@takosjp/yurucommu-core 3.0.2 → 3.2.0

package/src/backend/lib/notification-pusher-contract.ts

@@ -0,0 +1,340 @@
+/**
+ * Wire-compatible subset of Takosumi's product-neutral notification pusher
+ * contract. This package is independently published, so it intentionally does
+ * not import Takosumi source at runtime.
+ */
+
+export const NOTIFICATION_PUSHER_REGISTRATION_PATH =
+  "/api/notifications/pushers" as const;
+export const MATRIX_PUSH_GATEWAY_NOTIFY_PATH =
+  "/_matrix/push/v1/notify" as const;
+export const MAX_NOTIFICATION_PUSHER_DATA_BYTES = 2 * 1024;
+export const SOCIAL_NOTIFICATION_PRODUCTS = ["yurucommu", "yurume"] as const;
+
+export type SocialNotificationProduct =
+  (typeof SOCIAL_NOTIFICATION_PRODUCTS)[number];
+
+export type JsonValue =
+  null | boolean | number | string | JsonValue[] | { [key: string]: JsonValue };
+export type JsonObject = { [key: string]: JsonValue };
+
+export interface NotificationPusher {
+  readonly kind: "http";
+  readonly app_id: string;
+  readonly pushkey: string;
+  readonly app_display_name?: string;
+  readonly device_display_name?: string;
+  readonly profile_tag?: string;
+  readonly lang?: string;
+  readonly data: JsonObject & {
+    readonly url: string;
+    readonly format?: "event_id_only" | "full";
+  };
+}
+
+export interface ParsedNotificationPusherSetRequest {
+  readonly product: SocialNotificationProduct;
+  readonly scope: string | null;
+  readonly pusher: NotificationPusher;
+  readonly gatewayUrl: string;
+  readonly storedData: JsonObject;
+}
+
+export interface ParsedNotificationPusherDeleteRequest {
+  readonly product: SocialNotificationProduct;
+  readonly scope: string | null;
+  readonly appId: string;
+  readonly pushkey: string;
+}
+
+export type NotificationPusherParseResult<T> =
+  | { readonly ok: true; readonly value: T }
+  | {
+      readonly ok: false;
+      readonly error: {
+        readonly code: "BAD_REQUEST";
+        readonly error: string;
+        readonly field?: string;
+      };
+    };
+
+export function parseNotificationPusherSetRequest(
+  body: unknown,
+): NotificationPusherParseResult<ParsedNotificationPusherSetRequest> {
+  if (!isRecord(body)) return bad("body must be an object");
+  const product = parseProduct(body.product);
+  if (!product) {
+    return bad("product must be yurucommu or yurume", "product");
+  }
+  const scope = parseOptionalIdentifier(body.scope);
+  if (scope === undefined) return bad("scope is invalid", "scope");
+  if (!isRecord(body.pusher)) return bad("pusher must be an object", "pusher");
+  const pusher = body.pusher;
+  if (pusher.kind !== "http") {
+    return bad("pusher.kind must be http", "pusher.kind");
+  }
+  const appId = parseBoundedString(pusher.app_id, 255);
+  if (!appId || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(appId)) {
+    return bad("pusher.app_id is invalid", "pusher.app_id");
+  }
+  const pushkey = parseBoundedString(pusher.pushkey, 4096);
+  if (!pushkey) return bad("pusher.pushkey is invalid", "pusher.pushkey");
+  if (!isRecord(pusher.data)) {
+    return bad("pusher.data must be an object", "pusher.data");
+  }
+  const gatewayUrl = normalizeGatewayUrl(pusher.data.url);
+  if (!gatewayUrl) {
+    return bad("pusher.data.url is invalid", "pusher.data.url");
+  }
+  if (
+    pusher.data.format !== undefined &&
+    pusher.data.format !== "event_id_only" &&
+    pusher.data.format !== "full"
+  ) {
+    return bad("pusher.data.format is invalid", "pusher.data.format");
+  }
+
+  const clonedStoredData = cloneJsonObjectWithoutUrl(pusher.data);
+  if (!clonedStoredData) {
+    return bad("pusher.data must contain only bounded JSON", "pusher.data");
+  }
+  // The privacy-preserving wire mode is the contract default. Persist it
