@rmdes/indiekit-endpoint-activitypub 3.13.10 → 3.13.12

package/lib/defaults.js

@@ -0,0 +1,37 @@
+/**
+ * Default plugin options for @rmdes/indiekit-endpoint-activitypub.
+ * Merged over user options in the endpoint constructor.
+ */
+export const DEFAULTS = {
+  mountPath: "/activitypub",
+  actor: {
+    handle: "rick",
+    name: "",
+    summary: "",
+    icon: "",
+  },
+  checked: true,
+  alsoKnownAs: "",
+  activityRetentionDays: 90,
+  storeRawActivities: false,
+  redisUrl: "",
+  parallelWorkers: 5,
+  actorType: "Person",
+  logLevel: "warning",
+  timelineRetention: 1000,
+  notificationRetentionDays: 30,
+  debugDashboard: false,
+  debugPassword: "",
+  defaultVisibility: "public", // "public" | "unlisted" | "followers"
+};
+
+/**
+ * Merge user options over defaults (deep-merges the nested `actor` object).
+ * @param {object} [options]
+ * @returns {object} resolved options
+ */
+export function resolveOptions(options = {}) {
+  const merged = { ...DEFAULTS, ...options };
+  merged.actor = { ...DEFAULTS.actor, ...options.actor };
+  return merged;
+}

package/lib/endpoint-federation.js

@@ -0,0 +1,407 @@
+/**
+ * Federation send-path actions, extracted from the index.js god-entry
+ * (Phase 2). Each takes `self` (the ActivityPubEndpoint instance); the class
+ * keeps thin delegating methods so the public interface + the init() facade
+ * are preserved. Internal cross-calls go directly to the module functions.
+ */
+import {
+  needsDirectFollow,
+  sendDirectFollow,
+  sendDirectUnfollow,
+} from "./direct-follow.js";
+import { lookupWithSecurity } from "./lookup-helpers.js";
+import { logActivity } from "./activity-log.js";
+import { batchBroadcast } from "./batch-broadcast.js";
+import { buildPersonActor } from "./federation-setup.js";
+import { jf2ToAS2Activity } from "./jf2-to-as2.js";
+
+/**
+ * Load the RSA private key from ap_keys for direct HTTP Signature signing.
+ * @returns {Promise<CryptoKey|null>}
+ */
+export async function loadRsaPrivateKey(self) {
+  try {
+    const keyDoc = await self._collections.ap_keys.findOne({
+      privateKeyPem: { $exists: true },
+    });
+    if (!keyDoc?.privateKeyPem) return null;
+    const pemBody = keyDoc.privateKeyPem
+      .replace(/-----[^-]+-----/g, "")
+      .replace(/\s/g, "");
+    return await crypto.subtle.importKey(
+      "pkcs8",
+      Buffer.from(pemBody, "base64"),
+      { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+      true,
+      ["sign"],
+    );
+  } catch (error) {
+    console.error("[ActivityPub] Failed to load RSA key:", error.message);
+    return null;
+  }
+}
+
+/** Send a Follow activity to a remote actor and store in ap_following. */
+export async function followActor(self, actorUrl, actorInfo = {}) {
+  if (!self._federation) {
+    return { ok: false, error: "Federation not initialized" };
+  }
+
+  try {
+    const { Follow } = await import("@fedify/fedify/vocab");
+    const handle = self.options.actor.handle;
+    const ctx = self._federation.createContext(
+      new URL(self._publicationUrl),
+      { handle, publicationUrl: self._publicationUrl },
+    );
+
+    // Resolve the remote actor to get their inbox
+    // lookupWithSecurity handles signed→unsigned fallback automatically
+    const documentLoader = await ctx.getDocumentLoader({
+      identifier: handle,
+    });
+    const remoteActor = await lookupWithSecurity(ctx, actorUrl, {
+      documentLoader,
+    });
+    if (!remoteActor) {
+      return { ok: false, error: "Could not resolve remote actor" };
+    }
+
+    // Send Follow activity
+    if (needsDirectFollow(actorUrl)) {
+      // tags.pub rejects Fedify's LD Signature context (identity/v1).
