app/lib/social/platforms.server.ts

Functions

Imports

It imports app/lib/timed-fetch.server.ts. Imported by app/lib/social/lint.ts, app/lib/social/queue.server.ts, app/routes/social.tsx.

Source

1// The two platforms Carrel posts to, and the one way out to them. There is no reply or direct-message
2// code (design section 5, "Social"), and a guard makes sure none can be reached: every request is
3// checked against an allowlist of the exact endpoints that create a session or an original post,
4// and a post body carrying a reply reference is refused before it is sent.
5//
6// Bluesky: carried over from legacy Recova's lib/social/bluesky.ts (app-password session reused for
7// two hours, createRecord for the post), with its reply and search functions dropped and the session
8// kept per account. X: OAuth 1.0a user context for POST /2/tweets, signed here with Web Crypto
9// instead of Recova's twitter-api-v2 package.
10
11import { timedFetch } from "~/lib/timed-fetch.server";
12
13type Fetch = typeof fetch;
14
15export type Platform = "bluesky" | "x";
16
17export type Credentials =
18  | { platform: "bluesky"; handle: string; appPassword: string }
19  | { platform: "x"; apiKey: string; apiSecret: string; accessToken: string; accessSecret: string };
20
21/** A refusal made before anything is sent: a reply, a message, or any endpoint not on the list. */
22export class SocialRefused extends Error {
23  constructor(message: string) {
24    super(message);
25    this.name = "SocialRefused";
26  }
27}
28
29const BSKY = "https://bsky.social/xrpc";
30const X_TWEETS = "https://api.x.com/2/tweets";
31
32const ALLOWED = new Set([`POST ${BSKY}/com.atproto.server.createSession`, `POST ${BSKY}/com.atproto.repo.createRecord`, `POST ${X_TWEETS}`]);
33
34/** The guard every request passes. Exported so the tests can plant against it directly. */
35export function assertOriginalPost(method: string, url: string, body: unknown): void {
36  if (!ALLOWED.has(`${method.toUpperCase()} ${url}`)) throw new SocialRefused(`${method} ${url} is not an original post; Carrel never replies, messages, follows or likes.`);
37  const b = body as Record<string, unknown> | undefined;
38  const record = b?.record as Record<string, unknown> | undefined;
39  if (record && (record.reply !== undefined || record.$type !== "app.bsky.feed.post")) throw new SocialRefused("A Bluesky record that is a reply, or not a post, is refused.");
40  if (b?.collection !== undefined && b.collection !== "app.bsky.feed.post") throw new SocialRefused(`Writing to ${String(b.collection)} is refused; only posts.`);
41  if (url === X_TWEETS && (b?.reply !== undefined || b?.quote_tweet_id !== undefined || b?.direct_message_deep_link !== undefined)) {
42    throw new SocialRefused("An X post that replies, quotes or links a direct message is refused.");
43  }
44}
45
46async function send(fetcher: Fetch, method: string, url: string, body: unknown, headers: Record<string, string> = {}): Promise<Response> {
47  assertOriginalPost(method, url, body);
48  return fetcher(url, { method, headers: { "Content-Type": "application/json", ...headers }, body: JSON.stringify(body) });
49}
50
51// ---------- Bluesky (from Recova)
52
53const bskySessions = new Map<string, { accessJwt: string; did: string; expiresAt: number }>();
54
55export function clearBlueskySessions(): void {
56  bskySessions.clear();
57}
58
59async function blueskySession(creds: Extract<Credentials, { platform: "bluesky" }>, fetcher: Fetch, now: number) {
60  const cached = bskySessions.get(creds.handle);
61  // Re-authenticate when missing or within five minutes of expiry (Recova's rule).
62  if (cached && now < cached.expiresAt - 5 * 60 * 1000) return cached;
63  const res = await send(fetcher, "POST", `${BSKY}/com.atproto.server.createSession`, { identifier: creds.handle, password: creds.appPassword });
64  if (!res.ok) throw new Error(`Bluesky sign-in ${res.status}`);
65  const data = (await res.json()) as { accessJwt: string; did: string };
66  // Bluesky access tokens last two hours.
67  const session = { accessJwt: data.accessJwt, did: data.did, expiresAt: now + 2 * 60 * 60 * 1000 };
68  bskySessions.set(creds.handle, session);
69  return session;
70}
71
72/** Bluesky counts graphemes, not UTF-16 units. */
73export function graphemes(text: string): number {
74  return [...new Intl.Segmenter("en", { granularity: "grapheme" }).segment(text)].length;
75}
76
77async function postToBluesky(creds: Extract<Credentials, { platform: "bluesky" }>, text: string, fetcher: Fetch, now: number): Promise<string> {
78  const session = await blueskySession(creds, fetcher, now);
79  // A link is made clickable with a facet over its byte range, as the app does.
80  const facets = [...text.matchAll(/https?:\/\/[^\s]+/g)].map((m) => {
81    const start = new TextEncoder().encode(text.slice(0, m.index)).length;
