@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/lib/follow-edge-mutations.ts

@@ -0,0 +1,217 @@
+import { and, eq, gt, not, or, sql } from "drizzle-orm";
+import type { SQL } from "drizzle-orm";
+import type { BatchItem } from "drizzle-orm/batch";
+import { actors, blocks, follows } from "../../db/index.ts";
+import type { Database } from "../../db/index.ts";
+import { activityPubActorIdentityMatchesSql } from "./activitypub-actor-identity-sql.ts";
+import { resolveRetainedPersonalBlockTarget } from "./personal-actor-moderation.ts";
+
+type BatchStatement = BatchItem<"sqlite">;
+interface BatchableDb {
+  batch(
+    statements: readonly [BatchStatement, ...BatchStatement[]],
+  ): Promise<unknown>;
+}
+
+function followDirectionIdentityWhere(
+  followerApId: string,
+  followingApId: string,
+): SQL {
+  // Every personal follow edge has at least one exact local endpoint. Narrow on
+  // that indexed endpoint, then compare the retained remote endpoint through
+  // the complete verified-actor identity set.
+  const followingMatches = activityPubActorIdentityMatchesSql(
+    sql`
+      SELECT ${follows.followingApId}
+      FROM ${follows}
+      WHERE ${follows.followerApId} = ${followerApId}
+    `,
+    followingApId,
+  );
+  const followerMatches = activityPubActorIdentityMatchesSql(
+    sql`
+      SELECT ${follows.followerApId}
+      FROM ${follows}
+      WHERE ${follows.followingApId} = ${followingApId}
+    `,
+    followerApId,
+  );
+  return or(
+    and(
+      eq(follows.followerApId, followerApId),
+      sql`${follows.followingApId} IN (${followingMatches})`,
+    ),
+    and(
+      eq(follows.followingApId, followingApId),
+      sql`${follows.followerApId} IN (${followerMatches})`,
+    ),
+  ) as SQL;
+}
+
+function actorIdentityWhere(actorApId: string): SQL {
+  const retainedActors = activityPubActorIdentityMatchesSql(
+    sql`SELECT ${actors.apId} FROM ${actors}`,
+    actorApId,
+  );
+  return sql`${actors.apId} IN (${retainedActors})`;
+}
+
+function severFollowDirectionStatements(
+  db: Database,
+  followerApId: string,
+  followingApId: string,
+): [BatchStatement, BatchStatement, BatchStatement] {
+  const edgeWhere = followDirectionIdentityWhere(followerApId, followingApId);
+  const acceptedEdgeCount = sql<number>`(
+    SELECT COUNT(*)
+    FROM ${follows}
+    WHERE ${edgeWhere} AND ${follows.status} = 'accepted'
+  )`;
+  return [
+    db
+      .update(actors)
+      .set({
+        followingCount: sql`MAX(0, ${actors.followingCount} - ${acceptedEdgeCount})`,
+      })
+      .where(
+        and(actorIdentityWhere(followerApId), gt(actors.followingCount, 0)),
+      ),
+    db
+      .update(actors)
+      .set({
+        followerCount: sql`MAX(0, ${actors.followerCount} - ${acceptedEdgeCount})`,
+      })
+      .where(
+        and(actorIdentityWhere(followingApId), gt(actors.followerCount, 0)),
+      ),
+    db.delete(follows).where(edgeWhere),
+  ];
+}
+
+/**
+ * Remove every retained spelling of one logical follow direction and reconcile
+ * both endpoint counters in the same atomic batch.
+ *
+ * At least one endpoint must be the exact local actor/group IRI. The other may
+ * be any verified cosmetic spelling of the same remote actor. This keeps the
+ * query bounded to an indexed local endpoint while preventing a Reject,
+ * Remove, or Undo from leaving a second equivalent row with delivery or
+ * membership authority.
+ */
+export async function severFollowDirection(
+  db: Database,
+  followerApId: string,
+  followingApId: string,
+): Promise<void> {
+  await runBatch(
+    db,
