@rmdes/indiekit-endpoint-rss 1.0.17 → 1.1.0

package/README.md

@@ -37,7 +37,8 @@ export default {
       fetchTimeout: 10_000,          // 10 second timeout per feed
       maxConcurrentFetches: 3,       // Parallel feed fetches
       retentionDays: 30,             // Days to keep items
-      minItemsPerFeed: 10            // Newest items always kept, whatever their age
+      minItemsPerFeed: 10,           // Newest items always kept, whatever their age
+      maxPostsPerCycle: 10           // Max posts created per sync cycle
     })
   ],
   // MongoDB database is REQUIRED

package/index.js

@@ -19,6 +19,7 @@ const defaults = {
   maxConcurrentFetches: 3,
   retentionDays: 30,
   minItemsPerFeed: 10,
+  maxPostsPerCycle: 10,
 };
 
 export default class RssEndpoint {
@@ -77,6 +78,7 @@ export default class RssEndpoint {
     router.post("/api/feeds", express.json(), feedsController.add);
     router.delete("/api/feeds/:id", feedsController.remove);
     router.patch("/api/feeds/:id", express.json(), feedsController.toggle);
+    router.post("/api/feeds/:id/backfill", express.json(), feedsController.backfill);
 
     // Manual refresh (protected)
     router.post("/api/refresh", statusController.refresh);

package/lib/controllers/dashboard.js

@@ -73,6 +73,7 @@ export const dashboardController = {
         },
         mountPath: request.baseUrl,
         publicUrl: rssEndpoint,
+        postTypes: Object.keys(request.app.locals.publication?.postTypes || {}),
         ...flash,
       });
     } catch (error) {
@@ -111,7 +112,15 @@ export const dashboardController = {
       await feedsCollection.updateMany({}, { $set: { itemCount: 0 } });
 
       // Trigger sync
-      const result = await runSync(db, rssConfig);
+      const { application, publication } = request.app.locals;
+      const publishContext =
+        application?.micropubEndpoint && publication?.me
+          ? {
+              micropubEndpoint: application.micropubEndpoint,
+              me: publication.me,
+            }
+          : null;
+      const result = await runSync(db, rssConfig, publishContext);
 
       if (result.error) {
         return response.status(500).json({
@@ -164,7 +173,15 @@ export const dashboardController = {
         return response.redirect(request.baseUrl);
       }
 
-      const result = await runSync(db, rssConfig);
+      const { application, publication } = request.app.locals;
+      const publishContext =
+        application?.micropubEndpoint && publication?.me
+          ? {
+              micropubEndpoint: application.micropubEndpoint,
+              me: publication.me,
+            }
+          : null;
+      const result = await runSync(db, rssConfig, publishContext);
 
       if (result.error) {
         request.session.messages = [

package/lib/controllers/feeds.js

@@ -1,5 +1,7 @@
 import { ObjectId } from "mongodb";
 import { RssClient } from "../rss-client.js";
+import { defaultContent, defaultLinkProperty } from "../jf2-builder.js";
+import { watermarkFor } from "../publisher.js";
 import { formatFeed, isValidUrl, normalizeUrl } from "../utils.js";
 
 export const feedsController = {
@@ -147,20 +149,24 @@ export const feedsController = {
   },
 
   /**
-   * Toggle feed enabled/disabled
+   * Update a feed: enable/disable, or change its publish configuration
    * PATCH /api/feeds/:id
-   * Body: { enabled: boolean }
+   * Body: { enabled?: boolean, publish?: object }
    */
   async toggle(request, response) {
     try {
       const { id } = request.params;
-      const { enabled } = request.body;
+      const { enabled, publish } = request.body;
 
       if (!ObjectId.isValid(id)) {
         return response.status(400).json({ error: "Invalid feed ID" });
       }
 
-      if (typeof enabled !== "boolean") {
+      if (enabled === undefined && publish === undefined) {
+        return response.status(400).json({ error: "Nothing to update" });
+      }
+
+      if (enabled !== undefined && typeof enabled !== "boolean") {
         return response.status(400).json({ error: "enabled must be boolean" });
       }
 
