@takosjp/yurucommu-core 3.0.0

package/src/backend/routes/communities/membership-requests.ts

@@ -0,0 +1,296 @@
+import type { Context, Hono } from "hono";
+import { and, count, desc, eq, sql } from "drizzle-orm";
+import {
+  activities,
+  communities,
+  communityJoinRequests,
+  communityMembers,
+  follows,
+} from "../../../db/index.ts";
+import type { Env, Variables } from "../../types.ts";
+import {
+  activityApId,
+  formatUsername,
+  generateId,
+  isLocal,
+} from "../../federation-helpers.ts";
+import { enqueueDeliveryToActor } from "../../lib/delivery/queue.ts";
+import {
+  addMemberAtomic,
+  batchLoadActorInfo,
+  fetchCommunityId,
+  memberWhere,
+  requireManager,
+  unbanMember,
+} from "./membership-shared.ts";
+
+const AS_CONTEXT = "https://www.w3.org/ns/activitystreams";
+
+export function registerMembershipRequestRoutes(
+  communitiesRouter: Hono<{ Bindings: Env; Variables: Variables }>,
+) {
+  // GET /api/communities/:identifier/requests - List pending join requests
+  communitiesRouter.get(
+    "/:identifier/requests",
+    async (c: Context<{ Bindings: Env; Variables: Variables }>) => {
+      const actor = c.get("actor");
+      if (!actor) return c.json({ error: "Unauthorized" }, 401);
+
+      const identifier = c.req.param("identifier")!;
+      const db = c.get("db");
+
+      const { community } = await fetchCommunityId(c, identifier);
+      if (!community) {
+        return c.json({ error: "Community not found" }, 404);
+      }
+
+      const manager = await requireManager(db, community.apId, actor.ap_id);
+      if (!manager) {
+        return c.json({ error: "Forbidden" }, 403);
+      }
+
+      // Pending join requests come from TWO sources, merged (newest-first, capped
+      // so the response can't grow unbounded): local approval-joins recorded in
+      // community_join_requests, AND remote approval-joins which exist ONLY as a
+      // PENDING follows edge to the Group actor (a remote follower has no `actors`
+      // row, so it can't be mirrored into community_join_requests).
+      const localRequests = await db
+        .select()
+        .from(communityJoinRequests)
+        .where(
+          and(
+            eq(communityJoinRequests.communityApId, community.apId),
+            eq(communityJoinRequests.status, "pending"),
+          ),
+        )
+        .orderBy(desc(communityJoinRequests.createdAt))
+        .limit(200);
+      const pendingEdges = await db
+        .select({
+          actorApId: follows.followerApId,
+          createdAt: follows.createdAt,
+        })
+        .from(follows)
+        .where(
+          and(
+            eq(follows.followingApId, community.apId),
+            eq(follows.status, "pending"),
+          ),
+        )
+        .orderBy(desc(follows.createdAt))
+        .limit(200);
+
+      const byActor = new Map<string, string>(); // actorApId -> createdAt
+      for (const e of pendingEdges) byActor.set(e.actorApId, e.createdAt);
+      for (const r of localRequests) byActor.set(r.actorApId, r.createdAt);
+      const merged = [...byActor.entries()]
+        .sort((a, b) => (a[1] < b[1] ? 1 : -1))
+        .slice(0, 200);
+
+      const actorInfoMap = await batchLoadActorInfo(
+        db,
+        merged.map(([apId]) => apId),
+      );
+
+      const result = merged.map(([apId, createdAt]) => {
+        const actorInfo = actorInfoMap.get(apId);
+        return {
+          ap_id: apId,
+          username: formatUsername(apId),
+          preferred_username: actorInfo?.preferredUsername || null,
+          name: actorInfo?.name || null,
+          icon_url: actorInfo?.iconUrl || null,
+          created_at: createdAt,
+        };
+      });
+
+      return c.json({ requests: result });
+    },
+  );
+
+  // POST /api/communities/:identifier/requests/accept - Accept join request
+  communitiesRouter.post(
+    "/:identifier/requests/accept",
+    async (c: Context<{ Bindings: Env; Variables: Variables }>) => {
+      const actor = c.get("actor");
+      if (!actor) return c.json({ error: "Unauthorized" }, 401);
+
+      const identifier = c.req.param("identifier")!;
+      const db = c.get("db");
+      const body = await c.req.json<{ actor_ap_id: string }>();
+
+      if (!body.actor_ap_id) {
+        return c.json({ error: "actor_ap_id required" }, 400);
+      }
+
+      const { community } = await fetchCommunityId(c, identifier);
+      if (!community) {
+        return c.json({ error: "Community not found" }, 404);
+      }
+
+      const manager = await requireManager(db, community.apId, actor.ap_id);
+      if (!manager) {
+        return c.json({ error: "Forbidden" }, 403);
+      }
+
+      // A pending request is EITHER a community_join_requests row (local
+      // approval-join) OR a pending follows edge to the Group (remote
+      // approval-join — no join-request row, since a remote has no `actors` row).
