2 Commits

Include renames

Author	SHA1	Message	Date
thepraandClaude Opus 5.5	6f1ab0073c	P6: quote posts, received and sent (FEP-044f and the older keys) ... - Received quotes: read from `quote`, `quoteUrl`, `quoteUri`, `_misskey_quote` or a FEP-e232 Link tag; the quoted post is fetched once; a quoteAuthorization stamp is verified field by field on the quoted author's origin; a consent quote without a stamp is pending; an older-key quote of a public post is shown; Delete of a stamp revokes. Counts and a `quote` notification follow the accepted state. The `quote-inline` fallback survives sanitising and is removed from content when the real quote is shown. - Personas quote through `quoted_status_id`: posts that state a quote policy get a QuoteRequest and stay pending until an Accept brings a stamp we can verify, then an Update adds quoteAuthorization; posts that state none are quoted the older way, without `quote`; another persona's posts cannot be quoted yet (we issue no stamps). Quoting posts are delivered to the quoted author too. - Mastodon API: Status.quote (with the quoted status one level deep), quotes_count, quote_approval from the remote policy, GET /api/v1/statuses/:id/quotes, `quote` notifications, and api_versions.mastodon = 7. Checked live: GoToSocial's author-only quote policy is respected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 18:53:28 +02:00
thepraandClaude Opus 5.5	bf7c88ce71	Remote HTML is sanitized before it is stored ... S5 of the roadmap. ContentSanitizer wraps HtmlSanitizer with Mastodon's allowlist: the inline and list tags Mastodon keeps, href/rel/class and the list attributes, microformat and mention/hashtag/ellipsis/invisible classes, Mastodon's link schemes, every link rel=nofollow noopener noreferrer, relative links unlinked, headings folded to a bold paragraph, and the contents of script, style, svg, iframe and friends dropped rather than kept as text. Post and DmPost gain ContentHtml (what is shown) and ContentFormat (Markdown for local, Html for remote). Inbound Create and Update, and a remote actor's biography, are sanitized on the way in; local posts store their Markdig rendering. Migration _002 does the same to what is already stored, and migrations now run at startup. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 10:54:17 +02:00