@takosjp/yurucommu-core 3.0.0

package/src/backend/lib/chunk.ts

@@ -0,0 +1,33 @@
+/**
+ * Cloudflare D1 allows at most 100 bound parameters per query. A Drizzle
+ * `inArray(col, ids)` / `notInArray(col, ids)` binds ONE parameter per id, so
+ * any id list re-queried via IN(...) must be split into chunks of <=90 (leaving
+ * headroom for the other bound params in the same statement) and the per-chunk
+ * results merged.
+ *
+ * This is invisible in CI: the tests run on libsql / better-sqlite3, whose
+ * ~32k-parameter ceiling never trips, so an over-large IN(...) passes locally
+ * but throws "too many SQL variables" on production D1. Prefer a `db.select`
+ * subquery (`col IN (SELECT ...)`, zero per-element params) when the id set is
+ * itself a query result; use this chunker when the ids only exist as an
+ * in-memory JS array.
+ */
+export const D1_IN_CHUNK = 90;
+
+/**
+ * Split `items` into consecutive chunks of at most `size` (default
+ * {@link D1_IN_CHUNK}). Returns `[]` for an empty input and `[items]` when it
+ * already fits in a single chunk (no copy).
+ */
+export function chunkForInClause<T>(
+  items: T[],
+  size: number = D1_IN_CHUNK,
+): T[][] {
+  if (items.length === 0) return [];
+  if (items.length <= size) return [items];
+  const out: T[][] = [];
+  for (let i = 0; i < items.length; i += size) {
+    out.push(items.slice(i, i + size));
+  }
+  return out;
+}

package/src/backend/lib/client-ip.ts

@@ -0,0 +1,169 @@
+import type { Context } from "hono";
+import type { Env, Variables } from "../types.ts";
+
+const IPV4_PATTERN = /^(\d{1,3}\.){3}\d{1,3}$/;
+const IPV6_PATTERN = /^[0-9a-fA-F:]+$/;
+
+/**
+ * Validate IP address format (basic check).
+ */
+function isValidIP(ip: string): boolean {
+  if (IPV4_PATTERN.test(ip)) {
+    return ip
+      .split(".")
+      .map(Number)
+      .every((part) => part >= 0 && part <= 255);
+  }
+  return IPV6_PATTERN.test(ip) && ip.includes(":");
+}
+
+// How much an operator-declared reverse proxy is trusted for forwarding headers:
+//  - "none":    no opt-in; only the genuine CF edge (request.cf) is trusted.
+//  - "cf":      a Cloudflare front (edge OR cloudflared tunnel where request.cf
+//               is absent at the origin) — CF-Connecting-IP is authoritative.
+//  - "generic": a generic reverse proxy (nginx / Caddy / Traefik) that stamps
+//               X-Forwarded-For / X-Real-IP but neither sets nor strips the
+//               Cloudflare-specific header — trust XFF/X-Real-IP, NEVER a
+//               client-supplied CF-Connecting-IP.
+//  - "legacy":  the historical `TAKOS_TRUST_PROXY=true` / `1` opt-in. Treated
+//               like "generic" for spoof-safe precedence (XFF/X-Real-IP win over
+//               a forged CF header), but keeps a CF-Connecting-IP FALLBACK when
+//               no XFF/X-Real-IP is present so an existing cloudflared/CF origin
+//               configured with `true` is not regressed.
+type ProxyTrust = "none" | "cf" | "generic" | "legacy";
+
+function proxyTrust(
+  c: Context<{ Bindings: Env; Variables: Variables }>,
+): ProxyTrust {
+  const flag = c.env.TAKOS_TRUST_PROXY;
+  if (typeof flag !== "string") return "none";
+  const v = flag.trim().toLowerCase();
+  if (v === "cf" || v === "cloudflare") return "cf";
+  if (v === "generic" || v === "xff") return "generic";
+  if (v === "true" || v === "1") return "legacy";
+  return "none";
+}
+
+/**
+ * True when the request provably transits the genuine Cloudflare edge. The
+ * Cloudflare Workers runtime injects `request.cf` (colo / country / etc.) on
+ * real edge requests; a client CANNOT forge it, and it is absent on the Bun /
+ * node-postgres / Caddy distributions. This lets the canonical Cloudflare
+ * deployment trust `CF-Connecting-IP` WITHOUT requiring `TAKOS_TRUST_PROXY` to
+ * be set, while non-Cloudflare deployments still reject the spoofable header
+ * unless the operator explicitly opts in.
