@rmdes/indiekit-endpoint-activitypub 1.0.29 → 1.1.2

package/lib/timeline-store.js

@@ -0,0 +1,207 @@
+/**
+ * Timeline item extraction helpers
+ * @module timeline-store
+ */
+
+import sanitizeHtml from "sanitize-html";
+
+/**
+ * Sanitize HTML content for safe display
+ * @param {string} html - Raw HTML content
+ * @returns {string} Sanitized HTML
+ */
+export function sanitizeContent(html) {
+  if (!html) return "";
+
+  return sanitizeHtml(html, {
+    allowedTags: [
+      "p", "br", "a", "strong", "em", "ul", "ol", "li",
+      "blockquote", "code", "pre", "h1", "h2", "h3", "h4", "h5", "h6",
+      "span", "div", "img"
+    ],
+    allowedAttributes: {
+      a: ["href", "rel", "class"],
+      img: ["src", "alt", "class"],
+      span: ["class"],
+      div: ["class"]
+    },
+    allowedSchemes: ["http", "https", "mailto"],
+    allowedSchemesByTag: {
+      img: ["http", "https", "data"]
+    }
+  });
+}
+
+/**
+ * Extract actor information from Fedify Person/Application/Service object
+ * @param {object} actor - Fedify actor object
+ * @returns {object} { name, url, photo, handle }
+ */
+export async function extractActorInfo(actor) {
+  if (!actor) {
+    return {
+      name: "Unknown",
+      url: "",
+      photo: "",
+      handle: ""
+    };
+  }
+
+  const rawName = actor.name?.toString() || actor.preferredUsername?.toString() || "Unknown";
+  // Strip all HTML from actor names to prevent stored XSS
+  const name = sanitizeHtml(rawName, { allowedTags: [], allowedAttributes: {} });
+  const url = actor.id?.href || "";
+
+  // Extract photo URL from icon (Fedify uses async getters)
+  let photo = "";
+  try {
+    if (typeof actor.getIcon === "function") {
+      const iconObj = await actor.getIcon();
+      photo = iconObj?.url?.href || "";
+    } else {
+      const iconObj = await actor.icon;
+      photo = iconObj?.url?.href || "";
+    }
+  } catch {
+    // No icon available
+  }
+
+  // Extract handle from actor URL
+  let handle = "";
+  try {
+    const actorUrl = new URL(url);
+    const username = actor.preferredUsername?.toString() || "";
+    if (username) {
+      handle = `@${username}@${actorUrl.hostname}`;
+    }
+  } catch {
+    // Invalid URL, keep handle empty
+  }
+
+  return { name, url, photo, handle };
+}
+
+/**
+ * Extract timeline item data from Fedify Note/Article object
+ * @param {object} object - Fedify Note or Article object
+ * @param {object} options - Extraction options
+ * @param {object} [options.boostedBy] - Actor info for boosts
+ * @param {Date} [options.boostedAt] - Boost timestamp
+ * @returns {Promise<object>} Timeline item data
+ */
+export async function extractObjectData(object, options = {}) {
+  if (!object) {
+    throw new Error("Object is required");
+  }
+
+  const uid = object.id?.href || "";
+  const url = object.url?.href || uid;
+
+  // Determine type
+  let type = "note";
