summaryrefslogtreecommitdiff
path: root/internal/web
AgeCommit message (Collapse)AuthorFiles
2025-04-29[chore] tweak NoLLaMas proof-of-work algorithm (#4090)Libravatar kim1
# Description - tweaks the NoLLaMas proof-of-work algorithm to further granularity on time spent computing solutions - standardizes GoToSocial cookie security directive setting in a CookiePolicy{} type ## Checklist - [x] I/we have read the [GoToSocial contribution guidelines](https://codeberg.org/superseriousbusiness/gotosocial/src/branch/main/CONTRIBUTING.md). - [x] I/we have discussed the proposed changes already, either in an issue on the repository, or in the Matrix chat. - [x] I/we have not leveraged AI to create the proposed changes. - [x] I/we have performed a self-review of added code. - [x] I/we have written code that is legible and maintainable by others. - [x] I/we have commented the added code, particularly in hard-to-understand areas. - [ ] I/we have made any necessary changes to documentation. - [ ] I/we have added tests that cover new code. - [ ] I/we have run tests and they pass locally with the changes. - [x] I/we have run `go fmt ./...` and `golangci-lint run`. Co-authored-by: tobi <tobi.smethurst@protonmail.com> Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4090 Co-authored-by: kim <grufwub@gmail.com> Co-committed-by: kim <grufwub@gmail.com>
2025-04-28[feature] proof of work scraper deterrence (#4043)Libravatar kim1
This adds a proof-of-work based scraper deterrence to GoToSocial's middleware stack on profile and status web pages. Heavily inspired by https://github.com/TecharoHQ/anubis, but massively stripped back for our own usecase. Todo: - ~~add configuration option so this is disabled by default~~ - ~~fix whatever weirdness is preventing this working with CSP (even in debug)~~ - ~~use our standard templating mechanism going through apiutil helper func~~ - ~~probably some absurdly small performance improvements to be made in pooling re-used hex encode / hash encode buffers~~ the web endpoints aren't as hot a path as API / ActivityPub, will leave as-is for now as it is already very minimal and well optimized - ~~verify the cryptographic assumptions re: using a portion of token as challenge data~~ this isn't a serious application of cryptography, if it turns out to be a problem we'll fix it, but it definitely should not be easily possible to guess a SHA256 hash from the first 1/4 of it even if mathematically it might make it a bit easier - ~~theme / make look nice??~~ - ~~add a spinner~~ - ~~add entry in example configuration~~ - ~~add documentation~~ Verification page originally based on https://github.com/LucienV1/powtect Co-authored-by: tobi <tobi.smethurst@protonmail.com> Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4043 Reviewed-by: tobi <tsmethurst@noreply.codeberg.org> Co-authored-by: kim <grufwub@gmail.com> Co-committed-by: kim <grufwub@gmail.com>
2025-04-27[chore] Rewrite all remaining Github linksLibravatar Daenney1
2025-04-26[feature] Move to code.superseriousbusiness.orgLibravatar Daenney16
2025-04-22[chore/frontend] Reorder JS a little bit to avoid visible text changes (#4039)Libravatar tobi3
2025-03-31[feature] Use blurhashes in frontend, tidy up gallery view a bit (#3948)Libravatar tobi5
* [feature] Use blurhashes in frontend, tidy up gallery view a bit * weeeeeeeeeeeeeeeee * beep boop
2025-03-26[feature] Allow user to choose "gallery" style layout for web view of ↵Libravatar tobi2
profile (#3917) * [feature] Allow user to choose "gallery" style web layout * find a bug and squish it up and all day long you'll have good luck * just a sec * [performance] reindex public timeline + tinker with query a bit * fiddling * should be good now * last bit of finagling, i'm done now i prommy * panic normally
2025-02-20[feature] Add page-specific class per template (#3814)v0.18.0-rc3Libravatar tobi2
* [feature] Add page-specific class per template * cheeky bit cheaper
2025-02-05[feature] Use `X-Robots-Tag` headers to instruct scrapers/crawlers (#3737)Libravatar tobi3
