@rmdes/indiekit-endpoint-activitypub 2.8.1 → 2.9.0

package/assets/reader.css

@@ -1320,6 +1320,166 @@
   color: var(--color-on-background);
 }
 
+.ap-notification__handle {
+  color: var(--color-on-offset);
+  font-size: var(--font-size-s);
+  margin-left: var(--space-xs);
+}
+
+.ap-notifications__btn--primary {
+  background: var(--color-primary);
+  color: var(--color-on-primary, #fff);
+  text-decoration: none;
+}
+
+.ap-notifications__btn--primary:hover {
+  opacity: 0.9;
+}
+
+/* ==========================================================================
+   Messages
+   ========================================================================== */
+
+.ap-messages__layout {
+  display: grid;
+  grid-template-columns: 240px 1fr;
+  gap: var(--space-m);
+  min-height: 300px;
+}
+
+.ap-messages__sidebar {
+  border-right: var(--border-width-thin) solid var(--color-outline);
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  padding-right: var(--space-m);
+  overflow-y: auto;
+  max-height: 70vh;
+}
+
+.ap-messages__partner {
+  align-items: center;
+  border-radius: var(--border-radius-small);
+  color: var(--color-on-background);
+  display: flex;
+  gap: var(--space-s);
+  padding: var(--space-s);
+  text-decoration: none;
+  transition: background 0.15s ease;
+}
+
+.ap-messages__partner:hover {
+  background: var(--color-offset);
+}
+
+.ap-messages__partner--active {
+  background: var(--color-offset);
+  font-weight: var(--font-weight-bold);
+}
+
+.ap-messages__partner-avatar {
+  flex-shrink: 0;
+  height: 32px;
+  position: relative;
+  width: 32px;
+}
+
+.ap-messages__partner-avatar img {
+  border-radius: 50%;
+  height: 100%;
+  object-fit: cover;
+  width: 100%;
+}
+
+.ap-messages__partner-initial {
+  align-items: center;
+  background: var(--color-offset);
+  border-radius: 50%;
+  color: var(--color-on-offset);
+  display: flex;
+  font-size: var(--font-size-s);
+  height: 100%;
+  justify-content: center;
+  width: 100%;
+}
+
+.ap-messages__partner-avatar img + .ap-messages__partner-initial {
+  display: none;
+}
+
+.ap-messages__partner-info {
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+  overflow: hidden;
+}
+
+.ap-messages__partner-name {
+  font-size: var(--font-size-s);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.ap-messages__partner-handle {
+  color: var(--color-on-offset);
+  font-size: var(--font-size-xs);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.ap-messages__content {
+  min-width: 0;
+}
+
+.ap-message--outbound {
+  border-left-color: var(--color-primary);
+}
+
+.ap-message__direction {
+  color: var(--color-on-offset);
+  font-size: var(--font-size-s);
+  margin-right: var(--space-xs);
+}
+
+.ap-message__content {
+  color: var(--color-on-background);
+  font-size: var(--font-size-s);
+  line-height: 1.5;
+  margin-top: var(--space-xs);
+}
+
+.ap-message__content p {
+  margin: 0 0 var(--space-xs);
+}
+
+.ap-message__content p:last-child {
+  margin-bottom: 0;
+}
+
+@media (max-width: 640px) {
+  .ap-messages__layout {
+    grid-template-columns: 1fr;
+  }
+
+  .ap-messages__sidebar {
+    border-bottom: var(--border-width-thin) solid var(--color-outline);
+    border-right: none;
+    flex-direction: row;
+    max-height: none;
+    overflow-x: auto;
+    padding-bottom: var(--space-s);
+    padding-right: 0;
+    -webkit-overflow-scrolling: touch;
+  }
+
+  .ap-messages__partner {
+    flex-shrink: 0;
+    white-space: nowrap;
+  }
+}
+
 /* ==========================================================================
    Remote Profile
    ========================================================================== */

package/index.js

@@ -78,6 +78,14 @@ import {
 } from "./lib/controllers/tabs.js";
 import { hashtagExploreApiController } from "./lib/controllers/hashtag-explore.js";
 import { publicProfileController } from "./lib/controllers/public-profile.js";
+import {
+  messagesController,
+  messageComposeController,
+  submitMessageController,
+  markAllMessagesReadController,
+  clearAllMessagesController,
+  deleteMessageController,
+} from "./lib/controllers/messages.js";
 import { authorizeInteractionController } from "./lib/controllers/authorize-interaction.js";
 import { myProfileController } from "./lib/controllers/my-profile.js";
 import {
@@ -143,6 +151,11 @@ export default class ActivityPubEndpoint {
         text: "activitypub.notifications.title",
         requiresDatabase: true,
       },
+      {
+        href: `${this.options.mountPath}/admin/reader/messages`,
+        text: "activitypub.messages.title",
+        requiresDatabase: true,
+      },
       {
         href: `${this.options.mountPath}/admin/reader/moderation`,
         text: "activitypub.moderation.title",
@@ -252,6 +265,12 @@ export default class ActivityPubEndpoint {
     router.post("/admin/reader/notifications/mark-read", markAllNotificationsReadController(mp));
     router.post("/admin/reader/notifications/clear", clearAllNotificationsController(mp));
     router.post("/admin/reader/notifications/delete", deleteNotificationController(mp));
+    router.get("/admin/reader/messages", messagesController(mp));
+    router.get("/admin/reader/messages/compose", messageComposeController(mp, this));
+    router.post("/admin/reader/messages/compose", submitMessageController(mp, this));
+    router.post("/admin/reader/messages/mark-read", markAllMessagesReadController(mp));
+    router.post("/admin/reader/messages/clear", clearAllMessagesController(mp));
+    router.post("/admin/reader/messages/delete", deleteMessageController(mp));
     router.get("/admin/reader/compose", composeController(mp, this));
     router.post("/admin/reader/compose", submitComposeController(mp, this));
     router.post("/admin/reader/like", likeController(mp, this));
@@ -885,6 +904,8 @@ export default class ActivityPubEndpoint {
     Indiekit.addCollection("ap_blocked");
     Indiekit.addCollection("ap_interactions");
     Indiekit.addCollection("ap_followed_tags");
+    // Message collections
+    Indiekit.addCollection("ap_messages");
     // Explore tab collections
     Indiekit.addCollection("ap_explore_tabs");
 
