@rmdes/indiekit-endpoint-activitypub 3.7.4 → 3.8.0

package/README.md

@@ -1,6 +1,6 @@
 # @rmdes/indiekit-endpoint-activitypub
 
-ActivityPub federation endpoint for [Indiekit](https://getindiekit.com), built on [Fedify](https://fedify.dev) 2.0. Makes your IndieWeb site a full fediverse actor — discoverable, followable, and interactive from Mastodon, Misskey, Pixelfed, and any ActivityPub-compatible platform.
+ActivityPub federation endpoint for [Indiekit](https://getindiekit.com), built on [Fedify](https://fedify.dev) 2.0. Makes your IndieWeb site a full fediverse actor — discoverable, followable, and interactive from Mastodon, Misskey, Pixelfed, and any ActivityPub-compatible platform. Includes a Mastodon-compatible Client API so you can use Phanpy, Elk, Moshidon, Fedilab, and other Mastodon clients with your own AP instance.
 
 ## Features
 
@@ -79,6 +79,23 @@ ActivityPub federation endpoint for [Indiekit](https://getindiekit.com), built o
 - OpenTelemetry tracing for federation activity
 - Real-time activity inspection
 
+**Mastodon Client API** *(v3.0.0+)*
+- Full Mastodon REST API compatibility — use Phanpy, Elk, Moshidon, Fedilab, or any Mastodon-compatible client
+- OAuth2 with PKCE (S256) — app registration, authorization, token exchange
+- HTML+JS redirect for native Android apps (Chrome Custom Tabs block 302 to custom URI schemes)
+- Home, public, and hashtag timelines with chronological published-date pagination
+- Status creation via Micropub pipeline — posts flow through Indiekit → content file → AP syndication
+- URL auto-linkification and @mention extraction in posted content
+- Thread context (ancestors + descendants)
+- Remote profile resolution via Fedify WebFinger with follower/following/post counts from AP collections
+- Account stats enrichment — embedded account data in timeline responses includes real counts
+- Favourite, boost, bookmark interactions federated via Fedify AP activities
+- Notifications with type filtering
+- Search across accounts, statuses, and hashtags with remote resolution
+- Domain blocks API
+- Timeline backfill from posts collection on startup (bookmarks, likes, reposts get synthesized content)
+- In-memory account stats cache (500 entries, 1h TTL) for performance
+
 **Admin UI**
 - Dashboard with follower/following counts and recent activity
 - Profile editor (name, bio, avatar, header, profile links with rel="me" verification)
@@ -86,6 +103,7 @@ ActivityPub federation endpoint for [Indiekit](https://getindiekit.com), built o
 - Featured tags (hashtag collection)
 - Activity log (inbound/outbound)
 - Follower and following lists with source tracking
+- Federation management page with moderation overview (blocked servers, blocked accounts, muted)
 
 ## Requirements
 

package/index.js

@@ -79,7 +79,12 @@ import {
   instanceCheckApiController,
   popularAccountsApiController,
 } from "./lib/controllers/explore.js";
-import { followTagController, unfollowTagController } from "./lib/controllers/follow-tag.js";
+import {
+  followTagController,
+  unfollowTagController,
+  followTagGloballyController,
+  unfollowTagGloballyController,
+} from "./lib/controllers/follow-tag.js";
 import {
   listTabsController,
   addTabController,
@@ -296,6 +301,8 @@ export default class ActivityPubEndpoint {
     router.patch("/admin/reader/api/tabs/reorder", reorderTabsController(mp));
     router.post("/admin/reader/follow-tag", followTagController(mp));
     router.post("/admin/reader/unfollow-tag", unfollowTagController(mp));
+    router.post("/admin/reader/follow-tag-global", followTagGloballyController(mp, this));
+    router.post("/admin/reader/unfollow-tag-global", unfollowTagGloballyController(mp, this));
     router.get("/admin/reader/notifications", notificationsController(mp));
     router.post("/admin/reader/notifications/mark-read", markAllNotificationsReadController(mp));
     router.post("/admin/reader/notifications/clear", clearAllNotificationsController(mp));

package/lib/controllers/federation-mgmt.js

@@ -41,12 +41,16 @@ export function federationMgmtController(mountPath, plugin) {
 
       const redisUrl = plugin.options.redisUrl || "";
 
