@rmdes/indiekit-endpoint-activitypub 3.7.0 → 3.7.2

package/index.js

@@ -721,13 +721,19 @@ export default class ActivityPubEndpoint {
       );
 
       // Resolve the remote actor to get their inbox
-      // Use authenticated document loader for servers requiring Authorized Fetch
+      // Try authenticated document loader first (for Authorized Fetch servers),
+      // fall back to unsigned if that fails (some servers reject signed GETs)
       const documentLoader = await ctx.getDocumentLoader({
         identifier: handle,
       });
-      const remoteActor = await lookupWithSecurity(ctx,actorUrl, {
+      let remoteActor = await lookupWithSecurity(ctx, actorUrl, {
         documentLoader,
       });
+      if (!remoteActor) {
+        // Retry without authentication — some servers (e.g., tags.pub)
+        // may reject or mishandle signed GET requests
+        remoteActor = await lookupWithSecurity(ctx, actorUrl);
+      }
       if (!remoteActor) {
         return { ok: false, error: "Could not resolve remote actor" };
       }

package/lib/mastodon/helpers/account-cache.js

@@ -7,12 +7,18 @@
  * LRU-style with TTL — entries expire after 1 hour.
  */
 
+import { remoteActorId } from "./id-mapping.js";
+
 const CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 const MAX_ENTRIES = 500;
 
 // Map<actorUrl, { followersCount, followingCount, statusesCount, createdAt, cachedAt }>
 const cache = new Map();
 
+// Reverse map: accountId (hash) → actorUrl
+// Populated alongside the stats cache for follow/unfollow lookups
+const idToUrl = new Map();
+
 /**
  * Store account stats in cache.
  * @param {string} actorUrl - The actor's URL (cache key)
@@ -28,6 +34,10 @@ export function cacheAccountStats(actorUrl, stats) {
   }
 
   cache.set(actorUrl, { ...stats, cachedAt: Date.now() });
+
+  // Maintain reverse lookup
+  const hashId = remoteActorId(actorUrl);
+  if (hashId) idToUrl.set(hashId, actorUrl);
 }
 
 /**
@@ -49,3 +59,12 @@ export function getCachedAccountStats(actorUrl) {
 
   return entry;
 }
+
+/**
+ * Reverse lookup: get actor URL from account hash ID.
+ * @param {string} hashId - The 24-char hex account ID
+ * @returns {string|null} Actor URL or null
+ */
+export function getActorUrlFromId(hashId) {
+  return idToUrl.get(hashId) || null;
+}

package/lib/mastodon/routes/accounts.js

@@ -10,6 +10,7 @@ import { serializeStatus } from "../entities/status.js";
 import { accountId, remoteActorId } from "../helpers/id-mapping.js";
 import { buildPaginationQuery, parseLimit, setPaginationHeaders } from "../helpers/pagination.js";
 import { resolveRemoteAccount } from "../helpers/resolve-account.js";
+import { getActorUrlFromId } from "../helpers/account-cache.js";
 
 const router = express.Router(); // eslint-disable-line new-cap
 
@@ -714,6 +715,10 @@ async function resolveActorUrl(id, collections) {
     return profile.url;
   }
 
+  // Check account cache reverse lookup (populated by resolveRemoteAccount)
+  const cachedUrl = getActorUrlFromId(id);
+  if (cachedUrl) return cachedUrl;
+
   // Check followers
   const followers = await collections.ap_followers.find({}).toArray();
   for (const f of followers) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.7.0",
+  "version": "3.7.2",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",