@rmdes/indiekit-endpoint-activitypub 3.8.7 → 3.9.0

package/lib/batch-broadcast.js

@@ -0,0 +1,98 @@
+/**
+ * Shared batch broadcast for delivering activities to all followers.
+ * Deduplicates by shared inbox and delivers in batches with delay.
+ * @module batch-broadcast
+ */
+import { logActivity } from "./activity-log.js";
+
+const BATCH_SIZE = 25;
+const BATCH_DELAY_MS = 5000;
+
+/**
+ * Broadcast an activity to all followers via batch delivery.
+ *
+ * @param {object} options
+ * @param {object} options.federation - Fedify Federation instance
+ * @param {object} options.collections - MongoDB collections (needs ap_followers, ap_activities)
+ * @param {string} options.publicationUrl - Our publication URL
+ * @param {string} options.handle - Our actor handle
+ * @param {object} options.activity - Fedify activity object to send
+ * @param {string} options.label - Human-readable label for logging (e.g. "Update(Person)")
+ * @param {string} [options.objectUrl] - URL of the object being broadcast about
+ */
+export async function batchBroadcast({
+  federation,
+  collections,
+  publicationUrl,
+  handle,
+  activity,
+  label,
+  objectUrl,
+}) {
+  const ctx = federation.createContext(new URL(publicationUrl), {
+    handle,
+    publicationUrl,
+  });
+
+  const followers = await collections.ap_followers
+    .find({})
+    .project({ actorUrl: 1, inbox: 1, sharedInbox: 1 })
+    .toArray();
+
+  // Deduplicate by shared inbox
+  const inboxMap = new Map();
+  for (const f of followers) {
+    const key = f.sharedInbox || f.inbox;
+    if (key && !inboxMap.has(key)) {
+      inboxMap.set(key, f);
+    }
+  }
+
+  const uniqueRecipients = [...inboxMap.values()];
+  let delivered = 0;
+  let failed = 0;
+
+  console.info(
+    `[ActivityPub] Broadcasting ${label} to ${uniqueRecipients.length} ` +
+      `unique inboxes (${followers.length} followers) in batches of ${BATCH_SIZE}`,
+  );
+
+  for (let i = 0; i < uniqueRecipients.length; i += BATCH_SIZE) {
+    const batch = uniqueRecipients.slice(i, i + BATCH_SIZE);
+    const recipients = batch.map((f) => ({
+      id: new URL(f.actorUrl),
+      inboxId: new URL(f.inbox || f.sharedInbox),
+      endpoints: f.sharedInbox
+        ? { sharedInbox: new URL(f.sharedInbox) }
+        : undefined,
+    }));
+
+    try {
+      await ctx.sendActivity({ identifier: handle }, recipients, activity, {
+        preferSharedInbox: true,
+      });
+      delivered += batch.length;
+    } catch (error) {
+      failed += batch.length;
+      console.warn(
+        `[ActivityPub] ${label} batch ${Math.floor(i / BATCH_SIZE) + 1} failed: ${error.message}`,
+      );
+    }
+
+    if (i + BATCH_SIZE < uniqueRecipients.length) {
+      await new Promise((resolve) => setTimeout(resolve, BATCH_DELAY_MS));
+    }
+  }
+
+  console.info(
+    `[ActivityPub] ${label} broadcast complete: ${delivered} delivered, ${failed} failed`,
+  );
+
+  await logActivity(collections.ap_activities, {
+    direction: "outbound",
+    type: label.includes("(") ? label.split("(")[0] : label,
+    actorUrl: publicationUrl,
+    objectUrl: objectUrl || "",
+    summary: `Sent ${label} to ${delivered}/${uniqueRecipients.length} inboxes`,
+  }).catch(() => {});
+}

package/lib/controllers/compose.js

@@ -5,6 +5,7 @@
 import { getToken, validateToken } from "../csrf.js";
 import { sanitizeContent } from "../timeline-store.js";
 import { lookupWithSecurity } from "../lookup-helpers.js";
+import { createContext, getHandle, isFederationReady } from "../federation-actions.js";
 