-      // Parallel: collection stats + posts + recent activities
-      const [collectionStats, postsResult, recentActivities] =
+      // Parallel: collection stats + posts + recent activities + moderation data
+      const pluginCollections = plugin._collections || {};
+      const [collectionStats, postsResult, recentActivities, blockedServers, blockedAccounts, mutedAccounts] =
         await Promise.all([
           getCollectionStats(collections, { redisUrl }),
           getPaginatedPosts(collections, request.query.page),
           getRecentActivities(collections),
+          pluginCollections.ap_blocked_servers?.find({}).sort({ blockedAt: -1 }).toArray() || [],
+          pluginCollections.ap_blocked?.find({}).sort({ blockedAt: -1 }).toArray() || [],
+          pluginCollections.ap_muted?.find({}).sort({ mutedAt: -1 }).toArray() || [],
         ]);
 
       const csrfToken = getToken(request.session);
@@ -62,6 +66,9 @@ export function federationMgmtController(mountPath, plugin) {
         posts: postsResult.posts,
         cursor: postsResult.cursor,
         recentActivities,
+        blockedServers: blockedServers || [],
+        blockedAccounts: blockedAccounts || [],
+        mutedAccounts: mutedAccounts || [],
         csrfToken,
         mountPath,
         publicationUrl: plugin._publicationUrl,

package/lib/controllers/follow-tag.js

@@ -3,7 +3,13 @@
  */
 
 import { validateToken } from "../csrf.js";
-import { followTag, unfollowTag } from "../storage/followed-tags.js";
+import {
+  followTag,
+  unfollowTag,
+  setGlobalFollow,
+  removeGlobalFollow,
+  getTagsPubActorUrl,
+} from "../storage/followed-tags.js";
 
 export function followTagController(mountPath) {
   return async (request, response, next) => {
@@ -60,3 +66,81 @@ export function unfollowTagController(mountPath) {
     }
   };
 }
+
+export function followTagGloballyController(mountPath, plugin) {
+  return async (request, response, next) => {
+    try {
+      const { application } = request.app.locals;
+
+      // CSRF validation
+      if (!validateToken(request)) {
+        return response.status(403).json({ error: "Invalid CSRF token" });
+      }
+
+      const tag = typeof request.body.tag === "string" ? request.body.tag.trim() : "";
+      if (!tag) {
+        return response.redirect(`${mountPath}/admin/reader`);
+      }
+
+      const actorUrl = getTagsPubActorUrl(tag);
+
+      // Send AP Follow activity via Fedify
+      const result = await plugin.followActor(actorUrl);
+      if (!result.ok) {
+        const errorMsg = encodeURIComponent(result.error || "Follow failed");
+        return response.redirect(
+          `${mountPath}/admin/reader/tag?tag=${encodeURIComponent(tag)}&error=${errorMsg}`
+        );
+      }
+
+      // Store global follow state
+      const collections = {
+        ap_followed_tags: application?.collections?.get("ap_followed_tags"),
+      };
+      await setGlobalFollow(collections, tag, actorUrl);
+
+      return response.redirect(`${mountPath}/admin/reader/tag?tag=${encodeURIComponent(tag)}`);
+    } catch (error) {
+      next(error);
+    }
+  };
+}
+
+export function unfollowTagGloballyController(mountPath, plugin) {
+  return async (request, response, next) => {
+    try {
+      const { application } = request.app.locals;
+
+      // CSRF validation
+      if (!validateToken(request)) {
+        return response.status(403).json({ error: "Invalid CSRF token" });
+      }
+
+      const tag = typeof request.body.tag === "string" ? request.body.tag.trim() : "";
+      if (!tag) {
+        return response.redirect(`${mountPath}/admin/reader`);
+      }
+
+      const actorUrl = getTagsPubActorUrl(tag);
+
+      // Send AP Undo(Follow) activity via Fedify
+      const result = await plugin.unfollowActor(actorUrl);
+      if (!result.ok) {
+        const errorMsg = encodeURIComponent(result.error || "Unfollow failed");
+        return response.redirect(
+          `${mountPath}/admin/reader/tag?tag=${encodeURIComponent(tag)}&error=${errorMsg}`
+        );
+      }
+
+      // Remove global follow state
+      const collections = {
+        ap_followed_tags: application?.collections?.get("ap_followed_tags"),
+      };
+      await removeGlobalFollow(collections, tag);
+
+      return response.redirect(`${mountPath}/admin/reader/tag?tag=${encodeURIComponent(tag)}`);
+    } catch (error) {
+      next(error);
+    }
+  };
+}

