@oxy.so/federation 2.3.0 → 2.4.0

package/dist/cjs/node/actorRouter.js

@@ -23,6 +23,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createActorRouter = createActorRouter;
 const express_1 = require("express");
 const apContext_1 = require("../apContext");
+const httpCacheControl_1 = require("./httpCacheControl");
 const httpSignature_1 = require("../httpSignature");
 const urls_1 = require("../urls");
 /** Page size for the paginated followers/following collections (mirrors the outbox). */
@@ -57,6 +58,7 @@ function parseFollowOffset(raw) {
 function createActorRouter(config) {
     const router = (0, express_1.Router)();
     const { urls, domain, apContentType, logger } = config;
+    const httpCacheControl = (0, httpCacheControl_1.discoveryCacheControl)(config.httpCacheTtlSeconds, 1800);
     function wantsActivityPub(req) {
         return config.wantsActivityPub(req.headers.accept);
     }
@@ -242,7 +244,7 @@ function createActorRouter(config) {
                     },
                 };
                 res.set('Content-Type', apContentType);
-                res.set('Cache-Control', 'max-age=1800');
+                res.set('Cache-Control', httpCacheControl);
                 return res.json(actorObject);
             }
             const user = await config.resolveUser(username);
@@ -277,7 +279,7 @@ function createActorRouter(config) {
                 alsoKnownAs: user.alsoKnownAs,
             });
             res.set('Content-Type', apContentType);
-            res.set('Cache-Control', 'max-age=1800');
+            res.set('Cache-Control', httpCacheControl);
             return res.json({ '@context': apContext_1.AP_CONTEXT, ...actorObject });
         }
         catch (err) {