 /**
  * Fetch syndication targets from the Micropub config endpoint.
@@ -69,18 +70,15 @@ export function composeController(mountPath, plugin) {
           : null;
 
         // If not in timeline, try to look up remotely
-        if (!replyContext && plugin._federation) {
+        if (!replyContext && isFederationReady(plugin)) {
           try {
-            const handle = plugin.options.actor.handle;
-            const ctx = plugin._federation.createContext(
-              new URL(plugin._publicationUrl),
-              { handle, publicationUrl: plugin._publicationUrl },
-            );
+            const handle = getHandle(plugin);
+            const ctx = createContext(plugin);
             // Use authenticated document loader for Authorized Fetch
             const documentLoader = await ctx.getDocumentLoader({
               identifier: handle,
             });
-            const remoteObject = await lookupWithSecurity(ctx,new URL(replyTo), {
+            const remoteObject = await lookupWithSecurity(ctx, new URL(replyTo), {
               documentLoader,
             });
 

package/lib/controllers/interactions-boost.js

@@ -5,6 +5,7 @@
 
 import { validateToken } from "../csrf.js";
 import { resolveAuthor } from "../resolve-author.js";
+import { createContext, getHandle, getPublicationUrl, isFederationReady } from "../federation-actions.js";
 
 /**
  * POST /admin/reader/boost — send an Announce activity to followers.
@@ -28,7 +29,7 @@ export function boostController(mountPath, plugin) {
         });
       }
 
-      if (!plugin._federation) {
+      if (!isFederationReady(plugin)) {
         return response.status(503).json({
           success: false,
           error: "Federation not initialized",
@@ -36,14 +37,11 @@ export function boostController(mountPath, plugin) {
       }
 
       const { Announce } = await import("@fedify/fedify/vocab");
-      const handle = plugin.options.actor.handle;
-      const ctx = plugin._federation.createContext(
-        new URL(plugin._publicationUrl),
-        { handle, publicationUrl: plugin._publicationUrl },
-      );
+      const handle = getHandle(plugin);
+      const ctx = createContext(plugin);
 
       const uuid = crypto.randomUUID();
-      const baseUrl = plugin._publicationUrl.replace(/\/$/, "");
+      const baseUrl = getPublicationUrl(plugin).replace(/\/$/, "");
       const activityId = `${baseUrl}/activitypub/boosts/${uuid}`;
 
       const publicAddress = new URL(
@@ -160,7 +158,7 @@ export function unboostController(mountPath, plugin) {
         });
       }
 
-      if (!plugin._federation) {
+      if (!isFederationReady(plugin)) {
         return response.status(503).json({
           success: false,
           error: "Federation not initialized",
@@ -182,11 +180,8 @@ export function unboostController(mountPath, plugin) {
       }
 
       const { Announce, Undo } = await import("@fedify/fedify/vocab");
-      const handle = plugin.options.actor.handle;
-      const ctx = plugin._federation.createContext(
-        new URL(plugin._publicationUrl),
-        { handle, publicationUrl: plugin._publicationUrl },
-      );
+      const handle = getHandle(plugin);
+      const ctx = createContext(plugin);
 
       // Construct Undo(Announce)
       const announce = new Announce({

package/lib/controllers/interactions-like.js

@@ -5,6 +5,7 @@
 
 import { validateToken } from "../csrf.js";
 import { resolveAuthor } from "../resolve-author.js";
+import { createContext, getHandle, getPublicationUrl, isFederationReady } from "../federation-actions.js";
 
 /**
  * POST /admin/reader/like — send a Like activity to the post author.
@@ -30,7 +31,7 @@ export function likeController(mountPath, plugin) {
         });
       }
 
