Changeset dd1028a in Klonkt

Timestamp:

06/24/2026 10:48:18 AM (3 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

065452a

Parents:

5bf63b7

Message:

fix(activitypub): content-negotiation on canonical URLs

An AP request (Accept: application/activity+json) to a profile or post URL now
302-redirects to its /ap/* representation, so the same URL serves HTML to
browsers and AP-JSON to servers. Fixes Mastodon failing to resolve a pasted
profile/post URL (it received text/html). Gated on apWants() — no cost for
normal browser traffic.

Co-Authored-By: Claude <noreply@…>

File:

• src/server.js (modified) (2 diffs)

src/server.js

@@ -65 +65 @@
 import ogRoutes from './routes/og.js';
 import apRoutes from './routes/activitypub.js';
+import { apWants } from './services/ActivityPubService.js';
 
 // SESSION_SECRET: use the env var if set. Otherwise auto-generate a strong one
@@ -235 +236 @@
 app.use(loadTheme);
 
+// ActivityPub content negotiation on the human URLs: an AP request (Accept:
+// application/activity+json) to a profile/post URL is redirected to its /ap/*
+// representation — same URL serves HTML to browsers, AP-JSON to servers (this is
+// how Mastodon resolves a pasted profile/post URL). Gated on apWants() so normal
+// browser requests pay nothing.
+app.use((req, res, next) => {
+  if (req.method !== 'GET' || !apWants(req)) return next();
+  const site = res.locals.site;
+  if (!site || !site.slug) return next();
+  const seg = req.path.replace(/^\/+|\/+$/g, '');
+  if (seg === '') return res.redirect(302, `/ap/users/${encodeURIComponent(site.slug)}`);
+  if (!seg.includes('/')) {
+    try {
+      const post = db.prepare(
+        "SELECT id FROM posts WHERE site_id = ? AND slug = ? AND status = 'published' AND (fan_only IS NULL OR fan_only = 0)"
+      ).get(site.id, seg);
+      if (post) return res.redirect(302, `/ap/notes/${post.id}`);
+    } catch { /* fall through to normal HTML handling */ }
+  }
+  return next();
+});
+
 // Lightweight CSRF defense: reject cross-origin state-mutating requests.
 // Same-origin forms + HTMX send a matching Origin; missing Origin is allowed