82    return {
83      index: { byteStart: start, byteEnd: start + new TextEncoder().encode(m[0]).length },
84      features: [{ $type: "app.bsky.richtext.facet#link", uri: m[0] }],
85    };
86  });
87  const res = await send(
88    fetcher,
89    "POST",
90    `${BSKY}/com.atproto.repo.createRecord`,
91    {
92      repo: session.did,
93      collection: "app.bsky.feed.post",
94      record: { $type: "app.bsky.feed.post", text, createdAt: new Date(now).toISOString(), ...(facets.length ? { facets } : {}) },
95    },
96    { Authorization: `Bearer ${session.accessJwt}` },
97  );
98  if (!res.ok) throw new Error(`Bluesky post ${res.status}`);
99  return ((await res.json()) as { uri: string }).uri;
100}
101
102// ---------- X (OAuth 1.0a, Web Crypto)
103
104/** RFC 3986 percent-encoding, which OAuth 1.0a requires (encodeURIComponent leaves !'()* alone). */
105export function percentEncode(value: string): string {
106  return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
107}
108
109/**
110 * The OAuth 1.0a HMAC-SHA1 signature. Body parameters are signed only for form bodies; X's v2 JSON
111 * body is not part of the base string.
112 */
113export async function oauthSignature(
114  method: string,
115  url: string,
116  params: Record<string, string>,
117  consumerSecret: string,
118  tokenSecret: string,
119): Promise<string> {
120  const normalized = Object.entries(params)
121    .map(([k, v]) => [percentEncode(k), percentEncode(v)] as const)
122    .sort(([a, av], [b, bv]) => (a < b ? -1 : a > b ? 1 : av < bv ? -1 : av > bv ? 1 : 0))
123    .map(([k, v]) => `${k}=${v}`)
124    .join("&");
125  const base = [method.toUpperCase(), percentEncode(url), percentEncode(normalized)].join("&");
126  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(`${percentEncode(consumerSecret)}&${percentEncode(tokenSecret)}`), { name: "HMAC", hash: "SHA-1" }, false, ["sign"]);
127  const sig = new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(base)));
128  let binary = "";
129  for (const b of sig) binary += String.fromCharCode(b);
130  return btoa(binary);
131}
132
133async function postToX(creds: Extract<Credentials, { platform: "x" }>, text: string, fetcher: Fetch, now: number): Promise<string> {
134  const nonceBytes = crypto.getRandomValues(new Uint8Array(16));
135  const oauth: Record<string, string> = {
136    oauth_consumer_key: creds.apiKey,
137    oauth_nonce: [...nonceBytes].map((b) => b.toString(16).padStart(2, "0")).join(""),
138    oauth_signature_method: "HMAC-SHA1",
139    oauth_timestamp: String(Math.floor(now / 1000)),
140    oauth_token: creds.accessToken,
141    oauth_version: "1.0",
142  };
143  oauth.oauth_signature = await oauthSignature("POST", X_TWEETS, oauth, creds.apiSecret, creds.accessSecret);
144  const header = `OAuth ${Object.entries(oauth)
145    .map(([k, v]) => `${percentEncode(k)}="${percentEncode(v)}"`)
146    .join(", ")}`;
147  const res = await send(fetcher, "POST", X_TWEETS, { text }, { Authorization: header });
148  if (!res.ok) throw new Error(`X post ${res.status}`);
149  return ((await res.json()) as { data: { id: string } }).data.id;
150}
151
152/** The only exported way to post: an original post, text only. There is no reply parameter to pass. */
153export async function postOriginal(creds: Credentials, text: string, fetcher: Fetch = timedFetch, now = Date.now()): Promise<string> {
154  return creds.platform === "bluesky" ? postToBluesky(creds, text, fetcher, now) : postToX(creds, text, fetcher, now);
155}
156
157/** X's price per post since February 2026 (design section 5), in mills: $0.015, or $0.20 with a link. */
158export function xCostMills(text: string): number {
159  return /https?:\/\//.test(text) ? 200 : 15;
160}
161
162/** Credentials from secrets named for the account key: SOCIAL_<KEY>_..., dashes as underscores. */
163export function credentialsFor(env: Env, account: { key: string; platform: Platform; handle: string }): Credentials | { missing: string[] } {
164  const prefix = `SOCIAL_${account.key.toUpperCase().replace(/-/g, "_")}_`;
165  const get = (name: string) => (env as unknown as Record<string, string | undefined>)[`${prefix}${name}`]?.trim() || "";
166  if (account.platform === "bluesky") {
167    const appPassword = get("BLUESKY_APP_PASSWORD");
168    return appPassword ? { platform: "bluesky", handle: account.handle, appPassword } : { missing: [`${prefix}BLUESKY_APP_PASSWORD`] };
169  }
170  const names = ["X_API_KEY", "X_API_SECRET", "X_ACCESS_TOKEN", "X_ACCESS_SECRET"];
171  const missing = names.filter((n) => !get(n)).map((n) => `${prefix}${n}`);
172  if (missing.length) return { missing };
173  return { platform: "x", apiKey: get("X_API_KEY"), apiSecret: get("X_API_SECRET"), accessToken: get("X_ACCESS_TOKEN"), accessSecret: get("X_ACCESS_SECRET") };
174}