fix(activitypub): serve AP-likes with canonical id and proper Like dispatcher

Replace the semantically incorrect fake-Note approach with strict AP protocol compliance:

- patch-ap-like-note-dispatcher: rewritten to revert the fake-Note block
- patch-ap-like-activity-id: adds canonical id URI to Like activities (AP §6.2.1)
- patch-ap-like-activity-dispatcher: registers setObjectDispatcher(Like, ...) so
  /activitypub/activities/like/{id} is dereferenceable (AP §3.1)
- patch-ap-url-lookup-api-like: /api/ap-url now returns the likeOf URL for AP-likes
  so the "Also on: Fediverse" widget's authorize_interaction flow opens the
  original Mastodon post on the remote instance

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/patch-ap-like-activity-dispatcher.mjs

@@ -0,0 +1,108 @@
+/**
+ * Patch: register a Fedify Like activity dispatcher in federation-setup.js.
+ *
+ * Per ActivityPub §3.1, objects with an `id` MUST be dereferenceable at that
+ * URI. The Like activities produced by jf2ToAS2Activity (after patch-ap-like-
+ * activity-id.mjs adds an id) need a corresponding Fedify object dispatcher so
+ * that fetching /activitypub/activities/like/{id} returns the Like activity.
+ *
+ * Fix:
+ *   Add federation.setObjectDispatcher(Like, ...) after the Article dispatcher
+ *   in setupObjectDispatchers(). The handler looks up the post, calls
+ *   jf2ToAS2Activity, and returns the Like if that's what was produced.
+ */
+
+import { access, readFile, writeFile } from "node:fs/promises";
+
+const candidates = [
+  "node_modules/@rmdes/indiekit-endpoint-activitypub/lib/federation-setup.js",
+  "node_modules/@indiekit/indiekit/node_modules/@rmdes/indiekit-endpoint-activitypub/lib/federation-setup.js",
+];
+
+const MARKER = "// ap-like-activity-dispatcher patch";
+
+const OLD_SNIPPET = `  // Article dispatcher
+  federation.setObjectDispatcher(
+    Article,
+    \`\${mountPath}/objects/article/{+id}\`,
+    async (ctx, { id }) => {
+      const obj = await resolvePost(ctx, id);
+      return obj instanceof Article ? obj : null;
+    },
+  );
+}`;
+
+const NEW_SNIPPET = `  // Article dispatcher
+  federation.setObjectDispatcher(
+    Article,
+    \`\${mountPath}/objects/article/{+id}\`,
+    async (ctx, { id }) => {
+      const obj = await resolvePost(ctx, id);
+      return obj instanceof Article ? obj : null;
+    },
+  );
+
+  // Like activity dispatcher — makes AP-like activities dereferenceable (AP §3.1)
+  // ap-like-activity-dispatcher patch
+  federation.setObjectDispatcher(
+    Like,
+    \`\${mountPath}/activities/like/{+id}\`,
+    async (ctx, { id }) => {
+      if (!collections.posts || !publicationUrl) return null;
+      const postUrl = \`\${publicationUrl.replace(/\\/$/, "")}/\${id}\`;
+      const post = await collections.posts.findOne({
+        "properties.url": { $in: [postUrl, postUrl + "/"] },
+      });
+      if (!post) return null;
+      if (post?.properties?.["post-status"] === "draft") return null;
+      if (post?.properties?.visibility === "unlisted") return null;
+      if (post.properties?.deleted) return null;
+      const actorUrl = ctx.getActorUri(handle).href;
+      const activity = await jf2ToAS2Activity(post.properties, actorUrl, publicationUrl);
+      return activity instanceof Like ? activity : null;
+    },
+  );
+}`;
+
+async function exists(filePath) {
+  try {
+    await access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+let checked = 0;
+let patched = 0;
+
+for (const filePath of candidates) {
+  if (!(await exists(filePath))) {
+    continue;
+  }
+
+  checked += 1;
+  let source = await readFile(filePath, "utf8");
+
+  if (source.includes(MARKER)) {
+    continue; // already patched
+  }
+
+  if (!source.includes(OLD_SNIPPET)) {
+    console.log(`[postinstall] patch-ap-like-activity-dispatcher: snippet not found in ${filePath}`);
+    continue;
+  }
+
+  source = source.replace(OLD_SNIPPET, NEW_SNIPPET);
+  await writeFile(filePath, source, "utf8");
+  patched += 1;
+  console.log(`[postinstall] Applied patch-ap-like-activity-dispatcher to ${filePath}`);
+}
+
+if (checked === 0) {
+  console.log("[postinstall] patch-ap-like-activity-dispatcher: no target files found");
+} else if (patched === 0) {
+  console.log("[postinstall] patch-ap-like-activity-dispatcher: already up to date");
+} else {
+  console.log(`[postinstall] patch-ap-like-activity-dispatcher: patched ${patched}/${checked} file(s)`);
+}