+      const localRequest = await db
+        .select()
+        .from(communityJoinRequests)
+        .where(
+          and(
+            eq(communityJoinRequests.communityApId, community.apId),
+            eq(communityJoinRequests.actorApId, body.actor_ap_id),
+            eq(communityJoinRequests.status, "pending"),
+          ),
+        )
+        .get();
+      const pendingEdge = await db
+        .select({ activityApId: follows.activityApId })
+        .from(follows)
+        .where(
+          and(
+            eq(follows.followerApId, body.actor_ap_id),
+            eq(follows.followingApId, community.apId),
+            eq(follows.status, "pending"),
+          ),
+        )
+        .get();
+      if (!localRequest && !pendingEdge) {
+        return c.json({ error: "Join request not found" }, 404);
+      }
+
+      const now = new Date().toISOString();
+
+      if (isLocal(body.actor_ap_id, c.env.APP_URL)) {
+        const existingMember = await db
+          .select()
+          .from(communityMembers)
+          .where(memberWhere(community.apId, body.actor_ap_id))
+          .get();
+        if (!existingMember) {
+          // Atomic insert + guarded increment so a crash between them, or a
+          // concurrent double-accept, can't leave the count under/over the truth.
+          await addMemberAtomic(
+            db,
+            community.apId,
+            body.actor_ap_id,
+            "member",
+            now,
+          );
+        }
+      } else {
+        // A REMOTE member's membership IS the pending follows edge to the Group
+        // actor — NOT a communityMembers row (which would diverge from how the
+        // rest of the system resolves remote membership). Flip that edge to
+        // accepted and emit the community-signed Accept so the remote learns it
+        // was approved and our handleGroupCreate (which requires status=accepted)
+        // starts relaying its posts. The pending edge carries the original Follow
+        // activity id the Accept must reference.
+        await db
+          .update(follows)
+          .set({ status: "accepted", acceptedAt: now })
+          .where(
+            and(
+              eq(follows.followerApId, body.actor_ap_id),
+              eq(follows.followingApId, community.apId),
+            ),
+          );
+        if (pendingEdge?.activityApId) {
+          const acceptId = activityApId(c.env.APP_URL, generateId());
+          const acceptActivity = {
+            "@context": AS_CONTEXT,
+            id: acceptId,
+            type: "Accept",
+            actor: community.apId,
+            object: pendingEdge.activityApId,
+          };
+          await db.insert(activities).values({
+            apId: acceptId,
+            type: "Accept",
+            actorApId: community.apId,
+            objectApId: pendingEdge.activityApId,
+            rawJson: JSON.stringify(acceptActivity),
+            direction: "outbound",
+          });
+          // Delivery resolves the community's signing key from actor=community.apId.
+          await enqueueDeliveryToActor(c.env, acceptId, body.actor_ap_id);
+        }
+      }
+
+      // Accepting a join request is an explicit re-admission — lift any ban.
