Changeset 737ea05 in Klonkt for src/services/ActivityPubService.js

Timestamp:

07/01/2026 07:26:13 PM (2 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

9e1b1bb

Parents:

1c2dcba

Message:

feat(fediverse): receive reports (inbound Flag) → owner's notifications

Completes the Klonkt↔Klonkt report loop: a Flag delivered to a Klonkt inbox was
previously ignored. It's now signature-enforced, stored, and surfaced to the site
owner (who moderates their own instance) in the fediverse notifications.

• src/config/database.js — ap_reports table (per-site incoming reports).
• src/services/ActivityPubService.js — handleInbox handles inbound Flag (resolves which local site it targets from the reported object URIs, stores reporter + reason); Flag added to the signature-GATED list; getNotifications includes reports.
• src/views/pages/fedi-notifications.ejs — a report item (flag icon, reason).
• src/services/i18n.js — notif.reported (nl/en/de).
• CHANGELOG(.nl/.de).md — note that reports about your site show in notifications.

Co-Authored-By: Claude <noreply@…>

File:

• src/services/ActivityPubService.js (modified) (3 diffs)

src/services/ActivityPubService.js

@@ -936 +936 @@
   // Blocked actor/domain → silently drop (202, don't reveal the block).
   if (claimedActor && isBlockedAny(claimedActor)) { console.log('[AP] inbox dropped (blocked)', claimedActor, 'from', ip); return 202; }
-  const GATED = ['Create', 'Like', 'Announce', 'Follow', 'Delete', 'Undo', 'Accept', 'Reject', 'Add', 'Remove', 'Update'];
+  const GATED = ['Create', 'Like', 'Announce', 'Follow', 'Delete', 'Undo', 'Accept', 'Reject', 'Add', 'Remove', 'Update', 'Flag'];
   if (GATED.includes(type)) {
     if (!verified || !claimedActor || verified.id !== claimedActor) {
@@ -942 +942 @@
       return 401;
     }
+  }
+
+  // A moderation report (Flag) about our content — store it for the targeted site's owner
+  // (each Klonkt site is moderated by its own owner). Signature is enforced (GATED).
+  if (type === 'Flag') {
+    const objs = Array.isArray(act.object) ? act.object : (act.object ? [act.object] : []);
+    const objectUris = objs.map((o) => (typeof o === 'string' ? o : (o && o.id))).filter(Boolean);
+    let targetSlug = null;
+    const noteIds = [];
+    for (const u of objectUris) {
+      const s = slugFromActorUrl(u);        // one of our actors?
+      if (s) { targetSlug = targetSlug || s; continue; }
+      const pid = postIdFromNoteUrl(u, base); // one of our notes?
+      if (pid) noteIds.push(pid);
+    }
+    if (!targetSlug && noteIds.length) {
+      try { const r = db.prepare('SELECT s.slug FROM posts p JOIN sites s ON s.id = p.site_id WHERE p.id = ? LIMIT 1').get(noteIds[0]); if (r) targetSlug = r.slug; } catch { /* ignore */ }
+    }
+    if (!targetSlug) return 202; // not about us / can't tell → drop
+    const ai = actorInfo(await resolveActor(claimedActor).catch(() => null), claimedActor);
+    try {
+      db.prepare('INSERT INTO ap_reports (slug, actor_uri, actor_name, actor_handle, actor_icon, content, objects, created_at) VALUES (?,?,?,?,?,?,?,CURRENT_TIMESTAMP)')
+        .run(targetSlug, claimedActor || null, ai.name, ai.handle, ai.icon, HtmlSanitizerService.toPlainText(act.content || '').slice(0, 3000), JSON.stringify(objectUris.slice(0, 20)));
+      console.log('[AP] report received for', targetSlug, 'from', claimedActor);
+    } catch { /* ignore */ }
+    return 202;
   }
 
@@ -2110 +2136 @@
     });
   } catch { /* ignore */ }
+  try {
+    for (const r of db.prepare('SELECT actor_uri, actor_name, actor_handle, actor_icon, content, created_at FROM ap_reports WHERE slug = ? ORDER BY created_at DESC LIMIT 50').all(slug)) {
+      out.push({ type: 'report', name: r.actor_name, handle: r.actor_handle, url: r.actor_uri, icon: r.actor_icon, content: r.content, created_at: r.created_at });
+    }
+  } catch { /* ignore */ }
   out.sort((a, b) => new Date(b.created_at) - new Date(a.created_at));
   return out.slice(0, limit || 60);