@rmdes/indiekit-endpoint-activitypub 2.15.1 → 2.15.3

package/README.md

@@ -339,6 +339,23 @@ Mastodon's `update_account_fields` checks `attachment.is_a?(Array)` and silently
 
 **Revisit when:** Fedify adds an option to preserve arrays during JSON-LD serialization, or Mastodon fixes their array check.
 
+### Endpoints `as:Endpoints` Type Stripping
+
+**File:** `lib/federation-bridge.js` (in `sendFedifyResponse()`)
+**Upstream issue:** [fedify#576](https://github.com/fedify-dev/fedify/issues/576) — FIXED in Fedify 2.1.0
+
+Fedify serializes the `endpoints` object with `"type": "as:Endpoints"`, which is not a valid ActivityStreams type. browser.pub rejects this. The bridge strips the `type` field from the `endpoints` object before sending.
+
+**Remove when:** Upgrading to Fedify ≥ 2.1.0.
+
+### PropertyValue Attachment Type (Known Issue)
+
+**Upstream issue:** [fedify#629](https://github.com/fedify-dev/fedify/issues/629) — OPEN
+
+Fedify serializes `PropertyValue` attachments (used by Mastodon for profile metadata fields) with `"type": "PropertyValue"`, a schema.org type that is not a valid AS2 Object or Link. browser.pub rejects `/attachment` as invalid. However, every Mastodon-compatible server emits `PropertyValue` — removing it would break profile field display across the fediverse.
+
+**No workaround applied.** This is a de facto fediverse standard despite not being in the AS2 vocabulary.
+
 ### `.authorize()` Not Chained on Actor Dispatcher
 
 **File:** `lib/federation-setup.js` (line ~254)

package/index.js

@@ -434,7 +434,7 @@ export default class ActivityPubEndpoint {
           "properties.url": requestUrl,
         });
 
-        if (!post) {
+        if (!post || post.properties?.deleted) {
           return next();
         }
 

package/lib/federation-bridge.js

@@ -89,6 +89,12 @@ async function sendFedifyResponse(res, response, request) {
       if (json.attachment && !Array.isArray(json.attachment)) {
         json.attachment = [json.attachment];
       }
+      // WORKAROUND: Fedify serializes endpoints with "type": "as:Endpoints"
+      // which is not a valid AS2 type. The endpoints object should be a plain
+      // object with just sharedInbox/proxyUrl etc. Strip the invalid type.
+      if (json.endpoints && json.endpoints.type) {
+        delete json.endpoints.type;
+      }
       const patched = JSON.stringify(json);
       res.setHeader("content-length", Buffer.byteLength(patched));
       res.end(patched);

package/lib/federation-setup.js

@@ -609,10 +609,11 @@ function setupOutbox(federation, mountPath, handle, collections) {
 
         const pageSize = 20;
         const skip = cursor ? Number.parseInt(cursor, 10) : 0;
-        const total = await postsCollection.countDocuments();
+        const notDeleted = { "properties.deleted": { $exists: false } };
+        const total = await postsCollection.countDocuments(notDeleted);
 
         const posts = await postsCollection
-          .find()
+          .find(notDeleted)
           .sort({ "properties.published": -1 })
           .skip(skip)
           .limit(pageSize)
@@ -644,7 +645,9 @@ function setupOutbox(federation, mountPath, handle, collections) {
       if (identifier !== handle) return 0;
       const postsCollection = collections.posts;
       if (!postsCollection) return 0;
-      return await postsCollection.countDocuments();
+      return await postsCollection.countDocuments({
+        "properties.deleted": { $exists: false },
+      });
     })
     .setFirstCursor(async () => "0");
 }
@@ -656,6 +659,8 @@ function setupObjectDispatchers(federation, mountPath, handle, collections, publ
     const postUrl = `${publicationUrl.replace(/\/$/, "")}/${id}`;
     const post = await collections.posts.findOne({ "properties.url": postUrl });
     if (!post) return null;
+    // Soft-deleted posts should not be dereferenceable
+    if (post.properties?.deleted) return null;
     const actorUrl = ctx.getActorUri(handle).href;
     const activity = jf2ToAS2Activity(post.properties, actorUrl, publicationUrl);
     // Only Create activities wrap Note/Article objects

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "2.15.1",
+  "version": "2.15.3",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",