+      await unbanMember(db, community.apId, body.actor_ap_id);
+
+      // Mark the local join-request row processed (a remote accept has none).
+      if (localRequest) {
+        await db
+          .update(communityJoinRequests)
+          .set({ status: "accepted", processedAt: now })
+          .where(
+            and(
+              eq(communityJoinRequests.communityApId, community.apId),
+              eq(communityJoinRequests.actorApId, body.actor_ap_id),
+            ),
+          );
+      }
+
+      return c.json({ success: true });
+    },
+  );
+
+  // POST /api/communities/:identifier/requests/reject - Reject join request
+  communitiesRouter.post(
+    "/:identifier/requests/reject",
+    async (c: Context<{ Bindings: Env; Variables: Variables }>) => {
+      const actor = c.get("actor");
+      if (!actor) return c.json({ error: "Unauthorized" }, 401);
+
+      const identifier = c.req.param("identifier")!;
+      const db = c.get("db");
+      const body = await c.req.json<{ actor_ap_id: string }>();
+
+      if (!body.actor_ap_id) {
+        return c.json({ error: "actor_ap_id required" }, 400);
+      }
+
+      const { community } = await fetchCommunityId(c, identifier);
+      if (!community) {
+        return c.json({ error: "Community not found" }, 404);
+      }
+
+      const manager = await requireManager(db, community.apId, actor.ap_id);
+      if (!manager) {
+        return c.json({ error: "Forbidden" }, 403);
+      }
+
+      const request = await db
+        .select()
+        .from(communityJoinRequests)
+        .where(
+          and(
+            eq(communityJoinRequests.communityApId, community.apId),
+            eq(communityJoinRequests.actorApId, body.actor_ap_id),
+            eq(communityJoinRequests.status, "pending"),
+          ),
+        )
+        .get();
+      if (!request) {
+        return c.json({ error: "Join request not found" }, 404);
+      }
+
+      await db
+        .update(communityJoinRequests)
+        .set({ status: "rejected", processedAt: new Date().toISOString() })
+        .where(
+          and(
+            eq(communityJoinRequests.communityApId, community.apId),
+            eq(communityJoinRequests.actorApId, body.actor_ap_id),
+          ),
+        );
+
+      return c.json({ success: true });
+    },
+  );
+}

package/src/backend/routes/communities/membership-shared.ts

@@ -0,0 +1,364 @@
+import type { Context } from "hono";
+import { and, eq, gt, inArray, or, sql } from "drizzle-orm";
+import type { Database } from "../../../db/index.ts";
+import {
+  actorCache,
+  actors,
+  communities,
+  communityBans,
+  communityMembers,
+} from "../../../db/index.ts";
+import type { Env, Variables } from "../../types.ts";
+import { communityApId } from "../../federation-helpers.ts";
+import { chunkForInClause } from "../../lib/chunk.ts";
+
+export const managerRoles = new Set(["owner", "moderator"]);
+
+/**
+ * Record a durable ban so a removed member cannot immediately re-join an OPEN
+ * community (local re-join or a remote re-Follow). Idempotent.
+ */
+export async function banMember(
+  db: Database,
+  communityApIdVal: string,
+  bannedApId: string,
+): Promise<void> {
+  await db
+    .insert(communityBans)
+    .values({ communityApId: communityApIdVal, bannedApId })
+    .onConflictDoNothing();
+}
+
+/**
+ * Lift a ban on explicit re-admission (approve a join request / accept an
+ * invite / add a member). No-op when no ban exists.
