fedipod-server 0.13.2 → 0.14.1

package/web/app/dist/sw.js

@@ -55946,6 +55946,17 @@ async function mentionsFor(publisher, content, inReplyTo) {
   }
   return mentions;
 }
+function assertDirectAddressed(content, mentions) {
+  const wanted = [...new Set(mentionsIn(content))];
+  const missing = wanted.filter((h) => !mentions.some((m) => m.handle === h));
+  let why = null;
+  if (!wanted.length) why = "a direct message names who it is for \u2014 mention them as @name@host";
+  else if (missing.length) why = `could not find ${missing.map((h) => "@" + h).join(", ")} \u2014 the direct message was not sent`;
+  if (!why) return;
+  const e = new Error(why);
+  e.code = "unaddressed";
+  throw e;
+}
 async function publishNote(publisher, content, { inReplyTo, attachments, visibility = "public", spoilerText = null } = {}) {
   const { urls } = publisher;
   const priv = visibility === "private" || visibility === "direct";
@@ -55956,6 +55967,7 @@ async function publishNote(publisher, content, { inReplyTo, attachments, visibil
   const published = (/* @__PURE__ */ new Date()).toISOString();
   const slug = published.slice(0, 10) + "-" + node_crypto_default.randomBytes(4).toString("hex");
   const mentions = await publisher._mentionsFor(content, inReplyTo);
+  if (visibility === "direct") assertDirectAddressed(content, mentions);
   const note = noteDoc({
     urls,
     slug,
@@ -56157,6 +56169,7 @@ async function publishQuestion(publisher, content, {
   const published = (/* @__PURE__ */ new Date()).toISOString();
   const slug = published.slice(0, 10) + "-" + node_crypto_default.randomBytes(4).toString("hex");
   const mentions = await publisher._mentionsFor(content, inReplyTo);
+  if (visibility === "direct") assertDirectAddressed(content, mentions);
   const poll = {
     multiple: !!multiple,
     expiresAt: expiresAt || null,
@@ -57380,7 +57393,7 @@ async function onUndo(intake, activity, actor, { trusted = false } = {}) {
   await intake.republish({ followers: true });
   intake.log(`unfollowed by ${actor}`);
 }
-async function onCreate(intake, activity, actor) {
+async function onCreate(intake, activity, actor, { trusted = false } = {}) {
   const objectId = typeof activity.object === "string" ? activity.object : activity.object?.id;
   if (!objectId) return "Create without object id";
   if (intake.store.isBlocked(objectId)) return `blocked domain (${objectId})`;
@@ -57389,7 +57402,8 @@ async function onCreate(intake, activity, actor) {
   if (!intake.concernsUs(envelope, actor)) return `not addressed to us (${objectId})`;
   const ingested = intake.store.getStatuses().some((x) => x.noteId === objectId && (x.kind === "timeline" || x.kind === "mention"));
   if (!ingested) {
-    const rejected = await intake.ingestNote(objectId, actor);
+    const inline = trusted && typeof activity.object === "object" && activity.object?.id === objectId ? activity.object : null;
+    const rejected = await intake.ingestNote(objectId, actor, { inline });
     if (rejected) return rejected;
   }
   if (intake.config.kind === "group") await intake.amplify(objectId, { activity });
@@ -57471,9 +57485,9 @@ async function onUpdate(intake, activity, actor) {
   const note = await intake.fetchAP(objectId);
   if (!note) throw new Error(`cannot refetch ${objectId} \u2014 will retry`);
   if (note.id !== objectId || !isContentType(note.type)) return `object not verifiable content (${objectId}, ${note.type})`;
-  const { attachmentsOf: attachmentsOf2, titledContent: titledContent2 } = await Promise.resolve().then(() => (init_wire(), wire_exports));
+  const { attachmentsOf: attachmentsOf3, titledContent: titledContent2 } = await Promise.resolve().then(() => (init_wire(), wire_exports));
   const content = titledContent2(note);
-  const attachments = attachmentsOf2(note);
+  const attachments = attachmentsOf3(note);