package/lib/controllers/tag-timeline.js

@@ -45,17 +45,20 @@ export function tagTimelineController(mountPath) {
         interactionsCol: application?.collections?.get("ap_interactions"),
       });
 
-      // Check if this hashtag is followed
+      // Check if this hashtag is followed (local and/or global)
       const followedTagsCol = application?.collections?.get("ap_followed_tags");
       let isFollowed = false;
+      let isGloballyFollowed = false;
       if (followedTagsCol) {
         const followed = await followedTagsCol.findOne({
           tag: { $regex: new RegExp(`^${tag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "i") }
         });
-        isFollowed = !!followed;
+        isFollowed = !!(followed?.followedAt);
+        isGloballyFollowed = !!(followed?.globalFollow);
       }
 
       const csrfToken = getToken(request.session);
+      const error = typeof request.query.error === "string" ? request.query.error : null;
 
       response.render("activitypub-tag-timeline", {
         title: `#${tag}`,
@@ -68,6 +71,8 @@ export function tagTimelineController(mountPath) {
         csrfToken,
         mountPath,
         isFollowed,
+        isGloballyFollowed,
+        error,
       });
     } catch (error) {
       next(error);

package/lib/inbox-handlers.js

@@ -984,24 +984,6 @@ export async function handleUpdate(item, collections, ctx, handle) {
 
   const existing = await collections.ap_followers.findOne({ actorUrl });
   if (existing) {
-    let updatedAvatar = "";
-    try {
-      updatedAvatar = actorObj.icon
-        ? (await actorObj.icon)?.url?.href || ""
-        : "";
-    } catch {
-      // Icon fetch failed
-    }
-
-    let updatedBanner = "";
-    try {
-      updatedBanner = actorObj.image
-        ? (await actorObj.image)?.url?.href || ""
-        : "";
-    } catch {
-      // Banner fetch failed
-    }
-
     await collections.ap_followers.updateOne(
       { actorUrl },
       {
@@ -1011,8 +993,9 @@ export async function handleUpdate(item, collections, ctx, handle) {
             actorObj.preferredUsername?.toString() ||
             actorUrl,
           handle: actorObj.preferredUsername?.toString() || "",
-          avatar: updatedAvatar,
-          banner: updatedBanner,
+          avatar: actorObj.icon
+            ? (await actorObj.icon)?.url?.href || ""
+            : "",
           updatedAt: new Date().toISOString(),
         },
       },

package/lib/inbox-listeners.js

@@ -46,31 +46,12 @@ export function registerInboxListeners(inboxChain, options) {
 
   const getAuthLoader = (ctx) => ctx.getDocumentLoader({ identifier: handle });
 
-  // Diagnostic: track listener invocations to detect federation stalls
-  const _diag = { count: 0, lastType: "", lastActor: "", lastAt: 0 };
-  const _diagInterval = setInterval(() => {
-    if (_diag.count > 0) {
-      console.info(`[inbox-diag] ${_diag.count} activities received in last 5min (last: ${_diag.lastType} from ${_diag.lastActor})`);
-      _diag.count = 0;
-    }
-  }, 5 * 60 * 1000);
-  // Prevent timer from keeping the process alive
-  _diagInterval.unref?.();
-
-  const _diagTrack = (type, actorUrl) => {
-    _diag.count++;
-    _diag.lastType = type;
-    _diag.lastActor = actorUrl?.split("/").pop() || "?";
-    _diag.lastAt = Date.now();
-  };
-
   inboxChain
     // ── Follow ──────────────────────────────────────────────────────
     // Synchronous: Accept/Reject + follower storage (federation requirement)
     // Async: notification + activity log
     .on(Follow, async (ctx, follow) => {
       const actorUrl = follow.actorId?.href || "";
-      _diagTrack("Follow", actorUrl);
       if (await isServerBlocked(actorUrl, collections)) return;
       await touchKeyFreshness(collections, actorUrl);
       await resetDeliveryStrikes(collections, actorUrl);
@@ -85,30 +66,13 @@ export function registerInboxListeners(inboxChain, options) {
         followerActor.preferredUsername?.toString() ||
         followerUrl;
 
