@fedify/interaction-controls: interaction controls helpers#929
Conversation
Add the initial @fedify/interaction-controls package with the public InteractionControl type surface, structured verification results, policy results, response options, revocation metadata, and application state key types. The exported option and result types use readonly fields so the API contract is immutable from the start. fedify-dev#811 Assisted-by: Codex:gpt-5.5
Implement the shared interaction-control machinery needed by the first concrete control, then expose likeInteraction. The helper now creates and verifies LikeRequest and LikeAuthorization objects, evaluates canLike policies, builds polite and impolite responses, recognizes direct Like activities, and derives application state keys. fedify-dev#811 Assisted-by: Codex:gpt-5.5
Implement replyInteraction on top of the shared control machinery. The control now creates and verifies ReplyRequest and ReplyAuthorization objects, evaluates canReply rules, validates reply targets and attributed actors, and recognizes bare reply objects sent without a request step. fedify-dev#811 Assisted-by: Codex:gpt-5.5
Implement announceInteraction with request and authorization support for Announce activities. The helper validates the announced object and actor, evaluates canAnnounce policies, and recognizes bare Announce activities as unrequested interactions. fedify-dev#811 Assisted-by: Codex:gpt-5.5
Implement quoteInteraction for FEP-044f quote requests and Authorizations. The helper accepts both the quote property and compatible quoteUrl targets, validates quoted object and actor identity, evaluates canQuote policies, and recognizes bare quote objects. fedify-dev#811 Assisted-by: Codex:gpt-5.5
Implement featureInteraction for FEP-7aa9 FeatureRequest and FeatureAuthorization objects. The helper validates that the requesting actor owns the featured collection, evaluates canFeature policies on the featured actor, and keeps standalone featured-item recognition conservative. fedify-dev#811 Assisted-by: Codex:gpt-5.5
Add a manual page for the @fedify/interaction-controls package and list it in the manual navigation. The guide explains the supported helpers, policy evaluation, request and authorization flows, conservative feature behavior, impolite interaction recognition, and stable storage keys. fedify-dev#811 Assisted-by: Codex:gpt-5.5
Add @fedify/interaction-controls to the docs workspace dependencies so Twoslash can resolve the package, correct the storage-key example to match the actual key formatter APIs, and raise the docs build heap limit enough for the current VitePress build. Declare @fedify/testing's vocabulary dependencies so Bun can resolve its built package during the full test suite. fedify-dev#811 Assisted-by: Codex:gpt-5.5
Keep the interaction controls examples focused on the API calls readers need to copy by cutting the Context and placeholder setup from the rendered Twoslash snippets while preserving type checking. fedify-dev#811 Assisted-by: Codex:gpt-5.5
Keep the interaction controls manual focused by dropping the trailing References section. The same source links are already introduced at the start of the page where the context is explained. fedify-dev#811 Assisted-by: Codex:gpt-5.5
Show the interaction controls request, policy, authorization, and final interaction verification path as a Mermaid sequence diagram so readers can see the whole process before reading the individual helper examples. fedify-dev#811 Assisted-by: Codex:gpt-5.5
Allow feature request verification to derive the requester from a FeaturedCollection when a FEP-7aa9 request omits actor, while preserving the existing requester mismatch check for requests that do include actor. Also allow FeatureAuthorization objects without attributedTo. Verification still rejects authorizations from the wrong origin when callers provide the featured actor for host validation. fedify-dev#811 Assisted-by: Codex:gpt-5.5
Require authorization verification to know the expected grantor before it can accept a grant. The helper now uses the explicit attributedTo option when it is provided, otherwise it infers the grantor from the interaction target and fails closed when neither source is available. Also return structured request verification failures for embedded interaction objects or targets that lack ids instead of letting malformed federated input escape as an exception. fedify-dev#811 Assisted-by: Codex:gpt-5.5
Reject request instruments whose runtime type does not match the interaction helper that is verifying them, so a LikeRequest cannot be approved with an Announce or another matching-looking object. Also evaluate exact actor policy entries before broader public or collection entries, preserving actor-specific moderation overrides for otherwise public automatic rules. fedify-dev#811 Assisted-by: Codex:gpt-5.5
dahlia
added
activitypub/compliance
✅ Deploy Preview for fedify-json-schema canceled.
