mirror of
https://github.com/svemagie/indiekit-endpoint-activitypub.git
synced 2026-04-02 15:44:58 +02:00
12454749ad
27 issues fixed from multi-dimensional code review (4 Critical, 6 High, 11 Medium, 6 Low): Security (Critical): - Escape HTML in OAuth authorization page to prevent XSS (C1) - Add CSRF protection to OAuth authorize flow (C2) - Replace bypassable regex sanitizer with sanitize-html library (C3) - Enforce OAuth scopes on all Mastodon API routes (C4) Security (Medium/Low): - Fix SSRF via DNS resolution before private IP check (M1) - Add rate limiting to API, auth, and app registration endpoints (M2) - Validate redirect_uri on POST /oauth/authorize (M4) - Fix custom emoji URL injection with scheme validation + escaping (M5) - Remove data: scheme from allowed image sources (L6) - Add access token expiry (1hr) and refresh token rotation (90d) (M3) - Hash client secrets before storage (L3) Architecture: - Extract batch-broadcast.js — shared delivery logic (H1a) - Extract init-indexes.js — MongoDB index creation (H1b) - Extract syndicator.js — syndication logic (H1c) - Create federation-actions.js facade for controllers (M6) - index.js reduced from 1810 to ~1169 lines (35%) Performance: - Cache moderation data with 30s TTL + write invalidation (H6) - Increase inbox queue throughput to 10 items/sec (H5) - Make account enrichment non-blocking with fire-and-forget (H4) - Remove ephemeral getReplies/getLikes/getShares from ingest (M11) - Fix LRU caches to use true LRU eviction (L1) - Fix N+1 backfill queries with batch $in lookup (L2) UI/UX: - Split 3441-line reader.css into 15 feature-scoped files (H2) - Extract inline Alpine.js interaction component (H3) - Reduce sidebar navigation from 7 to 3 items (M7) - Add ARIA live regions for dynamic content updates (M8) - Extract shared CW/non-CW content partial (M9) - Document form handling pattern convention (M10) - Add accessible labels to functional emoji icons (L4) - Convert profile editor to Alpine.js (L5) Audit: documentation-central/audits/2026-03-24-activitypub-code-review.md Plan: documentation-central/plans/2026-03-24-activitypub-audit-fixes.md
59 lines
1.4 KiB
JSON
59 lines
1.4 KiB
JSON
{
|
|
"name": "@rmdes/indiekit-endpoint-activitypub",
|
|
"version": "3.8.7",
|
|
"description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
|
|
"keywords": [
|
|
"indiekit",
|
|
"indiekit-plugin",
|
|
"indieweb",
|
|
"activitypub",
|
|
"fediverse",
|
|
"federation",
|
|
"fedify"
|
|
],
|
|
"author": {
|
|
"name": "Ricardo Mendes",
|
|
"url": "https://rmendes.net"
|
|
},
|
|
"license": "MIT",
|
|
"engines": {
|
|
"node": ">=22"
|
|
},
|
|
"type": "module",
|
|
"main": "index.js",
|
|
"exports": "./index.js",
|
|
"files": [
|
|
"assets",
|
|
"lib",
|
|
"locales",
|
|
"views",
|
|
"index.js"
|
|
],
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/rmdes/indiekit-endpoint-activitypub"
|
|
},
|
|
"bugs": {
|
|
"url": "https://github.com/rmdes/indiekit-endpoint-activitypub/issues"
|
|
},
|
|
"dependencies": {
|
|
"@fedify/debugger": "^2.0.0",
|
|
"@fedify/fedify": "^2.0.0",
|
|
"@fedify/redis": "^2.0.0",
|
|
"@js-temporal/polyfill": "^0.5.0",
|
|
"express": "^5.0.0",
|
|
"express-rate-limit": "^7.5.1",
|
|
"ioredis": "^5.9.3",
|
|
"sanitize-html": "^2.13.1",
|
|
"unfurl.js": "^6.4.0"
|
|
},
|
|
"peerDependencies": {
|
|
"@indiekit/endpoint-micropub": "^1.0.0-beta.25",
|
|
"@indiekit/error": "^1.0.0-beta.25",
|
|
"@indiekit/frontend": "^1.0.0-beta.25"
|
|
},
|
|
"publishConfig": {
|
|
"access": "public"
|
|
}
|
|
}
|