@rmdes/indiekit-endpoint-activitypub 3.8.3 → 3.8.5

package/index.js

@@ -5,6 +5,11 @@ import { createMastodonRouter } from "./lib/mastodon/router.js";
 import { setLocalIdentity } from "./lib/mastodon/entities/status.js";
 import { initRedisCache } from "./lib/redis-cache.js";
 import { lookupWithSecurity } from "./lib/lookup-helpers.js";
+import {
+  needsDirectFollow,
+  sendDirectFollow,
+  sendDirectUnfollow,
+} from "./lib/direct-follow.js";
 import {
   createFedifyMiddleware,
 } from "./lib/federation-bridge.js";
@@ -231,13 +236,6 @@ export default class ActivityPubEndpoint {
       // authenticated `routes` getter, not the federation layer.
       if (req.path.startsWith("/admin")) return next();
 
-      // Diagnostic: log inbox POSTs to detect federation stalls
-      if (req.method === "POST" && req.path.includes("inbox")) {
-        const ua = req.get("user-agent") || "unknown";
-        const bodyParsed = req.body !== undefined && Object.keys(req.body || {}).length > 0;
-        console.info(`[federation-diag] POST ${req.path} from=${ua.slice(0, 60)} bodyParsed=${bodyParsed} readable=${req.readable}`);
-      }
-
       // Fedify's acceptsJsonLd() treats Accept: */* as NOT accepting JSON-LD
       // (it only returns true for explicit application/activity+json etc.).
       // Remote servers fetching actor URLs for HTTP Signature verification
@@ -729,6 +727,32 @@ export default class ActivityPubEndpoint {
    * @param {string} [actorInfo.photo] - Actor avatar URL
    * @returns {Promise<{ok: boolean, error?: string}>}
    */
+  /**
+   * Load the RSA private key from ap_keys for direct HTTP Signature signing.
+   * @returns {Promise<CryptoKey|null>}
+   */
+  async _loadRsaPrivateKey() {
+    try {
+      const keyDoc = await this._collections.ap_keys.findOne({
+        privateKeyPem: { $exists: true },
+      });
+      if (!keyDoc?.privateKeyPem) return null;
+      const pemBody = keyDoc.privateKeyPem
+        .replace(/-----[^-]+-----/g, "")
+        .replace(/\s/g, "");
+      return await crypto.subtle.importKey(
+        "pkcs8",
+        Buffer.from(pemBody, "base64"),
+        { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+        true,
+        ["sign"],
+      );
+    } catch (error) {
+      console.error("[ActivityPub] Failed to load RSA key:", error.message);
+      return null;
+    }
+  }
+
   async followActor(actorUrl, actorInfo = {}) {
     if (!this._federation) {
       return { ok: false, error: "Federation not initialized" };
@@ -755,14 +779,33 @@ export default class ActivityPubEndpoint {
       }
 
       // Send Follow activity
-      const follow = new Follow({
-        actor: ctx.getActorUri(handle),
-        object: new URL(actorUrl),
-      });
-
-      await ctx.sendActivity({ identifier: handle }, remoteActor, follow, {
-        orderingKey: actorUrl,
-      });
+      if (needsDirectFollow(actorUrl)) {
+        // tags.pub rejects Fedify's LD Signature context (identity/v1).
+        // Send a minimal signed Follow directly, bypassing the outbox pipeline.
+        // See: https://github.com/social-web-foundation/tags.pub/issues/10
+        const rsaKey = await this._loadRsaPrivateKey();
+        if (!rsaKey) {
+          return { ok: false, error: "No RSA key available for direct follow" };
+        }
+        const result = await sendDirectFollow({
+          actorUri: ctx.getActorUri(handle).href,
+          targetActorUrl: actorUrl,
+          inboxUrl: remoteActor.inboxId?.href,
+          keyId: `${ctx.getActorUri(handle).href}#main-key`,
+          privateKey: rsaKey,
+        });
+        if (!result.ok) {
+          return { ok: false, error: result.error };
+        }
+      } else {
+        const follow = new Follow({
+          actor: ctx.getActorUri(handle),
+          object: new URL(actorUrl),
+        });
+        await ctx.sendActivity({ identifier: handle }, remoteActor, follow, {
+          orderingKey: actorUrl,
+        });
+      }
 
