@rmdes/indiekit-endpoint-activitypub 3.13.8 → 3.13.10

package/index.js

@@ -1,5 +1,6 @@
 import express from "express";
 import { waitForReady } from "@rmdes/indiekit-startup-gate";
+import { ACTIVITYPUB_BLOCKS } from "./lib/blocks.js";
 
 import { setupFederation, buildPersonActor } from "./lib/federation-setup.js";
 import { createMastodonRouter } from "./lib/mastodon/router.js";
@@ -173,6 +174,10 @@ export default class ActivityPubEndpoint {
     this._fedifyMiddleware = null;
   }
 
+  get blocks() {
+    return ACTIVITYPUB_BLOCKS;
+  }
+
   get navigationItems() {
     return [
       {

package/lib/blocks.js

@@ -0,0 +1,37 @@
+/**
+ * ActivityPub v2 block declaration (Phase 7b — plugin block ownership).
+ *
+ * The `fediverse-follow` sidebar widget was a site-config BUILTIN_BLOCKS seed
+ * (requiresPlugin null, gated only by the theme's legacy widgetPluginRequirements
+ * render-map). Declaring it here makes site-config's scanPlugins stamp
+ * `sourcePlugin` → `requiresPlugin` ("ActivityPub endpoint"), so the block is
+ * properly plugin-gated (theme ENDPOINT_SLUGS maps it to the `activitypub`
+ * loadout slug). scanPlugins precedence is `built-in < plugin blocks`, so this
+ * entry OVERWRITES the builtin seed on sites where the plugin is loaded; the seed
+ * itself is removed from site-config in Phase 7d alongside the legacy-map bridge.
+ *
+ * activitypub is `default_enabled: false` — on a site without it loaded (e.g.
+ * chardonsbleus) the block correctly never appears in that site's catalog once
+ * the builtin seed is removed in 7d. Descriptor is byte-faithful to the
+ * BUILTIN_BLOCKS entry. Bespoke template: the theme owns
+ * `components/widgets/fediverse-follow.njk` (no generic `render.renderer`);
+ * `data.source:"config"` documents that it renders from config, not a runtime feed.
+ *
+ * @module lib/blocks
+ */
+
+/** @type {Array<object>} */
+export const ACTIVITYPUB_BLOCKS = [
+  {
+    id: "fediverse-follow",
+    version: 1,
+    label: "Fediverse Follow",
+    description: "Follow button for fediverse instances",
+    icon: "globe",
+    category: "social",
+    placement: { regions: ["sidebar"], surfaces: ["homepage"] },
+    multiple: false,
+    data: { source: "config" },
+    schema: { type: "object", additionalProperties: false, properties: {} },
+  },
+];

package/lib/inbox-handlers.js

@@ -43,6 +43,10 @@ import { getSettings } from "./settings.js";
 /** @type {string} ActivityStreams Public Collection constant */
 const PUBLIC = "https://www.w3.org/ns/activitystreams#Public";
 
+// Pure addressing/visibility helpers are exported for unit testing (see
+// tests/inbox-visibility.test.js). They are not part of the handler API.
+export { isDirectMessage as _isDirectMessage, computeVisibility as _computeVisibility };
+
 // ---------------------------------------------------------------------------
 // Router
 // ---------------------------------------------------------------------------

package/lib/item-processing.js

@@ -7,7 +7,9 @@
  */
 
 import { stripQuoteReferenceHtml } from "./og-unfurl.js";
-import { replaceCustomEmoji } from "./emoji-utils.js";
+// Use the hardened replaceCustomEmoji (validates http(s) URL schemes + escapes
+// attributes) — the render pipeline processes attacker-controlled remote emoji.
+import { replaceCustomEmoji } from "./timeline-store.js";
 import { shortenDisplayUrls, collapseHashtagStuffing } from "./content-utils.js";
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.13.8",
+  "version": "3.13.10",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",

package/lib/emoji-utils.js

@@ -1,38 +0,0 @@
-/**
- * Custom emoji replacement for fediverse content.
- *
- * Replaces :shortcode: patterns with <img> tags for custom emoji.
- * Must be called AFTER sanitizeContent() — the inserted <img> tags
- * would be stripped if run through the sanitizer.
- */
-
-/**
- * Escape special regex characters in a string.
- * @param {string} str
- * @returns {string}
- */
-function escapeRegex(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
-/**
- * Replace :shortcode: patterns in HTML with custom emoji <img> tags.
- *
- * @param {string} html - HTML string (already sanitized)
- * @param {Array<{shortcode: string, url: string}>} emojis - Custom emoji list
- * @returns {string} HTML with emoji shortcodes replaced by img tags
- */
-export function replaceCustomEmoji(html, emojis) {
-  if (!html || !emojis?.length) return html;
-
-  for (const emoji of emojis) {
-    if (!emoji.shortcode || !emoji.url) continue;
-    const pattern = new RegExp(`:${escapeRegex(emoji.shortcode)}:`, "g");
-    html = html.replace(
-      pattern,
-      `<img src="${emoji.url}" alt=":${emoji.shortcode}:" title=":${emoji.shortcode}:" class="ap-custom-emoji" loading="lazy">`,
-    );
-  }
-
-  return html;
-}