Changeset 928d1c7 in Klonkt for src/services/ActivityPubService.js

Timestamp:

07/21/2026 01:06:47 AM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

9e9e6f9

Parents:

61e3daf

git-author:

Robin <roboburr@…> (07/21/2026 01:06:45 AM)

git-committer:

Robin <roboburr@…> (07/21/2026 01:06:47 AM)

Message:

Feature: paid posts slice 2, post model + teaser gate

A post can be marked paid (klonkt-demo-aki), premium-gated in the
editor with an optional per-post price; additive columns posts.paid +
paid_min_cents. On the web, a paid post shows only a teaser to anyone
who is not the owner/editor (new pages/paid-gate, mirroring the
fan-gate); the owner previews the full post. The passkey unlock arrives
in slices 3-4, so the gate says so for now.

Federation is leak-safe: buildNote federates only a PUBLIC teaser (the
excerpt, else the first paragraph, never later content) plus a
"read the full post (supporters)" link back, and no media attachments.
A short paid post can no longer spill its body: the teaser is the first
paragraph only, pinned by a test.

Changed files:
src/config/database.js

• additive columns posts.paid, posts.paid_min_cents

src/routes/posts.js

• create/update read paid + price (premium-gated), store them, pass to deliverCreate/Update; paidTeaser helper; the paid web gate

src/services/ActivityPubService.js

• buildNote: paid post -> public teaser + link, first paragraph only

src/views/pages/post-edit.ejs

• paid toggle + price field (in the premium block)

New file:
src/views/pages/paid-gate.ejs

• teaser + supporters notice

test/paid-federation.test.js

• teaser + link, no full content, excerpt-as-teaser, non-paid intact

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

File:

• src/services/ActivityPubService.js (modified) (1 diff)

src/services/ActivityPubService.js

@@ -278 +278 @@
   const escTitle = String(post.title || '').replace(/[<>&]/g, (c) => ({ '<': '&lt;', '>': '&gt;', '&': '&amp;' }[c]));
   const titleHtml = post.title ? `<p><strong>${escTitle}</strong></p>` : '';
+
+  // Paid post (klonkt-demo-aki): federate a PUBLIC teaser + link, never the full
+  // content, so nothing leaks past the paywall. No media attachments either.
+  if (post.paid) {
+    const esc = (x) => String(x || '').replace(/[<>&]/g, (c) => ({ '<': '&lt;', '>': '&gt;', '&': '&amp;' }[c]));
+    const _firstP = (String(post.content || '').match(/<p[^>]*>([\s\S]*?)<\/p>/i) || [null, ''])[1] || '';
+    const rawTeaser = String(post.excerpt || '').trim()
+      || _firstP.replace(/<[^>]+>/g, ' ').replace(/&[a-z#0-9]+;/gi, ' ').replace(/\s+/g, ' ').trim().slice(0, 280);
+    return {
+      '@context': AP_CONTEXT,
+      id,
+      type: 'Note',
+      attributedTo: aId,
+      content: `${titleHtml}<p>${esc(rawTeaser)}${rawTeaser ? '…' : ''}</p><p><a href="${human}">Lees de volledige post (supporters)</a></p>`,
+      url: human,
+      published: toISO(post.published_at || post.created_at || Date.now()),
+      to: [PUBLIC],
+      cc: [`${aId}/followers`],
+      tag: [...hashtagTags(base, post.content)],
+      replies: `${id}/replies`,
+    };
+  }
 
   // Images travel as AP `attachment` (Mastodon strips <img> from content). Collect