@takosjp/yurucommu-core 3.4.1 → 3.4.4

package/src/backend/lib/account-migration.ts

@@ -9,6 +9,14 @@ import { signRequest } from "./ap-signing.ts";
 import type { RemoteFetchSigner } from "./activitypub-actor-cache.ts";
 import { parseWebFinger } from "./activitypub-validators.ts";
 import { isSafeRemoteUrl, normalizeRemoteDomain } from "./ssrf.ts";
+import type { Env } from "../types.ts";
+import type { Database, D1Statement } from "../../db/index.ts";
+import { activities, actors, follows, runBatch } from "../../db/index.ts";
+import { and, asc, eq, exists, gt, ne, notExists, sql } from "drizzle-orm";
+import { alias } from "drizzle-orm/sqlite-core";
+import { activityApId } from "./ap-ids.ts";
+import { enqueueDeliveriesToActor } from "./delivery/queue.ts";
+import { sha256Hex } from "./delivery/transformers.ts";
 
 const ALIAS_FETCH_TIMEOUT_MS = 15000;
 
@@ -104,3 +112,335 @@ export async function destinationDeclaresAlias(
     return false;
   }
 }
+
+// ---------------------------------------------------------------------------
+// Inbound Move follow-graph rewrite
+// ---------------------------------------------------------------------------
+
+const MOVE_REFOLLOW_PAGE_SIZE = 100;
+
+/**
+ * Stable namespace for the outbound Follow activities produced by one inbound
+ * Move. The inbox stamps a fixed-size, signer-bound internal activity id before
+ * dispatch; the old/new ids are mixed in as defense-in-depth and to keep direct
+ * handler tests deterministic when no inbox id is supplied.
+ */
+export async function moveRefollowPrefix(args: {
+  readonly baseUrl: string;
+  readonly inboundActivityId?: string;
+  readonly oldActorApId: string;
+  readonly newActorApId: string;
+}): Promise<string> {
+  const digest = await sha256Hex(
+    `${args.inboundActivityId ?? "synthetic-move"}\0${args.oldActorApId}\0${args.newActorApId}`,
+  );
+  return activityApId(args.baseUrl, `move-refollow-${digest}-`);
+}
+
+/**
+ * Re-enqueue every durable local re-Follow created for one Move. Returns the
+ * number of persisted activities found, so the handler can resume a graph
+ * rewrite that committed before a Queue send failed without re-fetching the
+ * destination alias or trying to reconstruct already-deleted old edges.
+ */
+export async function enqueuePersistedMoveRefollows(args: {
+  readonly db: Database;
+  readonly env: Env;
+  readonly newActorApId: string;
+  readonly refollowPrefix: string;
+}): Promise<number> {
+  let cursor: string | null = null;
+  let found = 0;
+
+  while (true) {
+    const page = await args.db
+      .select({ apId: activities.apId })
+      .from(activities)
+      .where(
+        and(
+          eq(activities.type, "Follow"),
+          eq(activities.objectApId, args.newActorApId),
+          eq(activities.direction, "outbound"),
+          // `LIKE prefix%` would hit D1's short LIKE-pattern complexity limit
+          // because the stable prefix contains a full URL + SHA-256 digest.
+          sql`instr(${activities.apId}, ${args.refollowPrefix}) = 1`,
+          cursor ? gt(activities.apId, cursor) : undefined,
+        ),
+      )
+      .orderBy(asc(activities.apId))
+      .limit(MOVE_REFOLLOW_PAGE_SIZE);
+
+    if (page.length === 0) break;
+    await enqueueDeliveriesToActor(
+      args.env,
+      page.map((row) => row.apId),
+      args.newActorApId,
+    );
+    found += page.length;
+    cursor = page[page.length - 1]!.apId;
+    if (page.length < MOVE_REFOLLOW_PAGE_SIZE) break;
+  }
+
+  return found;
+}
+
+/**
+ * Atomically rewrite every edge that names a moved remote actor.
