         catch {
-            return 0;
+            return undefined;
         }
     }
     /**