-      let followerAvatar = "";
-      try {
-        followerAvatar = followerActor.icon
-          ? (await followerActor.icon)?.url?.href || ""
-          : "";
-      } catch {
-        // Icon fetch failed
-      }
-
-      let followerBanner = "";
-      try {
-        followerBanner = followerActor.image
-          ? (await followerActor.image)?.url?.href || ""
-          : "";
-      } catch {
-        // Banner fetch failed
-      }
-
       const followerData = {
         actorUrl: followerUrl,
         handle: followerActor.preferredUsername?.toString() || "",
         name: followerName,
-        avatar: followerAvatar,
-        banner: followerBanner,
+        avatar: followerActor.icon
+          ? (await followerActor.icon)?.url?.href || ""
+          : "",
         inbox: followerActor.inbox?.id?.href || "",
         sharedInbox: followerActor.endpoints?.sharedInbox?.href || "",
       };
@@ -245,7 +209,6 @@ export function registerInboxListeners(inboxChain, options) {
     // ── Announce ────────────────────────────────────────────────────
     .on(Announce, async (ctx, announce) => {
       const actorUrl = announce.actorId?.href || "";
-      _diagTrack("Announce", actorUrl);
       if (await isServerBlocked(actorUrl, collections)) return;
       await touchKeyFreshness(collections, actorUrl);
       await resetDeliveryStrikes(collections, actorUrl);
@@ -261,7 +224,6 @@ export function registerInboxListeners(inboxChain, options) {
     // ── Create ──────────────────────────────────────────────────────
     .on(Create, async (ctx, create) => {
       const actorUrl = create.actorId?.href || "";
-      _diagTrack("Create", actorUrl);
       if (await isServerBlocked(actorUrl, collections)) return;
       await touchKeyFreshness(collections, actorUrl);
       await resetDeliveryStrikes(collections, actorUrl);
@@ -312,7 +274,6 @@ export function registerInboxListeners(inboxChain, options) {
     // ── Delete ──────────────────────────────────────────────────────
     .on(Delete, async (ctx, del) => {
       const actorUrl = del.actorId?.href || "";
-      _diagTrack("Delete", actorUrl);
       if (await isServerBlocked(actorUrl, collections)) return;
       await touchKeyFreshness(collections, actorUrl);
       await resetDeliveryStrikes(collections, actorUrl);
@@ -342,7 +303,6 @@ export function registerInboxListeners(inboxChain, options) {
     // ── Update ──────────────────────────────────────────────────────
     .on(Update, async (ctx, update) => {
       const actorUrl = update.actorId?.href || "";
-      _diagTrack("Update", actorUrl);
       if (await isServerBlocked(actorUrl, collections)) return;
       await touchKeyFreshness(collections, actorUrl);
       await resetDeliveryStrikes(collections, actorUrl);

package/lib/inbox-queue.js

@@ -83,32 +83,11 @@ export async function enqueueActivity(collections, { activityType, actorUrl, obj
  * @returns {NodeJS.Timeout} Interval ID (for cleanup)
  */
 export function startInboxProcessor(collections, getCtx, handle) {
-  // Diagnostic: detect stuck processing items and log queue health
-  let _diagProcessed = 0;
-  const _diagInterval = setInterval(async () => {
-    try {
-      const stuck = await collections.ap_inbox_queue?.countDocuments({ status: "processing" }) || 0;
-      const pending = await collections.ap_inbox_queue?.countDocuments({ status: "pending" }) || 0;
-      if (stuck > 0 || _diagProcessed > 0 || pending > 10) {
-        console.info(`[inbox-queue-diag] processed=${_diagProcessed}/5min pending=${pending} stuck_processing=${stuck}`);
-      }
-      _diagProcessed = 0;
-    } catch { /* ignore */ }
-  }, 5 * 60 * 1000);
-  _diagInterval.unref?.();
-
   const intervalId = setInterval(async () => {
     try {
       const ctx = getCtx();
       if (ctx) {
-        const before = Date.now();
         await processNextItem(collections, ctx, handle);
-        const elapsed = Date.now() - before;
-        if (elapsed > 0) _diagProcessed++;
-        // Warn if a single item takes too long (potential hang)
-        if (elapsed > 30_000) {
-          console.warn(`[inbox-queue-diag] slow item: ${elapsed}ms`);
-        }
       }
     } catch (error) {
       console.error("[inbox-queue] Processor error:", error.message);

