@nodebb/nodebb-plugin-reactions 3.0.4 → 3.1.2

package/helpers.js

@@ -0,0 +1,106 @@
+'use strict';
+
+let emojiTable = null;
+let emojiAliases = null;
+let characterIndex = null;
+
+function getEmojiTable() {
+	if (!emojiTable) {
+		emojiTable = nodebb.require('nodebb-plugin-emoji/build/emoji/table.json');
+	}
+	return emojiTable;
+}
+
+function getEmojiAliases() {
+	if (!emojiAliases) {
+		emojiAliases = nodebb.require('nodebb-plugin-emoji/build/emoji/aliases.json');
+	}
+	return emojiAliases;
+}
+
+function getCharacterIndex() {
+	if (!characterIndex) {
+		characterIndex = new Map();
+		Object.keys(getEmojiTable()).forEach((name) => {
+			const entry = getEmojiTable()[name];
+			if (entry && entry.character && !characterIndex.has(entry.character)) {
+				characterIndex.set(entry.character, name);
+			}
+		});
+	}
+	return characterIndex;
+}
+
+function resolveByName(name) {
+	if (!name || typeof name !== 'string') {
+		return null;
+	}
+	name = name.trim();
+	if (getEmojiTable()[name]) {
+		return name;
+	}
+	const aliases = getEmojiAliases();
+	if (aliases[name] && getEmojiTable()[aliases[name]]) {
+		return aliases[name];
+	}
+	return null;
+}
+
+/**
+ * Resolve FEP-c0e0 reaction content (unicode grapheme, `:shortcode:`, bare name,
+ * or a custom-emoji `tag`) to a local emoji name. Returns null when unresolvable.
+ */
+function resolveReaction(content, tag) {
+	if (typeof content !== 'string' || !content.trim()) {
+		return null;
+	}
+	const trimmed = content.trim();
+
+	let reaction;
+
+	// `:shortcode:`
+	const shortcode = trimmed.match(/^:([a-z0-9_+-]+):$/i);
+	if (shortcode) {
+		reaction = resolveByName(shortcode[1]);
+	} else {
+		// Bare name (only accepted when it resolves to a local emoji)
+		reaction = resolveByName(trimmed);
+
+		if (!reaction) {
+			// Unicode grapheme
+			const index = getCharacterIndex();
+			if (index.has(trimmed)) {
+				reaction = index.get(trimmed);
+			}
+			// Retry without variation selectors (table entries may omit them, e.g. keycaps)
+			const noVariation = trimmed.replace(/\uFE0F/g, '');
+			if (!reaction && noVariation !== trimmed && index.has(noVariation)) {
+				reaction = index.get(noVariation);
+			}
+			const firstCodepoint = [...trimmed][0];
+			if (!reaction && firstCodepoint && index.has(firstCodepoint)) {
+				reaction = index.get(firstCodepoint);
+			}
+		}
+	}
+
+	// Custom emoji: the tag carries the emoji's identity, so it is consulted
+	// when the content alone does not resolve to a local emoji (a remote
+	// custom emoji whose name matches a built-in one is usable)
+	if (!reaction && Array.isArray(tag)) {
+		const emojiTag = tag.find(t => t && t.type === 'Emoji' && typeof t.name === 'string');
+		if (emojiTag) {
+			reaction = resolveByName(emojiTag.name.replace(/^:|:$/g, ''));
+		}
+	}
+
+	return reaction;
+}
+
+module.exports = {
+	getEmojiTable,
+	getEmojiAliases,
+	getCharacterIndex,
+	resolveByName,
+	resolveReaction,
+};

package/library.js

@@ -10,28 +10,23 @@ const db = nodebb.require('./src/database');
 const translator = nodebb.require('./src/translator');
 const notifications = nodebb.require('./src/notifications');
 const routesHelpers = nodebb.require('./src/routes/helpers');
+const nconf = nodebb.require('nconf');
+const categories = nodebb.require('./src/categories');
+const activitypub = nodebb.require('./src/activitypub');
 const websockets = nodebb.require('./src/socket.io/index');
 const SocketPlugins = nodebb.require('./src/socket.io/plugins');
 
 const emojiParser = nodebb.require('nodebb-plugin-emoji/build/lib/parse.js');
-
-let emojiTable = null;
-let emojiAliases = null;
+const helpers = require('./helpers');
 
 const DEFAULT_MAX_EMOTES = 4;
 
 function nameToEmoji(name) {
-	if (!emojiTable) {
-		emojiTable = nodebb.require('nodebb-plugin-emoji/build/emoji/table.json');
-	}
-	return emojiTable[name];
+	return helpers.getEmojiTable()[name];
 }
 
 function parse(name) {
-	if (!emojiAliases) {
-		emojiAliases = nodebb.require('nodebb-plugin-emoji/build/emoji/aliases.json');
-	}
-	const emoji = nameToEmoji(name) || emojiTable[emojiAliases[name]];
+	const emoji = nameToEmoji(name) || helpers.getEmojiTable()[helpers.getEmojiAliases()[name]];
 	return emoji ? emojiParser.buildEmoji(emoji, '') : '';
 }
 
@@ -340,87 +335,292 @@ async function giveOwnerReactionReputation(reactionReputation, pid) {
 	}
 }
 