   const freshPoll = pollOf(note);
   const freshEmojis = emojisOf(note);
   intake.store.updateStatus(objectId, {
@@ -57603,12 +57617,12 @@ function referencesOurObject(intake, activity) {
   if (refs.some((r) => r.startsWith(intake.urls.notes))) return true;
   return intake.config.kind === "group" && refs.some((r) => intake.store.getStatuses().some((s) => s.noteId === r));
 }
-async function ingestNote(intake, objectId, actor, { via } = {}) {
-  const note = await intake.fetchAP(objectId);
+async function ingestNote(intake, objectId, actor, { via, inline = null } = {}) {
+  const note = inline || await intake.fetchAP(objectId);
   if (!note) return `object fetch failed (${objectId})`;
   if (note.id !== objectId || !isContentType(note.type)) return `object not verifiable content (${objectId}, ${note.type})`;
-  const { attachmentsOf: attachmentsOf2, titledContent: titledContent2 } = await Promise.resolve().then(() => (init_wire(), wire_exports));
-  const attachments = attachmentsOf2(note);
+  const { attachmentsOf: attachmentsOf3, titledContent: titledContent2 } = await Promise.resolve().then(() => (init_wire(), wire_exports));
+  const attachments = attachmentsOf3(note);
   const content = titledContent2(note);
   const author = authorOf(note, actor);
   if (!author) return `object names an author its origin does not vouch for (${objectId})`;
@@ -57652,7 +57666,9 @@ async function ingestNote(intake, objectId, actor, { via } = {}) {
     ...attachments.length ? { attachments } : {},
     ...via ? { via } : {}
   });
-  if (!followed || note.inReplyTo && String(note.inReplyTo).startsWith(intake.urls.notes)) {
+  const namesUs = mentions.some((m) => m.href === intake.urls.actor);
+  const replyToOurs = !!note.inReplyTo && String(note.inReplyTo).startsWith(intake.urls.notes);
+  if (!followed || replyToOurs || direct || namesUs) {
     intake.store.addNotification({ type: "mention", actor: author, noteId: note.id });
   }
   if (note.inReplyTo && String(note.inReplyTo).startsWith(intake.urls.notes)) {
@@ -63128,7 +63144,7 @@ var Intake = class {
       case "Undo":
         return this.onUndo(activity, actor, { trusted });
       case "Create":
-        return this.onCreate(activity, actor);
+        return this.onCreate(activity, actor, { trusted });
       case "Accept":
         return this.onAccept(activity, actor, { trusted });
       case "Like":
@@ -64107,7 +64123,7 @@ __export(social_exports, {
 });
 init_node_crypto();
 init_wire();
-async function lookupWebFinger(acct) {
+async function lookupWebFinger(acct, { fetchImpl = null } = {}) {
   const clean = String(acct || "").replace(/^acct:/, "");
   const at = clean.lastIndexOf("@");
   if (at < 1) return null;
@@ -64115,9 +64131,8 @@ async function lookupWebFinger(acct) {
   if (!host || /[/\\?#]/.test(host)) return null;
   const { safeFetch: safeFetch2, readCapped: readCapped3 } = await Promise.resolve().then(() => (init_safefetch(), safefetch_exports));
   const url = `https://${host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${clean}`)}`;
-  const res = await safeFetch2(url, {
-    headers: { accept: "application/jrd+json, application/json" }
-  }).catch(() => null);
+  const headers = { accept: "application/jrd+json, application/json" };
+  const res = await (fetchImpl ? fetchImpl(url, { headers }) : safeFetch2(url, { headers })).catch(() => null);
   if (!res || res.status >= 400) return null;
   let jrd2;
   try {
@@ -64153,13 +64168,15 @@ async function resolveHandle(agent2, handle7) {
   const clean = String(handle7 || "").replace(/^@/, "");
   if (!/^[^@]+@[^@]+$/.test(clean)) throw new Error("handle must look like user@host");
   if (agent2.store.isBlocked("https://" + clean.split("@")[1] + "/")) throw new Error("domain is blocked");
-  const jrd2 = await lookupWebFinger("acct:" + clean);
