Files
indiekit-endpoint-activitypub/views/activitypub-reader.njk
Ricardo 12454749ad fix: comprehensive security, performance, and architecture audit fixes
27 issues fixed from multi-dimensional code review (4 Critical, 6 High, 11 Medium, 6 Low):

Security (Critical):
- Escape HTML in OAuth authorization page to prevent XSS (C1)
- Add CSRF protection to OAuth authorize flow (C2)
- Replace bypassable regex sanitizer with sanitize-html library (C3)
- Enforce OAuth scopes on all Mastodon API routes (C4)

Security (Medium/Low):
- Fix SSRF via DNS resolution before private IP check (M1)
- Add rate limiting to API, auth, and app registration endpoints (M2)
- Validate redirect_uri on POST /oauth/authorize (M4)
- Fix custom emoji URL injection with scheme validation + escaping (M5)
- Remove data: scheme from allowed image sources (L6)
- Add access token expiry (1hr) and refresh token rotation (90d) (M3)
- Hash client secrets before storage (L3)

Architecture:
- Extract batch-broadcast.js — shared delivery logic (H1a)
- Extract init-indexes.js — MongoDB index creation (H1b)
- Extract syndicator.js — syndication logic (H1c)
- Create federation-actions.js facade for controllers (M6)
- index.js reduced from 1810 to ~1169 lines (35%)

Performance:
- Cache moderation data with 30s TTL + write invalidation (H6)
- Increase inbox queue throughput to 10 items/sec (H5)
- Make account enrichment non-blocking with fire-and-forget (H4)
- Remove ephemeral getReplies/getLikes/getShares from ingest (M11)
- Fix LRU caches to use true LRU eviction (L1)
- Fix N+1 backfill queries with batch $in lookup (L2)

UI/UX:
- Split 3441-line reader.css into 15 feature-scoped files (H2)
- Extract inline Alpine.js interaction component (H3)
- Reduce sidebar navigation from 7 to 3 items (M7)
- Add ARIA live regions for dynamic content updates (M8)
- Extract shared CW/non-CW content partial (M9)
- Document form handling pattern convention (M10)
- Add accessible labels to functional emoji icons (L4)
- Convert profile editor to Alpine.js (L5)

Audit: documentation-central/audits/2026-03-24-activitypub-code-review.md
Plan: documentation-central/plans/2026-03-24-activitypub-audit-fixes.md
2026-03-25 07:41:20 +01:00

