@oxy.so/federation 2.2.1 → 2.4.0

package/dist/esm/apUri.js

@@ -99,7 +99,9 @@ export function createDomainPolicy(config) {
         canonicalFederationHost(config.domain),
         canonicalFederationHost(config.actorDomain ?? config.domain),
     ]);
-    const identityApex = config.identityApex ? canonicalFederationHost(config.identityApex) : undefined;
+    const identityApex = config.identityApex
+        ? canonicalFederationHost(config.identityApex)
+        : undefined;
     const blocked = new Set();
     for (const d of config.blockedDomains ?? []) {
         blocked.add(canonicalFederationHost(d));
@@ -107,7 +109,7 @@ export function createDomainPolicy(config) {
     return {
         isBlockedDomain(domain) {
             const d = canonicalFederationHost(domain);
-            return localDomains.has(d) || (identityApex !== undefined && d === identityApex) || blocked.has(d);
+            return (localDomains.has(d) || (identityApex !== undefined && d === identityApex) || blocked.has(d));
         },
         extractLocalPostId(objectUri) {
             let parsed;

package/dist/esm/httpSignature.js

@@ -16,7 +16,7 @@
  *    Mention runs behind a CF-proxied apex that rewrites the origin `Host`, so it
  *    passes `true`; a directly-exposed origin leaves it `false`.
  *
- * Lives in the isomorphic `.` entry (no Express / Mongoose): it depends only on
+ * Lives in the isomorphic `.` entry (no Express / database driver): it depends only on
  * the runtime `crypto` builtin (Node / Bun) and is never invoked from browser /
  * React-Native bundles — RN consumers import only the connector TYPES, which are
  * erased at compile time.

package/dist/esm/index.js

@@ -8,8 +8,8 @@
  * connector produces, the local-event union connectors deliver outbound, and
  * the connector interface itself.
  *
- * IMPORTANT: this entry is intentionally free of Mongoose / Express / React
- * Native so it can be imported from any Oxy app backend (and, in later phases,
+ * IMPORTANT: this entry is intentionally free of database drivers / Express /
+ * React Native so it can be imported from any Oxy app backend (and, in later phases,
  * share the pure HTTP-signature + actor-object surface with browser/isomorphic
  * callers). The runnable Express/Node engine — signed fetch, delivery transport,
  * webfinger/actor/inbox routers, remote-actor resolution — lives under the
@@ -30,7 +30,7 @@ export { signRequest, verifyHttpSignature, HTTP_SIGNATURE_ALGORITHM, DEFAULT_SIG
  * Domain-parameterized ActivityPub URL builders — each app instantiates them once
  * with its own `FEDERATION_DOMAIN` so every actor stays `@user@its-own-domain`.
  */
-export { createUrlBuilders, normalizeActorUsername, INSTANCE_ACTOR_USERNAME } from './urls.js';
+export { createUrlBuilders, normalizeActorUsername, INSTANCE_ACTOR_USERNAME, } from './urls.js';
 /**
  * Network identity: the MECHANISM for re-labelling an account republished by a
  * bridge onto the network it actually came from, plus the network vocabulary and

package/dist/esm/networkIdentity.js

@@ -230,7 +230,8 @@ export function upstreamHandleFromProfileField(options) {
                 // https://https://twitter.com/jordievole. Repair exactly one duplicated
                 // HTTPS prefix, then run the ordinary host/path/credential validation.
                 const candidateHref = options.repairRepeatedHttpsScheme && href.startsWith('https://https://')
-                    ? href.slice('https://'.length) : href;
+                    ? href.slice('https://'.length)
+                    : href;
                 let handle;
                 try {
                     handle = profileUrlHandle(candidateHref, options.hosts, prefix);
@@ -431,7 +432,7 @@ export function createBridgeRelabeller(entries) {
             const bridge = findBridge(actorHost);
             if (!bridge)
                 return false;
-            return canonicalFederationHost(bridge.network.domain) === canonicalFederationHost(networkDomain);
+            return (canonicalFederationHost(bridge.network.domain) === canonicalFederationHost(networkDomain));
         },
         deriveNetworkIdentity: (candidate) => {
             const entry = findBridge(candidate.host);

