ActivityPub user and category outboxes coming soon
-
Up until today, when you queried a NodeBB user or category's
outbox, you would receive an emptyOrderedCollection. This was done because the property's inclusion in the actor object was required, but it was not immediately apparent in 2024 how many people utilised this property. Thus it was easier to just send the empty outbox and pursue more urgent functionality.While sending that empty outbox has not broken any implementations, but it has come to my attention that a few (read: more than 1) other implementors already do, or plans to, read from an actor outbox for backfill purposes.
The upcoming NodeBB v4.10.0 will contain an outbox populated by the contributions by that user or category.
Here's how that works...
For both users and categories, a standard
OrderedCollectionis returned, withfirst,last,prev, andnextproperties for navigation.For users:
- A combined set of the user's activity is returned in the form of activities (
Create,Like, etc.) — these activities include the user's posts, votes (both up and down), and shares. - Unlike other collections, this one uses a cursor. You can pass
?before=or?after=values in the query string to retrieve items 20 at a time.
For categories:
- A set of posts curated by this category is shown. It can contain both posts local to the instance, and remote posts from outside of the instance.
- All posts are wrapped in the
Announceactivity. If the post is local, it is anAnnounce(Create(Note/Article)), if it is a remote post, then it is just anAnnounce(Object)by reference. - This collection is paged like other collections served by NodeBB.
It is possible that this implementation serves data in an unexpected manner. If this is the case, please reply here to contact me directly so it can be fixed.
I used my best judgement for what to include in the outboxes, as well as using Piefed as a reference implementation. @rimu@piefed.social, I notice that Piefed's community outboxes serve up
Announce(Create(Page))even if the Page is not local to the instance. I was under the assumption that remote content couldn't (shouldn't?) be expanded in this manner because you cannot guarantee the integrity of the data, and so announcing the object by reference is preferred. Just wondering your thoughts on that. - A combined set of the user's activity is returned in the form of activities (
-
? Guest crossposted this topic to General Discussion
-
T tag-activitypub@relay.fedi.buzz shared this topic
-
@julian @rimu I think it's fine to include
Announces of remoteCreate(Page)s as long asAnnounce.actoris local. However, consumers must not trust the embedded activity, and fetch it by its ID (or verify FEP-8b32 integrity proof, if present).(apparently PieFed outboxes are served with a wrong content type,
application/json?) -
@julian @rimu I think it's fine to include
Announces of remoteCreate(Page)s as long asAnnounce.actoris local. However, consumers must not trust the embedded activity, and fetch it by its ID (or verify FEP-8b32 integrity proof, if present).(apparently PieFed outboxes are served with a wrong content type,
application/json?)Really? I can wrap a remote object in a Create of my own?
I suppose nothing is stopping me but I figured it was disingenuous.
-
@julian
Createis a bit more complicated because creating something that is not yours doesn't make much sense. However, if we focus solely on authentication, it's fine too. IfCreate.objecthas different origin thanCreate, just fetch it from there. -
Yeah that's the tricky part, since I've thrown away the original create long ago, so if I'm including it in the outbox after the fact all I can really do is Announce(Object) by reference, even if originally when it happened I might've properly announced the whole activity... I know Mastodon understands Announce(Object), but is that a proper use case?
-
@julian I think it's a good workaround if you don't keep original activities.
-
@julian @rimu I think it's fine to include
Announces of remoteCreate(Page)s as long asAnnounce.actoris local. However, consumers must not trust the embedded activity, and fetch it by its ID (or verify FEP-8b32 integrity proof, if present).(apparently PieFed outboxes are served with a wrong content type,
application/json?)I'll fix the content type, thanks!
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login