@rmdes/indiekit-endpoint-webmention-io 1.1.0 → 1.1.2

package/lib/controllers/dashboard.js

@@ -4,6 +4,7 @@
  */
 
 import { blockDomain } from "../storage/blocklist.js";
+import { normaliseDomain } from "../utils.js";
 import {
   getWebmentions,
   getWebmentionCounts,
@@ -208,11 +209,14 @@ export const dashboardController = {
       const wmCollection = database.collection("webmentions");
       const blockCollection = database.collection("webmentionBlocklist");
 
-      // Hide all existing mentions from this domain
-      const hidden = await hideByDomain(wmCollection, domain, "blocklist");
+      // Hide all existing mentions from this domain. Normalised because
+      // mentions store sourceDomain as a bare hostname while this form
+      // typically submits a full author URL.
+      const target = normaliseDomain(domain) ?? domain;
+      const hidden = await hideByDomain(wmCollection, target, "blocklist");
 
       // Add to blocklist
-      await blockDomain(blockCollection, domain, "spam", hidden);
+      await blockDomain(blockCollection, target, "spam", hidden);
 
       response.redirect(
         application.webmentionEndpoint +
@@ -246,10 +250,11 @@ export const dashboardController = {
       const blockCollection = database.collection("webmentionBlocklist");
 
       // Permanently delete all mentions from this domain
-      const deleted = await deleteByDomain(wmCollection, domain);
+      const target = normaliseDomain(domain) ?? domain;
+      const deleted = await deleteByDomain(wmCollection, target);
 
       // Add to blocklist with privacy reason
-      await blockDomain(blockCollection, domain, "privacy", deleted);
+      await blockDomain(blockCollection, target, "privacy", deleted);
 
       response.redirect(
         application.webmentionEndpoint +

package/lib/storage/blocklist.js

@@ -1,6 +1,12 @@
 /**
  * Webmention blocklist MongoDB storage
+ *
+ * Domains are normalised to a bare hostname on the way in and on every
+ * lookup. The moderation forms submit whatever the operator was looking at,
+ * commonly a full author URL, while mentions store sourceDomain as a
+ * hostname. Storing the raw value made the blocklist silently non-matching.
  */
+import { normaliseDomain } from "../utils.js";
 
 /**
  * Ensure indexes exist
@@ -24,6 +30,8 @@ export async function blockDomain(
   reason = "spam",
   mentionsHidden = 0,
 ) {
+  domain = normaliseDomain(domain) ?? domain;
+
   try {
     await collection.insertOne({
       domain,
@@ -55,7 +63,12 @@ export async function blockDomain(
  * @param {string} domain - Domain to unblock
  */
 export async function unblockDomain(collection, domain) {
-  await collection.deleteOne({ domain });
+  const normalised = normaliseDomain(domain);
+  // Delete both shapes: entries written before normalisation still hold the
+  // raw value the operator pasted.
+  await collection.deleteMany({
+    domain: { $in: [domain, normalised].filter(Boolean) },
+  });
 }
 
 /**
@@ -74,7 +87,10 @@ export async function getBlocklist(collection) {
  * @returns {Promise<boolean>}
  */
 export async function isDomainBlocked(collection, domain) {
-  const entry = await collection.findOne({ domain });
+  const normalised = normaliseDomain(domain);
+  const entry = await collection.findOne({
+    domain: { $in: [domain, normalised].filter(Boolean) },
+  });
   return !!entry;
 }
 
@@ -87,5 +103,9 @@ export async function getBlockedDomainSet(collection) {
   const entries = await collection
     .find({}, { projection: { domain: 1 } })
     .toArray();
-  return new Set(entries.map((e) => e.domain));
+  // Normalised on read as well as write, so entries stored before this was
+  // fixed start matching without needing a migration.
+  return new Set(
+    entries.map((e) => normaliseDomain(e.domain) ?? e.domain).filter(Boolean),
+  );
 }

package/lib/sync.js

@@ -109,6 +109,22 @@ export async function runSync(dbOrIndiekit, options) {
     // Get blocked domains
     const blockedDomains = await getBlockedDomainSet(blockCollection);
 