@@ -171,27 +177,152 @@ export const feedsController = {
 
       const feedsCollection = db.collection("rssFeeds");
       const feedId = new ObjectId(id);
+      const feed = await feedsCollection.findOne({ _id: feedId });
+
+      if (!feed) {
+        return response.status(404).json({
+          error: response.locals.__("rss.error.feedNotFound"),
+        });
+      }
+
+      const update = {};
+
+      if (enabled !== undefined) {
+        update.enabled = enabled;
+      }
+
+      if (publish !== undefined) {
+        const { postTypes } = request.app.locals.publication || {};
+
+        if (publish.enabled) {
+          if (!postTypes) {
+            return response.status(500).json({
+              error: "Post type configuration unavailable",
+            });
+          }
+
+          // postData.create() throws notImplemented for an unconfigured type,
+          // and the failure would be buried deep in the sync loop. Sites
+          // differ: chardonsbleus has audio, event, jam and rsvp disabled.
+          if (!Object.hasOwn(postTypes, publish.postType)) {
+            return response.status(400).json({
+              error: `Post type "${publish.postType}" is not enabled on this site`,
+            });
+          }
+        }
+
+        const merged = { ...feed.publish, ...publish };
+
+        update.publish = {
+          ...merged,
+          // Pre-fill from the post type when the caller left them out, so a
+          // minimal PATCH of { enabled, postType } yields a working config.
+          // An explicit null is respected: it means "no link property".
+          content: merged.content || defaultContent(merged.postType),
+          linkProperty:
+            publish.linkProperty === undefined
+              ? (merged.linkProperty ?? defaultLinkProperty(merged.postType))
+              : publish.linkProperty,
+          // Stamp the watermark the first time publishing is switched on, so
+          // enabling a feed does not publish its entire cached backlog.
+          since:
+            publish.enabled && !feed.publish?.since
+              ? new Date().toISOString()
+              : (feed.publish?.since ?? null),
+        };
+      }
 
       const result = await feedsCollection.findOneAndUpdate(
         { _id: feedId },
-        { $set: { enabled } },
-        { returnDocument: "after" }
+        { $set: update },
+        { returnDocument: "after" },
       );
 
-      if (!result) {
+      response.json({
+        message:
+          enabled === undefined
+            ? response.locals.__("rss.success.feedUpdated")
+            : enabled
+              ? response.locals.__("rss.success.feedEnabled")
+              : response.locals.__("rss.success.feedDisabled"),
+        feed: formatFeed(result),
+      });
+    } catch (error) {
+      console.error("[RSS] Error updating feed:", error.message);
+      response.status(500).json({ error: error.message });
+    }
+  },
+
+  /**
+   * Rewind a feed's watermark so past items get published
+   * POST /api/feeds/:id/backfill
+   * Body: { since?: string } or { last?: number }
+   */
+  async backfill(request, response) {
+    try {
+      const { id } = request.params;
+      const { since, last } = request.body;
+
+      if (!ObjectId.isValid(id)) {
+        return response.status(400).json({ error: "Invalid feed ID" });
+      }
+
+      const db = request.app.locals.application.getRssDb?.();
+      if (!db) {
+        return response.status(500).json({ error: "Database not available" });
+      }
+
+      const feedsCollection = db.collection("rssFeeds");
+      const itemsCollection = db.collection("rssItems");
+      const feedId = new ObjectId(id);
+      const feed = await feedsCollection.findOne({ _id: feedId });
+
+      if (!feed) {
         return response.status(404).json({
           error: response.locals.__("rss.error.feedNotFound"),
         });
       }
 
+      if (!feed.publish?.enabled) {
+        return response.status(400).json({
+          error: "Enable publishing on this feed first",
+        });
+      }
+
+      let oldestPubDate = null;
+      if (last) {
+        const items = await itemsCollection
+          .find({ feedId })
+          .sort({ pubDate: -1 })
+          .limit(Number(last))
+          .toArray();
+        oldestPubDate = items.at(-1)?.pubDate || null;
+      }
+
+      let watermark;
+      try {
+        watermark = watermarkFor({ since, last }, oldestPubDate);
+      } catch (error) {
+        return response.status(400).json({ error: error.message });
+      }
+
+      await feedsCollection.updateOne(
+        { _id: feedId },
+        {
+          $set: {
+            "publish.since": watermark,
+            // Imported history is always drafts, whatever the feed is set to.
+            "publish.status": "draft",
+          },
+        },
+      );
+
       response.json({
-        message: enabled
-          ? response.locals.__("rss.success.feedEnabled")
-          : response.locals.__("rss.success.feedDisabled"),
-        feed: formatFeed(result),
+        message: response.locals.__("rss.success.backfillQueued"),
+        since: watermark,
       });
     } catch (error) {
-      console.error("[RSS] Error toggling feed:", error.message);
+      console.error("[RSS] Error queueing backfill:", error.message);
       response.status(500).json({ error: error.message });
     }
   },

