mirror of
https://github.com/svemagie/indiekit-endpoint-activitypub.git
synced 2026-04-02 15:44:58 +02:00
12454749ad
27 issues fixed from multi-dimensional code review (4 Critical, 6 High, 11 Medium, 6 Low): Security (Critical): - Escape HTML in OAuth authorization page to prevent XSS (C1) - Add CSRF protection to OAuth authorize flow (C2) - Replace bypassable regex sanitizer with sanitize-html library (C3) - Enforce OAuth scopes on all Mastodon API routes (C4) Security (Medium/Low): - Fix SSRF via DNS resolution before private IP check (M1) - Add rate limiting to API, auth, and app registration endpoints (M2) - Validate redirect_uri on POST /oauth/authorize (M4) - Fix custom emoji URL injection with scheme validation + escaping (M5) - Remove data: scheme from allowed image sources (L6) - Add access token expiry (1hr) and refresh token rotation (90d) (M3) - Hash client secrets before storage (L3) Architecture: - Extract batch-broadcast.js — shared delivery logic (H1a) - Extract init-indexes.js — MongoDB index creation (H1b) - Extract syndicator.js — syndication logic (H1c) - Create federation-actions.js facade for controllers (M6) - index.js reduced from 1810 to ~1169 lines (35%) Performance: - Cache moderation data with 30s TTL + write invalidation (H6) - Increase inbox queue throughput to 10 items/sec (H5) - Make account enrichment non-blocking with fire-and-forget (H4) - Remove ephemeral getReplies/getLikes/getShares from ingest (M11) - Fix LRU caches to use true LRU eviction (L1) - Fix N+1 backfill queries with batch $in lookup (L2) UI/UX: - Split 3441-line reader.css into 15 feature-scoped files (H2) - Extract inline Alpine.js interaction component (H3) - Reduce sidebar navigation from 7 to 3 items (M7) - Add ARIA live regions for dynamic content updates (M8) - Extract shared CW/non-CW content partial (M9) - Document form handling pattern convention (M10) - Add accessible labels to functional emoji icons (L4) - Convert profile editor to Alpine.js (L5) Audit: documentation-central/audits/2026-03-24-activitypub-code-review.md Plan: documentation-central/plans/2026-03-24-activitypub-audit-fixes.md
85 lines
3.8 KiB
Plaintext
85 lines
3.8 KiB
Plaintext
{# Notification card partial #}
|
|
|
|
<div class="ap-notification{% if not item.read %} ap-notification--unread{% endif %}">
|
|
{# Dismiss button #}
|
|
<form method="post" action="{{ mountPath }}/admin/reader/notifications/delete" class="ap-notification__dismiss">
|
|
<input type="hidden" name="_csrf" value="{{ csrfToken }}">
|
|
<input type="hidden" name="uid" value="{{ item.uid }}">
|
|
<button type="submit" class="ap-notification__dismiss-btn" title="{{ __('activitypub.notifications.dismiss') }}">×</button>
|
|
</form>
|
|
|
|
{# Actor avatar with type badge #}
|
|
<div class="ap-notification__avatar-wrap" data-avatar-fallback>
|
|
{% if item.actorPhoto %}
|
|
<img src="{{ item.actorPhoto }}" alt="{{ item.actorName }}" class="ap-notification__avatar" loading="lazy" crossorigin="anonymous">
|
|
{% endif %}
|
|
<span class="ap-notification__avatar ap-notification__avatar--default" aria-hidden="true">{{ item.actorName[0] | upper if item.actorName else "?" }}</span>
|
|
<span class="ap-notification__type-badge" aria-hidden="true">
|
|
{% if item.type == "like" %}❤{% elif item.type == "boost" %}🔁{% elif item.type == "follow" or item.type == "follow_request" %}👤{% elif item.type == "reply" %}💬{% elif item.type == "mention" %}@{% elif item.type == "dm" %}✉{% elif item.type == "report" %}⚑{% endif %}
|
|
</span>
|
|
</div>
|
|
|
|
{# Notification body #}
|
|
<div class="ap-notification__body">
|
|
<span class="ap-notification__actor">
|
|
<a href="{{ item.actorUrl }}">{{ item.actorName }}</a>
|
|
</span>
|
|
|
|
<span class="ap-notification__action">
|
|
{% if item.type == "like" %}
|
|
{{ __("activitypub.notifications.liked") }}
|
|
{% elif item.type == "boost" %}
|
|
{{ __("activitypub.notifications.boostedPost") }}
|
|
{% elif item.type == "follow" %}
|
|
{{ __("activitypub.notifications.followedYou") }}
|
|
{% elif item.type == "follow_request" %}
|
|
{{ __("activitypub.followRequest") }}
|
|
{% elif item.type == "reply" %}
|
|
{{ __("activitypub.notifications.repliedTo") }}
|
|
{% elif item.type == "mention" %}
|
|
{{ __("activitypub.notifications.mentionedYou") }}
|
|
{% elif item.type == "dm" %}
|
|
{{ __("activitypub.messages.sentYouDM") }}
|
|
{% elif item.type == "report" %}
|
|
{{ __("activitypub.reports.sentReport") }}
|
|
{% endif %}
|
|
</span>
|
|
|
|
{% if item.targetUrl %}
|
|
<a href="{{ item.targetUrl }}" class="ap-notification__target">
|
|
{{ item.targetName or item.targetUrl }}
|
|
</a>
|
|
{% endif %}
|
|
|
|
{% if item.content and item.content.text %}
|
|
<div class="ap-notification__excerpt">
|
|
{{ item.content.text | truncate(200) }}
|
|
</div>
|
|
{% endif %}
|
|
|
|
{% if item.type == "reply" or item.type == "mention" %}
|
|
<div class="ap-notification__actions">
|
|
<a href="{{ mountPath }}/admin/reader/compose?replyTo={{ (item.url or item.uid) | urlencode }}" class="ap-notification__reply-btn" title="{{ __('activitypub.reader.actions.reply') }}">
|
|
↩ {{ __("activitypub.reader.actions.reply") }}
|
|
</a>
|
|
<a href="{{ mountPath }}/admin/reader/post?url={{ (item.url or item.uid) | urlencode }}" class="ap-notification__thread-btn" title="{{ __('activitypub.reader.post.title') }}">
|
|
💬 {{ __("activitypub.notifications.viewThread") }}
|
|
</a>
|
|
</div>
|
|
{% elif item.type == "dm" %}
|
|
<div class="ap-notification__actions">
|
|
<a href="{{ mountPath }}/admin/reader/messages?partner={{ item.actorUrl | urlencode }}" class="ap-notification__thread-btn" title="{{ __('activitypub.messages.title') }}">
|
|
✉ {{ __("activitypub.messages.viewMessage") }}
|
|
</a>
|
|
</div>
|
|
{% endif %}
|
|
</div>
|
|
|
|
{# Timestamp #}
|
|
{% if item.published %}
|
|
<time datetime="{{ item.published }}" class="ap-notification__time" x-data x-relative-time>
|
|
{{ item.published | date("PPp") }}
|
|
</time>
|
|
{% endif %}
|
|
</div>
|