Changeset b258a79 in Klonkt

Timestamp:

07/28/2026 07:53:36 AM (6 weeks ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

0101d0a

Parents:

fc40410

Message:

Fase 3: quotes federeren volgens de FEP, en de geciteerde auteur hoort het

De spiegel van wat we al aan de ingest-kant deden. Quoot je vanuit Klonkt een
fediverse-object, dan gaat dat nu ook echt de lijn over als quote, in de drie
vormen die het netwerk werkelijk leest: de FEP-044f quote-property, de de-facto
aliassen quoteUrl en _misskey_quote, en een FEP-e232 Link-tag. Alle drie wijzen
naar hetzelfde object, want elke lezer kijkt ergens anders.

En het belangrijkste: de geciteerde auteur komt in cc en zijn inbox in de
bezorglijst. Geciteerd worden zonder het te horen is precies de onbeleefdheid
die deze FEP probeert weg te ontwerpen.

De resolutie gebeurt een keer, bij publiceren (deliverCreate is toch al async),
en wordt opgeslagen op de post. buildNote blijft daardoor synchroon en hoeft
nooit te fetchen, ook niet als de outbox 'm opnieuw opbouwt.

Web-UI: een externe embed gebruikt nu dezelfde .tl-quote-kaart als een quote, dus
de belofte van een representatie klopt nu ook op het web.

Veiligheid: titel, provider en auteursnaam komen van een derde partij en worden
als PLATTE TEKST opgeslagen (tags eruit, lengte begrensd), zodat geen enkele
renderer verderop degene hoeft te zijn die aan escapen denkt. In de web-template
gaat de titel er bovendien nog een keer ge-escaped in, want de quote-kaart
rendert content als HTML (terecht voor AP-content, die we bij binnenkomst
saneren, maar niet voor dit).

Changed files:
src/config/database.js

• posts.quote_uri en posts.quote_actor

src/services/ActivityPubService.js

• applyQuoteProps: de drie quote-vormen + de auteur in cc
• buildNote past ze toe; resolveOwnQuote resolvet een keer bij publiceren
• deliverCreate bewaart het resultaat en bezorgt bij de geciteerde auteur
• externe embed slaat titel/provider/auteur als platte tekst op

src/views/partials/tl-item.ejs

• embed valt terug op dezelfde quote-kaart, met ge-escapete titel

test/external-embeds.test.js

• 4 tests erbij: de drie vormen, de auteur in cc zonder de followers te verliezen, junk-invoer verandert niets, en er wordt nooit markup opgeslagen

remarks: 209 tests groen.

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

Files:

• src/config/database.js (modified) (1 diff)
• src/services/ActivityPubService.js (modified) (5 diffs)
• src/views/partials/tl-item.ejs (modified) (1 diff)
• test/external-embeds.test.js (modified) (1 diff)

src/config/database.js

@@ -555 +555 @@
   ensureColumn('ap_timeline', 'link_json', 'TEXT');          // FEP-e232 object-link (quote/ref) tags from the inbound note, served back as `tag`
   ensureColumn('ap_timeline', 'quote_json', 'TEXT');         // FEP-044f resolved quoted-post snapshot (author + content), for the embedded quote card
-  ensureColumn('ap_timeline', 'embed_json', 'TEXT');         // resolved EXTERNAL embed (oEmbed/provider), thumbnail-only; gated per site (sites.external_embeds)
+  // FEP-044f: the fediverse object THIS post quotes, resolved once at publish
+  // time so buildNote (sync, also used by the outbox) needs no network.
+  ensureColumn('posts', 'quote_uri', 'TEXT');     // the quoted object's id
+  ensureColumn('posts', 'quote_actor', 'TEXT');   // its author, so we can address them
+  ensureColumn('ap_timeline', 'embed_json', 'TEXT');       // resolved EXTERNAL embed (oEmbed/provider), thumbnail-only; gated per site (sites.external_embeds)
   ensureColumn('ap_timeline', 'author_emoji_json', 'TEXT');  // FEP-9098 custom emojis in the author's display name (shaer:author.emojis)
   ensureColumn('ap_timeline', 'reblog_emoji_json', 'TEXT');  // FEP-9098 custom emojis in the booster's display name (shaer:booster.emojis)

