@rmdes/indiekit-endpoint-activitypub 2.0.36 → 2.1.0

package/lib/controllers/explore.js

@@ -5,117 +5,15 @@
  * Remote HTML is always passed through sanitizeContent() before storage.
  */
 
-import sanitizeHtml from "sanitize-html";
-import { sanitizeContent } from "../timeline-store.js";
 import { searchInstances, checkInstanceTimeline, getPopularAccounts } from "../fedidb.js";
 import { getToken } from "../csrf.js";
+import { validateInstance, validateHashtag, mapMastodonStatusToItem } from "./explore-utils.js";
 
 const FETCH_TIMEOUT_MS = 10_000;
 const MAX_RESULTS = 20;
 
-/**
- * Validate the instance parameter to prevent SSRF.
- * Only allows hostnames — no IPs, no localhost, no port numbers for exotic attacks.
- * @param {string} instance - Raw instance parameter from query string
- * @returns {string|null} Validated hostname or null
- */
-export function validateInstance(instance) {
-  if (!instance || typeof instance !== "string") return null;
-
-  try {
-    // Prepend https:// to parse as URL
-    const url = new URL(`https://${instance.trim()}`);
-
-    // Must be a plain hostname — no IP addresses, no localhost
-    const hostname = url.hostname;
-    if (
-      hostname === "localhost" ||
-      hostname === "127.0.0.1" ||
-      hostname === "0.0.0.0" ||
-      hostname === "::1" ||
-      hostname.startsWith("192.168.") ||
-      hostname.startsWith("10.") ||
-      hostname.startsWith("169.254.") ||
-      /^172\.(1[6-9]|2\d|3[01])\./.test(hostname) ||
-      /^[0-9]{1,3}(\.[0-9]{1,3}){3}$/.test(hostname) || // IPv4
-      hostname.includes("[") // IPv6
-    ) {
-      return null;
-    }
-
-    // Only allow the hostname (no path, no port override)
-    return hostname;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Map a Mastodon API status object to our timeline item format.
- * @param {object} status - Mastodon API status
- * @param {string} instance - Instance hostname (for handle construction)
- * @returns {object} Timeline item compatible with ap-item-card.njk
- */
-function mapMastodonStatusToItem(status, instance) {
-  const account = status.account || {};
-  const acct = account.acct || "";
-  // Mastodon acct is "user" for local, "user@remote" for remote
-  const handle = acct.includes("@") ? `@${acct}` : `@${acct}@${instance}`;
-
-  // Map mentions — store without leading @ (template prepends it)
-  const mentions = (status.mentions || []).map((m) => ({
-    name: m.acct.includes("@") ? m.acct : `${m.acct}@${instance}`,
-    url: m.url || "",
-  }));
-
-  // Map hashtags
-  const category = (status.tags || []).map((t) => t.name || "");
-
-  // Map media attachments
-  const photo = [];
-  const video = [];
-  const audio = [];
-  for (const att of status.media_attachments || []) {
-    const url = att.url || att.remote_url || "";
-    if (!url) continue;
-    if (att.type === "image" || att.type === "gifv") {
-      photo.push(url);
-    } else if (att.type === "video") {
-      video.push(url);
-    } else if (att.type === "audio") {
-      audio.push(url);
-    }
-  }
-
-  return {
-    uid: status.url || status.uri || "",
-    url: status.url || status.uri || "",
-    type: "note",
-    name: "",
-    content: {
-      text: (status.content || "").replace(/<[^>]*>/g, ""),
-      html: sanitizeContent(status.content || ""),
-    },
-    summary: status.spoiler_text || "",
-    sensitive: status.sensitive || false,
-    published: status.created_at || new Date().toISOString(),
-    author: {
-      name: sanitizeHtml(account.display_name || account.username || "Unknown", { allowedTags: [], allowedAttributes: {} }),
-      url: account.url || "",
-      photo: account.avatar || account.avatar_static || "",
-      handle,
-    },
-    category,
-    mentions,
-    photo,
-    video,
-    audio,
-    inReplyTo: status.in_reply_to_id ? `https://${instance}/web/statuses/${status.in_reply_to_id}` : "",
-    createdAt: new Date().toISOString(),
-    // Explore-specific: track source instance
-    _explore: true,
-  };
-}
+// Re-export validateInstance for backward compatibility (used by tabs.js, index.js)
+export { validateInstance } from "./explore-utils.js";
 