package/dist/cjs/node/delivery.js

@@ -25,6 +25,7 @@
  * call `deliverToFollowers` / `deliverActivity` / `queueDelivery` here.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeliveryAuthorizationDeniedError = void 0;
 exports.createDeliveryService = createDeliveryService;
 const apContext_1 = require("../apContext");
 const httpSignature_1 = require("../httpSignature");
@@ -34,6 +35,15 @@ const DELIVER_ACTIVITY_TIMEOUT_MS = 15000;
 const DELIVERY_RESPONSE_PREVIEW_MAX_BYTES = 1024;
 /** The ActivityStreams public collection — the `to` addressee of a public activity. */
 const AP_PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
+/** A definitive refusal: workers must discard, not retry or count a delivery. */
+class DeliveryAuthorizationDeniedError extends Error {
+    constructor() {
+        super('Outbound federation delivery is not authorized');
+        this.code = 'DELIVERY_AUTHORIZATION_DENIED';
+        this.name = 'DeliveryAuthorizationDeniedError';
+    }
+}
+exports.DeliveryAuthorizationDeniedError = DeliveryAuthorizationDeniedError;
 /** Read a bounded prefix of a failed-delivery response body for the debug log. */
 async function readResponsePreview(response) {
     const chunks = [];
@@ -72,7 +82,17 @@ function createDeliveryService(config) {
         const host = urlHost(url);
         return host === null || config.isBlockedDomain(host);
     }
+    async function authorizeDelivery(activity, senderAccountId) {
+        if (config.authorizeDelivery &&
+            !(await config.authorizeDelivery({ activity, senderAccountId }))) {
+            throw new DeliveryAuthorizationDeniedError();
+        }
+    }
     async function deliverActivity(activity, targetInbox, senderOxyUserId, senderUsername) {
+        await authorizeDelivery(activity, senderOxyUserId);
+        return deliverAuthorizedActivity(activity, targetInbox, senderUsername);
+    }
+    async function deliverAuthorizedActivity(activity, targetInbox, senderUsername) {
         if (isBlockedUrl(targetInbox)) {
             logger.warn(`[FedDeliver] refusing outbound delivery to blocked inbox ${targetInbox}`);
             return false;
@@ -110,6 +130,7 @@ function createDeliveryService(config) {
         }
     }
     async function queueDelivery(activity, targetInbox, senderOxyUserId) {
+        await authorizeDelivery(activity, senderOxyUserId);
         if (isBlockedUrl(targetInbox)) {
             logger.warn(`[FedDeliver] not queueing delivery to blocked inbox ${targetInbox}`);
             return;
@@ -147,6 +168,7 @@ function createDeliveryService(config) {
         return actor.sharedInboxUrl ?? actor.inboxUrl ?? undefined;
     }
     async function deliverToFollowers(activity, senderOxyUserId, senderUsername, options = {}) {
+        await authorizeDelivery(activity, senderOxyUserId);
         const actorUris = await config.follows.listAcceptedInboundFollowerActorUris(senderOxyUserId);
         const actors = actorUris.length > 0 ? await config.store.findActorInboxesByUris(actorUris) : [];
         // Group by shared inbox to avoid duplicate deliveries. Follower inboxes
@@ -241,17 +263,12 @@ function createDeliveryService(config) {
         // cached; if the actor is unknown locally we still record the follow and
         // queue the Follow activity, then refresh the actor in the background.
         const cached = await config.store.findActorByUri(remoteActorUri);
-        // Always refresh the actor in the background so its inbox/profile stay
-        // current (and so a missing actor gets resolved for delivery shortly).
-        config.actorRefresh.refreshActorInBackground(remoteActorUri, cached ?? undefined);
         const canonicalUri = cached?.uri ?? remoteActorUri;
         const localActorUri = urls.actor(localUsername);
         // Use the actor _id when known, otherwise a stable hash of the URI so the
         // activity ID is deterministic across retries before the actor is cached.
         const activityIdSuffix = cached?._id ? String(cached._id) : encodeURIComponent(canonicalUri);
         const activityId = `${localActorUri}/follows/${activityIdSuffix}`;
-        // Create or update the follow record
-        await config.follows.upsertOutboundPending(localOxyUserId, canonicalUri, activityId);
         const activity = {
             '@context': 'https://www.w3.org/ns/activitystreams',
             id: activityId,
@@ -259,11 +276,16 @@ function createDeliveryService(config) {
             actor: localActorUri,
             object: canonicalUri,
         };
+        // Refuse before committing an outbound follow or reporting success.
+        await authorizeDelivery(activity, localOxyUserId);
+        // A refused follow must not start remote actor discovery either.
+        config.actorRefresh.refreshActorInBackground(remoteActorUri, cached ?? undefined);
+        await config.follows.upsertOutboundPending(localOxyUserId, canonicalUri, activityId);
         // If we know the inbox, attempt delivery in the background; otherwise queue
         // for the delivery worker, which resolves the inbox once the actor lands.
         const targetInbox = cached?.sharedInboxUrl ?? cached?.inboxUrl;
         if (targetInbox && !isBlockedUrl(targetInbox)) {
-            void deliverActivity(activity, targetInbox, localOxyUserId, localUsername)
+            void deliverAuthorizedActivity(activity, targetInbox, localUsername)
                 .then((delivered) => {
                 if (!delivered)
                     return queueDelivery(activity, targetInbox, localOxyUserId);

package/dist/cjs/node/httpCacheControl.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.discoveryCacheControl = discoveryCacheControl;
+/** Shared discovery config validation; zero forbids downstream response retention. */
+function discoveryCacheControl(value, defaultSeconds) {
+    const seconds = value ?? defaultSeconds;
+    if (!Number.isInteger(seconds) || seconds < 0 || seconds > 86400) {
+        throw new RangeError('httpCacheTtlSeconds must be an integer from 0 to 86400');
+    }
+    return seconds === 0 ? 'no-store' : `max-age=${seconds}`;
+}