168 lines
7.1 KiB
Plaintext

{% extends "layouts/ap-reader.njk" %}
{% from "heading/macro.njk" import heading with context %}
{% from "prose/macro.njk" import prose with context %}
{% block readercontent %}
{# Explore link #}
<div class="ap-reader-tools">
<a href="{{ mountPath }}/admin/reader/explore" class="ap-reader-tools__explore">
🔭 {{ __("activitypub.reader.explore.title") }}
</a>
</div>
{# Followed tags #}
{% if followedTags and followedTags.length > 0 %}
<div class="ap-followed-tags">
<span class="ap-followed-tags__label">{{ __("activitypub.reader.tagTimeline.following") }}:</span>
{% for tag in followedTags %}
<a href="{{ mountPath }}/admin/reader/tag?tag={{ tag | urlencode }}" class="ap-card__tag">#{{ tag }}</a>
{% endfor %}
</div>
{% endif %}
{# Fediverse lookup with popular accounts autocomplete #}
<form action="{{ mountPath }}/admin/reader/resolve" method="get" class="ap-lookup"
x-data="apPopularAccounts('{{ mountPath }}')"
@submit="onSubmit">
<div class="ap-lookup-autocomplete">
<input type="text" name="q" class="ap-lookup__input"
placeholder="{{ __('activitypub.reader.resolve.placeholder') }}"
aria-label="{{ __('activitypub.reader.resolve.label') }}"
x-model="query"
@focus="loadAccounts()"
@input.debounce.200ms="filterAccounts()"
@keydown.arrow-down.prevent="highlightNext()"
@keydown.arrow-up.prevent="highlightPrev()"
@keydown.enter="selectHighlighted($event)"
@keydown.escape="close()"
@click.away="close()"
x-ref="input">
{# Popular accounts dropdown #}
<div class="ap-lookup-autocomplete__dropdown" x-show="showResults && suggestions.length > 0" x-cloak>
<template x-for="(item, index) in suggestions" :key="item.handle">
<button type="button"
class="ap-lookup-autocomplete__item"
:class="{ 'ap-lookup-autocomplete__item--highlighted': index === highlighted }"
@click="selectItem(item)"
@mouseenter="highlighted = index">
<img :src="item.avatar" :alt="item.name" class="ap-lookup-autocomplete__avatar">
<span class="ap-lookup-autocomplete__info">
<span class="ap-lookup-autocomplete__name" x-text="item.name"></span>
<span class="ap-lookup-autocomplete__handle" x-text="item.handle"></span>
</span>
<span class="ap-lookup-autocomplete__followers"
x-text="item.followers.toLocaleString() + ' {{ __("activitypub.reader.resolve.followersLabel") }}'"></span>
</button>
</template>
</div>
</div>
<button type="submit" class="ap-lookup__btn">{{ __("activitypub.reader.resolve.button") }}</button>
</form>
{# Tab navigation #}
<nav class="ap-tabs" role="tablist">
<a href="?tab=notes{% if unread %}&unread=1{% endif %}" class="ap-tab{% if tab == 'notes' %} ap-tab--active{% endif %}" role="tab">
{{ __("activitypub.reader.tabs.notes") }}
</a>
<a href="?tab=articles{% if unread %}&unread=1{% endif %}" class="ap-tab{% if tab == 'articles' %} ap-tab--active{% endif %}" role="tab">
{{ __("activitypub.reader.tabs.articles") }}
</a>
<a href="?tab=replies{% if unread %}&unread=1{% endif %}" class="ap-tab{% if tab == 'replies' %} ap-tab--active{% endif %}" role="tab">
{{ __("activitypub.reader.tabs.replies") }}
</a>
<a href="?tab=boosts{% if unread %}&unread=1{% endif %}" class="ap-tab{% if tab == 'boosts' %} ap-tab--active{% endif %}" role="tab">
{{ __("activitypub.reader.tabs.boosts") }}
</a>
<a href="?tab=media{% if unread %}&unread=1{% endif %}" class="ap-tab{% if tab == 'media' %} ap-tab--active{% endif %}" role="tab">
{{ __("activitypub.reader.tabs.media") }}
</a>
<a href="?tab=all{% if unread %}&unread=1{% endif %}" class="ap-tab{% if tab == 'all' %} ap-tab--active{% endif %}" role="tab">
{{ __("activitypub.reader.tabs.all") }}
</a>
<a href="?tab={{ tab }}{% if not unread %}&unread=1{% endif %}" class="ap-tab ap-unread-toggle{% if unread %} ap-unread-toggle--active{% endif %}" title="{% if unread %}Show all posts{% else %}Show unread only{% endif %}">
{% if unread %}
All posts
{% else %}
Unread{% if unreadTimelineCount %} ({{ unreadTimelineCount }}){% endif %}
{% endif %}
</a>
</nav>
{# New posts banner — polls every 30s, shows count of new items #}
{% if items.length > 0 %}
<div class="ap-new-posts-banner"
x-data="apNewPostsBanner()"
data-newest="{{ items[0].published }}"
data-tab="{{ tab }}"
data-mount-path="{{ mountPath }}"
x-show="count > 0"
role="status"
x-cloak>
<button class="ap-new-posts-banner__btn" @click="loadNew()">
<span x-text="count + ' new post' + (count !== 1 ? 's' : '')"></span> — Load
</button>
</div>
{% endif %}
{# Timeline items with read tracking #}
{% if items.length > 0 %}
<div class="ap-timeline"
id="ap-timeline"
data-mount-path="{{ mountPath }}"
data-before="{{ before if before else '' }}"
data-csrf-token="{{ csrfToken }}"
x-data="apReadTracker()"
x-init="init()">
{% for item in items %}
{% include "partials/ap-item-card.njk" %}
{% endfor %}
</div>
{# Pagination (progressive enhancement — visible without JS, hidden when Alpine active) #}
{% if before or after %}
<nav class="ap-pagination ap-pagination--js-hidden" id="ap-reader-pagination">
{% if after %}
<a href="?tab={{ tab }}&after={{ after }}" class="ap-pagination__prev">
{{ __("activitypub.reader.pagination.newer") }}
</a>
{% endif %}
{% if before %}
<a href="?tab={{ tab }}&before={{ before }}" class="ap-pagination__next">
{{ __("activitypub.reader.pagination.older") }}
</a>
{% endif %}
</nav>
{% endif %}
{# Infinite scroll load-more sentinel #}
{% if before %}
<div class="ap-load-more"
id="ap-load-more"
data-cursor="{{ before }}"
data-api-url="{{ mountPath }}/admin/reader/api/timeline"
data-cursor-param="before"
data-cursor-field="before"
data-timeline-id="ap-timeline"
data-extra-params='{{ { tab: tab } | dump }}'
data-hide-pagination="ap-reader-pagination"
x-data="apInfiniteScroll()"
x-init="init()">
<div class="ap-load-more__sentinel" x-ref="sentinel"></div>
<button class="ap-load-more__btn" @click="loadMore()" :disabled="loading" x-show="!done && !loading">
{{ __("activitypub.reader.pagination.loadMore") }}
</button>
<div class="ap-skeleton-group" x-show="loading" aria-live="polite" x-cloak>
{% include "partials/ap-skeleton-card.njk" %}
{% include "partials/ap-skeleton-card.njk" %}
{% include "partials/ap-skeleton-card.njk" %}
</div>
<p class="ap-load-more__done" x-show="done" x-cloak>{{ __("activitypub.reader.pagination.noMore") }}</p>
</div>
{% endif %}
{% else %}
{{ prose({ text: __("activitypub.reader.empty") }) }}
{% endif %}
{% endblock %}