michaelcpuckett/activity-kit

An attempt to build a spec-compliant ActivityPub core library.

activity-kit's Issues

Groups

Groups are mostly outside the ActivityPub spec, but my understanding is that some implementations do something akin to the following flow:

• Person Actor "Alice" follows Group Actor "Star Wars Fans"
• Group Actor "Star Wars Fans" accepts the follow, adding "Alice" to its Followers collection
• "Alice" broadcasts a Note Object wrapped in a Create Activity and addresses it to "Star Wars Fans"
• "Star Wars Fans" receives the Create Activity and, as a side effect, broadcasts an Announce Activity referencing the Note Object, addressed to its Following collection. This is only if the Actor of the Create Activity is in the Group Actor's Followers collection.

Clients may interpret this in various ways, but I assume for most users this just literally shows the Group Actor announcement/share/boost/etc. alongside the rest of the timeline. I think ideally a client would isolate Group Announce Activities into a separate area.

(outbox:upload-media) Accepts Uploaded Media in submissions [MUST]

https://w3c.github.io/activitypub/#uploading-media

Servers MAY support uploading document types to be referenced in activites, such as images, video or other binary data, but the precise mechanism is out of scope for this version of ActivityPub. The Social Web Community Group is refining the protocol in the ActivityPub Media Upload report.

https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload

The Media Upload mechanism defines a protocol for ActivityPub servers to support uploading document types to be referenced in activites, such as images, video or other binary data. To accomplish this, a client MUST submit a multipart/form-data message to the user's uploadMedia endpoint on their ActivityStreams profile object. (Unlike most client to server interactions, using this endpoint does not involve submitting to the outbox). A client should expect that it must be properly authenticated in order to be able to upload media.

The uploadMedia endpoint is part of the ActivityPub endpoints mapping. See ActivityPub extensions.

The submitted form data should contain two parts / fields:

file: The media file file being uploaded.
object: A shell of an ActivityStreams object, which will be finalized by the server.

Assuming that the server accepts the request and that the user was appropriately authorized to upload media, servers MUST respond with a 201 Created if the object is immediately available or a 202 Accepted if the server is still processing the submitted media. The response MUST contain a Location header pointing to the new or to-be-created object's id.

The server, having done any appropriate processing on the received file and putting it in place, transforms the object that will be retrievable by the id. In particular, servers MUST append an id property to the object, and SHOULD include the uploaded and/or processed file paths in the object's url property. The server MAY wrap the shell object submitted by the user in a Create via (object-without-create) if appropriate and present this as the object pointed to by the forementioned Location header in the post-media-upload response.

announcing group messages to the whole fediverse is spammy

As far as I understand, the groups plugin sends Announces to all known inboxes:

https://github.com/michaelcpuckett/activitypub-core/blob/34d57d2d7f89bf48da698116273dc86240f2f088/packages/activitypub-core-plugin-groups/src/index.ts#L212

I was wondering why some posts where showing up on my single user instance's global timeline when I noticed that they were Announced by an actor from chirp.social. My general expectation is that activities are only sent to following actors, otherwise this is sending bulk unsolicited content.

Set User-Agent header

name and version of activitypub-core and the domain

type is to restrictive (?)

Hello,

all the things which are not marked functional in the spec. can have multiple items.
So can type.
In fact if you look at the context, type is just an alias for the @type of JSON-LD.
It is not restricted to any Vocabulary.
For example
"type": ["Collection", "redaktor:PressFreedom"] or
"type": ["Place", "schema:Country"] or from my Public Broadcaster an Array with 8 types ;)

So, wondered about
type: typeof CoreObjectTypes[keyof typeof CoreObjectTypes];

Follow/Accept flow bug

I have attempted to follow the Follow/Accept flow as specified but bugs tend to pop up during testing, such as:

• After both actors follow each other, one will end up with an additional follower (the same follower, twice)

Avoid hanging on uncaught errors

Per @gobengo:

activitypub-core-server-express should probably catch unexpected exceptions in the endpoint respond methods and pass the error to express's next(err) callback. without that, express will hang on uncaught errors because res.end() is never called

Do you want an AWS DynamoDB adapter?

Hi maintainers,

I am interested in contributing a new feature to your project. I have an idea for a DynamoDB database adapter and wanted to get your feedback before I start working on it.

Is this something that would be useful for the project? Are there any guidelines or preferences I should follow while implementing it? (e.g. on what branch should I submit a pull request, etc.)

Looking forward to your response.

Thank you,
Matthias

Handle Mastodon Secure Mode

Some Mastodon accounts cannot interact with activitypub-core servers because GET requests are failing.

See https://docs.joinmastodon.org/spec/security/

When secure mode is enabled, all GET requests require HTTP signatures as well.

michaelcpuckett/ap-groups#1