@@ -906,6 +927,8 @@ export default class ActivityPubEndpoint {
       ap_blocked: indiekitCollections.get("ap_blocked"),
       ap_interactions: indiekitCollections.get("ap_interactions"),
       ap_followed_tags: indiekitCollections.get("ap_followed_tags"),
+      // Message collections
+      ap_messages: indiekitCollections.get("ap_messages"),
       // Explore tab collections
       ap_explore_tabs: indiekitCollections.get("ap_explore_tabs"),
       get posts() {
@@ -993,6 +1016,35 @@ export default class ActivityPubEndpoint {
         );
       }
 
+      // Message indexes
+      this._collections.ap_messages.createIndex(
+        { uid: 1 },
+        { unique: true, background: true },
+      );
+      this._collections.ap_messages.createIndex(
+        { published: -1 },
+        { background: true },
+      );
+      this._collections.ap_messages.createIndex(
+        { read: 1 },
+        { background: true },
+      );
+      this._collections.ap_messages.createIndex(
+        { conversationId: 1, published: -1 },
+        { background: true },
+      );
+      this._collections.ap_messages.createIndex(
+        { direction: 1 },
+        { background: true },
+      );
+      // TTL index for message cleanup (reuse notification retention)
+      if (notifRetention > 0) {
+        this._collections.ap_messages.createIndex(
+          { createdAt: 1 },
+          { expireAfterSeconds: notifRetention * 86_400 },
+        );
+      }
+
       // Muted collection — sparse unique indexes (allow multiple null values)
       this._collections.ap_muted
         .dropIndex("url_1")