-      if (!plugin._federation) {
+      if (!isFederationReady(plugin)) {
         return response.status(503).json({
           success: false,
           error: "Federation not initialized",
@@ -38,11 +39,8 @@ export function likeController(mountPath, plugin) {
       }
 
       const { Like } = await import("@fedify/fedify/vocab");
-      const handle = plugin.options.actor.handle;
-      const ctx = plugin._federation.createContext(
-        new URL(plugin._publicationUrl),
-        { handle, publicationUrl: plugin._publicationUrl },
-      );
+      const handle = getHandle(plugin);
+      const ctx = createContext(plugin);
 
       const documentLoader = await ctx.getDocumentLoader({
         identifier: handle,
@@ -70,7 +68,7 @@ export function likeController(mountPath, plugin) {
 
       // Generate a unique activity ID
       const uuid = crypto.randomUUID();
-      const baseUrl = plugin._publicationUrl.replace(/\/$/, "");
+      const baseUrl = getPublicationUrl(plugin).replace(/\/$/, "");
       const activityId = `${baseUrl}/activitypub/likes/${uuid}`;
 
       // Construct and send Like activity
@@ -142,7 +140,7 @@ export function unlikeController(mountPath, plugin) {
         });
       }
 
-      if (!plugin._federation) {
+      if (!isFederationReady(plugin)) {
         return response.status(503).json({
           success: false,
           error: "Federation not initialized",
@@ -165,11 +163,8 @@ export function unlikeController(mountPath, plugin) {
       }
 
       const { Like, Undo } = await import("@fedify/fedify/vocab");
-      const handle = plugin.options.actor.handle;
-      const ctx = plugin._federation.createContext(
-        new URL(plugin._publicationUrl),
-        { handle, publicationUrl: plugin._publicationUrl },
-      );
+      const handle = getHandle(plugin);
+      const ctx = createContext(plugin);
 
       const documentLoader = await ctx.getDocumentLoader({
         identifier: handle,

package/lib/federation-actions.js

@@ -0,0 +1,70 @@
+/**
+ * Facade for federation operations used by controllers.
+ * Centralizes Fedify context creation and common patterns
+ * so controllers don't access plugin._federation directly.
+ * @module federation-actions
+ */
+import { lookupWithSecurity } from "./lookup-helpers.js";
+
+/**
+ * Create a Fedify context from the plugin reference.
+ * @param {object} plugin - ActivityPubEndpoint instance
+ * @returns {object} Fedify Context
+ */
+export function createContext(plugin) {
+  const handle = plugin.options.actor.handle;
+  return plugin._federation.createContext(new URL(plugin._publicationUrl), {
+    handle,
+    publicationUrl: plugin._publicationUrl,
+  });
+}
+
+/**
+ * Get an authenticated document loader for signed HTTP fetches.
+ * @param {object} plugin - ActivityPubEndpoint instance
+ * @returns {Promise<object>} Fedify DocumentLoader
+ */
+export async function getAuthLoader(plugin) {
+  const ctx = createContext(plugin);
+  return ctx.getDocumentLoader({ identifier: plugin.options.actor.handle });
+}
+
+/**
+ * Resolve a remote actor with signed→unsigned fallback.
+ * @param {object} plugin - ActivityPubEndpoint instance
+ * @param {string|URL} target - Actor URL or acct: URI
+ * @param {object} [options] - Additional options for lookupWithSecurity
+ * @returns {Promise<object|null>} Resolved actor or null
+ */
+export async function resolveActor(plugin, target, options = {}) {
+  const ctx = createContext(plugin);
+  const documentLoader = await ctx.getDocumentLoader({
+    identifier: plugin.options.actor.handle,
+  });
+  const url = target instanceof URL ? target : new URL(target);
+  return lookupWithSecurity(ctx, url, { documentLoader, ...options });
+}
+
+/**
+ * Check if federation is initialized and ready.
+ * @param {object} plugin - ActivityPubEndpoint instance
+ * @returns {boolean}
+ */
+export function isFederationReady(plugin) {
+  return !!plugin._federation;
+}
+
+/** @returns {string} Our actor handle */
+export function getHandle(plugin) {
+  return plugin.options.actor.handle;
+}
+
+/** @returns {string} Our publication URL */
+export function getPublicationUrl(plugin) {
+  return plugin._publicationUrl;
+}
+
+/** @returns {object} MongoDB collections */
+export function getCollections(plugin) {
+  return plugin._collections;
+}

