bug: Remote Follow from Mastodon instance does not work when only entering the instance domain

Created by: NilaTheDragon

💡 Summary

When attempting to use the remote follow feature of Mastodon, the user is asked to enter their instance domain (e.g. instance.social) but also allows the full username (@user@instance.social).

When entering the full username, everything works as expected but when only entering the instance domain, the remote follow will fail. This is due to Webfinger being unable to provide a response and Mastodon defaulting to a page that Sharkey simply does not have.

Mastodon Behaviour comes from here: https://github.com/mastodon/mastodon/blob/main/app/javascript/packs/remote_interaction_helper.ts Remote Follow Link with Username: https://derg.social/authorize-follow?acct= Remote Follow Link with only Instance: https://derg.social/authorize_interaction?uri=

Webfinger Response with Username (https://derg.social/.well-known/webfinger?resource=acct:nila%40derg.social):

{
  "subject": "acct:nila@derg.social",
  "links": [
    {
      "rel": "self",
      "type": "application/activity+json",
      "href": "https://derg.social/users/9h6qyg5xy0"
    },
    {
      "rel": "http://webfinger.net/rel/profile-page",
      "type": "text/html",
      "href": "https://derg.social/@nila"
    },
    {
      "rel": "http://ostatus.org/schema/1.0/subscribe",
      "template": "https://derg.social/authorize-follow?acct={uri}"
    }
  ]
}

Webfinger Response with only Instance (https://derg.social/.well-known/webfinger?resource=https:%2F%2Fderg.social):

HTTP 404

🥰 Expected Behavior

I expect the remote follow to work with just the instance as the username portion is technically irrelevant.

My first idea to fix this was: Sharkey could map authorize_interaction?uri to authorize-follow?acct or even simply route both to the Follow page and handle the query param accordingly.

🤬 Actual Behavior

I get a 404 Page on my Sharkey instance when only entering the instance domain because Sharkey does not serve the default endpoint Mastodon would expect and Webfinger failed to find anything.

I verified this behaviour against my instance, shonk.social and transfem.social.

📝 Steps to Reproduce

1. Be signed in on your home Sharkey instance
2. Go to any Mastodon profile on the remote instance. Generic Example Profile: https://mastodon.social/@Mastodon
3. Hit Follow and enter only your instance domain (e.g. instance.social)
4. You will be presented with a 404 page of your instance

💻 Frontend Environment

* Model and OS of the device(s): macOS Sonoma 14.3, MacBook Pro (M1 Family)
* Browser: Arc 1.26.2
* Server URL: https://derg.social
* Sharkey: 2023.12.0

🛰 Backend Environment (for server admin)

* Installation Method or Hosting Service: Docker / Kubernetes
* Sharkey: 2023.12.0
* Node: v21.4.0
* PostgreSQL: 15.3-0
* Redis: docker.io/bitnami/redis:7.2.3-debian-11-r2
* OS and Architecture: Rocky Linux 9, AMD64

Do you want to address this bug yourself?

• Yes, I will patch the bug myself and send a pull request

Created by: dakkar

what kind of response does mastodon expect from that webfinger request? not even their own docs explain it https://docs.joinmastodon.org/spec/webfinger/

from the code, it looks like we could respond with

{
  "subject": "https://s.example.com",
  "links": [
    {
      "rel": "http://ostatus.org/schema/1.0/subscribe",
      "template": "https://s.example.com/authorize-follow?acct={uri}"
    }
  ]
}

for comparison, https://mastodon.social/.well-known/webfinger?resource=https:%2f%2fmastodon.social returns:

{
  "subject": "acct:mastodon.social@mastodon.social",
  "aliases": [
    "https://mastodon.social/actor"
  ],
  "links": [
    {
      "rel": "http://webfinger.net/rel/profile-page",
      "type": "text/html",
      "href": "https://mastodon.social/about/more?instance_actor=true"
    },
    {
      "rel": "self",
      "type": "application/activity+json",
      "href": "https://mastodon.social/actor"
    },
    {
      "rel": "http://ostatus.org/schema/1.0/subscribe",
      "template": "https://mastodon.social/authorize_interaction?uri={uri}"
    }
  ]
}

and the self and profile-page links look… useless

so yes, we could handle that other webfinger resource, shouldn't even be too hard, it's all in https://git.joinsharkey.org/Sharkey/Sharkey/src/branch/develop/packages/backend/src/server/WellKnownServerService.ts#L101

This is basically just a duplicate of #353 (closed) as the function just generally doesn't exist (it's not simply just adding a URL into the webfinger you also need a page and etc to handle the interactions) and as stated in that issue it is being discussed upstream

Created by: NilaTheDragon

Isn't that issue about implementing a "Take me Home" button in Misskey/Sharkey?

No it is about the general remote functions which also include this hence the reason of this comment https://github.com/misskey-dev/misskey/issues/12998#issuecomment-1893013671