Port federation reliability and actor-profile updates #57

Merged

erik merged 1 commit from feat/task-76fd6333-federation-reliability into main

2026-10-25 19:30:26 -05:00

erik commented

2026-10-25 19:26:49 -05:00

Owner

Summary

Port current template federation fixes into slugkit.com without replacing its reference API or recent browser-security work.

Reconstruct inbox verification URLs from the configured public origin while retaining encoded path/query, method, headers, body and abort signal; reject conflicting/malformed Host authorities without trusting forwarding headers.
Use compatible authenticated actor/key GETs in actor/shared inboxes and queue workers. Preserve explicit non-primary signing identities and loader safety/fetch options, including private-address restrictions.
Install a narrow, allowlisted LogTape bridge before queue activation and replace raw follower/exception logs with classified events.
Reuse a shared actor-document builder for discovery and actor-profile Update delivery, retaining persisted keys, identity/profile/account fields and timestamps, standalone legacy publicKey, acct: signing, and automatic follower acceptance.
Queue profile updates only after an authorized, CSRF-protected settings save and only for enabled federation with active followers. Give each edit a distinct activity ID. A queueing failure returns a generic 503 explaining that settings were saved, without leaking the exception or implying rollback.
Add stable @logtape/logtape 2.4.2 (shared with existing locked Fedify 2.3.0); no Fedify or Slugkit-contract package upgrade.

Task: task-76fd6333

Verification

./scripts/pre-pr.sh PASS: formatting, typecheck, build/reproducible CSS and 521 tests across 53 files.

Regression coverage includes both RFC 9421 and legacy Cavage signatures at both inboxes behind TLS termination; real cryptographic authenticated actor/key GET and Accept verification using controlled remote fixtures; spoofed forwarding/cross-host and malformed Host rejection; body tampering/actor mismatch; private-address safety; earlier body limits; sanitized diagnostics; database reopen/worker recreation preserving actor/keys/followers; and signed actor updates with unique IDs, account/profile/timestamp content, unchanged key documents/content/followers, safe queue failures and preserved CSRF protection.

Integration verification remains local-only. Follow fixtures intercept outbound POSTs instead of issuing real deliveries; no integration/browser/container testing or runtime provisioning was added to CI/release workflows. Current and historical API/schema regressions remain in the full suite.

Boundaries and rollout

Preserve the existing origin, actor username/identity/keys, followers, profile settings/content, API routes/schema bytes/archive discovery, branding and release tooling. No setup gate/lifecycle, database migration, key rotation, homelab mutation, release tag/image publication or production deployment was introduced. No production/live federation writes were performed.

See src/federation/README.md for proxy requirements, diagnostics, local verification and a separately approved rollout. The in-process queue is still not durable; queueing is not proof of remote delivery. Production rollout, live follows/profile edits and actual remote delivery verification require separate approval.

## Summary Port current template federation fixes into slugkit.com without replacing its reference API or recent browser-security work. - Reconstruct inbox verification URLs from the configured public origin while retaining encoded path/query, method, headers, body and abort signal; reject conflicting/malformed Host authorities without trusting forwarding headers. - Use compatible authenticated actor/key GETs in actor/shared inboxes and queue workers. Preserve explicit non-primary signing identities and loader safety/fetch options, including private-address restrictions. - Install a narrow, allowlisted LogTape bridge before queue activation and replace raw follower/exception logs with classified events. - Reuse a shared actor-document builder for discovery and actor-profile Update delivery, retaining persisted keys, identity/profile/account fields and timestamps, standalone legacy publicKey, acct: signing, and automatic follower acceptance. - Queue profile updates only after an authorized, CSRF-protected settings save and only for enabled federation with active followers. Give each edit a distinct activity ID. A queueing failure returns a generic 503 explaining that settings were saved, without leaking the exception or implying rollback. - Add stable @logtape/logtape 2.4.2 (shared with existing locked Fedify 2.3.0); no Fedify or Slugkit-contract package upgrade. Task: task-76fd6333 ## Verification `./scripts/pre-pr.sh` PASS: formatting, typecheck, build/reproducible CSS and **521 tests across 53 files**. Regression coverage includes both RFC 9421 and legacy Cavage signatures at both inboxes behind TLS termination; real cryptographic authenticated actor/key GET and Accept verification using controlled remote fixtures; spoofed forwarding/cross-host and malformed Host rejection; body tampering/actor mismatch; private-address safety; earlier body limits; sanitized diagnostics; database reopen/worker recreation preserving actor/keys/followers; and signed actor updates with unique IDs, account/profile/timestamp content, unchanged key documents/content/followers, safe queue failures and preserved CSRF protection. Integration verification remains local-only. Follow fixtures intercept outbound POSTs instead of issuing real deliveries; no integration/browser/container testing or runtime provisioning was added to CI/release workflows. Current and historical API/schema regressions remain in the full suite. ## Boundaries and rollout Preserve the existing origin, actor username/identity/keys, followers, profile settings/content, API routes/schema bytes/archive discovery, branding and release tooling. No setup gate/lifecycle, database migration, key rotation, homelab mutation, release tag/image publication or production deployment was introduced. No production/live federation writes were performed. See `src/federation/README.md` for proxy requirements, diagnostics, local verification and a separately approved rollout. The in-process queue is still not durable; queueing is not proof of remote delivery. Production rollout, live follows/profile edits and actual remote delivery verification require separate approval.