package/lib/controllers/messages.js

@@ -0,0 +1,372 @@
+/**
+ * Messages controllers — DM inbox, compose, and send.
+ * Direct messages bypass Micropub and use Fedify ctx.sendActivity() directly.
+ */
+
+import { getToken, validateToken } from "../csrf.js";
+import { sanitizeContent } from "../timeline-store.js";
+import {
+  getMessages,
+  getConversationPartners,
+  getUnreadMessageCount,
+  markMessagesRead,
+  markAllMessagesRead,
+  clearAllMessages,
+  deleteMessage,
+  addMessage,
+} from "../storage/messages.js";
+
+/**
+ * GET /admin/reader/messages — Messages inbox with conversation sidebar.
+ * @param {string} mountPath - Plugin mount path
+ */
+export function messagesController(mountPath) {
+  return async (request, response, next) => {
+    try {
+      const { application } = request.app.locals;
+      const collections = {
+        ap_messages: application?.collections?.get("ap_messages"),
+      };
+
+      const partner = request.query.partner || null;
+      const before = request.query.before;
+      const limit = Number.parseInt(request.query.limit || "20", 10);
+
+      const options = { before, limit };
+      if (partner) {
+        options.partner = partner;
+      }
+
+      // Get messages + conversation partners + unread count in parallel
+      const [result, partners, unreadCount] = await Promise.all([
+        getMessages(collections, options),
+        getConversationPartners(collections),
+        getUnreadMessageCount(collections),
+      ]);
+
+      // Auto mark-read when viewing a specific conversation
+      if (partner) {
+        await markMessagesRead(collections, partner);
+      }
+
+      const csrfToken = getToken(request.session);
+
+      response.render("activitypub-messages", {
+        title: response.locals.__("activitypub.messages.title"),
+        readerParent: { href: `${mountPath}/admin/reader`, text: response.locals.__("activitypub.reader.title") },
+        items: result.items,
+        before: result.before,
+        partners,
+        activePartner: partner,
+        unreadCount,
+        csrfToken,
+        mountPath,
+      });
+    } catch (error) {
+      next(error);
+    }
+  };
+}
+
+/**
+ * GET /admin/reader/messages/compose — DM compose form.
+ * @param {string} mountPath - Plugin mount path
+ * @param {object} plugin - ActivityPub plugin instance
+ */
+export function messageComposeController(mountPath, plugin) {
+  return async (request, response, next) => {
+    try {
+      const to = request.query.to || "";
+      const replyTo = request.query.replyTo || "";
+
+      // Load reply context if replying to a specific message
+      let replyContext = null;
+      if (replyTo) {
+        const { application } = request.app.locals;
+        const messagesCol = application?.collections?.get("ap_messages");
+        if (messagesCol) {
+          replyContext = await messagesCol.findOne({ uid: replyTo });
+        }
+      }
+
+      const csrfToken = getToken(request.session);
+
+      response.render("activitypub-message-compose", {
+        title: response.locals.__("activitypub.messages.compose"),
+        readerParent: { href: `${mountPath}/admin/reader/messages`, text: response.locals.__("activitypub.messages.title") },
+        to,
+        replyTo,
+        replyContext,
+        csrfToken,
+        mountPath,
+      });
+    } catch (error) {
+      next(error);
+    }
+  };
+}
+
+/**
+ * POST /admin/reader/messages/compose — Send a DM via Fedify.
+ * Bypasses Micropub — sends Create(Note) directly with DM addressing.
+ * @param {string} mountPath - Plugin mount path
+ * @param {object} plugin - ActivityPub plugin instance
+ */
+export function submitMessageController(mountPath, plugin) {
+  return async (request, response, next) => {
+    try {
+      if (!validateToken(request)) {
+        return response.status(403).redirect(`${mountPath}/admin/reader/messages/compose`);
+      }
+
+      const { to, content, replyTo } = request.body;
+
+      if (!to || !to.trim()) {
+        return response.status(400).render("activitypub-message-compose", {
+          title: response.locals.__("activitypub.messages.compose"),
+          readerParent: { href: `${mountPath}/admin/reader/messages`, text: response.locals.__("activitypub.messages.title") },
+          to: "",
+          replyTo: replyTo || "",
+          replyContext: null,
+          csrfToken: getToken(request.session),
+          mountPath,
+          error: response.locals.__("activitypub.messages.errorNoRecipient"),
+        });
+      }
+
+      if (!content || !content.trim()) {
+        return response.status(400).render("activitypub-message-compose", {
+          title: response.locals.__("activitypub.messages.compose"),
+          readerParent: { href: `${mountPath}/admin/reader/messages`, text: response.locals.__("activitypub.messages.title") },
+          to,
+          replyTo: replyTo || "",
+          replyContext: null,
+          csrfToken: getToken(request.session),
+          mountPath,
+          error: response.locals.__("activitypub.messages.errorEmpty"),
+        });
+      }
+
+      if (!plugin._federation) {
+        return response.status(503).render("activitypub-message-compose", {
+          title: response.locals.__("activitypub.messages.compose"),
+          readerParent: { href: `${mountPath}/admin/reader/messages`, text: response.locals.__("activitypub.messages.title") },
+          to,
+          replyTo: replyTo || "",
+          replyContext: null,
+          csrfToken: getToken(request.session),
+          mountPath,
+          error: "Federation not initialized",
+        });
+      }
+
+      const { Create, Note, Mention } = await import("@fedify/fedify/vocab");
+      const { Temporal } = await import("@js-temporal/polyfill");
+      const handle = plugin.options.actor.handle;
+      const ctx = plugin._federation.createContext(
+        new URL(plugin._publicationUrl),
+        { handle, publicationUrl: plugin._publicationUrl },
+      );
+
+      const documentLoader = await ctx.getDocumentLoader({
+        identifier: handle,
+      });
+
+      // Resolve recipient — accept @user@domain or full URL
+      let recipient;
+      try {
+        const recipientInput = to.trim();
+        if (recipientInput.startsWith("http")) {
+          recipient = await ctx.lookupObject(recipientInput, { documentLoader });
+        } else {
+          // Handle @user@domain format
+          const handle = recipientInput.replace(/^@/, "");
+          recipient = await ctx.lookupObject(handle, { documentLoader });
+        }
+      } catch {
+        recipient = null;
+      }
+
+      if (!recipient?.id) {
+        return response.status(404).render("activitypub-message-compose", {
+          title: response.locals.__("activitypub.messages.compose"),
+          readerParent: { href: `${mountPath}/admin/reader/messages`, text: response.locals.__("activitypub.messages.title") },
+          to,
+          replyTo: replyTo || "",
+          replyContext: null,
+          csrfToken: getToken(request.session),
+          mountPath,
+          error: response.locals.__("activitypub.messages.errorRecipientNotFound"),
+        });
+      }
+
+      // Build Create(Note) with DM addressing — to: recipient only, no PUBLIC_COLLECTION
+      const uuid = crypto.randomUUID();
+      const baseUrl = plugin._publicationUrl.replace(/\/$/, "");
+      const noteId = `${baseUrl}/activitypub/messages/${uuid}`;
+      const now = Temporal.Now.instant();
+
+      // Sanitize outbound content — basic paragraph wrapping
+      const htmlContent = `<p>${sanitizeContent(content.trim())}</p>`;
+
+      const note = new Note({
+        id: new URL(noteId),
+        attributedTo: ctx.getActorUri(handle),
+        tos: [recipient.id],
+        tags: [
+          new Mention({
+            href: recipient.id,
+            name: recipient.preferredUsername
+              ? `@${recipient.preferredUsername}`
+              : recipient.id.href,
+          }),
+        ],
+        content: htmlContent,
+        published: now,
+        replyTarget: replyTo ? new URL(replyTo) : null,
+      });
+
+      const create = new Create({
+        id: new URL(`${noteId}#activity`),
+        actor: ctx.getActorUri(handle),
+        tos: [recipient.id],
+        object: note,
+        published: now,
+      });
+
+      await ctx.sendActivity({ identifier: handle }, recipient, create, {
+        orderingKey: recipient.id.href,
+      });
+
+      // Store outbound message locally
+      const { application } = request.app.locals;
+      const collections = {
+        ap_messages: application?.collections?.get("ap_messages"),
+      };
+
+      const recipientName = recipient.name?.toString() ||
+        recipient.preferredUsername?.toString() ||
+        recipient.id.href;
+      const recipientHandle = recipient.preferredUsername
+        ? `@${recipient.preferredUsername}@${recipient.id.hostname}`
+        : recipient.id.href;
+
+      // Get our actor's icon for the outbound message
+      const profileCol = application?.collections?.get("ap_profile");
+      const profile = profileCol ? await profileCol.findOne({}) : null;
+
+      await addMessage(collections, {
+        uid: noteId,
+        actorUrl: recipient.id.href,
+        actorName: recipientName,
+        actorPhoto: recipient.iconUrl?.href || "",
+        actorHandle: recipientHandle,
+        content: {
+          text: content.trim(),
+          html: htmlContent,
+        },
+        inReplyTo: replyTo || null,
+        conversationId: recipient.id.href,
+        direction: "outbound",
+        published: new Date().toISOString(),
+        createdAt: new Date().toISOString(),
+      });
+
+      console.info(`[ActivityPub] Sent DM to ${recipientName} (${recipient.id.href})`);
+
+      return response.redirect(`${mountPath}/admin/reader/messages?partner=${encodeURIComponent(recipient.id.href)}`);
+    } catch (error) {
+      console.error("[ActivityPub] DM send failed:", error.message);
+      next(error);
+    }
+  };
+}
+
+/**
+ * POST /admin/reader/messages/mark-read — Mark all messages as read.
+ */
+export function markAllMessagesReadController(mountPath) {
+  return async (request, response, next) => {
+    try {
+      if (!validateToken(request)) {
+        return response.status(403).redirect(`${mountPath}/admin/reader/messages`);
+      }
+
+      const { application } = request.app.locals;
+      const collections = {
+        ap_messages: application?.collections?.get("ap_messages"),
+      };
+
+      await markAllMessagesRead(collections);
+
+      return response.redirect(`${mountPath}/admin/reader/messages`);
+    } catch (error) {
+      next(error);
+    }
+  };
+}
+
+/**
+ * POST /admin/reader/messages/clear — Delete all messages.
+ */
+export function clearAllMessagesController(mountPath) {
+  return async (request, response, next) => {
+    try {
+      if (!validateToken(request)) {
+        return response.status(403).redirect(`${mountPath}/admin/reader/messages`);
+      }
+
+      const { application } = request.app.locals;
+      const collections = {
+        ap_messages: application?.collections?.get("ap_messages"),
+      };
+
+      await clearAllMessages(collections);
+
+      return response.redirect(`${mountPath}/admin/reader/messages`);
+    } catch (error) {
+      next(error);
+    }
+  };
+}
+
+/**
+ * POST /admin/reader/messages/delete — Delete a single message.
+ */
+export function deleteMessageController(mountPath) {
+  return async (request, response, next) => {
+    try {
+      if (!validateToken(request)) {
+        return response.status(403).json({
+          success: false,
+          error: "Invalid CSRF token",
+        });
+      }
+
+      const { uid } = request.body;
+
+      if (!uid) {
+        return response.status(400).json({
+          success: false,
+          error: "Missing message UID",
+        });
+      }
+
+      const { application } = request.app.locals;
+      const collections = {
+        ap_messages: application?.collections?.get("ap_messages"),
+      };
+
+      await deleteMessage(collections, uid);
+
+      // Support both JSON (fetch) and form redirect
+      if (request.headers.accept?.includes("application/json")) {
+        return response.json({ success: true, uid });
+      }
+
+      return response.redirect(`${mountPath}/admin/reader/messages`);
+    } catch (error) {
+      next(error);
+    }
+  };
+}