+ */
+export async function unbanMember(
+  db: Database,
+  communityApIdVal: string,
+  bannedApId: string,
+): Promise<void> {
+  await db
+    .delete(communityBans)
+    .where(
+      and(
+        eq(communityBans.communityApId, communityApIdVal),
+        eq(communityBans.bannedApId, bannedApId),
+      ),
+    );
+}
+
+/** Whether `actorApId` is banned from the community. */
+export async function isMemberBanned(
+  db: Database,
+  communityApIdVal: string,
+  actorApId: string,
+): Promise<boolean> {
+  const row = await db
+    .select({ bannedApId: communityBans.bannedApId })
+    .from(communityBans)
+    .where(
+      and(
+        eq(communityBans.communityApId, communityApIdVal),
+        eq(communityBans.bannedApId, actorApId),
+      ),
+    )
+    .get();
+  return !!row;
+}
+
+// `Database` is a union whose `.batch` lives only on the concrete D1/libsql
+// subclasses; reach it through a narrow structural cast (matching membership-join).
+type Batchable = { batch: (stmts: unknown[]) => Promise<unknown> };
+
+/**
+ * Atomically remove a member and decrement memberCount in ONE batch. The
+ * decrement runs BEFORE the delete and is guarded by `EXISTS(member)` (so a
+ * duplicate concurrent removal — whose member row is already gone — cannot
+ * double-decrement) and `memberCount > 0` (underflow). Mirrors the federated
+ * undoFollowEdge pattern; replaces the previous non-atomic delete-then-`-1` that
+ * could tear on crash, underflow negative, or double-decrement under a race.
+ */
+export async function removeMemberAtomic(
+  db: Database,
+  communityApIdVal: string,
+  actorApIdVal: string,
+): Promise<void> {
+  const memberExists = sql`EXISTS (SELECT 1 FROM ${communityMembers} WHERE ${communityMembers.communityApId} = ${communityApIdVal} AND ${communityMembers.actorApId} = ${actorApIdVal})`;
+  await (db as unknown as Batchable).batch([
+    db
+      .update(communities)
+      .set({ memberCount: sql`${communities.memberCount} - 1` })
+      .where(
+        and(
+          eq(communities.apId, communityApIdVal),
+          gt(communities.memberCount, 0),
+          memberExists,
+        ),
+      ),
+    db
+      .delete(communityMembers)
+      .where(memberWhere(communityApIdVal, actorApIdVal)),
+  ]);
+}
+
+/**
+ * Atomically remove an OWNER only if ANOTHER owner still remains. Returns false
+ * (nothing removed) when the actor is the last owner.
+ *
+ * A plain `count(owners) > 1` check followed by a separate delete is a TOCTOU:
+ * two concurrent last-owner leaves both read count=2, both pass, both delete →
+ * the community is orphaned with ZERO owners. Conditioning the delete (and its
+ * memberCount decrement) on `EXISTS(another owner)` evaluated INSIDE the
+ * statement closes the window: D1 serializes the two deletes, so the second one
+ * to execute sees the first already gone and matches 0 rows.
+ */
+export async function removeOwnerIfAnotherExists(
+  db: Database,
+  communityApIdVal: string,
+  actorApIdVal: string,
+): Promise<boolean> {
+  const anotherOwnerExists = sql`EXISTS (SELECT 1 FROM ${communityMembers} WHERE ${communityMembers.communityApId} = ${communityApIdVal} AND ${communityMembers.role} = 'owner' AND ${communityMembers.actorApId} <> ${actorApIdVal})`;
+  const memberExists = sql`EXISTS (SELECT 1 FROM ${communityMembers} WHERE ${communityMembers.communityApId} = ${communityApIdVal} AND ${communityMembers.actorApId} = ${actorApIdVal})`;
+  await (db as unknown as Batchable).batch([
+    db
+      .update(communities)
+      .set({ memberCount: sql`${communities.memberCount} - 1` })
+      .where(
+        and(
+          eq(communities.apId, communityApIdVal),
+          gt(communities.memberCount, 0),
+          memberExists,
+          anotherOwnerExists,
+        ),
+      ),
+    db
+      .delete(communityMembers)
+      .where(
+        and(memberWhere(communityApIdVal, actorApIdVal), anotherOwnerExists),
+      ),
+  ]);
+  // Re-read whether the row is gone rather than trusting a batch affected-row
+  // count (its shape differs between D1 and the libsql test driver). The member
+  // row is keyed by (community, actor) and only this actor's leave touches it,
+  // so this read is reliable. Absent → removed (another owner existed); present
+  // → not removed (the actor was the last owner).