+      // Send a minimal signed Follow directly, bypassing the outbox pipeline.
+      // See: https://github.com/social-web-foundation/tags.pub/issues/10
+      const rsaKey = await loadRsaPrivateKey(self);
+      if (!rsaKey) {
+        return { ok: false, error: "No RSA key available for direct follow" };
+      }
+      const result = await sendDirectFollow({
+        actorUri: ctx.getActorUri(handle).href,
+        targetActorUrl: actorUrl,
+        inboxUrl: remoteActor.inboxId?.href,
+        keyId: `${ctx.getActorUri(handle).href}#main-key`,
+        privateKey: rsaKey,
+      });
+      if (!result.ok) {
+        return { ok: false, error: result.error };
+      }
+    } else {
+      const follow = new Follow({
+        actor: ctx.getActorUri(handle),
+        object: new URL(actorUrl),
+      });
+      await ctx.sendActivity({ identifier: handle }, remoteActor, follow, {
+        orderingKey: actorUrl,
+      });
+    }
+
+    // Store in ap_following
+    const name =
+      actorInfo.name ||
+      remoteActor.name?.toString() ||
+      remoteActor.preferredUsername?.toString() ||
+      actorUrl;
+    const actorHandle =
+      actorInfo.handle ||
+      remoteActor.preferredUsername?.toString() ||
+      "";
+    const avatar =
+      actorInfo.photo ||
+      (remoteActor.icon
+        ? (await remoteActor.icon)?.url?.href || ""
+        : "");
+    const inbox = remoteActor.inboxId?.href || "";
+    const sharedInbox = remoteActor.endpoints?.sharedInbox?.href || "";
+
+    await self._collections.ap_following.updateOne(
+      { actorUrl },
+      {
+        $set: {
+          actorUrl,
+          handle: actorHandle,
+          name,
+          avatar,
+          inbox,
+          sharedInbox,
+          followedAt: new Date().toISOString(),
+          source: "reader",
+        },
+      },
+      { upsert: true },
+    );
+
+    console.info(`[ActivityPub] Sent Follow to ${actorUrl}`);
+
+    await logActivity(self._collections.ap_activities, {
+      direction: "outbound",
+      type: "Follow",
+      actorUrl: self._publicationUrl,
+      objectUrl: actorUrl,
+      actorName: name,
+      summary: `Sent Follow to ${name} (${actorUrl})`,
+    });
+
+    return { ok: true };
+  } catch (error) {
+    console.error(`[ActivityPub] Follow failed for ${actorUrl}:`, error.message);
+
+    await logActivity(self._collections.ap_activities, {
+      direction: "outbound",
+      type: "Follow",
+      actorUrl: self._publicationUrl,
+      objectUrl: actorUrl,
+      summary: `Follow failed for ${actorUrl}: ${error.message}`,
+    }).catch(() => {});
+
+    return { ok: false, error: error.message };
+  }
+}
+
+/** Send an Undo(Follow) activity and remove from ap_following. */
+export async function unfollowActor(self, actorUrl) {
+  if (!self._federation) {
+    return { ok: false, error: "Federation not initialized" };
+  }
+
+  try {
+    const { Follow, Undo } = await import("@fedify/fedify/vocab");
+    const handle = self.options.actor.handle;
+    const ctx = self._federation.createContext(
+      new URL(self._publicationUrl),
+      { handle, publicationUrl: self._publicationUrl },
+    );
+
+    // Use authenticated document loader for servers requiring Authorized Fetch
+    const documentLoader = await ctx.getDocumentLoader({
+      identifier: handle,
+    });
+    const remoteActor = await lookupWithSecurity(ctx, actorUrl, {
+      documentLoader,
+    });
+    if (!remoteActor) {
+      // Even if we can't resolve, remove locally
+      await self._collections.ap_following.deleteOne({ actorUrl });
+
+      await logActivity(self._collections.ap_activities, {
+        direction: "outbound",
+        type: "Undo(Follow)",
+        actorUrl: self._publicationUrl,
+        objectUrl: actorUrl,
+        summary: `Removed ${actorUrl} locally (could not resolve remote actor)`,
+      }).catch(() => {});
+
+      return { ok: true };
+    }
+
+    if (needsDirectFollow(actorUrl)) {
+      // tags.pub rejects Fedify's LD Signature context (identity/v1).
