Profile and post pages, NodeInfo 2.1, and FEDERATION.md

/@user and /@user/{id} are Razor pages showing an avatar's or community's
public and unlisted posts: no scripts, a strict CSP, no-referrer, noindex,
and an alternate link to the ActivityPub document. A client asking them
for activity+json is redirected to the actor or note, and the actor and
note redirect browsers here.

NodeInfo answers 2.1 as well as 2.0 (repository, homepage, a link to
FEDERATION.md) and counts only public local posts.

FEDERATION.md (FEP-67ff) lists the protocols, FEPs, route names,
activities and the security rules a peer will notice.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Web/Pages/Pages.cs

@@ -0,0 +1,128 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.RazorPages;
+
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Post;
+using PrivaPub.StaticServices;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Web.Pages
+{
+	public sealed record PostView(string Title, string Warning, string ContentHtml, string Url, DateTime Published, bool Edited)
+	{
+		public static PostView From(PostEntity post, LocalActor author) => new(
+			post.Title,
+			post.SpoilerText ?? (post.HasContentWarning ? ActivityPubRenderer.ContentWarning : default),
+			post.ContentHtml ?? ActivityPubRenderer.Html(post.Text),
+			author.PostHtmlUrl(post.ID),
+			DateTime.SpecifyKind(post.CreationDate, DateTimeKind.Utc),
+			post.EditedAt.HasValue);
+	}
+
+	public abstract class PublicPageModel : PageModel
+	{
+		protected bool WantsActivityJson()
+		{
+			var accept = Request.Headers.Accept.ToString();
+			return accept.Contains("activity+json", StringComparison.OrdinalIgnoreCase) || accept.Contains("ld+json", StringComparison.OrdinalIgnoreCase);
+		}
+
+		protected void Harden()
+		{
+			Response.Headers["Content-Security-Policy"] = "default-src 'none'; style-src 'unsafe-inline'; img-src https: data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";
+			Response.Headers["Referrer-Policy"] = "no-referrer";
+			Response.Headers["X-Content-Type-Options"] = "nosniff";
+		}
+	}
+
+	public class ProfileModel : PublicPageModel
+	{
+		const int PageSize = 20;
+
+		readonly ILocalActorService _localActors;
+		readonly DbEntities _dbEntities;
+
+		public ProfileModel(ILocalActorService localActors, DbEntities dbEntities)
+		{
+			_localActors = localActors;
+			_dbEntities = dbEntities;
+		}
+
+		public LocalActor Actor { get; private set; }
+		public string BiographyHtml { get; private set; }
+		public IReadOnlyList<PostView> Posts { get; private set; } = Array.Empty<PostView>();
+
+		public async Task<IActionResult> OnGetAsync(string user, CancellationToken token)
+		{
+			Actor = await _localActors.FindByUserName(user, token);
+			if (Actor is not { IsFederated: true } || Actor.Kind == LocalActorKind.Application)
+				return NotFound();
+			if (WantsActivityJson())
+				return Redirect(Actor.Uri);
+
+			Harden();
+			BiographyHtml = ActivityPubRenderer.Html(Actor.Summary);
+			var posts = await (Actor.Kind == LocalActorKind.Group
+					? _dbEntities.Posts.Match(p => p.GroupId == Actor.Id)
+					: _dbEntities.Posts.Match(p => p.GroupUserId == Actor.Id && !p.IsFederatedCopy))
+				.Match(p => !p.DeletedAt.HasValue && (p.Visibility == PostVisibility.Public || p.Visibility == PostVisibility.Unlisted))
+				.Sort(p => p.ID, Order.Descending)
+				.Limit(PageSize)
+				.ExecuteAsync(token);
+			var authors = new Dictionary<string, LocalActor> { [Actor.Id] = Actor };
+			var views = new List<PostView>();
+			foreach (var post in posts)
+			{
+				if (post.IsFederatedCopy)
+					continue;
+				if (!authors.TryGetValue(post.GroupUserId, out var author))
+					authors[post.GroupUserId] = author = await _localActors.FindById(LocalActorKind.Person, post.GroupUserId, token);
+				if (author != default)
+					views.Add(PostView.From(post, author));
+			}
+			Posts = views;
+			return Page();
+		}
+	}
+
+	public class StatusModel : PublicPageModel
+	{
+		readonly ILocalActorService _localActors;
+		readonly DbEntities _dbEntities;
+
+		public StatusModel(ILocalActorService localActors, DbEntities dbEntities)
+		{
+			_localActors = localActors;
+			_dbEntities = dbEntities;
+		}
+
+		public LocalActor Actor { get; private set; }
+		public PostView Post { get; private set; }
+		public string ObjectUri { get; private set; }
+
+		public async Task<IActionResult> OnGetAsync(string user, string id, CancellationToken token)
+		{
+			Actor = await _localActors.FindByUserName(user, token);
+			if (Actor is not { IsFederated: true, Kind: LocalActorKind.Person })
+				return NotFound();
+			var post = await _dbEntities.Posts
+				.Match(p => p.ID == id && p.GroupUserId == Actor.Id && !p.IsFederatedCopy && !p.DeletedAt.HasValue
+					&& (p.Visibility == PostVisibility.Public || p.Visibility == PostVisibility.Unlisted))
+				.ExecuteFirstAsync(token);
+			if (post == default)
+				return NotFound();
+			ObjectUri = Actor.PostUri(post.ID);
+			if (WantsActivityJson())
+				return Redirect(ObjectUri);
+
+			Harden();
+			Post = PostView.From(post, Actor);
+			return Page();
+		}
+	}
+}