+  if (object.type?.toLowerCase() === "article") {
+    type = "article";
+  }
+  if (options.boostedBy) {
+    type = "boost";
+  }
+
+  // Extract content
+  const contentHtml = object.content?.toString() || "";
+  const contentText = object.source?.content?.toString() || contentHtml.replace(/<[^>]*>/g, "");
+
+  const content = {
+    text: contentText,
+    html: sanitizeContent(contentHtml)
+  };
+
+  // Extract name (articles only)
+  const name = type === "article" ? (object.name?.toString() || "") : "";
+
+  // Content warning / summary
+  const summary = object.summary?.toString() || "";
+  const sensitive = object.sensitive || false;
+
+  // Published date — store as ISO string per Indiekit convention
+  const published = object.published
+    ? String(object.published)
+    : new Date().toISOString();
+
+  // Extract author — use async getAttributedTo() for Fedify objects
+  let authorObj = null;
+  try {
+    if (typeof object.getAttributedTo === "function") {
+      const attr = await object.getAttributedTo();
+      authorObj = Array.isArray(attr) ? attr[0] : attr;
+    }
+  } catch {
+    // Fallback: try direct property access for plain objects
+    authorObj = object.attribution || object.attributedTo || null;
+  }
+  const author = await extractActorInfo(authorObj);
+
+  // Extract tags/categories
+  const category = [];
+  if (object.tag) {
+    const tags = Array.isArray(object.tag) ? object.tag : [object.tag];
+    for (const tag of tags) {
+      if (tag.type === "Hashtag" && tag.name) {
+        category.push(tag.name.toString().replace(/^#/, ""));
+      }
+    }
+  }
+
+  // Extract media attachments
+  const photo = [];
+  const video = [];
+  const audio = [];
+
+  if (object.attachment) {
+    const attachments = Array.isArray(object.attachment) ? object.attachment : [object.attachment];
+    for (const att of attachments) {
+      const mediaUrl = att.url?.href || "";
+      if (!mediaUrl) continue;
+
+      const mediaType = att.mediaType?.toLowerCase() || "";
+
+      if (mediaType.startsWith("image/")) {
+        photo.push(mediaUrl);
+      } else if (mediaType.startsWith("video/")) {
+        video.push(mediaUrl);
+      } else if (mediaType.startsWith("audio/")) {
+        audio.push(mediaUrl);
+      }
+    }
+  }
+
+  // In-reply-to
+  const inReplyTo = object.inReplyTo?.href || "";
+
+  // Build base timeline item
+  const item = {
+    uid,
+    type,
+    url,
+    name,
+    content,
+    summary,
+    sensitive,
+    published,
+    author,
+    category,
+    photo,
+    video,
+    audio,
+    inReplyTo,
+    createdAt: new Date().toISOString()
+  };
+
+  // Add boost metadata if this is a boost
+  if (options.boostedBy) {
+    item.boostedBy = options.boostedBy;
+    item.boostedAt = options.boostedAt || new Date().toISOString();
+    item.originalUrl = url;
+  }
+
+  return item;
+}

