@takosjp/yurucommu-core 3.2.0 → 3.2.1

package/src/backend/routes/notifications.ts

@@ -6,13 +6,10 @@ import {
   count,
   desc,
   eq,
-  exists,
   inArray,
   isNotNull,
   isNull,
   lt,
-  ne,
-  notExists,
   or,
   type SQL,
 } from "drizzle-orm";
@@ -34,7 +31,10 @@ import { batchLoadActorInfo } from "./communities/membership-shared.ts";
 import { requireActor } from "./actors-helpers.ts";
 import { communityReadableApIds } from "../lib/community-visibility.ts";
 import { chunkForInClause } from "../lib/chunk.ts";
-import { excludeBlockedMutedAuthors } from "../lib/feed-exclude.ts";
+import {
+  NOTIFICATION_ACTIVITY_TYPES,
+  notificationEligibilityWhere,
+} from "../lib/notification-eligibility.ts";
 
 const notifications = new Hono<{ Bindings: Env; Variables: Variables }>();
 
@@ -53,7 +53,6 @@ const ARCHIVE_CREATE_BATCH_SIZE = 30;
 // the rest drains on later runs.
 const ARCHIVE_CLEANUP_BATCH = 200;
 const ARCHIVE_ALL_CAP = 1000;
-const NOTIFICATION_ACTIVITY_TYPES = ["Follow", "Like", "Announce", "Create"];
 
 /**
  * Tracks the last cleanup timestamp per actor so cleanup is throttled to one
@@ -241,6 +240,9 @@ function notificationTarget(
 ): {
   target_kind: "post" | "story" | "profile" | "notifications";
   target_id: string | null;
+  // Same-origin in-app path shaped for the yurucommu web client's routing.
+  // Other clients (e.g. yurume's distinct IA) must treat target_kind/target_id
+  // as authoritative and build their own path, not follow target_url blindly.
   target_url: string;
 } {
   if (type === "follow" || type === "follow_request") {
@@ -305,37 +307,22 @@ notifications.get("/", async (c) => {
       ? typeToActivityType[typeFilter]
       : NOTIFICATION_ACTIVITY_TYPES;
 
-  // Archive partition pushed INTO SQL as a correlated EXISTS / NOT EXISTS, not a
-  // post-query filter. Filtering archived rows out in the result loop made two
-  // bugs: (1) `has_more` under-reported — a page whose limit+1 probe rows were
-  // mostly the wrong archive state returned < limit items yet there were older
-  // pages, so the client stopped loading; (2) every archived id for the actor
-  // was loaded into an unbounded in-memory Set per request. As an SQL predicate
-  // the limit+1 probe counts only rows that actually belong on the page.
-  const archivedCorrelation = and(
-    eq(notificationArchived.actorApId, inboxTable.actorApId),
-    eq(notificationArchived.activityApId, inboxTable.activityApId),
-  );
-  const archivedSubquery = db
-    .select({ activityApId: notificationArchived.activityApId })
-    .from(notificationArchived)
-    .where(archivedCorrelation);
-  const archiveCondition = showArchived
-    ? exists(archivedSubquery)
-    : notExists(archivedSubquery);
-
-  // Build inbox query with JOIN to activities. A direct (DM) Note is delivered
-  // as a `Create` inbox row just like a mention, so without excluding it every
-  // DM would double-surface here as a "mention" (with its body) AND inflate the
-  // unread badge independently of the DM view. LEFT JOIN the object and drop
-  // direct-visibility Creates; the join is LEFT because Follow's object is an
-  // actor (no `objects` row) → NULL visibility must be kept.
+  // Build inbox query with JOIN to activities. Shared eligibility predicate
+  // (lib/notification-eligibility.ts) — the SAME builder used by the unread
+  // badge and push delivery — supplies: not-self, user-facing types, the
+  // archive partition (pushed into SQL as a correlated EXISTS/NOT EXISTS so the
+  // limit+1 probe counts only rows that belong on the page, not a post-query
+  // filter), the direct-DM exclusion (a DM's `Create` inbox row must not
+  // double-surface here as a mention), and block/mute suppression. Direct
+  // Creates are dropped via LEFT JOIN + NULL-visibility keep (Follow's object
+  // is an actor, no `objects` row).
   const conditions = [
     eq(inboxTable.actorApId, actor.ap_id),
-    ne(activities.actorApId, actor.ap_id),
-    inArray(activities.type, activityTypes),
-    or(isNull(objects.visibility), ne(objects.visibility, "direct"))!,
-    archiveCondition,
+    ...notificationEligibilityWhere(db, actor.ap_id, {
+      direct: "exclude",
+      archived: showArchived ? "only" : "exclude",
+      activityTypes,
+    }),
   ];
   // reply vs mention both map to a Create; the split is whether the Create's
   // object is a reply (`inReplyTo` set). Pushed into SQL too so a type-filtered
@@ -348,17 +335,6 @@ notifications.get("/", async (c) => {
   if (before) {
     conditions.push(notifCursorPredicate(decodeNotifCursor(before)));
   }
-  // Suppress notifications whose actor the recipient has blocked or muted. This
-  // is the read-time choke point: mutes are read-only everywhere, and not every
-  // notify WRITE path block-checks, so gating here covers like/repost/follow/
-  // reply/mention (local AND federated) for both blocks and mutes. Keyed on the
-  // activity actor (subquery-scoped → D1-param-safe).
-  const listBlockMute = excludeBlockedMutedAuthors(
-    db,
-    actor.ap_id,
-    activities.actorApId,
-  );
-  if (listBlockMute) conditions.push(listBlockMute);
 
