Dreamwidth Changelog

Add bluesky to profile_services (#3707)

Commit: dad752a1 Author: Joshua Barrett

Bump sass in /etc/build-tools in the build-tools group (#3708)

Bumps the build-tools group in /etc/build-tools with 1 update: sass.

Updates sass from 1.105.1 to 1.107.0 - Release notes - Changelog - Commits

Show a helpful login error for email addresses (#3710)

• Show a helpful login error for email addresses

Fixes #3709

• Remove granular login error message tests

• Let complete email input reach login validation

Commit: 42028595 Author: Mark Smith

Validate thread arguments used in comment links (#3704)

destination_thread and thread are now reduced to numeric thread ids before they're used to build the expand, reply and edit links on entry pages, and Comment::expand_link escapes the URLs it emits.

Co-authored-by: Claude Opus 5.5 noreply@anthropic.com

Commit: 2bcb855e Author: Mark Smith

Fix protocol sync, export batching, and protocol rate limiting for backup clients (#3698)

• Fix first-ever syncitems/getevents under strict sql_mode

With no lastsync, syncitems and getevents(selecttype=syncitems) compared logtime against '0000-00-00 00:00:00'. Strict sql_mode (NO_ZERO_DATE) rejects that date with an error, which DBI turned into an empty result, so a client's first sync returned no entries. Use MySQL's minimum valid DATETIME instead, and treat a client-supplied zero date the same way.

t/protocol-sync-floor.t covers both modes; t/auth-client-compat.t no longer needs to pre-seed lastsync to work around this.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

• Install Term::ReadKey in the devcontainer

t/auth-client-compat.t runs the shipped jbackup, which needs Term::ReadKey, and skips itself without it, so it never ran in CI or a fresh devcontainer. Install it in the devcontainer image only; it's a client dependency, not a site one.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

• Load comment_body export data in batches

comment_body loaded the posters, text and props for its whole window at once, and loaded text even for comments it then printed without it. Load them 250 comments at a time, apply the suspended-poster filter first, and skip text for deleted comments. The output is unchanged for every window; t/export-comments.t compares it with the previous rendering across batch boundaries, long, deleted, screened and suspended-poster comments, and runs the shipped jbackup end to end.

jbackup and the content importer step through comment_body windows by a fixed amount. They now resume from a if a server ever sends one, so a server that cut a window short wouldn't make them skip comments. Dreamwidth doesn't send it today.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

• Rate limit authenticated protocol requests per user

XML-RPC and flat clients authenticate in the request body, so the rate-limit middleware treated every call as anonymous and limited it to 30/min per IP. Defer those requests to the protocol, which charges each one once it knows who is calling: successful logins to the user's bucket, failed ones to the anonymous per-IP bucket, getchallenge to its own per-IP bucket. A per-IP backstop still applies before any work is done, and over-limit calls get the same 429 and Retry-After as before.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

Back off syndication checks for feeds with no active readers (#3694)

Feeds with no watchers, or only watchers who are deleted/suspended or haven't been active in 180 days, now get their next check scheduled a week out instead of every hour (or day). Failing feeds with no active readers also wait at least that long between retries; failcount bookkeeping is unchanged. Active-reader detection stops at the first active watcher and assumes active after 50 probes. Newly watching a feed resets checknext so the new reader gets fresh content soon.

Adds dw.synsuck.* metrics for checks, readership class, interval bucket and wake-ups, and tunables $LJ::SYNSUCK_INACTIVE_{READER_DAYS,INTERVAL} and $LJ::SYNSUCK_ACTIVE_READER_PROBES.

Co-authored-by: Claude Opus 5.5 noreply@anthropic.com

Commit: 9996423b Author: Mark Smith

Allow embedding videos from sendvid (#3614)

• Add sendvid to embed whitelist and add test for it

• Update embed whitelist test plan and add a sendvid negative test

The sendvid test was added without bumping the plan count, and main has since added makertube, so the file planned too few tests. Also check that a sendvid watch page (not an /embed/ URL) is rejected.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

Add a REST API test suite and fix the bugs it found (#3693)

• Regenerate api/dist with the current build tooling

The committed dist files were generated by an older version of the yaml package, so any rebuild rewrites all of them with different anchor placement and key quoting. Regenerate them from the unchanged sources now, so later spec changes show up as small diffs. The content of every file is unchanged; only the formatting differs.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

• Add an end-to-end test suite for the REST API

Nothing exercised the REST controllers, which is how #3687 and #3691 reached users. The new t/plack-api-.t tests send real requests through app.psgi with a temporary user's API key (helpers in t/lib/DW/Test/API.pm), so routing, key auth, spec validation, rate limiting, controllers and backends are all covered. They run in CI's existing plack- step.

t/entry-to-json.t and t/proto-edit-tags.t test LJ::Entry::TO_JSON and arrayref taglists in postevent/editevent directly, and are added to CI's posting step. They include regression tests for #3687 and #3691.

