@takosjp/yurucommu-core 3.4.0 → 3.4.3

package/src/backend/routes/activitypub/handlers/inbox-follow-handlers.ts

@@ -1,12 +1,6 @@
 import type { Database } from "../../../../db/index.ts";
-import { and, eq, gt, inArray, sql } from "drizzle-orm";
-import {
-  activities,
-  actors,
-  follows,
-  likes,
-  objects,
-} from "../../../../db/index.ts";
+import { and, eq, gt, or, sql } from "drizzle-orm";
+import { activities, actors, follows } from "../../../../db/index.ts";
 import {
   activityApId,
   generateId,
@@ -43,6 +37,7 @@ export async function handleFollow(
   recipient: ActorRow,
   actor: string,
   baseUrl: string,
+  sourceActivityId: string = activity.id || "",
 ) {
   const db = c.get("db");
 
@@ -152,7 +147,9 @@ export async function handleFollow(
       id: acceptId,
       type: "Accept",
       actor: recipient.apId,
-      object: activityId,
+      // Echo the peer's bounded protocol id, not our origin-bound internal
+      // ledger id. Remote servers match Accept.object to their Follow id.
+      object: sourceActivityId || activityId,
     };
 
     // Store accept activity before enqueue.
@@ -160,7 +157,7 @@ export async function handleFollow(
       apId: acceptId,
       type: "Accept",
       actorApId: recipient.apId,
-      objectApId: activityId,
+      objectApId: sourceActivityId || activityId,
       rawJson: JSON.stringify(acceptActivity),
       direction: "outbound",
     });
@@ -294,10 +291,20 @@ export async function handleReject(
 // Undo handler
 // ---------------------------------------------------------------------------
 
+/**
+ * `recipient` is null when the Undo arrived at the shared inbox as an
+ * INSTANCE-scoped activity — i.e. Undo(Like|Announce), which is actor-keyed
+ * and idempotent and names no local actor. Undo(Follow|Block) is object-actor
+ * scoped and always dispatched with its resolved target, so a null recipient
+ * on a follow branch means the target could not be resolved; that is logged
+ * and refused rather than guessed at. The previous code guessed: it fell back
+ * to deleting the signer's likes across EVERY object the "recipient" had
+ * authored and rewriting every one of that actor's `objects` rows.
+ */
 export async function handleUndo(
   c: ActivityContext,
   activity: Activity,
-  recipient: ActorRow,
+  recipient: ActorRow | null,
   actor: string,
   _baseUrl: string,
 ) {
@@ -318,9 +325,17 @@ export async function handleUndo(
   }
 
   if (typeIncludes(objectType, "Follow")) {
+    if (!recipient) {
+      log.warn("Undo(Follow) without a resolved local target", {
+        event: "ap.undo.follow.no_recipient",
+        actor,
+        activityId: activity.id,
+      });
+      return;
+    }
     await undoFollow(db, objectId, actor, recipient);
   } else if (typeIncludes(objectType, "Like")) {
-    await undoLike(db, objectId, activityObject, actor, recipient);
+    await undoLike(db, objectId, activityObject, actor);
   } else if (typeIncludes(objectType, "Announce")) {
     await undoAnnounce(db, objectId, activityObject, actor);
   }
@@ -339,16 +354,25 @@ async function resolveUndoByActivityId(
   db: Database,
   objectId: string,
   actor: string,
-  recipient: ActorRow,
+  recipient: ActorRow | null,
 ): Promise<boolean> {
   const originalActivity = await db
     .select({
+      apId: activities.apId,
       type: activities.type,
       objectApId: activities.objectApId,
       actorApId: activities.actorApId,
     })
     .from(activities)
-    .where(eq(activities.apId, objectId))
+    .where(
+      or(
+        eq(activities.apId, objectId),
+        and(
+          eq(activities.direction, "inbound"),
+          sql`json_extract(${activities.rawJson}, '$.id') = ${objectId}`,
+        ),
+      ),
+    )
     .get();
   if (!originalActivity) return false;
 