       // Store in ap_following
       const name =
@@ -866,19 +909,35 @@ export default class ActivityPubEndpoint {
         return { ok: true };
       }
 
-      const follow = new Follow({
-        actor: ctx.getActorUri(handle),
-        object: new URL(actorUrl),
-      });
-
-      const undo = new Undo({
-        actor: ctx.getActorUri(handle),
-        object: follow,
-      });
-
-      await ctx.sendActivity({ identifier: handle }, remoteActor, undo, {
-        orderingKey: actorUrl,
-      });
+      if (needsDirectFollow(actorUrl)) {
+        // tags.pub rejects Fedify's LD Signature context (identity/v1).
+        // See: https://github.com/social-web-foundation/tags.pub/issues/10
+        const rsaKey = await this._loadRsaPrivateKey();
+        if (rsaKey) {
+          const result = await sendDirectUnfollow({
+            actorUri: ctx.getActorUri(handle).href,
+            targetActorUrl: actorUrl,
+            inboxUrl: remoteActor.inboxId?.href,
+            keyId: `${ctx.getActorUri(handle).href}#main-key`,
+            privateKey: rsaKey,
+          });
+          if (!result.ok) {
+            console.warn(`[ActivityPub] Direct unfollow failed for ${actorUrl}: ${result.error}`);
+          }
+        }
+      } else {
+        const follow = new Follow({
+          actor: ctx.getActorUri(handle),
+          object: new URL(actorUrl),
+        });
+        const undo = new Undo({
+          actor: ctx.getActorUri(handle),
+          object: follow,
+        });
+        await ctx.sendActivity({ identifier: handle }, remoteActor, undo, {
+          orderingKey: actorUrl,
+        });
+      }
       await this._collections.ap_following.deleteOne({ actorUrl });
 
       console.info(`[ActivityPub] Sent Undo(Follow) to ${actorUrl}`);
@@ -1530,6 +1589,7 @@ export default class ActivityPubEndpoint {
         federation: this._federation,
         followActor: (url, info) => pluginRef.followActor(url, info),
         unfollowActor: (url) => pluginRef.unfollowActor(url),
+        loadRsaKey: () => pluginRef._loadRsaPrivateKey(),
       },
     });
     Indiekit.addEndpoint({

package/lib/controllers/interactions-boost.js

@@ -72,11 +72,16 @@ export function boostController(mountPath, plugin) {
         identifier: handle,
       });
       const { application } = request.app.locals;
+      const rsaKey = await plugin._loadRsaPrivateKey();
       const recipient = await resolveAuthor(
         url,
         ctx,
         documentLoader,
         application?.collections,
+        {
+          privateKey: rsaKey,
+          keyId: `${ctx.getActorUri(handle).href}#main-key`,
+        },
       );
 
       if (recipient) {

package/lib/controllers/interactions-like.js

@@ -49,11 +49,16 @@ export function likeController(mountPath, plugin) {
       });
 
       const { application } = request.app.locals;
+      const rsaKey = await plugin._loadRsaPrivateKey();
       const recipient = await resolveAuthor(
         url,
         ctx,
         documentLoader,
         application?.collections,
+        {
+          privateKey: rsaKey,
+          keyId: `${ctx.getActorUri(handle).href}#main-key`,
+        },
       );
 
       if (!recipient) {
@@ -170,11 +175,16 @@ export function unlikeController(mountPath, plugin) {
         identifier: handle,
       });
 
