Changeset dd568e7 in Klonkt

Timestamp:

07/19/2026 03:15:18 AM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

bf72108

Parents:

d49b60b

git-author:

Robin <roboburr@…> (07/19/2026 03:14:01 AM)

git-committer:

Robin <roboburr@…> (07/19/2026 03:15:18 AM)

Message:

Feature: OAuth C2S outbox POST — apps can drive the account (phase 1 done)

Second half of AP Client-to-Server: a bearer-authenticated POST to
/ap/users/:slug/outbox accepts activities and translates them onto the existing
delivery machinery (deliverReply / sendInteraction / followActor /
deliverCreate) rather than reimplementing federation.

• ingestOutboxActivity(site, user, activity) dispatches Create(Note) (reply -> resolveRemoteNote + deliverReply; top-level -> a sanitized microblog post + deliverCreate), Like, Announce (+upsertBoostedNote), Follow, and Undo of Like/Announce/Follow. A bare Note is wrapped in a Create per AP section 6. Client "source" (plain) is preferred over "content" (HTML) for replies; top-level content is HtmlSanitizerService.sanitize()d. Unhandled verbs return a clear 400 rather than a silent no-op.
• Route: bearer via OAuthService.verifyBearer; the token is scoped to one site, so a slug mismatch is 403 and a readonly account is 403; no token is 401 with WWW-Authenticate. 201+Location for created objects, 202 for side-effect verbs. Declared after apJson (shared with the inbox handler) to avoid a TDZ on the const.

Verified live end to end against a running server with a real OAuth token:
top-level Note -> 201 + Location, stored published + sanitized (script stripped)
+ served as a valid Note at /ap/notes/<id>; Like/Follow -> 202; unresolvable
reply -> honest 502; no-token 401, wrong-site 403, unsupported type 400. 7 new
unit tests for the deterministic dispatch paths (80 green).

Ivory and other Mastodon-API clients are NOT supported by this: they speak
Mastodon's REST API (/api/v1/apps, /api/v1/instance, secret-based OAuth), not AP
C2S. That's a separate track (klonkt-demo-mastapi). Delete/Update of arbitrary
objects deferred (klonkt-demo-c2sdel). Beads: klonkt-demo-1w4.

Co-Authored-By: Claude Opus 4.8 <noreply@…>

Files:

• CHANGELOG.de.md (modified) (1 diff)
• CHANGELOG.md (modified) (1 diff)
• CHANGELOG.nl.md (modified) (1 diff)
• src/routes/activitypub.js (modified) (2 diffs)
• src/services/ActivityPubService.js (modified) (2 diffs)
• test/c2s-outbox.test.js (added)

CHANGELOG.de.md

@@ -16 +16 @@
   `/.well-known/oauth-authorization-server` (RFC 8414) liefert die Metadaten,
   sodass Clients alles entdecken statt Pfade festzuschreiben. Nur öffentliche
-  Clients + PKCE, keine Client-Secrets. Die Token-annehmende Outbox (POST) ist
-  die nächste Phase.
+  Clients + PKCE, keine Client-Secrets.
+- **Die Outbox nimmt Beiträge von Apps an (C2S, Phase 1 komplett).** Ein
+  `POST` mit Bearer-Token an `/ap/users/:slug/outbox` steuert jetzt dein Konto
+  aus einer App: einen Beitrag veröffentlichen, antworten, liken, teilen, folgen
+  und all das rückgängig machen. Aktivitäten laufen über dieselbe
+  Zustell-Maschinerie wie die Web-UI; eine nackte Note wird laut Spezifikation in
+  ein Create verpackt; Inhalt wird bereinigt; das Token ist an eine Seite
+  gebunden. Hinweis: Das ist ActivityPub C2S, das die Shaer-Apps sprechen.
+  Mastodon-Clients (Ivory usw.) nutzen Mastodons eigene API und werden hier nicht
+  unterstützt.
 
 ### Behoben

CHANGELOG.md

@@ -15 +15 @@
   `/.well-known/oauth-authorization-server` (RFC 8414) exposes the metadata, so
   clients discover everything instead of hardcoding paths. Public clients + PKCE
-  only, no client secrets. The token-accepting outbox (POST) is the next phase.
+  only, no client secrets.
+- **The outbox accepts posts from apps (C2S, phase 1 complete).** A
+  bearer-authenticated `POST` to `/ap/users/:slug/outbox` now drives your account
+  from a client: publish a note, reply, like, boost, follow, and undo any of
+  those. Activities are translated onto the same delivery machinery the web UI
+  uses; a bare Note is wrapped in a Create per the spec; content is sanitized;
+  the token is scoped to one site so it can't post as another. Note: this is
+  ActivityPub C2S, which the Shaer apps speak. Mastodon clients (Ivory etc.) use
+  Mastodon's own API and are not supported by this.
 