+    severFollowDirectionStatements(db, followerApId, followingApId),
+  );
+}
+
+/**
+ * Converge one logical follow direction to exactly one accepted retained row.
+ *
+ * Cosmetic remote-actor spellings can coexist in legacy data because the raw
+ * pair is the physical primary key. Accept/Add must not accept one row while a
+ * second remains pending, nor count two already-accepted spellings as two
+ * people. Reconcile each endpoint by the accepted-row delta, delete equivalent
+ * duplicates, and transition the retained row in one batch.
+ */
+export async function acceptRetainedFollowDirection(
+  db: Database,
+  retainedFollowerApId: string,
+  retainedFollowingApId: string,
+  acceptedAt: string,
+): Promise<void> {
+  const edgeWhere = followDirectionIdentityWhere(
+    retainedFollowerApId,
+    retainedFollowingApId,
+  );
+  const eligibleContribution = sql<number>`(
+    CASE WHEN EXISTS (
+      SELECT 1
+      FROM ${follows}
+      WHERE ${edgeWhere}
+        AND ${follows.status} IN ('pending', 'accepted')
+    ) THEN 1 ELSE 0 END
+  )`;
+  const acceptedEdgeCount = sql<number>`(
+    SELECT COUNT(*)
+    FROM ${follows}
+    WHERE ${edgeWhere} AND ${follows.status} = 'accepted'
+  )`;
+  const retainedEdge = and(
+    eq(follows.followerApId, retainedFollowerApId),
+    eq(follows.followingApId, retainedFollowingApId),
+  ) as SQL;
+
+  await runBatch(db, [
+    db
+      .update(actors)
+      .set({
+        followingCount: sql`MAX(0, ${actors.followingCount} + ${eligibleContribution} - ${acceptedEdgeCount})`,
+      })
+      .where(actorIdentityWhere(retainedFollowerApId)),
+    db
+      .update(actors)
+      .set({
+        followerCount: sql`MAX(0, ${actors.followerCount} + ${eligibleContribution} - ${acceptedEdgeCount})`,
+      })
+      .where(actorIdentityWhere(retainedFollowingApId)),
+    db.delete(follows).where(and(edgeWhere, not(retainedEdge))),
+    db
+      .update(follows)
+      .set({ status: "accepted", acceptedAt })
+      .where(and(retainedEdge, eq(follows.status, "pending"))),
+  ]);
+}
+
+async function runBatch(
+  db: Database,
+  statements: readonly [BatchStatement, ...BatchStatement[]],
+): Promise<void> {
+  await (db as unknown as BatchableDb).batch(statements);
+}
+
+/**
+ * Atomically sever both follow directions and reconcile their denormalized
+ * counters. Pending/absent edges are clean no-ops and retries cannot underflow.
+ */
+export async function severFollowPair(
+  db: Database,
+  leftApId: string,
+  rightApId: string,
+): Promise<void> {
+  await runBatch(db, [
+    ...severFollowDirectionStatements(db, leftApId, rightApId),
+    ...severFollowDirectionStatements(db, rightApId, leftApId),
+  ]);
+}
+
+/**
+ * Persist a local personal block and sever both follow directions as one D1
+ * commit. A storage failure must not leave either authority state half-applied.
+ */
+export async function blockActorAndSeverFollowPair(
+  db: Database,
+  blockerApId: string,
+  blockedApId: string,
+): Promise<void> {
+  const retainedBlockTarget = await resolveRetainedPersonalBlockTarget(
+    db,
+    blockerApId,
+    blockedApId,
+  );
+  await runBatch(db, [
+    db
+      .insert(blocks)
+      .values({
+        blockerApId,
+        blockedApId: retainedBlockTarget ?? blockedApId,
+      })
+      .onConflictDoNothing(),
+    ...severFollowDirectionStatements(db, blockedApId, blockerApId),
+    ...severFollowDirectionStatements(db, blockerApId, blockedApId),
+  ]);
+}

package/src/backend/lib/notification-eligibility.ts

@@ -20,6 +20,7 @@ import {
   ne,
   notExists,
   or,
+  sql,
   type SQL,
 } from "drizzle-orm";
 
