ActivityPub user and category outboxes coming soon

julian

Up until today, when you queried a NodeBB user or category's outbox, you would receive an empty OrderedCollection. This was done because the property's inclusion in the actor object was required, but it was not immediately apparent in 2024 how many people utilised this property. Thus it was easier to just send the empty outbox and pursue more urgent functionality.

While sending that empty outbox has not broken any implementations, but it has come to my attention that a few (read: more than 1) other implementors already do, or plans to, read from an actor outbox for backfill purposes.

The upcoming NodeBB v4.10.0 will contain an outbox populated by the contributions by that user or category.

Here's how that works...

For both users and categories, a standard OrderedCollection is returned, with first, last, prev, and next properties for navigation.

For users:

A combined set of the user's activity is returned in the form of activities (Create, Like, etc.) — these activities include the user's posts, votes (both up and down), and shares.
Unlike other collections, this one uses a cursor. You can pass ?before= or ?after= values in the query string to retrieve items 20 at a time.

For categories:

A set of posts curated by this category is shown. It can contain both posts local to the instance, and remote posts from outside of the instance.
All posts are wrapped in the Announce activity. If the post is local, it is an Announce(Create(Note/Article)), if it is a remote post, then it is just an Announce(Object) by reference.
This collection is paged like other collections served by NodeBB.

It is possible that this implementation serves data in an unexpected manner. If this is the case, please reply here to contact me directly so it can be fixed.

I used my best judgement for what to include in the outboxes, as well as using Piefed as a reference implementation. @rimu@piefed.social, I notice that Piefed's community outboxes serve up Announce(Create(Page)) even if the Page is not local to the instance. I was under the assumption that remote content couldn't (shouldn't?) be expanded in this manner because you cannot guarantee the integrity of the data, and so announcing the object by reference is preferred. Just wondering your thoughts on that.

silverpill

@julian @rimu I think it's fine to include Announces of remote Create(Page)s as long as Announce.actor is local. However, consumers must not trust the embedded activity, and fetch it by its ID (or verify FEP-8b32 integrity proof, if present).

(apparently PieFed outboxes are served with a wrong content type, application/json ?)

julian

Really? I can wrap a remote object in a Create of my own?

I suppose nothing is stopping me but I figured it was disingenuous.

silverpill

@julian Create is a bit more complicated because creating something that is not yours doesn't make much sense. However, if we focus solely on authentication, it's fine too. If Create.object has different origin than Create, just fetch it from there.

silverpill

FEP-fe34 currently lists 3 scenarios where you can trust an embedded object:

- An embedded object has the same origin and the same owner as the wrapping object.
- An embedded object is identified as a fragment of the wrapping object.
- An embedded object is anonymous (doesn't have an ID).

This may look too strict, but that's because I was taking C2S into account, where actors can create arbitrary objects and embed all kind of things in them.

julian

Yeah that's the tricky part, since I've thrown away the original create long ago, so if I'm including it in the outbox after the fact all I can really do is Announce(Object) by reference, even if originally when it happened I might've properly announced the whole activity... I know Mastodon understands Announce(Object), but is that a proper use case?