 ### Fixed

CHANGELOG.nl.md

@@ -15 +15 @@
   uploadMedia-endpoints en `/.well-known/oauth-authorization-server` (RFC 8414)
   geeft de metadata, dus apps ontdekken alles in plaats van paden vast te
-  spijkeren. Alleen publieke clients + PKCE, geen client-secrets. De outbox die
-  de tokens accepteert (POST) is de volgende fase.
+  spijkeren. Alleen publieke clients + PKCE, geen client-secrets.
+- **De outbox accepteert posts van apps (C2S, fase 1 compleet).** Een
+  `POST` met bearer-token naar `/ap/users/:slug/outbox` bestuurt nu je account
+  vanuit een app: een bericht plaatsen, reageren, liken, boosten, volgen en dat
+  allemaal ongedaan maken. Activities gaan via dezelfde bezorg-machinerie als de
+  web-UI; een kale Note wordt in een Create verpakt (spec); content wordt
+  gesanitized; het token is aan één site gebonden dus kan niet namens een andere
+  posten. Let op: dit is ActivityPub C2S, wat de Shaer-apps spreken.
+  Mastodon-clients (Ivory e.d.) gebruiken Mastodons eigen API en worden hier niet
+  ondersteund.
 
 ### Opgelost

src/routes/activitypub.js

@@ -18 +18 @@
 import { apReadLimiter, apInboxLimiter } from '../middleware/rate-limit.js';
 import { apEnabled } from '../services/SettingsService.js';
+import OAuth from '../services/OAuthService.js';
 
 const router = express.Router();
@@ -193 +194 @@
 });
 
+// ── Outbox POST: ActivityPub Client-to-Server ─────────────────────
+// A bearer-authenticated client (Shaer) POSTs an activity; we translate it onto
+// the normal delivery machinery. The token is scoped to one user+site (OAuth
+// consent), so it must match the slug in the URL. (Declared after apJson, which
+// this shares with the inbox handler.)
+router.post('/ap/users/:slug/outbox', apInboxLimiter, apJson, async (req, res) => {
+  const auth = OAuth.verifyBearer(req.headers.authorization);
+  if (!auth) { res.set('WWW-Authenticate', 'Bearer'); return res.status(401).json({ error: 'invalid_token' }); }
+  if (auth.site.slug !== req.params.slug) return res.status(403).json({ error: 'wrong_site', detail: 'token is scoped to a different site' });
+  if (auth.user.readonly) return res.status(403).json({ error: 'read_only_account' });
+
+  const out = await AP.ingestOutboxActivity(auth.site, auth.user, req.body);
+  if (out.error) return res.status(out.status || 400).json({ error: out.error, detail: out.detail });
+  // 201 Created → Location header (AP spec); 202 Accepted for side-effect verbs.
+  if (out.status === 201 && out.url) res.set('Location', out.url);
+  return res.status(out.status || 202).json({ ok: true, id: out.id, url: out.url });
+});
+
 export default router;

