Changeset c66cbb4 in Klonkt

Timestamp:

07/25/2026 08:22:15 AM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

8f520e0

Parents:

ad6f62a

Message:

Authorized fetch: gecommitte guardian leest ward-outbox gesigneerd (FEP-633c §5.3 noot)

De optionele verfijning uit de spec: een guardian die de outbox van z'n ward met
een HTTP-signature opvraagt, krijgt ook de fan_only (prive) posts mee, zonder als
follower te verschijnen en inclusief historie van voor een eventuele follow.
Ongesigneerde of niet-guardian callers krijgen zoals altijd alleen de publieke
collectie. De verbrede view gaat met Cache-Control private,no-store zodat een
gedeelde cache 'm nooit aan het publiek serveert.

De publieke shaer:guardians-lijst maakt dit mogelijk: de ward-server herkent de
signer als huidige guardian (getRelation) zonder extra coordinatie.

Changed files:
src/routes/activitypub.js

• outbox GET: signed-fetch check; guardian ziet fan_only; no-store op de verbrede view

src/services/ActivityPubService.js

• isWardGuardian(wardSlug, actorUri); sendAP krijgt optionele cache-control

test/authorized-fetch.test.js

• guardian herkend, vreemde niet

remarks: npm test 168/168. verifyRequest deed GET al aan (request-target/host/date,
digest alleen bij body). v1 en niet-guardian-verkeer ongewijzigd.

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

Files:

• src/routes/activitypub.js (modified) (1 diff)
• src/services/ActivityPubService.js (modified) (3 diffs)
• test/authorized-fetch.test.js (added)

src/routes/activitypub.js

@@ -79 +79 @@
 
 // ── Outbox ────────────────────────────────────────────────────────
-router.get('/ap/users/:slug/outbox', (req, res) => {
+router.get('/ap/users/:slug/outbox', async (req, res) => {
   const site = publicSite(req.params.slug);
   if (!site) return res.status(404).end();
+  // Authorized fetch (FEP-633c §5.3 note): a committed guardian doing a SIGNED
+  // GET may read the ward's fan-only history too, without appearing as a
+  // follower. Unsigned / non-guardian callers get the public collection only.
+  let asGuardian = false;
+  if (req.headers['signature']) {
+    const verified = await AP.verifyRequest(req).catch(() => null);
+    asGuardian = !!(verified && AP.isWardGuardian(req.params.slug, verified.id));
+  }
+  const fanClause = asGuardian ? '' : "AND (fan_only IS NULL OR fan_only = 0)";
   const posts = db.prepare(
     `SELECT id, slug, title, content, cover_image_url, cover_video_url, nsfw, content_warning, published_at, created_at
-     FROM posts WHERE site_id = ? AND status = 'published' AND (fan_only IS NULL OR fan_only = 0)
+     FROM posts WHERE site_id = ? AND status = 'published' ${fanClause}
      ORDER BY COALESCE(published_at, created_at) DESC LIMIT 20`
   ).all(site.id);
-  AP.sendAP(res, AP.buildOutbox(baseUrl(req), site, posts));
+  AP.sendAP(res, AP.buildOutbox(baseUrl(req), site, posts), asGuardian ? 'private, no-store' : undefined);
 });
 

src/services/ActivityPubService.js

@@ -144 +144 @@
 
 const AP_CONTENT_TYPE = 'application/activity+json; charset=utf-8';
-export function sendAP(res, obj) {
+export function sendAP(res, obj, cacheControl) {
   res.type(AP_CONTENT_TYPE);
-  res.set('Cache-Control', 'public, max-age=120');
+  // A per-caller (e.g. guardian-widened) view must not be publicly cached.
+  res.set('Cache-Control', cacheControl || 'public, max-age=120');
   res.send(JSON.stringify(obj));
 }
@@ -2901 +2902 @@
 }
 
+// FEP-633c §5.3 note (authorized fetch): true when `actorUri` is a committed
+// guardian of the local ward `wardSlug` — so a signed GET from it may read the
+// ward's non-public history without the guardian appearing as a follower.
+export function isWardGuardian(wardSlug, actorUri) {
+  try { return !!Guardianship.getRelation(wardSlug, 'ward', actorUri); } catch { return false; }
+}
+
 // FEP-633c §5.3: the guardians approved a gated follow of their ward. Send the
 // Accept to the follower and record them, so delivery (incl. followers-only)
@@ -3248 +3256 @@
   listOutbox, deliverOutboxDelete, deliverOutboxUpdate, deliverDirectNote,
   webfingerResolve, followActor, resolveRemoteActor, unfollowActor, listFollowing, setAutoBoost, backfillFromOutbox, getTimeline, timelineAttachments, sendInteraction, voteOnPoll, voteOnRemotePoll,
-  acceptGatedFollow, rejectGatedFollow,
+  acceptGatedFollow, rejectGatedFollow, isWardGuardian,
   parseOwnPoll, pollTally, ownPollView, deliverPollUpdate, maybeCrawlThread, sendReport, localMentionSlugs,
   autoBoostCount, boostedCount, markBoosted, unmarkBoosted, markLiked, unmarkLiked, getTimelineReaction, upsertBoostedNote, getCirkelPosts, getCirkelMembers, selfHealTimeline,