Copypasta from a list of general ActivityPub implementation tasks from pump.io:
Have we implemented URLs for:
- Object id properties? (Section 3.2 Retrieving objects)
- Actor inboxes?
- Actor outboxes?
- Actor Following collections?
- Actor Followers collections?
- Actor Likes collections? (optional)
- Binary uploads? (Section 6 Uploading Media, optional not optional for us)
Do we handle:
- The special Public collection?
- Local Activity side effects (including Undo side effects)?
- Server-to-server Activity side effects?
- Linked Data Notifications RDF representations (very optional)? (Section 8.1 Delivery) not for us
- Properly support Actor simplified login naming? (Section 4)
- Deliver activities properly?
- Implement authentication and authorization checks for clients?
- Do the same for server-to-server interactions?
- Scrub Activities for cross-site scripting attacks?
- Have a plan for combating spam?
In addition to the generic AP stuff:
- Handle AS2 vs. AS1 differences (old pump.io support)
- Test everything