mirror of
https://github.com/svemagie/indiekit-endpoint-activitypub.git
synced 2026-04-02 15:44:58 +02:00
27 issues fixed from multi-dimensional code review (4 Critical, 6 High, 11 Medium, 6 Low): Security (Critical): - Escape HTML in OAuth authorization page to prevent XSS (C1) - Add CSRF protection to OAuth authorize flow (C2) - Replace bypassable regex sanitizer with sanitize-html library (C3) - Enforce OAuth scopes on all Mastodon API routes (C4) Security (Medium/Low): - Fix SSRF via DNS resolution before private IP check (M1) - Add rate limiting to API, auth, and app registration endpoints (M2) - Validate redirect_uri on POST /oauth/authorize (M4) - Fix custom emoji URL injection with scheme validation + escaping (M5) - Remove data: scheme from allowed image sources (L6) - Add access token expiry (1hr) and refresh token rotation (90d) (M3) - Hash client secrets before storage (L3) Architecture: - Extract batch-broadcast.js — shared delivery logic (H1a) - Extract init-indexes.js — MongoDB index creation (H1b) - Extract syndicator.js — syndication logic (H1c) - Create federation-actions.js facade for controllers (M6) - index.js reduced from 1810 to ~1169 lines (35%) Performance: - Cache moderation data with 30s TTL + write invalidation (H6) - Increase inbox queue throughput to 10 items/sec (H5) - Make account enrichment non-blocking with fire-and-forget (H4) - Remove ephemeral getReplies/getLikes/getShares from ingest (M11) - Fix LRU caches to use true LRU eviction (L1) - Fix N+1 backfill queries with batch $in lookup (L2) UI/UX: - Split 3441-line reader.css into 15 feature-scoped files (H2) - Extract inline Alpine.js interaction component (H3) - Reduce sidebar navigation from 7 to 3 items (M7) - Add ARIA live regions for dynamic content updates (M8) - Extract shared CW/non-CW content partial (M9) - Document form handling pattern convention (M10) - Add accessible labels to functional emoji icons (L4) - Convert profile editor to Alpine.js (L5) Audit: documentation-central/audits/2026-03-24-activitypub-code-review.md Plan: documentation-central/plans/2026-03-24-activitypub-audit-fixes.md
168 lines
7.1 KiB
Plaintext
168 lines
7.1 KiB
Plaintext
{% extends "layouts/ap-reader.njk" %}
|
|
|
|
{% from "heading/macro.njk" import heading with context %}
|
|
{% from "prose/macro.njk" import prose with context %}
|
|
|
|
{% block readercontent %}
|
|
{# Explore link #}
|
|
<div class="ap-reader-tools">
|
|
<a href="{{ mountPath }}/admin/reader/explore" class="ap-reader-tools__explore">
|
|
🔭 {{ __("activitypub.reader.explore.title") }}
|
|
</a>
|
|
</div>
|
|
|
|
{# Followed tags #}
|
|
{% if followedTags and followedTags.length > 0 %}
|
|
<div class="ap-followed-tags">
|
|
<span class="ap-followed-tags__label">{{ __("activitypub.reader.tagTimeline.following") }}:</span>
|
|
{% for tag in followedTags %}
|
|
<a href="{{ mountPath }}/admin/reader/tag?tag={{ tag | urlencode }}" class="ap-card__tag">#{{ tag }}</a>
|
|
{% endfor %}
|
|
</div>
|
|
{% endif %}
|
|
|
|
{# Fediverse lookup with popular accounts autocomplete #}
