@takosjp/yurucommu-core 3.4.1 → 3.4.4

package/src/backend/routes/stories/routes.ts

@@ -2,7 +2,7 @@
 // v2: 1 Story = 1 Media (Instagram style)
 import { Hono } from "hono";
 import { and, desc, eq, gt, inArray, isNull, or, sql } from "drizzle-orm";
-import type { Database } from "../../../db/index.ts";
+import type { D1Statement, Database } from "../../../db/index.ts";
 import {
   activities,
   actors,
@@ -10,6 +10,7 @@ import {
   follows,
   likes,
   objects,
+  runBatch,
   storyViews,
 } from "../../../db/index.ts";
 import {
@@ -25,7 +26,7 @@ import {
   objectApId,
 } from "../../federation-helpers.ts";
 import { storyToActivityPub } from "../../lib/activitypub-helpers.ts";
-import { excludeBlockedMutedAuthors } from "../../lib/feed-exclude.ts";
+import { excludeModeratedActors } from "../../lib/feed-exclude.ts";
 import { maybeReapDrainedTombstones } from "../actors.ts";
 import { checkCommunityPostPermission } from "../posts/post-helpers.ts";
 import { rateLimit, RateLimitConfigs } from "../../middleware/rate-limit.ts";
@@ -34,7 +35,6 @@ import {
   cleanupExpiredStories,
   fetchActorCache,
   fetchBatchVotes,
-  fetchBlockedAndMutedIds,
   type StoryAuthor,
   sumVotes,
   transformStoryData,
@@ -45,30 +45,20 @@ import {
   enqueueFanoutToFollowers,
 } from "../../lib/delivery/queue.ts";
 import { logger } from "../../lib/logger.ts";
+import { personalActorIsSuppressedBy } from "../../lib/personal-actor-moderation.ts";
+import { prepareDeliveryFanoutJob } from "../../lib/delivery/fanout-outbox.ts";
 
 const log = logger.child({ component: "stories.routes" });
 
-/**
- * Narrow view over the concrete D1/libsql drizzle client's atomic batch API.
- * The shared `Database` union type does not surface `batch` (it lives on the
- * concrete subclasses), so we reach it through a structural cast at the call
- * site that needs an atomic multi-statement write.
- */
-type Batchable = {
-  batch(statements: readonly unknown[]): Promise<unknown>;
-};
-
 const stories = new Hono<{ Bindings: Env; Variables: Variables }>();
 
 // Best-effort, opportunistic retention of expired stories.
 //
-// This is NOT a substitute for a scheduled job: this Worker has no `scheduled`
-// handler / cron trigger, so expiry cleanup is triggered probabilistically on
-// the read path. Expired stories are already excluded from every read query
-// (the feed/single-story handlers filter on `endTime`), so the only impact of
-// a missed sweep is storage growth, not stale data leaking to users. The guard
-// below ensures at most one sweep runs at a time per isolate, so a burst of
-// feed requests cannot kick off several concurrent full-table delete sweeps.
+// The public Worker also exposes a scheduled retention handler. Keep this
+// probabilistic read-path pass as a self-hosting fallback for runtimes that do
+// not configure a cron trigger. Expired stories are already excluded from every
+// read query, so a missed sweep affects storage only. The guard below ensures
+// at most one fallback pass runs at a time per isolate.
 let expiredStoryCleanupInFlight = false;
 