package/dist/esm/node/actorResolver.js

@@ -104,9 +104,9 @@ function sameOriginUrl(a, b) {
     try {
         const urlA = new URL(a);
         const urlB = new URL(b);
-        return urlA.protocol === urlB.protocol
-            && urlA.port === urlB.port
-            && isSameFederationHost(urlA.hostname, urlB.hostname);
+        return (urlA.protocol === urlB.protocol &&
+            urlA.port === urlB.port &&
+            isSameFederationHost(urlA.hostname, urlB.hostname));
     }
     catch {
         return false;
@@ -226,8 +226,10 @@ export class ActorResolver {
                 // the username-based URI we may have stored.
                 const parsed = new URL(currentUri);
                 const pathUsername = parsed.pathname.split('/').filter(Boolean).pop();
-                const acct = canonicalAcctHint
-                    || (pathUsername ? this.config.normalizeFederatedAcct(`${pathUsername}@${parsed.hostname}`) : undefined);
+                const acct = canonicalAcctHint ||
+                    (pathUsername
+                        ? this.config.normalizeFederatedAcct(`${pathUsername}@${parsed.hostname}`)
+                        : undefined);
                 if (acct) {
                     this.config.logger.info(`[FedSync] attempting WebFinger fallback for ${acct}`);
                     const resolved = await this.resolveWebFinger(acct);
@@ -275,9 +277,9 @@ export class ActorResolver {
                 return null;
             }
             const actorHost = new URL(actorId).hostname.toLowerCase();
-            const username = this.config.text.inlineField(actor.preferredUsername)
-                || this.config.text.inlineField(actor.name)
-                || 'unknown';
+            const username = this.config.text.inlineField(actor.preferredUsername) ||
+                this.config.text.inlineField(actor.name) ||
+                'unknown';
             const actorWebfinger = typeof actor.webfinger === 'string'
                 ? this.config.normalizeFederatedAcct(actor.webfinger)
                 : undefined;
@@ -287,10 +289,10 @@ export class ActorResolver {
             const verifiedActorWebfinger = this.acctMatchesActorHost(actorWebfinger, actorHost)
                 ? actorWebfinger
                 : undefined;
-            const acct = verifiedAcctHint
-                || verifiedActorWebfinger
-                || this.config.normalizeFederatedAcct(`${username}@${actorHost}`)
-                || `${username.toLowerCase()}@${actorHost}`;
+            const acct = verifiedAcctHint ||
+                verifiedActorWebfinger ||
+                this.config.normalizeFederatedAcct(`${username}@${actorHost}`) ||
+                `${username.toLowerCase()}@${actorHost}`;
             const domain = this.config.domainFromAcct(acct) || actorHost;
             // Re-check against the RESOLVED host/acct (post-redirect / WebFinger), which
             // can differ from the originally-requested URI host the early guard screened.
@@ -438,7 +440,9 @@ export class ActorResolver {
                         postsCount: postsCount ?? undefined,
                         oxyUserId: fedActor.oxyUserId ?? undefined,
                     };
-                    const oxyId = await this.config.identity.resolveExternalUser(normalized, { forceAvatarRefresh });
+                    const oxyId = await this.config.identity.resolveExternalUser(normalized, {
+                        forceAvatarRefresh,
+                    });
                     if (oxyId && fedActor.oxyUserId !== oxyId && fedActor._id != null) {
                         await this.config.store.setActorOxyUserId(fedActor._id, oxyId);
                     }
@@ -479,11 +483,11 @@ export class ActorResolver {
         // instead of needing its own clause.
         const atIndex = federatedUsername.indexOf('@');
         const localPart = atIndex > 0 ? federatedUsername.slice(0, atIndex) : '';
-        if (domain.length === 0
-            || localPart.length === 0
-            || federatedUsername !== `${localPart}@${domain}`) {
-            this.config.logger.warn(`[FedSync] refusing network identity for ${candidate.actorUri}: `
-                + `"${derived.federatedUsername}" is not bindable to domain "${derived.instanceDomain}"`);
+        if (domain.length === 0 ||
+            localPart.length === 0 ||
+            federatedUsername !== `${localPart}@${domain}`) {
+            this.config.logger.warn(`[FedSync] refusing network identity for ${candidate.actorUri}: ` +
+                `"${derived.federatedUsername}" is not bindable to domain "${derived.instanceDomain}"`);
             return undefined;
         }
         return { federatedUsername, instanceDomain: domain, bio: derived.bio };
@@ -586,8 +590,8 @@ export class ActorResolver {
             return;
         const missingProfile = !existing || !existing.avatarUrl || !existing.headerUrl;
         const lastFetchedMs = existing?.lastFetchedAt?.getTime();
-        const refreshedRecently = typeof lastFetchedMs === 'number'
-            && Date.now() - lastFetchedMs < ACTOR_REFRESH_MIN_INTERVAL_MS;
+        const refreshedRecently = typeof lastFetchedMs === 'number' &&
+            Date.now() - lastFetchedMs < ACTOR_REFRESH_MIN_INTERVAL_MS;
         // Skip if we refreshed recently AND the cached profile is already complete.
         if (refreshedRecently && !missingProfile)
             return;