|
|
<form action="{{ mountPath }}/admin/reader/resolve" method="get" class="ap-lookup"
|
|
x-data="apPopularAccounts('{{ mountPath }}')"
|
|
@submit="onSubmit">
|
|
<div class="ap-lookup-autocomplete">
|
|
<input type="text" name="q" class="ap-lookup__input"
|
|
placeholder="{{ __('activitypub.reader.resolve.placeholder') }}"
|
|
aria-label="{{ __('activitypub.reader.resolve.label') }}"
|
|
x-model="query"
|
|
@focus="loadAccounts()"
|
|
@input.debounce.200ms="filterAccounts()"
|
|
@keydown.arrow-down.prevent="highlightNext()"
|
|
@keydown.arrow-up.prevent="highlightPrev()"
|
|
@keydown.enter="selectHighlighted($event)"
|
|
@keydown.escape="close()"
|
|
@click.away="close()"
|
|
x-ref="input">
|
|
|
|
{# Popular accounts dropdown #}
|
|
<div class="ap-lookup-autocomplete__dropdown" x-show="showResults && suggestions.length > 0" x-cloak>
|
|
<template x-for="(item, index) in suggestions" :key="item.handle">
|
|
<button type="button"
|
|
class="ap-lookup-autocomplete__item"
|
|
:class="{ 'ap-lookup-autocomplete__item--highlighted': index === highlighted }"
|
|
@click="selectItem(item)"
|
|
@mouseenter="highlighted = index">
|
|
<img :src="item.avatar" :alt="item.name" class="ap-lookup-autocomplete__avatar">
|
|
<span class="ap-lookup-autocomplete__info">
|
|
<span class="ap-lookup-autocomplete__name" x-text="item.name"></span>
|
|
<span class="ap-lookup-autocomplete__handle" x-text="item.handle"></span>
|
|
</span>
|
|
<span class="ap-lookup-autocomplete__followers"
|
|
x-text="item.followers.toLocaleString() + ' {{ __("activitypub.reader.resolve.followersLabel") }}'"></span>
|
|
</button>
|
|
</template>
|
|
</div>
|
|
</div>
|
|
<button type="submit" class="ap-lookup__btn">{{ __("activitypub.reader.resolve.button") }}</button>
|
|
</form>
|
|
|
|
{# Tab navigation #}
|
|
<nav class="ap-tabs" role="tablist">
|
|
<a href="?tab=notes{% if unread %}&unread=1{% endif %}" class="ap-tab{% if tab == 'notes' %} ap-tab--active{% endif %}" role="tab">
|
|
{{ __("activitypub.reader.tabs.notes") }}
|
|
</a>
|
|
<a href="?tab=articles{% if unread %}&unread=1{% endif %}" class="ap-tab{% if tab == 'articles' %} ap-tab--active{% endif %}" role="tab">
|
|
{{ __("activitypub.reader.tabs.articles") }}
|
|
</a>
|
|
<a href="?tab=replies{% if unread %}&unread=1{% endif %}" class="ap-tab{% if tab == 'replies' %} ap-tab--active{% endif %}" role="tab">
|
|
{{ __("activitypub.reader.tabs.replies") }}
|
|
</a>
|
|
<a href="?tab=boosts{% if unread %}&unread=1{% endif %}" class="ap-tab{% if tab == 'boosts' %} ap-tab--active{% endif %}" role="tab">
|
|
{{ __("activitypub.reader.tabs.boosts") }}
|
|
</a>
|
|
<a href="?tab=media{% if unread %}&unread=1{% endif %}" class="ap-tab{% if tab == 'media' %} ap-tab--active{% endif %}" role="tab">
|
|
{{ __("activitypub.reader.tabs.media") }}
|
|
</a>
|
|
<a href="?tab=all{% if unread %}&unread=1{% endif %}" class="ap-tab{% if tab == 'all' %} ap-tab--active{% endif %}" role="tab">
|
|
{{ __("activitypub.reader.tabs.all") }}
|
|
</a>
|
|
