ActivityPub Integration

Overview

Discussion and design of ActivityPub / Mastodon with ENiGMA½.

Act as both a server and a client
- On behalf of users
- As the BBS itself (bot)
Feed views
- Local
- Federated
- Following
Inbox
- Direct replies also land in user's inbox
- User can again reply, or directly post to ActivityPub addresses
- Similar to EchoMail
Message Areas
- Ability to map a message area to a ActivityPub 'group'
- Read and reply in message base
- Similar to EchoMail
- Bridged message areas, such as FTN (non-Mastodon node) <-> Local (Mastodon) <-> Fediverse
Users
- Users should be aware of any Mastodon bridged message networks or any time their messages land on Mastodon in general

First class Mastodon support

Add additional info/debug/warn/error logging to web.js to help track down issues and to (long term) help identify abuse by logging IP, maybe correlation id, etc etc.
Looks like Mastodon is adding some Group functionality that might make my suggested workaround for message areas unnecessary (depends on timing, I see anything about when it will be released though it does look like it is funded work): https://github.com/mastodon/mastodon/pull/19059

In order to interoperate with Mastodon, we need to implement HTTP Signatures. More info at: https://docs.joinmastodon.org/spec/security/
- Implementation in activitypub-express
- Based on node-http-signature - probably a good idea for us to use as well
- Private / Public keypairs are generated with the Node.JS crypto library.
- Notes on approach:
  1. Need to create a new public / private keypair and store in the db on account creation (or one-time during migration)
  2. As subscribe requests occur or lookups to other servers, the Actor object needs to be stored into the database
  3. On outbound requests from the the BBS that involve an actor, the private key is used to sign the requests
  4. On incoming requests that involve a remote actor, the public key stored for the actor is used to verify the signature
With increased usage of HTTP with ActivityPub/Mastodon support, we should look at additional security testing as well. See: Free for Open-Source App Security Tools for some tools that are free for Open Source projects.

Should we create a more generalized ActivityPub support/module/classes that Mastodon then extends?
How are we going to deal with profile pictures and banners? Have users upload them to the BBS? Add URLs on account creation? Both?
- Two main properties in actor: image and icon
Is the web part of this big enough that we should look into using something like express.js and a module like activitypub-express instead of rolling our own implementation - ANSWER: not at this time, we are going to try to create our own first
How to allow users to choose to use real vs username for Mastodon specific browse/follow/reply/etc.
- Note: Message areas have the ability to control this currently
How to handle follower approval (manuallyApprovesFollowers actor property)

core/
  servers/
    content/
      web.js
      web_handlers/
        webfinger.js
        mastodon.js

webfinger.js
- Handles standard WebFinger requests via acct:
- Handles standard profile request associated with WebFinger
- Includes additional rel and aliases if an ActivityPub system is also enabled, such as Mastodon
  - It would be nice if these could be 'injected' by mastdon.js
mastodon.js
- An ActivityPub implementation with Mastodon extensions