package/dist/esm/node/actorRouter.js

@@ -20,6 +20,7 @@
  */
 import { Router } from 'express';
 import { AP_CONTEXT } from '../apContext.js';
+import { discoveryCacheControl } from './httpCacheControl.js';
 import { verifyHttpSignature } from '../httpSignature.js';
 import { INSTANCE_ACTOR_USERNAME, normalizeActorUsername } from '../urls.js';
 /** Page size for the paginated followers/following collections (mirrors the outbox). */
@@ -54,6 +55,7 @@ function parseFollowOffset(raw) {
 export function createActorRouter(config) {
     const router = Router();
     const { urls, domain, apContentType, logger } = config;
+    const httpCacheControl = discoveryCacheControl(config.httpCacheTtlSeconds, 1800);
     function wantsActivityPub(req) {
         return config.wantsActivityPub(req.headers.accept);
     }
@@ -61,7 +63,7 @@ export function createActorRouter(config) {
     async function handleInbox(req, res) {
         try {
             // Verify HTTP signature (use originalUrl to avoid proxy path mangling).
-            const { verified, actorUri, reason: signatureError } = await verifyHttpSignature({
+            const { verified, actorUri, reason: signatureError, } = await verifyHttpSignature({
                 method: req.method,
                 path: req.originalUrl || req.path,
                 headers: req.headers,
@@ -91,7 +93,10 @@ export function createActorRouter(config) {
             // is never dropped.
             let enqueued = false;
             try {
-                enqueued = await config.inbound.enqueueInboxActivity({ activity, verifiedActorUri: actorUri });
+                enqueued = await config.inbound.enqueueInboxActivity({
+                    activity,
+                    verifiedActorUri: actorUri,
+                });
             }
             catch (err) {
                 logger.error('Failed to enqueue inbox activity — processing inline:', err);
@@ -139,7 +144,9 @@ export function createActorRouter(config) {
                     }
                     catch (err) {
                         logger.warn('[Federation] follow-collection summary total lookup failed', {
-                            username, direction, error: err,
+                            username,
+                            direction,
+                            error: err,
                         });
                     }
                 }
@@ -166,7 +173,10 @@ export function createActorRouter(config) {
                 // Fail-soft: never 500 the whole collection on an Oxy graph hiccup — serve
                 // an empty page against the best-known total rather than crashing.
                 logger.warn('[Federation] follow-collection Oxy graph list failed, serving empty page', {
-                    username, direction, offset, error: err,
+                    username,
+                    direction,
+                    offset,
+                    error: err,
                 });
             }
             const orderedItems = members
@@ -231,7 +241,7 @@ export function createActorRouter(config) {
                     },
                 };
                 res.set('Content-Type', apContentType);
-                res.set('Cache-Control', 'max-age=1800');
+                res.set('Cache-Control', httpCacheControl);
                 return res.json(actorObject);
             }
             const user = await config.resolveUser(username);
@@ -266,7 +276,7 @@ export function createActorRouter(config) {
                 alsoKnownAs: user.alsoKnownAs,
             });
             res.set('Content-Type', apContentType);
-            res.set('Cache-Control', 'max-age=1800');
+            res.set('Cache-Control', httpCacheControl);
             return res.json({ '@context': AP_CONTEXT, ...actorObject });
         }
         catch (err) {