 export function exploreController(mountPath) {
   return async (request, response, next) => {
@@ -123,24 +21,10 @@ export function exploreController(mountPath) {
       const rawInstance = request.query.instance || "";
       const scope = request.query.scope === "federated" ? "federated" : "local";
       const maxId = request.query.max_id || "";
-      const activeTab = request.query.tab === "decks" ? "decks" : "search";
-
-      // Fetch deck list for both tabs (needed for star button state + deck tab)
-      const { application } = request.app.locals;
-      const decksCollection = application?.collections?.get("ap_decks");
-      let decks = [];
-      try {
-        decks = await decksCollection
-          .find({})
-          .sort({ addedAt: 1 })
-          .toArray();
-      } catch {
-        // Collection unavailable — non-fatal, decks defaults to []
-      }
+      const rawHashtag = request.query.hashtag || "";
+      const hashtag = rawHashtag ? validateHashtag(rawHashtag) : null;
 
       const csrfToken = getToken(request.session);
-      const deckCount = decks.length;
-
       const readerParent = { href: `${mountPath}/admin/reader`, text: response.locals.__("activitypub.reader.title") };
 
       // No instance specified — render clean initial page (no error)
@@ -150,14 +34,11 @@ export function exploreController(mountPath) {
           readerParent,
           instance: "",
           scope,
+          hashtag: hashtag || "",
           items: [],
           maxId: null,
           error: null,
           mountPath,
-          activeTab,
-          decks,
-          deckCount,
-          isInDeck: false,
           csrfToken,
         });
       }
@@ -169,22 +50,25 @@ export function exploreController(mountPath) {
           readerParent,
           instance: rawInstance,
           scope,
+          hashtag: hashtag || "",
           items: [],
           maxId: null,
           error: response.locals.__("activitypub.reader.explore.invalidInstance"),
           mountPath,
-          activeTab,
-          decks,
-          deckCount,
-          isInDeck: false,
           csrfToken,
         });
       }
 
-      // Fetch public timeline from remote instance
+      // Build API URL: hashtag timeline or public timeline
       const isLocal = scope === "local";
-      const apiUrl = new URL(`https://${instance}/api/v1/timelines/public`);
-      apiUrl.searchParams.set("local", isLocal ? "true" : "false");
+      let apiUrl;
+      if (hashtag) {
+        apiUrl = new URL(`https://${instance}/api/v1/timelines/tag/${encodeURIComponent(hashtag)}`);
+        apiUrl.searchParams.set("local", isLocal ? "true" : "false");
+      } else {
+        apiUrl = new URL(`https://${instance}/api/v1/timelines/public`);
+        apiUrl.searchParams.set("local", isLocal ? "true" : "false");
+      }
       apiUrl.searchParams.set("limit", String(MAX_RESULTS));
       if (maxId) apiUrl.searchParams.set("max_id", maxId);
 
@@ -226,23 +110,16 @@ export function exploreController(mountPath) {
         error = msg;
       }
 
-      const isInDeck = decks.some(
-        (d) => d.domain === instance && d.scope === scope,
-      );
-
       response.render("activitypub-explore", {
         title: response.locals.__("activitypub.reader.explore.title"),
         readerParent,
         instance,
         scope,
+        hashtag: hashtag || "",
         items,
         maxId: nextMaxId,
         error,
         mountPath,
-        activeTab,
-        decks,
-        deckCount,
-        isInDeck,
         csrfToken,
         // Pass empty interactionMap — explore posts are not in our DB
         interactionMap: {},
@@ -263,15 +140,24 @@ export function exploreApiController(mountPath) {
       const rawInstance = request.query.instance || "";
       const scope = request.query.scope === "federated" ? "federated" : "local";
       const maxId = request.query.max_id || "";
+      const rawHashtag = request.query.hashtag || "";
+      const hashtag = rawHashtag ? validateHashtag(rawHashtag) : null;
 
       const instance = validateInstance(rawInstance);
       if (!instance) {
         return response.status(400).json({ error: "Invalid instance" });
       }
 