package/lib/jf2-builder.js

@@ -0,0 +1,115 @@
+import { sanitizeHtml, stripHtml } from "./utils.js";
+
+/**
+ * Discovery property pre-filled for each post type. Form defaults only —
+ * any combination the user sets is accepted.
+ */
+const LINK_PROPERTY_DEFAULTS = {
+  bookmark: "bookmark-of",
+  like: "like-of",
+  repost: "repost-of",
+  reply: "in-reply-to",
+  video: "video",
+  photo: "photo",
+};
+
+const PLACEHOLDERS = {
+  title: (item) => stripHtml(item.title),
+  link: (item) => item.link,
+  description: (item) => stripHtml(item.description),
+  content: (item) => sanitizeHtml(item.content),
+  author: (item) => stripHtml(item.author),
+  sourceTitle: (item) => stripHtml(item.sourceTitle),
+};
+
+/**
+ * Link property offered when a post type is chosen
+ * @param {string} postType - Post type key
+ * @returns {string|null} Property name, or null when the type needs none
+ */
+export const defaultLinkProperty = (postType) =>
+  LINK_PROPERTY_DEFAULTS[postType] || null;
+
+/**
+ * Content template offered when a post type is chosen
+ * @param {string} postType - Post type key
+ * @returns {string} Template string
+ */
+export const defaultContent = (postType) =>
+  postType === "article" ? "{{content}}" : "{{description}}";
+
+/**
+ * Render a feed item into a content string
+ * @param {string} template - Template with {{placeholder}} tokens
+ * @param {object} item - RSS item document
+ * @returns {string} Rendered content
+ */
+export function renderTemplate(template, item) {
+  return template.replaceAll(/\{\{(\w+)\}\}/g, (match, key) => {
+    const source = PLACEHOLDERS[key];
+    return source ? (source(item) ?? "") : match;
+  });
+}
+
+/**
+ * Build JF2 properties for one feed item.
+ *
+ * The post type is never sent: getPostType() derives it from the properties
+ * present, so `publish.postType` decides which discovery property to set.
+ * @param {object} item - RSS item document
+ * @param {object} publish - Feed publish configuration
+ * @returns {object} JF2 properties
+ */
+export function buildJf2(item, publish) {
+  const template = publish.content || defaultContent(publish.postType);
+  const rendered = renderTemplate(template, item);
+  const isHtml = template.includes("{{content}}");
+
+  const properties = {
+    type: "entry",
+    content: isHtml ? { html: rendered } : rendered,
+  };
+
+  // A `name` next to content makes discovery return "article" — see
+  // post-type-discovery.js: `if (content && properties.name) return "article"`.
+  // A note must therefore carry none.
+  const name = stripHtml(item.title);
+  if (publish.postType !== "note" && name) {
+    properties.name = name;
+  }
+
+  if (publish.linkProperty) {
+    const value =
+      publish.linkProperty === "photo" ? item.imageUrl : item.link;
+
+    if (!value) {
+      throw new Error(
+        `Item has no value for "${publish.linkProperty}": ${item.guid}`,
+      );
+    }
+
+    properties[publish.linkProperty] = value;
+  }
+
+  if (item.pubDate) {
+    properties.published =
+      item.pubDate instanceof Date ? item.pubDate.toISOString() : item.pubDate;
+  }
+
+  if (item.categories?.length) {
+    properties.category = item.categories;
+  }
+
+  if (publish.declareSyndication && item.link) {
+    properties.syndication = [item.link];
+  }
+
+  properties["post-status"] =
+    publish.status === "published" ? "published" : "draft";
+
+  if (publish.syndicateTo?.length) {
+    properties["mp-syndicate-to"] = publish.syndicateTo;
+  }
+
+  return properties;
+}