package/dist/esm/node/delivery.js

@@ -31,6 +31,14 @@ const DELIVER_ACTIVITY_TIMEOUT_MS = 15000;
 const DELIVERY_RESPONSE_PREVIEW_MAX_BYTES = 1024;
 /** The ActivityStreams public collection — the `to` addressee of a public activity. */
 const AP_PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
+/** A definitive refusal: workers must discard, not retry or count a delivery. */
+export class DeliveryAuthorizationDeniedError extends Error {
+    constructor() {
+        super('Outbound federation delivery is not authorized');
+        this.code = 'DELIVERY_AUTHORIZATION_DENIED';
+        this.name = 'DeliveryAuthorizationDeniedError';
+    }
+}
 /** Read a bounded prefix of a failed-delivery response body for the debug log. */
 async function readResponsePreview(response) {
     const chunks = [];
@@ -69,7 +77,17 @@ export function createDeliveryService(config) {
         const host = urlHost(url);
         return host === null || config.isBlockedDomain(host);
     }
+    async function authorizeDelivery(activity, senderAccountId) {
+        if (config.authorizeDelivery &&
+            !(await config.authorizeDelivery({ activity, senderAccountId }))) {
+            throw new DeliveryAuthorizationDeniedError();
+        }
+    }
     async function deliverActivity(activity, targetInbox, senderOxyUserId, senderUsername) {
+        await authorizeDelivery(activity, senderOxyUserId);
+        return deliverAuthorizedActivity(activity, targetInbox, senderUsername);
+    }
+    async function deliverAuthorizedActivity(activity, targetInbox, senderUsername) {
         if (isBlockedUrl(targetInbox)) {
             logger.warn(`[FedDeliver] refusing outbound delivery to blocked inbox ${targetInbox}`);
             return false;
@@ -107,6 +125,7 @@ export function createDeliveryService(config) {
         }
     }
     async function queueDelivery(activity, targetInbox, senderOxyUserId) {
+        await authorizeDelivery(activity, senderOxyUserId);
         if (isBlockedUrl(targetInbox)) {
             logger.warn(`[FedDeliver] not queueing delivery to blocked inbox ${targetInbox}`);
             return;
@@ -144,6 +163,7 @@ export function createDeliveryService(config) {
         return actor.sharedInboxUrl ?? actor.inboxUrl ?? undefined;
     }
     async function deliverToFollowers(activity, senderOxyUserId, senderUsername, options = {}) {
+        await authorizeDelivery(activity, senderOxyUserId);
         const actorUris = await config.follows.listAcceptedInboundFollowerActorUris(senderOxyUserId);
         const actors = actorUris.length > 0 ? await config.store.findActorInboxesByUris(actorUris) : [];
         // Group by shared inbox to avoid duplicate deliveries. Follower inboxes
@@ -189,7 +209,12 @@ export function createDeliveryService(config) {
                 return false;
             });
             if (!enqueued) {
-                durableFallback.push({ activityJson: activity, targetInbox: inbox, senderOxyUserId, nextAttemptAt: now });
+                durableFallback.push({
+                    activityJson: activity,
+                    targetInbox: inbox,
+                    senderOxyUserId,
+                    nextAttemptAt: now,
+                });
             }
         }
         if (durableFallback.length > 0) {
@@ -233,19 +258,12 @@ export function createDeliveryService(config) {
         // cached; if the actor is unknown locally we still record the follow and
         // queue the Follow activity, then refresh the actor in the background.
         const cached = await config.store.findActorByUri(remoteActorUri);
-        // Always refresh the actor in the background so its inbox/profile stay
-        // current (and so a missing actor gets resolved for delivery shortly).
-        config.actorRefresh.refreshActorInBackground(remoteActorUri, cached ?? undefined);
         const canonicalUri = cached?.uri ?? remoteActorUri;
         const localActorUri = urls.actor(localUsername);
         // Use the actor _id when known, otherwise a stable hash of the URI so the
         // activity ID is deterministic across retries before the actor is cached.
-        const activityIdSuffix = cached?._id
-            ? String(cached._id)
-            : encodeURIComponent(canonicalUri);
+        const activityIdSuffix = cached?._id ? String(cached._id) : encodeURIComponent(canonicalUri);
         const activityId = `${localActorUri}/follows/${activityIdSuffix}`;
-        // Create or update the follow record
-        await config.follows.upsertOutboundPending(localOxyUserId, canonicalUri, activityId);
         const activity = {
             '@context': 'https://www.w3.org/ns/activitystreams',
             id: activityId,
@@ -253,11 +271,16 @@ export function createDeliveryService(config) {
             actor: localActorUri,
             object: canonicalUri,
         };
+        // Refuse before committing an outbound follow or reporting success.
+        await authorizeDelivery(activity, localOxyUserId);
+        // A refused follow must not start remote actor discovery either.
+        config.actorRefresh.refreshActorInBackground(remoteActorUri, cached ?? undefined);
+        await config.follows.upsertOutboundPending(localOxyUserId, canonicalUri, activityId);
         // If we know the inbox, attempt delivery in the background; otherwise queue
         // for the delivery worker, which resolves the inbox once the actor lands.
         const targetInbox = cached?.sharedInboxUrl ?? cached?.inboxUrl;
         if (targetInbox && !isBlockedUrl(targetInbox)) {
-            void deliverActivity(activity, targetInbox, localOxyUserId, localUsername)
+            void deliverAuthorizedActivity(activity, targetInbox, localUsername)
                 .then((delivered) => {
                 if (!delivered)
                     return queueDelivery(activity, targetInbox, localOxyUserId);

