Federation Refactoring & Architecture Improvements (#930)

* initial commit

* add lists

* update permissions

* fix waypoint create

* needs_full_sync for activitypub trails

* fixes build issues

* fix list get

* further CSRF protection

* update API docs

* adds rate limiter

* fix tiptap mentions

* a bit more cleanup of main.go

* Fix migration order

* fixes reviewed notes

* require context for activitpub server calls

* improve hashing for identifier

* fix copy paste error

* fix sync trail/list issues

* fix summit log/comment duplicates

* adaptions after trail merge

* fix dockerignore

---------

Co-authored-by: Christian Beutel <>
Co-authored-by: slothful-vassal <89943360+slothful-vassal@users.noreply.github.com>

db/util/sanitize.go

@@ -0,0 +1,43 @@
+package util
+
+import (
+	"github.com/microcosm-cc/bluemonday"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+func SanitizeHTML() func(e *core.RecordRequestEvent) error {
+	return func(e *core.RecordRequestEvent) error {
+		fieldsToSanitize := map[string][]string{
+			"lists":       {"description"},
+			"settings":    {"bio"},
+			"summit_logs": {"text"},
+			"trails":      {"description"},
+			"comments":    {"text"},
+			"waypoints":   {"description"},
+		}
+		collection := e.Collection.Name
+		fields, ok := fieldsToSanitize[collection]
+		if !ok {
+			return e.Next()
+		}
+
+		p := bluemonday.NewPolicy()
+		p.AllowStandardAttributes()
+		p.AllowStandardURLs()
+		p.AllowLists()
+		p.AllowElements("br", "div", "hr", "p", "span", "wbr")
+		p.AllowElements("b", "strong", "em", "u", "blockquote", "a")
+		p.AllowAttrs("href").OnElements("a")
+		p.AllowAttrs("target").OnElements("a")
+		p.AllowAttrs("class").OnElements("a")
+
+		for _, field := range fields {
+			if val, ok := e.Record.Get(field).(string); ok {
+				sanitizedValue := p.Sanitize(val)
+				e.Record.Set(field, sanitizedValue)
+			}
+		}
+
+		return e.Next()
+	}
+}