package/lib/mastodon/routes/accounts.js

@@ -170,11 +170,12 @@ router.get("/api/v1/accounts/relationships", async (req, res, next) => {
 
     const collections = req.app.locals.mastodonCollections;
 
-    const [followers, following, blocked, muted] = await Promise.all([
+    const [followers, following, blocked, muted, blockedServers] = await Promise.all([
       collections.ap_followers.find({}).toArray(),
       collections.ap_following.find({}).toArray(),
       collections.ap_blocked.find({}).toArray(),
       collections.ap_muted.find({}).toArray(),
+      collections.ap_blocked_servers?.find({}).toArray() || [],
     ]);
 
     const followerIds = new Set(followers.map((f) => remoteActorId(f.actorUrl)));
@@ -182,6 +183,21 @@ router.get("/api/v1/accounts/relationships", async (req, res, next) => {
     const blockedIds = new Set(blocked.map((b) => remoteActorId(b.url)));
     const mutedIds = new Set(muted.filter((m) => m.url).map((m) => remoteActorId(m.url)));
 
+    // Build domain-blocked actor ID set by checking known actors against blocked server hostnames
+    const blockedDomains = new Set(blockedServers.map((s) => s.hostname).filter(Boolean));
+    const domainBlockedIds = new Set();
+    if (blockedDomains.size > 0) {
+      const allActors = [...followers, ...following];
+      for (const actor of allActors) {
+        try {
+          const domain = new URL(actor.actorUrl).hostname;
+          if (blockedDomains.has(domain)) {
+            domainBlockedIds.add(remoteActorId(actor.actorUrl));
+          }
+        } catch { /* skip invalid URLs */ }
+      }
+    }
+
     const relationships = ids.map((id) => ({
       id,
       following: followingIds.has(id),
@@ -195,7 +211,7 @@ router.get("/api/v1/accounts/relationships", async (req, res, next) => {
       muting_notifications: mutedIds.has(id),
       requested: false,
       requested_by: false,
-      domain_blocking: false,
+      domain_blocking: domainBlockedIds.has(id),
       endorsed: false,
       note: "",
     }));

package/lib/mastodon/routes/notifications.js

@@ -225,25 +225,23 @@ function resolveInternalTypes(mastodonTypes) {
 async function batchFetchStatuses(collections, notifications) {
   const statusMap = new Map();
 
-  // Collect both targetUrl (the post being acted on) and url (the triggering post)
-  // For mention/reply notifications, the url is the actual mention/reply post
-  const allUrls = [
+  const targetUrls = [
     ...new Set(
       notifications
-        .flatMap((n) => [n.targetUrl, n.url])
+        .map((n) => n.targetUrl)
         .filter(Boolean),
     ),
   ];
 
-  if (allUrls.length === 0 || !collections.ap_timeline) {
+  if (targetUrls.length === 0 || !collections.ap_timeline) {
     return statusMap;
   }
 
   const items = await collections.ap_timeline
     .find({
       $or: [
-        { uid: { $in: allUrls } },
-        { url: { $in: allUrls } },
+        { uid: { $in: targetUrls } },
+        { url: { $in: targetUrls } },
       ],
     })
     .toArray();

package/lib/mastodon/routes/stubs.js

@@ -21,6 +21,7 @@
 import express from "express";
 import { serializeStatus } from "../entities/status.js";
 import { parseLimit, buildPaginationQuery, setPaginationHeaders } from "../helpers/pagination.js";
+import { getFollowedTagsWithState } from "../../storage/followed-tags.js";
 