-SocketPlugins.reactions = {
-	addPostReaction: async function (socket, data) {
-		if (!socket.uid) {
-			throw new Error('[[error:not-logged-in]]');
-		}
+/**
+ * Core reaction logic, shared by the socket handlers and the ActivityPub
+ * (FEP-c0e0) inbox integration. `uid` may be a local numeric uid or a remote
+ * actor URL.
+ */
+ReactionsPlugin.addPostReaction = async function (pid, uid, reaction) {
+	const settings = await loadPluginConfig();
+	if (!settings.enablePostReactions) {
+		throw new Error('[[error:post-reactions-disabled]]');
+	}
 
-		if (!nameToEmoji(data.reaction)) {
-			throw new Error('[[reactions:error.invalid-reaction]]');
+	const [postData, totalReactions, emojiIsAlreadyExist, alreadyReacted, reactionReputation] = await Promise.all([
+		posts.getPostFields(pid, ['pid', 'tid', 'uid', 'content', 'sourceContent']),
+		db.setCount(`pid:${pid}:reactions`),
+		db.isSetMember(`pid:${pid}:reactions`, reaction),
+		db.isSetMember(`pid:${pid}:reaction:${reaction}`, uid),
+		getReactionReputation(reaction),
+	]);
+	const { tid } = postData;
+	if (!tid) {
+		throw new Error('[[error:no-post]]');
+	}
+
+	if (!emojiIsAlreadyExist) {
+		const { maximumReactions, maximumReactionsPerUserPerPost } = settings;
+		if (maximumReactions > 0 && totalReactions >= maximumReactions) {
+			throw new Error(`[[reactions:error.maximum-reached, ${maximumReactions}]]`);
 		}
 
-		const settings = await loadPluginConfig();
-		if (!settings.enablePostReactions) {
-			throw new Error('[[error:post-reactions-disabled]]');
+		if (maximumReactionsPerUserPerPost > 0) {
+			const emojiesInPost = await db.getSetMembers(`pid:${pid}:reactions`);
+			const userPostReactions = await db.isMemberOfSets(emojiesInPost.map(emojiName => `pid:${pid}:reaction:${emojiName}`), uid);
+			const userPostReactionCount = userPostReactions.filter(Boolean).length;
+			if (userPostReactionCount >= maximumReactionsPerUserPerPost) {
+				throw new Error(`[[reactions:error.maximum-per-user-per-post-reached, ${maximumReactionsPerUserPerPost}]]`);
+			}
 		}
+	}
 
-		const [postData, totalReactions, emojiIsAlreadyExist, alreadyReacted, reactionReputation] = await Promise.all([
-			posts.getPostFields(data.pid, ['pid', 'tid', 'uid', 'content', 'sourceContent']),
-			db.setCount(`pid:${data.pid}:reactions`),
-			db.isSetMember(`pid:${data.pid}:reactions`, data.reaction),
-			db.isSetMember(`pid:${data.pid}:reaction:${data.reaction}`, socket.uid),
-			getReactionReputation(data.reaction),
+	await Promise.all([
+		db.setAdd(`pid:${pid}:reactions`, reaction),
+		db.setAdd(`pid:${pid}:reaction:${reaction}`, uid),
+	]);
+
+	if (!alreadyReacted && reactionReputation > 0) {
+		await giveOwnerReactionReputation(reactionReputation, pid);
+	}
+
+	if (postData.uid && postData.uid !== uid) {
+		const [displayname, topicTitle, parsedPostData] = await Promise.all([
+			user.getNotificationDisplayname(uid),
+			topics.getNotificationTitle(tid),
+			posts.parsePost(postData),
 		]);
-		const { tid } = postData;
-		if (!tid) {
-			throw new Error('[[error:no-post]]');
-		}
-		data.uid = socket.uid;
-		data.tid = tid;
-		if (!emojiIsAlreadyExist) {
-			const { maximumReactions, maximumReactionsPerUserPerPost } = settings;
-			if (maximumReactions > 0 && totalReactions >= maximumReactions) {
-				throw new Error(`[[reactions:error.maximum-reached, ${maximumReactions}]]`);
-			}
+		const notifObj = await notifications.create({
+			type: 'reaction',
+			bodyShort: translator.compile(
+				'reactions:notification.user-has-reacted-with-to-your-post-in-topic',
+				displayname,
+				`:${reaction}:`,
+				topicTitle
+			),
+			bodyLong: parsedPostData.content,
+			nid: `uid:${uid}:pid:${pid}:reaction:${reaction}`,
+			pid: pid,
+			tid: tid,
+			from: uid,
+			path: `/post/${pid}`,
+		});
 