+  // explicitly so legacy/partial clients cannot accidentally opt into the
+  // metadata-bearing payload merely by omitting `format`.
+  const storedData: JsonObject = {
+    ...clonedStoredData,
+    format: pusher.data.format === "full" ? "full" : "event_id_only",
+  };
+  if (
+    utf8Bytes(JSON.stringify(storedData)) > MAX_NOTIFICATION_PUSHER_DATA_BYTES
+  ) {
+    return bad(
+      `pusher.data must be at most ${MAX_NOTIFICATION_PUSHER_DATA_BYTES} bytes without url`,
+      "pusher.data",
+    );
+  }
+
+  const optional = {
+    app_display_name: parseOptionalBoundedString(pusher.app_display_name, 255),
+    device_display_name: parseOptionalBoundedString(
+      pusher.device_display_name,
+      255,
+    ),
+    profile_tag: parseOptionalBoundedString(pusher.profile_tag, 255),
+    lang: parseOptionalBoundedString(pusher.lang, 64),
+  };
+  for (const [key, value] of Object.entries(optional)) {
+    if (value === undefined)
+      return bad(`pusher.${key} is invalid`, `pusher.${key}`);
+  }
+
+  return {
+    ok: true,
+    value: {
+      product,
+      scope,
+      gatewayUrl,
+      storedData,
+      pusher: {
+        kind: "http",
+        app_id: appId,
+        pushkey,
+        ...(optional.app_display_name
+          ? { app_display_name: optional.app_display_name }
+          : {}),
+        ...(optional.device_display_name
+          ? { device_display_name: optional.device_display_name }
+          : {}),
+        ...(optional.profile_tag ? { profile_tag: optional.profile_tag } : {}),
+        ...(optional.lang ? { lang: optional.lang } : {}),
+        data: { ...storedData, url: gatewayUrl },
+      },
+    },
+  };
+}
+
+export function parseNotificationPusherDeleteRequest(
+  body: unknown,
+): NotificationPusherParseResult<ParsedNotificationPusherDeleteRequest> {
+  if (!isRecord(body)) return bad("body must be an object");
+  const product = parseProduct(body.product);
+  if (!product) {
+    return bad("product must be yurucommu or yurume", "product");
+  }
+  const scope = parseOptionalIdentifier(body.scope);
+  if (scope === undefined) return bad("scope is invalid", "scope");
+  const appId = parseBoundedString(body.app_id, 255);
+  if (!appId || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(appId)) {
+    return bad("app_id is invalid", "app_id");
+  }
+  const pushkey = parseBoundedString(body.pushkey, 4096);
+  if (!pushkey) return bad("pushkey is invalid", "pushkey");
+  return { ok: true, value: { product, scope, appId, pushkey } };
+}
+
+export function normalizeGatewayUrl(value: unknown): string | null {
+  const text = parseBoundedString(value, 2048);
+  if (!text) return null;
+  try {
+    const url = new URL(text);
+    if (url.username || url.password || url.hash) return null;
+    if (url.protocol === "https:") {
+      if (url.port && url.port !== "443") return null;
+      if (!isPublicHttpsHostname(url.hostname)) return null;
+      return url.toString();
+    }
+    if (url.protocol !== "http:" || !isLoopbackHostname(url.hostname)) {
+      return null;
+    }
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+
+export function isLoopbackGatewayUrl(value: string): boolean {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" && isLoopbackHostname(url.hostname);
+  } catch {
+    return false;
+  }
+}
+
+function parseProduct(value: unknown): SocialNotificationProduct | null {
+  return SOCIAL_NOTIFICATION_PRODUCTS.includes(
+    value as SocialNotificationProduct,
+  )
+    ? (value as SocialNotificationProduct)
+    : null;
+}
+
+function parseOptionalIdentifier(value: unknown): string | null | undefined {
+  if (value == null) return null;