package/lib/controllers/reader.js

@@ -117,7 +117,7 @@ export function readerController(mountPath) {
 }
 
 export function notificationsController(mountPath) {
-  const validTabs = ["all", "reply", "like", "boost", "follow"];
+  const validTabs = ["all", "reply", "like", "boost", "follow", "dm"];
 
   return async (request, response, next) => {
     try {

package/lib/inbox-listeners.js

@@ -27,6 +27,7 @@ import { logActivity as logActivityShared } from "./activity-log.js";
 import { sanitizeContent, extractActorInfo, extractObjectData } from "./timeline-store.js";
 import { addTimelineItem, deleteTimelineItem, updateTimelineItem } from "./storage/timeline.js";
 import { addNotification } from "./storage/notifications.js";
+import { addMessage } from "./storage/messages.js";
 import { fetchAndStorePreviews, fetchAndStoreQuote } from "./og-unfurl.js";
 import { getFollowedTags } from "./storage/followed-tags.js";
 
@@ -39,6 +40,39 @@ import { getFollowedTags } from "./storage/followed-tags.js";
  * @param {string} options.handle - Actor handle
  * @param {boolean} options.storeRawActivities - Whether to store raw JSON
  */
+/** @type {string} ActivityStreams Public Collection constant */
+const PUBLIC = "https://www.w3.org/ns/activitystreams#Public";
+
+/**
+ * Determine if an object is a direct message (DM).
+ * A DM is addressed only to specific actors — no PUBLIC_COLLECTION,
+ * no followers collection, and includes our actor URL.
+ *
+ * @param {object} object - Fedify object (Note, Article, etc.)
+ * @param {string} ourActorUrl - Our actor's URL
+ * @param {string} followersUrl - Our followers collection URL
+ * @returns {boolean}
+ */
+function isDirectMessage(object, ourActorUrl, followersUrl) {
+  const allAddressed = [
+    ...object.toIds.map((u) => u.href),
+    ...object.ccIds.map((u) => u.href),
+    ...object.btoIds.map((u) => u.href),
+    ...object.bccIds.map((u) => u.href),
+  ];
+
+  // Must be addressed to us
+  if (!allAddressed.includes(ourActorUrl)) return false;
+
+  // Must NOT include public collection
+  if (allAddressed.some((u) => u === PUBLIC || u === "as:Public")) return false;
+
+  // Must NOT include our followers collection
+  if (followersUrl && allAddressed.includes(followersUrl)) return false;
+
+  return true;
+}
+
 export function registerInboxListeners(inboxChain, options) {
   const { collections, handle, storeRawActivities } = options;
 