-			if (maximumReactionsPerUserPerPost > 0) {
-				const emojiesInPost = await db.getSetMembers(`pid:${data.pid}:reactions`);
-				const userPostReactions = await db.isMemberOfSets(emojiesInPost.map(emojiName => `pid:${data.pid}:reaction:${emojiName}`), socket.uid);
-				const userPostReactionCount = userPostReactions.filter(Boolean).length;
-				if (userPostReactionCount >= maximumReactionsPerUserPerPost) {
-					throw new Error(`[[reactions:error.maximum-per-user-per-post-reached, ${maximumReactionsPerUserPerPost}]]`);
-				}
+		await notifications.push(notifObj, [postData.uid]);
+	}
+
+	await sendPostEvent({ pid, uid, tid, reaction }, 'event:reactions.addPostReaction');
+};
+
+ReactionsPlugin.removePostReaction = async function (pid, uid, reaction) {
+	const settings = await loadPluginConfig();
+	if (!settings.enablePostReactions) {
+		throw new Error('[[error:post-reactions-disabled]]');
+	}
+
+	const [tid, hasReacted, reactionReputation] = await Promise.all([
+		posts.getPostField(pid, 'tid'),
+		db.isSetMember(`pid:${pid}:reaction:${reaction}`, uid),
+		getReactionReputation(reaction),
+	]);
+	if (!tid) {
+		throw new Error('[[error:no-post]]');
+	}
+
+	if (hasReacted) {
+		await db.setRemove(`pid:${pid}:reaction:${reaction}`, uid);
+	}
+
+	const reactionCount = await db.setCount(`pid:${pid}:reaction:${reaction}`);
+	if (reactionCount === 0) {
+		await db.setRemove(`pid:${pid}:reactions`, reaction);
+	}
+	if (hasReacted && reactionReputation > 0) {
+		await giveOwnerReactionReputation(-reactionReputation, pid);
+	}
+
+	await sendPostEvent({ pid, uid, tid, reaction }, 'event:reactions.removePostReaction');
+};
+
+ReactionsPlugin.rescindPostReaction = async function (pid, uid, reaction) {
+	await notifications.rescind(`uid:${uid}:pid:${pid}:reaction:${reaction}`);
+};
+
+/*
+	ActivityPub (FEP-c0e0) integration.
+
+	Core fires `filter:activitypub.<type>` for every incoming activity before
+	built-in handling. The filter payload is `{ req, activity, claimed }` — a
+	plugin may claim the activity (core then skips its built-in handler) and/or
+	transparently rewrite `activity` for the rest of the chain.
+
+	This plugin claims:
+	- `EmojiReact` (always — it is the implementation)
+	- `Like` with `content` (FEP-c0e0 requires identical handling)
+	- `Undo` of either of the above
+	- `Announce` of either of the above (category sync / relays)
+*/
+
+/**
+ * Resolve the (local or remote) post referenced by an EmojiReact activity.
+ * Returns a pid for local posts, the note URL for remote posts, or null when
+ * the post cannot be found.
+ * Handles both full objects (object.id) and bare URL strings.
+ */
+async function resolveReactionPost(object) {
+	// Normalize: bare URL string or { id: '...' }
+	const objectUrl = typeof object === 'string' ? object : (object?.id || null);
+	if (!objectUrl) {
+		return null;
+	}
+
+	let id;
+	let exists;
+	if (objectUrl.startsWith(nconf.get('url'))) {
+		const { type, id: localId } = await activitypub.helpers.resolveLocalId(objectUrl);
+		if (type === 'post') {
+			id = localId;
+			exists = await posts.exists(id);
+		}
+	} else {
+		id = objectUrl;
+		exists = await posts.exists(id);
+		if (!exists) {
+			// Proactively pull in the note
+			const asserted = await activitypub.notes.assert(0, id, { skipChecks: 1 });
+			if (!asserted) {
+				return null;
 			}
+			exists = true;
 		}
+	}
+	return id && exists ? id : null;
+}
 
-		await Promise.all([
-			db.setAdd(`pid:${data.pid}:reactions`, data.reaction),
-			db.setAdd(`pid:${data.pid}:reaction:${data.reaction}`, socket.uid),
-		]);
+ReactionsPlugin.applyEmojiReact = async function (activity) {
+	const { actor, object, content, tag } = activity;
 
-		if (!alreadyReacted && reactionReputation > 0) {
-			await giveOwnerReactionReputation(reactionReputation, data.pid);
+	const id = await resolveReactionPost(object);
+	if (!id) {
+		return;
+	}
+
+	const reaction = helpers.resolveReaction(content, tag);
+	if (!reaction) {
+		activitypub.helpers.log(`[reactions/ap] Unresolvable reaction content (${JSON.stringify(content)}), ignoring.`);
+		return;
+	}
+
+	const allowed = await privileges.posts.can('posts:upvote', id, activitypub._constants.uid);
+	if (!allowed) {
+		activitypub.helpers.log(`[reactions/ap] ${id} not allowed to be reacted on.`);
+		throw new Error('[[error:no-privileges]]');
+	}
+
+	activitypub.helpers.log(`[reactions/ap] id ${id} (${reaction}) via ${actor}`);
+	await ReactionsPlugin.addPostReaction(id, actor, reaction);
+	await activitypub.feps.announce(object.id, activity);
+};
+
+ReactionsPlugin.undoEmojiReact = async function (activity) {
+	const { actor, object, content, tag } = activity;
+
+	const id = await resolveReactionPost(object);
+	if (!id) {
+		return;
+	}
+
+	const reaction = helpers.resolveReaction(content, tag);
+	if (!reaction) {
+		activitypub.helpers.log(`[reactions/ap] Unresolvable reaction content in undo, ignoring.`);
+		return;
+	}
+
+	activitypub.helpers.log(`[reactions/ap] undo id ${id} (${reaction}) via ${actor}`);
+	await ReactionsPlugin.removePostReaction(id, actor, reaction);
+	await ReactionsPlugin.rescindPostReaction(id, actor, reaction);
+	await activitypub.feps.announce(object.id, activity);
+};
+
+ReactionsPlugin.handleEmojiReact = async function (context) {
+	await ReactionsPlugin.applyEmojiReact(context.activity);
+	return { ...context, claimed: true };
+};
+
+ReactionsPlugin.handleLike = async function (context) {
+	// FEP-c0e0: a Like with content is an emoji reaction; a plain Like falls through to core
+	if (typeof context.activity.content === 'string' && context.activity.content.trim()) {
+		await ReactionsPlugin.applyEmojiReact(context.activity);
+		return { ...context, claimed: true };
+	}
+	return context;
+};
+
+ReactionsPlugin.handleUndo = async function (context) {
+	const { object } = context.activity;
+	if (!object || (object.type !== 'EmojiReact' && !(object.type === 'Like' && typeof object.content === 'string' && object.content.trim()))) {
+		return context;
+	}
+	await ReactionsPlugin.undoEmojiReact(object);
+	return { ...context, claimed: true };
+};
+
+ReactionsPlugin.handleAnnounce = async function (context) {
+	const { actor } = context.activity;
+
+	// Unwrap nested Announces and resolve string references, mirroring core
+	let { object } = context.activity;
+	while (object && object.type === 'Announce') {
+		object = object.object;
+	}
+	if (typeof object === 'string') {
+		try {
+			object = await activitypub.helpers.resolveObjects(object);
+		} catch (e) {
+			object = { id: object };
 		}
+	}
+	if (!object || (object.type !== 'EmojiReact' && !(object.type === 'Like' && typeof object.content === 'string' && object.content.trim()))) {
+		return context;
+	}
 
