@rmdes/indiekit-endpoint-activitypub 3.11.3 → 3.11.6

package/lib/mastodon/entities/status.js

@@ -44,7 +44,7 @@ export function setLocalIdentity(publicationUrl, handle) {
  * @param {Set<string>} [options.pinnedIds] - UIDs the user has pinned
  * @returns {object} Mastodon Status entity
  */
-export function serializeStatus(item, { baseUrl, favouritedIds, rebloggedIds, bookmarkedIds, pinnedIds }) {
+export function serializeStatus(item, { baseUrl, favouritedIds, rebloggedIds, bookmarkedIds, pinnedIds, replyIdMap } = {}) {
   if (!item) return null;
 
   // Use published-based cursor as the status ID so pagination cursors
@@ -204,8 +204,8 @@ export function serializeStatus(item, { baseUrl, favouritedIds, rebloggedIds, bo
   return {
     id,
     created_at: published,
-    in_reply_to_id: item.inReplyTo ? null : null, // TODO: resolve to local ID
-    in_reply_to_account_id: null, // TODO: resolve
+    in_reply_to_id: replyIdMap?.get(item.inReplyTo) ?? null,
+    in_reply_to_account_id: null,
     sensitive,
     spoiler_text: spoilerText,
     visibility,

package/lib/mastodon/helpers/resolve-reply-ids.js

@@ -0,0 +1,44 @@
+/**
+ * Batch-resolve inReplyTo URLs to Mastodon cursor IDs.
+ *
+ * Looks up parent posts in ap_timeline by uid/url and returns a Map
+ * of inReplyTo URL → cursor ID (milliseconds since epoch as string).
+ * Used by route handlers before calling serializeStatus().
+ *
+ * @param {object} collection - ap_timeline MongoDB collection
+ * @param {Array<object>} items - Timeline items with optional inReplyTo
+ * @returns {Promise<Map<string, string>>} Map of URL → cursor ID
+ */
+import { encodeCursor } from "./pagination.js";
+
+export async function resolveReplyIds(collection, items) {
+  const map = new Map();
+  if (!collection || !items?.length) return map;
+
+  // Collect unique inReplyTo URLs
+  const urls = [
+    ...new Set(
+      items
+        .map((item) => item.inReplyTo)
+        .filter(Boolean),
+    ),
+  ];
+  if (urls.length === 0) return map;
+
+  // Batch lookup parents by uid or url
+  const parents = await collection
+    .find({ $or: [{ uid: { $in: urls } }, { url: { $in: urls } }] })
+    .project({ uid: 1, url: 1, published: 1 })
+    .toArray();
+
+  for (const parent of parents) {
+    const cursorId = encodeCursor(parent.published);
+    if (cursorId && cursorId !== "0") {
+      // Map both uid and url to the cursor ID
+      if (parent.uid) map.set(parent.uid, cursorId);
+      if (parent.url && parent.url !== parent.uid) map.set(parent.url, cursorId);
+    }
+  }
+
+  return map;
+}

package/lib/mastodon/routes/media.js

@@ -98,8 +98,13 @@ router.post(
     try {
       const { application } = req.app.locals;
       const collections = req.app.locals.mastodonCollections;
+      // Use IndieAuth token stored during OAuth authorization, falling back
+      // to session token (native reader) or Mastodon token (won't work for
+      // Micropub media endpoint but covers direct internal calls).
       const token =
-        req.session?.access_token || req.mastodonToken?.accessToken;
+        req.session?.access_token ||
+        req.mastodonToken?.indieauthToken ||
+        req.mastodonToken?.accessToken;
 
       const file = req.files?.file;
       if (!file) {
@@ -142,8 +147,13 @@ router.post(
     try {
       const { application } = req.app.locals;
       const collections = req.app.locals.mastodonCollections;
+      // Use IndieAuth token stored during OAuth authorization, falling back
+      // to session token (native reader) or Mastodon token (won't work for
+      // Micropub media endpoint but covers direct internal calls).
       const token =
-        req.session?.access_token || req.mastodonToken?.accessToken;
+        req.session?.access_token ||
+        req.mastodonToken?.indieauthToken ||
+        req.mastodonToken?.accessToken;
 
       const file = req.files?.file;
       if (!file) {

package/lib/mastodon/routes/oauth.js

@@ -388,6 +388,9 @@ router.post("/oauth/authorize", async (req, res, next) => {
       redirectUri: redirect_uri,
       codeChallenge: code_challenge || null,
       codeChallengeMethod: code_challenge_method || null,
+      // Store the IndieAuth session token so Mastodon API routes can call
+      // Micropub/media endpoints on behalf of this user (single-user server).
+      indieauthToken: req.session?.access_token || null,
       createdAt: new Date(),
       expiresAt: new Date(Date.now() + 10 * 60 * 1000), // 10 minutes
     });

package/lib/mastodon/routes/statuses.js

@@ -18,6 +18,7 @@ import express from "express";
 import { ObjectId } from "mongodb";
 import { serializeStatus } from "../entities/status.js";
 import { decodeCursor } from "../helpers/pagination.js";
+import { resolveReplyIds } from "../helpers/resolve-reply-ids.js";
 import {
   likePost, unlikePost,
   boostPost, unboostPost,
@@ -43,11 +44,13 @@ router.get("/api/v1/statuses/:id", tokenRequired, scopeRequired("read", "read:st
 
