mirror of
https://github.com/svemagie/indiekit-endpoint-activitypub.git
synced 2026-04-02 15:44:58 +02:00
12454749ad
27 issues fixed from multi-dimensional code review (4 Critical, 6 High, 11 Medium, 6 Low): Security (Critical): - Escape HTML in OAuth authorization page to prevent XSS (C1) - Add CSRF protection to OAuth authorize flow (C2) - Replace bypassable regex sanitizer with sanitize-html library (C3) - Enforce OAuth scopes on all Mastodon API routes (C4) Security (Medium/Low): - Fix SSRF via DNS resolution before private IP check (M1) - Add rate limiting to API, auth, and app registration endpoints (M2) - Validate redirect_uri on POST /oauth/authorize (M4) - Fix custom emoji URL injection with scheme validation + escaping (M5) - Remove data: scheme from allowed image sources (L6) - Add access token expiry (1hr) and refresh token rotation (90d) (M3) - Hash client secrets before storage (L3) Architecture: - Extract batch-broadcast.js — shared delivery logic (H1a) - Extract init-indexes.js — MongoDB index creation (H1b) - Extract syndicator.js — syndication logic (H1c) - Create federation-actions.js facade for controllers (M6) - index.js reduced from 1810 to ~1169 lines (35%) Performance: - Cache moderation data with 30s TTL + write invalidation (H6) - Increase inbox queue throughput to 10 items/sec (H5) - Make account enrichment non-blocking with fire-and-forget (H4) - Remove ephemeral getReplies/getLikes/getShares from ingest (M11) - Fix LRU caches to use true LRU eviction (L1) - Fix N+1 backfill queries with batch $in lookup (L2) UI/UX: - Split 3441-line reader.css into 15 feature-scoped files (H2) - Extract inline Alpine.js interaction component (H3) - Reduce sidebar navigation from 7 to 3 items (M7) - Add ARIA live regions for dynamic content updates (M8) - Extract shared CW/non-CW content partial (M9) - Document form handling pattern convention (M10) - Add accessible labels to functional emoji icons (L4) - Convert profile editor to Alpine.js (L5) Audit: documentation-central/audits/2026-03-24-activitypub-code-review.md Plan: documentation-central/plans/2026-03-24-activitypub-audit-fixes.md
71 lines
2.2 KiB
JavaScript
71 lines
2.2 KiB
JavaScript
/**
|
|
* Facade for federation operations used by controllers.
|
|
* Centralizes Fedify context creation and common patterns
|
|
* so controllers don't access plugin._federation directly.
|
|
* @module federation-actions
|
|
*/
|
|
import { lookupWithSecurity } from "./lookup-helpers.js";
|
|
|
|
/**
|
|
* Create a Fedify context from the plugin reference.
|
|
* @param {object} plugin - ActivityPubEndpoint instance
|
|
* @returns {object} Fedify Context
|
|
*/
|
|
export function createContext(plugin) {
|
|
const handle = plugin.options.actor.handle;
|
|
return plugin._federation.createContext(new URL(plugin._publicationUrl), {
|
|
handle,
|
|
publicationUrl: plugin._publicationUrl,
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Get an authenticated document loader for signed HTTP fetches.
|
|
* @param {object} plugin - ActivityPubEndpoint instance
|
|
* @returns {Promise<object>} Fedify DocumentLoader
|
|
*/
|
|
export async function getAuthLoader(plugin) {
|
|
const ctx = createContext(plugin);
|
|
return ctx.getDocumentLoader({ identifier: plugin.options.actor.handle });
|
|
}
|
|
|
|
/**
|
|
* Resolve a remote actor with signed→unsigned fallback.
|
|
* @param {object} plugin - ActivityPubEndpoint instance
|
|
* @param {string|URL} target - Actor URL or acct: URI
|
|
* @param {object} [options] - Additional options for lookupWithSecurity
|
|
* @returns {Promise<object|null>} Resolved actor or null
|
|
*/
|
|
export async function resolveActor(plugin, target, options = {}) {
|
|
const ctx = createContext(plugin);
|
|
const documentLoader = await ctx.getDocumentLoader({
|
|
identifier: plugin.options.actor.handle,
|
|
});
|
|
const url = target instanceof URL ? target : new URL(target);
|
|
return lookupWithSecurity(ctx, url, { documentLoader, ...options });
|
|
}
|
|
|
|
/**
|
|
* Check if federation is initialized and ready.
|
|
* @param {object} plugin - ActivityPubEndpoint instance
|
|
* @returns {boolean}
|
|
*/
|
|
export function isFederationReady(plugin) {
|
|
return !!plugin._federation;
|
|
}
|
|
|
|
/** @returns {string} Our actor handle */
|
|
export function getHandle(plugin) {
|
|
return plugin.options.actor.handle;
|
|
}
|
|
|
|
/** @returns {string} Our publication URL */
|
|
export function getPublicationUrl(plugin) {
|
|
return plugin._publicationUrl;
|
|
}
|
|
|
|
/** @returns {object} MongoDB collections */
|
|
export function getCollections(plugin) {
|
|
return plugin._collections;
|
|
}
|