src/services/ActivityPubService.js

@@ -1750 +1750 @@
 }
 
+// ── ActivityPub Client-to-Server: ingest an activity POSTed to the outbox ──
+// The C2S counterpart of handleInbox: a native/web client (Shaer) posts an
+// activity here and we translate it onto the SAME delivery machinery the web UI
+// uses (deliverReply / sendInteraction / followActor / deliverCreate). Returns
+// { status, id?, url?, error? }. Auth + site-ownership are checked by the route.
+const c2sIdOf = (x) => (typeof x === 'string' ? x : (x && (x.id || x.href))) || null;
+
+export async function ingestOutboxActivity(site, user, activity) {
+  const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
+  if (!base || !site || !activity || typeof activity !== 'object') return { status: 400, error: 'invalid_activity' };
+
+  // AP §6: a client MAY POST a bare object; the server wraps it in a Create.
+  let type = activity.type;
+  let object = activity.object;
+  if (type === 'Note' || type === 'Article') { object = activity; type = 'Create'; }
+  if (Array.isArray(type)) type = type.find((t) => typeof t === 'string');
+
+  try {
+    switch (type) {
+      case 'Create': {
+        if (!object || typeof object !== 'object') return { status: 400, error: 'missing_object' };
+        // Client sends `source` (plain/markdown) + `content` (HTML). deliverReply
+        // re-escapes, so it needs plain text; a top-level post keeps sanitized HTML.
+        const plain = (object.source && object.source.content) || HtmlSanitizerService.toPlainText(object.content || '');
+        if (!plain.trim() && !object.content) return { status: 400, error: 'empty_note' };
+        if (object.inReplyTo) {
+          const parent = await resolveRemoteNote(c2sIdOf(object.inReplyTo)).catch(() => null);
+          if (!parent) return { status: 502, error: 'cannot_resolve_inReplyTo' };
+          const r = await deliverReply(site, { postId: parent.localPostId || '', postSlug: null, parent, text: plain });
+          if (!r || !r.id) return { status: 502, error: 'reply_failed' };
+          return { status: 201, id: r.id, url: `${base}/ap/notes/${r.id}` };
+        }
+        return await c2sCreatePost(base, site, user, object);
+      }
+      case 'Like':
+      case 'Announce': {
+        const targetUri = c2sIdOf(object);
+        if (!targetUri) return { status: 400, error: 'missing_object' };
+        const note = await resolveRemoteNote(targetUri).catch(() => null);
+        const objUri = (note && note.object_uri) || targetUri;
+        const authorUri = note && note.actor_uri;
+        const kind = type === 'Announce' ? 'boost' : 'like';
+        await sendInteraction(site, kind, objUri, authorUri);
+        setMyReaction(site.slug, targetUri, kind, true);
+        if (type === 'Announce' && note) { try { upsertBoostedNote(site.slug, note); } catch { /* non-fatal */ } }
+        return { status: 202, url: objUri };
+      }
+      case 'Follow': {
+        const actorUri = c2sIdOf(object);
+        if (!actorUri) return { status: 400, error: 'missing_object' };
+        await followActor(site, actorUri);
+        return { status: 202, url: actorUri };
+      }
+      case 'Undo': {
+        const inner = object && typeof object === 'object' ? object : null;
+        let innerType = inner && inner.type;
+        if (Array.isArray(innerType)) innerType = innerType.find((t) => typeof t === 'string');
+        const innerTarget = c2sIdOf(inner && inner.object);
+        if (innerType === 'Follow') { await unfollowActor(site, innerTarget); return { status: 202, url: innerTarget }; }
+        if (innerType === 'Like' || innerType === 'Announce') {
+          const kind = innerType === 'Announce' ? 'unboost' : 'unlike';
+          const note = await resolveRemoteNote(innerTarget).catch(() => null);
+          const objUri = (note && note.object_uri) || innerTarget;
+          await sendInteraction(site, kind, objUri, note && note.actor_uri);
+          setMyReaction(site.slug, innerTarget, innerType === 'Announce' ? 'boost' : 'like', false);
+          if (innerType === 'Announce') { try { unmarkBoosted(site.slug, objUri); } catch { /* non-fatal */ } }
+          return { status: 202, url: objUri };
+        }
+        return { status: 400, error: 'unsupported_undo' };
+      }
+      // Delete/Update of arbitrary objects need the post-edit pipeline; tracked
+      // separately (klonkt-demo-c2s-del). Reject clearly rather than half-doing it.
+      default:
+        return { status: 400, error: 'unsupported_type', detail: String(type || 'none') };
+    }
+  } catch (e) {
+    console.warn('[AP] C2S ingest failed:', e && e.message);
+    return { status: 500, error: 'ingest_error' };
+  }
+}
+
+// Create a top-level microblog post from a C2S Note and federate it. Minimal
+// sibling of the /posts/create route: sanitized HTML content, no title/cover.
+async function c2sCreatePost(base, site, user, object) {
+  const html = HtmlSanitizerService.sanitize(object.content || (object.source && object.source.content) || '');
+  if (!html.trim()) return { status: 400, error: 'empty_note' };
+  const postId = crypto.randomUUID();
+  const slug = 'n-' + postId.slice(0, 8);
+  const now = new Date().toISOString();
+  db.prepare(`INSERT INTO posts (id, site_id, slug, author_id, title, content, excerpt, status, type, language, created_at, updated_at, published_at)
+              VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)`)
+    .run(postId, site.id, slug, user.id, '', html, '', 'published', 'post', object.language || 'nl', now, now, now);
+  try { db.prepare('UPDATE posts SET content_rendered = ? WHERE id = ?').run(bakePostContent(html), postId); } catch { /* render fallback covers it */ }
+  bakePostContentWithMentions(html).then((h) => { try { db.prepare('UPDATE posts SET content_rendered = ? WHERE id = ?').run(h, postId); } catch { /* keep sync bake */ } }).catch(() => {});
+  try { db.prepare('INSERT INTO posts_fts(content, title, author, post_id) VALUES (?,?,?,?)').run(HtmlSanitizerService.toPlainText(html), '', user.username || '', postId); } catch { /* FTS non-fatal */ }
+  deliverCreate(site, { id: postId, slug, title: '', content: html, published_at: now, created_at: now }).catch(() => { /* best-effort */ });
+  return { status: 201, id: postId, url: `${base}/ap/notes/${postId}` };
+}
+
 // Send a reply FROM this site to a remote actor (in reply to their inbound reply).
 // `parent` = an ap_interactions row (actor_uri, actor_url, actor_handle, object_uri).
@@ -2659 +2758 @@
   linkifyBody, bakePostContent, bakePostContentWithMentions, listFollowers, removeFollower, listConnections,
   noteVisibility, isRejectedObject, rejectInteraction, interactionReportTarget,
-  getMessages, notificationsSeenAt,
+  getMessages, notificationsSeenAt, ingestOutboxActivity,
 };