+ */
+function isCloudflareEdge(
+  c: Context<{ Bindings: Env; Variables: Variables }>,
+): boolean {
+  const raw = c.req.raw as Request & { cf?: unknown };
+  return raw.cf != null && typeof raw.cf === "object";
+}
+
+/**
+ * Extract client IP with proper validation.
+ *
+ * Trust model:
+ *  - `CF-Connecting-IP` is set by the Cloudflare edge, which strips any
+ *    client-supplied copy before invoking the worker. That guarantee only
+ *    holds when the request actually transits a trusted edge/proxy, so the
+ *    header is honoured ONLY when the operator has opted in via
+ *    `TAKOS_TRUST_PROXY=true`. On the Bun (`bun src/backend/server.ts`) and
+ *    node-postgres/Caddy distributions nothing strips this header, so an
+ *    untrusted caller could otherwise rotate a forged `CF-Connecting-IP`
+ *    per request to get a fresh rate-limit / login-lockout bucket.
+ *  - `X-Forwarded-For` / `X-Real-IP` are likewise accepted only when the
+ *    operator has opted in via `TAKOS_TRUST_PROXY=true`. A client speaking
+ *    directly to the worker can set these headers, so trusting them by
+ *    default would let arbitrary callers spoof their source IP and
+ *    bypass per-IP rate limiting / abuse detection.
+ *  - Falls back to the authentic TCP peer address that the self-host (Bun)
+ *    entrypoint stamps onto the ExecutionContext props (server-side, not a
+ *    client-settable header). This keeps a directly-exposed self-host from
+ *    bucketing every caller as "unknown".
+ *  - Only when none of the above resolve does it fall back to "unknown". Rate
+ *    limiters bucket "unknown" together, so an attacker with no IP visibility
+ *    shares a budget with every other anonymous caller (intentional: degraded
+ *    mode, not bypass). Behind a reverse proxy whose socket address is constant,
+ *    set `TAKOS_TRUST_PROXY=true` so the forwarded client IP is used instead.
+ */
+export function getClientIP(
+  c: Context<{ Bindings: Env; Variables: Variables }>,
+): string {
+  // SECURITY (spoofable trust header / auth bypass): a generic reverse proxy
+  // (nginx / Caddy / Traefik) stamps X-Forwarded-For / X-Real-IP but does NOT
+  // set or strip the Cloudflare-specific `CF-Connecting-IP`, so a client-supplied
+  // copy passes through the proxy untouched. Honouring CF-Connecting-IP ahead of
+  // the proxy's XFF let an attacker rotate a forged header per request to defeat
+  // login-lockout / per-IP rate limits (or pin the owner's IP to lock them out).
+  // We therefore split the trust sources by an operator-declared proxy TYPE:
+  // CF-Connecting-IP is honoured only on the genuine CF edge or an explicit
+  // `cf`/cloudflared front; a generic/legacy proxy prefers the XFF it controls.
+  const trust = proxyTrust(c);
+
+  // CF-Connecting-IP is authoritative when we are provably on the Cloudflare
+  // edge (unspoofable `request.cf`) OR the operator declares a Cloudflare front
+  // (`TAKOS_TRUST_PROXY=cf`, e.g. a cloudflared tunnel where request.cf is
+  // absent at the origin). The canonical CF deployment works with no config.