+ *
+ * The statement count is fixed at eight regardless of graph size. Each INSERT
+ * reads the old graph with INSERT ... SELECT, so it binds only the handful of
+ * actor/prefix values rather than six parameters per edge. Both counter repairs
+ * are set-based UPDATEs. This is deliberately not implemented as insertMany()
+ * chunks: a large graph would eventually exceed the 50-statement atomic-batch
+ * ceiling, while splitting the delete/insert work across batches would expose
+ * a permanent half-migrated graph after a crash.
+ *
+ * Outbound local re-Follow activities are written in the same batch as their
+ * pending edges. If Queue delivery throws after commit, the stable prefix lets
+ * a retry call enqueuePersistedMoveRefollows() before touching the graph.
+ */
+export async function rewriteMovedFollowGraph(args: {
+  readonly db: Database;
+  readonly oldActorApId: string;
+  readonly newActorApId: string;
+  readonly refollowPrefix: string;
+}): Promise<void> {
+  const oldAsFollower = alias(follows, "move_old_as_follower");
+  const oldAsFollowee = alias(follows, "move_old_as_followee");
+  const existingFollowerTarget = alias(
+    follows,
+    "move_existing_follower_target",
+  );
+  const existingFollowingSource = alias(
+    follows,
+    "move_existing_following_source",
+  );
+  const localFollowerActor = alias(actors, "move_local_follower_actor");
+
+  // These aliases belong to the counter statements. Keep them separate from
+  // the INSERT aliases so each generated statement is unambiguous to SQLite.
+  const acceptedOldFollowee = alias(follows, "move_accepted_old_followee");
+  const acceptedOldFollower = alias(follows, "move_accepted_old_follower");
+  const duplicateNewFollower = alias(follows, "move_duplicate_new_follower");
+
+  const decrementLocalFollowers = args.db
+    .update(actors)
+    .set({ followingCount: sql`${actors.followingCount} - 1` })
+    .where(
+      and(
+        gt(actors.followingCount, 0),
+        exists(
+          args.db
+            .select({ one: sql`1` })
+            .from(acceptedOldFollowee)
+            .where(
+              and(
+                eq(acceptedOldFollowee.followingApId, args.oldActorApId),
+                eq(acceptedOldFollowee.followerApId, actors.apId),
+                eq(acceptedOldFollowee.status, "accepted"),
+              ),
+            ),
+        ),
+      ),
+    );
+
+  const decrementDroppedLocalFollowees = args.db
+    .update(actors)
+    .set({ followerCount: sql`${actors.followerCount} - 1` })
+    .where(
+      and(
+        gt(actors.followerCount, 0),
+        exists(
+          args.db
+            .select({ one: sql`1` })
+            .from(acceptedOldFollower)
+            .where(
+              and(
+                eq(acceptedOldFollower.followerApId, args.oldActorApId),
+                eq(acceptedOldFollower.followingApId, actors.apId),
+                eq(acceptedOldFollower.status, "accepted"),
+              ),
+            ),
+        ),
+        sql`(
+          ${actors.apId} = ${args.newActorApId}
+          OR ${exists(
+            args.db
+              .select({ one: sql`1` })
+              .from(duplicateNewFollower)
+              .where(
+                and(
+                  eq(duplicateNewFollower.followerApId, args.newActorApId),
+                  eq(duplicateNewFollower.followingApId, actors.apId),
+                ),
+              ),
+          )}
+        )`,
+      ),
+    );
+
+  const rewriteOldAsFollower = args.db
+    .insert(follows)
+    .select(
+      args.db
+        .select({
+          followerApId: sql<string>`${args.newActorApId}`.as("follower_ap_id"),
+          followingApId: oldAsFollower.followingApId,
+          status: oldAsFollower.status,
+          activityApId: oldAsFollower.activityApId,
+          createdAt: oldAsFollower.createdAt,
