@rmdes/indiekit-endpoint-activitypub 3.4.0 → 3.5.2

package/index.js

@@ -224,6 +224,14 @@ export default class ActivityPubEndpoint {
       // Skip Fedify for admin UI routes — they're handled by the
       // authenticated `routes` getter, not the federation layer.
       if (req.path.startsWith("/admin")) return next();
+
+      // Diagnostic: log inbox POSTs to detect federation stalls
+      if (req.method === "POST" && req.path.includes("inbox")) {
+        const ua = req.get("user-agent") || "unknown";
+        const bodyParsed = req.body !== undefined && Object.keys(req.body || {}).length > 0;
+        console.info(`[federation-diag] POST ${req.path} from=${ua.slice(0, 60)} bodyParsed=${bodyParsed} readable=${req.readable}`);
+      }
+
       return self._fedifyMiddleware(req, res, next);
     });
 

package/lib/inbox-handlers.js

@@ -984,6 +984,24 @@ export async function handleUpdate(item, collections, ctx, handle) {
 
   const existing = await collections.ap_followers.findOne({ actorUrl });
   if (existing) {
+    let updatedAvatar = "";
+    try {
+      updatedAvatar = actorObj.icon
+        ? (await actorObj.icon)?.url?.href || ""
+        : "";
+    } catch {
+      // Icon fetch failed
+    }
+
+    let updatedBanner = "";
+    try {
+      updatedBanner = actorObj.image
+        ? (await actorObj.image)?.url?.href || ""
+        : "";
+    } catch {
+      // Banner fetch failed
+    }
+
     await collections.ap_followers.updateOne(
       { actorUrl },
       {
@@ -993,9 +1011,8 @@ export async function handleUpdate(item, collections, ctx, handle) {
             actorObj.preferredUsername?.toString() ||
             actorUrl,
           handle: actorObj.preferredUsername?.toString() || "",
-          avatar: actorObj.icon
-            ? (await actorObj.icon)?.url?.href || ""
-            : "",
+          avatar: updatedAvatar,
+          banner: updatedBanner,
           updatedAt: new Date().toISOString(),
         },
       },

package/lib/inbox-listeners.js

@@ -46,12 +46,31 @@ export function registerInboxListeners(inboxChain, options) {
 
   const getAuthLoader = (ctx) => ctx.getDocumentLoader({ identifier: handle });
 
+  // Diagnostic: track listener invocations to detect federation stalls
+  const _diag = { count: 0, lastType: "", lastActor: "", lastAt: 0 };
+  const _diagInterval = setInterval(() => {
+    if (_diag.count > 0) {
+      console.info(`[inbox-diag] ${_diag.count} activities received in last 5min (last: ${_diag.lastType} from ${_diag.lastActor})`);
+      _diag.count = 0;
+    }
+  }, 5 * 60 * 1000);
+  // Prevent timer from keeping the process alive
+  _diagInterval.unref?.();
+
+  const _diagTrack = (type, actorUrl) => {
+    _diag.count++;
+    _diag.lastType = type;
+    _diag.lastActor = actorUrl?.split("/").pop() || "?";
+    _diag.lastAt = Date.now();
+  };
+
   inboxChain
     // ── Follow ──────────────────────────────────────────────────────
     // Synchronous: Accept/Reject + follower storage (federation requirement)
     // Async: notification + activity log
     .on(Follow, async (ctx, follow) => {
       const actorUrl = follow.actorId?.href || "";
+      _diagTrack("Follow", actorUrl);
       if (await isServerBlocked(actorUrl, collections)) return;
       await touchKeyFreshness(collections, actorUrl);
       await resetDeliveryStrikes(collections, actorUrl);
@@ -66,13 +85,30 @@ export function registerInboxListeners(inboxChain, options) {
         followerActor.preferredUsername?.toString() ||
         followerUrl;
 