+  if (isCloudflareEdge(c) || trust === "cf") {
+    const cfConnectingIp = c.req.header("CF-Connecting-IP");
+    if (cfConnectingIp && isValidIP(cfConnectingIp)) {
+      return cfConnectingIp;
+    }
+  }
+
+  // X-Forwarded-For (leftmost) / X-Real-IP: the value a trusted reverse proxy
+  // stamps. Honoured under any explicit proxy opt-in and PREFERRED over a
+  // client-supplied CF-Connecting-IP (which a generic proxy never controls).
+  if (trust === "generic" || trust === "legacy" || trust === "cf") {
+    const xff = c.req.header("X-Forwarded-For")?.split(",")[0]?.trim();
+    if (xff && isValidIP(xff)) return xff;
+
+    const xRealIp = c.req.header("X-Real-IP");
+    if (xRealIp && isValidIP(xRealIp)) return xRealIp;
+  }
+
+  // Back-compat: the historical `TAKOS_TRUST_PROXY=true` opt-in honoured
+  // CF-Connecting-IP. A cloudflared tunnel sets it but ALSO stamps XFF, so the
+  // block above already covered the common case; keep CF-Connecting-IP as a
+  // last-resort fallback ONLY for the ambiguous legacy flag so an existing
+  // `true`-configured CF/cloudflared origin that sends only the CF header is not
+  // regressed. Explicit `generic` never honours a client-settable CF header.
+  if (trust === "legacy") {
+    const cfConnectingIp = c.req.header("CF-Connecting-IP");
+    if (cfConnectingIp && isValidIP(cfConnectingIp)) {
+      return cfConnectingIp;
+    }
+  }
+
+  // Last resort: the authentic TCP peer address the self-host (Bun) entrypoint
+  // stamps onto the ExecutionContext props. Unlike a header it is NOT
+  // client-controllable, so it is safe to trust without an opt-in. This keeps a
+  // directly-exposed self-host from collapsing every caller into one "unknown"
+  // bucket (which would let any attacker trip the single owner's login-lockout).
+  // On Cloudflare the worker runs without our entrypoint, so this is simply
+  // absent there and the CF-Connecting-IP path above already returned.
+  const socketIp = stampedSocketIp(c);
+  if (socketIp) return socketIp;
+
+  return "unknown";
+}
+
+/**
+ * Read the server-stamped TCP peer address from the ExecutionContext props, if
+ * present and valid. `c.executionCtx` throws when the context was created
+ * without one (e.g. some unit tests), so access it defensively.
+ */
+function stampedSocketIp(
+  c: Context<{ Bindings: Env; Variables: Variables }>,
+): string | null {
+  try {
+    const ctx = c.executionCtx as unknown as {
+      props?: { socketIp?: unknown };
+    };
+    const ip = ctx?.props?.socketIp;
+    return typeof ip === "string" && isValidIP(ip) ? ip : null;
+  } catch {
+    return null;
+  }
+}

package/src/backend/lib/community-visibility.ts

@@ -0,0 +1,230 @@
+/**
+ * Shared community read-gate helper.
+ *
+ * Community-scoped Notes are stored with `visibility = "public"` (so the normal
+ * public/followers/direct visibility checks treat them as openly readable) but
+ * carry a non-empty `audienceJson = [communityApId]`. That non-empty audience is
+ * what keeps them out of the public / home / following feeds (which filter on
+ * `audienceJson = "[]"`).
+ *
+ * For a PRIVATE community this is not enough: a single-object fetch (GET a post,
+ * a reply, or an `/ap/objects/:id`) bypasses the audience filter entirely, so a
+ * "public"-visibility community post would leak to any caller. This module
+ * centralizes the membership gate those single-object paths must apply on top of
+ * the normal visibility check.
+ *
+ * Membership model: `community_members` has no status column — the presence of a
+ * row IS the acceptance (this mirrors `resolveCommunityRead` in routes/timeline.ts).
+ * A private community is readable only by an actor with a `community_members` row.