 const router = express.Router(); // eslint-disable-line new-cap
 
@@ -276,8 +277,29 @@ router.get("/api/v1/featured_tags", (req, res) => {
 
 // ─── Followed tags ──────────────────────────────────────────────────────────
 
-router.get("/api/v1/followed_tags", (req, res) => {
-  res.json([]);
+router.get("/api/v1/followed_tags", async (req, res, next) => {
+  try {
+    const collections = req.app.locals.mastodonCollections;
+    if (!collections?.ap_followed_tags) {
+      return res.json([]);
+    }
+
+    const pluginOptions = req.app.locals.mastodonPluginOptions || {};
+    const publicationUrl = pluginOptions.publicationUrl || "";
+    const tags = await getFollowedTagsWithState({ ap_followed_tags: collections.ap_followed_tags });
+
+    const response = tags.map((doc) => ({
+      id: doc._id.toString(),
+      name: doc.tag,
+      url: `${publicationUrl.replace(/\/$/, "")}/tags/${doc.tag}`,
+      history: [],
+      following: true,
+    }));
+
+    res.json(response);
+  } catch (error) {
+    next(error);
+  }
 });
 
 // ─── Suggestions ────────────────────────────────────────────────────────────
@@ -314,8 +336,15 @@ router.get("/api/v1/conversations", (req, res) => {
 
 // ─── Domain blocks ──────────────────────────────────────────────────────────
 
-router.get("/api/v1/domain_blocks", (req, res) => {
-  res.json([]);
+router.get("/api/v1/domain_blocks", async (req, res) => {
+  try {
+    const collections = req.app.locals.mastodonCollections;
+    if (!collections?.ap_blocked_servers) return res.json([]);
+    const docs = await collections.ap_blocked_servers.find({}).toArray();
+    res.json(docs.map((d) => d.hostname).filter(Boolean));
+  } catch {
+    res.json([]);
+  }
 });
 
 // ─── Endorsements ───────────────────────────────────────────────────────────

package/lib/resolve-author.js

@@ -91,11 +91,9 @@ export async function resolveAuthor(
   }
 
   // Strategy 2: Use author URL from timeline or notifications
-  // Support both Map (admin controllers) and plain object (Mastodon API)
   if (collections) {
-    const col = (name) => collections.get?.(name) ?? collections[name];
-    const ap_timeline = col("ap_timeline");
-    const ap_notifications = col("ap_notifications");
+    const ap_timeline = collections.get("ap_timeline");
+    const ap_notifications = collections.get("ap_notifications");
 
     // Search timeline by both uid (canonical) and url (display)
     let authorUrl = null;

package/lib/storage/followed-tags.js

@@ -15,6 +15,17 @@ export async function getFollowedTags(collections) {
   return docs.map((d) => d.tag);
 }
 
+/**
+ * Get all followed hashtags with full state (local + global follow tracking)
+ * @param {object} collections - MongoDB collections
+ * @returns {Promise<Array<{tag: string, followedAt?: string, globalFollow?: boolean, globalActorUrl?: string}>>}
+ */
+export async function getFollowedTagsWithState(collections) {
+  const { ap_followed_tags } = collections;
+  if (!ap_followed_tags) return [];
+  return ap_followed_tags.find({}).sort({ followedAt: -1 }).toArray();
+}
+
 /**
  * Follow a hashtag
  * @param {object} collections - MongoDB collections
@@ -36,16 +47,31 @@ export async function followTag(collections, tag) {
 }
 
 /**
- * Unfollow a hashtag
+ * Unfollow a hashtag locally.
+ * If a global follow (tags.pub) is active, preserves the document with global state intact.
+ * Only deletes the document entirely when no global follow is active.
  * @param {object} collections - MongoDB collections
  * @param {string} tag - Hashtag string (without # prefix)
- * @returns {Promise<boolean>} true if removed, false if not found
+ * @returns {Promise<boolean>} true if removed/updated, false if not found
  */
 export async function unfollowTag(collections, tag) {
   const { ap_followed_tags } = collections;
   const normalizedTag = tag.toLowerCase().trim().replace(/^#/, "");
   if (!normalizedTag) return false;
 
