Changeset bbce8da in Klonkt

Timestamp:

06/26/2026 12:50:25 PM (2 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

c7c7f02

Parents:

4c47eff

Message:

feat(ap): log source IP on dropped/rejected/ignored inbox hits

So an operator can see WHO is probing their fediverse inbox (e.g. unsigned/unknown
activities like Block/View). Uses req.ip (real client behind the proxy via trust
proxy). Added to the blocked, signature-rejected and ignored log lines:

[AP] inbox Block -> boiert from 1.2.3.4 (ignored)

No behavior change — visibility only.

Co-Authored-By: Claude <noreply@…>

File:

• src/services/ActivityPubService.js (modified) (3 diffs)

src/services/ActivityPubService.js

@@ -569 +569 @@
   const act = req.body || {};
   const type = act.type;
+  // Real client IP (behind the proxy via `trust proxy`) — logged on dropped/rejected/
+  // ignored inbox hits so an operator can see who is probing their fediverse inbox.
+  const ip = req.ip || (req.connection && req.connection.remoteAddress) || '?';
   const base = (process.env.PUBLIC_BASE_URL || `${req.protocol}://${req.get('host')}`).replace(/\/+$/, '');
   const verified = await verifyRequest(req).catch(() => null);
@@ -577 +580 @@
   const claimedActor = typeof act.actor === 'string' ? act.actor : (act.actor && act.actor.id);
   // Blocked actor/domain → silently drop (202, don't reveal the block).
-  if (claimedActor && isBlockedAny(claimedActor)) { console.log('[AP] inbox dropped (blocked)', claimedActor); return 202; }
+  if (claimedActor && isBlockedAny(claimedActor)) { console.log('[AP] inbox dropped (blocked)', claimedActor, 'from', ip); return 202; }
   const GATED = ['Create', 'Like', 'Announce', 'Follow', 'Delete', 'Undo', 'Accept', 'Reject', 'Add', 'Remove', 'Update'];
   if (GATED.includes(type)) {
     if (!verified || !claimedActor || verified.id !== claimedActor) {
-      console.warn('[AP] inbox REJECTED (signature)', type, claimedActor || '?', verified ? '(signer mismatch)' : '(unsigned/invalid)');
+      console.warn('[AP] inbox REJECTED (signature)', type, claimedActor || '?', 'from', ip, verified ? '(signer mismatch)' : '(unsigned/invalid)');
       return 401;
     }
@@ -708 +711 @@
   }
 
-  console.log('[AP] inbox', type || 'unknown', '→', slugParam || 'shared', '(ignored)');
+  console.log('[AP] inbox', type || 'unknown', '→', slugParam || 'shared', 'from', ip, '(ignored)');
   return 202;
 }