+      // See: https://github.com/social-web-foundation/tags.pub/issues/10
+      const rsaKey = await loadRsaPrivateKey(self);
+      if (rsaKey) {
+        const result = await sendDirectUnfollow({
+          actorUri: ctx.getActorUri(handle).href,
+          targetActorUrl: actorUrl,
+          inboxUrl: remoteActor.inboxId?.href,
+          keyId: `${ctx.getActorUri(handle).href}#main-key`,
+          privateKey: rsaKey,
+        });
+        if (!result.ok) {
+          console.warn(`[ActivityPub] Direct unfollow failed for ${actorUrl}: ${result.error}`);
+        }
+      }
+    } else {
+      const follow = new Follow({
+        actor: ctx.getActorUri(handle),
+        object: new URL(actorUrl),
+      });
+      const undo = new Undo({
+        actor: ctx.getActorUri(handle),
+        object: follow,
+      });
+      await ctx.sendActivity({ identifier: handle }, remoteActor, undo, {
+        orderingKey: actorUrl,
+      });
+    }
+    await self._collections.ap_following.deleteOne({ actorUrl });
+
+    console.info(`[ActivityPub] Sent Undo(Follow) to ${actorUrl}`);
+
+    await logActivity(self._collections.ap_activities, {
+      direction: "outbound",
+      type: "Undo(Follow)",
+      actorUrl: self._publicationUrl,
+      objectUrl: actorUrl,
+      summary: `Sent Undo(Follow) to ${actorUrl}`,
+    });
+
+    return { ok: true };
+  } catch (error) {
+    console.error(`[ActivityPub] Unfollow failed for ${actorUrl}:`, error.message);
+
+    await logActivity(self._collections.ap_activities, {
+      direction: "outbound",
+      type: "Undo(Follow)",
+      actorUrl: self._publicationUrl,
+      objectUrl: actorUrl,
+      summary: `Unfollow failed for ${actorUrl}: ${error.message}`,
+    }).catch(() => {});
+
+    // Remove locally even if remote delivery fails
+    await self._collections.ap_following.deleteOne({ actorUrl }).catch(() => {});
+    return { ok: false, error: error.message };
+  }
+}
+
+/** Send an Update(Person) to all followers so they re-fetch the actor. */
+export async function broadcastActorUpdate(self) {
+  if (!self._federation) return;
+
+  try {
+    const { Update } = await import("@fedify/fedify/vocab");
+    const handle = self.options.actor.handle;
+    const ctx = self._federation.createContext(
+      new URL(self._publicationUrl),
+      { handle, publicationUrl: self._publicationUrl },
+    );
+
+    const actor = await buildPersonActor(
+      ctx,
+      handle,
+      self._collections,
+      self.options.actorType,
+    );
+    if (!actor) {
+      console.warn("[ActivityPub] broadcastActorUpdate: could not build actor");
+      return;
+    }
+
+    const update = new Update({
+      actor: ctx.getActorUri(handle),
+      object: actor,
+    });
+
+    await batchBroadcast({
+      federation: self._federation,
+      collections: self._collections,
+      publicationUrl: self._publicationUrl,
+      handle,
+      activity: update,
+      label: "Update(Person)",
+      objectUrl: getActorUrl(self),
+    });
+  } catch (error) {
+    console.error("[ActivityPub] broadcastActorUpdate failed:", error.message);
+  }
+}
+
+/** Send a Delete activity to all followers for a removed post. */
+export async function broadcastDelete(self, postUrl) {
+  if (!self._federation) return;
+
+  try {
+    const { Delete } = await import("@fedify/fedify/vocab");
+    const handle = self.options.actor.handle;
+    const ctx = self._federation.createContext(
+      new URL(self._publicationUrl),
