@oxy.so/federation 2.3.0 → 2.4.0

package/dist/esm/node/actorRouter.js

@@ -20,6 +20,7 @@
  */
 import { Router } from 'express';
 import { AP_CONTEXT } from '../apContext.js';
+import { discoveryCacheControl } from './httpCacheControl.js';
 import { verifyHttpSignature } from '../httpSignature.js';
 import { INSTANCE_ACTOR_USERNAME, normalizeActorUsername } from '../urls.js';
 /** Page size for the paginated followers/following collections (mirrors the outbox). */
@@ -54,6 +55,7 @@ function parseFollowOffset(raw) {
 export function createActorRouter(config) {
     const router = Router();
     const { urls, domain, apContentType, logger } = config;
+    const httpCacheControl = discoveryCacheControl(config.httpCacheTtlSeconds, 1800);
     function wantsActivityPub(req) {
         return config.wantsActivityPub(req.headers.accept);
     }
@@ -239,7 +241,7 @@ export function createActorRouter(config) {
                     },
                 };
                 res.set('Content-Type', apContentType);
-                res.set('Cache-Control', 'max-age=1800');
+                res.set('Cache-Control', httpCacheControl);
                 return res.json(actorObject);
             }
             const user = await config.resolveUser(username);
@@ -274,7 +276,7 @@ export function createActorRouter(config) {
                 alsoKnownAs: user.alsoKnownAs,
             });
             res.set('Content-Type', apContentType);
-            res.set('Cache-Control', 'max-age=1800');
+            res.set('Cache-Control', httpCacheControl);
             return res.json({ '@context': AP_CONTEXT, ...actorObject });
         }
         catch (err) {

package/dist/esm/node/delivery.js

@@ -31,6 +31,14 @@ const DELIVER_ACTIVITY_TIMEOUT_MS = 15000;
 const DELIVERY_RESPONSE_PREVIEW_MAX_BYTES = 1024;
 /** The ActivityStreams public collection — the `to` addressee of a public activity. */
 const AP_PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
+/** A definitive refusal: workers must discard, not retry or count a delivery. */
+export class DeliveryAuthorizationDeniedError extends Error {
+    constructor() {
+        super('Outbound federation delivery is not authorized');
+        this.code = 'DELIVERY_AUTHORIZATION_DENIED';
+        this.name = 'DeliveryAuthorizationDeniedError';
+    }
+}
 /** Read a bounded prefix of a failed-delivery response body for the debug log. */
 async function readResponsePreview(response) {
     const chunks = [];
@@ -69,7 +77,17 @@ export function createDeliveryService(config) {
         const host = urlHost(url);
         return host === null || config.isBlockedDomain(host);
     }
+    async function authorizeDelivery(activity, senderAccountId) {
+        if (config.authorizeDelivery &&
+            !(await config.authorizeDelivery({ activity, senderAccountId }))) {
+            throw new DeliveryAuthorizationDeniedError();
+        }
+    }
     async function deliverActivity(activity, targetInbox, senderOxyUserId, senderUsername) {
+        await authorizeDelivery(activity, senderOxyUserId);
+        return deliverAuthorizedActivity(activity, targetInbox, senderUsername);
+    }
+    async function deliverAuthorizedActivity(activity, targetInbox, senderUsername) {
         if (isBlockedUrl(targetInbox)) {
             logger.warn(`[FedDeliver] refusing outbound delivery to blocked inbox ${targetInbox}`);
             return false;
@@ -107,6 +125,7 @@ export function createDeliveryService(config) {
         }
     }
     async function queueDelivery(activity, targetInbox, senderOxyUserId) {
+        await authorizeDelivery(activity, senderOxyUserId);
         if (isBlockedUrl(targetInbox)) {
             logger.warn(`[FedDeliver] not queueing delivery to blocked inbox ${targetInbox}`);
             return;
@@ -144,6 +163,7 @@ export function createDeliveryService(config) {
         return actor.sharedInboxUrl ?? actor.inboxUrl ?? undefined;
     }
     async function deliverToFollowers(activity, senderOxyUserId, senderUsername, options = {}) {
+        await authorizeDelivery(activity, senderOxyUserId);
         const actorUris = await config.follows.listAcceptedInboundFollowerActorUris(senderOxyUserId);
         const actors = actorUris.length > 0 ? await config.store.findActorInboxesByUris(actorUris) : [];
         // Group by shared inbox to avoid duplicate deliveries. Follower inboxes
@@ -238,17 +258,12 @@ export function createDeliveryService(config) {
         // cached; if the actor is unknown locally we still record the follow and
         // queue the Follow activity, then refresh the actor in the background.
         const cached = await config.store.findActorByUri(remoteActorUri);
-        // Always refresh the actor in the background so its inbox/profile stay
-        // current (and so a missing actor gets resolved for delivery shortly).
-        config.actorRefresh.refreshActorInBackground(remoteActorUri, cached ?? undefined);
         const canonicalUri = cached?.uri ?? remoteActorUri;
         const localActorUri = urls.actor(localUsername);
         // Use the actor _id when known, otherwise a stable hash of the URI so the
         // activity ID is deterministic across retries before the actor is cached.
         const activityIdSuffix = cached?._id ? String(cached._id) : encodeURIComponent(canonicalUri);
         const activityId = `${localActorUri}/follows/${activityIdSuffix}`;
-        // Create or update the follow record
-        await config.follows.upsertOutboundPending(localOxyUserId, canonicalUri, activityId);
         const activity = {
             '@context': 'https://www.w3.org/ns/activitystreams',
             id: activityId,
@@ -256,11 +271,16 @@ export function createDeliveryService(config) {
             actor: localActorUri,
             object: canonicalUri,
         };
+        // Refuse before committing an outbound follow or reporting success.
+        await authorizeDelivery(activity, localOxyUserId);
+        // A refused follow must not start remote actor discovery either.
+        config.actorRefresh.refreshActorInBackground(remoteActorUri, cached ?? undefined);
+        await config.follows.upsertOutboundPending(localOxyUserId, canonicalUri, activityId);
         // If we know the inbox, attempt delivery in the background; otherwise queue
         // for the delivery worker, which resolves the inbox once the actor lands.
         const targetInbox = cached?.sharedInboxUrl ?? cached?.inboxUrl;
         if (targetInbox && !isBlockedUrl(targetInbox)) {
-            void deliverActivity(activity, targetInbox, localOxyUserId, localUsername)
+            void deliverAuthorizedActivity(activity, targetInbox, localUsername)
                 .then((delivered) => {
                 if (!delivered)
                     return queueDelivery(activity, targetInbox, localOxyUserId);