package/dist/esm/node/httpCacheControl.js

@@ -0,0 +1,8 @@
+/** Shared discovery config validation; zero forbids downstream response retention. */
+export function discoveryCacheControl(value, defaultSeconds) {
+    const seconds = value ?? defaultSeconds;
+    if (!Number.isInteger(seconds) || seconds < 0 || seconds > 86400) {
+        throw new RangeError('httpCacheTtlSeconds must be an integer from 0 to 86400');
+    }
+    return seconds === 0 ? 'no-store' : `max-age=${seconds}`;
+}

package/dist/esm/node/inboundDispatch.js

@@ -217,9 +217,10 @@ export function createInboundDispatcher(config) {
         }
         else if (object.type === 'Follow') {
             const followActivityId = object.id;
-            updated = typeof followActivityId === 'string' && followActivityId.length > 0
-                ? await config.follows.markOutboundAcceptedByActivityId(actorUri, followActivityId)
-                : await config.follows.markOutboundAcceptedAnyPending(actorUri);
+            updated =
+                typeof followActivityId === 'string' && followActivityId.length > 0
+                    ? await config.follows.markOutboundAcceptedByActivityId(actorUri, followActivityId)
+                    : await config.follows.markOutboundAcceptedAnyPending(actorUri);
         }
         if (updated) {
             logger.debug(`Follow accepted by ${actorUri}`);