package/lib/publisher.js

@@ -0,0 +1,239 @@
+import jwt from "jsonwebtoken";
+import { jf2ToMf2 } from "@indiekit/endpoint-micropub/lib/mf2.js";
+import { buildJf2 } from "./jf2-builder.js";
+
+const TOKEN_TTL = "5m";
+
+/**
+ * Mint a short-lived token for background publishing.
+ *
+ * Background sync has no user session, so it cannot reuse the admin UI's
+ * access token. endpoint-auth signs and verifies with process.env.SECRET,
+ * the same mechanism start.sh already uses for the syndication poller.
+ * @param {string} me - Publication URL
+ * @returns {string} Signed JWT
+ */
+export function mintToken(me) {
+  if (!process.env.SECRET) {
+    throw new Error("Cannot publish: SECRET is not configured");
+  }
+
+  return jwt.sign({ me, scope: "create" }, process.env.SECRET, {
+    expiresIn: TOKEN_TTL,
+  });
+}
+
+/**
+ * POST one post to the site's own Micropub endpoint.
+ *
+ * The endpoint parses any JSON body as mf2, so JF2 properties are converted
+ * first — the same thing endpoint-posts does before calling the endpoint.
+ * jf2ToMf2 mutates its input (deletes `properties.type`), so a copy is
+ * passed to avoid corrupting the caller's object.
+ * @param {string} micropubEndpoint - Micropub endpoint URL
+ * @param {string} accessToken - Bearer token
+ * @param {object} properties - JF2 properties
+ * @param {object} [options] - Options
+ * @param {Function} [options.fetchImpl] - fetch implementation, for tests
+ * @returns {Promise<string|null>} URL of the created post
+ */
+export async function postToMicropub(
+  micropubEndpoint,
+  accessToken,
+  properties,
+  { fetchImpl = fetch } = {},
+) {
+  const mf2 = jf2ToMf2({ properties: { ...properties } });
+
+  const response = await fetchImpl(micropubEndpoint, {
+    method: "POST",
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${accessToken}`,
+      "content-type": "application/json",
+    },
+    body: JSON.stringify(mf2),
+  });
+
+  if (!response.ok) {
+    const body = await response.text();
+    const error = new Error(`Micropub ${response.status}: ${body.slice(0, 200)}`);
+    error.status = response.status;
+    throw error;
+  }
+
+  return response.headers.get("location");
+}
+
+/**
+ * Resolve what publishing needs from Indiekit configuration.
+ *
+ * micropubEndpoint is only resolved against the request in Indiekit's locals
+ * middleware, and background sync has no request. Relative endpoints are
+ * therefore resolved against localhost — the same loopback start.sh already
+ * uses for the syndication and webmention pollers.
+ * @param {object} application - Application configuration
+ * @param {object} publication - Publication configuration
+ * @returns {object|null} { micropubEndpoint, me }, or null when unconfigured
+ */
+export function resolvePublishContext(application = {}, publication = {}) {
+  const { micropubEndpoint, port } = application;
+  const { me } = publication;
+
+  if (!micropubEndpoint || !me) {
+    return null;
+  }
+
+  if (URL.canParse(micropubEndpoint)) {
+    return { micropubEndpoint, me };
+  }
+
+  // A misconfigured port must cost this site its publishing, not its whole
+  // sync cycle: this runs before runSync's try block, so a throw here would
+  // skip the feed fetch, the inserts and the prune too, every cycle, with
+  // nothing but a console.error to show for it.
+  const base = `http://localhost:${port || "3000"}`;
+  if (!URL.canParse(micropubEndpoint, base)) {
+    return null;
+  }
+
+  return { micropubEndpoint: new URL(micropubEndpoint, base).href, me };
+}
+
+const MAX_ATTEMPTS = 3;
+
+/**
+ * Publish the pending items of one feed.
+ *
+ * Retries are bounded on purpose: leaving postedAt unset retries next cycle,
+ * and unbounded that reproduces the prune churn fixed in 1.0.17 — a
+ * permanently invalid item retried every fifteen minutes forever.
+ * @param {object} feed - Feed document
+ * @param {object} itemsCollection - Items collection
+ * @param {object} options - Options
+ * @param {string} options.micropubEndpoint - Micropub endpoint URL
+ * @param {string} options.me - Publication URL
+ * @param {number} options.maxPostsPerCycle - Cap per cycle