@@ -363,7 +387,17 @@ async function resolveUndoByActivityId(
   }
 
   if (originalActivity.type === "Follow") {
-    const follow = await findFollowByActivityId(db, objectId);
+    // The followerCount decrement is keyed on the followed actor, so an
+    // instance-dispatched Undo (no resolved local target) must not run it.
+    if (!recipient) {
+      log.warn("Undo(Follow) by activity id without a resolved local target", {
+        event: "ap.undo.follow.no_recipient",
+        actor,
+        activityId: objectId,
+      });
+      return true;
+    }
+    const follow = await findFollowByActivityId(db, originalActivity.apId);
     if (follow) {
       await undoFollowEdge(
         db,
@@ -391,7 +425,14 @@ async function resolveUndoByActivityId(
     // A crash-then-retry converges (the recompute is idempotent against the true
     // edge set) instead of permanently over-counting on the retry's no-op
     // delete. The actor-mismatch guard above still constrains who may undo.
-    await undoInteraction(db, kind, countField, undefined, objectId, actor);
+    await undoInteraction(
+      db,
+      kind,
+      countField,
+      undefined,
+      originalActivity.apId,
+      actor,
+    );
     return true;
   }
 
@@ -476,12 +517,26 @@ async function undoFollow(
   await undoFollowEdge(db, followerApId, followingApId, recipient.apId);
 }
 
+/**
+ * Undo(Like).
+ *
+ * If the like edge cannot be identified — from the inner object's `object`, or
+ * from the referenced Like activity id — there is NOTHING to undo and we say
+ * so. There used to be a "last resort" here that deleted every like the signer
+ * held on ANY object authored by the delivery recipient and then recomputed
+ * `likeCount` for EVERY one of that actor's `objects` rows. It was reachable
+ * from a malformed `{type:'Undo', object:{type:'Like', id:...}}` with no inner
+ * `object` (and from the actor-mismatch branch), and under the shared inbox it
+ * ran once per local follower, so a single non-conformant peer could both wipe
+ * a user's likes across an author's whole timeline and amplify a full-table
+ * UPDATE by the follower count. Nothing about the activity authorised that
+ * scope: the only thing it identified was the signer.
+ */
 async function undoLike(
   db: Database,
   objectId: string | null,
   activityObject: ReturnType<typeof getActivityObject>,
   actor: string,
-  recipient: ActorRow,
 ): Promise<void> {
   const handled = await undoInteraction(
     db,
@@ -493,43 +548,13 @@ async function undoLike(
   );
   if (handled) return;
 
-  // Last resort: delete any like from this actor for the recipient's objects.
-  // #COUNTER-SYM: co-commit the edge delete and a COUNT(*) recompute of likeCount
-  // in one atomic batch (mirrors the primary undoInteraction path). Previously
-  // the delete committed first and the count was decremented (`- 1`) in a
-  // SEPARATE statement; a crash between them, then a peer retry whose delete
-  // matches 0 rows, permanently SKIPPED the decrement → a like OVER-count.
-  // Deriving each affected object's likeCount from COUNT(*) of the remaining like
-  // rows makes the fallback idempotent so a crash-then-retry CONVERGES instead of
-  // drifting.
-  // The recipient (local user) can have authored thousands of objects; splicing
-  // every id into an `IN (...)` would blow D1's 100-bound-parameter ceiling.
-  // Express the affected set as a SUBQUERY (delete) and a direct predicate
-  // (update) so no per-object parameter is bound. An empty set is a harmless
-  // no-op batch, so the previous early-return is unnecessary.
-  const recipientObjectsSubquery = db
-    .select({ apId: objects.apId })
-    .from(objects)
-    .where(eq(objects.attributedTo, recipient.apId));
-
-  await runBatch(db, [
-    db
-      .delete(likes)
-      .where(
-        and(
-          eq(likes.actorApId, actor),
-          inArray(likes.objectApId, recipientObjectsSubquery),
-        ),
-      ),
-    db
-      .update(objects)
-      .set({
-        likeCount: sql`(SELECT COUNT(*) FROM ${likes} WHERE ${likes.objectApId} = ${objects.apId})`,
-      })
-      .where(eq(objects.attributedTo, recipient.apId)),
-  ]);
+  log.warn("Undo(Like) names no resolvable like edge; ignoring", {
+    event: "ap.undo.like.unresolved",
+    actor,
+    activityId: objectId,
+    object: activityObject?.object,
+  });
 }
-
 async function undoAnnounce(
   db: Database,
   objectId: string | null,

