@oxy.so/federation 2.7.0 → 2.9.0

package/src/node/goneActor.ts

@@ -0,0 +1,45 @@
+/**
+ * A DELETED local actor, as the fediverse is told about it.
+ *
+ * Two halves, following Mastodon's account deletion:
+ *
+ *  1. Once, the app sends `Delete{actor}`: the actor deletes itself, signed with
+ *     its own key, to every follower's (shared) inbox. That is
+ *     `DeliveryService.federateActorDelete`, built by {@link buildActorDeleteActivity}.
+ *  2. From then on the actor's URLs answer `410 Gone` instead of `404`. That is
+ *     what a server that missed the Delete, or never acts on one, reads as
+ *     permanent: Mastodon deletes its copy of an account whose WebFinger answers
+ *     410, and Lemmy, PieFed and Mbin mark a community or person deleted when a
+ *     refetch answers 410 or a `Tombstone`. A 404 tells all of them nothing, so
+ *     they keep the ghost profile and keep delivering to it.
+ *
+ * The routers ask the app's `isActorGone(username)` only after `resolveUser`
+ * found nobody, so a live account is never answered as gone.
+ */
+
+import { AP_CONTEXT } from '../apContext';
+
+/** Does `username` name a local actor that was deleted? Asked only for a username that resolved to nobody. */
+export type IsActorGone = (username: string) => Promise<boolean>;
+
+/** The body of a `410 Gone` for a deleted object: a bare `Tombstone` naming it. */
+export function goneTombstone(id: string): Record<string, unknown> {
+  return { '@context': AP_CONTEXT, id, type: 'Tombstone' };
+}
+
+/**
+ * The actor's `Delete` of itself. The id is DETERMINISTIC (no timestamp), the
+ * shape Mastodon sends (`<actor>#delete`), so a retried run re-sends the same
+ * activity and a delivery queue that dedupes on activity id + inbox sends each
+ * inbox one copy.
+ */
+export function buildActorDeleteActivity(actorUri: string): Record<string, unknown> {
+  return {
+    '@context': AP_CONTEXT,
+    id: `${actorUri}#delete`,
+    type: 'Delete',
+    actor: actorUri,
+    to: ['https://www.w3.org/ns/activitystreams#Public'],
+    object: actorUri,
+  };
+}

package/src/node/index.ts

@@ -141,6 +141,12 @@ export {
  * The ActivityPub actor + inbox + follow-graph router (actor GET incl. the
  * `instance` actor, inbox POST with HTTP-sig verify, followers/following pages).
  */
+/**
+ * A deleted local actor: its `Delete` of itself, and the `Tombstone` its URLs
+ * answer `410 Gone` with afterwards.
+ */
+export { buildActorDeleteActivity, goneTombstone, type IsActorGone } from './goneActor';
+
 export {
   createActorRouter,
   type ActorRouterConfig,

package/src/node/webfingerRouter.ts

@@ -17,6 +17,7 @@ import { discoveryCacheControl } from './httpCacheControl';
 import { isSameFederationHost } from '../apUri';
 import type { UrlBuilders } from '../urls';
 import { INSTANCE_ACTOR_USERNAME, normalizeActorUsername } from '../urls';
+import type { IsActorGone } from './goneActor';
 
 /** Default HTTP response max-age. The injected JRD cache has its own policy. */
 const WEBFINGER_CACHE_TTL = 3600;
@@ -65,6 +66,12 @@ export interface WebfingerRouterConfig {
     get(username: string): Promise<WebfingerJrd | null>;
     set(username: string, jrd: WebfingerJrd): void;
   };
+  /**
+   * Whether a username that resolved to nobody names a DELETED local actor
+   * (`goneActor.ts`). True ⇒ `410 Gone` instead of 404, which is what makes
+   * Mastodon delete its copy of the account. Omitted ⇒ every miss is a 404.
+   */
+  isActorGone?: IsActorGone;
   /** HTTP response TTL in whole seconds, 0..86400. Defaults to 3600; 0 sends no-store. */
   httpCacheTtlSeconds?: number;
   /** Diagnostics sink. */
@@ -147,7 +154,13 @@ export function createWebfingerRouter(config: WebfingerRouterConfig): Router {
       }
 
       const user = await config.resolveUser(username);
-      if (!user) return res.status(404).json({ error: 'User not found' });
+      if (!user) {
+        if (config.isActorGone && (await config.isActorGone(username))) {
+          res.set('Cache-Control', httpCacheControl);
+          return res.status(410).json({ error: 'User deleted' });
+        }
+        return res.status(404).json({ error: 'User not found' });
+      }
 
       // Sharing OFF must be indistinguishable from a nonexistent user — same 404
       // body, no separate error code. UNLIKE the other user-scoped surfaces,