Changeset 25d4041 in Klonkt

Timestamp:

06/16/2026 12:52:39 AM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

0091cb7

Parents:

b300682

Message:

Circles v1 — step 3: pull side (CircleService.sync)

• CircleService.js: fetches the remote actor + outbox per circle_link, verifies the Ed25519 Klonkt-Signature, sanitises (HTML -> plain text), caches in remote_actors/remote_posts. Defensive: https-only, fetch timeout, body cap, max items. Security: same-origin object.id vs actor (anti-impersonation), TOFU on the public key (key change = re-confirmation required), pruning of disappeared posts.
• startCircleSyncLoop(): periodic background sync (15 min), no-op unless tenancy=circle.
• server.js: loop started after initializeDatabase.

Consumer round-trip verified in isolation (verify ok / tamper fails / cross-origin
rejected).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@…>

Location:

src

Files:

• server.js (modified) (2 diffs)
• services/CircleService.js (added)

src/server.js

@@ -44 +44 @@
 import postsRoutes from './routes/posts.js';
 import federationRoutes from './routes/federation.js';
+import { startCircleSyncLoop } from './services/CircleService.js';
 
 if (!process.env.SESSION_SECRET) {
@@ -146 +147 @@
 initializeDatabase();
 
+// Cirkels: periodieke achtergrond-sync van remote instances (no-op tenzij tenancy='circle').
+startCircleSyncLoop();
+
 // Bundle HTMX: copy from node_modules into our own assets dir so we can serve
 // it locally (no third-party CDN). Idempotent — only copies if size differs.