+  const text = parseBoundedString(value, 128);
+  if (!text || !/^[A-Za-z0-9._:-]+$/.test(text)) return undefined;
+  return text;
+}
+
+function parseOptionalBoundedString(
+  value: unknown,
+  maxLength: number,
+): string | null | undefined {
+  if (value == null) return null;
+  return parseBoundedString(value, maxLength) ?? undefined;
+}
+
+function parseBoundedString(value: unknown, maxLength: number): string | null {
+  if (typeof value !== "string") return null;
+  const text = value.trim();
+  return text && text.length <= maxLength ? text : null;
+}
+
+function cloneJsonObjectWithoutUrl(
+  value: Record<string, unknown>,
+): JsonObject | null {
+  const clone = Object.create(null) as JsonObject;
+  const budget = { entries: 0 };
+  for (const [key, item] of Object.entries(value)) {
+    if (key === "url") continue;
+    if (utf8Bytes(key) > 128) return null;
+    const parsed = cloneJson(item, 1, budget);
+    if (parsed === undefined) return null;
+    clone[key] = parsed;
+  }
+  return clone;
+}
+
+function cloneJson(
+  value: unknown,
+  depth: number,
+  budget: { entries: number },
+): JsonValue | undefined {
+  if (depth > 8 || budget.entries++ >= 64) return undefined;
+  if (value === null || typeof value === "boolean") return value;
+  if (typeof value === "number")
+    return Number.isFinite(value) ? value : undefined;
+  if (typeof value === "string") {
+    return utf8Bytes(value) <= 1024 ? value : undefined;
+  }
+  if (Array.isArray(value)) {
+    if (value.length > 64) return undefined;
+    const result: JsonValue[] = [];
+    for (const item of value) {
+      const parsed = cloneJson(item, depth + 1, budget);
+      if (parsed === undefined) return undefined;
+      result.push(parsed);
+    }
+    return result;
+  }
+  if (!isRecord(value)) return undefined;
+  const result = Object.create(null) as JsonObject;
+  for (const [key, item] of Object.entries(value)) {
+    if (utf8Bytes(key) > 128) return undefined;
+    const parsed = cloneJson(item, depth + 1, budget);
+    if (parsed === undefined) return undefined;
+    result[key] = parsed;
+  }
+  return result;
+}
+
+function bad<T>(
+  error: string,
+  field?: string,
+): NotificationPusherParseResult<T> {
+  return { ok: false, error: { code: "BAD_REQUEST", error, field } };
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isLoopbackHostname(hostname: string): boolean {
+  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (
+    normalized === "localhost" ||
+    normalized.endsWith(".localhost") ||
+    normalized === "::1"
+  ) {
+    return true;
+  }
+  const octets = normalized.split(".").map(Number);
+  return (
+    octets.length === 4 &&
+    octets.every(
+      (part) => Number.isInteger(part) && part >= 0 && part <= 255,
+    ) &&
+    octets[0] === 127
+  );
+}
+
+function isPublicHttpsHostname(hostname: string): boolean {
+  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (
+    !normalized.includes(".") ||
+    normalized.endsWith(".localhost") ||
+    normalized.endsWith(".local") ||
+    normalized.endsWith(".internal") ||
+    normalized.endsWith(".home") ||
+    normalized.endsWith(".lan")
+  ) {
+    return false;
+  }
+
+  const ipv4 = normalized.split(".").map(Number);
+  if (
+    ipv4.length === 4 &&
+    ipv4.every((part) => Number.isInteger(part) && part >= 0 && part <= 255)
+  ) {
+    return false;
+  }
+
+  // Any colon denotes an IPv6 literal. Reject local/private/non-routable IPv6
+  // and public literals alike for v1; operators should use an allowlisted DNS
+  // name so HTTPS identity remains meaningful.
+  return !normalized.includes(":");
+}
+
+function utf8Bytes(value: string): number {
+  return new TextEncoder().encode(value).byteLength;
+}