 function maybeCleanupExpiredStories(
@@ -219,60 +209,70 @@ async function createAndFanoutActivity(
   actorApIdStr: string,
   objectApIdStr: string,
   activity: Record<string, unknown>,
-  communityApId?: string | null,
+  communityApId: string | null | undefined,
+  localStatements: readonly [D1Statement, ...D1Statement[]],
 ): Promise<void> {
   const id = activity.id as string;
-  await db.insert(activities).values({
-    apId: id,
-    type: activity.type as string,
-    actorApId: actorApIdStr,
-    objectApId: objectApIdStr,
-    rawJson: JSON.stringify(activity),
-    direction: "outbound",
-  });
+  const preparedFanout = await prepareDeliveryFanoutJob(
+    db,
+    communityApId
+      ? {
+          kind: "community",
+          activityId: id,
+          targetApId: communityApId,
+        }
+      : {
+          kind: "followers",
+          activityId: id,
+          targetApId: actorApIdStr,
+        },
+  );
+  await runBatch(db, [
+    ...localStatements,
+    db.insert(activities).values({
+      apId: id,
+      type: activity.type as string,
+      actorApId: actorApIdStr,
+      objectApId: objectApIdStr,
+      rawJson: JSON.stringify(activity),
+      direction: "outbound",
+    }) as D1Statement,
+    preparedFanout.statement,
+  ]);
+  await publishDurableStoryFanoutWakeup(env, id, actorApIdStr, communityApId);
+}
+
+async function publishDurableStoryFanoutWakeup(
+  env: Env,
+  activityId: string,
+  actorApId: string,
+  communityApId?: string | null,
+): Promise<void> {
   // A community-scoped story has reach == community: fan its activity out to the
   // community's members/followers (the same audience posts use), NOT the
   // author's personal follower graph. A personal story keeps author-follower
   // reach.
-  if (communityApId) {
-    await enqueueFanoutToCommunity(env, id, communityApId);
-  } else {
-    await enqueueFanoutToFollowers(env, id, actorApIdStr);
+  try {
+    if (communityApId) {
+      await enqueueFanoutToCommunity(env, activityId, communityApId);
+    } else {
+      await enqueueFanoutToFollowers(env, activityId, actorApId);
+    }
+  } catch (error) {
+    // Activity and semantic fanout intent were committed atomically above. The
+    // Queue RPC is only a wakeup; keep the route moving so Create returns the
+    // committed story and Delete completes its local cascade while scheduled
+    // recovery republishes the pending row.
+    log.error("Failed to publish durable story fanout wakeup", {
+      event: "stories.fanout_wakeup_failed",
+      activityId,
+      actor: actorApId,
+      communityApId: communityApId ?? null,
+      error,
+    });
   }
 }
 
-/**
- * Delete all related data for a story, then the story object itself.
- *
- * Delegates to `deleteObjectCascade` (the SAME teardown the expiry path
- * `cleanupExpiredStories` runs) so it also reaps the story's mandatory R2 blob
- * and its `media_uploads` row — child-row-only deletion here would orphan the
- * image in R2 forever (there is no orphan-key sweep). The cascade covers
- * storyViews/Votes/Shares + likes + announces + bookmarks + objectRecipients +
- * media; it reads `attachments_json` off the still-present object row, so the
- * object row is dropped afterwards.
- */
-/**
- * Returns true when THIS call actually removed the objects row (false if it was
- * already gone). Callers gate the author's postCount decrement on this so a
- * concurrent duplicate delete — or a race with the opportunistic expiry sweep —
- * decrements at most once for the single +1 the story counted at create time.
- */
-async function deleteStoryAndRelatedData(
-  db: Database,
-  apId: string,
-  media?: IObjectStorage,
-): Promise<boolean> {
-  const mediaKeys = await deleteObjectCascade(db, apId, media);
-  const deleted = await db
-    .delete(objects)
-    .where(eq(objects.apId, apId))
-    .returning({ apId: objects.apId });
-  // Irreversible R2 purge LAST — after the objects row is gone.
-  await purgeMediaBlobs(media, mediaKeys);
-  return deleted.length > 0;
-}
-
 /**
  * Resolve the scope of a stories read request.
  *
@@ -369,7 +369,7 @@ stories.get("/", async (c) => {
           ),
         );
 
-  const excludeAuthors = excludeBlockedMutedAuthors(db, actor.ap_id);
+  const excludeAuthors = excludeModeratedActors(actor.ap_id);
   if (excludeAuthors) {
     storiesWhere = and(storiesWhere, excludeAuthors);
   }
@@ -529,14 +529,11 @@ stories.get("/:actorId", async (c) => {
   }
 
   // Check blocked/muted (if authenticated)
-  if (actor) {
-    const { blockedIds, mutedIds } = await fetchBlockedAndMutedIds(
-      db,
-      actor.ap_id,
-    );
-    if (blockedIds.includes(targetApId) || mutedIds.includes(targetApId)) {
-      return c.json({ stories: [] });
-    }
+  if (
+    actor &&
+    (await personalActorIsSuppressedBy(db, actor.ap_id, targetApId))
+  ) {
+    return c.json({ stories: [] });
   }
 
   // Personal stories are follower-scoped: the home feed (`GET /`) only surfaces
@@ -578,6 +575,7 @@ stories.get("/:actorId", async (c) => {
         eq(objects.attributedTo, targetApId),
         gt(objects.endTime, now),
         scopeCondition,
+        excludeModeratedActors(actor?.ap_id ?? ""),
       ),
     )
     .orderBy(desc(objects.published))
@@ -723,12 +721,6 @@ stories.post("/", async (c) => {
   };
   const attachmentsJson = JSON.stringify(storyData);
 