scripts/patch-ap-like-activity-id.mjs

@@ -0,0 +1,91 @@
+/**
+ * Patch: add a canonical `id` to the Like activity produced by jf2ToAS2Activity.
+ *
+ * Per ActivityPub §6.2.1, activities sent from a server SHOULD have an `id`
+ * URI so that remote servers can dereference them. The current Like activity
+ * has no `id`, which means it cannot be looked up by its URL.
+ *
+ * Fix:
+ *   In jf2-to-as2.js, derive the mount path from the actor URL and construct
+ *   a canonical id at /activitypub/activities/like/{post-path}.
+ *
+ * This enables:
+ *   - The Like activity dispatcher (patch-ap-like-activity-dispatcher.mjs) to
+ *     serve the Like at its canonical URL.
+ *   - Remote servers to dereference the Like activity by its id.
+ */
+
+import { access, readFile, writeFile } from "node:fs/promises";
+
+const candidates = [
+  "node_modules/@rmdes/indiekit-endpoint-activitypub/lib/jf2-to-as2.js",
+  "node_modules/@indiekit/indiekit/node_modules/@rmdes/indiekit-endpoint-activitypub/lib/jf2-to-as2.js",
+];
+
+const MARKER = "// ap-like-activity-id patch";
+
+const OLD_SNIPPET = `      return new Like({
+        actor: actorUri,
+        object: new URL(likeOfUrl),
+        to: new URL("https://www.w3.org/ns/activitystreams#Public"),
+      });`;
+
+const NEW_SNIPPET = `      // ap-like-activity-id patch
+      // Derive mount path from actor URL (e.g. "/activitypub") so we can
+      // construct the canonical id without needing mountPath in options.
+      const actorPath = new URL(actorUrl).pathname; // e.g. "/activitypub/users/sven"
+      const mp = actorPath.replace(/\\/users\\/[^/]+$/, ""); // → "/activitypub"
+      const postRelPath = (properties.url || "")
+        .replace(publicationUrl.replace(/\\/$/, ""), "")
+        .replace(/^\\//, "")
+        .replace(/\\/$/, ""); // e.g. "likes/9acc3"
+      const likeActivityId = \`\${publicationUrl.replace(/\\/$/, "")}\${mp}/activities/like/\${postRelPath}\`;
+      return new Like({
+        id: new URL(likeActivityId),
+        actor: actorUri,
+        object: new URL(likeOfUrl),
+        to: new URL("https://www.w3.org/ns/activitystreams#Public"),
+      });`;
+
+async function exists(filePath) {
+  try {
+    await access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+let checked = 0;
+let patched = 0;
+
+for (const filePath of candidates) {
+  if (!(await exists(filePath))) {
+    continue;
+  }
+
+  checked += 1;
+  let source = await readFile(filePath, "utf8");
+
+  if (source.includes(MARKER)) {
+    continue; // already patched
+  }
+
+  if (!source.includes(OLD_SNIPPET)) {
+    console.log(`[postinstall] patch-ap-like-activity-id: snippet not found in ${filePath}`);
+    continue;
+  }
+
+  source = source.replace(OLD_SNIPPET, NEW_SNIPPET);
+  await writeFile(filePath, source, "utf8");
+  patched += 1;
+  console.log(`[postinstall] Applied patch-ap-like-activity-id to ${filePath}`);
+}
+
+if (checked === 0) {
+  console.log("[postinstall] patch-ap-like-activity-id: no target files found");
+} else if (patched === 0) {
+  console.log("[postinstall] patch-ap-like-activity-id: already up to date");
+} else {
+  console.log(`[postinstall] patch-ap-like-activity-id: patched ${patched}/${checked} file(s)`);
+}