+      const rsaKey2 = await plugin._loadRsaPrivateKey();
       const recipient = await resolveAuthor(
         url,
         ctx,
         documentLoader,
         application?.collections,
+        {
+          privateKey: rsaKey2,
+          keyId: `${ctx.getActorUri(handle).href}#main-key`,
+        },
       );
 
       if (!recipient) {

package/lib/direct-follow.js

@@ -0,0 +1,163 @@
+/**
+ * Direct Follow/Undo(Follow) for servers that reject Fedify's LD Signatures.
+ *
+ * tags.pub's activitypub-bot uses the `activitystrea.ms` AS2 parser, which
+ * rejects the `https://w3id.org/identity/v1` JSON-LD context that Fedify 2.0
+ * adds for RsaSignature2017. This module sends Follow/Undo(Follow) activities
+ * with a minimal body (no LD Sig, no Data Integrity Proof) signed with
+ * draft-cavage HTTP Signatures.
+ *
+ * Upstream issue: https://github.com/social-web-foundation/tags.pub/issues/10
+ *
+ * @module direct-follow
+ */
+
+import crypto from "node:crypto";
+
+/** Hostnames that need direct follow (bypass Fedify outbox pipeline) */
+const DIRECT_FOLLOW_HOSTS = new Set(["tags.pub"]);
+
+/**
+ * Check if an actor URL requires direct follow delivery.
+ * @param {string} actorUrl
+ * @returns {boolean}
+ */
+export function needsDirectFollow(actorUrl) {
+  try {
+    return DIRECT_FOLLOW_HOSTS.has(new URL(actorUrl).hostname);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Send a Follow activity directly with draft-cavage HTTP Signatures.
+ * @param {object} options
+ * @param {string} options.actorUri - Our actor URI
+ * @param {string} options.targetActorUrl - Remote actor URL to follow
+ * @param {string} options.inboxUrl - Remote actor's inbox URL
+ * @param {string} options.keyId - Our key ID (e.g. ...#main-key)
+ * @param {CryptoKey} options.privateKey - RSA private key for signing
+ * @returns {Promise<{ok: boolean, status?: number, error?: string}>}
+ */
+export async function sendDirectFollow({
+  actorUri,
+  targetActorUrl,
+  inboxUrl,
+  keyId,
+  privateKey,
+}) {
+  const body = JSON.stringify({
+    "@context": "https://www.w3.org/ns/activitystreams",
+    type: "Follow",
+    actor: actorUri,
+    object: targetActorUrl,
+    id: `${actorUri.replace(/\/$/, "")}/#Follow/${crypto.randomUUID()}`,
+  });
+
+  return _signAndSend(inboxUrl, body, keyId, privateKey);
+}
+
+/**
+ * Send an Undo(Follow) activity directly with draft-cavage HTTP Signatures.
+ * @param {object} options
+ * @param {string} options.actorUri - Our actor URI
+ * @param {string} options.targetActorUrl - Remote actor URL to unfollow
+ * @param {string} options.inboxUrl - Remote actor's inbox URL
+ * @param {string} options.keyId - Our key ID (e.g. ...#main-key)
+ * @param {CryptoKey} options.privateKey - RSA private key for signing
+ * @returns {Promise<{ok: boolean, status?: number, error?: string}>}
+ */
+export async function sendDirectUnfollow({
+  actorUri,
+  targetActorUrl,
+  inboxUrl,
+  keyId,
+  privateKey,
+}) {
+  const body = JSON.stringify({
+    "@context": "https://www.w3.org/ns/activitystreams",
+    type: "Undo",
+    actor: actorUri,
+    object: {
+      type: "Follow",
+      actor: actorUri,
+      object: targetActorUrl,
+    },
+    id: `${actorUri.replace(/\/$/, "")}/#Undo/${crypto.randomUUID()}`,
+  });
+
+  return _signAndSend(inboxUrl, body, keyId, privateKey);
+}
+
+/**
+ * Sign a POST request with draft-cavage HTTP Signatures and send it.
+ * @private
+ */
+async function _signAndSend(inboxUrl, body, keyId, privateKey) {
+  const url = new URL(inboxUrl);
+  const date = new Date().toUTCString();
+
+  // Compute SHA-256 digest of the body
+  const digestRaw = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(body),
+  );
+  const digest = "SHA-256=" + Buffer.from(digestRaw).toString("base64");
+
+  // Build draft-cavage signing string
+  const signingString = [
+    `(request-target): post ${url.pathname}`,
+    `host: ${url.host}`,
+    `date: ${date}`,
+    `digest: ${digest}`,
+  ].join("\n");
+
+  // Sign with RSA-SHA256
+  const signature = await crypto.subtle.sign(
+    "RSASSA-PKCS1-v1_5",
+    privateKey,
+    new TextEncoder().encode(signingString),
+  );
+  const signatureB64 = Buffer.from(signature).toString("base64");
+
+  const signatureHeader = [
+    `keyId="${keyId}"`,
+    `algorithm="rsa-sha256"`,
+    `headers="(request-target) host date digest"`,
+    `signature="${signatureB64}"`,
+  ].join(",");
+
+  try {
+    const response = await fetch(inboxUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/activity+json",
+        Date: date,
+        Digest: digest,
+        Host: url.host,
+        Signature: signatureHeader,
+      },
+      body,
+    });
+
+    if (response.ok) {
+      return { ok: true, status: response.status };
+    }
+
+    const errorBody = await response.text().catch(() => "");
+    let detail = errorBody;
+    try {
+      detail = JSON.parse(errorBody).detail || errorBody;
+    } catch {
+      // not JSON
+    }
+    return {
+      ok: false,
+      status: response.status,
+      error: `${response.status} ${response.statusText}: ${detail}`,
+    };
+  } catch (error) {
+    return { ok: false, error: error.message };
+  }
+}