-  // Insert the story object and bump the author's denormalized postCount in a
-  // single atomic batch. D1 has no interactive transactions, so doing these as
-  // two separate writes could drift the counter relative to the stored stories
-  // on a mid-request failure. The `Database` union type does not surface `batch`
-  // (it is only on the concrete D1/libsql subclasses), so reach it through a
-  // narrow structural cast.
   const storyInsert = db.insert(objects).values({
     apId,
     type: "Story",
@@ -739,14 +731,12 @@ stories.post("/", async (c) => {
     endTime,
     published: now,
     isLocal: 1,
-  });
+  }) as D1Statement;
 
   const postCountBump = db
     .update(actors)
     .set({ postCount: sql`${actors.postCount} + 1` })
-    .where(eq(actors.apId, actor.ap_id));
-
-  await (db as unknown as Batchable).batch([storyInsert, postCountBump]);
+    .where(eq(actors.apId, actor.ap_id)) as D1Statement;
 
   const responseData = transformStoryData(attachmentsJson);
   const authorInfo = buildAuthor(actor.ap_id, {
@@ -805,6 +795,7 @@ stories.post("/", async (c) => {
       object: storyObject,
     },
     communityApIdValue,
+    [storyInsert, postCountBump],
   );
 
   return c.json({ story }, 201);
@@ -831,46 +822,70 @@ stories.post("/delete", async (c) => {
     return c.json({ error: "Forbidden" }, 403);
   }
 
-  // Enqueue Delete(Story) activity before deleting. Outbound delivery MUST NOT
-  // run in request path; enqueue is the sync boundary. A community-scoped story
-  // tombstone is addressed to and fanned out to the community (reach ==
-  // community), mirroring its Create; a personal story keeps author-follower
-  // reach.
+  // A community-scoped story tombstone is addressed to and fanned out to the
+  // community (reach == community), mirroring its Create; a personal story
+  // keeps author-follower reach.
   const baseUrl = c.env.APP_URL;
   const deleteTo = story.communityApId
     ? [`${story.communityApId}/followers`]
     : ["https://www.w3.org/ns/activitystreams#Public"];
-  await createAndFanoutActivity(
+  const deleteActivity = {
+    "@context": "https://www.w3.org/ns/activitystreams",
+    id: activityApId(baseUrl, generateId()),
+    type: "Delete",
+    actor: actor.ap_id,
+    to: deleteTo,
+    object: apId,
+  };
+  const preparedFanout = await prepareDeliveryFanoutJob(
     db,
-    c.env,
-    actor.ap_id,
-    apId,
-    {
-      "@context": "https://www.w3.org/ns/activitystreams",
-      id: activityApId(baseUrl, generateId()),
-      type: "Delete",
-      actor: actor.ap_id,
-      to: deleteTo,
-      object: apId,
-    },
-    story.communityApId,
+    story.communityApId
+      ? {
+          kind: "community",
+          activityId: deleteActivity.id,
+          targetApId: story.communityApId,
+        }
+      : {
+          kind: "followers",
+          activityId: deleteActivity.id,
+          targetApId: actor.ap_id,
+        },
   );
 
-  const removed = await deleteStoryAndRelatedData(db, apId, c.env.MEDIA);
-
-  // Decrement the author's postCount ONLY when THIS request actually removed the
-  // row. The early 404 above guards SEQUENTIAL duplicates, but two concurrent
-  // deletes (double-click / retry) — or a manual delete racing the opportunistic
-  // expiry sweep (cleanupExpiredStories) — can both pass the SELECT before either
-  // delete commits, then both reach here; an unconditional decrement would then
-  // subtract 2 for one +1. Gating on the actual delete keeps the count exact
-  // (gt > 0 still guards underflow). Mirrors the EXISTS-guarded post-delete path.
-  if (removed) {
-    await db
+  // Reap every projection of the OLD Create/Update activities while the story
+  // row still exists. The outbound Delete is deliberately inserted only in the
+  // final batch below; inserting it first made this cascade erase its own
+  // pending fanout before a Queue consumer could resolve the Activity.
+  const mediaKeys = await deleteObjectCascade(db, apId, c.env.MEDIA);
+  const storyExists = sql`EXISTS (SELECT 1 FROM ${objects} WHERE ${objects.apId} = ${apId})`;
+  await runBatch(db, [
+    db
       .update(actors)
       .set({ postCount: sql`${actors.postCount} - 1` })
-      .where(and(eq(actors.apId, actor.ap_id), gt(actors.postCount, 0)));
-  }
+      .where(
+        and(eq(actors.apId, actor.ap_id), gt(actors.postCount, 0), storyExists),
+      ) as D1Statement,
+    db.delete(objects).where(eq(objects.apId, apId)) as D1Statement,
+    db.insert(activities).values({
+      apId: deleteActivity.id,
+      type: deleteActivity.type,
+      actorApId: actor.ap_id,
+      objectApId: apId,
+      rawJson: JSON.stringify(deleteActivity),
+      direction: "outbound",
+    }) as D1Statement,
+    preparedFanout.statement,
+  ]);
+
+  // Irreversible R2 purge only after the story row is gone and its durable
+  // federation intent exists.
+  await purgeMediaBlobs(c.env.MEDIA, mediaKeys);
+  await publishDurableStoryFanoutWakeup(
+    c.env,
+    deleteActivity.id,
+    actor.ap_id,
+    story.communityApId,
+  );
 