   const inboxEntries = await db
     .select({
@@ -504,7 +480,7 @@ notifications.get("/", async (c) => {
       icon_url: string | null;
     };
     object_content: string;
-    target_kind: "post" | "story" | "profile" | "community" | "notifications";
+    target_kind: "post" | "story" | "profile" | "notifications";
     target_id: string | null;
     target_url: string;
   }> = [];
@@ -578,23 +554,10 @@ notifications.get("/unread/count", async (c) => {
   const db = c.get("db");
   await maybeCleanupArchivedNotifications(db, actor.ap_id);
 
-  // Mirror the list query's DM exclusion (see GET /): a direct Note's Create
-  // inbox row must not count toward the notification badge — the DM has its own
-  // unread badge, and marking it read never clears this inbox row.
-  // Mirror the default list view's archive exclusion: an archived notification
-  // is hidden from the inbox list, so it must NOT count toward the badge either —
-  // otherwise archiving an UNREAD notification (read stays 0) leaves a phantom
-  // count the client can never clear (its mark-read sweep only touches rows the
-  // inbox view returns, which no longer include the archived one).
-  const archivedSubquery = db
-    .select({ activityApId: notificationArchived.activityApId })
-    .from(notificationArchived)
-    .where(
-      and(
-        eq(notificationArchived.actorApId, inboxTable.actorApId),
-        eq(notificationArchived.activityApId, inboxTable.activityApId),
-      ),
-    );
+  // SAME shared eligibility builder as the list and push delivery: not-self,
+  // user-facing types, archive exclusion (an archived UNREAD notification must
+  // not leave a phantom count the client can never clear), the direct-DM
+  // exclusion (a DM has its own badge), and block/mute suppression.
   const result = await db
     .select({ count: count() })
     .from(inboxTable)
@@ -604,13 +567,7 @@ notifications.get("/unread/count", async (c) => {
       and(
         eq(inboxTable.actorApId, actor.ap_id),
         eq(inboxTable.read, 0),
-        ne(activities.actorApId, actor.ap_id),
-        inArray(activities.type, NOTIFICATION_ACTIVITY_TYPES),
-        or(isNull(objects.visibility), ne(objects.visibility, "direct"))!,
-        notExists(archivedSubquery),
-        // Mirror the list query: don't count notifications from blocked/muted
-        // actors toward the unread badge.
-        excludeBlockedMutedAuthors(db, actor.ap_id, activities.actorApId),
+        ...notificationEligibilityWhere(db, actor.ap_id, { direct: "exclude" }),
       ),
     )
     .get();

package/src/backend/routes/posts/transformers.ts

@@ -2,12 +2,14 @@ import { formatUsername, safeJsonParse } from "../../federation-helpers.ts";
 
 export const MAX_POST_CONTENT_LENGTH = 5000;
 export const MAX_POST_SUMMARY_LENGTH = 500;
-// Bound the attachments payload. PostAttachment is an open-ended record, so cap
-// both the COUNT and the serialized SIZE — the size cap bounds row/federated-doc
-// bloat regardless of internal shape (key count / field length). 16 KiB is ample
-// for MAX_ATTACHMENTS media descriptors with alt text + blurhash.
-export const MAX_ATTACHMENTS = 8;
-export const MAX_ATTACHMENTS_JSON_LENGTH = 16 * 1024;
+// Attachment bounds live in lib/attachments.ts (shared with the DM and
+// community-chat validators); re-exported here for the existing post-route and
+// inbound-handler importers.
+export {
+  boundAttachmentsJson,
+  MAX_ATTACHMENTS,
+  MAX_ATTACHMENTS_JSON_LENGTH,
+} from "../../lib/attachments.ts";
 