package/lib/inbox-queue.js

@@ -17,14 +17,14 @@ import { routeToHandler } from "./inbox-handlers.js";
  */
 async function processNextItem(collections, ctx, handle) {
   const { ap_inbox_queue } = collections;
-  if (!ap_inbox_queue) return;
+  if (!ap_inbox_queue) return false;
 
   const item = await ap_inbox_queue.findOneAndUpdate(
     { status: "pending" },
     { $set: { status: "processing" } },
     { sort: { receivedAt: 1 }, returnDocument: "after" },
   );
-  if (!item) return;
+  if (!item) return false;
 
   try {
     await routeToHandler(item, collections, ctx, handle);
@@ -45,6 +45,8 @@ async function processNextItem(collections, ctx, handle) {
     );
     console.error(`[inbox-queue] Failed processing ${item.activityType} from ${item.actorUrl}: ${error.message}`);
   }
+
+  return true;
 }
 
 /**
@@ -74,6 +76,9 @@ export async function enqueueActivity(collections, { activityType, actorUrl, obj
   });
 }
 
+const BATCH_SIZE = 10;
+const POLL_INTERVAL_MS = 1_000;
+
 /**
  * Start the background inbox processor.
  * @param {object} collections - MongoDB collections
@@ -85,14 +90,16 @@ export function startInboxProcessor(collections, getCtx, handle) {
   const intervalId = setInterval(async () => {
     try {
       const ctx = getCtx();
-      if (ctx) {
-        await processNextItem(collections, ctx, handle);
+      if (!ctx) return;
+      for (let i = 0; i < BATCH_SIZE; i++) {
+        const hadWork = await processNextItem(collections, ctx, handle);
+        if (!hadWork) break; // Queue empty, stop early
       }
     } catch (error) {
       console.error("[inbox-queue] Processor error:", error.message);
     }
-  }, 3_000); // Every 3 seconds
+  }, POLL_INTERVAL_MS);
 
-  console.info("[ActivityPub] Inbox queue processor started (3s interval)");
+  console.info(`[ActivityPub] Inbox queue processor started (${POLL_INTERVAL_MS}ms interval, batch size ${BATCH_SIZE})`);
   return intervalId;
 }