+  const stillMember = await db
+    .select({ actorApId: communityMembers.actorApId })
+    .from(communityMembers)
+    .where(memberWhere(communityApIdVal, actorApIdVal))
+    .get();
+  return !stillMember;
+}
+
+/**
+ * Atomically demote an OWNER to `newRole` only if ANOTHER owner (besides this
+ * target) still remains, preserving the ">=1 owner" invariant. Returns true when
+ * the target is no longer an owner (demotion applied), false when the target was
+ * the last owner and was therefore left untouched.
+ *
+ * Mirrors removeOwnerIfAnotherExists for the role-change path: a
+ * count(owners)>1 check followed by a separate UPDATE is a TOCTOU two owners who
+ * demote EACH OTHER concurrently can both pass, orphaning the community with
+ * zero owners. Conditioning the UPDATE on `EXISTS(another owner)` evaluated
+ * INSIDE the statement closes the window — D1 serializes the two updates, so the
+ * second to execute sees the first already demoted and matches 0 rows. The
+ * EXISTS is keyed on the TARGET (not the caller) so it equally covers demoting
+ * yourself and demoting a fellow owner.
+ */
+export async function demoteOwnerIfAnotherExists(
+  db: Database,
+  communityApIdVal: string,
+  targetApId: string,
+  newRole: string,
+): Promise<boolean> {
+  const anotherOwnerExists = sql`EXISTS (SELECT 1 FROM ${communityMembers} WHERE ${communityMembers.communityApId} = ${communityApIdVal} AND ${communityMembers.role} = 'owner' AND ${communityMembers.actorApId} <> ${targetApId})`;
+  await db
+    .update(communityMembers)
+    .set({ role: newRole })
+    .where(and(memberWhere(communityApIdVal, targetApId), anotherOwnerExists));
+  // Re-read (driver-agnostic — no reliance on batch affected-row counts). Absent
+  // or no-longer-owner → demotion held; still owner → it was the last owner.
+  const after = await db
+    .select({ role: communityMembers.role })
+    .from(communityMembers)
+    .where(memberWhere(communityApIdVal, targetApId))
+    .get();
+  return after?.role !== "owner";
+}
+
+/**
+ * Atomically add a member and increment memberCount in ONE batch. The increment
+ * is guarded by `NOT EXISTS(member)` so a duplicate concurrent add (or a retry)
+ * cannot double-count; the insert is onConflictDoNothing. Mirrors the open-join
+ * batch and the federated handleFollow pattern.
+ */
+export async function addMemberAtomic(
+  db: Database,
+  communityApIdVal: string,
+  actorApIdVal: string,
+  role: string,
+  joinedAt: string,
+): Promise<void> {
+  const memberAbsent = sql`NOT EXISTS (SELECT 1 FROM ${communityMembers} WHERE ${communityMembers.communityApId} = ${communityApIdVal} AND ${communityMembers.actorApId} = ${actorApIdVal})`;
+  await (db as unknown as Batchable).batch([
+    db
+      .update(communities)
+      .set({ memberCount: sql`${communities.memberCount} + 1` })
+      .where(and(eq(communities.apId, communityApIdVal), memberAbsent)),
+    db
+      .insert(communityMembers)
+      .values({
+        communityApId: communityApIdVal,
+        actorApId: actorApIdVal,
+        role,
+        joinedAt,
+      })
+      .onConflictDoNothing(),
+  ]);
+}
+
+export function resolveCommunityApId(
+  baseUrl: string,
+  identifier: string,
+): string {
+  return identifier.startsWith("http")
+    ? identifier
+    : communityApId(baseUrl, identifier);
+}
+
+/** Shared WHERE clause for looking up a community by identifier or apId. */
+export function communityWhere(apId: string, identifier: string) {
+  return or(
+    eq(communities.apId, apId),
+    eq(communities.preferredUsername, identifier),
+  );
+}
+
+export async function fetchCommunityDetails(