package/src/backend/lib/oauth-providers.ts

@@ -99,12 +99,13 @@ export function getAuthConfig(env: Env): AuthConfig {
     });
   }
 
-  // Takosumi Accounts OIDC. The client SECRET is optional: when Takosumi
-  // materializes the OIDC client for an auto-provisioned Capsule it mints a
-  // PUBLIC client (token_endpoint_auth_method "none", PKCE-only, no secret — the
-  // service-graph resolve path can't deliver a confidential secret). A confidential
-  // client (secret set) also works. Either way PKCE-S256 protects the exchange,
-  // so issuer + client_id are sufficient to offer the provider.
+  // Takosumi Accounts OIDC. The client SECRET is optional: a Takosumi-created
+  // Capsule client is PUBLIC (token_endpoint_auth_method "none", PKCE-only),
+  // because the explicit install mapping publishes issuer/client metadata but
+  // deliberately does not project secret-bearing material. A separately
+  // configured confidential client (secret set) also works. Either way
+  // PKCE-S256 protects the exchange, so issuer + client_id are sufficient to
+  // offer the provider.
   const oidcIssuer = getOidcIssuerUrl(env);
   const { clientId: oidcClientId } = getOidcClientCredentials(env);
   if (oidcIssuer && oidcClientId) {

package/src/backend/routes/communities/messages.ts

@@ -1,15 +1,26 @@
 import { Hono } from "hono";
-import { and, desc, eq, isNull, sql } from "drizzle-orm";
+import { and, desc, eq, isNull, ne, sql } from "drizzle-orm";
 import {
   activities,
   communities,
   communityMembers,
+  dmCommunityReadStatus,
+  notificationPushers,
+  notificationPushJobs,
   objectRecipients,
   objects,
 } from "../../../db/index.ts";
 import type { Env, Variables } from "../../types.ts";
-import { formatUsername, generateId } from "../../federation-helpers.ts";
+import {
+  formatUsername,
+  generateId,
+  safeJsonParse,
+} from "../../federation-helpers.ts";
 import { feedCursorWhere } from "../../lib/feed-cursor.ts";
+import {
+  MAX_ATTACHMENTS,
+  MAX_ATTACHMENTS_JSON_LENGTH,
+} from "../posts/transformers.ts";
 import { communityRequiresMembership } from "../../lib/community-visibility.ts";
 import { rateLimit, RateLimitConfigs } from "../../middleware/rate-limit.ts";
 import {
@@ -28,6 +39,30 @@ import {
 const MAX_COMMUNITY_MESSAGE_LENGTH = 5000;
 const MAX_COMMUNITY_MESSAGES_LIMIT = 100;
 
+type ChatAttachment = Record<string, unknown>;
+
+/**
+ * Validate a chat message's attachments array (mirrors the post-create and DM
+ * bounds: records only, capped count + serialized size). Returns the validated
+ * array ([] when absent) or an error message.
+ */
+function validateAttachments(
+  raw: unknown,
+): ChatAttachment[] | { error: string } {
+  if (raw === undefined || raw === null) return [];
+  if (!Array.isArray(raw)) return { error: "attachments must be an array" };
+  if (raw.some((a) => !a || typeof a !== "object" || Array.isArray(a))) {
+    return { error: "attachments must be objects" };
+  }
+  if (raw.length > MAX_ATTACHMENTS) {
+    return { error: `Too many attachments (max ${MAX_ATTACHMENTS})` };
+  }
+  if (JSON.stringify(raw).length > MAX_ATTACHMENTS_JSON_LENGTH) {
+    return { error: "attachments payload too large" };
+  }
+  return raw as ChatAttachment[];
+}
+
 // D1's batch() (atomic multi-statement) is only on the concrete D1/libsql
 // driver, not the shared `Database` union; reach it through a narrow cast.
 type Batchable = {
@@ -151,6 +186,7 @@ messagesRouter.get("/:identifier/messages", async (c) => {
       apId: objects.apId,
       attributedTo: objects.attributedTo,
       content: objects.content,
+      attachmentsJson: objects.attachmentsJson,
       published: objects.published,
     })
     .from(objectRecipients)
@@ -176,11 +212,38 @@ messagesRouter.get("/:identifier/messages", async (c) => {
         icon_url: senderInfo?.iconUrl || null,
       },
       content: msg.content,
+      attachments: safeJsonParse<ChatAttachment[]>(msg.attachmentsJson, []),
       created_at: msg.published,
     };
   });
 
-  return c.json({ messages: result, has_more: hasMore });
+  // Per-member read positions (LOCAL-ONLY read receipts): rows exist only for
+  // local members that marked the chat read — read state is never federated,
+  // so remote members simply never appear here. Restricted to CURRENT members
+  // so a kicked member's stale row doesn't leak into the read count.
+  const readStates = await db
+    .select({
+      actorApId: dmCommunityReadStatus.actorApId,
+      lastReadAt: dmCommunityReadStatus.lastReadAt,
+    })
+    .from(dmCommunityReadStatus)
+    .innerJoin(
+      communityMembers,
+      and(
+        eq(communityMembers.communityApId, dmCommunityReadStatus.communityApId),
+        eq(communityMembers.actorApId, dmCommunityReadStatus.actorApId),
+      ),
+    )
+    .where(eq(dmCommunityReadStatus.communityApId, community.apId));
+
+  return c.json({
+    messages: result,
+    has_more: hasMore,
+    read_states: readStates.map((r) => ({
+      actor_ap_id: r.actorApId,
+      last_read_at: r.lastReadAt,
+    })),
+  });
 });
 
