@rmdes/indiekit-endpoint-activitypub 1.1.8 → 1.1.10

package/assets/reader.css

@@ -296,24 +296,40 @@
   max-width: 100%;
 }
 
-/* @mentions — styled as subtle pills to distinguish from prose */
-.ap-card__content .h-card,
+/* @mentions — keep inline, style as subtle links */
+.ap-card__content .h-card {
+  display: inline;
+}
+
+.ap-card__content .h-card a,
 .ap-card__content a.u-url.mention {
+  display: inline;
   color: var(--color-on-offset);
-  font-size: var(--font-size-s);
   text-decoration: none;
+  white-space: nowrap;
+}
+
+.ap-card__content .h-card a span,
+.ap-card__content a.u-url.mention span {
+  display: inline;
 }
 
+.ap-card__content .h-card a:hover,
 .ap-card__content a.u-url.mention:hover {
   color: var(--color-primary);
   text-decoration: underline;
 }
 
-/* Hashtag mentions — subtle tag styling */
+/* Hashtag mentions — keep inline, subtle styling */
 .ap-card__content a.mention.hashtag {
+  display: inline;
   color: var(--color-on-offset);
-  font-size: var(--font-size-s);
   text-decoration: none;
+  white-space: nowrap;
+}
+
+.ap-card__content a.mention.hashtag span {
+  display: inline;
 }
 
 .ap-card__content a.mention.hashtag:hover {

package/index.js

@@ -496,7 +496,13 @@ export default class ActivityPubEndpoint {
       );
 
       // Resolve the remote actor to get their inbox
-      const remoteActor = await ctx.lookupObject(actorUrl);
+      // Use authenticated document loader for servers requiring Authorized Fetch
+      const documentLoader = await ctx.getDocumentLoader({
+        identifier: handle,
+      });
+      const remoteActor = await ctx.lookupObject(actorUrl, {
+        documentLoader,
+      });
       if (!remoteActor) {
         return { ok: false, error: "Could not resolve remote actor" };
       }
@@ -591,7 +597,13 @@ export default class ActivityPubEndpoint {
         { handle, publicationUrl: this._publicationUrl },
       );
 
-      const remoteActor = await ctx.lookupObject(actorUrl);
+      // Use authenticated document loader for servers requiring Authorized Fetch
+      const documentLoader = await ctx.getDocumentLoader({
+        identifier: handle,
+      });
+      const remoteActor = await ctx.lookupObject(actorUrl, {
+        documentLoader,
+      });
       if (!remoteActor) {
         // Even if we can't resolve, remove locally
         await this._collections.ap_following.deleteOne({ actorUrl });

package/lib/batch-refollow.js

@@ -227,8 +227,13 @@ async function processOneFollow(options, entry) {
   try {
     const ctx = federation.createContext(new URL(publicationUrl), { handle, publicationUrl });
 
-    // Resolve the remote actor
-    const remoteActor = await ctx.lookupObject(entry.actorUrl);
+    // Resolve the remote actor (signed request for Authorized Fetch)
+    const documentLoader = await ctx.getDocumentLoader({
+      identifier: handle,
+    });
+    const remoteActor = await ctx.lookupObject(entry.actorUrl, {
+      documentLoader,
+    });
     if (!remoteActor) {
       throw new Error("Could not resolve remote actor");
     }

package/lib/controllers/compose.js

@@ -5,6 +5,7 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { getTimelineItem } from "../storage/timeline.js";
 import { getToken, validateToken } from "../csrf.js";
+import { sanitizeContent } from "../timeline-store.js";
 
 /**
  * Fetch syndication targets from the Micropub config endpoint.
@@ -71,14 +72,22 @@ export function composeController(mountPath, plugin) {
               new URL(plugin._publicationUrl),
               { handle, publicationUrl: plugin._publicationUrl },
             );
-            const remoteObject = await ctx.lookupObject(new URL(replyTo));
+            // Use authenticated document loader for Authorized Fetch
+            const documentLoader = await ctx.getDocumentLoader({
+              identifier: handle,
+            });
+            const remoteObject = await ctx.lookupObject(new URL(replyTo), {
+              documentLoader,
+            });
 
             if (remoteObject) {
               let authorName = "";
               let authorUrl = "";
 
               if (typeof remoteObject.getAttributedTo === "function") {
-                const author = await remoteObject.getAttributedTo();
+                const author = await remoteObject.getAttributedTo({
+                  documentLoader,
+                });
                 const actor = Array.isArray(author) ? author[0] : author;
 
                 if (actor) {
@@ -90,12 +99,13 @@ export function composeController(mountPath, plugin) {
                 }
               }
 