@@ -400,6 +434,69 @@ export function registerInboxListeners(inboxChain, options) {
         actorObj?.preferredUsername?.toString() ||
         actorUrl;
 
+      // --- DM detection ---
+      // Check if this is a direct message before processing as reply/mention/timeline.
+      // DMs are handled separately and stored in ap_messages instead of ap_timeline.
+      const ourActorUrl = ctx.getActorUri(handle).href;
+      const followersUrl = ctx.getFollowersUri(handle)?.href || "";
+
+      if (isDirectMessage(object, ourActorUrl, followersUrl)) {
+        const actorInfo = await extractActorInfo(actorObj, { documentLoader: authLoader });
+        const rawHtml = object.content?.toString() || "";
+        const contentHtml = sanitizeContent(rawHtml);
+        const contentText = rawHtml.replace(/<[^>]*>/g, "").substring(0, 500);
+        const published = object.published ? String(object.published) : new Date().toISOString();
+        const inReplyToDM = object.replyTargetId?.href || null;
+
+        // Store as message
+        await addMessage(collections, {
+          uid: object.id?.href || `dm:${actorUrl}:${Date.now()}`,
+          actorUrl: actorInfo.url,
+          actorName: actorInfo.name,
+          actorPhoto: actorInfo.photo,
+          actorHandle: actorInfo.handle,
+          content: {
+            text: contentText,
+            html: contentHtml,
+          },
+          inReplyTo: inReplyToDM,
+          conversationId: actorInfo.url,
+          direction: "inbound",
+          published,
+          createdAt: new Date().toISOString(),
+        });
+
+        // Also create a notification so DMs appear in the notification tab
+        await addNotification(collections, {
+          uid: `dm:${object.id?.href || `${actorUrl}:${Date.now()}`}`,
+          url: object.url?.href || object.id?.href || "",
+          type: "dm",
+          actorUrl: actorInfo.url,
+          actorName: actorInfo.name,
+          actorPhoto: actorInfo.photo,
+          actorHandle: actorInfo.handle,
+          content: {
+            text: contentText,
+            html: contentHtml,
+          },
+          published,
+          createdAt: new Date().toISOString(),
+        });
+
+        await logActivity(collections, storeRawActivities, {
+          direction: "inbound",
+          type: "DirectMessage",
+          actorUrl,
+          actorName,
+          actorAvatar: actorInfo.photo || "",
+          objectUrl: object.id?.href || "",
+          content: contentText.substring(0, 100),
+          summary: `${actorName} sent a direct message`,
+        });
+
+        return; // Don't process DMs as timeline/mention/reply
+      }
+
       // Use replyTargetId (non-fetching) for the inReplyTo URL
       const inReplyTo = object.replyTargetId?.href || null;
 

package/lib/storage/messages.js

@@ -0,0 +1,175 @@
+/**
+ * Direct message storage operations
+ * @module storage/messages
+ */
+
+/**
+ * Add a message (uses atomic upsert for deduplication)
+ * @param {object} collections - MongoDB collections
+ * @param {object} message - Message data
+ * @param {string} message.uid - Activity/object ID (dedup key)
+ * @param {string} message.actorUrl - Other party's actor URL
+ * @param {string} message.actorName - Display name
+ * @param {string} message.actorPhoto - Avatar URL
+ * @param {string} message.actorHandle - @user@instance
+ * @param {object} message.content - { text, html } (sanitized)
+ * @param {string|null} message.inReplyTo - Parent message URL for threading
+ * @param {string} message.conversationId - Grouping key (other party's actorUrl)
+ * @param {"inbound"|"outbound"} message.direction - Message direction
+ * @param {string} message.published - ISO 8601 timestamp
+ * @param {string} message.createdAt - ISO 8601 creation timestamp
+ * @returns {Promise<object>} Created or existing message
+ */
+export async function addMessage(collections, message) {
+  const { ap_messages } = collections;
+
+  const result = await ap_messages.updateOne(
+    { uid: message.uid },
+    {
+      $setOnInsert: {
+        ...message,
+        read: message.direction === "outbound" ? true : false,
+      },
+    },
+    { upsert: true },
+  );
+
+  return await ap_messages.findOne({ uid: message.uid });
+}
+
+/**
+ * Get messages with cursor-based pagination
+ * @param {object} collections - MongoDB collections
+ * @param {object} options - Query options
+ * @param {string} [options.before] - Before cursor (published date ISO string)
+ * @param {number} [options.limit=20] - Items per page
+ * @param {string} [options.partner] - Filter by conversation partner (actorUrl)
+ * @returns {Promise<object>} { items, before }
+ */
+export async function getMessages(collections, options = {}) {
+  const { ap_messages } = collections;
+  const parsedLimit = Number.parseInt(options.limit, 10);
+  const limit = Math.min(
+    Number.isFinite(parsedLimit) && parsedLimit > 0 ? parsedLimit : 20,
+    100,
+  );
+
+  const query = {};
+
+  // Filter by conversation partner
+  if (options.partner) {
+    query.conversationId = options.partner;
+  }
+
+  // Cursor pagination — published is ISO string, lexicographic comparison works
+  if (options.before) {
+    query.published = { $lt: options.before };
+  }
+
+  const rawItems = await ap_messages
+    .find(query)
+    .sort({ published: -1 })
+    .limit(limit)
+    .toArray();
+
+  // Normalize published dates to ISO strings for Nunjucks | date filter
+  const items = rawItems.map((item) => ({
+    ...item,
+    published: item.published instanceof Date
+      ? item.published.toISOString()
+      : item.published,
+  }));
+
+  // Generate cursor for next page (only if full page returned = more may exist)
+  const before =
+    items.length === limit
+      ? items[items.length - 1].published
+      : null;
+
+  return {
+    items,
+    before,
+  };
+}
+
+/**
+ * Get conversation partners with last message date and unread count
+ * @param {object} collections - MongoDB collections
+ * @returns {Promise<Array>} Partners sorted by most recent message
+ */
+export async function getConversationPartners(collections) {
+  const { ap_messages } = collections;
+
+  const pipeline = [
+    {
+      $group: {
+        _id: "$conversationId",
+        actorName: { $last: "$actorName" },
+        actorPhoto: { $last: "$actorPhoto" },
+        actorHandle: { $last: "$actorHandle" },
+        lastMessage: { $max: "$published" },
+        unreadCount: {
+          $sum: { $cond: [{ $eq: ["$read", false] }, 1, 0] },
+        },
+      },
+    },
+    { $sort: { lastMessage: -1 } },
+  ];
+
+  return await ap_messages.aggregate(pipeline).toArray();
+}
+
+/**
+ * Get count of unread messages
+ * @param {object} collections - MongoDB collections
+ * @returns {Promise<number>} Unread message count
+ */
+export async function getUnreadMessageCount(collections) {
+  const { ap_messages } = collections;
+  return await ap_messages.countDocuments({ read: false });
+}
+
+/**
+ * Mark all messages from a partner as read
+ * @param {object} collections - MongoDB collections
+ * @param {string} actorUrl - Conversation partner's actor URL
+ * @returns {Promise<object>} Update result
+ */
+export async function markMessagesRead(collections, actorUrl) {
+  const { ap_messages } = collections;
+  return await ap_messages.updateMany(
+    { conversationId: actorUrl, read: false },
+    { $set: { read: true } },
+  );
+}
+
+/**
+ * Mark all messages as read
+ * @param {object} collections - MongoDB collections
+ * @returns {Promise<object>} Update result
+ */
+export async function markAllMessagesRead(collections) {
+  const { ap_messages } = collections;
+  return await ap_messages.updateMany({}, { $set: { read: true } });
+}
+
+/**
+ * Delete a single message by UID
+ * @param {object} collections - MongoDB collections
+ * @param {string} uid - Message UID
+ * @returns {Promise<object>} Delete result
+ */
+export async function deleteMessage(collections, uid) {
+  const { ap_messages } = collections;
+  return await ap_messages.deleteOne({ uid });
+}
+
+/**
+ * Delete all messages
+ * @param {object} collections - MongoDB collections
+ * @returns {Promise<object>} Delete result
+ */
+export async function clearAllMessages(collections) {
+  const { ap_messages } = collections;
+  return await ap_messages.deleteMany({});
+}

