@oxy.so/federation 2.2.0 → 2.3.0

package/src/node/identityBridge.ts

@@ -24,7 +24,11 @@ import type { NormalizedExternalActor } from '../index';
 export type ServiceRequestMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
 
 /** The service-scoped request transport oxy-api calls go through (`{ data }`-unwrapped). */
-export type ServiceRequest = <T>(method: ServiceRequestMethod, path: string, body?: unknown) => Promise<T>;
+export type ServiceRequest = <T>(
+  method: ServiceRequestMethod,
+  path: string,
+  body?: unknown,
+) => Promise<T>;
 
 /** Minimal logging sink the identity bridge writes to. */
 export interface IdentityBridgeLogger {
@@ -183,15 +187,21 @@ export function createIdentityBridge(config: IdentityBridgeConfig): IdentityBrid
         const httpStatus = getErrorStatus(error);
         const reason = getErrorMessage(error);
         if (isPermanentClientError(httpStatus)) {
-          config.logger.warn(`[Federation] actor-gone report for ${id} rejected (HTTP ${httpStatus}, permanent)`, {
-            reason,
-          });
+          config.logger.warn(
+            `[Federation] actor-gone report for ${id} rejected (HTTP ${httpStatus}, permanent)`,
+            {
+              reason,
+            },
+          );
           return 'skipped';
         }
-        config.logger.warn(`[Federation] actor-gone report for ${id} failed transiently; leaving for retry`, {
-          status: httpStatus,
-          reason,
-        });
+        config.logger.warn(
+          `[Federation] actor-gone report for ${id} failed transiently; leaving for retry`,
+          {
+            status: httpStatus,
+            reason,
+          },
+        );
         return 'failed';
       }
     },
@@ -201,9 +211,13 @@ export function createIdentityBridge(config: IdentityBridgeConfig): IdentityBrid
       if (!id) return 'skipped';
 
       try {
-        const data = await config.makeServiceRequest<ActorDeleteResponse>('POST', ACTOR_DELETE_PATH, {
-          oxyUserId: id,
-        });
+        const data = await config.makeServiceRequest<ActorDeleteResponse>(
+          'POST',
+          ACTOR_DELETE_PATH,
+          {
+            oxyUserId: id,
+          },
+        );
         const deleted = data?.deleted === true;
         config.logger.info(
           `[Federation] oxy-api ${deleted ? 'hard-deleted' : 'found no'} identity for gone actor ${id}`,
@@ -214,15 +228,21 @@ export function createIdentityBridge(config: IdentityBridgeConfig): IdentityBrid
         const httpStatus = getErrorStatus(error);
         const reason = getErrorMessage(error);
         if (isPermanentClientError(httpStatus)) {
-          config.logger.warn(`[Federation] actor-delete for ${id} rejected (HTTP ${httpStatus}, permanent)`, {
-            reason,
-          });
+          config.logger.warn(
+            `[Federation] actor-delete for ${id} rejected (HTTP ${httpStatus}, permanent)`,
+            {
+              reason,
+            },
+          );
           return 'skipped';
         }
-        config.logger.warn(`[Federation] actor-delete for ${id} failed transiently; leaving for retry`, {
-          status: httpStatus,
-          reason,
-        });
+        config.logger.warn(
+          `[Federation] actor-delete for ${id} failed transiently; leaving for retry`,
+          {
+            status: httpStatus,
+            reason,
+          },
+        );
         return 'failed';
       }
     },

package/src/node/inboundDispatch.ts

@@ -64,9 +64,7 @@ export interface InboundDispatcherLogger {
  * compact failure summary. The app owns the validation (its zod schemas); the
  * engine owns the drop-with-warn behaviour so every app logs identically.
  */
-export type InboundActivityValidation =
-  | { ok: true; type: string }
-  | { ok: false; summary: string };
+export type InboundActivityValidation = { ok: true; type: string } | { ok: false; summary: string };
 
 /** The Oxy-user fields the engine reads off a resolved local user (Follow target). */
 export interface InboundLocalUser {
@@ -99,9 +97,16 @@ export interface InboundActorResolver {
 /** Bring-your-own-store: the AP follow records + actor cache reads the follow verbs need. */
 export interface InboundFollowStore {
   /** `handleIncomingFollow`: upsert the accepted inbound follow row. */
-  upsertInboundAccepted(localUserId: string, remoteActorUri: string, activityId: string): Promise<void>;
+  upsertInboundAccepted(
+    localUserId: string,
+    remoteActorUri: string,
+    activityId: string,
+  ): Promise<void>;
   /** `handleUndo(Follow)`: the inbound follow row (scoped by localUserId when known). */
-  findInboundFollow(remoteActorUri: string, localUserId?: string): Promise<{ _id: unknown; localUserId: string } | null>;
+  findInboundFollow(
+    remoteActorUri: string,
+    localUserId?: string,
+  ): Promise<{ _id: unknown; localUserId: string } | null>;
   /** `handleUndo(Follow)`: delete a follow row by id. */
   deleteFollowById(id: unknown): Promise<void>;
   /** `handleUndo(Follow)`: the follower actor's cached Oxy user id (for `bridgeUnfollow`). */
@@ -154,7 +159,11 @@ export interface InboundDispatcherConfig {
    * NEVER throws (it handles its own errors); a failure must not fail (and thus
    * retry) the inbox activity. Absent ⇒ no notification.
    */
-  onInboundFollowAccepted?(localUserId: string, followerOxyUserId: string, actorUri: string): Promise<void>;
+  onInboundFollowAccepted?(
+    localUserId: string,
+    followerOxyUserId: string,
+    actorUri: string,
+  ): Promise<void>;
   /**
    * Best-effort: backfill the newly-followed remote actor's recent posts after an
    * outbound Follow was Accepted. NEVER throws. Absent ⇒ no backfill.
@@ -248,7 +257,10 @@ function objectTargetUri(object: unknown): string | undefined {
 export function createInboundDispatcher(config: InboundDispatcherConfig): InboundDispatcher {
   const { logger } = config;
 