 /** Truncate a string to `max` characters (no-op when already within bounds). */
 export function truncate(s: string, max: number): string {
@@ -28,10 +30,6 @@ export function boundInboundSummary(summary: unknown): string | null {
     ? truncate(summary, MAX_POST_SUMMARY_LENGTH)
     : null;
 }
-/** Drop an oversized inbound attachments blob to "[]" rather than store it. */
-export function boundAttachmentsJson(json: string): string {
-  return json.length > MAX_ATTACHMENTS_JSON_LENGTH ? "[]" : json;
-}
 // Capped at 90 (not 100): a page's object ids are re-queried via
 // `inArray(col, objectApIds)` for like/bookmark enrichment, and Cloudflare D1
 // allows at most 100 bound parameters per query. 90 leaves headroom for the

package/src/db/index.ts

@@ -47,16 +47,17 @@ export async function getDbSQLite(databasePath: string): Promise<Database> {
   const { drizzle } = await import("drizzle-orm/libsql");
 
   const client = createClient({ url: `file:${databasePath}` });
-  // Foreign keys are explicitly turned OFF so the libsql engine matches
-  // Cloudflare D1, which ignores the FK constraints declared in the
-  // migrations. NOTE: libsql (unlike bun:sqlite / stock SQLite, which default
-  // OFF) defaults foreign_keys ON, so this must be set explicitly — simply
-  // not enabling it is not enough. Remote actors are stored in actor_cache
-  // (never in actors), yet objects.attributed_to / follows.* / likes.* /
-  // announces.* FK-reference actors(ap_id); enforcement would make every
-  // inbound federated activity from a remote actor violate the FK and fail to
-  // insert. Referential cleanup is handled at the app level by
-  // delete-cascade.ts, identically on D1.
+  // Foreign keys are explicitly turned OFF so the libsql engine matches the
+  // MIGRATED production schema. Cloudflare D1 ENFORCES declared FKs (the old
+  // "D1 ignores FK" assumption was wrong — see migrations/0011, which exists
+  // precisely because enforcement broke inbound federation): remote actors
+  // live only in actor_cache, never in actors, so 0010/0011 REBUILT the
+  // affected tables to drop their actors FKs. Post-0011 the schema declares
+  // essentially no FKs and referential cleanup is handled at the app level by
+  // delete-cascade.ts / account-teardown.ts, identically on D1. NOTE: libsql
+  // (unlike bun:sqlite / stock SQLite, which default OFF) defaults
+  // foreign_keys ON, so this must be set explicitly — pre-0010 FKs still
+  // present in older local DB files must not diverge from D1 behavior.
   await client.execute("PRAGMA foreign_keys = OFF");
   sqliteDb = drizzle(client, { schema });
   return sqliteDb;

package/src/db/schema/mobile.ts

@@ -47,14 +47,16 @@ export const mobilePushRegistrations = sqliteTable(
  *
  * `pushkey` is an opaque downstream-provider identifier. Provider credentials
  * never live in this table; they stay in the configured stateless gateway.
+ *
+ * NO foreign key on actor_ap_id: D1 ENFORCES declared FKs (0010/0011 dropped
+ * the actors FKs for that reason) and cleanup is app-level
+ * (routes/account-teardown.ts), matching the rest of the schema.
  */
 export const notificationPushers = sqliteTable(
   "notification_pushers",
   {
     id: text("id").primaryKey(),
-    actorApId: text("actor_ap_id")
-      .notNull()
-      .references(() => actors.apId),
+    actorApId: text("actor_ap_id").notNull(),
     product: text("product").notNull(),
     scope: text("scope"),
     kind: text("kind").notNull().default("http"),
@@ -75,13 +77,9 @@ export const notificationPushers = sqliteTable(
     lastSeenAt: text("last_seen_at").notNull().$defaultFn(nowIsoUtc),
   },
   (t) => [
-    uniqueIndex("notification_pushers_actor_product_app_pushkey_idx").on(
-      t.actorApId,
-      t.product,
-      t.appId,
-      t.pushkeyHash,
-    ),
     index("notification_pushers_actor_product_idx").on(t.actorApId, t.product),
+    // Device uniqueness — strictly stronger than any actor-scoped unique
+    // variant, so this is the ONLY unique index.
     uniqueIndex("notification_pushers_device_idx").on(
       t.product,
       t.appId,