package/lib/mastodon/helpers/interactions.js

@@ -22,7 +22,7 @@ import { resolveAuthor } from "../../resolve-author.js";
  * @param {object} params.interactions - ap_interactions collection
  * @returns {Promise<{ activityId: string }>}
  */
-export async function likePost({ targetUrl, federation, handle, publicationUrl, collections, interactions }) {
+export async function likePost({ targetUrl, federation, handle, publicationUrl, collections, interactions, loadRsaKey }) {
   const { Like } = await import("@fedify/fedify/vocab");
   const ctx = federation.createContext(
     new URL(publicationUrl),
@@ -30,7 +30,11 @@ export async function likePost({ targetUrl, federation, handle, publicationUrl,
   );
 
   const documentLoader = await ctx.getDocumentLoader({ identifier: handle });
-  const recipient = await resolveAuthor(targetUrl, ctx, documentLoader, collections);
+  const rsaKey = loadRsaKey ? await loadRsaKey() : null;
+  const recipient = await resolveAuthor(targetUrl, ctx, documentLoader, collections, {
+    privateKey: rsaKey,
+    keyId: `${ctx.getActorUri(handle).href}#main-key`,
+  });
 
   const uuid = crypto.randomUUID();
   const baseUrl = publicationUrl.replace(/\/$/, "");
@@ -79,7 +83,7 @@ export async function likePost({ targetUrl, federation, handle, publicationUrl,
  * @param {object} params.interactions - ap_interactions collection
  * @returns {Promise<void>}
  */
-export async function unlikePost({ targetUrl, federation, handle, publicationUrl, collections, interactions }) {
+export async function unlikePost({ targetUrl, federation, handle, publicationUrl, collections, interactions, loadRsaKey }) {
   const existing = interactions
     ? await interactions.findOne({ objectUrl: targetUrl, type: "like" })
     : null;
@@ -95,7 +99,11 @@ export async function unlikePost({ targetUrl, federation, handle, publicationUrl
   );
 
   const documentLoader = await ctx.getDocumentLoader({ identifier: handle });
-  const recipient = await resolveAuthor(targetUrl, ctx, documentLoader, collections);
+  const rsaKey = loadRsaKey ? await loadRsaKey() : null;
+  const recipient = await resolveAuthor(targetUrl, ctx, documentLoader, collections, {
+    privateKey: rsaKey,
+    keyId: `${ctx.getActorUri(handle).href}#main-key`,
+  });
 
   if (recipient) {
     const like = new Like({
@@ -131,7 +139,7 @@ export async function unlikePost({ targetUrl, federation, handle, publicationUrl
  * @param {object} params.interactions - ap_interactions collection
  * @returns {Promise<{ activityId: string }>}
  */
-export async function boostPost({ targetUrl, federation, handle, publicationUrl, collections, interactions }) {
+export async function boostPost({ targetUrl, federation, handle, publicationUrl, collections, interactions, loadRsaKey }) {
   const { Announce } = await import("@fedify/fedify/vocab");
   const ctx = federation.createContext(
     new URL(publicationUrl),
@@ -162,7 +170,11 @@ export async function boostPost({ targetUrl, federation, handle, publicationUrl,
 