package/dist/esm/node/httpCacheControl.js

@@ -0,0 +1,8 @@
+/** Shared discovery config validation; zero forbids downstream response retention. */
+export function discoveryCacheControl(value, defaultSeconds) {
+    const seconds = value ?? defaultSeconds;
+    if (!Number.isInteger(seconds) || seconds < 0 || seconds > 86400) {
+        throw new RangeError('httpCacheTtlSeconds must be an integer from 0 to 86400');
+    }
+    return seconds === 0 ? 'no-store' : `max-age=${seconds}`;
+}

package/dist/esm/node/index.js

@@ -39,7 +39,7 @@ export { createActorResolver, ActorResolver, } from './actorResolver.js';
  * Accept(Follow)) + the `Update(Person)` actor rebroadcast, over injected key
  * custody, an SSRF-safe delivery transport, and bring-your-own-store adapters.
  */
-export { createDeliveryService, } from './delivery.js';
+export { createDeliveryService, DeliveryAuthorizationDeniedError, } from './delivery.js';
 /**
  * Inbound ActivityPub dispatch — the untrusted-activity validator + switch, the
  * follow-protocol handlers (Follow / Accept / Undo(Follow) / Reject) over the

package/dist/esm/node/webfingerRouter.js

@@ -12,9 +12,10 @@
  * Extracted behaviour-identically from Mention's `wellKnown.routes.ts`.
  */
 import { Router } from 'express';
+import { discoveryCacheControl } from './httpCacheControl.js';
 import { isSameFederationHost } from '../apUri.js';
 import { INSTANCE_ACTOR_USERNAME, normalizeActorUsername } from '../urls.js';
-/** 1 hour, in seconds — the WebFinger JRD cache TTL + response `max-age`. */
+/** Default HTTP response max-age. The injected JRD cache has its own policy. */
 const WEBFINGER_CACHE_TTL = 3600;
 /** 24h — host-meta is effectively static. */
 const HOST_META_CACHE_CONTROL = `max-age=${60 * 60 * 24}`;
@@ -22,6 +23,7 @@ const HOST_META_CACHE_CONTROL = `max-age=${60 * 60 * 24}`;
 export function createWebfingerRouter(config) {
     const router = Router();
     const { domain } = config;
+    const httpCacheControl = discoveryCacheControl(config.httpCacheTtlSeconds, WEBFINGER_CACHE_TTL);
     const webfingerTemplate = `https://${domain}/.well-known/webfinger?resource={uri}`;
     router.get('/webfinger', async (req, res) => {
         if (!config.federationEnabled) {
@@ -74,14 +76,14 @@ export function createWebfingerRouter(config) {
                     ],
                 };
                 res.set('Content-Type', 'application/jrd+json; charset=utf-8');
-                res.set('Cache-Control', `max-age=${WEBFINGER_CACHE_TTL}`);
+                res.set('Cache-Control', httpCacheControl);
                 return res.json(instanceJrd);
             }
             // Check the JRD cache first.
             const cached = await config.cache.get(username);
             if (cached) {
                 res.set('Content-Type', 'application/jrd+json; charset=utf-8');
-                res.set('Cache-Control', `max-age=${WEBFINGER_CACHE_TTL}`);
+                res.set('Cache-Control', httpCacheControl);
                 return res.json(cached);
             }
             const user = await config.resolveUser(username);
@@ -122,7 +124,7 @@ export function createWebfingerRouter(config) {
             };
             config.cache.set(username, response);
             res.set('Content-Type', 'application/jrd+json; charset=utf-8');
-            res.set('Cache-Control', `max-age=${WEBFINGER_CACHE_TTL}`);
+            res.set('Cache-Control', httpCacheControl);
             return res.json(response);
         }
         catch (err) {