+  c: Context<{ Bindings: Env; Variables: Variables }>,
+  identifier: string,
+) {
+  const db = c.get("db");
+  const apId = resolveCommunityApId(c.env.APP_URL, identifier);
+  const community = await db
+    .select()
+    .from(communities)
+    .where(communityWhere(apId, identifier))
+    .get();
+  return { apId, community };
+}
+
+export async function fetchCommunityId(
+  c: Context<{ Bindings: Env; Variables: Variables }>,
+  identifier: string,
+) {
+  const db = c.get("db");
+  const apId = resolveCommunityApId(c.env.APP_URL, identifier);
+  const community = await db
+    .select({ apId: communities.apId })
+    .from(communities)
+    .where(communityWhere(apId, identifier))
+    .get();
+  return { apId, community };
+}
+
+/** Compound key condition for CommunityMember / CommunityJoinRequest lookups. */
+export function memberWhere(communityApIdVal: string, actorApId: string) {
+  return and(
+    eq(communityMembers.communityApId, communityApIdVal),
+    eq(communityMembers.actorApId, actorApId),
+  );
+}
+
+/**
+ * Require the actor to be a manager (owner or moderator) of the community.
+ * Returns the membership record on success, or null if unauthorized.
+ */
+export async function requireManager(
+  db: Database,
+  communityApIdVal: string,
+  actorApId: string,
+) {
+  const member = await db
+    .select()
+    .from(communityMembers)
+    .where(memberWhere(communityApIdVal, actorApId))
+    .get();
+  if (!member || !managerRoles.has(member.role)) return null;
+  return member;
+}
+
+/**
+ * Batch load actor display info from both local actors and cached actors.
+ * Returns a single Map keyed by apId with the merged results (local takes priority).
+ */
+export async function batchLoadActorInfo(
+  db: Database,
+  apIds: string[],
+  includeIcon = true,
+) {
+  if (apIds.length === 0) {
+    return new Map<
+      string,
+      {
+        preferredUsername: string | null;
+        name: string | null;
+        iconUrl?: string | null;
+      }
+    >();
+  }
+
+  type ActorInfo = {
+    preferredUsername: string | null;
+    name: string | null;
+    iconUrl?: string | null;
+  };
+
+  const selectLocalBase = {
+    apId: actors.apId,
+    preferredUsername: actors.preferredUsername,
+    name: actors.name,
+    iconUrl: actors.iconUrl,
+  } as const;
+  const selectCachedBase = {
+    apId: actorCache.apId,
+    preferredUsername: actorCache.preferredUsername,
+    name: actorCache.name,
+    iconUrl: actorCache.iconUrl,
+  } as const;
+
+  // Chunk the IN(...) lookups: a community roster page can carry up to ~90
+  // member ids and D1 caps a query at 100 bound parameters. Chunks are disjoint
+  // id slices, so per-chunk maps merge collision-free; cached-then-local
+  // ordering still gives local-wins within each chunk.
+  const map = new Map<string, ActorInfo>();
+  for (const ids of chunkForInClause(apIds)) {
+    const [localActors, cachedActors] = await Promise.all([
+      db.select(selectLocalBase).from(actors).where(inArray(actors.apId, ids)),
+      db
+        .select(selectCachedBase)
+        .from(actorCache)
+        .where(inArray(actorCache.apId, ids)),
+    ]);
+
+    // Cached first so local overrides
+    for (const a of cachedActors) {
+      const info: ActorInfo = {
+        preferredUsername: a.preferredUsername,
+        name: a.name,
+      };
+      if (includeIcon) info.iconUrl = a.iconUrl;
+      map.set(a.apId, info);
+    }
+    for (const a of localActors) {
+      const info: ActorInfo = {
+        preferredUsername: a.preferredUsername,
+        name: a.name,
+      };
+      if (includeIcon) info.iconUrl = a.iconUrl;
+      map.set(a.apId, info);
+    }
+  }
+  return map;
+}