package/lib/storage/notifications.js

@@ -126,7 +126,7 @@ export async function getNotificationCountsByType(collections, unreadOnly = fals
 
   const results = await ap_notifications.aggregate(pipeline).toArray();
 
-  const counts = { all: 0, reply: 0, like: 0, boost: 0, follow: 0 };
+  const counts = { all: 0, reply: 0, like: 0, boost: 0, follow: 0, dm: 0 };
   for (const { _id, count } of results) {
     counts.all += count;
     if (_id === "reply" || _id === "mention") {

package/locales/en.json

@@ -165,10 +165,32 @@
         "replies": "Replies",
         "likes": "Likes",
         "boosts": "Boosts",
-        "follows": "Follows"
+        "follows": "Follows",
+        "dms": "DMs"
       },
       "emptyTab": "No %s notifications yet."
     },
+    "messages": {
+      "title": "Messages",
+      "empty": "No messages yet. Direct messages from other fediverse users will appear here.",
+      "allConversations": "All conversations",
+      "compose": "New message",
+      "send": "Send message",
+      "delete": "Delete",
+      "markAllRead": "Mark all read",
+      "clearAll": "Clear all",
+      "clearConfirm": "Delete all messages? This cannot be undone.",
+      "recipientLabel": "To",
+      "recipientPlaceholder": "@user@instance.social",
+      "placeholder": "Write your message...",
+      "sentTo": "To",
+      "replyingTo": "Replying to",
+      "sentYouDM": "sent you a direct message",
+      "viewMessage": "View message",
+      "errorEmpty": "Message content cannot be empty.",
+      "errorNoRecipient": "Please enter a recipient.",
+      "errorRecipientNotFound": "Could not find that user. Try a full @user@domain handle."
+    },
     "reader": {
       "title": "Reader",
       "tabs": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "2.8.1",
+  "version": "2.9.0",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",

package/views/activitypub-compose.njk

@@ -13,9 +13,9 @@
         </div>
       {% endif %}
       {% if replyContext.content and (replyContext.content.html or replyContext.content.text) %}
-        <blockquote class="ap-compose__context-text">
+        <div class="ap-card__content ap-compose__context-text">
           {{ replyContext.content.html | safe if replyContext.content.html else replyContext.content.text | truncate(300) }}
-        </blockquote>
+        </div>
       {% endif %}
       <a href="{{ replyTo }}" class="ap-compose__context-link" target="_blank" rel="noopener">{{ replyTo }}</a>
     </div>