+          acceptedAt: oldAsFollower.acceptedAt,
+        })
+        .from(oldAsFollower)
+        .where(
+          and(
+            eq(oldAsFollower.followerApId, args.oldActorApId),
+            ne(oldAsFollower.followingApId, args.newActorApId),
+            notExists(
+              args.db
+                .select({ one: sql`1` })
+                .from(existingFollowerTarget)
+                .where(
+                  and(
+                    eq(existingFollowerTarget.followerApId, args.newActorApId),
+                    eq(
+                      existingFollowerTarget.followingApId,
+                      oldAsFollower.followingApId,
+                    ),
+                  ),
+                ),
+            ),
+          ),
+        ),
+    )
+    .onConflictDoNothing();
+
+  const localFollowerExists = exists(
+    args.db
+      .select({ one: sql`1` })
+      .from(localFollowerActor)
+      .where(eq(localFollowerActor.apId, oldAsFollowee.followerApId)),
+  );
+  const targetEdgeDoesNotExist = notExists(
+    args.db
+      .select({ one: sql`1` })
+      .from(existingFollowingSource)
+      .where(
+        and(
+          eq(existingFollowingSource.followerApId, oldAsFollowee.followerApId),
+          eq(existingFollowingSource.followingApId, args.newActorApId),
+        ),
+      ),
+  );
+
+  const rewriteLocalFollowers = args.db
+    .insert(follows)
+    .select(
+      args.db
+        .select({
+          followerApId: oldAsFollowee.followerApId,
+          followingApId: sql<string>`${args.newActorApId}`.as(
+            "following_ap_id",
+          ),
+          status: sql<string>`'pending'`.as("status"),
+          activityApId:
+            sql<string>`${args.refollowPrefix} || lower(hex(randomblob(32)))`.as(
+              "activity_ap_id",
+            ),
+          createdAt: oldAsFollowee.createdAt,
+          acceptedAt: sql<null>`NULL`.as("accepted_at"),
+        })
+        .from(oldAsFollowee)
+        .where(
+          and(
+            eq(oldAsFollowee.followingApId, args.oldActorApId),
+            ne(oldAsFollowee.followerApId, args.newActorApId),
+            targetEdgeDoesNotExist,
+            localFollowerExists,
+          ),
+        ),
+    )
+    .onConflictDoNothing();
+
+  const rewriteRemoteFollowers = args.db
+    .insert(follows)
+    .select(
+      args.db
+        .select({
+          followerApId: oldAsFollowee.followerApId,
+          followingApId: sql<string>`${args.newActorApId}`.as(
+            "following_ap_id",
+          ),
+          status: oldAsFollowee.status,
+          activityApId: oldAsFollowee.activityApId,
+          createdAt: oldAsFollowee.createdAt,
+          acceptedAt: oldAsFollowee.acceptedAt,
+        })
+        .from(oldAsFollowee)
+        .where(
+          and(
+            eq(oldAsFollowee.followingApId, args.oldActorApId),
+            ne(oldAsFollowee.followerApId, args.newActorApId),
+            targetEdgeDoesNotExist,
+            notExists(
+              args.db
+                .select({ one: sql`1` })
+                .from(localFollowerActor)
+                .where(eq(localFollowerActor.apId, oldAsFollowee.followerApId)),
+            ),
+          ),
+        ),
+    )
+    .onConflictDoNothing();
+
+  const migratedLocalFollow = alias(follows, "move_migrated_local_follow");
+  const recordLocalRefollows = args.db
+    .insert(activities)
+    .select(
+      args.db
+        .select({
+          apId: migratedLocalFollow.activityApId,
+          type: sql<string>`'Follow'`.as("type"),
+          actorApId: migratedLocalFollow.followerApId,
+          objectApId: sql<string>`${args.newActorApId}`.as("object_ap_id"),
+          objectJson: sql<null>`NULL`.as("object_json"),
+          targetApId: sql<null>`NULL`.as("target_ap_id"),
+          rawJson: sql<string>`json_object(
