Changeset 0cea12b in Klonkt for src/routes/activitypub.js

Timestamp:

07/20/2026 08:19:20 PM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

81b2e1e

Parents:

513ba82

git-author:

Robin <roboburr@…> (07/20/2026 08:18:21 PM)

git-committer:

Robin <roboburr@…> (07/20/2026 08:19:20 PM)

Message:

Feature: owner inbox read over C2S (GET, bearer-gated)

GET /ap/users/:slug/inbox with a bearer scoped to that site returns the
recent timeline (accounts the owner follows) as an OrderedCollection of
Create(Note) items with content, url, published, sensitive and summary
(CW). Anyone else gets 403: the inbox stays write-only for the public.
This is the missing read half for a connected app's unified feed
(Shaer HomeBase, bead shaer-n4h); same gate pattern as the owner
followers/following read.

Changed files:
src/routes/activitypub.js

• GET /ap/users/:slug/inbox (owner only) mapping ap_timeline rows

New file:
test/c2s-inbox.test.js

• data-path coverage for the fields the mapping relies on

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

File:

• src/routes/activitypub.js (modified) (1 diff)

src/routes/activitypub.js

@@ -84 +84 @@
 });
 
+// ── Inbox read (owner only, AP C2S) ───────────────────────────────
+// GET on the inbox is part of ActivityPub C2S: the account owner (a bearer
+// scoped to this site) reads recent inbound posts (the timeline: accounts
+// they follow) as Create(Note) items, so an app (Shaer) can build a unified
+// feed. Anyone else gets 403; the inbox stays write-only for the public.
+router.get('/ap/users/:slug/inbox', (req, res) => {
+  const auth = OAuth.verifyBearer(req.headers.authorization);
+  if (!auth || auth.site.slug !== req.params.slug) return res.status(403).end();
+  const base = baseUrl(req);
+  const items = AP.getTimeline(auth.site.slug, 60).map((t) => ({
+    id: `${t.id}#create`,
+    type: 'Create',
+    actor: t.author_uri,
+    published: t.published || t.created_at || undefined,
+    object: {
+      id: t.id,
+      type: 'Note',
+      attributedTo: t.author_uri,
+      content: t.content,
+      url: t.url || undefined,
+      published: t.published || t.created_at || undefined,
+      sensitive: !!t.nsfw,
+      summary: t.cw || undefined,
+    },
+  }));
+  AP.sendAP(res, {
+    '@context': AP.AP_CONTEXT,
+    id: `${base}/ap/users/${auth.site.slug}/inbox`,
+    type: 'OrderedCollection',
+    totalItems: items.length,
+    orderedItems: items,
+  });
+});
+
 // ── Followers (count-only public, full for the owner) ─────────────
 // A C2S bearer scoped to this site (the account owner) gets the real actor