Closed jpgoldberg closed 7 months ago
Thank you! I will review it thoroughly this weekend.
Whilst I cannot review this, @jpgoldberg I think what you'll actually want to do is make a webfinger request:
https://host.example/.well-known/webfinger?resource=acct:username@host.example
this'll either succeed or fail, and gives the URLs to any such profile.
e.g., mine:
{
"subject" : "acct:thisismissem@hachyderm.io",
"aliases" : [
"https://hachyderm.io/@thisismissem",
"https://hachyderm.io/users/thisismissem"
],
"links" : [
{
"rel" : "http://webfinger.net/rel/profile-page",
"type" : "text/html",
"href" : "https://hachyderm.io/@thisismissem"
},
{
"rel" : "self",
"type" : "application/activity+json",
"href" : "https://hachyderm.io/users/thisismissem"
},
{
"rel" : "http://ostatus.org/schema/1.0/subscribe",
"template" : "https://hachyderm.io/authorize_interaction?uri={uri}"
},
{
"rel" : "http://webfinger.net/rel/avatar",
"type" : "image/jpeg",
"href" : "https://media.hachyderm.io/accounts/avatars/109/296/581/037/186/439/original/b55ac3f3a27e171e.jpeg"
}
]
}
Whilst I cannot review this, @jpgoldberg I think what you'll actually want to do is make a webfinger request:
https://host.example/.well-known/webfinger?resource=acct:username@host.example
Oh, that is a very cool thing. I did not know about it. (As you see, I really know very little about the protocols associated with Mastodon.)
But I do not want to take that approach for two (related) reasons
I do not want to make a query to https://host.example/
before knowing that "host.example
is syntactically valid. Attempting to use malformed data to see if it breaks as a way to test for its validity is the road to many security bugs. Instead, we should always check that something is syntactically valid before attempting to use it. Making a network call with potentially malformed data is a use, even if the use is intended as a validity check.
I would like to be able to construct the CV without a network connection. The CV should build off-line.
I really am a stickler for checking syntactic validity before any use. And, as you see, I do not pass up the opportunity to rant/lecture about it. Checking strict syntactic validity before any use is a really good habit to get into, and it prevents security issues that might otherwise arise years later.
Hello, if you're not working on this PR, I would like to merge it as it is.
The purpose of this PR is to add Mastodon as a social network, resolving issue #11.
Unlike the other social networks supported, there is no fixed hostname for the URL. Instead the hostname for the URL must be constructed from the full Mastodon address.
That is, a mastodon address may look like "
a_tooter@social.example
" which should then have the associated url be "https://social.example/@a_tooter
"Why is this PR more complicated than one might expect?
This really seems like it would be a simple fix.
Mastodon specs and DNS hostnames
Unfortunately there is no formal specification for these things. I am grateful @ThisIsMissEm for pointing me to the relevant lines of Mastodon reference implementation.
Unfortunately, what I glean from that would allow syntactically invalid hostnames. And so I included stricter validation of hostnames. Perhaps I failed to understand the Pydantic and dnspython documentation packages, but I found no obvious way to validate hostnames properly. So I resorted to a stack exchange answer.
I wasn't sure where to put my Mastodon address handling methods, so they are static methods in data_model.Connections.
Getting things to run
I need to tinker with
pyproject.toml
to get even the original to build on my system. I do not believe that I've done any harm, but testers should make sure that I haven't messed up build or packaging process.I also added tests, and to make it easier for me to run tests tinkered with
tests/test_data_model.py
. Again, I don't think I did anything that should interfere with other testing.