-		if (postData.uid && postData.uid !== socket.uid) {
-			const [displayname, topicTitle, parsedPostData] = await Promise.all([
-				user.getNotificationDisplayname(socket.uid),
-				topics.getNotificationTitle(data.tid),
-				posts.parsePost(postData),
-			]);
-			const notifObj = await notifications.create({
-				type: 'reaction',
-				bodyShort: translator.compile(
-					'reactions:notification.user-has-reacted-with-to-your-post-in-topic',
-					displayname,
-					`:${data.reaction}:`,
-					topicTitle
-				),
-				bodyLong: parsedPostData.content,
-				nid: `uid:${socket.uid}:pid:${data.pid}:reaction:${data.reaction}`,
-				pid: data.pid,
-				tid: data.tid,
-				from: socket.uid,
-				path: `/post/${data.pid}`,
-			});
+	// Only category-synced or relayed announces reach local posts
+	const fromRelay = await activitypub.relays.is(actor);
+	const categoryActor = await categories.exists(actor);
+	if (!categoryActor && !fromRelay) {
+		return context;
+	}
+
+	if (categoryActor) {
+		// Mirrors core's protection: category actors can only announce activities
+		// concerning posts in said category (the post's cid is the category actor URL)
+		let id = (object.object && object.object.id) || object.object;
+		const { id: localId } = await activitypub.helpers.resolveLocalId(id);
+		id = localId || id;
 
-			await notifications.push(notifObj, [postData.uid]);
+		if (!(await posts.exists(id)) || (await posts.getCidByPid(id)) !== actor) {
+			return context;
 		}
+	}
 
-		await sendPostEvent(data, 'event:reactions.addPostReaction');
-	},
-	removePostReaction: async function (socket, data) {
+	if (!(await activitypub.actors.assert(object.actor))) {
+		throw new Error('[[error:activitypub.invalid-id]]');
+	}
+
+	if (typeof object.object === 'string') {
+		try {
+			object.object = await activitypub.helpers.resolveObjects(object.object);
+		} catch (e) {
+			activitypub.helpers.log(`[reactions/ap] Failed to resolve announced object, using raw id: ${object.object}`);
+			object.object = { id: object.object };
+		}
+	}
+
+	await ReactionsPlugin.applyEmojiReact(object);
+	return { ...context, claimed: true };
+};
+
+SocketPlugins.reactions = {
+	addPostReaction: async function (socket, data) {
 		if (!socket.uid) {
 			throw new Error('[[error:not-logged-in]]');
 		}
@@ -429,34 +629,20 @@ SocketPlugins.reactions = {
 			throw new Error('[[reactions:error.invalid-reaction]]');
 		}
 
-		const [settings, tid, hasReacted, reactionReputation] = await Promise.all([
-			loadPluginConfig(),
-			posts.getPostField(data.pid, 'tid'),
-			db.isSetMember(`pid:${data.pid}:reaction:${data.reaction}`, socket.uid),
-			getReactionReputation(data.reaction),
-		]);
-		if (!settings.enablePostReactions) {
-			throw new Error('[[error:post-reactions-disabled]]');
-		}
-		if (!tid) {
-			throw new Error('[[error:no-post]]');
-		}
 		data.uid = socket.uid;
-		data.tid = tid;
-
-		if (hasReacted) {
-			await db.setRemove(`pid:${data.pid}:reaction:${data.reaction}`, socket.uid);
+		await ReactionsPlugin.addPostReaction(data.pid, socket.uid, data.reaction);
+	},
+	removePostReaction: async function (socket, data) {
+		if (!socket.uid) {
+			throw new Error('[[error:not-logged-in]]');
 		}
 
-		const reactionCount = await db.setCount(`pid:${data.pid}:reaction:${data.reaction}`);
-		if (reactionCount === 0) {
-			await db.setRemove(`pid:${data.pid}:reactions`, data.reaction);
-		}
-		if (hasReacted && reactionReputation > 0) {
-			await giveOwnerReactionReputation(-reactionReputation, data.pid);
+		if (!nameToEmoji(data.reaction)) {
+			throw new Error('[[reactions:error.invalid-reaction]]');
 		}
 