package/src/backend/routes/activitypub/handlers/inbox-interaction-handlers.ts

@@ -20,7 +20,9 @@ import {
   getActivityObjectId,
 } from "../inbox-types.ts";
 import { notifyLocalObjectOwner } from "./inbox-shared-helpers.ts";
+import { fetchAndPersistAnnouncedNote } from "./inbox-content-handlers.ts";
 import { isLocal } from "../../../lib/ap-ids.ts";
+import { notDeleted } from "../../../../db/index.ts";
 import {
   actorIsBlockedBy,
   canViewerReadObjectFull,
@@ -174,10 +176,15 @@ async function handleInteraction(
 // Like handler
 // ---------------------------------------------------------------------------
 
+/**
+ * A Like is INSTANCE-scoped: the affected object (and the local owner to
+ * notify) is resolved from `activity.object`, never from a delivery recipient.
+ * The recipient argument was already ignored; removing it is what stops the
+ * shared inbox from being able to run this once per local follower.
+ */
 export async function handleLike(
   c: ActivityContext,
   activity: Activity,
-  _recipient: ActorRow,
   actor: string,
   baseUrl: string,
 ) {
@@ -188,13 +195,70 @@ export async function handleLike(
 // Announce handler (repost/boost)
 // ---------------------------------------------------------------------------
 
+/**
+ * Does at least one (non-tombstoned) LOCAL actor have an accepted follow of
+ * `actorApId`? The fetch-and-store path below is gated on this so an arbitrary
+ * remote cannot use our inbox as an open relay: only a boost from someone a
+ * local user chose to follow may trigger an outbound object fetch.
+ */
+async function actorHasLocalFollowers(
+  db: Database,
+  actorApId: string,
+): Promise<boolean> {
+  const row = await db
+    .select({ followerApId: follows.followerApId })
+    .from(follows)
+    .innerJoin(
+      actors,
+      and(eq(actors.apId, follows.followerApId), notDeleted(actors)),
+    )
+    .where(
+      and(eq(follows.followingApId, actorApId), eq(follows.status, "accepted")),
+    )
+    .limit(1)
+    .get();
+  return Boolean(row);
+}
+
+/** Instance-scoped, exactly like {@link handleLike}. */
 export async function handleAnnounce(
   c: ActivityContext,
   activity: Activity,
-  _recipient: ActorRow,
   actor: string,
   baseUrl: string,
 ) {
+  // Fetch-and-store an UNKNOWN boosted remote object before recording the
+  // announce, so a followed remote's boost of a post this instance never saw
+  // still surfaces in feeds (previously the Announce only left a dangling
+  // announce edge + a counter no-op). Strictly gated: the target must be
+  // remote and unknown, and the booster must have at least one local follower
+  // (no open-relay amplification). On any fetch/validation failure the
+  // Announce degrades to exactly the old behavior — handleInteraction records
+  // the edge idempotently and the counter recompute no-ops on the absent row,
+  // so a later Create of the same object retroactively completes the boost.
+  const db = c.get("db");
+  const objectId = getActivityObjectId(activity);
+  if (objectId && !isLocal(objectId, baseUrl)) {
+    const known = await db
+      .select({ apId: objects.apId })
+      .from(objects)
+      .where(eq(objects.apId, objectId))
+      .get();
+    if (!known && (await actorHasLocalFollowers(db, actor))) {
+      const persisted = await fetchAndPersistAnnouncedNote(
+        db,
+        objectId,
+        baseUrl,
+      );
+      if (!persisted) {
+        log.debug("Announce target fetch skipped or failed", {
+          event: "ap.announce.object_fetch_failed",
+          actor,
+          objectId,
+        });
+      }
+    }
+  }
   await handleInteraction("announce", c, activity, actor, baseUrl);
 }
 

package/src/backend/routes/activitypub/handlers/inbox-shared-helpers.ts

@@ -23,18 +23,13 @@ import type { Activity } from "../inbox-types.ts";
 // ---------------------------------------------------------------------------
 
 type BatchStatement = BatchItem<"sqlite">;
-interface BatchableDb {
-  batch(
-    statements: readonly [BatchStatement, ...BatchStatement[]],
-  ): Promise<unknown>;
-}
 