     // Load interaction state if authenticated
     const interactionState = await loadItemInteractions(collections, item);
+    const replyIdMap = await resolveReplyIds(collections.ap_timeline, [item]);
 
     const status = serializeStatus(item, {
       baseUrl,
       ...interactionState,
       pinnedIds: new Set(),
+      replyIdMap,
     });
 
     res.json(status);
@@ -122,7 +125,9 @@ router.get("/api/v1/statuses/:id/context", tokenRequired, scopeRequired("read",
       pinnedIds: new Set(),
     };
 
-    const serializeOpts = { baseUrl, ...emptyInteractions };
+    const allItems = [...ancestors, ...descendants];
+    const replyIdMap = await resolveReplyIds(collections.ap_timeline, allItems);
+    const serializeOpts = { baseUrl, ...emptyInteractions, replyIdMap };
 
     res.json({
       ancestors: ancestors.map((a) => serializeStatus(a, serializeOpts)),
@@ -245,7 +250,7 @@ router.post("/api/v1/statuses", tokenRequired, scopeRequired("write", "write:sta
     for (const m of mediaUrls) {
       if (m.type?.startsWith("image/")) {
         if (!jf2.photo) jf2.photo = [];
-        jf2.photo.push({ value: m.url, alt: m.alt });
+        jf2.photo.push({ url: m.url, alt: m.alt });
       } else if (m.type?.startsWith("video/")) {
         if (!jf2.video) jf2.video = [];
         jf2.video.push(m.url);

package/lib/mastodon/routes/timelines.js

@@ -8,6 +8,7 @@
 import express from "express";
 import { serializeStatus } from "../entities/status.js";
 import { buildPaginationQuery, parseLimit, setPaginationHeaders } from "../helpers/pagination.js";
+import { resolveReplyIds } from "../helpers/resolve-reply-ids.js";
 import { loadModerationData, applyModerationFilters } from "../../item-processing.js";
 import { enrichAccountStats } from "../helpers/enrich-accounts.js";
 import { tokenRequired } from "../middleware/token-required.js";
@@ -63,6 +64,9 @@ router.get("/api/v1/timelines/home", tokenRequired, scopeRequired("read", "read:
       items,
     );
 
+    // Resolve reply parent IDs for threading
+    const replyIdMap = await resolveReplyIds(collections.ap_timeline, items);
+
     // Serialize to Mastodon Status entities
     const statuses = items.map((item) =>
       serializeStatus(item, {
@@ -71,6 +75,7 @@ router.get("/api/v1/timelines/home", tokenRequired, scopeRequired("read", "read:
         rebloggedIds,
         bookmarkedIds,
         pinnedIds: new Set(),
+        replyIdMap,
       }),
     );
 
@@ -163,6 +168,8 @@ router.get("/api/v1/timelines/public", async (req, res, next) => {
       ));
     }
 
+    const replyIdMap = await resolveReplyIds(collections.ap_timeline, items);
+
     const statuses = items.map((item) =>
       serializeStatus(item, {
         baseUrl,
@@ -170,6 +177,7 @@ router.get("/api/v1/timelines/public", async (req, res, next) => {
         rebloggedIds,
         bookmarkedIds,
         pinnedIds: new Set(),
+        replyIdMap,
       }),
     );
 
@@ -226,6 +234,8 @@ router.get("/api/v1/timelines/tag/:hashtag", async (req, res, next) => {
       ));
     }
 
+    const replyIdMap = await resolveReplyIds(collections.ap_timeline, items);
+
     const statuses = items.map((item) =>
       serializeStatus(item, {
         baseUrl,
@@ -233,6 +243,7 @@ router.get("/api/v1/timelines/tag/:hashtag", async (req, res, next) => {
         rebloggedIds,
         bookmarkedIds,
         pinnedIds: new Set(),
+        replyIdMap,
       }),
     );
 

package/lib/syndicator.js

@@ -344,8 +344,19 @@ function buildTimelineContent(properties) {
     };
   }
 
-  // Regular post — return body content as-is
+  // Regular post — append permalink to match federated AS2 content.
+  // Without this, the Mastodon API timeline entry lacks the link back
+  // to the source post that fediverse users see via federation.
   if (bodyText || bodyHtml) {
+    const postUrl = properties.url;
+    if (postUrl) {
+      const linkText = `\n\n\u{1F517} ${postUrl}`;
+      const linkHtml = `<p>\u{1F517} <a href="${esc(postUrl)}">${esc(postUrl)}</a></p>`;
+      return {
+        text: `${bodyText}${linkText}`,
+        html: `${bodyHtml}\n${linkHtml}`,
+      };
+    }
     return { text: bodyText, html: bodyHtml };
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.11.3",
+  "version": "3.11.6",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",