mirror of
https://github.com/svemagie/indiekit-endpoint-activitypub.git
synced 2026-04-02 15:44:58 +02:00
12454749ad
27 issues fixed from multi-dimensional code review (4 Critical, 6 High, 11 Medium, 6 Low): Security (Critical): - Escape HTML in OAuth authorization page to prevent XSS (C1) - Add CSRF protection to OAuth authorize flow (C2) - Replace bypassable regex sanitizer with sanitize-html library (C3) - Enforce OAuth scopes on all Mastodon API routes (C4) Security (Medium/Low): - Fix SSRF via DNS resolution before private IP check (M1) - Add rate limiting to API, auth, and app registration endpoints (M2) - Validate redirect_uri on POST /oauth/authorize (M4) - Fix custom emoji URL injection with scheme validation + escaping (M5) - Remove data: scheme from allowed image sources (L6) - Add access token expiry (1hr) and refresh token rotation (90d) (M3) - Hash client secrets before storage (L3) Architecture: - Extract batch-broadcast.js — shared delivery logic (H1a) - Extract init-indexes.js — MongoDB index creation (H1b) - Extract syndicator.js — syndication logic (H1c) - Create federation-actions.js facade for controllers (M6) - index.js reduced from 1810 to ~1169 lines (35%) Performance: - Cache moderation data with 30s TTL + write invalidation (H6) - Increase inbox queue throughput to 10 items/sec (H5) - Make account enrichment non-blocking with fire-and-forget (H4) - Remove ephemeral getReplies/getLikes/getShares from ingest (M11) - Fix LRU caches to use true LRU eviction (L1) - Fix N+1 backfill queries with batch $in lookup (L2) UI/UX: - Split 3441-line reader.css into 15 feature-scoped files (H2) - Extract inline Alpine.js interaction component (H3) - Reduce sidebar navigation from 7 to 3 items (M7) - Add ARIA live regions for dynamic content updates (M8) - Extract shared CW/non-CW content partial (M9) - Document form handling pattern convention (M10) - Add accessible labels to functional emoji icons (L4) - Convert profile editor to Alpine.js (L5) Audit: documentation-central/audits/2026-03-24-activitypub-code-review.md Plan: documentation-central/plans/2026-03-24-activitypub-audit-fixes.md
95 lines
3.0 KiB
CSS
95 lines
3.0 KiB
CSS
/* ==========================================================================
|
|
Dark Mode Overrides
|
|
Softens saturated colors that are uncomfortable on dark backgrounds.
|
|
Uses Indiekit's existing light-variant tokens (red80, green90, yellow90)
|
|
which are designed for dark surfaces.
|
|
========================================================================== */
|
|
|
|
@media (prefers-color-scheme: dark) {
|
|
|
|
/* --- Action button hover states: softer colors, more visible tinted backgrounds --- */
|
|
.ap-card__action--reply:hover {
|
|
background: color-mix(in srgb, var(--color-primary) 18%, transparent);
|
|
color: var(--color-primary-on-background);
|
|
}
|
|
|
|
.ap-card__action--boost:hover {
|
|
background: color-mix(in srgb, var(--color-green50) 18%, transparent);
|
|
color: var(--color-green90);
|
|
}
|
|
|
|
.ap-card__action--like:hover {
|
|
background: color-mix(in srgb, var(--color-red45) 18%, transparent);
|
|
color: var(--color-red80);
|
|
}
|
|
|
|
.ap-card__action--save:hover {
|
|
background: color-mix(in srgb, var(--color-primary) 18%, transparent);
|
|
color: var(--color-primary-on-background);
|
|
}
|
|
|
|
/* --- Active interaction states --- */
|
|
.ap-card__action--like.ap-card__action--active {
|
|
background: color-mix(in srgb, var(--color-red45) 18%, transparent);
|
|
color: var(--color-red80);
|
|
}
|
|
|
|
.ap-card__action--boost.ap-card__action--active {
|
|
background: color-mix(in srgb, var(--color-green50) 18%, transparent);
|
|
color: var(--color-green90);
|
|
}
|
|
|
|
.ap-card__action--save.ap-card__action--active {
|
|
background: color-mix(in srgb, var(--color-primary) 18%, transparent);
|
|
color: var(--color-primary-on-background);
|
|
}
|
|
|
|
/* --- Post-type left border accents: desaturated for dark surfaces --- */
|
|
.ap-card--note,
|
|
.ap-card--note:hover {
|
|
border-left-color: var(--color-purple90);
|
|
}
|
|
|
|
.ap-card--article,
|
|
.ap-card--article:hover {
|
|
border-left-color: var(--color-green90);
|
|
}
|
|
|
|
.ap-card--boost,
|
|
.ap-card--boost:hover {
|
|
border-left-color: var(--color-yellow90);
|
|
}
|
|
|
|
.ap-card--reply,
|
|
.ap-card--reply:hover {
|
|
border-left-color: var(--color-primary-on-background);
|
|
}
|
|
|
|
/* --- Notification unread glow: toned down --- */
|
|
.ap-notification--unread {
|
|
border-color: var(--color-yellow90);
|
|
box-shadow: 0 0 6px 0 color-mix(in srgb, var(--color-yellow50) 15%, transparent);
|
|
}
|
|
|
|
/* --- Post detail highlight ring: softened --- */
|
|
.ap-post-detail__main .ap-card {
|
|
border-color: color-mix(in srgb, var(--color-primary) 50%, transparent);
|
|
box-shadow: 0 0 0 1px color-mix(in srgb, var(--color-primary) 50%, transparent);
|
|
}
|
|
|
|
/* --- Card shadows: use light tint instead of black --- */
|
|
.ap-card {
|
|
box-shadow: 0 1px 2px hsl(var(--tint-neutral) 90% / 0.04);
|
|
}
|
|
|
|
.ap-card:hover {
|
|
box-shadow: 0 2px 8px hsl(var(--tint-neutral) 90% / 0.06);
|
|
}
|
|
|
|
/* --- Tab badge federated: soften purple --- */
|
|
.ap-tab__badge--federated {
|
|
color: var(--color-purple90);
|
|
background: color-mix(in srgb, var(--color-purple45) 18%, transparent);
|
|
}
|
|
}
|