+ * @param {Function} [options.postImpl] - Post implementation, for tests
+ * @param {Function} [options.mintImpl] - Token minter, for tests
+ * @returns {Promise<object>} Counts for this feed
+ */
+export async function publishPending(feed, itemsCollection, options) {
+  if (!feed.publish?.enabled) {
+    return { published: 0, failed: 0 };
+  }
+
+  const {
+    micropubEndpoint,
+    me,
+    maxPostsPerCycle,
+    postImpl = postToMicropub,
+    mintImpl = mintToken,
+  } = options;
+
+  const query = {
+    feedId: feed._id,
+    postedAt: { $exists: false },
+    postSkipped: { $ne: true },
+  };
+
+  if (feed.publish.since) {
+    // An item with no parsable date would be excluded forever by a bare
+    // `pubDate: { $gt: since }`, because null sorts below every Date in BSON —
+    // a silent permanent no-op. fetchedAt is always set on insert and is
+    // monotonic with cache entry, so it stands in when pubDate is missing.
+    query.$or = [
+      { pubDate: { $gt: feed.publish.since } },
+      { pubDate: null, fetchedAt: { $gt: feed.publish.since } },
+    ];
+  }
+
+  const items = await itemsCollection
+    .find(query)
+    .sort({ pubDate: 1 })
+    .limit(maxPostsPerCycle)
+    .toArray();
+
+  if (items.length === 0) {
+    return { published: 0, failed: 0 };
+  }
+
+  let published = 0;
+  let failed = 0;
+
+  // ponytail: a crash between POST and $set re-posts the item next cycle;
+  // postData.create replaceOne's on the same URL, so it overwrites rather
+  // than duplicates. Add a q=source reconciliation if a feed ever produces
+  // non-deterministic slugs.
+  for (const item of items) {
+    try {
+      // Minted per item, not once for the batch: signing is a cheap HMAC, and
+      // a single batch token can expire mid-cycle on a slow endpoint. The
+      // resulting 401 is a 4xx, so under the permanent-failure rule the tail
+      // of the batch would be marked postSkipped and lost for good.
+      const token = mintImpl(me);
+      const properties = buildJf2(item, feed.publish);
+      const postUrl = await postImpl(micropubEndpoint, token, properties);
+
+      await itemsCollection.updateOne(
+        { _id: item._id },
+        { $set: { postedAt: new Date().toISOString(), postUrl } },
+      );
+      published++;
+    } catch (error) {
+      failed++;
+
+      // A 4xx does not become a 201 on retry, and neither does an item that
+      // structurally cannot be built. Both are permanent. Note postedAt is
+      // never written here: pruneOldItems spares any item where it exists.
+      const isPermanent =
+        !error.status || (error.status >= 400 && error.status < 500);
+      const attempts = (item.postAttempts || 0) + 1;
+
+      await itemsCollection.updateOne(
+        { _id: item._id },
+        {
+          $set: {
+            postError: error.message,
+            postErrorAt: new Date().toISOString(),
+            ...(isPermanent || attempts >= MAX_ATTEMPTS
+              ? { postSkipped: true }
+              : {}),
+          },
+          $inc: { postAttempts: 1 },
+        },
+      );
+
+      console.error(`[RSS] Publish failed for ${item.guid}: ${error.message}`);
+    }
+  }
+
+  console.log(
+    `[RSS] Published ${published} item(s) from ${feed.title || feed.url}${failed ? `, ${failed} failed` : ""}`,
+  );
+
+  return { published, failed };
+}
+
+/**
+ * Resolve the watermark a backfill request should move the feed to.
+ *
+ * Backfill is not a separate publishing path: it rewinds publish.since and
+ * lets the normal loop catch up at maxPostsPerCycle per cycle, which is
+ * where the cap and the rate limit already live.
+ * @param {object} request - { since } ISO date, or { last } item count
+ * @param {Date|string|null} oldestPubDate - pubDate of the Nth newest item
+ * @returns {string} ISO watermark
+ */
+export function watermarkFor({ since, last }, oldestPubDate) {
+  if (since) {
+    return new Date(since).toISOString();
+  }
+
+  if (last && oldestPubDate) {
+    // One millisecond below, so the Nth item passes the loop's `$gt` filter.
+    return new Date(new Date(oldestPubDate).getTime() - 1).toISOString();
+  }
+
+  throw new Error("Backfill requires since or last");
+}

