Sorry for the rapid-fire pull requests. I want to make sure that I'm including the references that @thisismissem gave me for open redirects, and I realized that I could make the (close-window) action a little less verbose.
Reviewed-on: https://codeberg.org/fediverse/fep/pulls/428
Co-authored-by: Ben Pate <ben@pate.org>
Co-committed-by: Ben Pate <ben@pate.org>
I've expanded and updated the information about open redirects, an OWASP vulnerability that servers MUST mitigate if they implement the `on-success` and `on-cancel` workflows. Thanks to @thisismissem@hachyderm.io for information and guidance on this.
Reviewed-on: https://codeberg.org/fediverse/fep/pulls/427
Co-authored-by: Ben Pate <ben@pate.org>
Co-committed-by: Ben Pate <ben@pate.org>
This FEP documents the `searchableBy` extension property introduced by Fedibird.
I'm not the maintainer of Fedibird, but I've contacted the maintainer and confirmed that they are okay with me submitting a FEP for the extension.
Reviewed-on: https://codeberg.org/fediverse/fep/pulls/420
Co-authored-by: Daiki Mizukami <tesaguriguma@gmail.com>
Co-committed-by: Daiki Mizukami <tesaguriguma@gmail.com>
Note: This PR copies `context.jsonld` to `fep-xxxx.jsonld` for any FEP that has an existing context document. This is intended to prevent breakage from the proposed change, which resolves `https://w3id.org/fep/xxxx` with `Accept: application/ld+json` requests to `fep/xxxx/fep-xxxx.jsonld` instead of to `fep/xxxx/context.jsonld`. This change is part of broader support for machine-readable definitions. Going forward, 888d intends to support a merged JSON-LD document that contains both a `@context` key for usage as a context document as well as a `@graph` key for usage as an ontology.
A corresponding w3id.org PR on GitHub will be filed after this one is merged.
fediverse.codeberg.page is used for everything except JSON-LD, because that subdomain will serve files with the correct content types, while raw.codeberg.page will serve all text files as text/plain. The reason JSON-LD requests still link to raw.codeberg.page is because that subdomain will serve files with `Access-Control-Allow-Origin: *` and thus support in-browser tools like `https://json-ld.org/playground`. See https://codeberg.org/Codeberg/pages-server/issues/289 for more details about this issue.
Reviewed-on: https://codeberg.org/fediverse/fep/pulls/412
Co-authored-by: a <a@trwnh.com>
Co-committed-by: a <a@trwnh.com>
- Require shortcode in content to be enclosed in colons.
- Added a note about possible constraints on number of reactions.
- Added example of Undo(EmojiReact) activity.
- Added "Implementations" section.
Reviewed-on: https://codeberg.org/fediverse/fep/pulls/404
Co-authored-by: silverpill <silverpill@firemail.cc>
Co-committed-by: silverpill <silverpill@firemail.cc>
This FEP describes the conversation threads extension, with two properties.
`thread`: the collection of objects in this object's conversation thread
`root`: the root object of a thread
It includes processing recommendations, examples, and security considerations.
Co-authored-by: Evan Prodromou <codeberg@evanprodromou.name>
Reviewed-on: https://codeberg.org/fediverse/fep/pulls/406
Co-authored-by: Evan Prodromou <evanp@noreply.codeberg.org>
Co-committed-by: Evan Prodromou <evanp@noreply.codeberg.org>
- Require path to be an opaque string.
- Clarify that custom query parameters should not be used.
- Added "Authentication and authorization" section.
- Added description of WebFinger address reverse discovery in compatibility mode.
- Corrected description of a relationship between proof.verificationMethod and URL authority.
- Fixed incorrect verificationMethod values in examples.
- Discuss follow-your-nose discovery.
- Rearranged "Discussion" subsections.
Reviewed-on: https://codeberg.org/fediverse/fep/pulls/397
Co-authored-by: silverpill <silverpill@firemail.cc>
Co-committed-by: silverpill <silverpill@firemail.cc>
- Use "same origin" principle instead of "same owner" in authentication.
- Self-ownership of actors.
- Ownership of public keys and verification methods.
- Owner must be an actor and must not change.
- Generalize unattributed collection rule to all objects.
Reviewed-on: https://codeberg.org/fediverse/fep/pulls/387
Co-authored-by: silverpill <silverpill@firemail.cc>
Co-committed-by: silverpill <silverpill@firemail.cc>
Servers can advertise what features of the API they support, such as creating a poll or boosting a post. Clients can recognize if a server doesn't support a feature and hide it from the UI.
This proposal overlaps a little with FEP-9fde and FEP-6481. Special thanks to Nik Clayton who inspired this with his FEP and discussion at FediForum. The main difference with this is we attempt to describe what features a server supports based on ActivityStreams types instead of new identifiers or URIs. For that reason, it felt right to start with a new FEP rather than update either of those existing FEPs.
I'm happy to collaborate with anyone on this. When there is some consensus that we're on the right track, I plan to take an open source Mastodon API client and adapt it to support this as a proof of concept.
Reviewed-on: https://codeberg.org/fediverse/fep/pulls/378
Co-authored-by: Manton Reece <manton@me.com>
Co-committed-by: Manton Reece <manton@me.com>
Helge
silverpill
a
Steve Bate
Ben Pate
Daiki Mizukami
Steve Bate
bumblefudge
Arnold Schrijver
Evan Prodromou
trwnh
ilja
Manton Reece
Tobias Diekershoff
silverpill