scripts/patch-ap-like-note-dispatcher.mjs

@@ -0,0 +1,87 @@
+/**
+ * Patch: REVERT the wrong ap-like-note-dispatcher change in federation-setup.js.
+ *
+ * The previous version of this script served AP-likes as fake Notes at the
+ * Note dispatcher URL, which violated ActivityPub semantics (Like activities
+ * should not be served as Notes).
+ *
+ * This rewritten version removes that fake-Note block and restores the original
+ * resolvePost() logic. The correct AP-compliant fixes are handled by:
+ *   - patch-ap-like-activity-id.mjs    (adds id to Like activity)
+ *   - patch-ap-like-activity-dispatcher.mjs  (registers Like object dispatcher)
+ *   - patch-ap-url-lookup-api-like.mjs  (returns likeOf URL for AP-likes in widget)
+ */
+
+import { access, readFile, writeFile } from "node:fs/promises";
+
+const candidates = [
+  "node_modules/@rmdes/indiekit-endpoint-activitypub/lib/federation-setup.js",
+  "node_modules/@indiekit/indiekit/node_modules/@rmdes/indiekit-endpoint-activitypub/lib/federation-setup.js",
+];
+
+// Marker from the old wrong patch — if this is present, we need to revert
+const WRONG_PATCH_MARKER = "// ap-like-note-dispatcher patch";
+
+// Clean up the Like import comment added by the old patch
+const OLD_IMPORT = `  Like, // Like import for ap-like-note-dispatcher patch`;
+const NEW_IMPORT = `  Like,`;
+
+async function exists(filePath) {
+  try {
+    await access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+let checked = 0;
+let patched = 0;
+
+for (const filePath of candidates) {
+  if (!(await exists(filePath))) {
+    continue;
+  }
+
+  checked += 1;
+  let source = await readFile(filePath, "utf8");
+
+  if (!source.includes(WRONG_PATCH_MARKER)) {
+    // Already reverted (or never applied)
+    continue;
+  }
+
+  let modified = false;
+
+  // 1. Clean up Like import comment
+  if (source.includes(OLD_IMPORT)) {
+    source = source.replace(OLD_IMPORT, NEW_IMPORT);
+    modified = true;
+  }
+
+  // 2. Remove fake Note block — use regex to avoid escaping issues with
+  //    unicode escapes and template literals inside the block.
+  //    Match from the opening comment through `return await activity.getObject();`
+  const fakeNoteBlock = /    \/\/ Only Create activities wrap Note\/Article objects\.\n[\s\S]*?    return await activity\.getObject\(\);/;
+  if (fakeNoteBlock.test(source)) {
+    source = source.replace(
+      fakeNoteBlock,
+      `    // Only Create activities wrap Note/Article objects\n    if (!(activity instanceof Create)) return null;\n    return await activity.getObject();`,
+    );
+    modified = true;
+  }
+
+  if (modified) {
+    await writeFile(filePath, source, "utf8");
+    patched += 1;
+    console.log(`[postinstall] Reverted ap-like-note-dispatcher patch in ${filePath}`);
+  }
+}
+
+if (checked === 0) {
+  console.log("[postinstall] patch-ap-like-note-dispatcher: no target files found");
+} else if (patched === 0) {
+  console.log("[postinstall] patch-ap-like-note-dispatcher: already up to date");
+} else {
+  console.log(`[postinstall] patch-ap-like-note-dispatcher: reverted ${patched}/${checked} file(s)`);
+}