package/locales/en.json

@@ -49,7 +49,16 @@
       "authorizedFetchLabel": "Require authorized fetch (secure mode)",
       "authorizedFetchHint": "When enabled, only servers with valid HTTP Signatures can fetch your actor and collections. This improves privacy but may reduce compatibility with some clients.",
       "save": "Save profile",
-      "saved": "Profile saved. Changes are now visible to the fediverse."
+      "saved": "Profile saved. Changes are now visible to the fediverse.",
+      "remote": {
+        "follow": "Follow",
+        "unfollow": "Unfollow",
+        "viewOn": "View on",
+        "postsTitle": "Posts",
+        "noPosts": "No posts from this account yet.",
+        "followToSee": "Follow this account to see their posts in your timeline.",
+        "notFound": "Could not find this account. It may have been deleted or the server may be unavailable."
+      }
     },
     "migrate": {
       "title": "Mastodon migration",
@@ -94,6 +103,80 @@
         "paused": "Paused",
         "completed": "Completed"
       }
+    },
+    "moderation": {
+      "title": "Moderation",
+      "blockedTitle": "Blocked accounts",
+      "mutedActorsTitle": "Muted accounts",
+      "mutedKeywordsTitle": "Muted keywords",
+      "noBlocked": "No blocked accounts.",
+      "noMutedActors": "No muted accounts.",
+      "noMutedKeywords": "No muted keywords.",
+      "unblock": "Unblock",
+      "unmute": "Unmute",
+      "addKeywordTitle": "Add muted keyword",
+      "keywordPlaceholder": "Enter keyword or phrase…",
+      "addKeyword": "Add",
+      "muteActor": "Mute",
+      "blockActor": "Block"
+    },
+    "compose": {
+      "title": "Compose reply",
+      "modeLabel": "Reply mode",
+      "modeMicropub": "Post as blog reply",
+      "modeMicropubHint": "Creates a permanent post on your blog, syndicated to the fediverse",
+      "modeQuick": "Quick reply",
+      "modeQuickHint": "Sends a reply directly to the fediverse (no blog post created)",
+      "placeholder": "Write your reply…",
+      "syndicateLabel": "Syndicate to",
+      "submitMicropub": "Post reply",
+      "submitQuick": "Send reply",
+      "cancel": "Cancel",
+      "errorEmpty": "Reply content cannot be empty"
+    },
+    "notifications": {
+      "title": "Notifications",
+      "empty": "No notifications yet. Interactions from other fediverse users will appear here.",
+      "liked": "liked your post",
+      "boostedPost": "boosted your post",
+      "followedYou": "followed you",
+      "repliedTo": "replied to your post",
+      "mentionedYou": "mentioned you"
+    },
+    "reader": {
+      "title": "Reader",
+      "tabs": {
+        "all": "All",
+        "notes": "Notes",
+        "articles": "Articles",
+        "replies": "Replies",
+        "boosts": "Boosts",
+        "media": "Media"
+      },
+      "pagination": {
+        "newer": "← Newer",
+        "older": "Older →"
+      },
+      "empty": "Your timeline is empty. Follow some accounts to see their posts here.",
+      "boosted": "boosted",
+      "replyingTo": "Replying to",
+      "showContent": "Show content",
+      "hideContent": "Hide content",
+      "sensitiveContent": "Sensitive content",
+      "videoNotSupported": "Your browser does not support the video element.",
+      "audioNotSupported": "Your browser does not support the audio element.",
+      "actions": {
+        "reply": "Reply",
+        "boost": "Boost",
+        "unboost": "Undo boost",
+        "like": "Like",
+        "unlike": "Unlike",
+        "viewOriginal": "View original",
+        "liked": "Liked",
+        "boosted": "Boosted",
+        "likeError": "Could not like this post",
+        "boostError": "Could not boost this post"
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "1.0.29",
+  "version": "1.1.2",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",
@@ -42,7 +42,8 @@
     "@fedify/redis": "^1.10.3",
     "@js-temporal/polyfill": "^0.5.0",
     "express": "^5.0.0",
-    "ioredis": "^5.9.3"
+    "ioredis": "^5.9.3",
+    "sanitize-html": "^2.13.1"
   },
   "peerDependencies": {
     "@indiekit/error": "^1.0.0-beta.25",

