thepraandClaude Opus 5.5
125a49a1a0
NeverFiveHundredTests walks every endpoint the server maps and fills each route parameter
with junk ('x', zeroed and random ObjectIds, a dot-dot segment, 5000 characters). It calls
each one anonymously, as a persona, and with a junk token, and asserts that nothing
answers 5xx or throws, and that every /api error carries a Mastodon error body.
It found two bugs:
- A junk 'Authorization: Bearer' on any non-/api route, anonymous ones included
(/build.json, /peasants/*, inboxes), broke the response. JwtEvents.AuthenticationFailed
wrote a body during authentication and the endpoint then wrote its own. The 401 body now
comes from the Challenge event, which runs only when an endpoint needs a user.
- /api answered 401, 404 and 429 with no body. UseMastodonErrorBodies gives any /api error
that leaves without a body Mastodon's {"error": ...}.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2
PrivaPub
A self-hosted ActivityPub server in C# (.NET 10, MongoDB) where one private login owns several unlinkable public personas. It federates with Mastodon, GoToSocial, Pleroma/Akkoma, Misskey and Lemmy.
- Live: https://privapub.thepra.dev
- Client: decePubClient, https://decepub.thepra.dev
- Architecture, conventions and deploy: CLAUDE.md
- Decisions and the plan to full ActivityPub interop: docs/ROADMAP.md
dotnet build PrivaPub.sln -c Release