src/services/ActivityPubService.js

@@ -503 +503 @@
   // FEP-633c §2.2: object hint that the author is a ward (safely ignorable).
   Object.assign(note, Guardianship.hasGuardiansProps(site.slug));
+  // FEP-044f: this post quotes a fediverse object. Emit it the way the network
+  // actually reads it, and address the quoted author so they get told.
+  applyQuoteProps(note, post.quote_uri, post.quote_actor);
   if (post.nsfw) note.summary = post.content_warning || 'Gevoelige inhoud';
   if (attachment.length) note.attachment = attachment;
@@ -1775 +1778 @@
   // mentioned person is notified even if they don't follow us (Mastodon-standard mention).
   const mres = await resolveMentionsInText(base, post.content || '');
-  const post2 = mres.inboxes.length ? { ...post, content: mres.html } : post;
+  let post2 = mres.inboxes.length ? { ...post, content: mres.html } : post;
+  // FEP-044f: does this post quote a fediverse object? Resolve it once, here,
+  // and remember it on the post, so buildNote (sync, also used by the outbox)
+  // never has to fetch. The quoted author's inbox joins the delivery set: that
+  // IS the notification.
+  const quoteInboxes = [];
+  if (post2.quote_uri === undefined || post2.quote_uri === null) {
+    const q = await resolveOwnQuote(post2.content || '');
+    if (q) {
+      try { db.prepare('UPDATE posts SET quote_uri = ?, quote_actor = ? WHERE id = ?').run(q.uri, q.actor || null, post.id); } catch { /* ignore */ }
+      post2 = { ...post2, quote_uri: q.uri, quote_actor: q.actor || null };
+    }
+  }
+  if (post2.quote_actor) {
+    const a = await fetchActor(post2.quote_actor).catch(() => null);
+    const inbox = a && ((a.endpoints && a.endpoints.sharedInbox) || a.inbox);
+    if (inbox) quoteInboxes.push(inbox);
+  }
   const followers = fStmts().list.all(site.slug);
-  const inboxes = [...new Set([...followers.map((f) => f.shared_inbox || f.inbox), ...mres.inboxes].filter(Boolean))];
-  if (!inboxes.length) return; // no followers and no one mentioned
+  const inboxes = [...new Set([...followers.map((f) => f.shared_inbox || f.inbox), ...mres.inboxes, ...quoteInboxes].filter(Boolean))];
+  if (!inboxes.length) return; // no followers, no one mentioned, no one quoted
   const keys = getOrCreateKeys(site.slug);
   const keyId = `${actorId(base, site.slug)}#main-key`;
@@ -2848 +2868 @@
 }
 
