@sockethub/platform-metadata 1.0.1-beta.0 → 1.0.1-beta.1

package/README.md

@@ -101,8 +101,12 @@ so those URLs are resolved through preview services built for this purpose:
   self-text, and direct `i.redd.it` image are mapped into the preview; text posts
   intentionally have no image. oEmbed remains a title-only failure fallback.
   See `compatUserAgent` below.
-* **Facebook** remains best-effort: post text usually comes through, but
-  media requires authentication and no public preview service exists.
+* **Facebook** remains best-effort: post text usually comes through. The
+  video or photo thumbnail is taken from the post's Open Graph image, then
+  its Twitter card image, and finally the image rendered by Facebook's public
+  embed plugin (`/plugins/video.php` or `/plugins/post.php`), which Facebook
+  serves to third parties when it withholds Open Graph media from a
+  datacenter address. Full media still requires authentication.
 
 ### `userAgent`
 
@@ -151,9 +155,14 @@ Because the server fetches whatever URL a client supplies as `actor.id`, metadat
 requests are hardened against server-side request forgery (SSRF) and resource
 exhaustion. The fetch runs through a guarded connection layer that:
 
+* rejects URL schemes other than `http` and `https`;
 * refuses to connect to loopback, private, link-local, carrier-grade NAT, or
-  cloud-metadata addresses (e.g. `169.254.169.254`), in every IPv4/IPv6 spelling,
-  validated at connection time so it also covers redirect hops;
+  cloud-metadata addresses (e.g. `169.254.169.254`), validated at connection
+  time so it also covers redirect hops. IPv4-mapped, IPv4-compatible, and
+  well-known NAT64 (`64:ff9b::/96`) embeddings are judged as the embedded IPv4
+  address. The local-use NAT64 prefix `64:ff9b:1::/48` is refused entirely.
+  The ranges are listed under
+  [Outbound URL guard](../../docs/configuration.md#outbound-url-guard);
 * caps the response body size.
 
 ### `allowPrivateAddresses`

package/dist/index.d.ts

@@ -168,6 +168,12 @@ export default class Metadata implements PlatformInterface {
     private fetchDirectImage;
     /** Fetch and validate YouTube's official preview metadata. */
     private fetchYouTubeEmbed;
+    /**
+     * Last-resort thumbnail for a Facebook post whose page carried no
+     * Open Graph image: the media image rendered by Facebook's public embed
+     * plugin, which is served to third parties without a login wall.
+     */
+    private fetchFacebookEmbedImage;
     private fetchTweet;
     private fetchReddit;
     /**

package/dist/index.js

@@ -74222,7 +74222,7 @@ var import_undici3 = __toESM(require_undici(), 1);
 // package.json
 var package_default = {
   name: "@sockethub/platform-metadata",
-  version: "1.0.1-beta.0",
+  version: "1.0.1-beta.1",
   description: "Fetch metadata from a given URL",
   author: "Nick Jennings <nick@silverbucket.net>",
   license: "LGPL-3.0+",
@@ -74264,17 +74264,17 @@ var package_default = {
     "clean:deps": "rm -rf node_modules"
   },
   dependencies: {
-    "@sockethub/util": "^1.0.0-beta.0",
+    "@sockethub/util": "^1.0.0-beta.1",
     "open-graph-scraper": "^6.11.0",
     undici: "^7.30.0"
   },
   devDependencies: {
-    "@sockethub/schemas": "^3.0.0-beta.0"
+    "@sockethub/schemas": "^3.0.0-beta.1"
   },
   peerDependencies: {
-    "@sockethub/server": "^5.0.0-beta.0"
+    "@sockethub/server": "^5.0.0-beta.1"
   },
-  gitHead: "75002ae8f15d7679bd58a9327f5a1d7eeaffa237",
+  gitHead: "06c9062f1cb5f0c0599fd979e6e91da79f08eda0",
   types: "./dist/index.d.ts"
 };
 