* [feature] Use `X-Robots-Tag` headers to instruct scrapers/crawlers * use switch for RobotsHeaders
2025-02-04[feature] Change `instance-stats-randomize` to `instance-stats-mode` with ↵Libravatar tobi1
multiple options; implement nodeinfo 2.1 (#3734) * [feature] Change `instance-stats-randomize` to `instance-stats-mode` with multiple options; implement nodeinfo 2.1 * swaggalaggadingdong
2025-02-03[chore] disallow /nodeinfo/ too (#3729)Libravatar jade arson.1
2025-01-29[feature] Use maintenance router to serve 503 while server is ↵Libravatar tobi4
starting/migrating (#3705) * [feature] Use maintenance router to serve 503 while server is starting/migrating * love you linter, kissies
2025-01-27[feature/frontend] Add login button to index page which reiterates info ↵Libravatar Vivian Lim ⭐3
about clients (#3377) * Add login button to index page which reiterates info about clients * bit of CSS fiddling, move apps from front page to login info * fix indentation --------- Co-authored-by: tobi <tobi.smethurst@protonmail.com>
2025-01-03[chore] Update robots.txt with more AI bots (#3634)Libravatar Daenney1
2024-12-18[bugfix] Load instance-wide custom css in page stylesheets template (#3601)Libravatar CDN9
* [bugfix] Load instance-wide custom css in page stylesheets template * [chore] remove redunt import
2024-12-03[bugfix] Load instance-wide custom css unconditionally in thread details ↵Libravatar CDN1
page (#3595)
2024-12-02[feature] Add global instance CSS customization setting (#3352)Libravatar Victor Dyotte11
Allow instance admins to add custom CSS that will affect every page of their instance. This is done with a new CustomCSS instance setting that works pretty much exactly like the Users CustomCSS property. This custom CSS is then requested for every page load. User styles/themes take precedence over this CSS. Co-authored-by: tobi <tobi.smethurst@protonmail.com>
2024-09-07[chore] More AI blocking (#3273)Libravatar Daenney1
2024-08-29[chore] Update robots.txt with more AI scrapers (#3248)Libravatar Daenney1
2024-08-02[feature] Beef up our AI opt-outs (#3165)Libravatar Daenney1
* [chore] Synchronise our robots.txt with upstream * [feature] Add headers to escape AI crawlers This adds 2 headers that a number of AI crawlers respect to signal that content should not be included in their datasets.
2024-07-21[feature/frontend] Respect `prefers-reduced-motion` for avatars, headers, ↵Libravatar tobi1
and emojis (#3118) * [feature/frontend] Respect `prefers-reduced-motion` for avatars, headers, and emojis * go fmt * fix tests * use static version of instance thumbnail when appropriate * use prefers-reduced-motion * simplify account conversion a bit * fix c&p error
2024-07-12[feature/frontend] Better visual separation between "main" thread and ↵Libravatar tobi2
"replies" (#3093) * [feature/frontend] Better web threading model * fix test * bwap * tweaks * more tweaks to wording * typo * indenting * adjust wording * aaa
2024-07-10[choore] Update robots.txt (#3092)Libravatar Daenney1
Recategorises a pair of scrapers according to their use.
2024-07-08[feature/frontend] Allow setting alt-text for avatar + header (#3086)Libravatar tobi2
2024-06-23[chore] Update our robots.txt (#3033)Libravatar Daenney1
This syncs our copy with the current state of the ai.robots.txt repository. Upstream has tightened their scope to be AI-only, whereas before it included a bunch of SEO and "web intelligence" marketing stuff. I've kept those but moved them into their own section.
2024-06-12[chore] Don't render sign-up form when registrations closed (#3001)Libravatar tobi1
2024-06-06[feature] Self-serve email change for users (#2957)Libravatar tobi1
* [feature] Email change * frontend stuff for changing email * docs * tests etc * differentiate more clearly between local user+account and account * populate user
2024-04-22[chore] Update robots.txt (#2856)Libravatar Daenney1
This updates the robots.txt based on the list of the ai.robots.txt repository. We can look at automating that at some point. It's worth pointing out that some robots, namely the ones by Bytedance, are known to ignore robots.txt entirely.