package/lib/sync.js

@@ -1,4 +1,5 @@
 import { RssClient } from "./rss-client.js";
+import { publishPending, resolvePublishContext } from "./publisher.js";
 
 let syncInterval = null;
 let initialSyncTimeout = null;
@@ -71,9 +72,13 @@ export function stopSync() {
  * Run a single sync cycle
  * @param {Object} dbOrIndiekit - Database instance or Indiekit instance (for backwards compat)
  * @param {Object} options - Plugin options
+ * @param {Object|null} [publishContext] - { micropubEndpoint, me }. Callers with
+ *   a request (manual sync controllers) should supply their own resolved
+ *   values; background sync has none, so it derives its own from the
+ *   Indiekit instance.
  * @returns {Promise<Object>}
  */
-export async function runSync(dbOrIndiekit, options) {
+export async function runSync(dbOrIndiekit, options, publishContext) {
   // Support both direct db object and Indiekit object (for background sync)
   const db = dbOrIndiekit.database || dbOrIndiekit;
   if (!db || typeof db.collection !== "function") {
@@ -81,6 +86,15 @@ export async function runSync(dbOrIndiekit, options) {
     return { error: syncState.lastError };
   }
 
+  publishContext =
+    publishContext ??
+    (dbOrIndiekit.config
+      ? resolvePublishContext(
+          dbOrIndiekit.config.application,
+          dbOrIndiekit.config.publication,
+        )
+      : null);
+
   if (syncState.syncing) {
     return { error: "Sync already in progress" };
   }
@@ -129,6 +143,30 @@ export async function runSync(dbOrIndiekit, options) {
       syncState.feedsProcessed++;
     }
 
+    // Publish items from feeds wired to Micropub. Runs after insertion so it
+    // reads what syncFeed just wrote, and before the prune so nothing is
+    // published from items about to be removed.
+    let itemsPublished = 0;
+
+    if (publishContext) {
+      for (const feed of feeds.filter((entry) => entry.publish?.enabled)) {
+        try {
+          const result = await publishPending(feed, itemsCollection, {
+            ...publishContext,
+            maxPostsPerCycle: options.maxPostsPerCycle || 10,
+          });
+          itemsPublished += result.published;
+        } catch (error) {
+          // One feed's failure must not cost the remaining feeds their publish
+          // step, nor the cycle its prune. syncFeed isolates per feed the same
+          // way.
+          console.error(
+            `[RSS] Publish failed for ${feed.url}: ${error.message}`,
+          );
+        }
+      }
+    }
+
     // Prune old items
     const retentionDays = options.retentionDays || 30;
     const itemsPruned = await pruneOldItems(
@@ -142,12 +180,13 @@ export async function runSync(dbOrIndiekit, options) {
     syncState.syncing = false;
 
     console.log(
-      `[RSS] Sync complete: ${syncState.feedsProcessed} feeds, ${syncState.itemsAdded} new items, ${itemsPruned} pruned`
+      `[RSS] Sync complete: ${syncState.feedsProcessed} feeds, ${syncState.itemsAdded} new items, ${itemsPublished} published, ${itemsPruned} pruned`
     );
 
     return {
       feedsProcessed: syncState.feedsProcessed,
       itemsAdded: syncState.itemsAdded,
+      itemsPublished,
       itemsPruned,
     };
   } catch (error) {
@@ -339,6 +378,9 @@ export async function pruneOldItems(
         // $ne: null also excludes missing dates: in BSON null sorts before
         // Date, so a bare $lt would delete every undated item as "too old".
         pubDate: { $lt: cutoff, $ne: null },
+        // A published item is never forgotten: if the feed re-serves it later
+        // it would return without postedAt and be published a second time.
+        postedAt: { $exists: false },
         _id: { $nin: keep.map((item) => item._id) },
       });
 

package/lib/utils.js

@@ -38,6 +38,12 @@ export function sanitizeHtml(html) {
     ],
     allowedAttributes: {
       a: ["href", "title", "rel"],
+      code: ["class"],
+      pre: ["class"],
+    },
+    allowedClasses: {
+      code: ["language-*"],
+      pre: ["language-*"],
     },
     allowedSchemes: ["http", "https", "mailto"],
   });
@@ -172,6 +178,9 @@ export function formatFeed(feed) {
     lastFetchedAt: toISO(feed.lastFetchedAt),
     lastError: feed.lastError,
     itemCount: feed.itemCount || 0,
+    publish: feed.publish
+      ? { ...feed.publish, since: toISO(feed.publish.since) }
+      : null,
   };
 }
 