   // Also send directly to the original post author
   const documentLoader = await ctx.getDocumentLoader({ identifier: handle });
-  const recipient = await resolveAuthor(targetUrl, ctx, documentLoader, collections);
+  const rsaKey = loadRsaKey ? await loadRsaKey() : null;
+  const recipient = await resolveAuthor(targetUrl, ctx, documentLoader, collections, {
+    privateKey: rsaKey,
+    keyId: `${ctx.getActorUri(handle).href}#main-key`,
+  });
   if (recipient) {
     try {
       await ctx.sendActivity({ identifier: handle }, recipient, announce, {

package/lib/mastodon/routes/statuses.js

@@ -614,6 +614,7 @@ function getFederationOpts(req) {
     handle: pluginOptions.handle || "user",
     publicationUrl: pluginOptions.publicationUrl,
     collections: req.app.locals.mastodonCollections,
+    loadRsaKey: pluginOptions.loadRsaKey,
   };
 }
 

package/lib/resolve-author.js

@@ -6,6 +6,8 @@
  *
  * Strategies (tried in order):
  * 1. lookupObject on post URL → getAttributedTo
+ * 1b. Raw signed fetch fallback (for servers like wafrn that return
+ *     non-standard JSON-LD that Fedify can't parse)
  * 2. Timeline/notification DB lookup → lookupObject on stored author URL
  * 3. Extract author URL from post URL pattern → lookupObject
  */
@@ -60,6 +62,9 @@ export function extractAuthorUrl(postUrl) {
  * @param {object} ctx - Fedify context
  * @param {object} documentLoader - Authenticated document loader
  * @param {object} [collections] - Optional MongoDB collections map (application.collections)
+ * @param {object} [options] - Additional options
+ * @param {CryptoKey} [options.privateKey] - RSA private key for raw signed fetch fallback
+ * @param {string} [options.keyId] - Key ID for HTTP Signature (e.g. "...#main-key")
  * @returns {Promise<object|null>} - Fedify Actor object or null
  */
 export async function resolveAuthor(
@@ -67,6 +72,7 @@ export async function resolveAuthor(
   ctx,
   documentLoader,
   collections,
+  options = {},
 ) {
   // Strategy 1: Look up remote post via Fedify (signed request)
   try {
@@ -90,6 +96,46 @@ export async function resolveAuthor(
     );
   }
 
+  // Strategy 1b: Raw signed fetch fallback
+  // Some servers (e.g. wafrn) return AP JSON without @context, which Fedify's
+  // JSON-LD processor rejects. A raw fetch can still extract attributedTo/actor.
+  if (options.privateKey && options.keyId) {
+    try {
+      const { signRequest } = await import("@fedify/fedify/sig");
+      const request = new Request(postUrl, {
+        method: "GET",
+        headers: { Accept: "application/activity+json" },
+      });
+      const signed = await signRequest(request, options.privateKey, new URL(options.keyId), {
+        spec: "draft-cavage-http-signatures-12",
+      });
+      const res = await fetch(signed, { redirect: "follow" });
+      if (res.ok) {
+        const contentType = res.headers.get("content-type") || "";
+        if (contentType.includes("json")) {
+          const json = await res.json();
+          const authorUrl = json.attributedTo || json.actor;
+          if (authorUrl && typeof authorUrl === "string") {
+            const actor = await lookupWithSecurity(ctx, new URL(authorUrl), {
+              documentLoader,
+            });
+            if (actor) {
+              console.info(
+                `[ActivityPub] Resolved author via raw fetch for ${postUrl} → ${authorUrl}`,
+              );
+              return actor;
+            }
+          }
+        }
+      }
+    } catch (error) {
+      console.warn(
+        `[ActivityPub] Raw fetch fallback failed for ${postUrl}:`,
+        error.message,
+      );
+    }
+  }
+
   // Strategy 2: Use author URL from timeline or notifications
   if (collections) {
     const ap_timeline = collections.get("ap_timeline");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.8.3",
+  "version": "3.8.5",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",