|
dahlia
moved this to In review
in STF 2025–2026 Milestone 7: Advanced Features and Standards (FEP-ef61, new FEPs)
|
@codex review |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds ChangesInteraction controls
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Application
participant InteractionControl
participant InteractionPolicy
participant Authorization
Application->>InteractionControl: createRequest()
InteractionControl->>InteractionPolicy: evaluatePolicy()
InteractionControl->>Authorization: createAuthorization()
Application->>InteractionControl: verifyAuthorization()
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 49815c246c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces the new @fedify/interaction-controls package, which implements GoToSocial interaction controls, FEP-044f, and FEP-7aa9. It provides immutable TypeScript APIs for creating and verifying interaction requests and authorizations, evaluating interaction policies, recognizing bare interactions, and formatting stable storage keys for likes, replies, announces, quotes, and feature interactions. The workspace configuration, documentation, and lockfiles have been updated to integrate this new package. There are no review comments, so I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4d93930080
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Empty permissive interaction rules now use the same default as a missing rule instead of falling through to noMatch. Actor-only rule misses also report noMatch when no collection matcher is available, because a bare URL is not enough information to classify it as an unverifiable collection. Authorization URL verification now rejects obvious origin mismatches before dereferencing the supplied URL, so remote inputs cannot force a fetch that will only fail after parsing. fedify-dev#929 (comment) fedify-dev#929 (comment) fedify-dev#929 (comment) fedify-dev#929 (comment) Assisted-by: Codex:gpt-5.5
|
@codex review |
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces the new @fedify/interaction-controls package, which implements GoToSocial interaction controls, FEP-044f, and FEP-7aa9. It provides immutable TypeScript APIs for managing interaction requests and authorizations, evaluating policies, recognizing bare interactions, and formatting stable storage keys for various interaction types (like, reply, announce, quote, and feature). The PR also includes comprehensive unit tests, documentation, and workspace configuration updates. As there are no review comments provided, I have no feedback to offer.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 134dee8a6a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
URL authorizations with no known grantor now fail before any remote fetch. That keeps verification closed when the caller only has URL-shaped inputs and cannot establish who was allowed to grant the interaction. Collection policy matcher failures now become unverifiableCollection denials instead of escaping from policy evaluation. Inbox code can treat these as structured moderation outcomes instead of unexpected exceptions. fedify-dev#929 (comment) fedify-dev#929 (comment) Assisted-by: Codex:gpt-5.5
|
@codex review |
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces the new @fedify/interaction-controls package, which provides helper logic and immutable TypeScript APIs for implementing GoToSocial interaction controls, FEP-044f, and FEP-7aa9. It supports evaluating interaction policies, creating and verifying requests and authorizations, and formatting stable storage keys for likes, replies, announces, quotes, and featured actors. Feedback on the implementation includes simplifying the policy evaluation logic in control.ts by removing redundant checks for unverifiableCollection when matchRule is executed with actorOnly: true. Additionally, it is recommended to make getAuthorizationOrigin more robust by catching any error rather than just TypeError when falling back to id.origin.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d5b2d92d2f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Remote interaction parsing now uses the same loader for JSON-LD contexts as for the fetched document. This keeps offline and restricted loader setups in control of compacted GoToSocial and FEP documents. Approval collection checks now keep evaluating later collection alternatives after an earlier collection fails. A policy only denies as unverifiable when no later collection matches. fedify-dev#929 (comment) fedify-dev#929 (comment) fedify-dev#929 (comment) Assisted-by: Codex:gpt-5.5
|
/gemini review |
|
@codex review |
There was a problem hiding this comment.