+      // Build API URL: hashtag timeline or public timeline
       const isLocal = scope === "local";
-      const apiUrl = new URL(`https://${instance}/api/v1/timelines/public`);
-      apiUrl.searchParams.set("local", isLocal ? "true" : "false");
+      let apiUrl;
+      if (hashtag) {
+        apiUrl = new URL(`https://${instance}/api/v1/timelines/tag/${encodeURIComponent(hashtag)}`);
+        apiUrl.searchParams.set("local", isLocal ? "true" : "false");
+      } else {
+        apiUrl = new URL(`https://${instance}/api/v1/timelines/public`);
+        apiUrl.searchParams.set("local", isLocal ? "true" : "false");
+      }
       apiUrl.searchParams.set("limit", String(MAX_RESULTS));
       if (maxId) apiUrl.searchParams.set("max_id", maxId);
 

package/lib/controllers/hashtag-explore.js

@@ -0,0 +1,223 @@
+/**
+ * Hashtag explore API — aggregates a hashtag timeline across all pinned instance tabs.
+ *
+ * GET /admin/reader/api/explore/hashtag
+ *   ?hashtag={tag}
+ *   &cursors={json}   — JSON-encoded { domain: maxId } cursor map for pagination
+ *
+ * Returns JSON:
+ *   {
+ *     html: string,             — server-rendered HTML cards
+ *     cursors: { [domain]: string|null },  — updated cursor map
+ *     sources: { [domain]: "ok" | "error:N" },
+ *     instancesQueried: number,
+ *     instancesTotal: number,
+ *     instanceLabels: string[],
+ *   }
+ */
+
+import { validateHashtag, mapMastodonStatusToItem } from "./explore-utils.js";
+
+const FETCH_TIMEOUT_MS = 10_000;
+const PAGE_SIZE = 20;
+const MAX_HASHTAG_INSTANCES = 10;
+
+/**
+ * Fetch hashtag timeline from one instance.
+ * Returns { statuses, nextMaxId, error }.
+ */
+async function fetchHashtagFromInstance(domain, scope, hashtag, maxId) {
+  try {
+    const isLocal = scope === "local";
+    const url = new URL(
+      `https://${domain}/api/v1/timelines/tag/${encodeURIComponent(hashtag)}`
+    );
+    url.searchParams.set("local", isLocal ? "true" : "false");
+    url.searchParams.set("limit", "20");
+    if (maxId) url.searchParams.set("max_id", maxId);
+
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+
+    const res = await fetch(url.toString(), {
+      headers: { Accept: "application/json" },
+      signal: controller.signal,
+    });
+    clearTimeout(timeoutId);
+
+    if (!res.ok) {
+      return { statuses: [], nextMaxId: null, error: `error:${res.status}` };
+    }
+
+    const statuses = await res.json();
+    if (!Array.isArray(statuses)) {
+      return { statuses: [], nextMaxId: null, error: "error:invalid" };
+    }
+
+    const nextMaxId =
+      statuses.length === 20 && statuses.length > 0
+        ? statuses[statuses.length - 1].id || null
+        : null;
+
+    return { statuses, nextMaxId, error: null };
+  } catch {
+    return { statuses: [], nextMaxId: null, error: "error:timeout" };
+  }
+}
+
+/**
+ * Hashtag explore API controller.
+ * Queries up to MAX_HASHTAG_INSTANCES pinned instance tabs in parallel.
+ */
+export function hashtagExploreApiController(mountPath) {
+  return async (request, response, next) => {
+    try {
+      // Validate hashtag
+      const rawHashtag = request.query.hashtag || "";
+      const hashtag = validateHashtag(rawHashtag);
+      if (!hashtag) {
+        return response.status(400).json({ error: "Invalid hashtag" });
+      }
+
+      const tabsCollection = request.app.locals.application?.collections?.get("ap_explore_tabs");
+      if (!tabsCollection) {
+        return response.json({
+          html: "", cursors: {}, sources: {}, instancesQueried: 0, instancesTotal: 0, instanceLabels: [],
+        });
+      }
+
+      // Parse cursors map — { [domain]: maxId | null }
+      let cursors = {};
+      try {
+        const raw = request.query.cursors || "{}";
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+          cursors = parsed;
