Changeset 67f7150 in Klonkt for src/services/ActivityPubService.js

Timestamp:

07/30/2026 11:26:35 AM (6 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

6dd26e5

Parents:

a9da2c0

Message:

C2S Delete voor eigen notes en shaer:author op de eigen outbox

Twee dingen uit de app (Robins verzoek, 30-7). Een: long-press delete op
een eigen post. De C2S outbox accepteert nu Delete voor notes van dit
account: eigen posts (Tombstone naar volgers, dan cascade zoals de
web-route) en eigen outbound replies (via deliverOutboxDelete). Andermans
posts en onbekende notes krijgen een helder 403/404.

Twee: eigen posts hadden in de app geen header. De timeline-entries
dragen shaer:author, maar de eigen outbox-leg niet, dus elke kaart had
een byline behalve je eigen. De outbox zet nu op de friend-leg de eigen
display-info (titel, handle, avatar) als shaer:author op elke note.

Changed files:
src/services/ActivityPubService.js

• case 'Delete' in ingestOutboxActivity: eigen post -> deliverDelete + cascade (comments, FTS, post); eigen outbox-reply -> tombstone; vreemd -> 403/404
• selfAuthor(base, site): eigen byline in shaer:author-vorm

src/routes/activitypub.js

• outbox friend-leg verrijkt elke note met shaer:author

test/c2s-compose.test.js

• delete-test (eigen wel, andermans niet, onbekend 404) en selfAuthor-test

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

File:

• src/services/ActivityPubService.js (modified) (3 diffs)

src/services/ActivityPubService.js

@@ -760 +760 @@
   if (user) out.preferredUsername = user;
   if (d.icon) out.icon = { type: 'Image', url: d.icon };
+  return out;
+}
+
+// The site's OWN display info in the same shape as `shaer:author` on timeline
+// entries. The owner's app reads its own posts from the outbox, which carried
+// no author info, so every card but your own had a byline (Robins melding,
+// 30-7: geen header van self op eigen posts).
+export function selfAuthor(base, site) {
+  const out = {
+    name: site.title || site.slug,
+    handle: `@${site.slug}@${String(base).replace(/^https?:\/\//, '')}`,
+    url: `${base}/${site.slug === site.primary_slug ? '' : 'user/' + encodeURIComponent(site.slug)}`,
+  };
+  if (site.profile_photo) {
+    out.icon = /^https?:/.test(site.profile_photo) ? site.profile_photo : `${base}${site.profile_photo.startsWith('/') ? '' : '/'}${site.profile_photo}`;
+  }
   return out;
 }
@@ -2374 +2390 @@
         return { status: 400, error: 'unsupported_undo' };
       }
-      // Delete/Update of arbitrary objects need the post-edit pipeline; tracked
+      // Delete your OWN note (Robins verzoek, 30-7: long-press delete in de
+      // app). Scope stays narrow: this account's posts and outbound replies,
+      // nothing else. The web delete route is the model: Tombstone to the
+      // followers first, then the cascade, so nobody keeps a live copy of a
+      // post the child took back.
+      case 'Delete': {
+        const targetUri = c2sIdOf(object);
+        if (!targetUri) return { status: 400, error: 'missing_object' };
+        const pid = postIdFromNoteUrl(targetUri, base);
+        if (pid) {
+          const post = db.prepare('SELECT * FROM posts WHERE id = ?').get(pid);
+          if (post) {
+            if (post.site_id !== site.id) return { status: 403, error: 'not_your_note' };
+            if (post.status === 'published') deliverDelete(site, post).catch(() => { /* best-effort */ });
+            db.transaction(() => {
+              db.prepare('DELETE FROM comments WHERE post_id = ?').run(post.id);
+              try { db.prepare('DELETE FROM posts_fts WHERE post_id = ?').run(post.id); } catch { /* FTS optional */ }
+              db.prepare('DELETE FROM posts WHERE id = ?').run(post.id);
+            })();
+            return { status: 202, url: targetUri };
+          }
+          // Same /ap/notes/ namespace: one of our outbound replies/messages.
+          // deliverOutboxDelete checks the site itself and tombstones too.
+          if (await deliverOutboxDelete(site, pid)) return { status: 202, url: targetUri };
+        }
+        return { status: 404, error: 'not_your_note' };
+      }
+      // Update of arbitrary objects needs the post-edit pipeline; tracked
       // separately (klonkt-demo-c2s-del). Reject clearly rather than half-doing it.
       default:
@@ -4114 +4157 @@
   linkifyBody, bakePostContent, bakePostContentWithMentions, listFollowers, removeFollower, listConnections,
   noteVisibility, belongsInTimeline, playerUrlFor, isRejectedObject, rejectInteraction, interactionReportTarget,
-  getMessages, notificationsSeenAt, ingestOutboxActivity, c2sVisibility, actorDisplay, buildActorRef, prefersEnriched,
+  getMessages, notificationsSeenAt, ingestOutboxActivity, c2sVisibility, actorDisplay, buildActorRef, prefersEnriched, selfAuthor,
 };