Changeset 8b07c12 in Klonkt for src

Timestamp:

07/22/2026 12:26:08 AM (7 weeks ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

dc4aa08

Parents:

4c70ecb

Message:

The AP blocked collection: the server blocklist drives Shaer's Orbit

Robins call: no separate client-side Orbit state; the block list on the
server is the source of truth. The actor now advertises the standard
ActivityPub blocked collection (spec 5.6) and the owner reads it over C2S;
Shaer hydrates "in Orbit" from it and keeps nothing locally.

Changed files:
src/services/ActivityPubService.js

• buildActor: blocked: {id}/blocked (AP 5.6, owner-only GET)

src/routes/activitypub.js

• GET /ap/users/:slug/blocked (bearer, owner-only): actor-kind blocks as an OrderedCollection of actor uris; domain blocks stay out (instance policy, not an Orbit member)

test/c2s-block.test.js

• the actor advertises blocked; actor-kind items only

test/activitypub-as2.test.js

• blocked added to the AS2 allowlist (a spec term, same family as liked/streams)

153 tests, all green.

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

Location:

src

Files:

• routes/activitypub.js (modified) (1 diff)
• services/ActivityPubService.js (modified) (1 diff)

src/routes/activitypub.js

@@ -87 +87 @@
   ).all(site.id);
   AP.sendAP(res, AP.buildOutbox(baseUrl(req), site, posts));
+});
+
+// ── Blocked collection (owner only, AP §5.6) ──────────────────────
+// The server blocklist is the source of truth for Shaer's "in Orbit":
+// clients read it here instead of keeping their own state. Actor-kind
+// blocks only (domain blocks are instance policy, not an Orbit member).
+router.get('/ap/users/:slug/blocked', (req, res) => {
+  const auth = OAuth.verifyBearer(req.headers.authorization);
+  if (!auth || auth.site.slug !== req.params.slug) return res.status(403).end();
+  const base = baseUrl(req);
+  const items = AP.listBlocks(auth.site.slug)
+    .filter((b) => b.kind === 'actor')
+    .map((b) => b.target);
+  AP.sendAP(res, {
+    '@context': AP.AP_CONTEXT,
+    id: `${base}/ap/users/${auth.site.slug}/blocked`,
+    type: 'OrderedCollection',
+    totalItems: items.length,
+    orderedItems: items,
+  });
 });
 

src/services/ActivityPubService.js

@@ -167 +167 @@
     following: `${id}/following`,
     featured: `${id}/featured`,
+    // AP §5.6: the private blocked collection (owner-only GET). The server
+    // list is the source of truth for Shaer's "in Orbit"; clients keep no
+    // separate state.
+    blocked: `${id}/blocked`,
     // C2S clients (Shaer apps) discover auth + upload here — no hardcoded paths.
     // All four are ActivityPub-spec `endpoints` terms. Dynamic client registration