package/locales/en.json

@@ -39,8 +39,10 @@
     "success": {
       "feedAdded": "Feed added successfully",
       "feedRemoved": "Feed removed",
-      "feedEnabled": "Feed enabled",
+      "feedUpdated": "Feed updated",
+    "feedEnabled": "Feed enabled",
       "feedDisabled": "Feed disabled",
+      "backfillQueued": "Backfill queued; items will be published as drafts over the next sync cycles",
       "syncComplete": "Sync complete",
       "clearResync": "Items cleared and re-synced"
     },
@@ -48,6 +50,15 @@
       "title": "Public Page",
       "description": "View aggregated RSS feeds on the public page",
       "view": "View News Page"
+    },
+    "publish": {
+      "title": "Publish to site",
+      "enabled": "Create posts from this feed",
+      "postType": "Post type",
+      "content": "Content template",
+      "linkProperty": "Link property",
+      "status": "Post status",
+      "save": "Save publish settings"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-rss",
-  "version": "1.0.17",
+  "version": "1.1.0",
   "description": "RSS feed reader endpoint for Indiekit. Aggregates multiple feeds, caches in MongoDB, displays on frontend.",
   "keywords": [
     "indiekit",
@@ -44,15 +44,15 @@
     "index.js"
   ],
   "dependencies": {
-    "@rmdes/indiekit-startup-gate": "^1.0.0",
+    "@indiekit/endpoint-micropub": "^1.0.0-beta.29",
     "@indiekit/error": "^1.0.0-beta.25",
+    "@rmdes/indiekit-startup-gate": "^1.0.0",
     "express": "^5.0.0",
+    "jsonwebtoken": "^9.0.2",
+    "mongodb": "^7.5.0",
     "rss-parser": "^3.13.0",
     "sanitize-html": "^2.13.0"
   },
-  "peerDependencies": {
-    "@indiekit/indiekit": ">=1.0.0-beta.25"
-  },
   "publishConfig": {
     "access": "public"
   }

package/views/rss.njk

@@ -101,6 +101,39 @@
             <div class="rss-feed-error">{{ feed.lastError }}</div>
             {% endif %}
           </div>
+          <details class="rss-publish">
+            <summary>{{ __("rss.publish.title") }}{% if feed.publish.enabled %} &bull; {{ feed.publish.postType }}{% endif %}</summary>
+            <form data-publish-feed="{{ feed.id }}">
+              <label>
+                <input type="checkbox" name="enabled" {{ "checked" if feed.publish.enabled }}>
+                {{ __("rss.publish.enabled") }}
+              </label>
+              <label>
+                {{ __("rss.publish.postType") }}
+                <select name="postType">
+                  {% for type in postTypes %}
+                  <option value="{{ type }}" {{ "selected" if feed.publish.postType == type }}>{{ type }}</option>
+                  {% endfor %}
+                </select>
+              </label>
+              <label>
+                {{ __("rss.publish.content") }}
+                <input class="input" type="text" name="content" value="{{ feed.publish.content or '{{description}}' }}">
+              </label>
+              <label>
+                {{ __("rss.publish.linkProperty") }}
+                <input class="input" type="text" name="linkProperty" value="{{ feed.publish.linkProperty or '' }}">
+              </label>
+              <label>
+                {{ __("rss.publish.status") }}
+                <select name="status">
+                  <option value="draft" {{ "selected" if feed.publish.status != "published" }}>draft</option>
+                  <option value="published" {{ "selected" if feed.publish.status == "published" }}>published</option>
+                </select>
+              </label>
+              {{ button({ type: "submit", text: __("rss.publish.save") }) }}
+            </form>
+          </details>
           <div class="rss-feed-actions">
             <label class="rss-toggle">
               <input
@@ -280,5 +313,39 @@
       }
     });
   });
+
+  // Handle publish configuration
+  document.querySelectorAll('[data-publish-feed]').forEach(form => {
+    form.addEventListener('submit', async (e) => {
+      e.preventDefault();
+      const feedId = e.target.dataset.publishFeed;
+      const data = new FormData(e.target);
+
+      const publish = {
+        enabled: data.get('enabled') === 'on',
+        postType: data.get('postType'),
+        content: data.get('content'),
+        linkProperty: data.get('linkProperty') || null,
+        status: data.get('status'),
+      };
+
+      try {
+        const response = await fetch(`{{ mountPath }}/api/feeds/${feedId}`, {
+          method: 'PATCH',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ publish })
+        });
+
+        if (response.ok) {
+          location.reload();
+        } else {
+          const body = await response.json();
+          alert(body.error || 'Failed to save publish settings');
+        }
+      } catch (err) {
+        alert('Failed to save publish settings: ' + err.message);
+      }
+    });
+  });
 </script>
 {% endblock %}