2024-04-13[feature] Admin accounts endpoints; approve/reject sign-ups (#2826)Libravatar tobi4
* update settings panels, add pending overview + approve/deny functions * add admin accounts get, approve, reject * send approved/rejected emails * use signup URL * docs! * email * swagger * web linting * fix email tests * wee lil fixerinos * use new paging logic for GetAccounts() series of admin endpoints, small changes to query building * shuffle useAccountIDIn check *before* adding to query * fix parse from toot react error * use `netip.Addr` * put valid slices in globals * optimistic updates for account state --------- Co-authored-by: kim <grufwub@gmail.com>
2024-04-11[feature] New user sign-up via web page (#2796)Libravatar tobi4
* [feature] User sign-up form and admin notifs * add chosen + filtered languages to migration * remove stray comment * chosen languages schmosen schmanguages * proper error on local account missing
2024-03-25[feature] User-selectable preset CSS themes for accounts (#2777)Libravatar tobi3
* [feature] User-selectable preset themes * docs, more theme stuff * lint, tests * fix css name * correct some little issues * add another theme * fix poll background * okay last theme i swear * make retrieval of apimodel themes more conventional * preallocate stylesheet slices
2024-02-27[feature] Block Amazonbot (#2692)Libravatar Daenney1
Blocks the Amazon crawler bot. Closes: #2686
2024-02-21[chore] Rename frontend.tmpl to settings.tmpl, remove unused "lightgray" ↵Libravatar tobi1
class (#2674)
2023-12-27[chore] Refactor HTML templates and CSS (#2480)Libravatar tobi13
* [chore] Refactor HTML templates and CSS * eslint * ignore "Local" * rss tests * fiddle with OG just a tiny bit * dick around with polls a bit more so SR stops saying "clickable" * remove break * oh lord * don't lazy load avatar * fix ogmeta tests * clean up some cruft * catch remaining calls to c.HTML * fix error rendering + stack overflow in tag * allow templating attributes * fix indent * set aria-hidden on status complementary content, since it's already present in the label anyway * tidy up templating calls a little * try to make styling a bit more consistent + readable * fix up some remaining CSS issues * fix up reports
2023-12-01[bugfix/chore] `Announce` reliability updates (#2405)v0.13.0-rc1Libravatar tobi1
* [bugfix/chore] `Announce` updates * test update * fix tests * TestParseAnnounce * update comments * don't lock/unlock, change function signature * naming stuff * don't check domain block twice * UnwrapIfBoost * beep boop
2023-11-27[performance] http response encoding / writing improvements (#2374)Libravatar kim1
2023-11-23[chore/bugfix] Fix double gzip on prometheus endpoint (#2383)Libravatar tobi2
* [chore] Move "/metrics" into separate API module * use our own gzip middleware for prom
2023-11-20[feature] Initial Prometheus metrics implementation (#2334)Libravatar Tsuribori2
* feat: Initial OTEL metrics * docs: add metrics documentation * fix: metrics endpoint conditional check * feat: metrics endpoint basic auth * fix: make metrics-auth-enabled default false * fix: go fmt helpers.gen.go * fix: add metric-related env vars to envparsing.sh * fix: metrics docs * fix: metrics related stuff in envparsing.sh * fix: metrics docs * chore: metrics docs wording * fix: metrics stuff in envparsing? * bump otel versions --------- Co-authored-by: Tsuribori <user@acertaindebian> Co-authored-by: Tsuribori <none@example.org> Co-authored-by: tsmethurst <tobi.smethurst@protonmail.com>
2023-11-17[feature] Set/show instance language(s); show post language on frontend (#2362)Libravatar tobi3
* update go text, include text/display * [feature] Set instance langs, show post lang on frontend * go fmt * WebGet * set language for whole article, don't use FA icon * mention instance languages + other optional config vars * little tweak * put languages in config properly * warn log language parse * change some naming around * tidy up validate a bit * lint * rename LanguageTmpl in template
2023-11-13[feature/performance] Wrap incoming HTTP requests in timeout handler (#2353)Libravatar tobi1
* deinterface router, start messing about with deadlines * weeeee * thanks linter (thinter) * write Connection: close when timing out requests * update wording * don't replace req * don't bother with fancy Cause functions (I'll use them one day...)
2023-11-10[feature] Media attachment placeholders (#2331)Libravatar tobi2
* [feature] Use placeholders for unknown media types * fix read of underreported small files * switch to reduce nesting * simplify cleanup
2023-09-30[feature] Block a bunch of "AI" crawlers (#2239)Libravatar Daenney1
* [feature] Block Google Bard/AI crawlers * [feature] Block the other OpenAI crawler * [feature] Block Common Crawl crawler This is used in research, but also gleefully advertises itself as the training source used in all LLMs and GPT-3. Fixes: #2240 * [feature] Block Omgilikebot Used by some shady big web data engine company. * [feature] Block Meta's language model crawler * [feature] Block well-known.dev crawler