Cases that currently fail are marked TODO; the following commits fix them.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

• Keep omitted fields when editing entries through the API

The API treats a field left out of an edit as unchanged, but formto_backend read "missing" as "off". A text-only edit removed the entry's tags, age restriction, backdating, comment settings and slug, and reset a custom access filter's mask to 0. When editing, fall back to the entry's current value for each of those fields.

Edits now honour datetime, which was documented but ignored, and keep the current date when it's left out. text is optional on edit as the spec says, and an explicit empty subject clears the subject. The spec now describes these semantics and the 200 response edits already returned, and documents that count is capped at the site's scrollback limit.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

• Tighten API key validation

Only return a key from DW::API::Key::get_key when its account is active. The check runs on every lookup, after the cached key data is read, so a change to the account takes effect immediately.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

• Return valid error statuses from the entry edit and tag endpoints

Two rest_error calls passed an HTTP method name as the status code, so responses went out with a status of "POST" or "GET". A maintainer editing someone else's entry now gets a 403 with a message.

Creating tags only reported an error when two or more tags failed, and reused one error buffer for every tag. Now any failed tag makes the request a 400 that carries the error messages. Protocol errors on edit, such as an invalid date, return 400 as they do when posting, instead of 500.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

• Fix accesslist editing, deletion, and id validation in the API

Adding journals to an accesslist read $body->{journals}, but the spec's body is a plain array of usernames, so every request died with a 500. The endpoint now reads the array and responds with the updated list, as the spec documents.

Deleting an accesslist passed a hashref to delete_trust_group, which takes a list, so nothing was ever deleted even though the response was 204. trust_groups was called the same way, so its existence checks always passed. Deleting a missing list is now a 404, and fetching an unused one is a 400.

Ids outside 1-60 made trust_groups die, which caused 500s; the spec now bounds them, so they are rejected as 400s.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

• Harden REST request handling

Require the Bearer scheme in the Authorization header, matched case-insensitively as RFC 6750 and RFC 9110 11.1 specify. Before, any header that happened to contain a key was accepted, and "bearer" in lowercase was rejected.

Anchor REST route patterns at the start as well as the end, so routes no longer match under arbitrary prefixes such as /api/v1/x/spec.

Request bodies in a content type the spec has no schema for now get a 415, instead of dying in validation with a 500. Missing required bodies and invalid JSON get a 400 that says what went wrong, and validation errors include their messages, which were always empty before. Bodies for creating entries, tags and accesslists are now marked required in the spec.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

• Validate tags given as a list before posting or editing

The REST API sends tags as an arrayref, but common_event_validation checked the taglist before it was joined, so the stringified reference always passed. Invalid tags in a list were silently dropped, and the request still succeeded. Join the list at the start of common_event_validation, so lists get error 211 the same way tag strings do. That makes the separate arrayref handling in postevent and editevent redundant, so remove it.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

Accept tags as an array when editing entries through the API (#3691)

editevent treated the taglist as a string, so the arrayref the REST API sends was saved as a single tag like "array(0x...)". Join it the same way postevent already does.

Fixes #3689.

Commit: f664de2a Author: Drue Wilding

Keep accounts in the switcher across logout and account creation (#3683)

• Keep accounts in the switcher across logout and account creation

Logging out of the active account now leaves it listed in the account switcher as signed out, instead of dropping it, while still handing off to the next usable account. A logout that leaves nothing to switch to keeps the list unless it only ever held that one account.

/logout gains "Log Out of All Accounts", which ends every session in the browser and either keeps the accounts listed (signed out) or, if asked, forgets them. Creating an account while logged in now demotes the current account into the switcher rather than silently replacing it, and /manage/accounts links to account creation and logout.

Co-Authored-By: Claude Opus 5.5 (1M context) noreply@anthropic.com

• Abort logout when a session can't be revoked

Logging out now destroys stored sessions by their handle rather than only when they validate from the current request, so an IP-bound session from another network is revoked too. If a session can't be destroyed, logout stops before handing off or rewriting cookies, and the page reports the failure. The log-out-all option only appears when another account is actually signed in.

Co-Authored-By: Claude Opus 5.5 (1M context) noreply@anthropic.com