-		await sendPostEvent(data, 'event:reactions.removePostReaction');
+		data.uid = socket.uid;
+		await ReactionsPlugin.removePostReaction(data.pid, socket.uid, data.reaction);
 	},
 	addMessageReaction: async function (socket, data) {
 		if (!socket.uid) {

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@nodebb/nodebb-plugin-reactions",
-  "version": "3.0.4",
+  "version": "3.1.2",
   "nbbpm": {
-    "compatibility": "^4.14.0"
+    "compatibility": "^4.16.0"
   },
   "description": "Reactions plugin for NodeBB",
   "main": "library.js",

package/plugin.json

@@ -3,7 +3,6 @@
     "name": "NodeBB Reactions",
     "description": "Reactions plugin for NodeBB",
     "url": "https://github.com/NodeBB-Community/nodebb-plugin-reactions",
-    "library": "./library.js",
     "templates": "templates",
     "languages": "languages",
     "scss": [
@@ -24,6 +23,10 @@
         { "hook": "filter:messaging.getMessages", "method": "getMessageReactions" },
         { "hook": "filter:post.get", "method": "onReply" },
         { "hook": "action:posts.purge", "method": "deleteReactions" },
+        { "hook": "filter:activitypub.emojireact", "method": "handleEmojiReact" },
+        { "hook": "filter:activitypub.like", "method": "handleLike" },
+        { "hook": "filter:activitypub.undo", "method": "handleUndo" },
+        { "hook": "filter:activitypub.announce", "method": "handleAnnounce" },
         { "hook": "filter:notifications.addFilters", "method": "addNotificationFilters" },
         { "hook": "filter:user.notificationTypes", "method": "notificationTypes" }
     ]

