@rmdes/indiekit-endpoint-activitypub 3.11.2 → 3.11.4

package/lib/mastodon/router.js

@@ -67,18 +67,10 @@ export function createMastodonRouter({ collections, pluginOptions = {} }) {
 
   // ─── Body parsers ───────────────────────────────────────────────────────
   // Mastodon clients send JSON, form-urlencoded, and occasionally text/plain.
-  // Skip multipart/form-data requests — multer handles those in media routes.
-  // If express.json/urlencoded consume the stream first, multer gets nothing.
-  const jsonParser = express.json();
-  const urlencodedParser = express.urlencoded({ extended: true });
-  router.use("/api", (req, res, next) => {
-    if (req.is("multipart/form-data")) return next();
-    jsonParser(req, res, next);
-  });
-  router.use("/api", (req, res, next) => {
-    if (req.is("multipart/form-data")) return next();
-    urlencodedParser(req, res, next);
-  });
+  // Note: multipart/form-data is handled globally by express-fileupload
+  // (configured in Indiekit's express.js), so no multer needed here.
+  router.use("/api", express.json());
+  router.use("/api", express.urlencoded({ extended: true }));
   router.use("/oauth", express.json());
   router.use("/oauth", express.urlencoded({ extended: true }));
 

package/lib/mastodon/routes/media.js

@@ -5,18 +5,16 @@
  * POST /api/v1/media — legacy upload (same as v2)
  * GET /api/v1/media/:id — get media attachment metadata
  * PUT /api/v1/media/:id — update media metadata (description/focus)
+ *
+ * File uploads are handled by express-fileupload (configured globally by
+ * Indiekit's express.js). Files arrive on req.files, NOT req.file (multer).
  */
 import express from "express";
-import multer from "multer";
 import { ObjectId } from "mongodb";
 import { tokenRequired } from "../middleware/token-required.js";
 import { scopeRequired } from "../middleware/scope-required.js";
 
 const router = express.Router(); // eslint-disable-line new-cap
-const upload = multer({
-  storage: multer.memoryStorage(),
-  limits: { fileSize: 40 * 1024 * 1024 },
-});
 
 /**
  * Determine Mastodon media type from MIME type.
@@ -54,6 +52,7 @@ function serializeMediaAttachment(doc) {
 
 /**
  * Upload file to the Micropub media endpoint.
+ * Accepts an express-fileupload file object (has .data Buffer, .mimetype, .name).
  * Returns the URL from the Location header.
  */
 async function uploadToMediaEndpoint(file, application, token) {
@@ -67,8 +66,8 @@ async function uploadToMediaEndpoint(file, application, token) {
     : new URL(mediaEndpoint, application.url).href;
 
   const formData = new FormData();
-  const blob = new Blob([file.buffer], { type: file.mimetype });
-  formData.append("file", blob, file.originalname);
+  const blob = new Blob([file.data], { type: file.mimetype });
+  formData.append("file", blob, file.name);
 
   const response = await fetch(mediaUrl, {
     method: "POST",
@@ -95,15 +94,20 @@ router.post(
   "/api/v2/media",
   tokenRequired,
   scopeRequired("write", "write:media"),
-  upload.single("file"),
   async (req, res, next) => {
     try {
       const { application } = req.app.locals;
       const collections = req.app.locals.mastodonCollections;
+      // Use IndieAuth token stored during OAuth authorization, falling back
+      // to session token (native reader) or Mastodon token (won't work for
+      // Micropub media endpoint but covers direct internal calls).
       const token =
-        req.session?.access_token || req.mastodonToken?.accessToken;
+        req.session?.access_token ||
+        req.mastodonToken?.indieauthToken ||
+        req.mastodonToken?.accessToken;
 
-      if (!req.file) {
+      const file = req.files?.file;
+      if (!file) {
         return res.status(422).json({ error: "No file provided" });
       }
 
@@ -113,17 +117,13 @@ router.post(
           .json({ error: "Authentication required for media upload" });
       }
 
-      const fileUrl = await uploadToMediaEndpoint(
-        req.file,
-        application,
-        token,
-      );
+      const fileUrl = await uploadToMediaEndpoint(file, application, token);
 
       const doc = {
         url: fileUrl,
         description: req.body.description || "",
         focus: req.body.focus || null,
-        mimeType: req.file.mimetype,
+        mimeType: file.mimetype,
         createdAt: new Date(),
       };
 
@@ -143,15 +143,20 @@ router.post(
   "/api/v1/media",
   tokenRequired,
   scopeRequired("write", "write:media"),
-  upload.single("file"),
   async (req, res, next) => {
     try {
       const { application } = req.app.locals;
       const collections = req.app.locals.mastodonCollections;
+      // Use IndieAuth token stored during OAuth authorization, falling back
+      // to session token (native reader) or Mastodon token (won't work for
+      // Micropub media endpoint but covers direct internal calls).
       const token =
-        req.session?.access_token || req.mastodonToken?.accessToken;
+        req.session?.access_token ||
+        req.mastodonToken?.indieauthToken ||
+        req.mastodonToken?.accessToken;
 
-      if (!req.file) {
+      const file = req.files?.file;
+      if (!file) {
         return res.status(422).json({ error: "No file provided" });
       }
 
@@ -161,17 +166,13 @@ router.post(
           .json({ error: "Authentication required for media upload" });
       }
 
-      const fileUrl = await uploadToMediaEndpoint(
-        req.file,
-        application,
-        token,
-      );
+      const fileUrl = await uploadToMediaEndpoint(file, application, token);
 
       const doc = {
         url: fileUrl,
         description: req.body.description || "",
         focus: req.body.focus || null,
-        mimeType: req.file.mimetype,
+        mimeType: file.mimetype,
         createdAt: new Date(),
       };
 

package/lib/mastodon/routes/oauth.js

@@ -388,6 +388,9 @@ router.post("/oauth/authorize", async (req, res, next) => {
       redirectUri: redirect_uri,
       codeChallenge: code_challenge || null,
       codeChallengeMethod: code_challenge_method || null,
+      // Store the IndieAuth session token so Mastodon API routes can call
+      // Micropub/media endpoints on behalf of this user (single-user server).
+      indieauthToken: req.session?.access_token || null,
       createdAt: new Date(),
       expiresAt: new Date(Date.now() + 10 * 60 * 1000), // 10 minutes
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.11.2",
+  "version": "3.11.4",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",
@@ -45,7 +45,6 @@
     "express": "^5.0.0",
     "express-rate-limit": "^7.5.1",
     "ioredis": "^5.9.3",
-    "multer": "^2.1.1",
     "sanitize-html": "^2.13.1",
     "unfurl.js": "^6.4.0"
   },