mirror of
https://github.com/svemagie/indiekit-endpoint-activitypub.git
synced 2026-04-02 15:44:58 +02:00
12454749ad
27 issues fixed from multi-dimensional code review (4 Critical, 6 High, 11 Medium, 6 Low): Security (Critical): - Escape HTML in OAuth authorization page to prevent XSS (C1) - Add CSRF protection to OAuth authorize flow (C2) - Replace bypassable regex sanitizer with sanitize-html library (C3) - Enforce OAuth scopes on all Mastodon API routes (C4) Security (Medium/Low): - Fix SSRF via DNS resolution before private IP check (M1) - Add rate limiting to API, auth, and app registration endpoints (M2) - Validate redirect_uri on POST /oauth/authorize (M4) - Fix custom emoji URL injection with scheme validation + escaping (M5) - Remove data: scheme from allowed image sources (L6) - Add access token expiry (1hr) and refresh token rotation (90d) (M3) - Hash client secrets before storage (L3) Architecture: - Extract batch-broadcast.js — shared delivery logic (H1a) - Extract init-indexes.js — MongoDB index creation (H1b) - Extract syndicator.js — syndication logic (H1c) - Create federation-actions.js facade for controllers (M6) - index.js reduced from 1810 to ~1169 lines (35%) Performance: - Cache moderation data with 30s TTL + write invalidation (H6) - Increase inbox queue throughput to 10 items/sec (H5) - Make account enrichment non-blocking with fire-and-forget (H4) - Remove ephemeral getReplies/getLikes/getShares from ingest (M11) - Fix LRU caches to use true LRU eviction (L1) - Fix N+1 backfill queries with batch $in lookup (L2) UI/UX: - Split 3441-line reader.css into 15 feature-scoped files (H2) - Extract inline Alpine.js interaction component (H3) - Reduce sidebar navigation from 7 to 3 items (M7) - Add ARIA live regions for dynamic content updates (M8) - Extract shared CW/non-CW content partial (M9) - Document form handling pattern convention (M10) - Add accessible labels to functional emoji icons (L4) - Convert profile editor to Alpine.js (L5) Audit: documentation-central/audits/2026-03-24-activitypub-code-review.md Plan: documentation-central/plans/2026-03-24-activitypub-audit-fixes.md
40 lines
2.1 KiB
Plaintext
40 lines
2.1 KiB
Plaintext
{% extends "document.njk" %}
|
|
|
|
{% block content %}
|
|
{# Infinite scroll component — must load before Alpine to register via alpine:init #}
|
|
<script defer src="/assets/@rmdes-indiekit-endpoint-activitypub/reader-infinite-scroll.js"></script>
|
|
{# Card interaction component — apCardInteraction Alpine component #}
|
|
<script defer src="/assets/@rmdes-indiekit-endpoint-activitypub/reader-interactions.js"></script>
|
|
{# Autocomplete components for explore + popular accounts #}
|
|
<script defer src="/assets/@rmdes-indiekit-endpoint-activitypub/reader-autocomplete.js"></script>
|
|
{# Tab components — apExploreTabs #}
|
|
<script defer src="/assets/@rmdes-indiekit-endpoint-activitypub/reader-tabs.js"></script>
|
|
{# Relative timestamps — converts absolute dates to "5m", "3h", "2d" etc. #}
|
|
<script defer src="/assets/@rmdes-indiekit-endpoint-activitypub/reader-relative-time.js"></script>
|
|
|
|
{# Avatar fallback — remove broken images to reveal initials fallback underneath #}
|
|
<script>document.addEventListener("error",function(e){var t=e.target;if(t.tagName==="IMG"&&t.closest("[data-avatar-fallback]"))t.remove()},true)</script>
|
|
|
|
{# Alpine.js loaded by default.njk — AP scripts register via alpine:init before it initializes #}
|
|
|
|
{# Reader stylesheet — loaded in body is fine for modern browsers #}
|
|
<link rel="stylesheet" href="/assets/@rmdes-indiekit-endpoint-activitypub/reader.css">
|
|
<link rel="stylesheet" href="/assets/@rmdes-indiekit-endpoint-activitypub/reader-links.css">
|
|
|
|
{# AP link interception for internal navigation #}
|
|
<script defer src="/assets/@rmdes-indiekit-endpoint-activitypub/reader-links.js"></script>
|
|
{# Blurhash placeholder backgrounds for gallery images #}
|
|
<script defer src="/assets/@rmdes-indiekit-endpoint-activitypub/reader-blurhash.js"></script>
|
|
|
|
{% if readerParent %}
|
|
<nav class="ap-breadcrumb" aria-label="Breadcrumb">
|
|
<a href="{{ readerParent.href }}">{{ readerParent.text }}</a>
|
|
<span class="ap-breadcrumb__separator" aria-hidden="true">/</span>
|
|
<span class="ap-breadcrumb__current" aria-current="page">{{ title }}</span>
|
|
</nav>
|
|
{% endif %}
|
|
|
|
{% block readercontent %}
|
|
{% endblock %}
|
|
{% endblock %}
|