package/dist/esm/node/index.js

@@ -17,6 +17,11 @@
  * actor + inbox + follow-graph Express routers.
  */
 export { createSignedFetch, } from './signedFetch.js';
+/**
+ * X's `t.co` wrapper unwrapped into the link the author posted, over the same
+ * injected single-hop transport — for bridged X bios and posts.
+ */
+export { createTcoLinkExpander, } from './tcoLinks.js';
 /**
  * The actor↔Oxy-user identity bridge — the default implementation of the
  * `PUT /users/resolve` + actor-gone archive/delete seam over an injected
@@ -34,7 +39,7 @@ export { createActorResolver, ActorResolver, } from './actorResolver.js';
  * Accept(Follow)) + the `Update(Person)` actor rebroadcast, over injected key
  * custody, an SSRF-safe delivery transport, and bring-your-own-store adapters.
  */
-export { createDeliveryService, } from './delivery.js';
+export { createDeliveryService, DeliveryAuthorizationDeniedError, } from './delivery.js';
 /**
  * Inbound ActivityPub dispatch — the untrusted-activity validator + switch, the
  * follow-protocol handlers (Follow / Accept / Undo(Follow) / Reject) over the

package/dist/esm/node/tcoLinks.js

@@ -0,0 +1,94 @@
+/**
+ * Expanding X's `t.co` link wrapper back into the link the author posted.
+ *
+ * X rewrites EVERY link in a post or bio into `https://t.co/<id>`, and a bridge
+ * that mirrors an X account (bird.makeup, mastox) republishes that text as it
+ * is: the actor `summary` and the Note `content` carry only the wrapper. The
+ * author never wrote `t.co`; it is X's click tracker standing in for their link,
+ * and an X API client never shows it because it reads the expansion beside it.
+ * The bridges drop that expansion, so the only place left to recover it is the
+ * wrapper's own redirect.
+ *
+ * Only `t.co` is unwrapped, and only ONE hop. A `bit.ly` the author chose is
+ * their link and stays; so does wherever their link redirects next. What is
+ * replaced is exactly X's wrapper, by exactly the URL it names.
+ *
+ * The transport is injected — the same SSRF-safe, IP-pinned single-hop fetch
+ * {@link createSignedFetch} takes — so each backend keeps its own network
+ * contract. A link that does not resolve (timeout, 404, a malformed or
+ * self-referencing `Location`) is left as `t.co`: still a working link, never a
+ * broken one.
+ */
+/**
+ * A `t.co` link in plain text. X ids are alphanumeric; the lookahead stops a
+ * longer token (`t.co/abc/def`, `t.co/abcé`) from being half-replaced.
+ */
+const TCO_LINK = /\bhttps?:\/\/t\.co\/([A-Za-z0-9]+)(?![\w/])/gi;
+const REDIRECT_STATUS_CODES = new Set([301, 302, 303, 307, 308]);
+/** A link that has not answered by then is kept as `t.co`. */
+const TCO_TIMEOUT_MS = 5000;
+/** Bounds the requests one text can cost; the rest keep their wrapper. */
+const MAX_LINKS_PER_TEXT = 10;
+/** The `t.co` ids in `text`, in order of first appearance. */
+function findTcoLinkIds(text) {
+    return [...new Set(Array.from(text.matchAll(TCO_LINK), (match) => match[1]))];
+}
+/** The redirect target, if it is an http(s) URL that is not another `t.co` wrapper. */
+function readTarget(response, from) {
+    if (!REDIRECT_STATUS_CODES.has(response.status))
+        return null;
+    const location = response.headers.get('location');
+    if (!location)
+        return null;
+    let target;
+    try {
+        target = new URL(location, from);
+    }
+    catch {
+        return null;
+    }
+    if (target.protocol !== 'https:' && target.protocol !== 'http:')
+        return null;
+    if (target.hostname.toLowerCase() === 't.co')
+        return null;
+    return target.href;
+}
+export function createTcoLinkExpander(config) {
+    const { cache } = config;
+    async function resolve(id) {
+        const cached = await cache?.get(id).catch(() => null);
+        if (cached)
+            return cached;
+        const from = `https://t.co/${id}`;
+        let target;
+        try {
+            const response = await config.fetchSingleHop(from, {
+                headers: { Accept: '*/*', 'User-Agent': config.userAgent },
+                signal: AbortSignal.timeout(TCO_TIMEOUT_MS),
+                headersTimeoutMs: TCO_TIMEOUT_MS,
+            });
+            target = readTarget(response, from);
+            await response.body?.cancel().catch(() => undefined);
+        }
+        catch {
+            return null;
+        }
+        if (target)
+            await cache?.set(id, target).catch(() => undefined);
+        return target;
+    }
+    return async function expandTcoLinks(text) {
+        const ids = findTcoLinkIds(text).slice(0, MAX_LINKS_PER_TEXT);
+        if (ids.length === 0)
+            return text;
+        const targets = new Map();
+        await Promise.all(ids.map(async (id) => {
+            const target = await resolve(id);
+            if (target)
+                targets.set(id, target);
+        }));
+        if (targets.size === 0)
+            return text;
+        return text.replace(TCO_LINK, (whole, id) => targets.get(id) ?? whole);
+    };
+}