+      { handle, publicationUrl: self._publicationUrl },
+    );
+
+    const del = new Delete({
+      actor: ctx.getActorUri(handle),
+      object: new URL(postUrl),
+    });
+
+    await batchBroadcast({
+      federation: self._federation,
+      collections: self._collections,
+      publicationUrl: self._publicationUrl,
+      handle,
+      activity: del,
+      label: "Delete",
+      objectUrl: postUrl,
+    });
+  } catch (error) {
+    console.warn("[ActivityPub] broadcastDelete failed:", error.message);
+  }
+}
+
+/** Micropub delete hook: record a tombstone (FEP-4f05) + broadcast Delete. */
+export async function deletePost(self, url) {
+  // Record tombstone for FEP-4f05
+  try {
+    const { addTombstone } = await import("./storage/tombstones.js");
+    const postsCol = self._collections.posts;
+    const post = postsCol ? await postsCol.findOne({ "properties.url": url }) : null;
+    await addTombstone(self._collections, {
+      url,
+      formerType: post?.properties?.["post-type"] === "article" ? "Article" : "Note",
+      published: post?.properties?.published || null,
+      deleted: new Date().toISOString(),
+    });
+  } catch (error) {
+    console.warn(`[ActivityPub] Tombstone creation failed for ${url}: ${error.message}`);
+  }
+
+  await broadcastDelete(self, url).catch((err) =>
+    console.warn(`[ActivityPub] broadcastDelete failed for ${url}: ${err.message}`)
+  );
+}
+
+/** Micropub update hook: broadcast an Update for the modified post. */
+export async function updatePost(self, properties) {
+  await broadcastPostUpdate(self, properties).catch((err) =>
+    console.warn(`[ActivityPub] broadcastPostUpdate failed for ${properties?.url}: ${err.message}`)
+  );
+}
+
+/** Send an Update activity to all followers for a modified post. */
+export async function broadcastPostUpdate(self, properties) {
+  if (!self._federation) return;
+
+  try {
+    const { Update } = await import("@fedify/fedify/vocab");
+    const actorUrl = getActorUrl(self);
+    const handle = self.options.actor.handle;
+    const ctx = self._federation.createContext(
+      new URL(self._publicationUrl),
+      { handle, publicationUrl: self._publicationUrl },
+    );
+
+    const createActivity = jf2ToAS2Activity(
+      properties,
+      actorUrl,
+      self._publicationUrl,
+      { visibility: self.options.defaultVisibility },
+    );
+
+    if (!createActivity) {
+      console.warn(`[ActivityPub] broadcastPostUpdate: could not convert post to AS2 for ${properties?.url}`);
+      return;
+    }
+
+    const noteObject = await createActivity.getObject();
+    const activity = new Update({
+      actor: ctx.getActorUri(handle),
+      object: noteObject,
+    });
+
+    await batchBroadcast({
+      federation: self._federation,
+      collections: self._collections,
+      publicationUrl: self._publicationUrl,
+      handle,
+      activity,
+      label: "Update(Note)",
+      objectUrl: properties.url,
+    });
+  } catch (error) {
+    console.warn("[ActivityPub] broadcastPostUpdate failed:", error.message);
+  }
+}
+
+/** Build the full actor URL from config. */
+export function getActorUrl(self) {
+  const base = self._publicationUrl.replace(/\/$/, "");
+  return `${base}${self.options.mountPath}/users/${self.options.actor.handle}`;
+}

package/lib/mastodon/routes/oauth.js

@@ -68,6 +68,15 @@ function parseScopes(value) {
     .filter(Boolean);
 }
 
+// Pure helpers exported for unit testing (see tests/oauth-helpers.test.js).