package/views/activitypub-compose.njk

@@ -0,0 +1,94 @@
+{% extends "layouts/reader.njk" %}
+
+{% from "heading/macro.njk" import heading with context %}
+
+{% block content %}
+  {{ heading({
+    text: title,
+    level: 1,
+    parent: { text: __("activitypub.reader.title"), href: mountPath + "/admin/reader" }
+  }) }}
+
+  {# Reply context — show the post being replied to #}
+  {% if replyContext %}
+    <div class="ap-compose__context">
+      <div class="ap-compose__context-label">{{ __("activitypub.reader.replyingTo") }}</div>
+      {% if replyContext.author %}
+        <div class="ap-compose__context-author">
+          <a href="{{ replyContext.author.url }}">{{ replyContext.author.name }}</a>
+        </div>
+      {% endif %}
+      {% if replyContext.content and replyContext.content.text %}
+        <blockquote class="ap-compose__context-text">
+          {{ replyContext.content.text | truncate(300) }}
+        </blockquote>
+      {% endif %}
+      <a href="{{ replyTo }}" class="ap-compose__context-link" target="_blank" rel="noopener">{{ replyTo }}</a>
+    </div>
+  {% endif %}
+
+  <form method="post" action="{{ mountPath }}/admin/reader/compose" class="ap-compose__form"
+    x-data="{
+      mode: 'micropub',
+      content: '',
+      maxChars: 500,
+      get remaining() { return this.maxChars - this.content.length; }
+    }">
+    <input type="hidden" name="_csrf" value="{{ csrfToken }}">
+    {% if replyTo %}
+      <input type="hidden" name="in-reply-to" value="{{ replyTo }}">
+    {% endif %}
+
+    {# Mode toggle #}
+    <fieldset class="ap-compose__mode">
+      <legend>{{ __("activitypub.compose.modeLabel") }}</legend>
+      <label class="ap-compose__mode-option">
+        <input type="radio" name="mode" value="micropub" x-model="mode" checked>
+        {{ __("activitypub.compose.modeMicropub") }}
+        <span class="ap-compose__mode-hint">{{ __("activitypub.compose.modeMicropubHint") }}</span>
+      </label>
+      <label class="ap-compose__mode-option">
+        <input type="radio" name="mode" value="quick" x-model="mode">
+        {{ __("activitypub.compose.modeQuick") }}
+        <span class="ap-compose__mode-hint">{{ __("activitypub.compose.modeQuickHint") }}</span>
+      </label>
+    </fieldset>
+
+    {# Content textarea #}
+    <div class="ap-compose__editor">
+      <textarea name="content" class="ap-compose__textarea"
+        rows="6"
+        :maxlength="mode === 'quick' ? maxChars : undefined"
+        x-model="content"
+        placeholder="{{ __('activitypub.compose.placeholder') }}"
+        required></textarea>
+      <div class="ap-compose__counter" x-show="mode === 'quick'" x-cloak>
+        <span :class="{ 'ap-compose__counter--warn': remaining < 50, 'ap-compose__counter--over': remaining < 0 }"
+          x-text="remaining"></span>
+      </div>
+    </div>
+
+    {# Syndication targets (Micropub mode only) #}
+    {% if syndicationTargets.length > 0 %}
+      <fieldset class="ap-compose__syndication" x-show="mode === 'micropub'">
+        <legend>{{ __("activitypub.compose.syndicateLabel") }}</legend>
+        {% for target in syndicationTargets %}
+          <label class="ap-compose__syndication-target">
+            <input type="checkbox" name="mp-syndicate-to" value="{{ target.uid }}" checked>
+            {{ target.name }}
+          </label>
+        {% endfor %}
+      </fieldset>
+    {% endif %}
+
+    <div class="ap-compose__actions">
+      <button type="submit" class="ap-compose__submit">
+        <span x-show="mode === 'micropub'">{{ __("activitypub.compose.submitMicropub") }}</span>
+        <span x-show="mode === 'quick'">{{ __("activitypub.compose.submitQuick") }}</span>
+      </button>
+      <a href="{{ mountPath }}/admin/reader" class="ap-compose__cancel">
+        {{ __("activitypub.compose.cancel") }}
+      </a>
+    </div>
+  </form>
+{% endblock %}