   return c.json({ success: true });
 });

package/src/backend/routes/takos-tools/dm.ts

@@ -5,7 +5,7 @@
  *          yurucommu_get_dm_messages
  */
 
-import { and, desc, eq, isNotNull } from "drizzle-orm";
+import { and, desc, eq, inArray, or } from "drizzle-orm";
 import {
   activities,
   actors,
@@ -18,7 +18,6 @@ import {
   activityApId,
   generateId,
   objectApId,
-  safeJsonParse,
 } from "../../federation-helpers.ts";
 import {
   MAX_DM_CONTENT_LENGTH,
@@ -30,11 +29,16 @@ import {
   errRequired,
   ok,
   requireString,
-  resolveDmPartner,
   toolLimit,
   type ToolResponse,
 } from "../takos-tools-response.ts";
+import {
+  dmWhereForActor,
+  getOtherParticipant,
+  recipientObjectIds,
+} from "../dm/conversations-helpers.ts";
 import type { Input, ToolContext } from "./types.ts";
+import { isActorBlockedStrict } from "../../lib/blocklist.ts";
 
 // `.batch` lives only on the concrete D1/libsql subclasses; reach it through a
 // narrow structural cast so the Note + recipient + activity + inbox commit
@@ -165,13 +169,7 @@ export async function handleGetDmThreads(
       content: objects.content,
     })
     .from(objects)
-    .where(
-      and(
-        eq(objects.visibility, "direct"),
-        eq(objects.type, "Note"),
-        isNotNull(objects.conversation),
-      ),
-    )
+    .where(dmWhereForActor(db, actor.ap_id))
     .orderBy(desc(objects.published))
     .limit(2000);
 
@@ -182,7 +180,7 @@ export async function handleGetDmThreads(
   > = {};
 
   for (const dm of dms) {
-    const partner = resolveDmPartner(dm, actor.ap_id);
+    const partner = getOtherParticipant(dm, actor.ap_id);
     if (partner && !threads[partner]) {
       threads[partner] = {
         partner,
@@ -206,6 +204,9 @@ export async function handleGetDmMessages(
   const threadId = requireString(input, "thread_id");
   const limit = toolLimit(input.limit, 50, 100);
   if (!threadId) return c.json(errRequired("Thread ID"), 400);
+  if (await isActorBlockedStrict(db, threadId)) {
+    return c.json(errNotFound("Thread"), 404);
+  }
 
   const baseUrl = c.env.APP_URL;
   // Read from the STORED conversation id (incl. a legacy-scheme thread) so the
@@ -225,19 +226,18 @@ export async function handleGetDmMessages(
         eq(objects.visibility, "direct"),
         eq(objects.type, "Note"),
         eq(objects.conversation, conversationId),
+        or(
+          eq(objects.attributedTo, actor.ap_id),
+          inArray(objects.apId, recipientObjectIds(db, actor.ap_id)),
+        ),
       ),
     )
     .orderBy(desc(objects.published))
     .limit(limit);
 
-  const filtered = messages.filter((m) => {
-    if (m.attributedTo === actor.ap_id) return true;
-    return safeJsonParse<string[]>(m.toJson, []).includes(actor.ap_id);
-  });
-
   return c.json(
     ok({
-      messages: filtered.map((m) => ({
+      messages: messages.map((m) => ({
         ap_id: m.apId,
         content: m.content,
         from: m.attributedTo,