scripts/patch-ap-url-lookup-api-like.mjs

@@ -0,0 +1,110 @@
+/**
+ * Patch: make the /api/ap-url endpoint return the liked post URL for AP-likes.
+ *
+ * Root cause:
+ *   For like posts where like-of is an ActivityPub URL (e.g. a Mastodon status),
+ *   the "Also on: Fediverse" widget's authorize_interaction flow needs to send
+ *   the user to the original AP object, not to a blog-side Note URL.
+ *
+ *   The current handler always returns a /activitypub/objects/note/{id} URL,
+ *   which 404s for AP-likes (because jf2ToAS2Activity returns a Like activity,
+ *   not a Create(Note), so the Note dispatcher returns null).
+ *
+ * Fix:
+ *   Before building the Note/Article URL, check whether the post is an AP-like
+ *   (like-of is a URL that responds with application/activity+json). If it is,
+ *   return { apUrl: likeOf } so that authorize_interaction opens the original
+ *   AP object on the remote instance, where the user can interact with it.
+ *
+ *   Non-AP likes (like-of is a plain web URL) fall through to the existing
+ *   Note URL logic unchanged.
+ */
+
+import { access, readFile, writeFile } from "node:fs/promises";
+
+const candidates = [
+  "node_modules/@rmdes/indiekit-endpoint-activitypub/index.js",
+  "node_modules/@indiekit/indiekit/node_modules/@rmdes/indiekit-endpoint-activitypub/index.js",
+];
+
+const MARKER = "// ap-url-lookup-api-like patch";
+
+const OLD_SNIPPET = `        // Determine the AP object type (mirrors jf2-to-as2.js logic)
+        const postType = post.properties?.["post-type"];
+        const isArticle = postType === "article" && !!post.properties?.name;
+        const objectType = isArticle ? "article" : "note";`;
+
+const NEW_SNIPPET = `        // Determine the AP object type (mirrors jf2-to-as2.js logic)
+        const postType = post.properties?.["post-type"];
+
+        // For AP-likes: the widget should open the liked post on the remote instance.
+        // We detect AP URLs the same way as jf2-to-as2.js: HEAD with activity+json Accept.
+        // ap-url-lookup-api-like patch
+        if (postType === "like") {
+          const likeOf = post.properties?.["like-of"] || "";
+          if (likeOf) {
+            let isAp = false;
+            try {
+              const ctrl = new AbortController();
+              const tid = setTimeout(() => ctrl.abort(), 3000);
+              const r = await fetch(likeOf, {
+                method: "HEAD",
+                headers: { Accept: "application/activity+json, application/ld+json" },
+                signal: ctrl.signal,
+              });
+              clearTimeout(tid);
+              const ct = r.headers.get("content-type") || "";
+              isAp = ct.includes("activity+json") || ct.includes("ld+json");
+            } catch { /* network error — treat as non-AP */ }
+            if (isAp) {
+              res.set("Cache-Control", "public, max-age=60");
+              return res.json({ apUrl: likeOf });
+            }
+          }
+        }
+
+        const isArticle = postType === "article" && !!post.properties?.name;
+        const objectType = isArticle ? "article" : "note";`;
+
+async function exists(filePath) {
+  try {
+    await access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+let checked = 0;
+let patched = 0;
+
+for (const filePath of candidates) {
+  if (!(await exists(filePath))) {
+    continue;
+  }
+
+  checked += 1;
+  let source = await readFile(filePath, "utf8");
+
+  if (source.includes(MARKER)) {
+    continue; // already patched
+  }
+
+  if (!source.includes(OLD_SNIPPET)) {
+    console.log(`[postinstall] patch-ap-url-lookup-api-like: snippet not found in ${filePath}`);
+    continue;
+  }
+
+  source = source.replace(OLD_SNIPPET, NEW_SNIPPET);
+  await writeFile(filePath, source, "utf8");
+  patched += 1;
+  console.log(`[postinstall] Applied patch-ap-url-lookup-api-like to ${filePath}`);
+}
+
+if (checked === 0) {
+  console.log("[postinstall] patch-ap-url-lookup-api-like: no target files found");
+} else if (patched === 0) {
+  console.log("[postinstall] patch-ap-url-lookup-api-like: already up to date");
+} else {
+  console.log(`[postinstall] patch-ap-url-lookup-api-like: patched ${patched}/${checked} file(s)`);
+}