Let remote curators feature Groups in their collections (FEP-7aa9)

package.json

@@ -71,7 +71,10 @@
       "esbuild",
       "protobufjs",
       "sharp"
-    ]
+    ],
+    "patchedDependencies": {
+      "@fedify/fedify@2.4.2": "patches/@fedify__fedify@2.4.2.patch"
+    }
   },
   "devDependencies": {
     "@lingui/cli": "5.9.5",

patches/@fedify__fedify@2.4.2.patch

@@ -0,0 +1,45 @@
+diff --git a/dist/middleware-BqefXH6B.js b/dist/middleware-BqefXH6B.js
+index 51dee9c19027e60c6b0455def7b40da1af27179e..aa3223fa4d8bc4fc6611c61c3ed72900d9c99e13 100644
+--- a/dist/middleware-BqefXH6B.js
++++ b/dist/middleware-BqefXH6B.js
+@@ -6003,6 +6003,40 @@ async function handleInboxInternal(request, parameters, span) {
+ 		status: "verified",
+ 		attempts: observation.verification.attempts.filter((attempt) => attempt.status === "verified")
+ 	};
++	// [moim patch] FEP-7aa9 interop: Mastodon's FeatureRequest carries no `actor`
++	// (the FEP example omits it; Pixelfed accepts it the same way). Mastodon always
++	// HTTP-signs deliveries, so authenticate the request by its HTTP Signature here
++	// (Fedify skips that step once an LD Signature or proof has verified the body)
++	// and use the key owner as the actor instead of rejecting with "Missing actor".
++	if (activity.actorId == null && !skipSignatureVerification && getTypeId(activity).href === "https://w3id.org/fep/7aa9#FeatureRequest") {
++		let signerKey = httpSigKey;
++		if (signerKey == null) {
++			const verification = await verifyRequestDetailed(request, {
++				contextLoader: ctx.contextLoader,
++				documentLoader: ctx.documentLoader,
++				timeWindow: signatureTimeWindow,
++				maxSignatures: maxHttpSignatures,
++				keyCache,
++				meterProvider,
++				tracerProvider
++			});
++			if (verification.verified) signerKey = verification.key;
++		}
++		const signer = signerKey == null ? null : await getKeyOwner(signerKey, {
++			documentLoader: ctx.documentLoader,
++			contextLoader: ctx.contextLoader,
++			tracerProvider
++		});
++		if (signer?.id != null) {
++			logger.debug("FeatureRequest has no actor; using the HTTP signature key owner {actorId} as the actor (FEP-7aa9 interop).", {
++				actorId: signer.id.href,
++				recipient
++			});
++			if (json != null && typeof json === "object" && !Array.isArray(json)) json.actor = signer.id.href;
++			if (compactedJson != null && compactedJson !== json && typeof compactedJson === "object" && !Array.isArray(compactedJson)) compactedJson.actor = signer.id.href;
++			activity = activity.clone({ actor: signer.id });
++		} else logger.warn("FeatureRequest has no actor and its HTTP Signature could not be resolved to an owner.", { recipient });
++	}
+ 	observation.stage = "dispatch";
+ 	const routeResult = await routeActivity({
+ 		context: ctx,

src/server/fediverse/featured-collections.ts

@@ -0,0 +1,44 @@
+/**
+ * FEP-7aa9 (Featured Collections) support — consumer side only.
+ *
+ * Moim lets remote curators (e.g. Mastodon "Collections") feature local
+ * Group actors. This is intentionally stateless: the approval stamp
+ * (`FeatureAuthorization`) encodes the collection URI in its own URL, so
+ * no table is needed. A stamp is valid as long as the Group still exists
+ * and its policy still allows the curator.
+ */
+import { InteractionPolicy, InteractionRule, PUBLIC_COLLECTION } from "@fedify/vocab";
+import type { Context } from "@fedify/fedify";
+
+/** Path segment: base64url of the collection URI (URL-safe, no padding). */
+export function encodeCollectionUri(collection: URL): string {
+  return Buffer.from(collection.href, "utf8").toString("base64url");
+}
+
+export function decodeCollectionUri(segment: string): URL | null {
+  try {
+    const href = Buffer.from(segment, "base64url").toString("utf8");
+    const url = new URL(href);
+    if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+    return url;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Who may feature this Group. Mirrors Mastodon's own rule:
+ * locked (manually approves followers) → followers only; otherwise anyone.
+ */
+export function buildFeaturePolicy(
+  ctx: Context<void>,
+  identifier: string,
+  manuallyApprovesFollowers: boolean,
+): InteractionPolicy {
+  const allowed = manuallyApprovesFollowers
+    ? ctx.getFollowersUri(identifier)
+    : PUBLIC_COLLECTION;
+  return new InteractionPolicy({
+    canFeature: new InteractionRule({ automaticApprovals: [allowed] }),
+  });
+}