package/test/index.js

@@ -0,0 +1,506 @@
+'use strict';
+
+/* globals nodebb, describe, it, before, after, beforeEach */
+
+const assert = require('assert');
+const util = require('util');
+
+const sleep = util.promisify(setTimeout);
+
+const db = nodebb.require('./test/mocks/databasemock');
+const nconf = nodebb.require('nconf');
+const meta = nodebb.require('./src/meta');
+const install = nodebb.require('./src/install');
+const user = nodebb.require('./src/user');
+const categories = nodebb.require('./src/categories');
+const topics = nodebb.require('./src/topics');
+const posts = nodebb.require('./src/posts');
+const privileges = nodebb.require('./src/privileges');
+const controllers = nodebb.require('./src/controllers');
+const activitypub = nodebb.require('./src/activitypub');
+const utils = nodebb.require('./src/utils');
+const SocketPlugins = nodebb.require('./src/socket.io/plugins');
+const apHelpers = nodebb.require('./test/activitypub/helpers');
+
+const plugin = require('../library');
+const helpers = require('../helpers');
+
+describe('helpers.resolveReaction', () => {
+	it('should resolve a unicode grapheme', () => {
+		assert.strictEqual(helpers.resolveReaction('🔥'), 'fire');
+	});
+
+	it('should resolve a :shortcode:', () => {
+		assert.strictEqual(helpers.resolveReaction(':fire:'), 'fire');
+	});
+
+	it('should resolve a bare name', () => {
+		assert.strictEqual(helpers.resolveReaction('fire'), 'fire');
+	});
+
+	it('should resolve an aliased :shortcode:', () => {
+		assert.strictEqual(helpers.resolveReaction(':telephone:'), 'phone');
+	});
+
+	it('should resolve the character of an aliased emoji', () => {
+		assert.strictEqual(helpers.resolveReaction('☎'), 'phone');
+	});
+
+	it('should resolve a keycap with a variation selector', () => {
+		assert.strictEqual(helpers.resolveReaction('1️⃣'), 'one'); // "1" + U+FE0F + U+20E3
+	});
+
+	it('should resolve a keycap without a variation selector', () => {
+		assert.strictEqual(helpers.resolveReaction('1⃣'), 'one'); // "1" + U+20E3
+	});
+
+	it('should resolve by first codepoint when the full grapheme is not in the table', () => {
+		// waving hand + medium-light skin tone → wave
+		assert.strictEqual(helpers.resolveReaction('👋🏻'), 'wave');
+	});
+
+	it('should resolve a custom emoji tag that matches a local emoji', () => {
+		assert.strictEqual(helpers.resolveReaction(':blobwtf:', [{ type: 'Emoji', name: ':fire:' }]), 'fire');
+	});
+
+	it('should return null for a custom emoji tag that does not match locally', () => {
+		assert.strictEqual(helpers.resolveReaction(':blobwtf:', [{ type: 'Emoji', name: ':blobwtf:' }]), null);
+	});
+
+	it('should return null for unresolvable content', () => {
+		assert.strictEqual(helpers.resolveReaction(':nope:'), null);
+		assert.strictEqual(helpers.resolveReaction('🛸'), null);
+		assert.strictEqual(helpers.resolveReaction('blobwtf'), null);
+		assert.strictEqual(helpers.resolveReaction(''), null);
+		assert.strictEqual(helpers.resolveReaction(null), null);
+	});
+});
+
+describe('ActivityPub (FEP-c0e0)', () => {
+	const remoteActor = 'https://example.org/user/reactions-tester';
+	const defaultSettings = {
+		enablePostReactions: 'on',
+		'reaction-reputations': [{ reaction: 'fire', reputation: 5 }],
+	};
+
+	let apEnabled;
+	let cid;
+	let ownerUid;
+	let postData;
+
+	before(async () => {
+		apEnabled = meta.config.activitypubEnabled;
+		meta.config.activitypubEnabled = 1;
+		nconf.set('runJobs', 1);
+		await install.giveWorldPrivileges();
+		await meta.settings.set('reactions', defaultSettings);
+		({ cid } = await categories.create({ name: utils.generateUUID().slice(0, 8) }));
+	});
+
+	after(async () => {
+		meta.config.activitypubEnabled = apEnabled;
+		nconf.set('runJobs', undefined);
+		await meta.settings.set('reactions', defaultSettings);
+	});
+
+	beforeEach(async () => {
+		ownerUid = await user.create({ username: utils.generateUUID().slice(0, 10) });
+		({ postData } = await topics.post({
+			uid: ownerUid,
+			cid,
+			title: utils.generateUUID(),
+			content: utils.generateUUID(),
+		}));
+	});
+
+	function reactionActivity(override = {}) {
+		const activity = {
+			'@context': 'https://www.w3.org/ns/activitystreams',
+			id: `https://example.org/activity/${utils.generateUUID()}`,
+			type: 'EmojiReact',
+			actor: remoteActor,
+			object: {
+				type: 'Note',
+				id: `${nconf.get('url')}/post/${postData.pid}`,
+			},
+			content: '🔥',
+		};
+		Object.assign(activity, override);
+		return activity;
+	}
+
+	function mockRes() {
+		const res = { req: { method: 'POST', loggedIn: false }, statusCode: null, payload: null };
+		res.set = (key, value) => {
+			res[key] = value;
+		};
+		res.status = (code) => {
+			res.statusCode = code;
+			return res;
+		};
+		res.json = (payload) => {
+			res.payload = payload;
+			return res;
+		};
+		res.sendStatus = (code) => {
+			res.statusCode = code;
+		};
+		return res;
+	}
+
+	it('should still ignore unknown activity types (200) when the plugin is installed', async () => {
+		const res = mockRes();
+		await controllers.activitypub.postInbox({
+			body: {
+				id: `https://example.org/activity/${utils.generateUUID()}`,
+				type: 'BlowAWhistle',
+				actor: remoteActor,
+				object: { id: `${nconf.get('url')}/post/${postData.pid}` },
+			},
+		}, res);
+
+		assert.strictEqual(res.statusCode, 200);
+	});
+
+	describe('EmojiReact', () => {
+		it('should store a reaction from a unicode grapheme on a local post', async () => {
+			const res = mockRes();
+			await controllers.activitypub.postInbox({ body: reactionActivity() }, res);
+
+			assert.strictEqual(res.statusCode, 202);
+			assert(await db.isSetMember(`pid:${postData.pid}:reactions`, 'fire'));
+			assert(await db.isSetMember(`pid:${postData.pid}:reaction:fire`, remoteActor));
+		});
+
+		it('should store a reaction from a :shortcode:', async () => {
+			const res = mockRes();
+			await controllers.activitypub.postInbox({ body: reactionActivity({ content: ':fire:' }) }, res);