+            '@context', 'https://www.w3.org/ns/activitystreams',
+            'id', ${migratedLocalFollow.activityApId},
+            'type', 'Follow',
+            'actor', ${migratedLocalFollow.followerApId},
+            'object', ${args.newActorApId}
+          )`.as("raw_json"),
+          direction: sql<string>`'outbound'`.as("direction"),
+          processed: sql<number>`0`.as("processed"),
+          createdAt: sql<string>`datetime('now')`.as("created_at"),
+        })
+        .from(migratedLocalFollow)
+        .where(
+          and(
+            eq(migratedLocalFollow.followingApId, args.newActorApId),
+            sql`instr(${migratedLocalFollow.activityApId}, ${args.refollowPrefix}) = 1`,
+          ),
+        ),
+    )
+    .onConflictDoNothing();
+
+  const deleteOldAsFollower = args.db
+    .delete(follows)
+    .where(eq(follows.followerApId, args.oldActorApId));
+  const deleteOldAsFollowee = args.db
+    .delete(follows)
+    .where(eq(follows.followingApId, args.oldActorApId));
+
+  await runBatch(args.db, [
+    decrementLocalFollowers,
+    decrementDroppedLocalFollowees,
+    rewriteOldAsFollower,
+    rewriteLocalFollowers,
+    rewriteRemoteFollowers,
+    recordLocalRefollows,
+    deleteOldAsFollower,
+    deleteOldAsFollowee,
+  ] as unknown as [D1Statement, ...D1Statement[]]);
+}

package/src/backend/lib/activity-delete-cascade.ts

@@ -0,0 +1,193 @@
+import { and, inArray, notExists, or, type SQL } from "drizzle-orm";
+
+import {
+  activities,
+  deliveryFanouts,
+  deliveryQueue,
+  deliveryResolutions,
+  inboundActivityClaims,
+  inbox,
+  notificationArchived,
+  notificationPushJobs,
+  runBatch,
+  type Database,
+  type D1Statement,
+} from "../../db/index.ts";
+
+/**
+ * A write-time fence for deleting an Activity actor's signing material.
+ *
+ * Preliminary reads are not sufficient: a fanout/resolution worker can
+ * materialize an endpoint after the reaper checked delivery_queue and then
+ * mark its own outbox terminal before the reaper checks that table. Reuse this
+ * predicate on EVERY statement in the atomic cleanup batch so newly active
+ * work stops the remaining deletes before the Activity or signer disappears.
+ */
+export function activityDeliveryDrainedGuard(
+  db: Database,
+  activityWhere: SQL,
+): SQL {
+  const targetActivityIds = () =>
+    db.select({ apId: activities.apId }).from(activities).where(activityWhere);
+
+  return and(
+    notExists(
+      db
+        .select({ id: deliveryQueue.id })
+        .from(deliveryQueue)
+        .where(
+          and(
+            inArray(deliveryQueue.activityApId, targetActivityIds()),
+            inArray(deliveryQueue.status, [
+              "pending",
+              "processing",
+              "retry_wait",
+            ]),
+          ),
+        ),
+    ),
+    notExists(
+      db
+        .select({ id: deliveryResolutions.id })
+        .from(deliveryResolutions)
+        .where(
+          and(
+            inArray(deliveryResolutions.activityApId, targetActivityIds()),
+            inArray(deliveryResolutions.status, [
+              "pending",
+              "queued",
+              "processing",
+              "retry_wait",
+            ]),
+          ),
+        ),
+    ),
+    notExists(
+      db
+        .select({ id: deliveryFanouts.id })
+        .from(deliveryFanouts)
+        .where(
+          and(
+            or(
+              inArray(deliveryFanouts.activityApId, targetActivityIds()),
+              inArray(
+                deliveryFanouts.announceActivityApId,
+                targetActivityIds(),
+              ),
+            ),
+            inArray(deliveryFanouts.status, ["pending", "published"]),
+          ),
+        ),
+    ),
+  )!;
+}
+
+/**
+ * Build the atomic cleanup unit for every durable projection of matching
+ * activities while retaining the activity ledger rows themselves.
