fix(api): enforce federation jsonld context

Author: skulidropek

packages/api/src/api/contracts.ts

@@ -490,6 +490,26 @@ export type ContainerTaskSnapshot = {
   readonly agents: ReadonlyArray<AgentSession>
 }
 
+export const activityStreamsJsonLdContext = "https://www.w3.org/ns/activitystreams" as const
+export const forgeFedJsonLdContext = "https://forgefed.org/ns" as const
+export const securityJsonLdContext = "https://w3id.org/security/v1" as const
+export const activityForgeFedJsonLdContext = [
+  activityStreamsJsonLdContext,
+  forgeFedJsonLdContext
+] as const
+export const actorJsonLdContext = [
+  activityStreamsJsonLdContext,
+  securityJsonLdContext,
+  forgeFedJsonLdContext
+] as const
+export const federationJsonLdContentType =
+  `application/ld+json; profile="${activityStreamsJsonLdContext}"` as const
+export const federationJsonLdResponseContentType =
+  `${federationJsonLdContentType}; charset=utf-8` as const
+
+export type ActivityForgeFedJsonLdContext = typeof activityForgeFedJsonLdContext
+export type ActorJsonLdContext = typeof actorJsonLdContext
+
 export type ForgeFedTicket = {
   readonly id: string
   readonly attributedTo: string
@@ -550,7 +570,7 @@ export type CreateFollowRequest = {
 export type FollowStatus = "pending" | "accepted" | "rejected"
 
 export type ActivityPubFollowActivity = {
-  readonly "@context": string | ReadonlyArray<string>
+  readonly "@context": ActivityForgeFedJsonLdContext
   readonly id: string
   readonly type: "Follow"
   readonly actor: string
@@ -566,7 +586,7 @@ export type ActivityPubPublicKey = {
 }
 
 export type ActivityPubPerson = {
-  readonly "@context": "https://www.w3.org/ns/activitystreams"
+  readonly "@context": ActorJsonLdContext
   readonly type: "Person"
   readonly id: string
   readonly name: string
@@ -584,7 +604,7 @@ export type ActivityPubPerson = {
 }
 
 export type ActivityPubOrderedCollection = {
-  readonly "@context": "https://www.w3.org/ns/activitystreams" | ReadonlyArray<string>
+  readonly "@context": ActivityForgeFedJsonLdContext
   readonly type: "OrderedCollection"
   readonly id: string
   readonly totalItems: number

packages/api/src/http.ts

@@ -11,7 +11,7 @@ import * as Schema from "effect/Schema"
 import { renderError, type AppError } from "@effect-template/lib/usecases/errors"
 
 import { ApiAuthRequiredError, ApiBadRequestError, ApiConflictError, ApiInternalError, ApiNotFoundError, describeUnknown } from "./api/errors.js"
-import type { ApplyProjectRequest } from "./api/contracts.js"
+import { federationJsonLdResponseContentType, type ApplyProjectRequest } from "./api/contracts.js"
 import {
   AuthMenuRequestSchema,
   AuthTerminalSessionRequestSchema,
@@ -275,8 +275,8 @@ const binaryResponse = (data: Uint8Array, contentType: string, status = 200) =>
     )
   )
 
-const activityJsonResponse = (data: unknown, status: number) =>
-  textResponse(JSON.stringify(data), "application/activity+json; charset=utf-8", status)
+const jsonLdResponse = (data: unknown, status: number) =>
+  textResponse(JSON.stringify(data), federationJsonLdResponseContentType, status)
 
 const parseQueryInt = (url: string, key: string, fallback: number): number => {
   const parsed = Number(new URL(url, "http://localhost").searchParams.get(key) ?? "")
@@ -595,6 +595,13 @@ export const federationExchangeStatusResponse = () =>
     return yield* _(jsonResponse(makeFederationExchangeStatus(context), 200))
   }).pipe(Effect.catchAll(errorResponse))
 
+export const federationActorDocumentResponse = () =>
+  Effect.gen(function*(_) {
+    const request = yield* _(HttpServerRequest.HttpServerRequest)
+    const context = yield* _(resolveFederationContext(request))
+    return yield* _(jsonLdResponse(makeFederationActorDocument(context), 200))
+  }).pipe(Effect.catchAll(errorResponse))
+
 const terminalWebSocketUpgradeResponse = Effect.gen(function*(_) {
   const request = yield* _(HttpServerRequest.HttpServerRequest)
   const upgrade = readHeader(request, "upgrade")?.toLowerCase()
@@ -859,42 +866,38 @@ export const makeRouter = () => {
     ),
     HttpRouter.get(
       "/federation/actor",
-      Effect.gen(function*(_) {
-        const request = yield* _(HttpServerRequest.HttpServerRequest)
-        const context = yield* _(resolveFederationContext(request))
-        return yield* _(activityJsonResponse(makeFederationActorDocument(context), 200))
-      }).pipe(Effect.catchAll(errorResponse))
+      federationActorDocumentResponse()
     ),
     HttpRouter.get(
       "/federation/outbox",
       Effect.gen(function*(_) {
         const request = yield* _(HttpServerRequest.HttpServerRequest)
         const context = yield* _(resolveFederationContext(request))
-        return yield* _(activityJsonResponse(makeFederationOutboxCollection(context), 200))
+        return yield* _(jsonLdResponse(makeFederationOutboxCollection(context), 200))
       }).pipe(Effect.catchAll(errorResponse))
     ),
     HttpRouter.get(
       "/federation/followers",
       Effect.gen(function*(_) {
         const request = yield* _(HttpServerRequest.HttpServerRequest)
         const context = yield* _(resolveFederationContext(request))
-        return yield* _(activityJsonResponse(makeFederationFollowersCollection(context), 200))
+        return yield* _(jsonLdResponse(makeFederationFollowersCollection(context), 200))
       }).pipe(Effect.catchAll(errorResponse))
     ),
     HttpRouter.get(
       "/federation/following",
       Effect.gen(function*(_) {
         const request = yield* _(HttpServerRequest.HttpServerRequest)
         const context = yield* _(resolveFederationContext(request))
-        return yield* _(activityJsonResponse(makeFederationFollowingCollection(context), 200))
+        return yield* _(jsonLdResponse(makeFederationFollowingCollection(context), 200))
       }).pipe(Effect.catchAll(errorResponse))
     ),
     HttpRouter.get(
       "/federation/liked",
       Effect.gen(function*(_) {
         const request = yield* _(HttpServerRequest.HttpServerRequest)
         const context = yield* _(resolveFederationContext(request))
-        return yield* _(activityJsonResponse(makeFederationLikedCollection(context), 200))
+        return yield* _(jsonLdResponse(makeFederationLikedCollection(context), 200))
       }).pipe(Effect.catchAll(errorResponse))
     ),
     HttpRouter.get(