-export async function runBatch(
-  db: Database,
-  statements: readonly [BatchStatement, ...BatchStatement[]],
-): Promise<void> {
-  await (db as unknown as BatchableDb).batch(statements);
-}
+// The batch primitive lives with the other D1 write primitives (src/db/
+// d1-write.ts) so the atomicity rule and the parameter-budget rule cannot
+// drift apart. Re-exported here because the inbox handlers are its heaviest
+// caller and this is the import path they already use.
+export { runBatch } from "../../../../db/d1-write.ts";
+import { runBatch } from "../../../../db/d1-write.ts";
 
 // ---------------------------------------------------------------------------
 // Shared helpers used by multiple inbox handler files
@@ -97,7 +92,7 @@ export async function findFollowByActivityId(
   followingApId: string;
   status: string;
 } | null> {
-  const row = await db
+  let row = await db
     .select({
       followerApId: follows.followerApId,
       followingApId: follows.followingApId,
@@ -106,6 +101,34 @@ export async function findFollowByActivityId(
     .from(follows)
     .where(eq(follows.activityApId, activityApIdValue))
     .get();
+  if (!row) {
+    // Inbound envelopes use an origin-bound internal activities.apId. Undo
+    // carries the peer's protocol id, so resolve that bounded raw-json id back
+    // to the internal row before looking up the follow edge. The direct lookup
+    // above preserves compatibility with legacy rows.
+    const source = await db
+      .select({ apId: activities.apId })
+      .from(activities)
+      .where(
+        and(
+          eq(activities.direction, "inbound"),
+          sql`json_extract(${activities.rawJson}, '$.id') = ${activityApIdValue}`,
+        ),
+      )
+      .limit(2);
+    for (const candidate of source) {
+      row = await db
+        .select({
+          followerApId: follows.followerApId,
+          followingApId: follows.followingApId,
+          status: follows.status,
+        })
+        .from(follows)
+        .where(eq(follows.activityApId, candidate.apId))
+        .get();
+      if (row) break;
+    }
+  }
   return row ?? null;
 }
 