@@ -32,6 +33,7 @@ import {
   type Database,
 } from "../../db/index.ts";
 import { excludeBlockedMutedAuthors } from "./feed-exclude.ts";
+import { operatorActorNotBlockedSql } from "./blocklist.ts";
 
 /**
  * The activity types that surface as notifications. Any addition must hold for
@@ -135,15 +137,19 @@ export function notificationEligibilityWhere(
     directCondition,
   ];
 
-  // Suppress notifications whose actor the recipient has blocked or muted.
-  // This is the read-time choke point: mutes are read-only everywhere, and not
-  // every notify WRITE path block-checks, so gating here covers like/repost/
-  // follow/reply/mention (local AND federated) for both blocks and mutes.
-  const blockMute = excludeBlockedMutedAuthors(
-    db,
-    actorApId,
-    activities.actorApId,
-  );
+  // Suppress notifications whose actor the recipient has blocked or muted,
+  // and identities defederated by the instance operator. This is deliberately
+  // a read-time gate shared by list, unread badge, realtime snapshot, and push:
+  // retained inbox/activity rows must become inert immediately even when an
+  // earlier content purge was partial and will converge on retry.
+  conditions.push(operatorActorNotBlockedSql(sql`${activities.actorApId}`));
+
+  // Personal block/mute suppression remains per recipient.
+  // This remains the read-time choke point for every notification path even
+  // when a specific inbound write path also suppresses muted interactions, so
+  // like/repost/follow/reply/mention stay covered for both local and federated
+  // producers.
+  const blockMute = excludeBlockedMutedAuthors(actorApId, activities.actorApId);
   if (blockMute) conditions.push(blockMute);
 
   return conditions;

package/src/backend/lib/notification-push.ts

@@ -26,7 +26,7 @@ import {
   type DeliveryNotificationPushMessageV1,
   type DeliveryQueueMessageV1,
 } from "./delivery/types.ts";
-import { excludeBlockedMutedAuthors } from "./feed-exclude.ts";
+import { excludeModeratedActors } from "./feed-exclude.ts";
 import {
   NOTIFICATION_ACTIVITY_TYPES,
   notificationEligibilityWhere,
@@ -996,7 +996,7 @@ async function loadPushEvent(
           ne(activities.actorApId, actorApId),
           inArray(activities.type, [...NOTIFICATION_ACTIVITY_TYPES]),
           exists(currentCommunityMembership),
-          excludeBlockedMutedAuthors(db, actorApId, activities.actorApId),
+          excludeModeratedActors(actorApId, activities.actorApId),
         ),
       )
       .get();

package/src/backend/lib/oidc-id-token.ts

@@ -23,8 +23,74 @@ export type OidcIdTokenClaims = {
   email?: string;
   email_verified?: boolean;
   preferred_username?: string;
+  takosumi?: unknown;
 };
 