+ *
+ * The inbox FK/trigger only removes push jobs in selected non-terminal states;
+ * delivery work, archived markers, in-flight/terminal push jobs, and inbound
+ * claim leases otherwise survive. This projection-only form is also used when
+ * an object is deleted but its historical Activity must remain available.
+ */
+export function activityProjectionDeleteStatements(
+  db: Database,
+  activityWhere: SQL,
+  options: { readonly guard?: SQL } = {},
+): readonly [D1Statement, ...D1Statement[]] {
+  const targetActivityIds = () =>
+    db.select({ apId: activities.apId }).from(activities).where(activityWhere);
+  const guarded = (where: SQL): SQL =>
+    options.guard ? and(where, options.guard)! : where;
+
+  return [
+    db
+      .delete(notificationPushJobs)
+      .where(
+        guarded(
+          inArray(notificationPushJobs.activityApId, targetActivityIds()),
+        ),
+      ) as D1Statement,
+    db
+      .delete(notificationArchived)
+      .where(
+        guarded(
+          inArray(notificationArchived.activityApId, targetActivityIds()),
+        ),
+      ) as D1Statement,
+    db
+      .delete(inboundActivityClaims)
+      .where(
+        guarded(
+          inArray(inboundActivityClaims.activityApId, targetActivityIds()),
+        ),
+      ) as D1Statement,
+    db
+      .delete(deliveryQueue)
+      .where(
+        guarded(inArray(deliveryQueue.activityApId, targetActivityIds())),
+      ) as D1Statement,
+    db
+      .delete(deliveryResolutions)
+      .where(
+        guarded(inArray(deliveryResolutions.activityApId, targetActivityIds())),
+      ) as D1Statement,
+    db
+      .delete(deliveryFanouts)
+      .where(
+        guarded(inArray(deliveryFanouts.activityApId, targetActivityIds())),
+      ) as D1Statement,
+    // Keep the secondary Announce reference in its own statement. Combining
+    // both predicates with OR duplicates every bound value in D1, so a normal
+    // 90-id cascade would exceed the platform's 100-parameter ceiling.
+    db
+      .delete(deliveryFanouts)
+      .where(
+        guarded(
+          inArray(deliveryFanouts.announceActivityApId, targetActivityIds()),
+        ),
+      ) as D1Statement,
+    db
+      .delete(inbox)
+      .where(
+        guarded(inArray(inbox.activityApId, targetActivityIds())),
+      ) as D1Statement,
+  ];
+}
+
+/**
+ * Build one atomic hard-delete unit for activities and every durable
+ * projection keyed by their AP IDs.
+ *
+ * Keep the activities rows until the final statement so every preceding
+ * subquery sees the same target set. Semantic edges (`likes`, `announces`,
+ * `follows`) are intentionally caller-owned because removing them also
+ * requires domain-specific counter repair.
+ */
+export function activityDeleteCascadeStatements(
+  db: Database,
+  activityWhere: SQL,
+  options: { readonly guard?: SQL } = {},
+): readonly [D1Statement, ...D1Statement[]] {
+  return [
+    ...activityProjectionDeleteStatements(db, activityWhere, options),
+    db
+      .delete(activities)
+      .where(
+        options.guard ? and(activityWhere, options.guard) : activityWhere,
+      ) as D1Statement,
+  ];
+}
+
+/**
+ * Atomically hard-delete matching activities and all of their projections.
+ * A failed final activity delete rolls the preceding cleanup back, so the
+ * caller can retry the same idempotent predicate without partial state.
+ */
+export async function deleteActivitiesCascade(
+  db: Database,
+  activityWhere: SQL,
+): Promise<void> {
+  await runBatch(db, activityDeleteCascadeStatements(db, activityWhere));
+}