package/views/activitypub-message-compose.njk

@@ -0,0 +1,59 @@
+{% extends "layouts/ap-reader.njk" %}
+
+{% from "heading/macro.njk" import heading with context %}
+
+{% block readercontent %}
+  {# Error message #}
+  {% if error %}
+    <div class="ap-compose__error">{{ error }}</div>
+  {% endif %}
+
+  {# Reply context — the message being replied to #}
+  {% if replyContext %}
+    <div class="ap-compose__context">
+      <div class="ap-compose__context-label">{{ __("activitypub.messages.replyingTo") }}</div>
+      <div class="ap-compose__context-author">
+        <a href="{{ replyContext.actorUrl }}">{{ replyContext.actorName }}</a>
+      </div>
+      {% if replyContext.content and (replyContext.content.html or replyContext.content.text) %}
+        <div class="ap-card__content ap-compose__context-text">
+          {{ replyContext.content.html | safe if replyContext.content.html else replyContext.content.text | truncate(300) }}
+        </div>
+      {% endif %}
+    </div>
+  {% endif %}
+
+  <form method="post" action="{{ mountPath }}/admin/reader/messages/compose" class="ap-compose__form">
+    <input type="hidden" name="_csrf" value="{{ csrfToken }}">
+    {% if replyTo %}
+      <input type="hidden" name="replyTo" value="{{ replyTo }}">
+    {% endif %}
+
+    {# Recipient field #}
+    <div class="ap-compose__field">
+      <label for="dm-to" class="ap-compose__label">{{ __("activitypub.messages.recipientLabel") }}</label>
+      <input type="text" id="dm-to" name="to" value="{{ to }}"
+        class="ap-compose__input"
+        placeholder="{{ __('activitypub.messages.recipientPlaceholder') }}"
+        required
+        autocomplete="off">
+    </div>
+
+    {# Content textarea #}
+    <div class="ap-compose__editor">
+      <textarea name="content" class="ap-compose__textarea"
+        rows="6"
+        placeholder="{{ __('activitypub.messages.placeholder') }}"
+        required></textarea>
+    </div>
+
+    <div class="ap-compose__actions">
+      <button type="submit" class="ap-compose__submit">
+        {{ __("activitypub.messages.send") }}
+      </button>
+      <a href="{{ mountPath }}/admin/reader/messages" class="ap-compose__cancel">
+        {{ __("activitypub.compose.cancel") }}
+      </a>
+    </div>
+  </form>
+{% endblock %}

package/views/activitypub-messages.njk

@@ -0,0 +1,78 @@
+{% extends "layouts/ap-reader.njk" %}
+
+{% from "heading/macro.njk" import heading with context %}
+{% from "prose/macro.njk" import prose with context %}
+
+{% block readercontent %}
+  {# Toolbar — compose + mark read + clear all #}
+  {% set msgBase = mountPath + "/admin/reader/messages" %}
+  <div class="ap-notifications__toolbar">
+    <a href="{{ msgBase }}/compose" class="ap-notifications__btn ap-notifications__btn--primary">
+      {{ __("activitypub.messages.compose") }}
+    </a>
+    {% if unreadCount > 0 %}
+      <form method="post" action="{{ msgBase }}/mark-read">
+        <input type="hidden" name="_csrf" value="{{ csrfToken }}">
+        <button type="submit" class="ap-notifications__btn">{{ __("activitypub.messages.markAllRead") }}</button>
+      </form>
+    {% endif %}
+    <form method="post" action="{{ msgBase }}/clear"
+          onsubmit="return confirm('{{ __("activitypub.messages.clearConfirm") }}')">
+      <input type="hidden" name="_csrf" value="{{ csrfToken }}">
+      <button type="submit" class="ap-notifications__btn ap-notifications__btn--danger">{{ __("activitypub.messages.clearAll") }}</button>
+    </form>
+  </div>
+
+  <div class="ap-messages__layout">
+    {# Conversation partner sidebar #}
+    {% if partners.length > 0 %}
+      <aside class="ap-messages__sidebar">
+        <a href="{{ msgBase }}" class="ap-messages__partner{% if not activePartner %} ap-messages__partner--active{% endif %}">
+          {{ __("activitypub.messages.allConversations") }}
+        </a>
+        {% for p in partners %}
+          <a href="{{ msgBase }}?partner={{ p._id | urlencode }}"
+             class="ap-messages__partner{% if activePartner == p._id %} ap-messages__partner--active{% endif %}">
+            <span class="ap-messages__partner-avatar" data-avatar-fallback>
+              {% if p.actorPhoto %}
+                <img src="{{ p.actorPhoto }}" alt="{{ p.actorName }}" loading="lazy" crossorigin="anonymous">
+              {% endif %}
+              <span class="ap-messages__partner-initial" aria-hidden="true">{{ p.actorName[0] | upper if p.actorName else "?" }}</span>
+            </span>
+            <span class="ap-messages__partner-info">
+              <span class="ap-messages__partner-name">{{ p.actorName }}</span>
+              {% if p.actorHandle %}
+                <span class="ap-messages__partner-handle">{{ p.actorHandle }}</span>
+              {% endif %}
+            </span>
+            {% if p.unreadCount > 0 %}
+              <span class="ap-tab__count">{{ p.unreadCount }}</span>
+            {% endif %}
+          </a>
+        {% endfor %}
+      </aside>
+    {% endif %}
+
+    {# Messages list #}
+    <div class="ap-messages__content">
+      {% if items.length > 0 %}
+        <div class="ap-timeline">
+          {% for item in items %}
+            {% include "partials/ap-message-card.njk" %}
+          {% endfor %}
+        </div>
+
+        {# Pagination — preserve active partner #}
+        {% if before %}
+          <nav class="ap-pagination">
+            <a href="?{% if activePartner %}partner={{ activePartner | urlencode }}&{% endif %}before={{ before }}" class="ap-pagination__next">
+              {{ __("activitypub.reader.pagination.older") }}
+            </a>
+          </nav>
+        {% endif %}
+      {% else %}
+        {{ prose({ text: __("activitypub.messages.empty") }) }}
+      {% endif %}
+    </div>
+  </div>
+{% endblock %}

