Changeset 8b07c12 in Klonkt for test

Timestamp:

07/22/2026 12:26:08 AM (7 weeks ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

dc4aa08

Parents:

4c70ecb

Message:

The AP blocked collection: the server blocklist drives Shaer's Orbit

Robins call: no separate client-side Orbit state; the block list on the
server is the source of truth. The actor now advertises the standard
ActivityPub blocked collection (spec 5.6) and the owner reads it over C2S;
Shaer hydrates "in Orbit" from it and keeps nothing locally.

Changed files:
src/services/ActivityPubService.js

• buildActor: blocked: {id}/blocked (AP 5.6, owner-only GET)

src/routes/activitypub.js

• GET /ap/users/:slug/blocked (bearer, owner-only): actor-kind blocks as an OrderedCollection of actor uris; domain blocks stay out (instance policy, not an Orbit member)

test/c2s-block.test.js

• the actor advertises blocked; actor-kind items only

test/activitypub-as2.test.js

• blocked added to the AS2 allowlist (a spec term, same family as liked/streams)

153 tests, all green.

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

Location:

test

Files:

• activitypub-as2.test.js (modified) (1 diff)
• c2s-block.test.js (modified) (1 diff)

test/activitypub-as2.test.js

@@ -30 +30 @@
   'totalItems', 'orderedItems', 'items', 'first', 'last', 'partOf', 'next', 'prev',
   'preferredUsername', 'inbox', 'outbox', 'followers', 'following', 'endpoints', 'sharedInbox',
+  // ActivityPub §5.6: the private blocked collection (owner-only GET).
+  'blocked',
   // ActivityPub §4.1 `endpoints` vocabulary (same category as sharedInbox), used for C2S.
   'oauthAuthorizationEndpoint', 'oauthTokenEndpoint', 'uploadMedia',

test/c2s-block.test.js

@@ -43 +43 @@
   assert.equal(out.status, 400);
 });
+
+test('the actor advertises the blocked collection (AP 5.6)', () => {
+  site.primary_slug = 'me';
+  const actor = AP.buildActor('https://test.example', site);
+  assert.equal(actor.blocked, 'https://test.example/ap/users/me/blocked');
+});
+
+test('actor-kind blocks form the collection items; domain blocks stay out', async () => {
+  await AP.ingestOutboxActivity(site, user, { type: 'Block', object: BULLY });
+  await AP.blockTarget(site, 'nare-server.example');   // domain block
+  const items = AP.listBlocks('me').filter((b) => b.kind === 'actor').map((b) => b.target);
+  assert.deepEqual(items, [BULLY]);
+});