+export type VerifiedTakosumiWorkspaceGrant = {
+  workspaceId: string;
+  capsuleId: string;
+  role: "owner" | "admin" | "member" | "viewer";
+};
+
+/**
+ * Read the exact Workspace authority Takosumi Accounts placed in a verified
+ * ID token. Call this only after `verifyOidcIdToken`: this parser validates the
+ * claim shape, while the signature/issuer/audience checks establish who said
+ * it. Unknown or partial shapes grant nothing.
+ */
+export function readVerifiedTakosumiWorkspaceGrant(
+  claims: OidcIdTokenClaims,
+): VerifiedTakosumiWorkspaceGrant | undefined {
+  const value = claims.takosumi;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return undefined;
+  }
+  const record = value as Record<string, unknown>;
+  if (
+    !sameStrings(Object.keys(record).sort(), [
+      "capsule_id",
+      "role",
+      "workspace_id",
+    ]) ||
+    !boundedIdentifier(record.workspace_id) ||
+    !boundedIdentifier(record.capsule_id) ||
+    !isTakosumiWorkspaceRole(record.role)
+  ) {
+    return undefined;
+  }
+  return {
+    workspaceId: record.workspace_id,
+    capsuleId: record.capsule_id,
+    role: record.role,
+  };
+}
+
+function boundedIdentifier(value: unknown): value is string {
+  return (
+    typeof value === "string" &&
+    value.length > 0 &&
+    value.length <= 512 &&
+    value.trim() === value &&
+    !/\s/u.test(value)
+  );
+}
+
+function isTakosumiWorkspaceRole(
+  value: unknown,
+): value is VerifiedTakosumiWorkspaceGrant["role"] {
+  return (
+    typeof value === "string" &&
+    ["owner", "admin", "member", "viewer"].includes(value)
+  );
+}
+
+function sameStrings(left: readonly string[], right: readonly string[]) {
+  return (
+    left.length === right.length &&
+    left.every((value, index) => value === right[index])
+  );
+}
+
 type Jwk = JsonWebKey & { kid?: string; alg?: string; use?: string };
 