package/lib/init-indexes.js

@@ -0,0 +1,251 @@
+/**
+ * Create MongoDB indexes for all ActivityPub collections.
+ * Idempotent — safe to run on every startup.
+ * @module init-indexes
+ *
+ * @param {object} collections - MongoDB collections object
+ * @param {object} options
+ * @param {number} options.activityRetentionDays - TTL for ap_activities (0 = forever)
+ * @param {number} options.notificationRetentionDays - TTL for notifications (0 = forever)
+ */
+export function createIndexes(collections, options) {
+  const { activityRetentionDays, notificationRetentionDays } = options;
+
+  // Create indexes — wrapped in try-catch because collection references
+  // may be undefined if MongoDB hasn't finished connecting yet.
+  // Indexes are idempotent; they'll be created on next successful startup.
+  try {
+    // TTL index for activity cleanup (MongoDB handles expiry automatically)
+    const retentionDays = activityRetentionDays;
+    if (retentionDays > 0) {
+      collections.ap_activities.createIndex(
+        { receivedAt: 1 },
+        { expireAfterSeconds: retentionDays * 86_400 },
+      );
+    }
+
+    // Performance indexes for inbox handlers and batch refollow
+    collections.ap_followers.createIndex(
+      { actorUrl: 1 },
+      { unique: true, background: true },
+    );
+    collections.ap_following.createIndex(
+      { actorUrl: 1 },
+      { unique: true, background: true },
+    );
+    collections.ap_following.createIndex(
+      { source: 1 },
+      { background: true },
+    );
+    collections.ap_activities.createIndex(
+      { objectUrl: 1 },
+      { background: true },
+    );
+    collections.ap_activities.createIndex(
+      { type: 1, actorUrl: 1, objectUrl: 1 },
+      { background: true },
+    );
+
+    // Reader indexes (timeline, notifications, moderation, interactions)
+    collections.ap_timeline.createIndex(
+      { uid: 1 },
+      { unique: true, background: true },
+    );
+    collections.ap_timeline.createIndex(
+      { published: -1 },
+      { background: true },
+    );
+    collections.ap_timeline.createIndex(
+      { "author.url": 1 },
+      { background: true },
+    );
+    collections.ap_timeline.createIndex(
+      { type: 1, published: -1 },
+      { background: true },
+    );
+
+    collections.ap_notifications.createIndex(
+      { uid: 1 },
+      { unique: true, background: true },
+    );
+    collections.ap_notifications.createIndex(
+      { published: -1 },
+      { background: true },
+    );
+    collections.ap_notifications.createIndex(
+      { read: 1 },
+      { background: true },
+    );
+    collections.ap_notifications.createIndex(
+      { type: 1, published: -1 },
+      { background: true },
+    );
+
+    // TTL index for notification cleanup
+    const notifRetention = notificationRetentionDays;
+    if (notifRetention > 0) {
+      collections.ap_notifications.createIndex(
+        { createdAt: 1 },
+        { expireAfterSeconds: notifRetention * 86_400 },
+      );
+    }
+
+    // Message indexes
+    collections.ap_messages.createIndex(
+      { uid: 1 },
+      { unique: true, background: true },
+    );
+    collections.ap_messages.createIndex(
+      { published: -1 },
+      { background: true },
+    );
+    collections.ap_messages.createIndex(
+      { read: 1 },
+      { background: true },
+    );
+    collections.ap_messages.createIndex(
+      { conversationId: 1, published: -1 },
+      { background: true },
+    );
+    collections.ap_messages.createIndex(
+      { direction: 1 },
+      { background: true },
+    );
+    // TTL index for message cleanup (reuse notification retention)
+    if (notifRetention > 0) {
+      collections.ap_messages.createIndex(
+        { createdAt: 1 },
+        { expireAfterSeconds: notifRetention * 86_400 },
+      );
+    }
+
+    // Muted collection — sparse unique indexes (allow multiple null values)
+    collections.ap_muted
+      .dropIndex("url_1")
+      .catch(() => {})
+      .then(() =>
+        collections.ap_muted.createIndex(
+          { url: 1 },
+          { unique: true, sparse: true, background: true },
+        ),
+      )
+      .catch(() => {});
+    collections.ap_muted
+      .dropIndex("keyword_1")
+      .catch(() => {})
+      .then(() =>
+        collections.ap_muted.createIndex(
+          { keyword: 1 },
+          { unique: true, sparse: true, background: true },
+        ),
+      )
+      .catch(() => {});
+
+    collections.ap_blocked.createIndex(
+      { url: 1 },
+      { unique: true, background: true },
+    );
+
+    collections.ap_interactions.createIndex(
+      { objectUrl: 1, type: 1 },
+      { unique: true, background: true },
+    );
+    collections.ap_interactions.createIndex(
+      { type: 1 },
+      { background: true },
+    );
+
+    // Followed hashtags — unique on tag (case-insensitive via normalization at write time)
+    collections.ap_followed_tags.createIndex(
+      { tag: 1 },
+      { unique: true, background: true },
+    );
+
+    // Tag filtering index on timeline
+    collections.ap_timeline.createIndex(
+      { category: 1, published: -1 },
+      { background: true },
+    );
+
+    // Explore tab indexes
+    // Compound unique on (type, domain, scope, hashtag) prevents duplicate tabs.
+    // ALL insertions must explicitly set all four fields (unused fields = null)
+    // because MongoDB treats missing fields differently from null in unique indexes.
+    collections.ap_explore_tabs.createIndex(
+      { type: 1, domain: 1, scope: 1, hashtag: 1 },
+      { unique: true, background: true },
+    );
+    // Order index for efficient sorting of tab bar
+    collections.ap_explore_tabs.createIndex(
+      { order: 1 },
+      { background: true },
+    );
+
+    // ap_reports indexes
+    if (notifRetention > 0) {
+      collections.ap_reports.createIndex(
+        { createdAt: 1 },
+        { expireAfterSeconds: notifRetention * 86_400 },
+      );
+    }
+    collections.ap_reports.createIndex(
+      { reporterUrl: 1 },
+      { background: true },
+    );
+    collections.ap_reports.createIndex(
+      { reportedUrls: 1 },
+      { background: true },
+    );
+    // Pending follow requests — unique on actorUrl
+    collections.ap_pending_follows.createIndex(
+      { actorUrl: 1 },
+      { unique: true, background: true },
+    );
+    collections.ap_pending_follows.createIndex(
+      { requestedAt: -1 },
+      { background: true },
+    );
+    // Server-level blocks
+    collections.ap_blocked_servers.createIndex(
+      { hostname: 1 },
+      { unique: true, background: true },
+    );
+    // Key freshness tracking
+    collections.ap_key_freshness.createIndex(
+      { actorUrl: 1 },
+      { unique: true, background: true },
+    );
+
+    // Inbox queue indexes
+    collections.ap_inbox_queue.createIndex(
+      { status: 1, receivedAt: 1 },
+      { background: true },
+    );
+    // TTL: auto-prune completed items after 24h
+    collections.ap_inbox_queue.createIndex(
+      { processedAt: 1 },
+      { expireAfterSeconds: 86_400, background: true },
+    );
+
+    // Mastodon Client API indexes
+    collections.ap_oauth_apps.createIndex(
+      { clientId: 1 },
+      { unique: true, background: true },
+    );
+    collections.ap_oauth_tokens.createIndex(
+      { accessToken: 1 },
+      { unique: true, sparse: true, background: true },
+    );
+    collections.ap_oauth_tokens.createIndex(
+      { code: 1 },
+      { unique: true, sparse: true, background: true },
+    );
+    collections.ap_markers.createIndex(
+      { userId: 1, timeline: 1 },
+      { unique: true, background: true },
+    );
+  } catch {
+    // Index creation failed — collections not yet available.
+    // Indexes already exist from previous startups; non-fatal.
+  }
+}