@@ -74447,7 +74447,35 @@ function isFacebookUrl(url) {
   return FACEBOOK_HOSTS.has(host) || host === "fb.watch";
 }
 function stripFacebookEngagement(title) {
-  return title?.replace(/^[^|]*\p{Nd}[^|]*·[^|]*\|\s*/u, "");
+  const bar = title?.indexOf("|") ?? -1;
+  if (title === undefined || bar === -1) {
+    return title;
+  }
+  const segment = title.slice(0, bar);
+  const dot = segment.lastIndexOf("·");
+  const isStats = dot !== -1 && /\p{Nd}/u.test(segment.slice(0, dot)) || /^\s*(?:\p{Nd}+[.,]\p{Nd}+(?:[.,\s]\p{Nd}+)*\p{L}{0,2}|\p{Nd}{1,3}\p{L}{1,2}|\p{Nd}{4,})(?:\s+\p{L}+\.)?\s+\p{L}+\s*$/u.test(segment);
+  return isStats ? title.slice(bar + 1).trimStart() : title;
+}
+function resolveFacebookEmbed(url, ogType) {
+  if (!isFacebookUrl(url)) {
+    return null;
+  }
+  const isVideo = ogType?.startsWith("video") || /^\/(?:reel|watch)(?:\/|$)|\/videos\//i.test(new URL(url).pathname);
+  const plugin = isVideo ? "video.php" : "post.php";
+  return `https://www.facebook.com/plugins/${plugin}?href=${encodeURIComponent(url)}`;
+}
+var FACEBOOK_EMBED_MAX_CHARS = 500000;
+function extractFacebookEmbedImage(html) {
+  const match = html.slice(0, FACEBOOK_EMBED_MAX_CHARS).match(/<img\b[^>]*\bsrc="(https:\/\/[^"]*\.fbcdn\.net\/[^"]*)"/i);
+  if (!match) {
+    return;
+  }
+  const url = match[1].replace(/&amp;/g, "&");
+  try {
+    return new URL(url).hostname.endsWith(".fbcdn.net") ? url : undefined;
+  } catch {
+    return;
+  }
 }
 function isRedditUrl(url) {
   let parsed;
@@ -74753,6 +74781,7 @@ var TWEET_API_TIMEOUT_MS = 1e4;
 var REDDIT_OEMBED_URL = "https://www.reddit.com/oembed";
 var REDDIT_OEMBED_TIMEOUT_MS = 4000;
 var YOUTUBE_OEMBED_TIMEOUT_MS = 4000;
+var FACEBOOK_EMBED_TIMEOUT_MS = 4000;
 var SCRAPE_TIMEOUT_MS = 5000;
 var REDDIT_JSON_TIMEOUT_MS = 2500;
 var REDDIT_JSON_MAX_BYTES = 1e6;
@@ -74939,6 +74968,29 @@ class Metadata {
       return;
     }
   }
+  async fetchFacebookEmbedImage(embedUrl) {
+    try {
+      const res = await this.fetchImpl(embedUrl, {
+        dispatcher: this.getDispatcher(),
+        headers: { "user-agent": this.userAgent() },
+        signal: AbortSignal.timeout(FACEBOOK_EMBED_TIMEOUT_MS)
+      });
+      if (!res.ok) {
+        await res.body?.cancel().catch(() => {
+          return;
+        });
+        throw new Error(`Facebook embed returned HTTP ${res.status}`);
+      }
+      const image = extractFacebookEmbedImage(await res.text());
+      if (!image) {
+        throw new Error("Facebook embed contained no CDN image");
+      }
+      return image;
+    } catch (err) {
+      this.log.debug(`facebook embed fetch failed for ${embedUrl}: ${String(err)}; using scraped metadata`);
+      return;
+    }
+  }
   async fetchTweet(apiUrl, job, cb) {
     try {
       const res = await this.fetchImpl(apiUrl, {
@@ -75158,6 +75210,22 @@ class Metadata {
           this.log.debug(`facebook canonical scrape failed for ${result.ogUrl}: ${String(err)}; using share metadata`);
         }
       }
+      if (facebook && !result.ogImage?.length) {
+        if (result.twitterImage?.length) {
+          result = { ...result, ogImage: result.twitterImage };
+        } else {
+          const embedUrl = resolveFacebookEmbed(result.ogUrl || job.actor.id, result.ogType);
+          const embedImage = embedUrl ? await withDeadline(this.fetchFacebookEmbedImage(embedUrl), FACEBOOK_EMBED_TIMEOUT_MS).catch(() => {
+            return;
+          }) : undefined;
+          if (embedImage) {
+            result = {
+              ...result,
+              ogImage: [{ url: embedImage }]
+            };
+          }
+        }
+      }
       const embed = reddit ? await redditEmbed : undefined;
       const youtube = await youtubeEmbed;
       if (!reddit)
@@ -75175,7 +75243,7 @@ class Metadata {
         name: embed?.provider_name ?? youtube?.provider_name ?? siteName,
         description: normalizeDescription(youtubeDescription || result.ogDescription || ""),
         image: reddit ? redditPostImages(result.ogImage) ?? redditOEmbedImage(embed ?? {}) : scrapedImages?.length ? scrapedImages : youtubeOEmbedImage(youtube),
-        url: reddit ? job.actor.id : result.ogUrl,
+        url: job.actor.id,
         favicon: result.favicon || "/favicon.ico",
         charset: result.charset
       };
@@ -75233,4 +75301,4 @@ export {
   withDeadline
 };
 
-//# debugId=A3842767FBDDF58564756E2164756E21
+//# debugId=E636DFFA5AC4B45D64756E2164756E21