+
+			assert.strictEqual(res.statusCode, 202);
+			assert(await db.isSetMember(`pid:${postData.pid}:reactions`, 'fire'));
+		});
+
+		it('should notify the post owner', async () => {
+			const res = mockRes();
+			await controllers.activitypub.postInbox({ body: reactionActivity() }, res);
+
+			// notifications.push is deferred (500ms) through the batch queue
+			await sleep(700);
+			const nid = `uid:${remoteActor}:pid:${postData.pid}:reaction:fire`;
+			assert(await db.isSortedSetMember(`uid:${ownerUid}:notifications:unread`, nid));
+		});
+
+		it('should grant reaction reputation only once per reactor', async () => {
+			const res = mockRes();
+			await controllers.activitypub.postInbox({ body: reactionActivity() }, res);
+			await controllers.activitypub.postInbox({ body: reactionActivity() }, res);
+
+			assert.strictEqual(parseInt(await user.getUserField(ownerUid, 'reputation'), 10), 5);
+			assert.strictEqual(await db.setCount(`pid:${postData.pid}:reaction:fire`), 1);
+		});
+
+		it('should not upvote the post', async () => {
+			const res = mockRes();
+			await controllers.activitypub.postInbox({ body: reactionActivity() }, res);
+
+			const { upvoted } = await posts.hasVoted(postData.pid, remoteActor);
+			assert.strictEqual(upvoted, false);
+			assert.strictEqual(await posts.getPostField(postData.pid, 'upvotes'), 0);
+		});
+
+		it('should ignore unresolvable custom emoji', async () => {
+			const res = mockRes();
+			await controllers.activitypub.postInbox({
+				body: reactionActivity({
+					content: ':blobwtf:',
+					tag: [{ type: 'Emoji', name: ':blobwtf:' }],
+				}),
+			}, res);
+
+			assert.strictEqual(res.statusCode, 202);
+			assert.strictEqual(await db.setCount(`pid:${postData.pid}:reactions`), 0);
+		});
+
+		describe('with posts:upvote revoked from the fediverse pseudo-user', () => {
+			before(async () => {
+				await privileges.categories.rescind(['groups:posts:upvote'], cid, 'fediverse');
+			});
+
+			after(async () => {
+				await privileges.categories.give(['groups:posts:upvote'], cid, 'fediverse');
+			});
+
+			it('should throw [[error:no-privileges]]', async () => {
+				try {
+					await plugin.applyEmojiReact(reactionActivity());
+					assert.fail('expected applyEmojiReact to throw');
+				} catch (e) {
+					assert.strictEqual(e.message, '[[error:no-privileges]]');
+				}
+			});
+		});
+	});
+
+	describe('Like with content', () => {
+		it('should store a reaction, not an upvote', async () => {
+			const res = mockRes();
+			await controllers.activitypub.postInbox({
+				body: { ...reactionActivity({ type: 'Like' }) },
+			}, res);
+
+			assert.strictEqual(res.statusCode, 202);
+			assert(await db.isSetMember(`pid:${postData.pid}:reactions`, 'fire'));
+			const { upvoted } = await posts.hasVoted(postData.pid, remoteActor);
+			assert.strictEqual(upvoted, false);
+		});
+	});
+
+	describe('Undo', () => {
+		async function react() {
+			const res = mockRes();
+			await controllers.activitypub.postInbox({ body: reactionActivity() }, res);
+			assert.strictEqual(res.statusCode, 202);
+		}
+
+		it('should remove an EmojiReact reaction', async () => {
+			await react();
+			const original = reactionActivity();
+
+			const res = mockRes();
+			await controllers.activitypub.postInbox({
+				body: {
+					id: `https://example.org/activity/${utils.generateUUID()}`,
+					type: 'Undo',
+					actor: remoteActor,
+					object: original,
+				},
+			}, res);
+
+			assert.strictEqual(res.statusCode, 202);
+			assert(!(await db.isSetMember(`pid:${postData.pid}:reactions`, 'fire')));
+			assert(!(await db.isSetMember(`pid:${postData.pid}:reaction:fire`, remoteActor)));
+		});
+
+		it('should rescind the post owner notification', async () => {
+			await react();
+			await sleep(700);
+			const nid = `uid:${remoteActor}:pid:${postData.pid}:reaction:fire`;
+			assert(await db.isSortedSetMember(`uid:${ownerUid}:notifications:unread`, nid));
+
+			const res = mockRes();
+			await controllers.activitypub.postInbox({
+				body: {
+					id: `https://example.org/activity/${utils.generateUUID()}`,
+					type: 'Undo',
+					actor: remoteActor,
+					object: reactionActivity(),
+				},
+			}, res);
+
+			// the notification object is deleted (stale entries are pruned lazily)
+			assert(!(await db.exists(`notifications:${nid}`)));
+			assert(!(await db.isSortedSetMember('notifications', nid)));
+		});
+
+		it('should remove a Like-with-content reaction without touching the vote', async () => {
+			const like = { ...reactionActivity({ type: 'Like' }) };
+			const res = mockRes();
+			await controllers.activitypub.postInbox({ body: like }, res);
+			assert.strictEqual(res.statusCode, 202);
+
+			const undoRes = mockRes();
+			await controllers.activitypub.postInbox({
+				body: {
+					id: `https://example.org/activity/${utils.generateUUID()}`,
+					type: 'Undo',
+					actor: remoteActor,
+					object: like,
+				},
+			}, undoRes);
+
+			assert.strictEqual(undoRes.statusCode, 202);
+			assert(!(await db.isSetMember(`pid:${postData.pid}:reactions`, 'fire')));
+			assert.strictEqual(await posts.getPostField(postData.pid, 'upvotes'), 0);
+		});
+
+		it('should not claim undos of plain activities (core handles them)', async () => {
+			// plain Like (no content) → core upvotes
+			const plainLike = {
+				id: `https://example.org/activity/${utils.generateUUID()}`,
+				type: 'Like',
+				actor: remoteActor,
+				object: { type: 'Note', id: `${nconf.get('url')}/post/${postData.pid}` },
+			};
+			const res = mockRes();
+			await controllers.activitypub.postInbox({ body: plainLike }, res);
+			assert.strictEqual(res.statusCode, 202);
+			const { upvoted } = await posts.hasVoted(postData.pid, remoteActor);
+			assert.strictEqual(upvoted, true);
+
+			// plain Undo(Like) → core unvotes
+			const undoRes = mockRes();
+			await controllers.activitypub.postInbox({
+				body: {
+					id: `https://example.org/activity/${utils.generateUUID()}`,
+					type: 'Undo',
