@oxy.so/federation 2.0.0 → 2.1.0

package/dist/cjs/actorObject.js

@@ -22,6 +22,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND = exports.AP_ACTOR_TYPES = void 0;
 exports.isApActorType = isApActorType;
 exports.localActorTypeForAccountKind = localActorTypeForAccountKind;
+exports.normalizeAlsoKnownAs = normalizeAlsoKnownAs;
 exports.createLocalActorBuilder = createLocalActorBuilder;
 const contracts_1 = require("@oxy.so/contracts");
 /**
@@ -177,6 +178,31 @@ function buildActorImage(config, banner) {
     }
     return apImageObject(resolved);
 }
+/**
+ * The publishable subset of an `alsoKnownAs` input: absolute `https:` URIs,
+ * first occurrence wins, input order kept. Exported so every actor builder
+ * (Oxy's own included) applies the same rule.
+ */
+function normalizeAlsoKnownAs(values) {
+    if (!values)
+        return [];
+    const seen = new Set();
+    const result = [];
+    for (const value of values) {
+        if (typeof value !== 'string' || seen.has(value))
+            continue;
+        try {
+            if (new URL(value).protocol !== 'https:')
+                continue;
+        }
+        catch {
+            continue;
+        }
+        seen.add(value);
+        result.push(value);
+    }
+    return result;
+}
 /**
  * Build the per-instance local-actor builder. Bind it once with an app's domain +
  * media resolver; call the returned function per user.
@@ -207,6 +233,10 @@ function createLocalActorBuilder(config) {
                 publicKeyPem: publicKey.publicKeyPem,
             },
         };
+        const aliases = normalizeAlsoKnownAs(params.alsoKnownAs);
+        if (aliases.length > 0) {
+            actorObject.alsoKnownAs = aliases;
+        }
         // `published` (account creation date) is advertised when the API provides it.
         if (createdAt) {
             actorObject.published = new Date(createdAt).toISOString();

package/dist/cjs/apContext.js

@@ -33,7 +33,12 @@ exports.AP_CONTEXT = [
     // is typed `@id` (an IRI, not a literal); the `misskey`/`fedibird` namespaces
     // and the AS2 `Link` type back the FEP-e232 `Link` quote tag. Without these
     // declarations a strict JSON-LD consumer DROPS the quote fields.
+    //
+    // `alsoKnownAs` is the account-alias term a Mastodon `Move` verifies. It is
+    // `as:alsoKnownAs` typed `@id`, exactly as Mastodon declares it; without the
+    // declaration a strict consumer drops the aliases and the move is refused.
     {
+        alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' },
         sensitive: 'as:sensitive',
         toot: 'http://joinmastodon.org/ns#',
         votersCount: 'toot:votersCount',

package/dist/cjs/index.js

@@ -22,7 +22,7 @@
  * knowledge of any app's post shape.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND = exports.AP_ACTOR_TYPES = exports.isApActorType = exports.localActorTypeForAccountKind = exports.createLocalActorBuilder = exports.createDomainPolicy = exports.extractActorUriFromActivityId = exports.isSameFederationHost = exports.canonicalFederationHost = exports.AP_CONTEXT = exports.readProxyDeclarations = exports.upstreamHandleFromProxyOf = exports.upstreamHandleFromPreferredUsername = exports.upstreamHandleFromAutomatedActor = exports.upstreamHandleFromAlsoKnownAs = exports.upstreamHandleFromProfileField = exports.federatedUsernameFromUpstreamUrl = exports.parseUpstreamProfileUrl = exports.upstreamProfileUrl = exports.stripBridgeBoilerplate = exports.createBridgeRelabeller = exports.blueskyUsernameFromHandle = exports.BSKY_NETWORK_DOMAIN = exports.FEDERATION_NETWORKS = exports.INSTANCE_ACTOR_USERNAME = exports.normalizeActorUsername = exports.createUrlBuilders = exports.DEFAULT_SIGNED_CONTENT_TYPE = exports.HTTP_SIGNATURE_ALGORITHM = exports.verifyHttpSignature = exports.signRequest = void 0;
+exports.LOCAL_ACTOR_TYPE_BY_ACCOUNT_KIND = exports.AP_ACTOR_TYPES = exports.isApActorType = exports.localActorTypeForAccountKind = exports.normalizeAlsoKnownAs = exports.createLocalActorBuilder = exports.createDomainPolicy = exports.extractActorUriFromActivityId = exports.isSameFederationHost = exports.canonicalFederationHost = exports.AP_CONTEXT = exports.readProxyDeclarations = exports.upstreamHandleFromProxyOf = exports.upstreamHandleFromPreferredUsername = exports.upstreamHandleFromAutomatedActor = exports.upstreamHandleFromAlsoKnownAs = exports.upstreamHandleFromProfileField = exports.federatedUsernameFromUpstreamUrl = exports.parseUpstreamProfileUrl = exports.upstreamProfileUrl = exports.stripBridgeBoilerplate = exports.createBridgeRelabeller = exports.blueskyUsernameFromHandle = exports.BSKY_NETWORK_DOMAIN = exports.FEDERATION_NETWORKS = exports.INSTANCE_ACTOR_USERNAME = exports.normalizeActorUsername = exports.createUrlBuilders = exports.DEFAULT_SIGNED_CONTENT_TYPE = exports.HTTP_SIGNATURE_ALGORITHM = exports.verifyHttpSignature = exports.signRequest = void 0;
 /**
  * HTTP Signatures (draft-cavage) — the pure sign/verify crypto every Oxy app's
  * ActivityPub federation shares. Private-key custody is injected; the key never
@@ -93,6 +93,7 @@ Object.defineProperty(exports, "createDomainPolicy", { enumerable: true, get: fu
  */
 var actorObject_1 = require("./actorObject");
 Object.defineProperty(exports, "createLocalActorBuilder", { enumerable: true, get: function () { return actorObject_1.createLocalActorBuilder; } });
+Object.defineProperty(exports, "normalizeAlsoKnownAs", { enumerable: true, get: function () { return actorObject_1.normalizeAlsoKnownAs; } });
 Object.defineProperty(exports, "localActorTypeForAccountKind", { enumerable: true, get: function () { return actorObject_1.localActorTypeForAccountKind; } });
 Object.defineProperty(exports, "isApActorType", { enumerable: true, get: function () { return actorObject_1.isApActorType; } });
 Object.defineProperty(exports, "AP_ACTOR_TYPES", { enumerable: true, get: function () { return actorObject_1.AP_ACTOR_TYPES; } });