+              const rawHtml = remoteObject.content?.toString() || "";
               replyContext = {
                 url: replyTo,
                 name: remoteObject.name?.toString() || "",
                 content: {
-                  text:
-                    remoteObject.content?.toString()?.slice(0, 300) || "",
+                  html: sanitizeContent(rawHtml),
+                  text: rawHtml.replace(/<[^>]*>/g, "").slice(0, 300),
                 },
                 author: { name: authorName, url: authorUrl },
               };
@@ -112,6 +122,13 @@ export function composeController(mountPath, plugin) {
         ? await getSyndicationTargets(application, token)
         : [];
 
+      // Default-check only AP (Fedify) and Bluesky targets
+      // "@rick@rmendes.net" = AP Fedify, "@rmendes.net" = Bluesky
+      for (const target of syndicationTargets) {
+        const name = target.name || "";
+        target.defaultChecked = name === "@rick@rmendes.net" || name === "@rmendes.net";
+      }
+
       const csrfToken = getToken(request.session);
 
       response.render("activitypub-compose", {
@@ -198,13 +215,20 @@ export function submitComposeController(mountPath, plugin) {
         // If replying, also send to the original author
         if (inReplyTo) {
           try {
-            const remoteObject = await ctx.lookupObject(new URL(inReplyTo));
+            const documentLoader = await ctx.getDocumentLoader({
+              identifier: handle,
+            });
+            const remoteObject = await ctx.lookupObject(new URL(inReplyTo), {
+              documentLoader,
+            });
 
             if (
               remoteObject &&
               typeof remoteObject.getAttributedTo === "function"
             ) {
-              const author = await remoteObject.getAttributedTo();
+              const author = await remoteObject.getAttributedTo({
+                documentLoader,
+              });
               const recipient = Array.isArray(author)
                 ? author[0]
                 : author;

package/lib/controllers/interactions-boost.js

@@ -57,15 +57,20 @@ export function boostController(mountPath, plugin) {
         orderingKey: url,
       });
 
-      // Also send to the original post author
+      // Also send to the original post author (signed request for Authorized Fetch)
       try {
-        const remoteObject = await ctx.lookupObject(new URL(url));
+        const documentLoader = await ctx.getDocumentLoader({
+          identifier: handle,
+        });
+        const remoteObject = await ctx.lookupObject(new URL(url), {
+          documentLoader,
+        });
 
         if (
           remoteObject &&
           typeof remoteObject.getAttributedTo === "function"
         ) {
-          const author = await remoteObject.getAttributedTo();
+          const author = await remoteObject.getAttributedTo({ documentLoader });
           const recipient = Array.isArray(author) ? author[0] : author;
 
           if (recipient) {

package/lib/controllers/interactions-like.js

@@ -4,6 +4,7 @@
  */
 
 import { validateToken } from "../csrf.js";
+import { getTimelineItem } from "../storage/timeline.js";
 
 /**
  * POST /admin/reader/like — send a Like activity to the post author.
@@ -43,29 +44,52 @@ export function likeController(mountPath, plugin) {
         { handle, publicationUrl: plugin._publicationUrl },
       );
 
-      // Look up the remote post to find its author
-      const remoteObject = await ctx.lookupObject(new URL(url));
-
-      if (!remoteObject) {
-        return response.status(404).json({
-          success: false,
-          error: "Could not resolve remote post",
-        });
-      }
+      // Use authenticated document loader for servers requiring Authorized Fetch
+      const documentLoader = await ctx.getDocumentLoader({
+        identifier: handle,
+      });
 
-      // Get the post author for delivery
+      // Resolve author for delivery — try multiple strategies
       let recipient = null;
 
-      if (typeof remoteObject.getAttributedTo === "function") {
-        const author = await remoteObject.getAttributedTo();
-        recipient = Array.isArray(author) ? author[0] : author;
+      // Strategy 1: Look up remote post via Fedify (signed request)
+      try {
+        const remoteObject = await ctx.lookupObject(new URL(url), {
+          documentLoader,
+        });
+        if (remoteObject && typeof remoteObject.getAttributedTo === "function") {
+          const author = await remoteObject.getAttributedTo({ documentLoader });
+          recipient = Array.isArray(author) ? author[0] : author;
+        }
+      } catch {
+        // Network failure — fall through to timeline
       }
 
+      // Strategy 2: Use author URL from our timeline (already stored)
       if (!recipient) {
-        return response.status(404).json({
-          success: false,
-          error: "Could not resolve post author",
-        });
+        const { application } = request.app.locals;
+        const collections = {
+          ap_timeline: application?.collections?.get("ap_timeline"),
+        };
+        const timelineItem = await getTimelineItem(collections, url);
+        const authorUrl = timelineItem?.author?.url;
+
+        if (authorUrl) {
+          try {
+            recipient = await ctx.lookupObject(new URL(authorUrl), {
+              documentLoader,
+            });
+          } catch {
+            // Could not resolve author actor either
+          }
+        }
+
+        if (!recipient) {
+          return response.status(404).json({
+            success: false,
+            error: "Could not resolve post author",
+          });
+        }
       }
 