2023-08-11[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100)Libravatar tobi1
2023-08-08[chore] Update robots.txt, give chatgpt the middle finger (#2085)Libravatar tobi1
2023-08-03[feature] simpler cache size configuration (#2051)Libravatar kim1
* add automatic cache max size generation based on ratios of a singular fixed memory target Signed-off-by: kim <grufwub@gmail.com> * remove now-unused cache max-size config variables Signed-off-by: kim <grufwub@gmail.com> * slight ratio tweak Signed-off-by: kim <grufwub@gmail.com> * remove unused visibility config var Signed-off-by: kim <grufwub@gmail.com> * add secret little ratio config trick Signed-off-by: kim <grufwub@gmail.com> * fixed a word Signed-off-by: kim <grufwub@gmail.com> * update cache library to remove use of TTL in result caches + slice cache Signed-off-by: kim <grufwub@gmail.com> * update other cache usages to use correct interface Signed-off-by: kim <grufwub@gmail.com> * update example config to explain the cache memory target Signed-off-by: kim <grufwub@gmail.com> * update env parsing test with new config values Signed-off-by: kim <grufwub@gmail.com> * do some ratio twiddling Signed-off-by: kim <grufwub@gmail.com> * add missing header * update envparsing with latest defaults Signed-off-by: kim <grufwub@gmail.com> * update size calculations to take into account result cache, simple cache and extra map overheads Signed-off-by: kim <grufwub@gmail.com> * tweak the ratios some more Signed-off-by: kim <grufwub@gmail.com> * more nan rampaging Signed-off-by: kim <grufwub@gmail.com> * fix envparsing script Signed-off-by: kim <grufwub@gmail.com> * update cache library, add sweep function to keep caches trim Signed-off-by: kim <grufwub@gmail.com> * sweep caches once a minute Signed-off-by: kim <grufwub@gmail.com> * add a regular job to sweep caches and keep under 80% utilisation Signed-off-by: kim <grufwub@gmail.com> * remove dead code Signed-off-by: kim <grufwub@gmail.com> * add new size library used to libraries section of readme Signed-off-by: kim <grufwub@gmail.com> * add better explanations for the mem-ratio numbers Signed-off-by: kim <grufwub@gmail.com> * update go-cache Signed-off-by: kim <grufwub@gmail.com> * library version bump Signed-off-by: kim <grufwub@gmail.com> * update cache.result{} size model estimation Signed-off-by: kim <grufwub@gmail.com> --------- Signed-off-by: kim <grufwub@gmail.com>
2023-07-31[feature] Hashtag federation (in/out), hashtag client API endpoints (#2032)Libravatar tobi2
* update go-fed * do the things * remove unused columns from tags * update to latest lingo from main * further tag shenanigans * serve stub page at tag endpoint * we did it lads * tests, oh tests, ohhh tests, oh tests (doo doo doo doo) * swagger docs * document hashtag usage + federation * instanceGet * don't bother parsing tag href * rename whereStartsWith -> whereStartsLike * remove GetOrCreateTag * dont cache status tag timelineability
2023-07-25[performance] retry db queries on busy errors (#2025)Libravatar kim1
* catch SQLITE_BUSY errors, wrap bun.DB to use our own busy retrier, remove unnecessary db.Error type Signed-off-by: kim <grufwub@gmail.com> * remove dead code Signed-off-by: kim <grufwub@gmail.com> * remove more dead code, add missing error arguments Signed-off-by: kim <grufwub@gmail.com> * update sqlite to use maxOpenConns() Signed-off-by: kim <grufwub@gmail.com> * add uncommitted changes Signed-off-by: kim <grufwub@gmail.com> * use direct calls-through for the ConnIface to make sure we don't double query hook Signed-off-by: kim <grufwub@gmail.com> * expose underlying bun.DB better Signed-off-by: kim <grufwub@gmail.com> * retry on the correct busy error Signed-off-by: kim <grufwub@gmail.com> * use longer possible maxRetries for db retry-backoff Signed-off-by: kim <grufwub@gmail.com> * remove the note regarding max-open-conns only applying to postgres Signed-off-by: kim <grufwub@gmail.com> * improved code commenting Signed-off-by: kim <grufwub@gmail.com> * remove unnecessary infof call (just use info) Signed-off-by: kim <grufwub@gmail.com> * rename DBConn to WrappedDB to better follow sql package name conventions Signed-off-by: kim <grufwub@gmail.com> * update test error string checks Signed-off-by: kim <grufwub@gmail.com> * shush linter Signed-off-by: kim <grufwub@gmail.com> * update backoff logic to be more transparent Signed-off-by: kim <grufwub@gmail.com> --------- Signed-off-by: kim <grufwub@gmail.com>
2023-07-13[bugfix] Set Vary header correctly on cache-control (#1988)v0.10.0-rc2Libravatar tobi1
* [bugfix] Set Vary header correctly on cache-control * Prefer activitypub types on AP endpoints * use immutable on file server, vary by range * vary auth on Accept
2023-07-10[bugfix] Tidy up rss feed serving; don't error on empty feed (#1970)Libravatar tobi1
* [bugfix] Tidy up rss feed serving; don't error on empty feed * fall back to account creation time as rss feed update time * return feed early when account has no eligible statuses
2023-07-07[bugfix] Reorder web view logic, other small fixes (#1954)Libravatar tobi2
generated by cgit v1.2.3 (git 2.46.0) at 2025-12-02 10:47:35 +0000