@rmdes/indiekit-endpoint-activitypub 3.12.2 → 3.12.4

package/lib/mastodon/entities/status.js

@@ -15,6 +15,7 @@
  */
 import { serializeAccount } from "./account.js";
 import { sanitizeHtml } from "./sanitize.js";
+import { remoteActorId } from "../helpers/id-mapping.js";
 
 // Module-level defaults set once at startup via setLocalIdentity()
 let _localPublicationUrl = "";
@@ -178,13 +179,17 @@ export function serializeStatus(item, { baseUrl, favouritedIds, rebloggedIds, bo
     url: `${baseUrl}/tags/${encodeURIComponent(tag)}`,
   }));
 
-  // Mentions
-  const mentions = (item.mentions || []).map((m) => ({
-    id: "0", // We don't have stable IDs for mentioned accounts
-    username: m.name || "",
-    url: m.url || "",
-    acct: m.name || "",
-  }));
+  // Mentions — use actorUrl for deterministic ID, parse acct from handle
+  const mentions = (item.mentions || []).map((m) => {
+    const handle = (m.name || "").replace(/^@/, "");
+    const parts = handle.split("@");
+    return {
+      id: m.actorUrl ? remoteActorId(m.actorUrl) : "0",
+      username: parts[0] || handle,
+      url: m.url || m.actorUrl || "",
+      acct: handle,
+    };
+  });
 
   // Custom emojis
   const emojis = (item.emojis || []).map((e) => ({

package/lib/mastodon/routes/oauth.js

@@ -467,7 +467,6 @@ router.post("/oauth/token", async (req, res, next) => {
         accessToken,
         createdAt: new Date(),
         grantType: "client_credentials",
-        expiresAt: new Date(Date.now() + 3600 * 1000),
       });
 
       return res.json({
@@ -475,7 +474,6 @@ router.post("/oauth/token", async (req, res, next) => {
         token_type: "Bearer",
         scope: "read",
         created_at: Math.floor(Date.now() / 1000),
-        expires_in: 3600,
       });
     }
 
@@ -510,9 +508,9 @@ router.post("/oauth/token", async (req, res, next) => {
           $set: {
             accessToken: newAccessToken,
             refreshToken: newRefreshToken,
-            expiresAt: new Date(Date.now() + 3600 * 1000),
             refreshExpiresAt: new Date(Date.now() + 90 * 24 * 3600 * 1000),
           },
+          $unset: { expiresAt: "" },
         },
       );
 
@@ -522,7 +520,6 @@ router.post("/oauth/token", async (req, res, next) => {
         scope: existing.scopes.join(" "),
         created_at: Math.floor(existing.createdAt.getTime() / 1000),
         refresh_token: newRefreshToken,
-        expires_in: 3600,
       });
     }
 
@@ -590,8 +587,9 @@ router.post("/oauth/token", async (req, res, next) => {
       }
     }
 
-    // Generate access token and refresh token with expiry.
-    const ACCESS_TOKEN_TTL = 3600 * 1000; // 1 hour
+    // Generate access token and refresh token.
+    // Access tokens do not expire (matching Mastodon behavior — valid until revoked).
+    // Refresh tokens expire after 90 days as a safety measure.
     const REFRESH_TOKEN_TTL = 90 * 24 * 3600 * 1000; // 90 days
     const accessToken = randomHex(64);
     const refreshToken = randomHex(64);
@@ -601,7 +599,6 @@ router.post("/oauth/token", async (req, res, next) => {
         $set: {
           accessToken,
           refreshToken,
-          expiresAt: new Date(Date.now() + ACCESS_TOKEN_TTL),
           refreshExpiresAt: new Date(Date.now() + REFRESH_TOKEN_TTL),
         },
       },
@@ -613,7 +610,6 @@ router.post("/oauth/token", async (req, res, next) => {
       scope: grant.scopes.join(" "),
       created_at: Math.floor(grant.createdAt.getTime() / 1000),
       refresh_token: refreshToken,
-      expires_in: 3600,
     });
   } catch (error) {
     next(error);

package/lib/syndicator.js

@@ -227,11 +227,39 @@ export function createSyndicator(plugin) {
           const content = buildTimelineContent(properties);
           // Permalink is appended at read time by serializeStatus, not here.
 
+          // Linkify @mentions in content using resolved WebFinger data.
+          // This ensures the ap_timeline HTML has proper <a> links for
+          // mentions, matching what the federated AS2 activity contains.
+          if (resolvedMentions.length > 0 && content.html) {
+            const { default: jf2Mod } = await import("./jf2-to-as2.js");
+            // Import linkifyMentions — it's not exported, so inline the logic
+            for (const { handle, profileUrl, actorUrl } of resolvedMentions) {
+              const escaped = handle.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+              const pattern = new RegExp(`(?<!["\\/\\w])@${escaped}(?![\\w])`, "gi");
+              const parts = handle.split("@");
+              const url = profileUrl || (actorUrl ? actorUrl : `https://${parts[1]}/@${parts[0]}`);
+              content.html = content.html.replace(
+                pattern,
+                `<a href="${url}" class="mention" rel="nofollow noopener" target="_blank">@${handle}</a>`,
+              );
+            }
+          }
+
+          // Store resolved mentions for Mastodon API serialization
+          const timelineMentions = resolvedMentions
+            .filter(m => m.actorUrl)
+            .map(m => ({
+              name: `@${m.handle}`,
+              url: m.profileUrl || m.actorUrl,
+              actorUrl: m.actorUrl,
+            }));
+
           const timelineItem = {
             uid: properties.url,
             url: properties.url,
             type: mapPostType(properties["post-type"]),
             content,
+            mentions: timelineMentions,
             author: {
               name: profile?.name || handle,
               url: profile?.url || plugin._publicationUrl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.12.2",
+  "version": "3.12.4",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",