package/dist/esm/node/webfingerRouter.js

@@ -12,9 +12,10 @@
  * Extracted behaviour-identically from Mention's `wellKnown.routes.ts`.
  */
 import { Router } from 'express';
+import { discoveryCacheControl } from './httpCacheControl.js';
 import { isSameFederationHost } from '../apUri.js';
 import { INSTANCE_ACTOR_USERNAME, normalizeActorUsername } from '../urls.js';
-/** 1 hour, in seconds — the WebFinger JRD cache TTL + response `max-age`. */
+/** Default HTTP response max-age. The injected JRD cache has its own policy. */
 const WEBFINGER_CACHE_TTL = 3600;
 /** 24h — host-meta is effectively static. */
 const HOST_META_CACHE_CONTROL = `max-age=${60 * 60 * 24}`;
@@ -22,6 +23,7 @@ const HOST_META_CACHE_CONTROL = `max-age=${60 * 60 * 24}`;
 export function createWebfingerRouter(config) {
     const router = Router();
     const { domain } = config;
+    const httpCacheControl = discoveryCacheControl(config.httpCacheTtlSeconds, WEBFINGER_CACHE_TTL);
     const webfingerTemplate = `https://${domain}/.well-known/webfinger?resource={uri}`;
     router.get('/webfinger', async (req, res) => {
         if (!config.federationEnabled) {
@@ -74,14 +76,14 @@ export function createWebfingerRouter(config) {
                     ],
                 };
                 res.set('Content-Type', 'application/jrd+json; charset=utf-8');
-                res.set('Cache-Control', `max-age=${WEBFINGER_CACHE_TTL}`);
+                res.set('Cache-Control', httpCacheControl);
                 return res.json(instanceJrd);
             }
             // Check the JRD cache first.
             const cached = await config.cache.get(username);
             if (cached) {
                 res.set('Content-Type', 'application/jrd+json; charset=utf-8');
-                res.set('Cache-Control', `max-age=${WEBFINGER_CACHE_TTL}`);
+                res.set('Cache-Control', httpCacheControl);
                 return res.json(cached);
             }
             const user = await config.resolveUser(username);
@@ -122,7 +124,7 @@ export function createWebfingerRouter(config) {
             };
             config.cache.set(username, response);
             res.set('Content-Type', 'application/jrd+json; charset=utf-8');
-            res.set('Cache-Control', `max-age=${WEBFINGER_CACHE_TTL}`);
+            res.set('Cache-Control', httpCacheControl);
             return res.json(response);
         }
         catch (err) {