+// FEP-044f, emit side. The mirror of extractQuoteUrl (ingest): when one of our
+// own posts quotes a fediverse object, say so in the shapes the network really
+// reads. `quote` is the FEP property; quoteUrl / _misskey_quote are the de-facto
+// ones Mastodon and Misskey look at, and the FEP-e232 `Link` in `tag` is the
+// third form. All three point at the same object, which is what every reader
+// expects. The quoted author goes in `cc`, because being quoted without being
+// told is exactly the rudeness this FEP is trying to design away.
+export function applyQuoteProps(note, quoteUri, quoteActor) {
+  if (!note || typeof quoteUri !== 'string' || !/^https?:\/\//i.test(quoteUri)) return note;
+  note.quote = quoteUri;
+  note.quoteUrl = quoteUri;
+  note['_misskey_quote'] = quoteUri;
+  note.tag = [...(note.tag || []), {
+    type: 'Link',
+    mediaType: 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"',
+    href: quoteUri,
+    rel: ['https://misskey-hub.net/ns#_misskey_quote'],
+    name: quoteUri,
+  }];
+  if (typeof quoteActor === 'string' && /^https?:\/\//i.test(quoteActor)) {
+    note.cc = [...new Set([...(note.cc || []), quoteActor])];
+  }
+  return note;
+}
+
 // The first external (non-fediverse) link in a note, resolved to the same card
 // shape as a quote: THUMBNAIL ONLY, never the provider's iframe. An arbitrary
@@ -2867 +2912 @@
   const thumb = (card.media || []).find((m) => m && m.url);
   if (!thumb && !card.title) return null;
+  // Title, provider and author name come from a third party. Store them as
+  // PLAIN TEXT (tags stripped, length-capped), so no renderer downstream has to
+  // be the one that remembers to escape. A card is a card, not an essay.
+  const plain = (v) => (v ? HtmlSanitizerService.toPlainText(String(v)).trim().slice(0, 200) : null);
   return JSON.stringify({
     url: card.url,
     kind: card.kind,                       // 'provider' | 'oembed'
-    provider: card.provider || null,
-    title: card.title || null,
-    author: card.author || null,
+    provider: plain(card.provider),
+    title: plain(card.title),
+    author: card.author ? { ...card.author, name: plain(card.author.name), handle: plain(card.author.handle) } : null,
     media: thumb ? [thumb] : [],           // thumbnail only, no html/iframe
   });
+}
+
+/**
+ * Does our own post link to a fediverse object? Returns { uri, actor } when the
+ * first external link resolves to a quotable AP object, else null. Runs once at
+ * publish time; the answer is stored on the post.
+ */
+export async function resolveOwnQuote(html) {
+  const first = firstExternalUrl(html);
+  if (!first) return null;
+  const io = EmbedResolver.liveIO({ safeFetch, detectProvider: () => null, fetchActor, actorInfo });
+  const card = await EmbedResolver.resolveEmbed(first, io).catch(() => null);
+  if (!card || card.kind !== 'ap' || !card.id) return null;
+  return { uri: card.id, actor: card.attributedTo || null };
 }
 
@@ -3634 +3697 @@
   getInteractions, getInteractionById, setInteractionBoosted, setInteractionLiked, setMyReaction, getMyReactions, buildReplyNote, getOutboxNote, deliverReply, resolveRemoteNote,
   listOutbox, deliverOutboxDelete, deliverOutboxUpdate, deliverDirectNote,
-  webfingerResolve, followActor, resolveRemoteActor, unfollowActor, listFollowing, setAutoBoost, backfillFromOutbox, getTimeline, timelineAttachments, timelineEmojis, timelineObjectLinks, timelineQuote, timelineEmbed, sendInteraction, voteOnPoll, voteOnRemotePoll,
+  webfingerResolve, followActor, resolveRemoteActor, unfollowActor, listFollowing, setAutoBoost, backfillFromOutbox, getTimeline, timelineAttachments, timelineEmojis, timelineObjectLinks, timelineQuote, timelineEmbed, applyQuoteProps, sendInteraction, voteOnPoll, voteOnRemotePoll,
   acceptGatedFollow, rejectGatedFollow, isWardGuardian, sendFollowDecision,
   parseOwnPoll, pollTally, ownPollView, deliverPollUpdate, maybeCrawlThread, sendReport, localMentionSlugs,