+					actor: remoteActor,
+					object: plainLike,
+				},
+			}, undoRes);
+			assert.strictEqual(undoRes.statusCode, 202);
+			const { upvoted: stillUpvoted } = await posts.hasVoted(postData.pid, remoteActor);
+			assert.strictEqual(stillUpvoted, false);
+		});
+
+		it('should handle Undo(Like) when object is a bare URL (not a full activity)', async () => {
+			// Some senders send the object as a bare URL instead of the full Like activity
+			const likeRes = mockRes();
+			await controllers.activitypub.postInbox({
+				body: { ...reactionActivity({ type: 'Like' }) },
+			}, likeRes);
+			assert.strictEqual(likeRes.statusCode, 202);
+
+			// Undo with a bare URL as the object — core inbox.undo normalizes this
+			// but the plugin's handleUndo fires first and must not crash
+			const undoRes = mockRes();
+			await controllers.activitypub.postInbox({
+				body: {
+					id: `https://example.org/activity/${utils.generateUUID()}`,
+					type: 'Undo',
+					actor: remoteActor,
+					object: `${nconf.get('url')}/post/${postData.pid}`,
+				},
+			}, undoRes);
+			// The plugin can't claim this (missing inner activity content), core handles it
+			assert.strictEqual(undoRes.statusCode, 202);
+		});
+	});
+
+	describe('Announce', () => {
+		let remoteCid;
+		let remotePostId;
+		let emojiReact;
+
+		before(async function () {
+			({ id: remoteCid } = apHelpers.mocks.group());
+			await activitypub.actors.assertGroup([remoteCid]);
+
+			// A remote post that lands in the remote category
+			const { note, id } = apHelpers.mocks.note({ audience: [remoteCid] });
+			const { activity } = apHelpers.mocks.create(note);
+			await activitypub.inbox.create({ body: activity });
+			this.remotePostId = id;
+			remotePostId = id;
+
+			emojiReact = {
+				id: `https://example.org/activity/${utils.generateUUID()}`,
+				type: 'EmojiReact',
+				actor: remoteActor,
+				object: { type: 'Note', id },
+				content: '🔥',
+			};
+		});
+
+		it('should ignore EmojiReact announces from non-category, non-relay actors', async () => {
+			const { activity } = apHelpers.mocks.announce({ actor: remoteActor, object: emojiReact });
+			const res = mockRes();
+			await controllers.activitypub.postInbox({ body: activity }, res);
+
+			// falls through to core's announce handler, which also does nothing for this
+			assert.strictEqual(res.statusCode, 202);
+			assert.strictEqual(await db.setCount(`pid:${remotePostId}:reactions`), 0);
+		});
+
+		it('should apply a reaction announced by the remote category', async () => {
+			const { activity } = apHelpers.mocks.announce({ actor: remoteCid, object: emojiReact });
+			const res = mockRes();
+			await controllers.activitypub.postInbox({ body: activity }, res);
+
+			assert.strictEqual(res.statusCode, 202);
+			assert(await db.isSetMember(`pid:${remotePostId}:reactions`, 'fire'));
+			assert(await db.isSetMember(`pid:${remotePostId}:reaction:fire`, remoteActor));
+		});
+	});
+});
+
+describe('Socket handlers', () => {
+	const defaultSettings = {
+		enablePostReactions: 'on',
+		'reaction-reputations': [{ reaction: 'fire', reputation: 5 }],
+	};
+
+	let cid;
+	let uid;
+	let postData;
+
+	before(async () => {
+		({ cid } = await categories.create({ name: utils.generateUUID().slice(0, 8) }));
+		await meta.settings.set('reactions', defaultSettings);
+	});
+
+	after(async () => {
+		await meta.settings.set('reactions', defaultSettings);
+	});
+
+	beforeEach(async () => {
+		uid = await user.create({ username: utils.generateUUID().slice(0, 10) });
+		({ postData } = await topics.post({
+			uid,
+			cid,
+			title: utils.generateUUID(),
+			content: utils.generateUUID(),
+		}));
+	});
+
+	it('should add a reaction', async () => {
+		await SocketPlugins.reactions.addPostReaction({ uid }, { pid: postData.pid, reaction: 'fire' });
+		assert(await db.isSetMember(`pid:${postData.pid}:reaction:fire`, uid));
+	});
+
+	it('should require a logged-in socket', async () => {
+		try {
+			await SocketPlugins.reactions.addPostReaction({}, { pid: postData.pid, reaction: 'fire' });
+			assert.fail('expected addPostReaction to throw');
+		} catch (e) {
+			assert.strictEqual(e.message, '[[error:not-logged-in]]');
+		}
+	});
+
+	it('should reject unknown reaction names', async () => {
+		try {
+			await SocketPlugins.reactions.addPostReaction({ uid }, { pid: postData.pid, reaction: 'notarealemoji' });
+			assert.fail('expected addPostReaction to throw');
+		} catch (e) {
+			assert.strictEqual(e.message, '[[reactions:error.invalid-reaction]]');
+		}
+	});
+
+	it('should remove a reaction', async () => {
+		await SocketPlugins.reactions.addPostReaction({ uid }, { pid: postData.pid, reaction: 'fire' });
+		await SocketPlugins.reactions.removePostReaction({ uid }, { pid: postData.pid, reaction: 'fire' });
+		assert(!(await db.isSetMember(`pid:${postData.pid}:reaction:fire`, uid)));
+		assert(!(await db.isSetMember(`pid:${postData.pid}:reactions`, 'fire')));
+	});
+
+	it('should enforce the maximumReactions cap', async () => {
+		await meta.settings.set('reactions', { ...defaultSettings, maximumReactions: '2' });
+		await SocketPlugins.reactions.addPostReaction({ uid }, { pid: postData.pid, reaction: 'fire' });
+		await SocketPlugins.reactions.addPostReaction({ uid }, { pid: postData.pid, reaction: 'phone' });
+		try {
+			await SocketPlugins.reactions.addPostReaction({ uid }, { pid: postData.pid, reaction: 'smile' });
+			assert.fail('expected addPostReaction to throw');
+		} catch (e) {
+			assert(e.message.startsWith('[[reactions:error.maximum-reached, '));
+		}
+	});
+
+	it('should throw when post reactions are disabled', async () => {
+		await meta.settings.set('reactions', { ...defaultSettings, enablePostReactions: 'off' });
+		try {
+			await SocketPlugins.reactions.addPostReaction({ uid }, { pid: postData.pid, reaction: 'fire' });
+			assert.fail('expected addPostReaction to throw');
+		} catch (e) {
+			assert.strictEqual(e.message, '[[error:post-reactions-disabled]]');
+		}
+	});
+});