@rmdes/indiekit-endpoint-activitypub 3.5.9 → 3.6.1

package/lib/mastodon/entities/notification.js

@@ -13,6 +13,7 @@
  */
 import { serializeAccount } from "./account.js";
 import { serializeStatus } from "./status.js";
+import { encodeCursor } from "../helpers/pagination.js";
 
 /**
  * Map internal notification types to Mastodon API types.
@@ -115,12 +116,14 @@ export function serializeNotification(notif, { baseUrl, statusMap, interactionSt
     };
   }
 
+  const createdAt = notif.published instanceof Date
+    ? notif.published.toISOString()
+    : notif.published || notif.createdAt || new Date().toISOString();
+
   return {
-    id: notif._id.toString(),
+    id: encodeCursor(createdAt) || notif._id.toString(),
     type: mastodonType,
-    created_at: notif.published instanceof Date
-      ? notif.published.toISOString()
-      : notif.published || notif.createdAt || new Date().toISOString(),
+    created_at: createdAt,
     account,
     status,
   };

package/lib/mastodon/entities/status.js

@@ -15,6 +15,7 @@
  */
 import { serializeAccount } from "./account.js";
 import { sanitizeHtml } from "./sanitize.js";
+import { encodeCursor } from "../helpers/pagination.js";
 
 // Module-level defaults set once at startup via setLocalIdentity()
 let _localPublicationUrl = "";
@@ -46,7 +47,10 @@ export function setLocalIdentity(publicationUrl, handle) {
 export function serializeStatus(item, { baseUrl, favouritedIds, rebloggedIds, bookmarkedIds, pinnedIds }) {
   if (!item) return null;
 
-  const id = item._id.toString();
+  // Use published-based cursor as the status ID so pagination cursors
+  // (max_id/min_id) sort chronologically, not by insertion order.
+  const cursorDate = item.published || item.createdAt || item.boostedAt;
+  const id = encodeCursor(cursorDate) || item._id.toString();
   const uid = item.uid || "";
   const url = item.url || uid;
 

package/lib/mastodon/helpers/pagination.js

@@ -1,14 +1,50 @@
 /**
  * Mastodon-compatible cursor pagination helpers.
  *
- * Uses MongoDB ObjectId as cursor (chronologically ordered).
+ * Uses `published` date as cursor (chronologically correct) instead of
+ * MongoDB ObjectId. ObjectId reflects insertion order, not publication
+ * order — backfilled or syndicated posts get new ObjectIds at import
+ * time, breaking chronological sort. The `published` field matches the
+ * native reader's sort and produces a correct timeline.
+ *
+ * Cursor values are `published` ISO strings, but Mastodon clients pass
+ * them as opaque `max_id`/`min_id`/`since_id` strings. We encode the
+ * published date as a Mastodon-style snowflake-ish ID (milliseconds
+ * since epoch) so clients treat them as comparable integers.
+ *
  * Emits RFC 8288 Link headers that masto.js / Phanpy parse.
  */
-import { ObjectId } from "mongodb";
 
 const DEFAULT_LIMIT = 20;
 const MAX_LIMIT = 40;
 
+/**
+ * Encode a published date string as a numeric cursor ID.
+ * Mastodon clients expect IDs to be numeric strings that sort chronologically.
+ * We use milliseconds since epoch — monotonic and comparable.
+ *
+ * @param {string|Date} published - ISO date string or Date object
+ * @returns {string} Numeric string (ms since epoch)
+ */
+export function encodeCursor(published) {
+  if (!published) return "0";
+  const ms = new Date(published).getTime();
+  return Number.isFinite(ms) ? String(ms) : "0";
+}
+
+/**
+ * Decode a numeric cursor ID back to an ISO date string.
+ *
+ * @param {string} cursor - Numeric cursor from client
+ * @returns {string|null} ISO date string, or null if invalid
+ */
+export function decodeCursor(cursor) {
+  if (!cursor) return null;
+  const ms = Number.parseInt(cursor, 10);
+  if (!Number.isFinite(ms) || ms <= 0) return null;
+  return new Date(ms).toISOString();
+}
+
 /**
  * Parse and clamp the limit parameter.
  *
@@ -24,48 +60,45 @@ export function parseLimit(raw) {
 /**
  * Build a MongoDB filter object for cursor-based pagination.
  *
- * Mastodon cursor params (all optional, applied to `_id`):
- *   max_id   — return items older than this ID (exclusive)
- *   min_id   — return items newer than this ID (exclusive), closest first
- *   since_id — return items newer than this ID (exclusive), most recent first
+ * Mastodon cursor params (all optional, applied to `published`):
+ *   max_id   — return items older than this cursor (exclusive)
+ *   min_id   — return items newer than this cursor (exclusive), closest first
+ *   since_id — return items newer than this cursor (exclusive), most recent first
  *
  * @param {object} baseFilter - Existing MongoDB filter to extend
  * @param {object} cursors
- * @param {string} [cursors.max_id]
- * @param {string} [cursors.min_id]
- * @param {string} [cursors.since_id]
+ * @param {string} [cursors.max_id] - Numeric cursor (ms since epoch)
+ * @param {string} [cursors.min_id] - Numeric cursor (ms since epoch)
+ * @param {string} [cursors.since_id] - Numeric cursor (ms since epoch)
  * @returns {{ filter: object, sort: object, reverse: boolean }}
  */
 export function buildPaginationQuery(baseFilter, { max_id, min_id, since_id } = {}) {
   const filter = { ...baseFilter };
-  let sort = { _id: -1 }; // newest first (default)
+  let sort = { published: -1 }; // newest first (default)
   let reverse = false;
 
