barryf/vibrancy

Headless CMS and Micropub endpoint for personal websites. Used for the back-end of https://barryfrost.com

vibrancy

Vibrancy is a Headless CMS and Micropub endpoint that acts as the backend to my personal website.

It's built using the Architect serverless framework in Node.js and must be deployed to AWS.

See the separate barryfrost project for the frontend of barryfrost.com which uses Vibrancy as its backend.

Status

This project is currently under active development and should be considered highly experimental and likely to change at any time. You're free to fork and hack on it but its primary purpose is to evolve based on my needs. Use at your own risk!

Licence

The source code is available under the MIT licence.

vibrancy's Issues

Store `client_id` of client that created posts, with their post

Something I have, at present on my site, is that I have information about the Micropub clients that are publishing content to my site.

Do you think this would be something you'd be interested in being part of Vibrancy, or is it something I should look at doing for just my own site?

Add support for arbitrary post-rewriting middleware

Currently, I have two main usecases in which my Micropub endpoint modifies the incoming request before saving it, which the latter of which would be quite key for me to move over:

• Rewrite a twitter profile URL as an h-card:

        "Have you asked https://twitter.com/jamietanna?",
        "Have you asked <span class=\"h-card\"><a class=\"u-url\" href=\"https://twitter.com/jamietanna\">@jamietanna</a></span>?"),
  

• Mark hashtags in the post as category properties in the post itself, with some custom rules:

  • i.e. #Java becomes java (just lowercase'd)
  • i.e. #SocialMedia becomes social-media (split words on capitalisation)
  • i.e. #IndieWeb becomes indieweb (custom rule)
  • i.e. #FOSDEM becomes fosdem (all caps get treated as one word)

(There are other cases, like "if I'm replying to Twitter, add a syndication link, but those are lower priority)

Rename `scope` parameter in `micropub.action`

Just looking through the code and had a double-take, as I confused it for an OAuth2 scope - what do you think about renaming to i.e. actionType?

Extract `open-graph.js` to separate library

As you're aware, I'm planning on migrating my Micropub endpoint to Vibrancy at some point.

In the meantime, I've spotted that this would be a good pipe for OpenGraph to i.e. Microformats2, as it'd allow me to make use of this from my current Micropub server, which doesn't have a library handy for OpenGraph parsing.

I'm happy doing this myself, as the code is MIT'd, but thought I'd check with you before doing this in case you'd like to create/maintain the underlying library.

`content-type` isn't always returned correctly

Just spotted this:

curl 'http://localhost:3333/micropub?q=source&url=2020/09/29-180505' -i
HTTP/1.1 400 Bad Request
content-type: text/plain; charset=utf-8
Date: Tue, 13 Jul 2021 21:09:06 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 76

{"error":"invalid_parameter","error_description":"URL parameter is invalid

Not sure if there are any other edge cases we may need to get to, but thought I'd raise it 😄

Support content-type negotiation

When someone sends a Micropub request, i.e. via an HTML form, the response will not be displayed nicely by the User Agent, as the Location header may not be followed for 201 Created.

To allow for the ability to serve information about the post, in a human-readable manner, we should perform content-negotiation to discover the incoming accept header, and return the response accordingly.

For example, currently when sending a normal Micropub request:

