Changeset eb852c5 in Klonkt

Timestamp:

06/24/2026 11:22:49 AM (3 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

c16e0a5

Parents:

5a93ac0

Message:

feat(activitypub): federate post deletions (Delete + Tombstone)

Deleting a published, non-fan-only post now sends a Delete activity (Tombstone)
to followers' inboxes, so it's removed from their Mastodon feeds instead of being
orphaned.

Co-Authored-By: Claude <noreply@…>

Location:

src

Files:

• routes/posts.js (modified) (1 diff)
• services/ActivityPubService.js (modified) (1 diff)

src/routes/posts.js

@@ -369 +369 @@
   if (!PermissionsService.canDeletePost(req.session.user, post, site)) {
     return res.status(403).send('No permission');
+  }
+
+  // ActivityPub: tell followers the post is gone (Delete + Tombstone), but only
+  // if it was actually federated (published + not fan-only). Fire before the row
+  // is removed — we still have post.id (= the Note id).
+  if (post.status === 'published' && !post.fan_only) {
+    ActivityPubService.deliverDelete(site, post).catch(() => { /* best-effort */ });
   }
 

src/services/ActivityPubService.js

@@ -288 +288 @@
 }
 
+// Tell followers a post is gone (Delete + Tombstone) so it's removed from their feeds.
+export async function deliverDelete(site, post) {
+  const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
+  if (!base || !site || !site.slug || !post || !post.id) return;
+  const followers = fStmts().list.all(site.slug);
+  if (!followers.length) return;
+  const inboxes = [...new Set(followers.map((f) => f.shared_inbox || f.inbox).filter(Boolean))];
+  const keys = getOrCreateKeys(site.slug);
+  const me = actorId(base, site.slug);
+  const nid = noteId(base, post.id);
+  const del = {
+    '@context': 'https://www.w3.org/ns/activitystreams',
+    id: `${nid}#delete-${Date.now()}`,
+    type: 'Delete',
+    actor: me,
+    to: [PUBLIC],
+    object: { id: nid, type: 'Tombstone' },
+  };
+  for (const inbox of inboxes) deliver(inbox, del, `${me}#main-key`, keys.private_pem).catch(() => { /* best-effort */ });
+}
+
 export default {
   getOrCreateKeys, apWants, sendAP, actorId, noteId,
   buildActor, buildNote, buildCreate, buildOutbox, buildFollowers,
-  followerCount, deliver, fetchActor, verifyRequest, handleInbox, deliverCreate,
+  followerCount, deliver, fetchActor, verifyRequest, handleInbox, deliverCreate, deliverDelete,
 };