       // Generate a unique activity ID
@@ -170,13 +194,42 @@ export function unlikeController(mountPath, plugin) {
         { handle, publicationUrl: plugin._publicationUrl },
       );
 
-      // Resolve the recipient
-      const remoteObject = await ctx.lookupObject(new URL(url));
+      // Use authenticated document loader for servers requiring Authorized Fetch
+      const documentLoader = await ctx.getDocumentLoader({
+        identifier: handle,
+      });
+
+      // Resolve the recipient — try remote first, then timeline fallback
       let recipient = null;
 
-      if (remoteObject && typeof remoteObject.getAttributedTo === "function") {
-        const author = await remoteObject.getAttributedTo();
-        recipient = Array.isArray(author) ? author[0] : author;
+      try {
+        const remoteObject = await ctx.lookupObject(new URL(url), {
+          documentLoader,
+        });
+        if (remoteObject && typeof remoteObject.getAttributedTo === "function") {
+          const author = await remoteObject.getAttributedTo({ documentLoader });
+          recipient = Array.isArray(author) ? author[0] : author;
+        }
+      } catch {
+        // Network failure
+      }
+
+      if (!recipient) {
+        const collections = {
+          ap_timeline: application?.collections?.get("ap_timeline"),
+        };
+        const timelineItem = await getTimelineItem(collections, url);
+        const authorUrl = timelineItem?.author?.url;
+
+        if (authorUrl) {
+          try {
+            recipient = await ctx.lookupObject(new URL(authorUrl), {
+              documentLoader,
+            });
+          } catch {
+            // Could not resolve — will proceed to cleanup
+          }
+        }
       }
 
       if (!recipient) {

package/lib/controllers/moderation.js

@@ -151,7 +151,12 @@ export function blockController(mountPath, plugin) {
             { handle, publicationUrl: plugin._publicationUrl },
           );
 
-          const remoteActor = await ctx.lookupObject(new URL(url));
+          const documentLoader = await ctx.getDocumentLoader({
+            identifier: handle,
+          });
+          const remoteActor = await ctx.lookupObject(new URL(url), {
+            documentLoader,
+          });
 
           if (remoteActor) {
             const block = new Block({
@@ -225,7 +230,12 @@ export function unblockController(mountPath, plugin) {
             { handle, publicationUrl: plugin._publicationUrl },
           );
 
-          const remoteActor = await ctx.lookupObject(new URL(url));
+          const documentLoader = await ctx.getDocumentLoader({
+            identifier: handle,
+          });
+          const remoteActor = await ctx.lookupObject(new URL(url), {
+            documentLoader,
+          });
 
           if (remoteActor) {
             const block = new Block({

package/lib/controllers/profile.remote.js

@@ -36,11 +36,14 @@ export function remoteProfileController(mountPath, plugin) {
         { handle, publicationUrl: plugin._publicationUrl },
       );
 
-      // Look up the remote actor
+      // Look up the remote actor (signed request for Authorized Fetch)
+      const documentLoader = await ctx.getDocumentLoader({
+        identifier: handle,
+      });
       let actor;
 
       try {
-        actor = await ctx.lookupObject(new URL(actorUrl));
+        actor = await ctx.lookupObject(new URL(actorUrl), { documentLoader });
       } catch {
         return response.status(404).render("error", {
           title: "Error",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "1.1.8",
+  "version": "1.1.10",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",

package/views/activitypub-compose.njk

@@ -18,9 +18,9 @@
           <a href="{{ replyContext.author.url }}">{{ replyContext.author.name }}</a>
         </div>
       {% endif %}
-      {% if replyContext.content and replyContext.content.text %}
+      {% if replyContext.content and (replyContext.content.html or replyContext.content.text) %}
         <blockquote class="ap-compose__context-text">
-          {{ replyContext.content.text | truncate(300) }}
+          {{ replyContext.content.html | safe if replyContext.content.html else replyContext.content.text | truncate(300) }}
         </blockquote>
       {% endif %}
       <a href="{{ replyTo }}" class="ap-compose__context-link" target="_blank" rel="noopener">{{ replyTo }}</a>
@@ -74,7 +74,7 @@
         <legend>{{ __("activitypub.compose.syndicateLabel") }}</legend>
         {% for target in syndicationTargets %}
           <label class="ap-compose__syndication-target">
-            <input type="checkbox" name="mp-syndicate-to" value="{{ target.uid }}" checked>
+            <input type="checkbox" name="mp-syndicate-to" value="{{ target.uid }}" {{ "checked" if target.defaultChecked }}>
             {{ target.name }}
           </label>
         {% endfor %}