+  const remote = agent2.intake?.deliverer?.signedFetch ? (u, i) => agent2.intake.deliverer.signedFetch(u, i) : null;
+  const lookup2 = (a) => lookupWebFinger(a, { fetchImpl: remote });
+  const jrd2 = await lookup2("acct:" + clean);
   const self2 = selfLink(jrd2);
   if (!self2?.href) throw new Error(`webfinger found no actor for ${clean}`);
   const doc = await agent2.intake.fetchAP(self2.href);
   if (!doc?.id) throw new Error(`actor document unusable for ${clean}`);
   if (agent2.store.isBlocked(doc.id)) throw new Error("actor is blocked");
-  await confirmDelegation(clean.slice(clean.lastIndexOf("@") + 1), doc);
+  await confirmDelegation(clean.slice(clean.lastIndexOf("@") + 1), doc, lookup2);
   await cacheCounts(agent2, doc);
   return doc;
 }
@@ -64528,6 +64545,16 @@ var postUrl = (uri) => {
   const m = String(uri).match(/^at:\/\/([^/]+)\/[^/]+\/(.+)$/);
   return m ? `https://bsky.app/profile/${m[1]}/post/${m[2]}` : null;
 };
+function attachmentsOf2(post) {
+  const e = post?.embed || {};
+  const images = [...e.images || [], ...e.media?.images || []].filter((i) => i?.fullsize).map((i) => ({ url: i.fullsize, mediaType: "image/jpeg", description: i.alt || "" }));
+  const card = e.external?.thumb || e.media?.external?.thumb;
+  if (card) {
+    const ext = e.external || e.media.external;
+    images.push({ url: card, mediaType: "image/jpeg", description: ext.title || ext.uri || "" });
+  }
+  return images;
+}
 var BskyFeed = class {
   constructor({ store, atproto, log: log2 = console.log, onNotification = null }) {
     Object.assign(this, { store, atproto, log: log2, onNotification });
@@ -64583,14 +64610,27 @@ var BskyFeed = class {
     return url;
   }
   // One Bluesky post into the statuses index. Returns its noteId, new or not.
+  // A post seen before is completed, not duplicated: a reply first met as a
+  // bare notification record learns its parent and its pictures from the
+  // full view when that arrives.
   _mirrorPost(post, { via = null } = {}) {
     const noteId = post.uri;
-    const existing = this.store.getStatuses().some((s) => s.noteId === noteId);
-    if (existing) return { noteId, added: false };
+    const inReplyTo = post.record?.reply?.parent?.uri || null;
+    const attachments = attachmentsOf2(post);
+    const existing = this.store.getStatuses().find((s) => s.noteId === noteId);
+    if (existing) {
+      const patch = {
+        ...inReplyTo && !existing.inReplyTo ? { inReplyTo } : {},
+        ...attachments.length && !existing.attachments?.length ? { attachments } : {}
+      };
+      if (Object.keys(patch).length && typeof this.store.updateStatus === "function") {
+        this.store.updateStatus(noteId, patch);
+      }
+      return { noteId, added: false };
+    }
     const actor = this._rememberAuthor(post.author);
     if (this.store.isBlocked(actor)) return { noteId, added: false };
     const text = post.record?.text || "";
-    const images = post.embed?.images || [];
     this.store.addStatus({
       noteId,
       actor,
@@ -64600,12 +64640,46 @@ var BskyFeed = class {
       ...post.cid ? { cid: post.cid } : {},
       link: postUrl(noteId),
       ...via ? { via } : {},
-      ...images.length ? {
-        attachments: images.map((i) => ({ url: i.fullsize, mediaType: "image/jpeg", description: i.alt || "" }))
-      } : {}
+      ...inReplyTo ? { inReplyTo } : {},
+      ...attachments.length ? { attachments } : {}
     });
     return { noteId, added: true };
   }
+  // The conversation under one post, asked for when a post is opened: the
+  // ancestors it hangs from and the replies beneath it, each mirrored with
+  // the reply link the thread view is built from. View cache only, like the
+  // timeline. Returns how many posts were new; a thread Bluesky will not
+  // give (gone, blocked, rate-limited) adds none and is logged, not thrown.