package/views/activitypub-notifications.njk

@@ -23,6 +23,10 @@
       {{ __("activitypub.notifications.tabs.follows") }}
       {% if tabCounts.follow %}<span class="ap-tab__count">{{ tabCounts.follow }}</span>{% endif %}
     </a>
+    <a href="{{ notifBase }}?tab=dm" class="ap-tab{% if tab == 'dm' %} ap-tab--active{% endif %}">
+      {{ __("activitypub.notifications.tabs.dms") }}
+      {% if tabCounts.dm %}<span class="ap-tab__count">{{ tabCounts.dm }}</span>{% endif %}
+    </a>
     <a href="{{ notifBase }}?tab=all" class="ap-tab{% if tab == 'all' %} ap-tab--active{% endif %}">
       {{ __("activitypub.notifications.tabs.all") }}
       {% if tabCounts.all %}<span class="ap-tab__count">{{ tabCounts.all }}</span>{% endif %}

package/views/partials/ap-message-card.njk

@@ -0,0 +1,60 @@
+{# Message card partial — inbound/outbound DM display #}
+
+<div class="ap-notification{% if not item.read %} ap-notification--unread{% endif %}{% if item.direction == 'outbound' %} ap-message--outbound{% endif %}">
+  {# Dismiss button #}
+  <form method="post" action="{{ mountPath }}/admin/reader/messages/delete" class="ap-notification__dismiss">
+    <input type="hidden" name="_csrf" value="{{ csrfToken }}">
+    <input type="hidden" name="uid" value="{{ item.uid }}">
+    <button type="submit" class="ap-notification__dismiss-btn" title="{{ __('activitypub.messages.delete') }}">&times;</button>
+  </form>
+
+  {# Actor avatar with direction badge #}
+  <div class="ap-notification__avatar-wrap" data-avatar-fallback>
+    {% if item.actorPhoto %}
+    <img src="{{ item.actorPhoto }}" alt="{{ item.actorName }}" class="ap-notification__avatar" loading="lazy" crossorigin="anonymous">
+    {% endif %}
+    <span class="ap-notification__avatar ap-notification__avatar--default" aria-hidden="true">{{ item.actorName[0] | upper if item.actorName else "?" }}</span>
+    <span class="ap-notification__type-badge">
+      {% if item.direction == "outbound" %}↗{% else %}✉{% endif %}
+    </span>
+  </div>
+
+  {# Message body #}
+  <div class="ap-notification__body">
+    <span class="ap-notification__actor">
+      {% if item.direction == "outbound" %}
+        <span class="ap-message__direction">{{ __("activitypub.messages.sentTo") }}</span>
+      {% endif %}
+      <a href="{{ item.actorUrl }}">{{ item.actorName }}</a>
+      {% if item.actorHandle %}
+        <span class="ap-notification__handle">{{ item.actorHandle }}</span>
+      {% endif %}
+    </span>
+
+    {% if item.content and item.content.html %}
+      <div class="ap-message__content">
+        {{ item.content.html | safe }}
+      </div>
+    {% elif item.content and item.content.text %}
+      <div class="ap-message__content">
+        {{ item.content.text }}
+      </div>
+    {% endif %}
+
+    {# Reply action (only for inbound messages) #}
+    {% if item.direction == "inbound" %}
+      <div class="ap-notification__actions">
+        <a href="{{ mountPath }}/admin/reader/messages/compose?to={{ item.actorHandle | urlencode }}&replyTo={{ item.uid | urlencode }}" class="ap-notification__reply-btn">
+          ↩ {{ __("activitypub.reader.actions.reply") }}
+        </a>
+      </div>
+    {% endif %}
+  </div>
+
+  {# Timestamp #}
+  {% if item.published %}
+    <time datetime="{{ item.published }}" class="ap-notification__time" x-data x-relative-time>
+      {{ item.published | date("PPp") }}
+    </time>
+  {% endif %}
+</div>

package/views/partials/ap-notification-card.njk

@@ -15,7 +15,7 @@
     {% endif %}
     <span class="ap-notification__avatar ap-notification__avatar--default" aria-hidden="true">{{ item.actorName[0] | upper if item.actorName else "?" }}</span>
     <span class="ap-notification__type-badge">
-      {% if item.type == "like" %}❤{% elif item.type == "boost" %}🔁{% elif item.type == "follow" %}👤{% elif item.type == "reply" %}💬{% elif item.type == "mention" %}@{% endif %}
+      {% if item.type == "like" %}❤{% elif item.type == "boost" %}🔁{% elif item.type == "follow" %}👤{% elif item.type == "reply" %}💬{% elif item.type == "mention" %}@{% elif item.type == "dm" %}✉{% endif %}
     </span>
   </div>
 
@@ -36,6 +36,8 @@
         {{ __("activitypub.notifications.repliedTo") }}
       {% elif item.type == "mention" %}
         {{ __("activitypub.notifications.mentionedYou") }}
+      {% elif item.type == "dm" %}
+        {{ __("activitypub.messages.sentYouDM") }}
       {% endif %}
     </span>
 
@@ -60,6 +62,12 @@
           💬 {{ __("activitypub.notifications.viewThread") }}
         </a>
       </div>
+    {% elif item.type == "dm" %}
+      <div class="ap-notification__actions">
+        <a href="{{ mountPath }}/admin/reader/messages?partner={{ item.actorUrl | urlencode }}" class="ap-notification__thread-btn" title="{{ __('activitypub.messages.title') }}">
+          ✉ {{ __("activitypub.messages.viewMessage") }}
+        </a>
+      </div>
     {% endif %}
   </div>