+      let followerAvatar = "";
+      try {
+        followerAvatar = followerActor.icon
+          ? (await followerActor.icon)?.url?.href || ""
+          : "";
+      } catch {
+        // Icon fetch failed
+      }
+
+      let followerBanner = "";
+      try {
+        followerBanner = followerActor.image
+          ? (await followerActor.image)?.url?.href || ""
+          : "";
+      } catch {
+        // Banner fetch failed
+      }
+
       const followerData = {
         actorUrl: followerUrl,
         handle: followerActor.preferredUsername?.toString() || "",
         name: followerName,
-        avatar: followerActor.icon
-          ? (await followerActor.icon)?.url?.href || ""
-          : "",
+        avatar: followerAvatar,
+        banner: followerBanner,
         inbox: followerActor.inbox?.id?.href || "",
         sharedInbox: followerActor.endpoints?.sharedInbox?.href || "",
       };
@@ -209,6 +245,7 @@ export function registerInboxListeners(inboxChain, options) {
     // ── Announce ────────────────────────────────────────────────────
     .on(Announce, async (ctx, announce) => {
       const actorUrl = announce.actorId?.href || "";
+      _diagTrack("Announce", actorUrl);
       if (await isServerBlocked(actorUrl, collections)) return;
       await touchKeyFreshness(collections, actorUrl);
       await resetDeliveryStrikes(collections, actorUrl);
@@ -224,6 +261,7 @@ export function registerInboxListeners(inboxChain, options) {
     // ── Create ──────────────────────────────────────────────────────
     .on(Create, async (ctx, create) => {
       const actorUrl = create.actorId?.href || "";
+      _diagTrack("Create", actorUrl);
       if (await isServerBlocked(actorUrl, collections)) return;
       await touchKeyFreshness(collections, actorUrl);
       await resetDeliveryStrikes(collections, actorUrl);
@@ -274,6 +312,7 @@ export function registerInboxListeners(inboxChain, options) {
     // ── Delete ──────────────────────────────────────────────────────
     .on(Delete, async (ctx, del) => {
       const actorUrl = del.actorId?.href || "";
+      _diagTrack("Delete", actorUrl);
       if (await isServerBlocked(actorUrl, collections)) return;
       await touchKeyFreshness(collections, actorUrl);
       await resetDeliveryStrikes(collections, actorUrl);
@@ -303,6 +342,7 @@ export function registerInboxListeners(inboxChain, options) {
     // ── Update ──────────────────────────────────────────────────────
     .on(Update, async (ctx, update) => {
       const actorUrl = update.actorId?.href || "";
+      _diagTrack("Update", actorUrl);
       if (await isServerBlocked(actorUrl, collections)) return;
       await touchKeyFreshness(collections, actorUrl);
       await resetDeliveryStrikes(collections, actorUrl);

package/lib/inbox-queue.js

@@ -83,11 +83,32 @@ export async function enqueueActivity(collections, { activityType, actorUrl, obj
  * @returns {NodeJS.Timeout} Interval ID (for cleanup)
  */
 export function startInboxProcessor(collections, getCtx, handle) {
+  // Diagnostic: detect stuck processing items and log queue health
+  let _diagProcessed = 0;
+  const _diagInterval = setInterval(async () => {
+    try {
+      const stuck = await collections.ap_inbox_queue?.countDocuments({ status: "processing" }) || 0;
+      const pending = await collections.ap_inbox_queue?.countDocuments({ status: "pending" }) || 0;
+      if (stuck > 0 || _diagProcessed > 0 || pending > 10) {
+        console.info(`[inbox-queue-diag] processed=${_diagProcessed}/5min pending=${pending} stuck_processing=${stuck}`);
+      }
+      _diagProcessed = 0;
+    } catch { /* ignore */ }
+  }, 5 * 60 * 1000);
+  _diagInterval.unref?.();
+
   const intervalId = setInterval(async () => {
     try {
       const ctx = getCtx();
       if (ctx) {
+        const before = Date.now();
         await processNextItem(collections, ctx, handle);
+        const elapsed = Date.now() - before;
+        if (elapsed > 0) _diagProcessed++;
+        // Warn if a single item takes too long (potential hang)
+        if (elapsed > 30_000) {
+          console.warn(`[inbox-queue-diag] slow item: ${elapsed}ms`);
+        }
       }
     } catch (error) {
       console.error("[inbox-queue] Processor error:", error.message);

package/lib/mastodon/entities/notification.js

@@ -55,17 +55,26 @@ export function serializeNotification(notif, { baseUrl, statusMap, interactionSt
   );
 
   // Resolve the associated status (for favourite, reblog, mention types)
+  // For mention types, prefer the triggering post (notif.url) over the target post (notif.targetUrl)
+  // because targetUrl for replies points to the user's OWN post being replied to
   let status = null;
-  if (notif.targetUrl && statusMap) {
-    const timelineItem = statusMap.get(notif.targetUrl);
-    if (timelineItem) {
-      status = serializeStatus(timelineItem, {
-        baseUrl,
-        favouritedIds: interactionState?.favouritedIds || new Set(),
-        rebloggedIds: interactionState?.rebloggedIds || new Set(),
-        bookmarkedIds: interactionState?.bookmarkedIds || new Set(),
-        pinnedIds: new Set(),
-      });
+  if (statusMap) {
+    const isMentionType = mastodonType === "mention";
+    const lookupUrl = isMentionType
+      ? (notif.url || notif.targetUrl)
+      : (notif.targetUrl || notif.url);
+
+    if (lookupUrl) {
+      const timelineItem = statusMap.get(lookupUrl);
+      if (timelineItem) {
+        status = serializeStatus(timelineItem, {
+          baseUrl,
+          favouritedIds: interactionState?.favouritedIds || new Set(),
+          rebloggedIds: interactionState?.rebloggedIds || new Set(),
+          bookmarkedIds: interactionState?.bookmarkedIds || new Set(),
+          pinnedIds: new Set(),
+        });
+      }
     }
   }
 