   if (max_id) {
-    try {
-      filter._id = { ...filter._id, $lt: new ObjectId(max_id) };
-    } catch {
-      // Invalid ObjectId — ignore
+    const date = decodeCursor(max_id);
+    if (date) {
+      filter.published = { ...filter.published, $lt: date };
     }
   }
 
   if (since_id) {
-    try {
-      filter._id = { ...filter._id, $gt: new ObjectId(since_id) };
-    } catch {
-      // Invalid ObjectId — ignore
+    const date = decodeCursor(since_id);
+    if (date) {
+      filter.published = { ...filter.published, $gt: date };
     }
   }
 
   if (min_id) {
-    try {
-      filter._id = { ...filter._id, $gt: new ObjectId(min_id) };
+    const date = decodeCursor(min_id);
+    if (date) {
+      filter.published = { ...filter.published, $gt: date };
       // min_id returns results closest to the cursor, so sort ascending
       // then reverse the results before returning
-      sort = { _id: 1 };
+      sort = { published: 1 };
       reverse = true;
-    } catch {
-      // Invalid ObjectId — ignore
     }
   }
 
@@ -77,7 +110,7 @@ export function buildPaginationQuery(baseFilter, { max_id, min_id, since_id } =
  *
  * @param {object} res - Express response object
  * @param {object} req - Express request object (for building URLs)
- * @param {Array} items - Result items (must have `_id` or `id`)
+ * @param {Array} items - Result items (must have `published`)
  * @param {number} limit - The limit used for the query
  */
 export function setPaginationHeaders(res, req, items, limit) {
@@ -86,10 +119,10 @@ export function setPaginationHeaders(res, req, items, limit) {
   // Only emit Link if we got a full page (may have more)
   if (items.length < limit) return;
 
-  const firstId = itemId(items[0]);
-  const lastId = itemId(items[items.length - 1]);
+  const firstCursor = encodeCursor(items[0].published);
+  const lastCursor = encodeCursor(items[items.length - 1].published);
 
-  if (!firstId || !lastId) return;
+  if (firstCursor === "0" || lastCursor === "0") return;
 
   const baseUrl = `${req.protocol}://${req.get("host")}${req.path}`;
 
@@ -106,25 +139,15 @@ export function setPaginationHeaders(res, req, items, limit) {
 
   const links = [];
 
-  // rel="next" — older items (max_id = last item's ID)
+  // rel="next" — older items (max_id = last item's cursor)
   const nextParams = new URLSearchParams(existingParams);
-  nextParams.set("max_id", lastId);
+  nextParams.set("max_id", lastCursor);
   links.push(`<${baseUrl}?${nextParams.toString()}>; rel="next"`);
 
-  // rel="prev" — newer items (min_id = first item's ID)
+  // rel="prev" — newer items (min_id = first item's cursor)
   const prevParams = new URLSearchParams(existingParams);
-  prevParams.set("min_id", firstId);
+  prevParams.set("min_id", firstCursor);
   links.push(`<${baseUrl}?${prevParams.toString()}>; rel="prev"`);
 
   res.set("Link", links.join(", "));
 }
-
-/**
- * Extract the string ID from an item.
- */
-function itemId(item) {
-  if (!item) return null;
-  if (item._id) return item._id.toString();
-  if (item.id) return String(item.id);
-  return null;
-}

package/lib/mastodon/routes/statuses.js

@@ -15,6 +15,7 @@
 import express from "express";
 import { ObjectId } from "mongodb";
 import { serializeStatus } from "../entities/status.js";
+import { decodeCursor } from "../helpers/pagination.js";
 import {
   likePost, unlikePost,
   boostPost, unboostPost,
@@ -32,14 +33,7 @@ router.get("/api/v1/statuses/:id", async (req, res, next) => {
     const collections = req.app.locals.mastodonCollections;
     const baseUrl = `${req.protocol}://${req.get("host")}`;
 