src/server/fediverse/federation.ts

@@ -5,6 +5,8 @@ import {
   Create,
   EmojiReact,
   Endpoints,
+  FeatureAuthorization,
+  FeatureRequest,
   Follow,
   Group,
   Image,
@@ -46,6 +48,11 @@ import {
   users,
 } from "~/server/db/schema";
 import { ensureRemoteActor } from "~/server/fediverse/actor-cache";
+import {
+  buildFeaturePolicy,
+  decodeCollectionUri,
+  encodeCollectionUri,
+} from "~/server/fediverse/featured-collections";
 import { env } from "~/server/env";
 import { getI18n } from "~/server/i18n";
 import { EMOJI_SET } from "~/server/fediverse/otp";
@@ -231,6 +238,13 @@ federation
         following: ctx.getFollowingUri(identifier),
         followers: ctx.getFollowersUri(identifier),
         manuallyApprovesFollowers: actor.manuallyApprovesFollowers,
+        // FEP-7aa9: let remote curators feature this group in their collections
+        discoverable: true,
+        interactionPolicy: buildFeaturePolicy(
+          ctx,
+          identifier,
+          actor.manuallyApprovesFollowers,
+        ),
         icon: actor.avatarUrl
           ? new Image({
               url: new URL(`/avatars/${actor.id}.webp`, env.baseUrl),
@@ -518,6 +532,38 @@ federation.setObjectDispatcher(
   },
 );
 
+// --- FeatureAuthorization object dispatcher (FEP-7aa9 approval stamp) ---
+// Stateless: the collection URI is encoded in the path, so the stamp is
+// valid as long as the Group exists. Remote servers verify a FeaturedItem by
+// fetching this and comparing interactingObject / interactionTarget.
+federation.setObjectDispatcher(
+  FeatureAuthorization,
+  "/ap/feature-authorizations/{identifier}/{collection}",
+  async (ctx, { identifier, collection }) => {
+    const collectionUri = decodeCollectionUri(collection);
+    if (!collectionUri) return null;
+
+    const [actor] = await db
+      .select({ id: actors.id })
+      .from(actors)
+      .where(
+        and(
+          eq(actors.handle, identifier),
+          eq(actors.isLocal, true),
+          eq(actors.type, "Group"),
+        ),
+      )
+      .limit(1);
+    if (!actor) return null;
+
+    return new FeatureAuthorization({
+      id: ctx.getObjectUri(FeatureAuthorization, { identifier, collection }),
+      interactingObject: collectionUri,
+      interactionTarget: ctx.getActorUri(identifier),
+    });
+  },
+);
+
 // --- NodeInfo ---
 federation.setNodeInfoDispatcher("/nodeinfo/2.1", async () => {
   const [result] = await db.select({ total: count() }).from(users);
@@ -810,6 +856,87 @@ federation
         );
     }
   })
+  .on(FeatureRequest, async (ctx, request) => {
+    // FEP-7aa9: a remote curator asks to feature one of our Groups in a
+    // collection. object = our Group, instrument = their collection.
+    if (request.id == null || request.actorId == null) return;
+    if (request.objectId == null || request.instrumentId == null) return;
+
+    const parsed = ctx.parseUri(request.objectId);
+    if (parsed == null || parsed.type !== "actor") return;
+    const identifier = parsed.identifier;
+
+    const [group] = await db
+      .select()
+      .from(actors)
+      .where(
+        and(
+          eq(actors.handle, identifier),
+          eq(actors.isLocal, true),
+          eq(actors.type, "Group"),
+        ),
+      )
+      .limit(1);
+    if (!group) return;
+
+    const curator = await request.getActor();
+    if (curator?.id == null || curator.inboxId == null) return;
+
+    // Locked groups only accept curators who already follow them;
+    // this matches the policy advertised in the actor document.
+    let allowed = !group.manuallyApprovesFollowers;
+    if (!allowed) {
+      const [row] = await db
+        .select({ id: follows.followerId })
+        .from(follows)
+        .innerJoin(actors, eq(follows.followerId, actors.id))
+        .where(
+          and(
+            eq(actors.actorUrl, curator.id.href),
+            eq(follows.followingId, group.id),
+            eq(follows.status, "accepted"),
+          ),
+        )
+        .limit(1);
+      allowed = row != null;
+    }
+
+    if (!allowed) {
+      await ctx.sendActivity(
+        { identifier },
+        curator,
+        new Reject({
+          id: new URL(
+            `#rejects/feature-requests/${encodeCollectionUri(request.instrumentId)}`,
+            ctx.getActorUri(identifier),
+          ),
+          actor: ctx.getActorUri(identifier),
+          to: curator.id,
+          object: request.id,
+        }),
+      );
+      return;
+    }
+
+    const collection = encodeCollectionUri(request.instrumentId);
+    await ctx.sendActivity(
+      { identifier },
+      curator,
+      new Accept({
+        id: new URL(
+          `#accepts/feature-requests/${collection}`,
+          ctx.getActorUri(identifier),
+        ),
+        actor: ctx.getActorUri(identifier),
+        to: curator.id,
+        object: request.id,
+        result: ctx.getObjectUri(FeatureAuthorization, {
+          identifier,
+          collection,
+        }),
+      }),
+    );
+  })
   .on(Create, async (ctx, create) => {
     const object = await create.getObject();
     if (!(object instanceof Note)) return;