-  async function handleIncomingFollow(activity: Record<string, unknown>, actorUri: string): Promise<void> {
+  async function handleIncomingFollow(
+    activity: Record<string, unknown>,
+    actorUri: string,
+  ): Promise<void> {
     const targetActorUri = objectTargetUri(activity.object);
     if (!targetActorUri) return;
 
@@ -314,7 +326,10 @@ export function createInboundDispatcher(config: InboundDispatcherConfig): Inboun
     logger.info(`Accepted follow from ${actorUri} to ${username}`);
   }
 
-  async function handleUndoFollow(object: Record<string, unknown>, actorUri: string): Promise<void> {
+  async function handleUndoFollow(
+    object: Record<string, unknown>,
+    actorUri: string,
+  ): Promise<void> {
     const targetActorUri = objectTargetUri(object.object);
     const match = targetActorUri?.match(/\/ap\/users\/([^/]+)$/);
     let localUserId: string | undefined;
@@ -374,9 +389,10 @@ export function createInboundDispatcher(config: InboundDispatcherConfig): Inboun
       }
     } else if ((object as { type?: unknown }).type === 'Follow') {
       const followActivityId = (object as { id?: unknown }).id;
-      updated = typeof followActivityId === 'string' && followActivityId.length > 0
-        ? await config.follows.markOutboundAcceptedByActivityId(actorUri, followActivityId)
-        : await config.follows.markOutboundAcceptedAnyPending(actorUri);
+      updated =
+        typeof followActivityId === 'string' && followActivityId.length > 0
+          ? await config.follows.markOutboundAcceptedByActivityId(actorUri, followActivityId)
+          : await config.follows.markOutboundAcceptedAnyPending(actorUri);
     }
 
     if (updated) {
@@ -394,7 +410,8 @@ export function createInboundDispatcher(config: InboundDispatcherConfig): Inboun
 
     const objectType = typeof object === 'string' ? null : (object as { type?: unknown }).type;
     if (objectType === 'Follow') {
-      const followActivityId = typeof object === 'object' ? (object as { id?: unknown }).id : undefined;
+      const followActivityId =
+        typeof object === 'object' ? (object as { id?: unknown }).id : undefined;
       await config.follows.markOutboundRejected(
         actorUri,
         typeof followActivityId === 'string' ? followActivityId : undefined,
@@ -403,7 +420,10 @@ export function createInboundDispatcher(config: InboundDispatcherConfig): Inboun
     }
   }
 
-  async function processInboxActivity(activity: Record<string, unknown>, verifiedActorUri: string): Promise<void> {
+  async function processInboxActivity(
+    activity: Record<string, unknown>,
+    verifiedActorUri: string,
+  ): Promise<void> {
     // Instance domain policy, FIRST — before the payload is even parsed.
     //
     // This is the single chokepoint for inbound federation: every transport (the

package/src/node/index.ts

@@ -26,6 +26,17 @@ export {
   type SignedFetchLogger,
 } from './signedFetch';
 
+/**
+ * X's `t.co` wrapper unwrapped into the link the author posted, over the same
+ * injected single-hop transport — for bridged X bios and posts.
+ */
+export {
+  createTcoLinkExpander,
+  type TcoLinkExpander,
+  type TcoLinkCache,
+  type CreateTcoLinkExpanderConfig,
+} from './tcoLinks';
+
 /**
  * The actor↔Oxy-user identity bridge — the default implementation of the
  * `PUT /users/resolve` + actor-gone archive/delete seam over an injected

package/src/node/signedFetch.ts

@@ -156,7 +156,9 @@ export function createSignedFetch(config: CreateSignedFetchConfig): SignedFetch
     // resources. Retry from the post-redirect URL so we don't restart a chain that
     // already landed on the failing hop.
     if (res.status >= 500) {
-      config.logger?.info(`[FedSync] signedFetch got ${res.status} for ${finalUrl}, retrying unsigned`);
+      config.logger?.info(
+        `[FedSync] signedFetch got ${res.status} for ${finalUrl}, retrying unsigned`,
+      );
       return fetchFollowingRedirects(finalUrl, false).then(({ res: unsignedRes }) => unsignedRes);
     }
 

