hyaenidae/TODO.md

# Things That Need To Be Done

## Actix Web 4.0
It's not out yet, and not everything has a beta release yet, but we should continue tracking the
status of 4.0 and update our libraries as we can.

Current status:
- actix-webfinger on actix-web 4.0.0-beta.1
- http-signature-normalization-actix on actix-web 4.0.0-beta.1
- background-jobs on actix-rt 2.0.0

## Sled 1.0
As of the time of writing, the official Sled 1.0 release date is ~~in two days~~ eventually. I'm
not sure how much the API will change, but I can assume there will be changes around flushing and
transactions, as those have been the subjects of recent PRs against Sled. Most of the other PRs
against Sled in the last month or so have been about reducing memory usage by employing a variety
of fancy techniques backed by whitepapers.

## Async
A lot of logic in the Profiles and Submissions modules synchronously accesses Sled, which is an
issue because Sled is potentially blocking. All of the Big Dangers (transactions) are safely on a
threadpool already, but a couple iterations are currently occuring directly on the Arbiters.

## Organization
A lot of modules in hyaenidae-server have circular dependencies, and a few are more than a thousand
lines long, each. These should be separated where possible into smaller modules which create a
dependency DAG

## Pagination
Tasks:
- Enable pagination for notifications
- (potentially) Enable pagination for comments on submissions
    - this one is less clear because comments are tree-structures

## Submissions
Tasks:
- Add "Mark as Sensitive" to report actions
- Ensure submission updates cannot override an administrator's "mark as sensitive" ruling
- (potentially) expose an NSFW flag on profiles to both hide profile banner image, and to default
    submissions to NSFW

## Registration
There is currently no way to disable or limit registration to Hyaenidae

Tasks:
- Add an option in the Admin settings to disable registration
- Create a concept of Invite Links which can be used N (user specified) times to register accounts
    when registration is disabled
- Add an option in the Admin settings to generate invite links

## Tags
Tags are useful for searching Hyaenidae for content. There should be a tag system that makes it
simple to search for submissions.

Tasks:
- Design a Tag database optimized for multi-tag lookups (within reason)
- Design a UI for authors to add tags to a submission
- Design ActivityPub interop for tag federation

## Reports
Reports are implemented for on-server moderation, but cross-server moderation has not been tested.

Tasks:
- Add a "delete" mechanism for remote objects. This should not induce any federation, but should
    ensure the object is not accessible locally
- Enable forwarding reports to origin server. There is already code written to perform this
    forwarding, but it is not exposed in the UI.
- Enable viewing of closed reports

## Reacts
Reacts are similar to "likes" on other platforms, but do not get added to a collection for a given
profile. Reacts only notify the author of the item being reacted to.

Tasks:
- Design a UI for reacting to submissions
- Design a UI for reacting to comments
- Design a UI for reacting to posts (see Posts)
- Decide which kinds of reacts are valid

## Posts
Posts are top-level content created by profiles that do not have associated images, and so cannot be
considered Submissions. Posts are stored and viewed separately from submissions, and are more
"ephemeral" in that they will not backfill (see Backfills).

Tasks:
- Design a Post database
- Design a UI for creating new posts
- Design a UI for viewing posts from followed accounts
- Hook Posts into Note federation code

## Direct Messages
Direct Messages are Posts that are shared directly between two profiles, and are not publically
visible to other profiles.

## Shares
Shares are a collection of submissions a profile can display that were submitted by other profiles.
They will not appear in followers' feeds, but will be visible on a given profile's page. This
feature is analogous to a public favorites gallery on other platforms, although it is separate from
"reacts", which can act as favoriting a post. Whether a profile is notified of a share is undecided.

Tasks:
- Add shares tree(s) in the data store. This is likely not much more than a single tree with a key
    consisting of the Profile ID, a timestamp, and the Submission ID, where the value of is the
    Submission ID as well. A second tree could contain Profile ID + Submission ID keys for quick
    lookups for whether a given submission has been shared by a given profile to avoid duplicates
- Add a shares page or section to the profile section of Hyaenidae.
- Implement Shares in ActivityPub as a variant of Announce Note where the Note represents a
    Submission

## Backfills
Bakfills for a given item should not be permitted to run concurrently. A single backfill task may be
permitted to have multiple requests in-flight, but no two tasks may backfill the same item. There
should also be a limit on concurrency for backfills from a given server

Tasks:
- Add Profile Backfill on federation
- Add Submission Backfill on follow

## Object Cleanup
When things get deleted or suspended, we need to ensure that the database does not hold onto any
lingering data. This includes cleaning text fields for deleted items, cleaning up dependent items on
deletion.

Tasks:
- Differentiate between Profile Deletion and Profile Suspsension
- Federate profile suspensions for local suspended profiles
- Delete profiles (and submissions and comments and reacts) for defederated servers

## Federation Fixes
Not all of federation has been tested yet

Things that have been tested:
- Federation:
    - Request
    - Accept
    - Reject
    - Defederate
- Profiles:
    - Create
    - Update
- Submissions:
    - Create
    - Update

Anything not in this list has not been tested and needs to be verified and possibly fixed.

## Blind Key Rotation
If an incoming post has an invalid key, we should try fetching the key/profile & then verifying the
signature again. This is because other softwares, like mastodon, work on the assumption that you
might not want deleted posts to be associated with your account. It's not a Big Deal IMO when only
HTTP Signatures are in use, such as in Hyaenidae, but when JSON-LD Signatures are in use by other
software, it becomes trivial to trace authorship of any object.