fix(federation): batch A production readiness — normalization, logging, security

FED-001: normalize homeInstance in processCreateEvent member skip
FED-002: normalize homeInstance in getFriendEventTargets
FED-003: normalize homeInstance in handleSizeRejection
FED-004: add warning log when queueOutboxEvent drops events (zero peer match)
FED-012: remove unused challenge from peer handshake
FED-013: reject non-HTTPS origins in validateOrigin (except localhost)

packages/server/src/utils/federationOutbox.ts

@@ -149,6 +149,9 @@ export function queueOutboxEvent(
       : activePeers;
 
     if (peers.length === 0) {
+      if (targetPeerOrigins) {
+        console.warn(`[federation] queueOutboxEvent: zero peers matched targets ${JSON.stringify(targetPeerOrigins)}. Active peer origins: ${JSON.stringify(activePeers.map(p => p.origin))}`);
+      }
       return;
     }
 
@@ -245,6 +248,7 @@ export function getDmParticipants(dmChannelId: string): FederationRelayParticipa
       homeUserId: schema.users.homeUserId,
       homeInstance: schema.users.homeInstance,
       id: schema.users.id,
+      username: schema.users.username,
       displayName: schema.users.displayName,
       avatar: schema.users.avatar,
       avatarColor: schema.users.avatarColor,
@@ -260,6 +264,7 @@ export function getDmParticipants(dmChannelId: string): FederationRelayParticipa
     homeUserId: m.homeUserId || m.id,
     homeInstance: m.homeInstance || domainOrigin,
     profile: {
+      username: m.username ?? null,
       displayName: m.displayName ?? null,
       avatar: m.avatar ?? null,
       avatarColor: m.avatarColor ?? null,
@@ -371,11 +376,14 @@ export function getFriendEventTargets(
   const ourOrigin = getOurOrigin();
   const targets = new Set<string>();
 
-  if (fromHomeInstance && fromHomeInstance !== ourOrigin) {
-    targets.add(fromHomeInstance);
+  const normalizedFrom = fromHomeInstance?.startsWith('http') ? fromHomeInstance : fromHomeInstance ? `https://${fromHomeInstance}` : null;
+  const normalizedTo = toHomeInstance?.startsWith('http') ? toHomeInstance : toHomeInstance ? `https://${toHomeInstance}` : null;
+
+  if (normalizedFrom && normalizedFrom !== ourOrigin) {
+    targets.add(normalizedFrom);
   }
-  if (toHomeInstance && toHomeInstance !== ourOrigin) {
-    targets.add(toHomeInstance);
+  if (normalizedTo && normalizedTo !== ourOrigin) {
+    targets.add(normalizedTo);
   }
 
   return Array.from(targets);

packages/server/src/utils/federationWorker.ts

@@ -421,7 +421,8 @@ function handleSizeRejection(
       .from(schema.users)
       .where(eq(schema.users.id, member.userId))
       .get();
-    if (user && (!user.homeInstance || user.homeInstance === ourOrigin)) {
+    const userHome = user?.homeInstance?.startsWith('http') ? user.homeInstance : user?.homeInstance ? `https://${user.homeInstance}` : null;
+    if (user && (!user.homeInstance || userHome === ourOrigin)) {
       affectedUserIds.push(user.homeUserId || user.id);
     }
   }