+  // Check if a global follow is active before deleting
+  const existing = await ap_followed_tags.findOne({ tag: normalizedTag });
+  if (!existing) return false;
+
+  if (existing.globalFollow) {
+    // Preserve the document — only unset the local follow fields
+    await ap_followed_tags.updateOne(
+      { tag: normalizedTag },
+      { $unset: { followedAt: "" } }
+    );
+    return true;
+  }
+
   const result = await ap_followed_tags.deleteOne({ tag: normalizedTag });
   return result.deletedCount > 0;
 }
@@ -63,3 +89,61 @@ export async function isTagFollowed(collections, tag) {
   const doc = await ap_followed_tags.findOne({ tag: normalizedTag });
   return !!doc;
 }
+
+/**
+ * Returns the deterministic tags.pub actor URL for a hashtag.
+ * @param {string} tag - Hashtag string (without # prefix)
+ * @returns {string} Actor URL
+ */
+export function getTagsPubActorUrl(tag) {
+  return `https://tags.pub/user/${tag.toLowerCase()}`;
+}
+
+/**
+ * Set global follow state for a hashtag (upsert — works even with no local follow).
+ * @param {object} collections - MongoDB collections
+ * @param {string} tag - Hashtag string (without # prefix)
+ * @param {string} actorUrl - The tags.pub actor URL
+ * @returns {Promise<void>}
+ */
+export async function setGlobalFollow(collections, tag, actorUrl) {
+  const { ap_followed_tags } = collections;
+  const normalizedTag = tag.toLowerCase().trim().replace(/^#/, "");
+  if (!normalizedTag) return;
+
+  await ap_followed_tags.updateOne(
+    { tag: normalizedTag },
+    {
+      $set: { globalFollow: true, globalActorUrl: actorUrl },
+      $setOnInsert: { tag: normalizedTag },
+    },
+    { upsert: true }
+  );
+}
+
+/**
+ * Remove global follow state for a hashtag.
+ * If no local follow exists (no followedAt), deletes the document entirely.
+ * @param {object} collections - MongoDB collections
+ * @param {string} tag - Hashtag string (without # prefix)
+ * @returns {Promise<void>}
+ */
+export async function removeGlobalFollow(collections, tag) {
+  const { ap_followed_tags } = collections;
+  const normalizedTag = tag.toLowerCase().trim().replace(/^#/, "");
+  if (!normalizedTag) return;
+
+  const existing = await ap_followed_tags.findOne({ tag: normalizedTag });
+  if (!existing) return;
+
+  if (existing.followedAt) {
+    // Local follow is still active — just unset the global fields
+    await ap_followed_tags.updateOne(
+      { tag: normalizedTag },
+      { $unset: { globalFollow: "", globalActorUrl: "" } }
+    );
+  } else {
+    // No local follow — delete the document entirely
+    await ap_followed_tags.deleteOne({ tag: normalizedTag });
+  }
+}

package/locales/en.json

@@ -297,7 +297,11 @@
         "noPosts": "No posts found with #%s in your timeline.",
         "followTag": "Follow hashtag",
         "unfollowTag": "Unfollow hashtag",
-        "following": "Following"
+        "following": "Following",
+        "followGlobally": "Follow globally via tags.pub",
+        "unfollowGlobally": "Unfollow global",
+        "globallyFollowing": "Following globally",
+        "globalFollowError": "Failed to follow globally: %s"
       },
       "pagination": {
         "newer": "← Newer",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.7.4",
+  "version": "3.8.0",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",

