Changeset cae8ded in Klonkt

Timestamp:

07/31/2026 11:03:47 AM (6 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

0ca7e5d0

Parents:

0f48411

Message:

Een eerlijke User-Agent op al het uitgaande federatieverkeer

Robins vraag (31-7): welke UA gebruiken wij? Het federatieverkeer ging
met de kale Node-default de deur uit. safeFetch zet nu standaard
Klonkt/<versie> (+​https://klonkt.com) op elk uitgaand verzoek; een
caller die zelf een User-Agent meegeeft (de EmbedResolver) wint. En het
spiegelbeeld-lek dicht: klonkt staat nu ook in de eigen bot-regex,
zodat een Klonkt-preview-fetch op een andere Klonkt niet als bezoeker
telt.

Changed files:
src/services/ActivityPubService.js

• KLONKT_UA uit package.json-versie; safeFetch merge't hem als default in de headers

src/services/StatsService.js

• BOT_RE + klonkt

test/stats-bots.test.js

• de eigen embed-fetcher telt niet op een andere Klonkt

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

Files:

• src/services/ActivityPubService.js (modified) (2 diffs)
• src/services/StatsService.js (modified) (1 diff)
• test/stats-bots.test.js (modified) (1 diff)

src/services/ActivityPubService.js

@@ -96 +96 @@
   if (!addrs.length || addrs.some((a) => isBlockedIp(a.address))) throw new Error('ssrf-blocked-host');
 }
+// One honest name on ALL outbound federation traffic (Robins vraag, 31-7):
+// safeFetch went out with the bare Node default before, and polite fediverse
+// citizens say who they are (some instances even refuse anonymous UAs). A
+// caller-provided User-Agent (the EmbedResolver) still wins.
+let _uaVer = '1.0';
+try { _uaVer = JSON.parse(fs.readFileSync(new URL('../../package.json', import.meta.url))).version || _uaVer; } catch { /* keep default */ }
+const KLONKT_UA = `Klonkt/${_uaVer} (+https://klonkt.com)`;
+
 export async function safeFetch(url, opts = {}, maxRedirects = 3) {
   let target = url;
@@ -102 +110 @@
     if (u.protocol !== 'https:' && u.protocol !== 'http:') throw new Error('ssrf-bad-scheme');
     await assertPublicHost(u.hostname);
-    const r = await fetch(target, { ...opts, redirect: 'manual', signal: AbortSignal.timeout(8000) });
+    const r = await fetch(target, {
+      ...opts,
+      headers: { 'User-Agent': KLONKT_UA, ...(opts.headers || {}) },
+      redirect: 'manual',
+      signal: AbortSignal.timeout(8000),
+    });
     const loc = (r.status >= 300 && r.status < 400) ? r.headers.get('location') : null;
     if (loc && hop < maxRedirects) { target = new URL(loc, target).toString(); continue; }

src/services/StatsService.js

@@ -47 +47 @@
 // Skip known bots/crawlers + link-preview fetchers + scripts so they don't inflate
 // view/visitor-day counts. Empty UA = almost always automated.
-const BOT_RE = /bot|crawl|spider|slurp|mediapartners|bingpreview|facebookexternalhit|whatsapp|telegram|discord|twitter|linkedin|embedly|pinterest|redditbot|applebot|petalbot|yandex|baidu|duckduckbot|semrush|ahrefs|mj12|dotbot|uptimerobot|pingdom|statuscake|headless|lighthouse|gptbot|claude|ccbot|perplexity|bytespider|amazonbot|googleother|google-read-aloud|python-requests|scrapy|curl|wget|axios|node-fetch|go-http|java\/|okhttp|libwww|httpclient|mastodon|pleroma|akkoma|misskey|calckey|firefish|friendica|hubzilla|lemmy|pixelfed|peertube|gotosocial|honk|http\.rb|activitypub/i;
+const BOT_RE = /bot|crawl|spider|slurp|mediapartners|bingpreview|facebookexternalhit|whatsapp|telegram|discord|twitter|linkedin|embedly|pinterest|redditbot|applebot|petalbot|yandex|baidu|duckduckbot|semrush|ahrefs|mj12|dotbot|uptimerobot|pingdom|statuscake|headless|lighthouse|gptbot|claude|ccbot|perplexity|bytespider|amazonbot|googleother|google-read-aloud|python-requests|scrapy|curl|wget|axios|node-fetch|go-http|java\/|okhttp|libwww|httpclient|mastodon|pleroma|akkoma|misskey|calckey|firefish|friendica|hubzilla|lemmy|pixelfed|peertube|gotosocial|honk|http\.rb|activitypub|klonkt/i;
 function isBot(req) {
   const ua = (req && req.headers && req.headers['user-agent']) || '';

test/stats-bots.test.js

@@ -35 +35 @@
 });
 
+test("a Klonkt's own embed-fetcher does not count on another Klonkt", () => {
+  const before = pv();
+  Stats.recordPageview('s1', fakeReq({ 'user-agent': 'Mozilla/5.0 (compatible; Klonkt/1.0; +https://klonkt.com)' }));
+  assert.equal(pv(), before);
+});
+
 test('a SIGNED request never counts, whatever the UA claims', () => {
   const before = pv();