package/dist/cjs/node/index.js

@@ -18,7 +18,7 @@
  * actor + inbox + follow-graph Express routers.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createActorRouter = exports.createWebfingerRouter = exports.ActorResolutionPendingError = exports.createInboundDispatcher = exports.createDeliveryService = exports.ActorResolver = exports.createActorResolver = exports.createIdentityBridge = exports.createTcoLinkExpander = exports.createSignedFetch = void 0;
+exports.createActorRouter = exports.createWebfingerRouter = exports.ActorResolutionPendingError = exports.createInboundDispatcher = exports.DeliveryAuthorizationDeniedError = exports.createDeliveryService = exports.ActorResolver = exports.createActorResolver = exports.createIdentityBridge = exports.createTcoLinkExpander = exports.createSignedFetch = void 0;
 var signedFetch_1 = require("./signedFetch");
 Object.defineProperty(exports, "createSignedFetch", { enumerable: true, get: function () { return signedFetch_1.createSignedFetch; } });
 /**
@@ -49,6 +49,7 @@ Object.defineProperty(exports, "ActorResolver", { enumerable: true, get: functio
  */
 var delivery_1 = require("./delivery");
 Object.defineProperty(exports, "createDeliveryService", { enumerable: true, get: function () { return delivery_1.createDeliveryService; } });
+Object.defineProperty(exports, "DeliveryAuthorizationDeniedError", { enumerable: true, get: function () { return delivery_1.DeliveryAuthorizationDeniedError; } });
 /**
  * Inbound ActivityPub dispatch — the untrusted-activity validator + switch, the
  * follow-protocol handlers (Follow / Accept / Undo(Follow) / Reject) over the

package/dist/cjs/node/webfingerRouter.js

@@ -15,9 +15,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createWebfingerRouter = createWebfingerRouter;
 const express_1 = require("express");
+const httpCacheControl_1 = require("./httpCacheControl");
 const apUri_1 = require("../apUri");
 const urls_1 = require("../urls");
-/** 1 hour, in seconds — the WebFinger JRD cache TTL + response `max-age`. */
+/** Default HTTP response max-age. The injected JRD cache has its own policy. */
 const WEBFINGER_CACHE_TTL = 3600;
 /** 24h — host-meta is effectively static. */
 const HOST_META_CACHE_CONTROL = `max-age=${60 * 60 * 24}`;
@@ -25,6 +26,7 @@ const HOST_META_CACHE_CONTROL = `max-age=${60 * 60 * 24}`;
 function createWebfingerRouter(config) {
     const router = (0, express_1.Router)();
     const { domain } = config;
+    const httpCacheControl = (0, httpCacheControl_1.discoveryCacheControl)(config.httpCacheTtlSeconds, WEBFINGER_CACHE_TTL);
     const webfingerTemplate = `https://${domain}/.well-known/webfinger?resource={uri}`;
     router.get('/webfinger', async (req, res) => {
         if (!config.federationEnabled) {
@@ -77,14 +79,14 @@ function createWebfingerRouter(config) {
                     ],
                 };
                 res.set('Content-Type', 'application/jrd+json; charset=utf-8');
-                res.set('Cache-Control', `max-age=${WEBFINGER_CACHE_TTL}`);
+                res.set('Cache-Control', httpCacheControl);
                 return res.json(instanceJrd);
             }
             // Check the JRD cache first.
             const cached = await config.cache.get(username);
             if (cached) {
                 res.set('Content-Type', 'application/jrd+json; charset=utf-8');
-                res.set('Cache-Control', `max-age=${WEBFINGER_CACHE_TTL}`);
+                res.set('Cache-Control', httpCacheControl);
                 return res.json(cached);
             }
             const user = await config.resolveUser(username);
@@ -125,7 +127,7 @@ function createWebfingerRouter(config) {
             };
             config.cache.set(username, response);
             res.set('Content-Type', 'application/jrd+json; charset=utf-8');
-            res.set('Cache-Control', `max-age=${WEBFINGER_CACHE_TTL}`);
+            res.set('Cache-Control', httpCacheControl);
             return res.json(response);
         }
         catch (err) {