 // POST /api/communities/:name/messages - Send a chat message
@@ -196,14 +259,31 @@ messagesRouter.post(
     const db = c.get("db");
     const baseUrl = c.env.APP_URL;
     const apId = resolveCommunityApId(baseUrl, identifier);
-    const body = await c.req.json<{ content: string }>();
-
-    // Guard non-string content before .trim() (else TypeError → 500).
-    if (typeof body.content !== "string") {
+    const body = await c.req.json<{
+      content?: string;
+      attachments?: unknown;
+    }>();
+
+    const attachmentsOrError = validateAttachments(body.attachments);
+    if (!Array.isArray(attachmentsOrError)) {
+      return c.json({ error: attachmentsOrError.error }, 400);
+    }
+    const attachments = attachmentsOrError;
+
+    // Guard non-string content before .trim() (else TypeError → 500). An
+    // attachment-only message (image send) carries no text.
+    const rawContent = body.content;
+    if (
+      typeof rawContent !== "string" &&
+      !(
+        attachments.length > 0 &&
+        (rawContent === undefined || rawContent === null)
+      )
+    ) {
       return c.json({ error: "Message content is required" }, 400);
     }
-    const content = body.content.trim();
-    if (!content) {
+    const content = typeof rawContent === "string" ? rawContent.trim() : "";
+    if (!content && attachments.length === 0) {
       return c.json({ error: "Message content is required" }, 400);
     }
     if (content.length > MAX_COMMUNITY_MESSAGE_LENGTH) {
@@ -257,6 +337,54 @@ messagesRouter.post(
     const activityId = generateId();
     const activityApIdVal = `${baseUrl}/ap/activities/${activityId}`;
 
+    // Community talk deliberately has no social-inbox row, so its durable push
+    // jobs must commit with the message itself. Resolve only members that own a
+    // Yurume pusher at event time; delivery re-checks membership before egress.
+    const pushRecipients = await db
+      .selectDistinct({ actorApId: notificationPushers.actorApId })
+      .from(notificationPushers)
+      .innerJoin(
+        communityMembers,
+        eq(communityMembers.actorApId, notificationPushers.actorApId),
+      )
+      .where(
+        and(
+          eq(communityMembers.communityApId, community.apId),
+          eq(notificationPushers.product, "yurume"),
+          ne(notificationPushers.actorApId, actor.ap_id),
+        ),
+      );
+    const pushJobStatements: unknown[] = [];
+    // D1 caps bound parameters at 100. Keep each multi-row insert below that
+    // limit while retaining every insert in the same atomic batch.
+    const pushJobBatchSize = 8;
+    for (
+      let offset = 0;
+      offset < pushRecipients.length;
+      offset += pushJobBatchSize
+    ) {
+      pushJobStatements.push(
+        db
+          .insert(notificationPushJobs)
+          .values(
+            pushRecipients
+              .slice(offset, offset + pushJobBatchSize)
+              .map(({ actorApId }) => ({
+                id: `${actorApId}\n${activityApIdVal}`,
+                actorApId,
+                activityApId: activityApIdVal,
+                product: "yurume",
+                status: "pending",
+                attempts: 0,
+                nextAttemptAt: now,
+                createdAt: now,
+                updatedAt: now,
+              })),
+          )
+          .onConflictDoNothing(),
+      );
+    }
+
     // Persist the chat message atomically: the Note, its community-audience
     // recipient row (which the GET-messages reader joins on), the Create
     // activity, and the community's lastMessageAt. D1 has no interactive
@@ -270,6 +398,7 @@ messagesRouter.post(
         type: "Note",
         attributedTo: actor.ap_id,
         content,
+        attachmentsJson: JSON.stringify(attachments),
         toJson,
         audienceJson,
         visibility: "unlisted",
@@ -293,6 +422,7 @@ messagesRouter.post(
         .update(communities)
         .set({ lastMessageAt: now })
         .where(eq(communities.apId, community.apId)),
+      ...pushJobStatements,
     ]);
 
     return c.json(
@@ -307,6 +437,7 @@ messagesRouter.post(
             icon_url: actor.icon_url,
           },
           content,
+          attachments,
           created_at: now,
         },
       },