package/views/activitypub-federation-mgmt.njk

@@ -116,6 +116,53 @@
     {% endif %}
   </section>
 
+  {# --- Moderation Overview --- #}
+  <section class="ap-federation__section">
+    <h2>Moderation</h2>
+    {% if blockedServers.length > 0 %}
+      <h3>Blocked servers ({{ blockedServers.length }})</h3>
+      <div class="ap-federation__stats-grid">
+        {% for server in blockedServers %}
+          <div class="ap-federation__stat-card">
+            <span class="ap-federation__stat-label">🚫 {{ server.hostname }}</span>
+            {% if server.blockedAt %}
+              <span class="ap-federation__stat-count" style="font-size: 0.75rem; opacity: 0.7">{{ server.blockedAt | date("PPp") }}</span>
+            {% endif %}
+          </div>
+        {% endfor %}
+      </div>
+    {% else %}
+      {{ prose({ text: "No servers blocked." }) }}
+    {% endif %}
+
+    {% if blockedAccounts.length > 0 %}
+      <h3>Blocked accounts ({{ blockedAccounts.length }})</h3>
+      <div class="ap-federation__stats-grid">
+        {% for account in blockedAccounts %}
+          <div class="ap-federation__stat-card">
+            <span class="ap-federation__stat-label">🚫 {{ account.url or account.handle or "Unknown" }}</span>
+            {% if account.blockedAt %}
+              <span class="ap-federation__stat-count" style="font-size: 0.75rem; opacity: 0.7">{{ account.blockedAt | date("PPp") }}</span>
+            {% endif %}
+          </div>
+        {% endfor %}
+      </div>
+    {% else %}
+      {{ prose({ text: "No accounts blocked." }) }}
+    {% endif %}
+
+    {% if mutedAccounts.length > 0 %}
+      <h3>Muted ({{ mutedAccounts.length }})</h3>
+      <div class="ap-federation__stats-grid">
+        {% for muted in mutedAccounts %}
+          <div class="ap-federation__stat-card">
+            <span class="ap-federation__stat-label">🔇 {{ muted.url or muted.keyword or "Unknown" }}</span>
+          </div>
+        {% endfor %}
+      </div>
+    {% endif %}
+  </section>
+
   {# --- JSON Modal --- #}
   <div class="ap-federation__modal-overlay" x-show="jsonModalOpen" x-cloak
     @click.self="jsonModalOpen = false" @keydown.escape.window="jsonModalOpen = false">

package/views/activitypub-tag-timeline.njk

@@ -4,12 +4,15 @@
   {# Tag header #}
   <header class="ap-tag-header">
     <div class="ap-tag-header__info">
-      <h2 class="ap-tag-header__title">#{{ hashtag }}</h2>
+      <h2 class="ap-tag-header__title">#{{ hashtag }}{% if isGloballyFollowed %} <span class="ap-tag-header__global-badge" title="{{ __('activitypub.reader.tagTimeline.globallyFollowing') }}">🌐</span>{% endif %}</h2>
       <p class="ap-tag-header__count">
         {{ __("activitypub.reader.tagTimeline.postsTagged", items.length) }}
       </p>
     </div>
     <div class="ap-tag-header__actions">
+      {% if error %}
+        <p class="ap-tag-header__error">{{ __("activitypub.reader.tagTimeline.globalFollowError", error) }}</p>
+      {% endif %}
       {% if isFollowed %}
         <form action="{{ mountPath }}/admin/reader/unfollow-tag" method="post" class="ap-tag-header__follow-form">
           <input type="hidden" name="_csrf" value="{{ csrfToken }}">
@@ -27,6 +30,23 @@
           </button>
         </form>
       {% endif %}
+      {% if isGloballyFollowed %}
+        <form action="{{ mountPath }}/admin/reader/unfollow-tag-global" method="post" class="ap-tag-header__follow-form">
+          <input type="hidden" name="_csrf" value="{{ csrfToken }}">
+          <input type="hidden" name="tag" value="{{ hashtag }}">
+          <button type="submit" class="ap-tag-header__unfollow-btn ap-tag-header__unfollow-btn--global">
+            🌐 {{ __("activitypub.reader.tagTimeline.unfollowGlobally") }}
+          </button>
+        </form>
+      {% else %}
+        <form action="{{ mountPath }}/admin/reader/follow-tag-global" method="post" class="ap-tag-header__follow-form">
+          <input type="hidden" name="_csrf" value="{{ csrfToken }}">
+          <input type="hidden" name="tag" value="{{ hashtag }}">
+          <button type="submit" class="ap-tag-header__follow-btn ap-tag-header__follow-btn--global">
+            🌐 {{ __("activitypub.reader.tagTimeline.followGlobally") }}
+          </button>
+        </form>
+      {% endif %}
       <a href="{{ mountPath }}/admin/reader" class="ap-tag-header__back">
         ← {{ __("activitypub.reader.title") }}
       </a>