package/src/backend/routes/activitypub/inbox-addressing.ts

@@ -0,0 +1,236 @@
+/**
+ * Shared-inbox addressing: which LOCAL actors is an inbound activity for?
+ *
+ * The old model was an exception list. Six types were "recipient independent"
+ * and dispatched once; everything else fell through to "fan out to every local
+ * actor that follows the SENDER". That fallback is a guess, and it is wrong in
+ * both directions:
+ *
+ *   - A DM or a Like from someone the recipient does not follow resolved to
+ *     ZERO recipients. The route then committed `processed = 1`, so the
+ *     activity was permanently un-redeliverable — a silent drop with a 202.
+ *     Our own delivery planner always prefers `endpoints.sharedInbox`, and so
+ *     does Mastodon, so this is the NORMAL inbound path, not an edge case.
+ *   - `Like` / `Announce` were fanned out once PER LOCAL FOLLOWER even though
+ *     their handlers take `_recipient` and resolve the target from the object's
+ *     `attributedTo`. Every extra follower was one more redundant whole-row
+ *     counter recompute.
+ *
+ * The replacement is a total function over the handled activity types. Every
+ * type declares its addressing class, `satisfies` makes the map exhaustive, and
+ * a new handler therefore cannot be added without declaring where it is
+ * addressed — the enforcement is `bunx tsc --noEmit`, not a lint script.
+ */
+
+import { and, eq, inArray } from "drizzle-orm";
+import type { Database } from "../../../db/index.ts";
+import { actors, follows, inChunks } from "../../../db/index.ts";
+import { isLocal } from "../../federation-helpers.ts";
+import type { Activity } from "./inbox-types.ts";
+import {
+  addressesPublic,
+  MAX_ADDRESS_ENTRIES,
+} from "./handlers/inbox-content-handlers.ts";
+
+export type ActorRow = typeof actors.$inferSelect;
+
+/**
+ * How an inbound activity names its recipients.
+ *
+ * `audience` is never DECLARED — it is only ever the RESULT of resolving an
+ * `addressed` activity whose addressing actually contains a Public or
+ * followers-collection marker. That distinction is the whole point: the old
+ * code performed a follower fan-out because it had found no other recipient,
+ * rather than because the activity asked for one.
+ */
+export type AddressingClass =
+  "instance" | "object-actor" | "addressed" | "audience";
+
+export type DeclaredAddressingClass = Exclude<AddressingClass, "audience">;
+
+/** Activity types `dispatchUserActivity` handles. */
+export const HANDLED_ACTIVITY_TYPES = [
+  "Follow",
+  "Accept",
+  "Undo",
+  "Like",
+  "Create",
+  "Delete",
+  "Announce",
+  "Update",
+  "Reject",
+  "Add",
+  "Remove",
+  "Block",
+  "Flag",
+  "Move",
+] as const;
+
+export type HandledActivityType = (typeof HANDLED_ACTIVITY_TYPES)[number];
+
+/**
+ * The addressing declaration. `satisfies` keeps it total: adding a handler to
+ * {@link HANDLED_ACTIVITY_TYPES} without a class here is a type error.
+ *
+ * `Like` and `Announce` are `instance`: their handlers already ignore the
+ * recipient argument and resolve the affected object (and its owner) from
+ * `activity.object`, so dispatching them once is not a behaviour change — it
+ * only removes the per-follower duplication.
+ *
+ * `Undo` is declared `object-actor` because Undo(Follow|Block) must reach the
+ * followed/blocked actor. Undo(Like|Announce) carries no local actor target and
+ * is actor-keyed + idempotent, so the resolver downgrades it to `instance`.
+ */
+export const ACTIVITY_ADDRESSING = {
+  Accept: "instance",
+  Delete: "instance",
+  Update: "instance",
+  Reject: "instance",
+  Flag: "instance",
+  Move: "instance",
+  Like: "instance",
+  Announce: "instance",
+
+  Follow: "object-actor",
+  Block: "object-actor",
+  Undo: "object-actor",
+
+  Create: "addressed",
+  Add: "addressed",
+  Remove: "addressed",
+} satisfies Record<HandledActivityType, DeclaredAddressingClass>;
+
+export function isHandledActivityType(
+  type: string,
+): type is HandledActivityType {
+  return type in ACTIVITY_ADDRESSING;
+}
+
+/**
+ * Every IRI the activity uses to name an audience, from the ENVELOPE and from
+ * an embedded object. The envelope fields used to be discarded by
+ * `parseActivity`, which is why a DM's addressing never reached routing.
+ *
+ * `bto`/`bcc` are included: a peer that strips them before delivery simply
+ * contributes nothing, and one that does not must still be honoured.
+ */
+export function collectAddresses(activity: Activity): string[] {
+  const object = typeof activity.object === "string" ? null : activity.object;
