57696286e4
Task group 3 of federation-hardening. There was no blocklist of any kind;
the only lever against a hostile instance was an IP/host block in Caddy.
- New `federation_blocked_instances` table (domain PK, reason,
created_at). Additive → created by drizzle-kit push.
- `federation-blocklist.server.ts`: exact-host matching —
`isBlockedDomain`, `isBlockedIri` (unparseable IRI ⇒ treated as
blocked), and `filterBlockedDomains` for batch recipient filtering.
- Enforced at all three boundaries (spec: federation-operations
"Instance blocklist"):
- inbox — each of the 4 listeners silently drops a blocked actor's
activity (202, no error oracle) before dedup/side effects;
- delivery enqueue — `enqueueActivityDeliveries` filters blocked
recipients in one batch query;
- outbox poll / actor fetch — `pollRemoteActor` refuses a blocked host
up front (`skipped: "blocked instance"`), before any network.
- Operator procedure (SQL insert/list/delete) documented in the
deployment runbook's federation section.
- Tests: unit (hostOfIri) + integration against real Postgres covering
the helper and the delivery + outbox boundaries; inbox uses the same
tested isBlockedIri primitive.
Note: the inbox-drop *counter* (federation_inbox_dropped_total{reason})
lands with the other metrics in task 4.2; this commit is the enforcement.
Verified: db + journal typecheck + lint clean; drizzle-kit push creates
the table; blocklist integration tests green against real Postgres;
journal unit suite 357 passing.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
54 lines
2 KiB
TypeScript
54 lines
2 KiB
TypeScript
// Instance blocklist (spec: federation-operations "Instance blocklist").
|
|
// A blocked domain is inert in both directions: its inbound activities are
|
|
// silently dropped, we send it no deliveries, and we don't fetch its
|
|
// actors/outboxes. Matching is exact-host (subdomain wildcarding is
|
|
// deferred until a real need). Management is a documented operator SQL
|
|
// procedure — see FEDERATION.md — with this table as the seam a future
|
|
// admin UI can sit on.
|
|
|
|
import { inArray, eq } from "drizzle-orm";
|
|
import { federationBlockedInstances } from "@trails-cool/db/schema/journal";
|
|
import { getDb } from "./db.ts";
|
|
|
|
/** The host of an actor/object IRI, or null if it doesn't parse. */
|
|
export function hostOfIri(iri: string): string | null {
|
|
try {
|
|
return new URL(iri).host;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
/** Whether an exact host is on the blocklist. */
|
|
export async function isBlockedDomain(domain: string): Promise<boolean> {
|
|
const db = getDb();
|
|
const [row] = await db
|
|
.select({ domain: federationBlockedInstances.domain })
|
|
.from(federationBlockedInstances)
|
|
.where(eq(federationBlockedInstances.domain, domain))
|
|
.limit(1);
|
|
return row !== undefined;
|
|
}
|
|
|
|
/** Whether an actor/object IRI's host is blocked. Unparseable IRIs are
|
|
* treated as blocked — we won't process something we can't attribute. */
|
|
export async function isBlockedIri(iri: string): Promise<boolean> {
|
|
const host = hostOfIri(iri);
|
|
if (host === null) return true;
|
|
return isBlockedDomain(host);
|
|
}
|
|
|
|
/**
|
|
* The subset of `domains` that are blocked, resolved in one query. Used
|
|
* by delivery fan-out to filter a batch of recipients without a query per
|
|
* recipient.
|
|
*/
|
|
export async function filterBlockedDomains(domains: string[]): Promise<Set<string>> {
|
|
if (domains.length === 0) return new Set();
|
|
const db = getDb();
|
|
const rows = await db
|
|
.select({ domain: federationBlockedInstances.domain })
|
|
.from(federationBlockedInstances)
|
|
.where(inArray(federationBlockedInstances.domain, domains));
|
|
return new Set(rows.map((r) => r.domain));
|
|
}
|