Changeset 74c5abc in Klonkt for src/services/ActivityPubService.js

Timestamp:

06/28/2026 04:46:38 PM (2 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

99989f9

Parents:

f79a471

Message:

feat(images): downscale remote (fediverse) avatars via a signed proxy

Remote avatars live on other servers, so the browser shrank full-res line-art to ~44px
(jagged). Fetch them once (SSRF-safe via safeFetch), downscale identically (lanczos -> WebP),
cache, serve. HMAC-signed proxy URLs → not an open resizer.

• services/ActivityPubService.js — export safeFetch
• services/ThumbnailService.js — getRemoteThumbnail + signed imgProxyUrl/verifyImg; +128px size
• server.js — GET /img/a/:w signed proxy route
• middleware/render.js — avatar(url,w) helper (local thumb / remote proxy)
• views: news.ejs, fedi-node.ejs, following.ejs avatars -> avatar()

File:

• src/services/ActivityPubService.js (modified) (1 diff)

src/services/ActivityPubService.js

@@ -60 +60 @@
   if (!addrs.length || addrs.some((a) => isBlockedIp(a.address))) throw new Error('ssrf-blocked-host');
 }
-async function safeFetch(url, opts = {}, maxRedirects = 3) {
+export async function safeFetch(url, opts = {}, maxRedirects = 3) {
   let target = url;
   for (let hop = 0; ; hop++) {