+  async mirrorThread(uri, { depth = 6 } = {}) {
+    if (!this.atproto?.connected()) return 0;
+    if (this.quietUntil && Date.now() < this.quietUntil) return 0;
+    let out;
+    try {
+      out = await this.atproto.xrpc("app.bsky.feed.getPostThread", { params: { uri, depth, parentHeight: 40 } });
+    } catch (e) {
+      if (e.status === 429 || e.status >= 500) this._backOff(e.status, null);
+      else this.log(`bskyfeed: thread ${uri}: ${e.message}`);
+      return 0;
+    }
+    const self2 = this.atproto.read()?.did;
+    const ownMirrors = new Set(this.store.getStatuses().map((s) => s.atproto?.uri).filter(Boolean));
+    let added = 0;
+    const take2 = (node) => {
+      const post = node?.post;
+      if (!post?.uri) return;
+      if (post.author?.did === self2 && ownMirrors.has(post.uri)) return;
+      if (this._mirrorPost(post).added) added++;
+    };
+    for (let up = out?.thread?.parent; up; up = up.parent) take2(up);
+    const walk = (node, left) => {
+      take2(node);
+      if (left <= 0) return;
+      for (const r of node?.replies || []) walk(r, left - 1);
+    };
+    walk(out?.thread, depth);
+    if (added) this.log(`bskyfeed: +${added} from the thread under ${uri}`);
+    return added;
+  }
   async sweep() {
     if (!this.atproto?.connected()) return;
     if (this.quietUntil && Date.now() < this.quietUntil) return;
@@ -64644,8 +64718,13 @@ var BskyFeed = class {
           this.store.addNotification({ type: "follow", actor, bsky: true });
           await this.onNotification?.(n, { actor });
         } else if (n.reason === "mention" || n.reason === "reply") {
-          const record = { uri: n.uri, cid: n.cid, author: n.author, record: n.record, indexedAt: n.indexedAt };
-          this._mirrorPost(record);
+          let view = null;
+          try {
+            const got = await this.atproto.xrpc("app.bsky.feed.getPosts", { params: { uris: n.uri } });
+            view = (got?.posts || [])[0] || null;
+          } catch {
+          }
+          this._mirrorPost(view || { uri: n.uri, cid: n.cid, author: n.author, record: n.record, indexedAt: n.indexedAt });
           this.store.addNotification({ type: "mention", actor, noteId: n.uri, bsky: true });
           await this.onNotification?.(n, { actor });
         }
@@ -65896,10 +65975,16 @@ async function handle6(api, ctx) {
       api.store.setScheduled(sched);
       return send(200, api.scheduledJson(entry));
     }
-    const note = await api.agent.publisher.publishNote(
-      body.status,
-      { inReplyTo, attachments, visibility, spoilerText }
-    );
+    let note;
+    try {
+      note = await api.agent.publisher.publishNote(
+        body.status,
+        { inReplyTo, attachments, visibility, spoilerText }
+      );
+    } catch (e) {
+      if (e.code === "unaddressed") return send(422, { error: e.message });
+      throw e;
+    }
     const s = api.store.getStatuses().find((x) => x.noteId === note.id);
     return send(200, api.status(s));
   }
@@ -65978,6 +66063,10 @@ async function handle6(api, ctx) {
   const mContext = /^\/api\/v1\/statuses\/([a-f0-9]+)\/context$/.exec(pathname);
   if (mContext) {
     const noteUrl = api.lookup(mContext[1]).s?.noteId;
+    const opened = noteUrl && api.store.getStatuses().find((x) => x.noteId === noteUrl);
+    if (opened?.kind === "bsky" && typeof api.agent?.bskyfeed?.mirrorThread === "function") {
+      await api.agent.bskyfeed.mirrorThread(noteUrl);
+    }
     const all = api.store.getStatuses();
     const byId = new Map(all.map((s) => [s.noteId, s]));
     const ancestors = [];
@@ -66413,8 +66502,8 @@ var TagFeed = class {
             await this.intake.fetchAP(author).catch(() => {
             });
           }
-          const { attachmentsOf: attachmentsOf2, titledContent: titledContent2 } = await Promise.resolve().then(() => (init_wire(), wire_exports));
-          const attachments = attachmentsOf2(note);
+          const { attachmentsOf: attachmentsOf3, titledContent: titledContent2 } = await Promise.resolve().then(() => (init_wire(), wire_exports));
+          const attachments = attachmentsOf3(note);
           this.store.addStatus({
             noteId,
             actor: author,
@@ -69677,7 +69766,11 @@ var BrowserAgent = class _BrowserAgent {
       deliverer: this.deliverer,
       publicKeyPem: keys.rsaPublicPem,
       assertionKey: null,
-      log: this.log
+      log: this.log,
+      // Who a post names, resolved — the same lookup the installed agent
+      // gives its publisher. Without it no mention from the browser ever
+      // resolved: a direct message went to nobody, a mention notified no one.
+      resolveMention: (h) => resolveHandle(this, h)
     });
     this.atproto = new BrowserAtproto({ store: this.store, actorId: this.urls.actor, log: this.log });
     this.publisher.atproto = this.atproto;