Changeset 25d4041 in Klonkt for src/services/CircleFederation.js

Timestamp:

06/16/2026 12:52:39 AM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

0091cb7

Parents:

b300682

Message:

Circles v1 — step 3: pull side (CircleService.sync)

• CircleService.js: fetches the remote actor + outbox per circle_link, verifies the Ed25519 Klonkt-Signature, sanitises (HTML -> plain text), caches in remote_actors/remote_posts. Defensive: https-only, fetch timeout, body cap, max items. Security: same-origin object.id vs actor (anti-impersonation), TOFU on the public key (key change = re-confirmation required), pruning of disappeared posts.
• startCircleSyncLoop(): periodic background sync (15 min), no-op unless tenancy=circle.
• server.js: loop started after initializeDatabase.

Consumer round-trip verified in isolation (verify ok / tamper fails / cross-origin
rejected).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@…>

(No files)