<a href="?tab={{ tab }}{% if not unread %}&unread=1{% endif %}" class="ap-tab ap-unread-toggle{% if unread %} ap-unread-toggle--active{% endif %}" title="{% if unread %}Show all posts{% else %}Show unread only{% endif %}">
|
|
{% if unread %}
|
|
All posts
|
|
{% else %}
|
|
Unread{% if unreadTimelineCount %} ({{ unreadTimelineCount }}){% endif %}
|
|
{% endif %}
|
|
</a>
|
|
</nav>
|
|
|
|
{# New posts banner — polls every 30s, shows count of new items #}
|
|
{% if items.length > 0 %}
|
|
<div class="ap-new-posts-banner"
|
|
x-data="apNewPostsBanner()"
|
|
data-newest="{{ items[0].published }}"
|
|
data-tab="{{ tab }}"
|
|
data-mount-path="{{ mountPath }}"
|
|
x-show="count > 0"
|
|
role="status"
|
|
x-cloak>
|
|
<button class="ap-new-posts-banner__btn" @click="loadNew()">
|
|
<span x-text="count + ' new post' + (count !== 1 ? 's' : '')"></span> — Load
|
|
</button>
|
|
</div>
|
|
{% endif %}
|
|
|
|
{# Timeline items with read tracking #}
|
|
{% if items.length > 0 %}
|
|
<div class="ap-timeline"
|
|
id="ap-timeline"
|
|
data-mount-path="{{ mountPath }}"
|
|
data-before="{{ before if before else '' }}"
|
|
data-csrf-token="{{ csrfToken }}"
|
|
x-data="apReadTracker()"
|
|
x-init="init()">
|
|
{% for item in items %}
|
|
{% include "partials/ap-item-card.njk" %}
|
|
{% endfor %}
|
|
</div>
|
|
|
|
{# Pagination (progressive enhancement — visible without JS, hidden when Alpine active) #}
|
|
{% if before or after %}
|
|
<nav class="ap-pagination ap-pagination--js-hidden" id="ap-reader-pagination">
|
|
{% if after %}
|
|
<a href="?tab={{ tab }}&after={{ after }}" class="ap-pagination__prev">
|
|
{{ __("activitypub.reader.pagination.newer") }}
|
|
</a>
|
|
{% endif %}
|
|
{% if before %}
|
|
<a href="?tab={{ tab }}&before={{ before }}" class="ap-pagination__next">
|
|
{{ __("activitypub.reader.pagination.older") }}
|
|
</a>
|
|
{% endif %}
|
|
</nav>
|
|
{% endif %}
|
|
|
|
{# Infinite scroll load-more sentinel #}
|
|
{% if before %}
|
|
<div class="ap-load-more"
|
|
id="ap-load-more"
|
|
data-cursor="{{ before }}"
|
|
data-api-url="{{ mountPath }}/admin/reader/api/timeline"
|
|
data-cursor-param="before"
|
|
data-cursor-field="before"
|
|
data-timeline-id="ap-timeline"
|
|
data-extra-params='{{ { tab: tab } | dump }}'
|
|
data-hide-pagination="ap-reader-pagination"
|
|
x-data="apInfiniteScroll()"
|
|
x-init="init()">
|
|
<div class="ap-load-more__sentinel" x-ref="sentinel"></div>
|
|
<button class="ap-load-more__btn" @click="loadMore()" :disabled="loading" x-show="!done && !loading">
|
|
{{ __("activitypub.reader.pagination.loadMore") }}
|
|
</button>
|
|
<div class="ap-skeleton-group" x-show="loading" aria-live="polite" x-cloak>
|
|
{% include "partials/ap-skeleton-card.njk" %}
|
|
{% include "partials/ap-skeleton-card.njk" %}
|
|
{% include "partials/ap-skeleton-card.njk" %}
|
|
</div>
|
|
<p class="ap-load-more__done" x-show="done" x-cloak>{{ __("activitypub.reader.pagination.noMore") }}</p>
|
|
</div>
|
|
{% endif %}
|
|
{% else %}
|
|
{{ prose({ text: __("activitypub.reader.empty") }) }}
|
|
{% endif %}
|
|
{% endblock %}
|