package/views/activitypub-moderation.njk

@@ -0,0 +1,118 @@
+{% extends "layouts/reader.njk" %}
+
+{% from "heading/macro.njk" import heading with context %}
+{% from "prose/macro.njk" import prose with context %}
+
+{% block content %}
+  {{ heading({
+    text: title,
+    level: 1,
+    parent: { text: __("activitypub.reader.title"), href: mountPath + "/admin/reader" }
+  }) }}
+
+  {# Blocked actors #}
+  <section class="ap-moderation__section">
+    <h2>{{ __("activitypub.moderation.blockedTitle") }}</h2>
+    {% if blocked.length > 0 %}
+      <ul class="ap-moderation__list">
+        {% for entry in blocked %}
+          <li class="ap-moderation__entry"
+            x-data="{ removing: false }">
+            <a href="{{ entry.url }}">{{ entry.url }}</a>
+            <button class="ap-moderation__remove"
+              :disabled="removing"
+              @click="
+                removing = true;
+                fetch('{{ mountPath }}/admin/reader/unblock', {
+                  method: 'POST',
+                  headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': '{{ csrfToken }}' },
+                  body: JSON.stringify({ url: '{{ entry.url }}' })
+                }).then(r => r.json()).then(d => { if (d.success) $el.closest('li').remove(); else removing = false; }).catch(() => removing = false);
+              ">{{ __("activitypub.moderation.unblock") }}</button>
+          </li>
+        {% endfor %}
+      </ul>
+    {% else %}
+      {{ prose({ text: __("activitypub.moderation.noBlocked") }) }}
+    {% endif %}
+  </section>
+
+  {# Muted actors #}
+  <section class="ap-moderation__section">
+    <h2>{{ __("activitypub.moderation.mutedActorsTitle") }}</h2>
+    {% set mutedActors = muted | selectattr("url") %}
+    {% if mutedActors | length > 0 %}
+      <ul class="ap-moderation__list">
+        {% for entry in mutedActors %}
+          <li class="ap-moderation__entry"
+            x-data="{ removing: false }">
+            <a href="{{ entry.url }}">{{ entry.url }}</a>
+            <button class="ap-moderation__remove"
+              :disabled="removing"
+              @click="
+                removing = true;
+                fetch('{{ mountPath }}/admin/reader/unmute', {
+                  method: 'POST',
+                  headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': '{{ csrfToken }}' },
+                  body: JSON.stringify({ url: '{{ entry.url }}' })
+                }).then(r => r.json()).then(d => { if (d.success) $el.closest('li').remove(); else removing = false; }).catch(() => removing = false);
+              ">{{ __("activitypub.moderation.unmute") }}</button>
+          </li>
+        {% endfor %}
+      </ul>
+    {% else %}
+      {{ prose({ text: __("activitypub.moderation.noMutedActors") }) }}
+    {% endif %}
+  </section>
+
+  {# Muted keywords #}
+  <section class="ap-moderation__section">
+    <h2>{{ __("activitypub.moderation.mutedKeywordsTitle") }}</h2>
+    {% set mutedKeywords = muted | selectattr("keyword") %}
+    {% if mutedKeywords | length > 0 %}
+      <ul class="ap-moderation__list">
+        {% for entry in mutedKeywords %}
+          <li class="ap-moderation__entry"
+            x-data="{ removing: false }">
+            <code>{{ entry.keyword }}</code>
+            <button class="ap-moderation__remove"
+              :disabled="removing"
+              @click="
+                removing = true;
+                fetch('{{ mountPath }}/admin/reader/unmute', {
+                  method: 'POST',
+                  headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': '{{ csrfToken }}' },
+                  body: JSON.stringify({ keyword: '{{ entry.keyword }}' })
+                }).then(r => r.json()).then(d => { if (d.success) $el.closest('li').remove(); else removing = false; }).catch(() => removing = false);
+              ">{{ __("activitypub.moderation.unmute") }}</button>
+          </li>
+        {% endfor %}
+      </ul>
+    {% else %}
+      {{ prose({ text: __("activitypub.moderation.noMutedKeywords") }) }}
+    {% endif %}
+  </section>
+
+  {# Add keyword mute form #}
+  <section class="ap-moderation__section">
+    <h2>{{ __("activitypub.moderation.addKeywordTitle") }}</h2>
+    <form class="ap-moderation__add-form"
+      x-data="{ keyword: '', submitting: false }"
+      @submit.prevent="
+        if (!keyword.trim()) return;
+        submitting = true;
+        fetch('{{ mountPath }}/admin/reader/mute', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': '{{ csrfToken }}' },
+          body: JSON.stringify({ keyword: keyword.trim() })
+        }).then(r => r.json()).then(d => { if (d.success) location.reload(); submitting = false; }).catch(() => submitting = false);
+      ">
+      <input type="text" x-model="keyword"
+        placeholder="{{ __('activitypub.moderation.keywordPlaceholder') }}"
+        class="ap-moderation__input">
+      <button type="submit" :disabled="submitting" class="ap-moderation__add-btn">
+        {{ __("activitypub.moderation.addKeyword") }}
+      </button>
+    </form>
+  </section>
+{% endblock %}