+// Not part of the router API.
+export {
+  escapeHtml as _escapeHtml,
+  hashSecret as _hashSecret,
+  parseRedirectUris as _parseRedirectUris,
+  parseScopes as _parseScopes,
+};
+
 // ─── POST /api/v1/apps — Register client application ────────────────────────
 
 router.post("/api/v1/apps", async (req, res, next) => {

package/lib/navigation.js

@@ -0,0 +1,22 @@
+/**
+ * Admin navigation items for the ActivityPub endpoint.
+ * Extracted from index.js so the nav structure is unit-testable.
+ */
+
+/**
+ * Build the plugin's admin navigation items.
+ * @param {string} mountPath - The plugin mount path (e.g. "/activitypub")
+ * @returns {Array<{href: string, text: string, requiresDatabase: boolean}>}
+ */
+export function buildNavigationItems(mountPath) {
+  return [
+    { href: mountPath, text: "activitypub.title", requiresDatabase: true },
+    { href: `${mountPath}/admin/reader`, text: "activitypub.reader.title", requiresDatabase: true },
+    { href: `${mountPath}/admin/reader/notifications`, text: "activitypub.notifications.title", requiresDatabase: true },
+    { href: `${mountPath}/admin/reader/messages`, text: "activitypub.messages.title", requiresDatabase: true },
+    { href: `${mountPath}/admin/reader/moderation`, text: "activitypub.moderation.title", requiresDatabase: true },
+    { href: `${mountPath}/admin/my-profile`, text: "activitypub.myProfile.title", requiresDatabase: true },
+    { href: `${mountPath}/admin/federation`, text: "activitypub.federationMgmt.title", requiresDatabase: true },
+    { href: `${mountPath}/admin/settings`, text: "activitypub.settings.title", requiresDatabase: true },
+  ];
+}

package/lib/routes/admin-routes.js

@@ -0,0 +1,204 @@
+/**
+ * Authenticated admin UI routes for the ActivityPub endpoint.
+ * Extracted from index.js's `get routes()` getter (Phase 2 god-entry split).
+ * `self` is the ActivityPubEndpoint instance (passed through to controllers).
+ */
+import express from "express";
+
+import { dashboardController } from "../controllers/dashboard.js";
+import {
+  readerController,
+  notificationsController,
+  markAllNotificationsReadController,
+  clearAllNotificationsController,
+  deleteNotificationController,
+  composeController,
+  submitComposeController,
+  remoteProfileController,
+  followController,
+  unfollowController,
+  postDetailController,
+} from "../controllers/reader.js";
+import {
+  likeController,
+  unlikeController,
+  boostController,
+  unboostController,
+} from "../controllers/interactions.js";
+import {
+  muteController,
+  unmuteController,
+  blockController,
+  unblockController,
+  blockServerController,
+  unblockServerController,
+  moderationController,
+  filterModeController,
+} from "../controllers/moderation.js";
+import { followersController } from "../controllers/followers.js";
+import {
+  approveFollowController,
+  rejectFollowController,
+} from "../controllers/follow-requests.js";
+import { followingController } from "../controllers/following.js";
+import { activitiesController } from "../controllers/activities.js";
+import {
+  migrateGetController,
+  migratePostController,
+  migrateImportController,
+} from "../controllers/migrate.js";
+import {
+  profileGetController,
+  profilePostController,
+} from "../controllers/profile.js";
+import {
+  featuredGetController,
+  featuredPinController,
+  featuredUnpinController,
+} from "../controllers/featured.js";
+import {
+  featuredTagsGetController,
+  featuredTagsAddController,
+  featuredTagsRemoveController,
+} from "../controllers/featured-tags.js";
+import { resolveController } from "../controllers/resolve.js";
+import { tagTimelineController } from "../controllers/tag-timeline.js";