package/dist/cjs/node/actorRouter.js

@@ -266,6 +266,7 @@ function createActorRouter(config) {
                 profileHeaderImage,
                 publicKey,
                 createdAt: user.createdAt,
+                alsoKnownAs: user.alsoKnownAs,
             });
             res.set('Content-Type', apContentType);
             res.set('Cache-Control', 'max-age=1800');

package/dist/cjs/node/delivery.js

@@ -383,6 +383,7 @@ function createDeliveryService(config) {
                 profileHeaderImage,
                 publicKey,
                 createdAt: user.createdAt,
+                alsoKnownAs: user.alsoKnownAs,
             });
             const actor = urls.actor(username);
             const now = new Date();

package/dist/cjs/node/inboundDispatch.js

@@ -13,6 +13,12 @@
  * post/engagement handlers live. The consent gate + notification side effects are
  * injected so the engine holds no app knowledge.
  *
+ * `Move` (account migration) is handed to {@link InboundDispatcherConfig.onMove}
+ * after a SHAPE check only: the engine proves the activity is the signing actor
+ * moving itself, and the app forwards it to Oxy (`POST /federation/move`), which
+ * owns the identity decision — the alias check and the re-fetch of the old
+ * actor's `movedTo`.
+ *
  * Extracted behaviour-identically from Mention's former `InboxProcessingService`
  * dispatcher + `handleIncomingFollow` / `handleUndo(Follow)` / `handleAccept` /
  * `handleReject`.
@@ -43,6 +49,38 @@ class ActorResolutionPendingError extends Error {
     }
 }
 exports.ActorResolutionPendingError = ActorResolutionPendingError;
+/**
+ * The shape check for an inbound `Move`.
+ *
+ * A Move is only meaningful as an actor moving ITSELF: `actor` and `object` must
+ * both be the actor whose HTTP signature was verified, so a relay or a third
+ * party cannot move somebody else's followers. `target` must be an absolute
+ * https URI, and differ from the old actor.
+ */
+function parseInboundMove(activity, verifiedActorUri) {
+    const activityId = typeof activity.id === 'string' ? activity.id : undefined;
+    if (!activityId)
+        return { ok: false, reason: 'missing id' };
+    const actor = objectTargetUri(activity.actor);
+    if (actor !== verifiedActorUri)
+        return { ok: false, reason: 'actor is not the signer' };
+    const object = objectTargetUri(activity.object);
+    if (object !== verifiedActorUri)
+        return { ok: false, reason: 'object is not the moving actor' };
+    const target = objectTargetUri(activity.target);
+    if (!target)
+        return { ok: false, reason: 'missing target' };
+    try {
+        if (new URL(target).protocol !== 'https:')
+            return { ok: false, reason: 'target is not https' };
+    }
+    catch {
+        return { ok: false, reason: 'target is not a URL' };
+    }
+    if (target === verifiedActorUri)
+        return { ok: false, reason: 'target is the moving actor' };
+    return { ok: true, move: { activityId, oldActorUri: verifiedActorUri, targetActorUri: target } };
+}
 /**
  * The lowercased host of an actor URI, or null when it is not a parseable absolute
  * URL. Callers treat null as blocked: an origin whose host cannot be determined
@@ -260,6 +298,19 @@ function createInboundDispatcher(config) {
             case 'Update':
                 await config.onContentActivity(activity, verifiedActorUri);
                 break;
+            case 'Move': {
+                const parsed = parseInboundMove(activity, verifiedActorUri);
+                if (!parsed.ok) {
+                    logger.warn(`[Federation] dropping Move from ${verifiedActorUri}: ${parsed.reason}`);
+                    break;
+                }
+                if (!config.onMove) {
+                    logger.debug(`Unhandled Move from ${verifiedActorUri} (no onMove handler)`);
+                    break;
+                }
+                await config.onMove(parsed.move);
+                break;
+            }
             default:
                 logger.debug(`Unhandled activity type: ${validation.type}`);
         }