+    // Enforce the blocklist over mentions already stored, not just incoming
+    // ones. Blocking hid what was present at the time and nothing after, so a
+    // mention that arrived before the block - or was restored by a later
+    // sync - stayed visible with no way to clear it short of blocking again.
+    // hideByDomain only touches rows not already hidden, so this is cheap and
+    // idempotent on every cycle.
+    let sweptHidden = 0;
+    for (const blocked of blockedDomains) {
+      sweptHidden += await hideByDomain(wmCollection, blocked, "blocklist");
+    }
+    if (sweptHidden > 0) {
+      console.log(
+        `[Webmentions] Blocklist sweep hid ${sweptHidden} existing mention(s)`,
+      );
+    }
+
     // Fetch pages from webmention.io
     let page = 0;
     let hasMore = true;

package/lib/utils.js

@@ -50,15 +50,17 @@ export const getMentionTitle = (jf2) => {
  * @returns {string} Author name or URL fallback
  */
 export const getAuthorName = (jf2) => {
-  if (jf2.author?.name) return jf2.author.name;
+  if (jf2.author?.name) {
+    return jf2.author.name;
+  }
 
-  try {
-    let url = jf2.author?.url || jf2.url;
-    url = new URL(url);
-    return url.hostname + url.pathname.replace(/\/$/, "");
-  } catch {
-    return "Unknown";
+  const url = jf2.author?.url || jf2.url;
+  if (!URL.canParse(url)) {
+    return url;
   }
+
+  const { hostname, pathname } = new URL(url);
+  return hostname + pathname.replace(/\/$/, "");
 };
 
 /**
@@ -121,6 +123,36 @@ export const ensureISOString = (value) => {
  * @param {string} url - URL
  * @returns {string|null} Domain or null
  */
+/**
+ * Reduce a user-supplied value to the bare hostname stored on a webmention.
+ *
+ * Mentions carry sourceDomain as a hostname ("rmendes.net"), but the
+ * moderation forms hand back whatever the operator had in front of them -
+ * often the full author URL ("https://rmendes.net"). Blocking stored that
+ * verbatim and matched it verbatim against sourceDomain, so it matched
+ * nothing: the blocklist entry appeared, mentionsHidden was 0, and the
+ * mentions stayed visible. extractDomain alone will not do, since it returns
+ * null for a bare hostname.
+ * @param {string} value - Hostname or URL
+ * @returns {string|null} Lowercased hostname, or null if unparseable
+ */
+export const normaliseDomain = (value) => {
+  if (!value) return null;
+
+  const trimmed = String(value).trim().toLowerCase();
+  if (!trimmed) return null;
+
+  const withScheme = /^[a-z][a-z0-9+.-]*:\/\//.test(trimmed)
+    ? trimmed
+    : `https://${trimmed}`;
+
+  try {
+    return new URL(withScheme).hostname || null;
+  } catch {
+    return null;
+  }
+};
+
 export const extractDomain = (url) => {
   try {
     return new URL(url).hostname;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-webmention-io",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "Webmention moderation endpoint for Indiekit. Syncs webmentions from webmention.io into MongoDB with delete, block, and privacy removal capabilities.",
   "keywords": [
     "indiekit",
@@ -38,12 +38,10 @@
   ],
   "dependencies": {
     "@indiekit/error": "^1.0.0-beta.28",
+    "@rmdes/indiekit-startup-gate": "^1.0.0",
     "express": "^5.2.1",
     "sanitize-html": "^2.17.7"
   },
-  "peerDependencies": {
-    "@indiekit/indiekit": ">=1.0.0-beta.25"
-  },
   "publishConfig": {
     "access": "public"
   },