+import { apiTimelineController, countNewController, markReadController } from "../controllers/api-timeline.js";
+import {
+  exploreController,
+  exploreApiController,
+  instanceSearchApiController,
+  instanceCheckApiController,
+  popularAccountsApiController,
+} from "../controllers/explore.js";
+import {
+  followTagController,
+  unfollowTagController,
+  followTagGloballyController,
+  unfollowTagGloballyController,
+} from "../controllers/follow-tag.js";
+import {
+  listTabsController,
+  addTabController,
+  removeTabController,
+  reorderTabsController,
+} from "../controllers/tabs.js";
+import { hashtagExploreApiController } from "../controllers/hashtag-explore.js";
+import {
+  messagesController,
+  messageComposeController,
+  submitMessageController,
+  markAllMessagesReadController,
+  clearAllMessagesController,
+  deleteMessageController,
+} from "../controllers/messages.js";
+import { myProfileController } from "../controllers/my-profile.js";
+import {
+  refollowPauseController,
+  refollowResumeController,
+  refollowStatusController,
+} from "../controllers/refollow.js";
+import { deleteFederationController } from "../controllers/federation-delete.js";
+import {
+  federationMgmtController,
+  rebroadcastController,
+  viewApJsonController,
+  broadcastActorUpdateController,
+  lookupObjectController,
+} from "../controllers/federation-mgmt.js";
+import {
+  settingsGetController,
+  settingsPostController,
+} from "../controllers/settings.js";
+
+/**
+ * Build the authenticated admin router.
+ * @param {object} self - the ActivityPubEndpoint instance
+ * @returns {import("express").Router}
+ */
+export function buildAdminRoutes(self) {
+  const router = express.Router(); // eslint-disable-line new-cap
+  const mp = self.options.mountPath;
+
+  router.get("/", dashboardController(mp));
+  router.get("/admin/reader", readerController(mp));
+  router.get("/admin/reader/tag", tagTimelineController(mp));
+  router.get("/admin/reader/api/timeline", apiTimelineController(mp));
+  router.get("/admin/reader/api/timeline/count-new", countNewController());
+  router.post("/admin/reader/api/timeline/mark-read", markReadController());
+  router.get("/admin/reader/explore", exploreController(mp));
+  router.get("/admin/reader/api/explore", exploreApiController(mp));
+  router.get("/admin/reader/api/explore/hashtag", hashtagExploreApiController(mp));
+  router.get("/admin/reader/api/instances", instanceSearchApiController(mp));
+  router.get("/admin/reader/api/instance-check", instanceCheckApiController(mp));
+  router.get("/admin/reader/api/popular-accounts", popularAccountsApiController(mp));
+  router.get("/admin/reader/api/tabs", listTabsController(mp));
+  router.post("/admin/reader/api/tabs", addTabController(mp));
+  router.post("/admin/reader/api/tabs/remove", removeTabController(mp));
+  router.patch("/admin/reader/api/tabs/reorder", reorderTabsController(mp));
+  router.post("/admin/reader/follow-tag", followTagController(mp));
+  router.post("/admin/reader/unfollow-tag", unfollowTagController(mp));
+  router.post("/admin/reader/follow-tag-global", followTagGloballyController(mp, self));
+  router.post("/admin/reader/unfollow-tag-global", unfollowTagGloballyController(mp, self));
+  router.get("/admin/reader/notifications", notificationsController(mp));
+  router.post("/admin/reader/notifications/mark-read", markAllNotificationsReadController(mp));
+  router.post("/admin/reader/notifications/clear", clearAllNotificationsController(mp));
+  router.post("/admin/reader/notifications/delete", deleteNotificationController(mp));
+  router.get("/admin/reader/messages", messagesController(mp));
+  router.get("/admin/reader/messages/compose", messageComposeController(mp, self));
