@rmdes/indiekit-endpoint-activitypub 3.5.7 → 3.5.9

package/lib/mastodon/entities/account.js

@@ -95,8 +95,8 @@ export function serializeAccount(actor, { baseUrl, isLocal = false, handle = ""
     url,
     display_name: displayName,
     note: sanitizeHtml(note),
-    avatar: avatarUrl || `${baseUrl}/placeholder-avatar.png`,
-    avatar_static: avatarUrl || `${baseUrl}/placeholder-avatar.png`,
+    avatar: avatarUrl || `${baseUrl}/images/default-avatar.svg`,
+    avatar_static: avatarUrl || `${baseUrl}/images/default-avatar.svg`,
     header: headerUrl || "",
     header_static: headerUrl || "",
     locked: actor.manuallyApprovesFollowers || false,

package/lib/mastodon/routes/oauth.js

@@ -322,6 +322,11 @@ router.post("/oauth/authorize", async (req, res, next) => {
     const code = randomHex(32);
     const collections = req.app.locals.mastodonCollections;
 
+    // Note: accessToken is NOT set here — it's added later during token exchange.
+    // The sparse unique index on accessToken skips documents where the field is
+    // absent, allowing multiple auth codes to coexist. Setting it to null would
+    // cause E11000 duplicate key errors because MongoDB sparse indexes still
+    // enforce uniqueness on explicit null values.
     await collections.ap_oauth_tokens.insertOne({
       code,
       clientId: client_id,
@@ -329,11 +334,8 @@ router.post("/oauth/authorize", async (req, res, next) => {
       redirectUri: redirect_uri,
       codeChallenge: code_challenge || null,
       codeChallengeMethod: code_challenge_method || null,
-      accessToken: null,
       createdAt: new Date(),
       expiresAt: new Date(Date.now() + 10 * 60 * 1000), // 10 minutes
-      usedAt: null,
-      revokedAt: null,
     });
 
     // Out-of-band: show code on page
@@ -399,19 +401,14 @@ router.post("/oauth/token", async (req, res, next) => {
         });
       }
 
+      // No code field — this is a direct token grant, not a code exchange.
+      // Omitting code (instead of setting null) avoids sparse index collisions.
       const accessToken = randomHex(64);
       await collections.ap_oauth_tokens.insertOne({
-        code: null,
         clientId,
         scopes: ["read"],
-        redirectUri: null,
-        codeChallenge: null,
-        codeChallengeMethod: null,
         accessToken,
         createdAt: new Date(),
-        expiresAt: null,
-        usedAt: null,
-        revokedAt: null,
         grantType: "client_credentials",
       });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.5.7",
+  "version": "3.5.9",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",