% curl https://www-api.staging.jvt.me/micropub -i -H 'Authorization: Bearer ...' -d h=entry -d "content=It's been a great Sunday for #Morph"
HTTP/1.1 202 Accepted
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Length: 0
Date: Tue, 20 Oct 2020 20:44:57 GMT
Expires: 0
Location: https://www.staging.jvt.me/post#ewogICJkYXRlIiA6ICIyMDIwLTEwLTIwVDIwOjQ0OjU3LjkwNloiLAogICJkZWxldGVkIiA6IGZhbHNlLAogICJoIiA6ICJoLWVudHJ5IiwKICAicHJvcGVydGllcyIgOiB7CiAgICAic3luZGljYXRpb24iIDogWyAiaHR0cHM6Ly9icmlkLmd5L3B1Ymxpc2gvdHdpdHRlciIgXSwKICAgICJwdWJsaXNoZWQiIDogWyAiMjAyMC0xMC0yMFQyMDo0NDo1Ny45MDZaIiBdLAogICAgImNhdGVnb3J5IiA6IFsgIm1vcnBoIiBdLAogICAgImNvbnRlbnQiIDogWyB7CiAgICAgICJodG1sIiA6ICIiLAogICAgICAidmFsdWUiIDogIkl0J3MgYmVlbiBhIGdyZWF0IFN1bmRheSBmb3IgPGEgaHJlZj1cIi90YWdzL21vcnBoL1wiPiNNb3JwaDwvYT4iCiAgICB9IF0KICB9LAogICJraW5kIiA6ICJub3RlcyIsCiAgInNsdWciIDogIjIwMjAvMTAvMHFqMWgiLAogICJ0YWdzIiA6IFsgIm1vcnBoIiBdLAogICJjbGllbnRfaWQiIDogImh0dHBzOi8vcXVpbGwucDNrLmlvLyIKfQ==
Pragma: no-cache
Server: Caddy
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block

And when negotiation occurs:

% curl https://www-api.staging.jvt.me/micropub -i -H 'Authorization: Bearer ...' -d h=entry -d "content=It's been a great Sunday for #Morph"  -H 'accept: text/html'
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Length: 1446
Content-Type: text/html;charset=UTF-8
Date: Tue, 20 Oct 2020 20:45:06 GMT
Expires: 0
Pragma: no-cache
Server: Caddy
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block

<html><body><p>The post has been created at <a href="https://www.staging.jvt.me/post#ewogICJkYXRlIiA6ICIyMDIwLTEwLTIwVDIwOjQ1OjA2LjUxNFoiLAogICJkZWxldGVkIiA6IGZhbHNlLAogICJoIiA6ICJoLWVudHJ5IiwKICAicHJvcGVydGllcyIgOiB7CiAgICAic3luZGljYXRpb24iIDogWyAiaHR0cHM6Ly9icmlkLmd5L3B1Ymxpc2gvdHdpdHRlciIgXSwKICAgICJwdWJsaXNoZWQiIDogWyAiMjAyMC0xMC0yMFQyMDo0NTowNi41MTRaIiBdLAogICAgImNhdGVnb3J5IiA6IFsgIm1vcnBoIiBdLAogICAgImNvbnRlbnQiIDogWyB7CiAgICAgICJodG1sIiA6ICIiLAogICAgICAidmFsdWUiIDogIkl0J3MgYmVlbiBhIGdyZWF0IFN1bmRheSBmb3IgPGEgaHJlZj1cIi90YWdzL21vcnBoL1wiPiNNb3JwaDwvYT4iCiAgICB9IF0KICB9LAogICJraW5kIiA6ICJub3RlcyIsCiAgInNsdWciIDogIjIwMjAvMTAvcWpkcXkiLAogICJ0YWdzIiA6IFsgIm1vcnBoIiBdLAogICJjbGllbnRfaWQiIDogImh0dHBzOi8vcXVpbGwucDNrLmlvLyIKfQ==">https://www.staging.jvt.me/post#ewogICJkYXRlIiA6ICIyMDIwLTEwLTIwVDIwOjQ1OjA2LjUxNFoiLAogICJkZWxldGVkIiA6IGZhbHNlLAogICJoIiA6ICJoLWVudHJ5IiwKICAicHJvcGVydGllcyIgOiB7CiAgICAic3luZGljYXRpb24iIDogWyAiaHR0cHM6Ly9icmlkLmd5L3B1Ymxpc2gvdHdpdHRlciIgXSwKICAgICJwdWJsaXNoZWQiIDogWyAiMjAyMC0xMC0yMFQyMDo0NTowNi41MTRaIiBdLAogICAgImNhdGVnb3J5IiA6IFsgIm1vcnBoIiBdLAogICAgImNvbnRlbnQiIDogWyB7CiAgICAgICJodG1sIiA6ICIiLAogICAgICAidmFsdWUiIDogIkl0J3MgYmVlbiBhIGdyZWF0IFN1bmRheSBmb3IgPGEgaHJlZj1cIi90YWdzL21vcnBoL1wiPiNNb3JwaDwvYT4iCiAgICB9IF0KICB9LAogICJraW5kIiA6ICJub3RlcyIsCiAgInNsdWciIDogIjIwMjAvMTAvcWpkcXkiLAogICJ0YWdzIiA6IFsgIm1vcnBoIiBdLAogICJjbGllbnRfaWQiIDogImh0dHBzOi8vcXVpbGwucDNrLmlvLyIKfQ==</a>.</p></body></html>