package/views/activitypub-notifications.njk

@@ -0,0 +1,31 @@
+{% extends "layouts/reader.njk" %}
+
+{% from "heading/macro.njk" import heading with context %}
+{% from "prose/macro.njk" import prose with context %}
+
+{% block content %}
+  {{ heading({
+    text: __("activitypub.notifications.title"),
+    level: 1,
+    parent: { text: __("activitypub.reader.title"), href: mountPath + "/admin/reader" }
+  }) }}
+
+  {% if items.length > 0 %}
+    <div class="ap-timeline">
+      {% for item in items %}
+        {% include "partials/ap-notification-card.njk" %}
+      {% endfor %}
+    </div>
+
+    {# Pagination #}
+    {% if before %}
+      <nav class="ap-pagination">
+        <a href="?before={{ before }}" class="ap-pagination__next">
+          {{ __("activitypub.reader.pagination.older") }}
+        </a>
+      </nav>
+    {% endif %}
+  {% else %}
+    {{ prose({ text: __("activitypub.notifications.empty") }) }}
+  {% endif %}
+{% endblock %}

package/views/activitypub-reader.njk

@@ -0,0 +1,61 @@
+{% extends "layouts/reader.njk" %}
+
+{% from "heading/macro.njk" import heading with context %}
+{% from "prose/macro.njk" import prose with context %}
+
+{% block content %}
+  {{ heading({
+    text: __("activitypub.reader.title"),
+    level: 1,
+    parent: { text: __("activitypub.title"), href: mountPath }
+  }) }}
+
+  {# Tab navigation #}
+  <nav class="ap-tabs" role="tablist">
+    <a href="?tab=all" class="ap-tab{% if tab == 'all' %} ap-tab--active{% endif %}" role="tab">
+      {{ __("activitypub.reader.tabs.all") }}
+    </a>
+    <a href="?tab=notes" class="ap-tab{% if tab == 'notes' %} ap-tab--active{% endif %}" role="tab">
+      {{ __("activitypub.reader.tabs.notes") }}
+    </a>
+    <a href="?tab=articles" class="ap-tab{% if tab == 'articles' %} ap-tab--active{% endif %}" role="tab">
+      {{ __("activitypub.reader.tabs.articles") }}
+    </a>
+    <a href="?tab=replies" class="ap-tab{% if tab == 'replies' %} ap-tab--active{% endif %}" role="tab">
+      {{ __("activitypub.reader.tabs.replies") }}
+    </a>
+    <a href="?tab=boosts" class="ap-tab{% if tab == 'boosts' %} ap-tab--active{% endif %}" role="tab">
+      {{ __("activitypub.reader.tabs.boosts") }}
+    </a>
+    <a href="?tab=media" class="ap-tab{% if tab == 'media' %} ap-tab--active{% endif %}" role="tab">
+      {{ __("activitypub.reader.tabs.media") }}
+    </a>
+  </nav>
+
+  {# Timeline items #}
+  {% if items.length > 0 %}
+    <div class="ap-timeline">
+      {% for item in items %}
+        {% include "partials/ap-item-card.njk" %}
+      {% endfor %}
+    </div>
+
+    {# Pagination #}
+    {% if before or after %}
+      <nav class="ap-pagination">
+        {% if after %}
+          <a href="?tab={{ tab }}&after={{ after }}" class="ap-pagination__prev">
+            {{ __("activitypub.reader.pagination.newer") }}
+          </a>
+        {% endif %}
+        {% if before %}
+          <a href="?tab={{ tab }}&before={{ before }}" class="ap-pagination__next">
+            {{ __("activitypub.reader.pagination.older") }}
+          </a>
+        {% endif %}
+      </nav>
+    {% endif %}
+  {% else %}
+    {{ prose({ text: __("activitypub.reader.empty") }) }}
+  {% endif %}
+{% endblock %}