Finally worked some more on #FediFoxShield, my project to write a protective layer of sorts around Mastodon 4.x' newly way too exposed API
Code is a sprawling mess, but i'm also using this as a playground for some new tech, like streamed server-side React rendering with Suspense
Central to the design is that it authenticates as a local account on the instance, so you can run it with `DISALLOW_UNAUTHENTICATED_API_ACCESS`
(which would totally break the entire new frontend), and still have functional public profile and thread pages.
This also allows introducing more configurability and more consent, like letting users choose if they want to include unlisted statuses, or even show their profile publicly at all
(also it just uses the Mastodon api, so you can run it in front of a GoToSocial instance too if you wanted)