Support different backends

As a GitLab user, I'd like to use GitLab as my repo source.

I'd say this could work by some environment-based configuration which specifies which Git host to use, defaulting to GitHub.

This would replace the write-github with write-to-git which then calls the relevant SDK for the write event

Slug generation for notes causes (IMO) unnecessary 400s

curl localhost:3333/micropub -i -d h=entry -d content='this will become a long slug for the thing'
HTTP/1.1 201 Created
content-type: text/plain; charset=utf-8
location: http://localhost:4444/2021/12/this-will-become-a-long-slug
Date: Thu, 09 Dec 2021 15:21:16 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 0

curl localhost:3333/micropub -i -d h=entry -d content='this will become a long slug for the thing, but has a different content value'
HTTP/1.1 400 Bad Request
content-type: application/json; charset=utf-8
Date: Thu, 09 Dec 2021 15:21:18 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 0

I'd say that in this case, we should then append on a random suffix, or just use a random slug altogether

Un-barryf-ify

Replace any hard-coded references to me with config variables. Make improvements that make it easier for someone else to use Vibrancy for their own backend.

Don't store `content` for cite

To avoid unnecessary storage overhead (in the case of long posts) as well as potential copyright claims we should remove the content for a context.

That being said, we would want this for a repost so maybe it needs more nuance?

Add support for contacts

As mentioned in Platform-Aware @-mentioning People on my Blog I found that setting up the q=contact Micropub query like so:

{
  "contacts": [
    {
      "name": "Barry Frost",
      "nickname": "barryfrost.com",
      "url": "https://barryfrost.com/",
      "silos": {
        "twitter": "BarryF"
      },
      "_internal_url": "https://www.jvt.me/contacts/barryfrost.com/"
    }
  ]
}

Makes it handy to perform different syndication, as well as having autocomplete of people in i.e. Indigenous for Android.

Add ability to update posts' syndication URLs if a link is returned

Bridgy and IndieNews return a url property after syndication that is the post's syndicated URL.

We should provide some sort of middleware (for want of a better word?) that can perform this for us.

I.e. via https://brid.gy/about#response:

HTTP/1.1 201 Created
Content-Type: application/json
Location: https://twitter.com/me/status/456789

{
  "url": "https://twitter.com/me/status/456789",
  "type": "post",
  "id": "456789"
}

(The url property should be used, not the Location header)

Require `alt` text for images

Although it's generally going to be added when we're posting, it's a good thing to enforce at the server level to make sure that any photos being posted (as a photo post) include an alt text attribute.

Allow `q=config` (and some other queries) to be unauthenticated

I've currently got my Micropub server not requiring this, as I don't think this query requires anything - what are your thoughts?

Also wondering about allowing q=source to attempt to retrieve a post if unauthenticated, and only show it if it's public

Support Micropub actions for contacts

With the contacts endpoint in place (#21), it should be possible to create/update contacts via Micropub.

This would be the first non-h-entry type to be supported.

Use content-addressible hash for image filenames

To make it easier to deduplicate images, as well as programatically determine the output filename for a media file, could we move to using a content-addressible hash?

For instance, this is what my current media endpoint does:

      slug = DigestUtils.sha256Hex(Base64.getEncoder().encode(file.getBytes())).substring(0, 10);

Inspired by Marty's https://martymcgui.re/2017/01/26/spano-a-minimum-viable-micropub-media-endpoint/