+ */
+
+import { and, eq, inArray } from "drizzle-orm";
+import type { Database } from "../../db/index.ts";
+import { communities, communityMembers } from "../../db/index.ts";
+import { objects } from "../../db/index.ts";
+import { safeJsonParse } from "../federation-helpers.ts";
+import { chunkForInClause } from "./chunk.ts";
+
+/**
+ * Drizzle predicate that matches only objects with NO extra audience (i.e. not
+ * community-scoped and not otherwise addressed). Anonymous LIST queries should
+ * AND this in so community / addressed posts never appear in a public feed.
+ *
+ * This is exactly `eq(objects.audienceJson, "[]")`; exported as a named constant
+ * so every list query references the same canonical condition.
+ */
+export const NO_AUDIENCE_PREDICATE = eq(objects.audienceJson, "[]");
+
+/**
+ * The community `visibility` values that REQUIRE membership to read. Single
+ * source of truth shared by JS predicates ({@link communityRequiresMembership})
+ * AND drizzle `inArray` gates, so the membership rule cannot drift per surface.
+ *
+ * The read-gate previously keyed on `=== "private"` (single-object / batched
+ * gates) while feed / roster / discovery / messages / inbox sites keyed on
+ * `!== "public"`. Those are equivalent ONLY because creation validation
+ * restricts the column to {public, private}; the moment a third members-only
+ * value is added it must be added HERE once and every gate updates atomically
+ * (otherwise the single-object gate would serve it while feeds hid it). As a
+ * `const` tuple it is usable directly in `inArray(communities.visibility, ...)`.
+ */
+export const MEMBERSHIP_REQUIRED_VISIBILITIES = ["private"] as const;
+
+/**
+ * True when reading a community with this `visibility` requires membership.
+ * (A non-member — including an anonymous viewer — cannot read it.)
+ */
+export function communityRequiresMembership(
+  visibility: string | null | undefined,
+): boolean {
+  return (MEMBERSHIP_REQUIRED_VISIBILITIES as readonly string[]).includes(
+    visibility ?? "public",
+  );
+}
+
+/** Minimal object shape needed to evaluate the community read-gate. */
+export type CommunityGateObject = {
+  audienceJson?: string | null;
+  communityApId?: string | null;
+};
+
+/**
+ * True when the object is addressed to a community (or otherwise carries a
+ * non-empty audience). Community-scoped Notes set `audienceJson = [communityApId]`.
+ */
+export function isAddressedToCommunity(obj: CommunityGateObject): boolean {
+  const audience = safeJsonParse<unknown[]>(obj.audienceJson ?? "[]", []);
+  return Array.isArray(audience) && audience.length > 0;
+}
+
+/**
+ * Extract the community AP IDs an object is addressed to. Prefers the explicit
+ * `communityApId` column when present, otherwise reads them out of `audienceJson`.
+ */
+function communityApIdsFor(obj: CommunityGateObject): string[] {
+  const ids = new Set<string>();
+  if (obj.communityApId) ids.add(obj.communityApId);
+  const audience = safeJsonParse<unknown[]>(obj.audienceJson ?? "[]", []);
+  if (Array.isArray(audience)) {
+    for (const entry of audience) {
+      if (typeof entry === "string" && entry.length > 0) ids.add(entry);
+    }
+  }
+  return [...ids];
+}
+
+/**
+ * Single-object community read-gate.
+ *
+ * If `obj` is addressed to a community whose `visibility` is "private", this
+ * returns `true` only when `viewerApId` is an accepted member (a row in
+ * `community_members`) of that community; otherwise it returns `true` and leaves
+ * the normal public/followers/direct visibility check to the caller.
+ *
+ * An anonymous viewer (`viewerApId` null/undefined) against a private community
+ * always returns `false`. This NEVER widens access: a non-community or
+ * public-community object short-circuits to `true` and is still subject to the
+ * caller's existing visibility gate.
+ */
+export async function canViewerReadObject(
+  db: Database,
+  obj: CommunityGateObject,
+  viewerApId: string | null | undefined,
+): Promise<boolean> {
+  const communityIds = communityApIdsFor(obj);
+  if (communityIds.length === 0) return true;
+
+  // Only PRIVATE communities gate single-object reads. Resolve which (if any)
+  // of the addressed communities are private in one batched query.