+  router.post("/admin/reader/messages/compose", submitMessageController(mp, self));
+  router.post("/admin/reader/messages/mark-read", markAllMessagesReadController(mp));
+  router.post("/admin/reader/messages/clear", clearAllMessagesController(mp));
+  router.post("/admin/reader/messages/delete", deleteMessageController(mp));
+  router.get("/admin/reader/compose", composeController(mp, self));
+  router.post("/admin/reader/compose", submitComposeController(mp, self));
+  router.post("/admin/reader/like", likeController(mp, self));
+  router.post("/admin/reader/unlike", unlikeController(mp, self));
+  router.post("/admin/reader/boost", boostController(mp, self));
+  router.post("/admin/reader/unboost", unboostController(mp, self));
+  router.get("/admin/reader/resolve", resolveController(mp, self));
+  router.get("/admin/reader/profile", remoteProfileController(mp, self));
+  router.get("/admin/reader/post", postDetailController(mp, self));
+  router.post("/admin/reader/follow", followController(mp, self));
+  router.post("/admin/reader/unfollow", unfollowController(mp, self));
+  router.get("/admin/reader/moderation", moderationController(mp));
+  router.post("/admin/reader/moderation/filter-mode", filterModeController(mp));
+  router.post("/admin/reader/mute", muteController(mp, self));
+  router.post("/admin/reader/unmute", unmuteController(mp, self));
+  router.post("/admin/reader/block", blockController(mp, self));
+  router.post("/admin/reader/unblock", unblockController(mp, self));
+  router.post("/admin/reader/block-server", blockServerController(mp));
+  router.post("/admin/reader/unblock-server", unblockServerController(mp));
+  router.get("/admin/followers", followersController(mp));
+  router.post("/admin/followers/approve", approveFollowController(mp, self));
+  router.post("/admin/followers/reject", rejectFollowController(mp, self));
+  router.get("/admin/following", followingController(mp));
+  router.get("/admin/activities", activitiesController(mp));
+  router.get("/admin/featured", featuredGetController(mp));
+  router.post("/admin/featured/pin", featuredPinController(mp, self));
+  router.post("/admin/featured/unpin", featuredUnpinController(mp, self));
+  router.get("/admin/tags", featuredTagsGetController(mp));
+  router.post("/admin/tags/add", featuredTagsAddController(mp, self));
+  router.post("/admin/tags/remove", featuredTagsRemoveController(mp, self));
+  router.get("/admin/profile", profileGetController(mp));
+  router.post("/admin/profile", profilePostController(mp, self));
+  router.get("/admin/my-profile", myProfileController(self));
+  router.get("/admin/migrate", migrateGetController(mp, self.options));
+  router.post("/admin/migrate", migratePostController(mp, self.options));
+  router.post("/admin/migrate/import", migrateImportController(mp, self.options));
+  router.post("/admin/refollow/pause", refollowPauseController(mp, self));
+  router.post("/admin/refollow/resume", refollowResumeController(mp, self));
+  router.get("/admin/refollow/status", refollowStatusController(mp));
+  router.post("/admin/federation/delete", deleteFederationController(mp, self));
+  router.get("/admin/federation", federationMgmtController(mp, self));
+  router.post("/admin/federation/rebroadcast", rebroadcastController(mp, self));
+  router.get("/admin/federation/ap-json", viewApJsonController(mp, self));
+  router.post("/admin/federation/broadcast-actor", broadcastActorUpdateController(mp, self));
+  router.get("/admin/federation/lookup", lookupObjectController(mp, self));
+
+  // Settings
+  router.get("/admin/settings", settingsGetController(mp));
+  router.post("/admin/settings", settingsPostController(mp));
+
+  return router;
+}