Code Review
This pull request introduces a new package, @fedify/interaction-controls, which implements GoToSocial interaction controls, FEP-044f, and FEP-7aa9. It provides immutable TypeScript APIs for creating and verifying interaction requests and authorizations, evaluating InteractionPolicy, recognizing bare interactions, and formatting stable storage keys for likes, replies, announces, quotes, and featured actors. The PR also includes comprehensive unit tests, documentation, and workspace configuration updates. There are no review comments provided, so I have no feedback to address.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0e10800668
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Policy evaluation now treats an unavailable automatic collection as a pending denial until broader manual rules have been checked. This lets a public manual fallback still route a request to moderation when a narrow automatic collection cannot be verified. Authorization verification also reports id-less interacting objects and targets as structured failures instead of throwing while processing malformed federated input. fedify-dev#929 (comment) fedify-dev#929 (comment) Assisted-by: Codex:gpt-5.5
|
@codex review |
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces the new @fedify/interaction-controls package, which implements GoToSocial interaction controls, FEP-044f, and FEP-7aa9. It provides immutable TypeScript APIs for creating and verifying interaction requests and authorizations, evaluating interaction policies, recognizing bare interactions, and formatting stable storage keys for various interaction types (like, reply, announce, quote, and feature). The changes also include comprehensive tests, documentation, and integration into the workspace. The feedback suggests simplifying the getAuthorizationOrigin helper function to catch any error when calling getFe34Origin and safely fall back to id.origin for improved robustness.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Authorization origin checks use FEP-fe34 origins when available, but fall back to the URL origin when the helper cannot derive one. Catching all helper failures keeps that fallback stable if the origin parser gains new failure modes while preserving the same same-origin comparison. fedify-dev#929 (comment) Assisted-by: Codex:gpt-5.5
|
@codex review |
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces a new package, @fedify/interaction-controls, which provides helper logic and immutable TypeScript APIs for implementing GoToSocial interaction controls, FEP-044f, and FEP-7aa9. It supports likes, replies, announces, quotes, and featuring actors, including policy evaluation, request/authorization flows, and stable storage keys. Feedback on the changes highlights a compilation issue in packages/interaction-controls/src/types.ts where the Temporal namespace is used but not imported, which could cause compilation errors for consumers.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e8879db16a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Request verification now passes the selected document loader as the context loader when dereferencing embedded interaction fields. This keeps remote objects with caller-supplied JSON-LD contexts verifiable through the same loader path. The public types also import the Temporal namespace explicitly so emitted declarations do not rely on a non-standard global. fedify-dev#929 (comment) fedify-dev#929 (comment) Assisted-by: Codex:gpt-5.5
The new package is now included in the main package table and in the repository structure guidance. Keeping these indexes current makes the publishable workspace package discoverable to both users and contributors. fedify-dev#929 (comment) Assisted-by: Codex:gpt-5.5
|
@codex review |
|
/gemini review |
1 participant
This pull request adds
@fedify/interaction-controls, a small helper package for the request/authorization pattern used by GoToSocial interaction controls, FEP-044f, and FEP-7aa9.The package keeps the protocol pieces separate from application policy. It does not install inbox handlers, store moderation queues, or decide how an app should surface approvals. Instead, it gives applications typed primitives for the parts that are easy to get subtly wrong: creating request activities, checking that a request's instrument really matches its actor and target, evaluating
InteractionPolicy, issuing authorization objects, and verifying those authorizations before accepting the final interaction.The shared implementation lives in packages/interaction-controls/src/control.ts. Each interaction helper supplies only the protocol-specific shape: which request and authorization classes to use, which policy property to read, how to find the requester, and how to compare the interaction object with the target. That keeps
likeInteraction,replyInteraction,announceInteraction,quoteInteraction, andfeatureInteractionconsistent without forcing their different FEP details into one loose union type.The public types are intentionally immutable. The examples in the issue did not require this, but the package exposes result objects, keys, options, and failure records as public API, so every field is
readonly. That matches the rest of Fedify's preference for values that can be passed between inbox, storage, and moderation code without accidental mutation.Request and authorization verification fail closed where the protocol needs an authority check. Feature requests can omit
actorwhen the featured collection itself supplies the requester throughattributedTo, matching FEP-7aa9. Feature authorizations do not have to carryattributedTo, but callers still must provide the expected grantor when verifying an authorization so the helper can check that the grant comes from the target actor's origin. Malformed embedded request objects return structured failures rather than escaping as exceptions.Policy evaluation follows the interaction control semantics that exact actor entries are more specific than public or collection entries. This means an app can allow public automatic approval while still naming one actor for manual review. The exact actor rule wins before broader collection membership is consulted.
The docs in docs/manual/interaction-controls.md show the complete flow: policy evaluation, request verification, authorization creation, authorization verification, impolite interaction recognition, and revocation. The examples are Twoslash-checked, and the Mermaid diagram puts the request, moderation, and authorization path in one place.
Closes #811.