@@ -82,7 +91,7 @@ export function serializeNotification(notif, { baseUrl, statusMap, interactionSt
       visibility: notif.type === "dm" ? "direct" : "public",
       language: null,
       uri: notif.uid || "",
-      url: notif.targetUrl || notif.uid || "",
+      url: notif.url || notif.targetUrl || notif.uid || "",
       replies_count: 0,
       reblogs_count: 0,
       favourites_count: 0,

package/lib/mastodon/routes/accounts.js

@@ -110,7 +110,7 @@ router.get("/api/v1/accounts/lookup", async (req, res, next) => {
     if (follower) {
       return res.json(
         serializeAccount(
-          { name: follower.name, url: follower.actorUrl, photo: follower.avatar, handle: follower.handle },
+          { name: follower.name, url: follower.actorUrl, photo: follower.avatar, handle: follower.handle, bannerUrl: follower.banner || "" },
           { baseUrl },
         ),
       );
@@ -277,7 +277,7 @@ router.get("/api/v1/accounts/:id/followers", async (req, res, next) => {
 
     const accounts = followers.map((f) =>
       serializeAccount(
-        { name: f.name, url: f.actorUrl, photo: f.avatar, handle: f.handle },
+        { name: f.name, url: f.actorUrl, photo: f.avatar, handle: f.handle, bannerUrl: f.banner || "" },
         { baseUrl },
       ),
     );
@@ -310,7 +310,7 @@ router.get("/api/v1/accounts/:id/following", async (req, res, next) => {
 
     const accounts = following.map((f) =>
       serializeAccount(
-        { name: f.name, url: f.actorUrl, photo: f.avatar, handle: f.handle },
+        { name: f.name, url: f.actorUrl, photo: f.avatar, handle: f.handle, bannerUrl: f.banner || "" },
         { baseUrl },
       ),
     );
@@ -712,23 +712,35 @@ async function resolveActorUrl(id, collections) {
  * Returns { actor, actorUrl } or { actor: null, actorUrl: null }.
  */
 async function resolveActorData(id, collections) {
-  // Check followers
+  // Check followers — pass through all stored fields for richer serialization
   const followers = await collections.ap_followers.find({}).toArray();
   for (const f of followers) {
     if (remoteActorId(f.actorUrl) === id) {
       return {
-        actor: { name: f.name, url: f.actorUrl, photo: f.avatar, handle: f.handle },
+        actor: {
+          name: f.name,
+          url: f.actorUrl,
+          photo: f.avatar,
+          handle: f.handle,
+          bannerUrl: f.banner || "",
+        },
         actorUrl: f.actorUrl,
       };
     }
   }
 
-  // Check following
+  // Check following — pass through all stored fields
   const following = await collections.ap_following.find({}).toArray();
   for (const f of following) {
     if (remoteActorId(f.actorUrl) === id) {
       return {
-        actor: { name: f.name, url: f.actorUrl, photo: f.avatar, handle: f.handle },
+        actor: {
+          name: f.name,
+          url: f.actorUrl,
+          photo: f.avatar,
+          handle: f.handle,
+          bannerUrl: f.banner || "",
+        },
         actorUrl: f.actorUrl,
       };
     }

package/lib/mastodon/routes/notifications.js

@@ -225,23 +225,25 @@ function resolveInternalTypes(mastodonTypes) {
 async function batchFetchStatuses(collections, notifications) {
   const statusMap = new Map();
 
-  const targetUrls = [
+  // Collect both targetUrl (the post being acted on) and url (the triggering post)
+  // For mention/reply notifications, the url is the actual mention/reply post
+  const allUrls = [
     ...new Set(
       notifications
-        .map((n) => n.targetUrl)
+        .flatMap((n) => [n.targetUrl, n.url])
         .filter(Boolean),
     ),
   ];
 
-  if (targetUrls.length === 0 || !collections.ap_timeline) {
+  if (allUrls.length === 0 || !collections.ap_timeline) {
     return statusMap;
   }
 
   const items = await collections.ap_timeline
     .find({
       $or: [
-        { uid: { $in: targetUrls } },
-        { url: { $in: targetUrls } },
+        { uid: { $in: allUrls } },
+        { url: { $in: allUrls } },
       ],
     })
     .toArray();

package/lib/mastodon/routes/oauth.js

@@ -219,10 +219,11 @@ router.get("/oauth/authorize", async (req, res, next) => {
     // Check if user is logged in via IndieAuth session
     const session = req.session;
     if (!session?.access_token && !force_login) {
-      // Not logged in — redirect to Indiekit login, then back here
-      const returnUrl = `${req.protocol}://${req.get("host")}${req.originalUrl}`;
+      // Not logged in — redirect to Indiekit's login page, then back here.
+      // Indiekit uses /session/login?redirect=<path> (see indieauth.js authenticate()).
+      // The redirect value must be a local path (validated by regex in indieauth.js).
       return res.redirect(
-        `/auth?redirect=${encodeURIComponent(returnUrl)}`,
+        `/session/login?redirect=${encodeURIComponent(req.originalUrl)}`,
       );
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.4.0",
+  "version": "3.5.2",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",