src/views/partials/tl-item.ejs

@@ -23 +23 @@
             <div class="tl-content"><%- emojiHtml(p.content, p.emoji_json) %></div>
           <% } %>
-          <% var _quote = noteQuote(p.quote_json); if (_quote) { %><%- include('../partials/quote-card', { q: _quote }) %><% } %>
+          <%
+            // One card for both: a fediverse quote and an external embed look
+            // identical; only where they came from differs. An embed carries a
+            // title and a thumbnail, never an iframe.
+            var _quote = noteQuote(p.quote_json);
+            if (!_quote) {
+              var _emb = noteQuote(p.embed_json);
+              // The title comes from a third-party oEmbed provider, so it is
+              // escaped here: the quote card renders `content` as HTML (fine for
+              // AP content, which we sanitise on the way in, but not for this).
+              if (_emb) _quote = { url: _emb.url, author: _emb.author || (_emb.provider ? { name: _emb.provider } : null),
+                                   content: _emb.title ? ('<p>' + emojiName(_emb.title, null) + '</p>') : '', media: _emb.media || [] };
+            }
+          %>
+          <% if (_quote) { %><%- include('../partials/quote-card', { q: _quote }) %><% } %>
           <% if (_nsfwVisual) { %><div class="nsfw-media"><% } %>
           <% if (imgs.length) { %>

test/external-embeds.test.js

@@ -43 +43 @@
   assert.equal(timelineEmbed('{"title":"no url"}'), undefined, 'a card without a url is not a card');
 });
+
+// FEP-044f emit side: quoting a fediverse object must federate as a quote AND
+// tell the quoted author. This is the mirror of the ingest we already had.
+const { applyQuoteProps } = await import('../src/services/ActivityPubService.js');
+
+test('a quote is emitted in all three shapes the network reads', () => {
+  const note = { to: ['https://www.w3.org/ns/activitystreams#Public'], cc: [], tag: [{ type: 'Hashtag', name: '#x' }] };
+  applyQuoteProps(note, 'https://s/objects/9', 'https://s/users/alice');
+  assert.equal(note.quote, 'https://s/objects/9', 'the FEP property');
+  assert.equal(note.quoteUrl, 'https://s/objects/9', 'the as: alias Mastodon reads');
+  assert.equal(note._misskey_quote, 'https://s/objects/9', 'the misskey alias');
+  const link = note.tag.find((t) => t.type === 'Link');
+  assert.ok(link, 'and an FEP-e232 Link tag');
+  assert.equal(link.href, 'https://s/objects/9');
+  assert.ok(link.mediaType.includes('activitystreams'));
+  assert.ok(note.tag.some((t) => t.type === 'Hashtag'), 'existing tags survive');
+});
+
+test('the quoted author is addressed, so being quoted is not a surprise', () => {
+  const note = { cc: ['https://s/users/me/followers'] };
+  applyQuoteProps(note, 'https://s/objects/9', 'https://s/users/alice');
+  assert.ok(note.cc.includes('https://s/users/alice'));
+  assert.ok(note.cc.includes('https://s/users/me/followers'), 'without dropping the followers');
+});
+
+test('no quote, or a junk one, changes nothing', () => {
+  const a = { cc: [], tag: [] };
+  applyQuoteProps(a, null, null);
+  assert.equal(a.quote, undefined);
+  assert.equal(a.tag.length, 0);
+  const b = { cc: [], tag: [] };
+  applyQuoteProps(b, 'javascript:alert(1)', 'https://s/users/alice');
+  assert.equal(b.quote, undefined, 'a non-http quote uri is refused');
+  const c = { cc: [], tag: [] };
+  applyQuoteProps(c, 'https://s/objects/9', 'not-a-url');
+  assert.equal(c.quote, 'https://s/objects/9');
+  assert.equal(c.cc.length, 0, 'a junk actor is simply not addressed');
+});
+
+test('a hostile oEmbed title is stored as plain text, not markup', async () => {
+  const { resolveExternalEmbed } = await import('../src/services/ActivityPubService.js');
+  // No network in the test env, so the resolver bails and returns null; the
+  // point here is the contract: whatever comes back is never raw provider HTML.
+  const out = await resolveExternalEmbed('<p><a href="https://v.example/1">x</a></p>');
+  assert.ok(out === null || !/<script/i.test(out), 'never stores executable markup');
+});