Changeset 5bf63b7 in Klonkt for src/routes

Timestamp:

06/24/2026 10:35:48 AM (3 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

dd1028a

Parents:

6bd25d1

Message:

feat(activitypub): phase 1b — Follow/Accept, HTTP Signatures, delivery

Inbox handles Follow (store follower + send signed Accept) and Undo Follow;
incoming requests are signature-verified (best-effort). Outgoing POSTs to inboxes
are signed (draft-cavage RSA-SHA256). New published public posts are delivered as
Create(Note) to followers' inboxes. Makes a Klonkt actor truly followable from
Mastodon; live interop test pending with Bart.

Co-Authored-By: Claude <noreply@…>

Location:

src/routes

Files:

• activitypub.js (modified) (1 diff)
• posts.js (modified) (2 diffs)

src/routes/activitypub.js

@@ -80 +80 @@
 });
 
-// ── Inbox (Phase 1 stub: accept; Follow/Accept + sig verify next step) ──
-const apJson = express.json({ type: ['application/activity+json', 'application/ld+json', 'application/json'], limit: '1mb' });
-router.post(['/ap/users/:slug/inbox', '/ap/inbox'], apJson, (req, res) => {
-  try { console.log('[AP inbox]', (req.body && req.body.type) || 'unknown', '→', req.params.slug || 'shared'); } catch { /* ignore */ }
-  res.status(202).end();
+// ── Inbox — Follow→Accept, Undo Follow (best-effort signature verify) ──
+const apJson = express.json({
+  type: ['application/activity+json', 'application/ld+json', 'application/json'],
+  limit: '1mb',
+  verify: (req, _res, buf) => { req.rawBody = buf; }, // raw body for digest verification
+});
+router.post(['/ap/users/:slug/inbox', '/ap/inbox'], apJson, async (req, res) => {
+  try { return res.status(await AP.handleInbox(req, req.params.slug || null) || 202).end(); }
+  catch (e) { console.warn('[AP inbox] error:', e.message); return res.status(202).end(); }
 });
 

src/routes/posts.js

@@ -19 +19 @@
 import { audioUrl } from '../services/AudioStreamService.js';
 import { toWebp } from '../services/ImageWebpService.js';
+import ActivityPubService from '../services/ActivityPubService.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -230 +231 @@
       ).run(HtmlSanitizerService.toPlainText(cleanContent), title || '', req.session.user.username, postId);
     } catch (e) { /* FTS index issues are non-fatal */ }
+
+    // ActivityPub: federate a freshly published public post to followers.
+    if (!fanOnly) {
+      ActivityPubService.deliverCreate(site, {
+        id: postId, slug: finalSlug, title: title || finalSlug,
+        content: cleanContent, published_at: publishedAt, created_at: now,
+      }).catch(() => { /* best-effort */ });
+    }
   }