+  const privateRows = await db
+    .select({ apId: communities.apId })
+    .from(communities)
+    .where(
+      and(
+        inArray(communities.apId, communityIds),
+        inArray(communities.visibility, MEMBERSHIP_REQUIRED_VISIBILITIES),
+      ),
+    );
+
+  if (privateRows.length === 0) return true;
+
+  // Addressed to at least one private community: an anonymous viewer can never
+  // satisfy membership, so fail closed.
+  if (!viewerApId) return false;
+
+  const privateApIds = privateRows.map((r) => r.apId);
+  const membership = await db
+    .select({ communityApId: communityMembers.communityApId })
+    .from(communityMembers)
+    .where(
+      and(
+        inArray(communityMembers.communityApId, privateApIds),
+        eq(communityMembers.actorApId, viewerApId),
+      ),
+    )
+    .limit(1)
+    .get();
+
+  return Boolean(membership);
+}
+
+/**
+ * Batched equivalent of {@link canViewerReadObject} for a whole page of objects.
+ *
+ * Returns the set of `apId`s that PASS the community read-gate, in TWO queries
+ * total (private-community lookup + viewer-membership lookup) instead of the
+ * 1-2 queries PER object the per-row form costs. The per-object semantics are
+ * identical: an object passes unless it is addressed to a private community the
+ * viewer is not a member of (an anonymous viewer never satisfies a private
+ * community). Objects with no community audience always pass.
+ *
+ * Both IN(...) lookups are chunked to stay under D1's 100-bound-parameter cap,
+ * since a page can address up to ~90 distinct communities.
+ */
+export async function communityReadableApIds<
+  T extends CommunityGateObject & { apId: string },
+>(
+  db: Database,
+  objs: T[],
+  viewerApId: string | null | undefined,
+): Promise<Set<string>> {
+  const readable = new Set<string>();
+  const perObjectCommunityIds = new Map<string, string[]>();
+  const unionIds = new Set<string>();
+  for (const o of objs) {
+    const ids = communityApIdsFor(o);
+    perObjectCommunityIds.set(o.apId, ids);
+    for (const id of ids) unionIds.add(id);
+  }
+
+  // No object is community-addressed → every object passes the gate.
+  if (unionIds.size === 0) {
+    for (const o of objs) readable.add(o.apId);
+    return readable;
+  }
+
+  // Which addressed communities are private? (only private communities gate)
+  const privateSet = new Set<string>();
+  for (const chunk of chunkForInClause([...unionIds])) {
+    const rows = await db
+      .select({ apId: communities.apId })
+      .from(communities)
+      .where(
+        and(
+          inArray(communities.apId, chunk),
+          inArray(communities.visibility, MEMBERSHIP_REQUIRED_VISIBILITIES),
+        ),
+      );
+    for (const r of rows) privateSet.add(r.apId);
+  }
+
+  // Which of those private communities is the viewer a member of?
+  const viewerMemberSet = new Set<string>();
+  if (viewerApId && privateSet.size > 0) {
+    for (const chunk of chunkForInClause([...privateSet])) {
+      const rows = await db
+        .select({ communityApId: communityMembers.communityApId })
+        .from(communityMembers)
+        .where(
+          and(
+            inArray(communityMembers.communityApId, chunk),
+            eq(communityMembers.actorApId, viewerApId),
+          ),
+        );
+      for (const r of rows) viewerMemberSet.add(r.communityApId);
+    }
+  }
+
+  for (const o of objs) {
+    const privateForObj = (perObjectCommunityIds.get(o.apId) ?? []).filter(
+      (id) => privateSet.has(id),
+    );
+    if (privateForObj.length === 0) {
+      readable.add(o.apId); // not addressed to any private community
+    } else if (privateForObj.some((id) => viewerMemberSet.has(id))) {
+      readable.add(o.apId); // member of at least one of its private communities
+    }
+    // else: addressed to a private community the viewer is not in → excluded.
+  }
+  return readable;
+}