package/lib/item-processing.js

@@ -268,14 +268,32 @@ export async function renderItemCards(items, request, templateData) {
   return htmlParts.join("");
 }
 
+// ─── Moderation data cache ──────────────────────────────────────────────────
+let _moderationCache = null;
+let _moderationCacheAt = 0;
+const MODERATION_CACHE_TTL = 30_000; // 30 seconds
+
+/**
+ * Invalidate the moderation data cache.
+ * Call this from any write operation that changes muted/blocked data.
+ */
+export function invalidateModerationCache() {
+  _moderationCache = null;
+  _moderationCacheAt = 0;
+}
+
 /**
  * Load moderation data from MongoDB collections.
- * Convenience wrapper to reduce boilerplate in controllers.
+ * Results are cached in memory for 30 seconds to avoid redundant queries.
  *
  * @param {object} modCollections - { ap_muted, ap_blocked, ap_profile }
  * @returns {Promise<object>} moderation data for postProcessItems()
  */
 export async function loadModerationData(modCollections) {
+  if (_moderationCache && Date.now() - _moderationCacheAt < MODERATION_CACHE_TTL) {
+    return _moderationCache;
+  }
+
   // Dynamic import to avoid circular dependency
   const { getMutedUrls, getMutedKeywords, getBlockedUrls, getFilterMode } =
     await import("./storage/moderation.js");
@@ -287,5 +305,7 @@ export async function loadModerationData(modCollections) {
     getFilterMode(modCollections),
   ]);
 
-  return { mutedUrls, mutedKeywords, blockedUrls, filterMode };
+  _moderationCache = { mutedUrls, mutedKeywords, blockedUrls, filterMode };
+  _moderationCacheAt = Date.now();
+  return _moderationCache;
 }

package/lib/lookup-cache.js

@@ -20,6 +20,9 @@ export function getCached(url) {
     lookupCache.delete(url);
     return null;
   }
+  // Promote to end of Map (true LRU)
+  lookupCache.delete(url);
+  lookupCache.set(url, entry);
   return entry.data;
 }