+  const all = [
+    ...(activity.to ?? []),
+    ...(activity.cc ?? []),
+    ...(activity.bto ?? []),
+    ...(activity.bcc ?? []),
+    ...(activity.audience ?? []),
+    ...(object?.to ?? []),
+    ...(object?.cc ?? []),
+  ];
+  // Same bound the persisted addressing arrays use (policy defined once, in
+  // inbox-content-handlers): a remote must not be able to make one delivery
+  // cost an unbounded number of actor lookups.
+  return [...new Set(all)].slice(0, MAX_ADDRESS_ENTRIES);
+}
+
+/**
+ * A followers-collection IRI. Matched by suffix, exactly like the visibility
+ * classifier in inbox-content-handlers — resolving the sender's real
+ * `followers` URL would need a network fetch for a remote actor.
+ */
+function addressesFollowersCollection(addresses: readonly string[]): boolean {
+  return addresses.some((a) => a.endsWith("/followers"));
+}
+
+export type AddressingResolution = {
+  /** The class actually applied (may be `audience`, which is never declared). */
+  readonly cls: AddressingClass;
+  readonly recipients: readonly ActorRow[];
+  /** Addressing IRIs read off the activity, for logging. */
+  readonly addresses: readonly string[];
+};
+
+/**
+ * Local actors explicitly named in the addressing.
+ */
+async function resolveAddressedLocalActors(
+  db: Database,
+  addresses: readonly string[],
+  baseUrl: string,
+): Promise<ActorRow[]> {
+  const localIris = addresses.filter(
+    (a) => isLocal(a, baseUrl) && !addressesPublic([a]),
+  );
+  if (localIris.length === 0) return [];
+  // Bounded by MAX_ADDRESS_ENTRIES, but routed through inChunks anyway so the
+  // D1 parameter rule holds if that bound is ever raised.
+  return await inChunks(localIris, (chunk) =>
+    db.query.actors.findMany({ where: inArray(actors.apId, [...chunk]) }),
+  );
+}
+
+/**
+ * Local actors with an accepted follow of `senderApId`.
+ */
+async function resolveLocalFollowers(
+  db: Database,
+  senderApId: string,
+  baseUrl: string,
+  limit: number,
+): Promise<ActorRow[]> {
+  const rows = await db
+    .select({ followerApId: follows.followerApId })
+    .from(follows)
+    .where(
+      and(
+        eq(follows.followingApId, senderApId),
+        eq(follows.status, "accepted"),
+      ),
+    )
+    .limit(limit);
+
+  const localFollowerApIds = rows
+    .map((row) => row.followerApId)
+    .filter((apId) => isLocal(apId, baseUrl));
+  if (localFollowerApIds.length === 0) return [];
+
+  return await inChunks(localFollowerApIds, (chunk) =>
+    db.query.actors.findMany({ where: inArray(actors.apId, [...chunk]) }),
+  );
+}
+
+/**
+ * Resolve an `addressed` activity's local recipients.
+ *
+ * A follower fan-out happens ONLY when the activity actually addresses Public
+ * or a followers collection (`audience`). An activity that names specific
+ * actors resolves to exactly those (`addressed`). An activity that names
+ * neither resolves to nothing, and the caller must treat that as UNDELIVERABLE
+ * rather than as a completed no-op — the old code's `processed = 1` on that
+ * branch is what made non-follower DMs unrecoverable.
+ */
+export async function resolveAddressedRecipients(
+  db: Database,
+  activity: Activity,
+  senderApId: string,
+  baseUrl: string,
+  followerFanoutLimit: number,
+): Promise<AddressingResolution> {
+  const addresses = collectAddresses(activity);
+  const addressed = await resolveAddressedLocalActors(db, addresses, baseUrl);
+
+  const wantsAudience =
+    addressesPublic([...addresses]) || addressesFollowersCollection(addresses);
+
+  if (!wantsAudience) {
+    return { cls: "addressed", recipients: addressed, addresses };
+  }
+
+  const followers = await resolveLocalFollowers(
+    db,
+    senderApId,
+    baseUrl,
+    followerFanoutLimit,
+  );
+  const byApId = new Map<string, ActorRow>();
+  for (const row of [...addressed, ...followers]) byApId.set(row.apId, row);
+  return { cls: "audience", recipients: [...byApId.values()], addresses };
+}

package/src/backend/routes/activitypub/inbox-types.ts

@@ -29,6 +29,14 @@ export type Activity = {
   object?: string | ActivityObject;
   target?: string | ActivityObject;
   room?: string;
+  // Envelope addressing, preserved by parseActivity. Shared-inbox routing is
+  // derived from these (inbox-addressing.ts); before they were parsed the
+  // route had to guess the recipients from the sender's follower graph.
+  to?: string[];
+  cc?: string[];
+  bto?: string[];
+  bcc?: string[];
+  audience?: string[];
 };
 
 export type RemoteActor = {