+        }
+      } catch {
+        // Invalid JSON — use empty cursors (start from beginning)
+      }
+
+      // Load instance tabs, capped at MAX_HASHTAG_INSTANCES by order
+      const instanceTabs = await tabsCollection
+        .find({ type: "instance" })
+        .sort({ order: 1 })
+        .limit(MAX_HASHTAG_INSTANCES)
+        .toArray();
+
+      const instancesTotal = await tabsCollection.countDocuments({
+        type: "instance",
+      });
+
+      if (instanceTabs.length === 0) {
+        return response.json({
+          html: "",
+          cursors: {},
+          sources: {},
+          instancesQueried: 0,
+          instancesTotal,
+          instanceLabels: [],
+        });
+      }
+
+      // Fetch from all instances in parallel
+      const fetchResults = await Promise.allSettled(
+        instanceTabs.map((tab) =>
+          fetchHashtagFromInstance(
+            tab.domain,
+            tab.scope,
+            hashtag,
+            cursors[tab.domain] || null
+          )
+        )
+      );
+
+      // Build sources map and collect all statuses with their domain
+      const sources = {};
+      const updatedCursors = {};
+      const allItems = [];
+
+      for (let i = 0; i < instanceTabs.length; i++) {
+        const tab = instanceTabs[i];
+        const result = fetchResults[i];
+
+        if (result.status === "fulfilled") {
+          const { statuses, nextMaxId, error } = result.value;
+          sources[tab.domain] = error || "ok";
+          updatedCursors[tab.domain] = nextMaxId;
+
+          if (!error) {
+            for (const status of statuses) {
+              allItems.push({ status, domain: tab.domain });
+            }
+          }
+        } else {
+          sources[tab.domain] = "error:rejected";
+          updatedCursors[tab.domain] = cursors[tab.domain] || null;
+        }
+      }
+
+      // Merge by published date descending
+      allItems.sort((a, b) => {
+        const dateA = new Date(a.status.created_at || 0).getTime();
+        const dateB = new Date(b.status.created_at || 0).getTime();
+        return dateB - dateA;
+      });
+
+      // Deduplicate by post URL (first occurrence wins)
+      const seenUrls = new Set();
+      const dedupedItems = [];
+      for (const { status, domain } of allItems) {
+        const uid = status.url || status.uri || "";
+        if (uid && seenUrls.has(uid)) continue;
+        if (uid) seenUrls.add(uid);
+        dedupedItems.push({ status, domain });
+      }
+
+      // Paginate: take first PAGE_SIZE items
+      const pageItems = dedupedItems.slice(0, PAGE_SIZE);
+
+      // Map to timeline item format
+      const items = pageItems.map(({ status, domain }) =>
+        mapMastodonStatusToItem(status, domain)
+      );
+
+      // Render HTML AFTER merge/dedup/paginate (don't waste CPU on discarded items)
+      const templateData = {
+        ...response.locals,
+        mountPath,
+        csrfToken: "",
+        interactionMap: {},
+      };
+
+      const htmlParts = await Promise.all(
+        items.map(
+          (item) =>
+            new Promise((resolve, reject) => {
+              request.app.render(
+                "partials/ap-item-card.njk",
+                { ...templateData, item },
+                (err, html) => {
+                  if (err) reject(err);
+                  else resolve(html);
+                }
+              );
+            })
+        )
+      );
+
+      const instanceLabels = instanceTabs.map((t) => t.domain);
+
+      response.json({
+        html: htmlParts.join(""),
+        cursors: updatedCursors,
+        sources,
+        instancesQueried: instanceTabs.length,
+        instancesTotal,
+        instanceLabels,
+      });
+    } catch (error) {
+      next(error);
+    }
+  };
+}