-    let objectId;
-    try {
-      objectId = new ObjectId(id);
-    } catch {
-      return res.status(404).json({ error: "Record not found" });
-    }
-
-    const item = await collections.ap_timeline.findOne({ _id: objectId });
+    const item = await findTimelineItemById(collections.ap_timeline, id);
     if (!item) {
       return res.status(404).json({ error: "Record not found" });
     }
@@ -67,14 +61,7 @@ router.get("/api/v1/statuses/:id/context", async (req, res, next) => {
     const collections = req.app.locals.mastodonCollections;
     const baseUrl = `${req.protocol}://${req.get("host")}`;
 
-    let objectId;
-    try {
-      objectId = new ObjectId(id);
-    } catch {
-      return res.status(404).json({ error: "Record not found" });
-    }
-
-    const item = await collections.ap_timeline.findOne({ _id: objectId });
+    const item = await findTimelineItemById(collections.ap_timeline, id);
     if (!item) {
       return res.status(404).json({ error: "Record not found" });
     }
@@ -173,18 +160,12 @@ router.post("/api/v1/statuses", async (req, res, next) => {
       return res.status(422).json({ error: "Validation failed: Text content is required" });
     }
 
-    // Resolve in_reply_to URL from timeline ObjectId
+    // Resolve in_reply_to URL from status ID (cursor or ObjectId)
     let inReplyTo = null;
     if (inReplyToId) {
-      try {
-        const replyItem = await collections.ap_timeline.findOne({
-          _id: new ObjectId(inReplyToId),
-        });
-        if (replyItem) {
-          inReplyTo = replyItem.uid || replyItem.url;
-        }
-      } catch {
-        // Invalid ObjectId — ignore
+      const replyItem = await findTimelineItemById(collections.ap_timeline, inReplyToId);
+      if (replyItem) {
+        inReplyTo = replyItem.uid || replyItem.url;
       }
     }
 
@@ -300,14 +281,7 @@ router.delete("/api/v1/statuses/:id", async (req, res, next) => {
     const collections = req.app.locals.mastodonCollections;
     const baseUrl = `${req.protocol}://${req.get("host")}`;
 
-    let objectId;
-    try {
-      objectId = new ObjectId(id);
-    } catch {
-      return res.status(404).json({ error: "Record not found" });
-    }
-
-    const item = await collections.ap_timeline.findOne({ _id: objectId });
+    const item = await findTimelineItemById(collections.ap_timeline, id);
     if (!item) {
       return res.status(404).json({ error: "Record not found" });
     }
@@ -553,20 +527,38 @@ router.post("/api/v1/statuses/:id/unbookmark", async (req, res, next) => {
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
 /**
- * Resolve a timeline item from the :id param, plus common context.
+ * Find a timeline item by cursor ID (published-based) or ObjectId (legacy).
+ * Status IDs are now encodeCursor(published) — milliseconds since epoch.
+ * Falls back to ObjectId lookup for backwards compatibility.
+ *
+ * @param {object} collection - ap_timeline collection
+ * @param {string} id - Status ID from client
+ * @returns {Promise<object|null>} Timeline document or null
  */
-async function resolveStatusForInteraction(req) {
-  const collections = req.app.locals.mastodonCollections;
-  const baseUrl = `${req.protocol}://${req.get("host")}`;
+async function findTimelineItemById(collection, id) {
+  // Try cursor-based lookup first (published date from ms-since-epoch)
+  const publishedDate = decodeCursor(id);
+  if (publishedDate) {
+    const item = await collection.findOne({ published: publishedDate });
+    if (item) return item;
+  }
 
-  let objectId;
+  // Fall back to ObjectId lookup (legacy IDs)
   try {
-    objectId = new ObjectId(req.params.id);
+    return await collection.findOne({ _id: new ObjectId(id) });
   } catch {
-    return { item: null, collections, baseUrl };
+    return null;
   }
+}
+
+/**
+ * Resolve a timeline item from the :id param, plus common context.
+ */
+async function resolveStatusForInteraction(req) {
+  const collections = req.app.locals.mastodonCollections;
+  const baseUrl = `${req.protocol}://${req.get("host")}`;
 
-  const item = await collections.ap_timeline.findOne({ _id: objectId });
+  const item = await findTimelineItemById(collections.ap_timeline, req.params.id);
   return { item, collections, baseUrl };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.5.9",
+  "version": "3.6.1",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",