package/src/node/tcoLinks.ts

@@ -0,0 +1,114 @@
+/**
+ * Expanding X's `t.co` link wrapper back into the link the author posted.
+ *
+ * X rewrites EVERY link in a post or bio into `https://t.co/<id>`, and a bridge
+ * that mirrors an X account (bird.makeup, mastox) republishes that text as it
+ * is: the actor `summary` and the Note `content` carry only the wrapper. The
+ * author never wrote `t.co`; it is X's click tracker standing in for their link,
+ * and an X API client never shows it because it reads the expansion beside it.
+ * The bridges drop that expansion, so the only place left to recover it is the
+ * wrapper's own redirect.
+ *
+ * Only `t.co` is unwrapped, and only ONE hop. A `bit.ly` the author chose is
+ * their link and stays; so does wherever their link redirects next. What is
+ * replaced is exactly X's wrapper, by exactly the URL it names.
+ *
+ * The transport is injected — the same SSRF-safe, IP-pinned single-hop fetch
+ * {@link createSignedFetch} takes — so each backend keeps its own network
+ * contract. A link that does not resolve (timeout, 404, a malformed or
+ * self-referencing `Location`) is left as `t.co`: still a working link, never a
+ * broken one.
+ */
+
+import type { SingleHopFetch } from './signedFetch';
+
+/**
+ * A `t.co` link in plain text. X ids are alphanumeric; the lookahead stops a
+ * longer token (`t.co/abc/def`, `t.co/abcé`) from being half-replaced.
+ */
+const TCO_LINK = /\bhttps?:\/\/t\.co\/([A-Za-z0-9]+)(?![\w/])/gi;
+const REDIRECT_STATUS_CODES: ReadonlySet<number> = new Set([301, 302, 303, 307, 308]);
+/** A link that has not answered by then is kept as `t.co`. */
+const TCO_TIMEOUT_MS = 5_000;
+/** Bounds the requests one text can cost; the rest keep their wrapper. */
+const MAX_LINKS_PER_TEXT = 10;
+
+/**
+ * A store of resolved wrappers, keyed by the `t.co` id. A wrapper never changes
+ * what it points to, so an entry never goes stale. Failures are not cached.
+ */
+export interface TcoLinkCache {
+  get(id: string): Promise<string | null | undefined>;
+  set(id: string, target: string): Promise<void>;
+}
+
+/** Adapters a {@link TcoLinkExpander} is built from. */
+export interface CreateTcoLinkExpanderConfig {
+  /** SSRF-safe single-hop transport (does NOT follow redirects). */
+  fetchSingleHop: SingleHopFetch;
+  /** User-Agent presented to t.co. A browser UA gets an HTML page instead of the 301. */
+  userAgent: string;
+  cache?: TcoLinkCache;
+}
+
+/** Replace every `t.co` link in `text` with the URL it redirects to. */
+export type TcoLinkExpander = (text: string) => Promise<string>;
+
+/** The `t.co` ids in `text`, in order of first appearance. */
+function findTcoLinkIds(text: string): string[] {
+  return [...new Set(Array.from(text.matchAll(TCO_LINK), (match) => match[1]))];
+}
+
+/** The redirect target, if it is an http(s) URL that is not another `t.co` wrapper. */
+function readTarget(response: Response, from: string): string | null {
+  if (!REDIRECT_STATUS_CODES.has(response.status)) return null;
+  const location = response.headers.get('location');
+  if (!location) return null;
+  let target: URL;
+  try {
+    target = new URL(location, from);
+  } catch {
+    return null;
+  }
+  if (target.protocol !== 'https:' && target.protocol !== 'http:') return null;
+  if (target.hostname.toLowerCase() === 't.co') return null;
+  return target.href;
+}
+
+export function createTcoLinkExpander(config: CreateTcoLinkExpanderConfig): TcoLinkExpander {
+  const { cache } = config;
+
+  async function resolve(id: string): Promise<string | null> {
+    const cached = await cache?.get(id).catch(() => null);
+    if (cached) return cached;
+    const from = `https://t.co/${id}`;
+    let target: string | null;
+    try {
+      const response = await config.fetchSingleHop(from, {
+        headers: { Accept: '*/*', 'User-Agent': config.userAgent },
+        signal: AbortSignal.timeout(TCO_TIMEOUT_MS),
+        headersTimeoutMs: TCO_TIMEOUT_MS,
+      });
+      target = readTarget(response, from);
+      await response.body?.cancel().catch(() => undefined);
+    } catch {
+      return null;
+    }
+    if (target) await cache?.set(id, target).catch(() => undefined);
+    return target;
+  }
+
+  return async function expandTcoLinks(text: string): Promise<string> {
+    const ids = findTcoLinkIds(text).slice(0, MAX_LINKS_PER_TEXT);
+    if (ids.length === 0) return text;
+    const targets = new Map<string, string>();
+    await Promise.all(
+      ids.map(async (id) => {
+        const target = await resolve(id);
+        if (target) targets.set(id, target);
+      }),
+    );
+    if (targets.size === 0) return text;
+    return text.replace(TCO_LINK, (whole, id: string) => targets.get(id) ?? whole);
+  };
+}