erik added 1 commit

2026-10-25 19:26:49 -05:00

fix: port federation reliability and profile updates

CI / verify (pull_request) Successful in 45s

Details

c1a022b33e

Task: #task-76fd6333

erik commented

2026-10-25 19:30:25 -05:00

Author

Owner

Independent review — `c1a022b33e`

A separate fresh-context Pi reviewer inspected the full diff, relevant routing/delivery/persistence/settings/security/API archive code, tests and locked Fedify internals with read/grep/find/ls only. Result: No actionable defects found.

Review confirmed operator-owned canonical origin/Host verification, authenticated loader option and identity preservation, shared app/worker queue and persisted keys, protected profile updates with unique IDs and accurate queue-failure reporting, sanitized diagnostics, and retained reference-host/browser-security behavior. It found the controlled tests meaningfully exercise real cryptographic verification and production loader paths rather than only mocked success.

Optional suggestion: add a local-only real InProcessMessageQueue retry/stop regression. Deferred as non-blocking follow-up: the underlying queue implementation is unchanged, manual fixtures intentionally skip delayed retries, and these tests establish app/worker wiring and recreation but do not claim real delayed-retry timing or durable queue behavior.

Verification limits: independent review was static/read-only and did not rerun tests or verify production interoperability. Implementation-session checks separately passed scripts/pre-pr.sh (521 tests in 53 files, formatting/types/build/CSS reproducibility) and Forgejo PR CI run #55 for this exact commit. CI was checked using fj actions tasks because fj pr status has a known response-parsing issue.

No release tag/image publication, production deployment, homelab change, migration/key rotation or live federation writes were performed or authorized. Queueing success is not proof of delivery; live rollout verification still requires separate approval.

## Independent review — c1a022b33e8d375077d2d398340fde1334528785 A separate fresh-context Pi reviewer inspected the full diff, relevant routing/delivery/persistence/settings/security/API archive code, tests and locked Fedify internals with read/grep/find/ls only. Result: **No actionable defects found.** Review confirmed operator-owned canonical origin/Host verification, authenticated loader option and identity preservation, shared app/worker queue and persisted keys, protected profile updates with unique IDs and accurate queue-failure reporting, sanitized diagnostics, and retained reference-host/browser-security behavior. It found the controlled tests meaningfully exercise real cryptographic verification and production loader paths rather than only mocked success. Optional suggestion: add a local-only real InProcessMessageQueue retry/stop regression. Deferred as non-blocking follow-up: the underlying queue implementation is unchanged, manual fixtures intentionally skip delayed retries, and these tests establish app/worker wiring and recreation but do not claim real delayed-retry timing or durable queue behavior. Verification limits: independent review was static/read-only and did not rerun tests or verify production interoperability. Implementation-session checks separately passed scripts/pre-pr.sh (521 tests in 53 files, formatting/types/build/CSS reproducibility) and Forgejo PR CI run #55 for this exact commit. CI was checked using fj actions tasks because fj pr status has a known response-parsing issue. No release tag/image publication, production deployment, homelab change, migration/key rotation or live federation writes were performed or authorized. Queueing success is not proof of delivery; live rollout verification still requires separate approval.

erik merged commit 418a628a16 into main

2026-10-25 19:30:26 -05:00

erik deleted branch feat/task-76fd6333-federation-reliability

2026-10-25 19:30:26 -05:00

erik referenced this pull request from a commit

2026-10-25 19:30:26 -05:00

Merge pull request 'Port federation reliability and actor-profile updates' (#57) from feat/task-76fd6333-federation-reliability into main

erik referenced this pull request

2026-10-25 20:36:25 -05:00

Add database readiness and native container health checks #58