 function b64urlToBytes(segment: string): Uint8Array {

package/src/backend/lib/personal-actor-moderation.ts

@@ -0,0 +1,239 @@
+import { and, eq, sql, type SQL } from "drizzle-orm";
+
+import type { Database } from "../../db/index.ts";
+import { blocks, mutes } from "../../db/index.ts";
+import { normalizeActivityPubActorId } from "./activitypub-actor-identity.ts";
+import {
+  activityPubActorIdentityMatchesSql,
+  activityPubActorIdentitySetSql,
+} from "./activitypub-actor-identity-sql.ts";
+
+// Historical regression boundary retained for fixtures: mutation compatibility
+// used to inspect only the newest 512 rows. Production mutation queries no
+// longer use this value; they match the complete SQL identity set.
+export const LEGACY_PERSONAL_MODERATION_CANDIDATE_LIMIT = 512;
+
+export function canonicalPersonalModerationActorId(actorApId: string): string {
+  return normalizeActivityPubActorId(actorApId) ?? actorApId;
+}
+
+async function actorIdentitySetContains(
+  db: Database,
+  actorApId: string,
+  rawActorIds: SQL,
+): Promise<boolean> {
+  const identitySet = activityPubActorIdentitySetSql(rawActorIds);
+  const canonicalActorApId = canonicalPersonalModerationActorId(actorApId);
+  const match = (await db.get(sql`
+    SELECT CASE
+      WHEN ${canonicalActorApId} IN (${identitySet}) THEN 1
+      ELSE 0
+    END AS matched
+  `)) as { matched: number } | undefined;
+  return match?.matched === 1;
+}
+
+export async function resolveRetainedPersonalBlockTarget(
+  db: Database,
+  blockerApId: string,
+  blockedApId: string,
+): Promise<string | null> {
+  const exact = await db
+    .select({ actorApId: blocks.blockedApId })
+    .from(blocks)
+    .where(
+      and(
+        eq(blocks.blockerApId, blockerApId),
+        eq(blocks.blockedApId, blockedApId),
+      ),
+    )
+    .get();
+  if (exact) return exact.actorApId;
+
+  const matches = activityPubActorIdentityMatchesSql(
+    sql`
+      SELECT ${blocks.blockedApId}
+      FROM ${blocks}
+      WHERE ${blocks.blockerApId} = ${blockerApId}
+    `,
+    blockedApId,
+  );
+  // BaseSQLiteDatabase.get() normalizes a missing libsql row as an object and
+  // throws before returning. A scalar subquery always yields one row and uses
+  // NULL for the normal "no retained spelling" case on both libsql and D1.
+  const retained = (await db.get(sql`
+    SELECT (${matches}) AS actor_id
+  `)) as { actor_id: string | null } | undefined;
+  return retained?.actor_id ?? null;
+}
+
+export async function resolveRetainedPersonalMuteTarget(
+  db: Database,
+  muterApId: string,
+  mutedApId: string,
+): Promise<string | null> {
+  const exact = await db
+    .select({ actorApId: mutes.mutedApId })
+    .from(mutes)
+    .where(and(eq(mutes.muterApId, muterApId), eq(mutes.mutedApId, mutedApId)))
+    .get();
+  if (exact) return exact.actorApId;
+
+  const matches = activityPubActorIdentityMatchesSql(
+    sql`
+      SELECT ${mutes.mutedApId}
+      FROM ${mutes}
+      WHERE ${mutes.muterApId} = ${muterApId}
+    `,
+    mutedApId,
+  );
+  const retained = (await db.get(sql`
+    SELECT (${matches}) AS actor_id
+  `)) as { actor_id: string | null } | undefined;
+  return retained?.actor_id ?? null;
+}
+
+export async function personalActorIsBlockedBy(
+  db: Database,
+  blockerApId: string,
+  blockedApId: string,
+): Promise<boolean> {
+  const exact = await db
+    .select({ actorApId: blocks.blockedApId })
+    .from(blocks)
+    .where(
+      and(
+        eq(blocks.blockerApId, blockerApId),
+        eq(blocks.blockedApId, blockedApId),
+      ),
+    )
+    .get();
+  if (exact) return true;
+
+  return actorIdentitySetContains(
+    db,
+    blockedApId,
+    sql`
+      SELECT ${blocks.blockedApId}
+      FROM ${blocks}
+      WHERE ${blocks.blockerApId} = ${blockerApId}
+    `,
+  );
+}
+
+export async function personalActorIsSuppressedBy(
+  db: Database,
+  ownerApId: string,
+  actorApId: string,
+): Promise<boolean> {
+  const [exactBlock, exactMute] = await Promise.all([
+    db
+      .select({ actorApId: blocks.blockedApId })
+      .from(blocks)
+      .where(
+        and(
+          eq(blocks.blockerApId, ownerApId),
+          eq(blocks.blockedApId, actorApId),
+        ),
+      )
+      .get(),
+    db
+      .select({ actorApId: mutes.mutedApId })
+      .from(mutes)
+      .where(
+        and(eq(mutes.muterApId, ownerApId), eq(mutes.mutedApId, actorApId)),
+      )
+      .get(),
+  ]);
+  if (exactBlock || exactMute) return true;
+
+  return actorIdentitySetContains(
+    db,
+    actorApId,
+    sql`
+      SELECT ${blocks.blockedApId}
+      FROM ${blocks}
+      WHERE ${blocks.blockerApId} = ${ownerApId}
+      UNION ALL
+      SELECT ${mutes.mutedApId}
+      FROM ${mutes}
+      WHERE ${mutes.muterApId} = ${ownerApId}
+    `,
+  );
+}
+
+/** Single-user policy: any local owner's block/mute suppresses public ingress. */
+export async function anyOwnerSuppressesInboundActor(
+  db: Database,
+  actorApId: string,
+): Promise<boolean> {
+  const [exactBlock, exactMute] = await Promise.all([
+    db
+      .select({ actorApId: blocks.blockerApId })
+      .from(blocks)
+      .where(eq(blocks.blockedApId, actorApId))
+      .get(),
+    db
+      .select({ actorApId: mutes.muterApId })
+      .from(mutes)
+      .where(eq(mutes.mutedApId, actorApId))
+      .get(),
+  ]);
+  if (exactBlock || exactMute) return true;
+
+  return actorIdentitySetContains(
+    db,
+    actorApId,
+    sql`
+      SELECT ${blocks.blockedApId} FROM ${blocks}
+      UNION ALL
+      SELECT ${mutes.mutedApId} FROM ${mutes}
+    `,
+  );
+}
+
+export async function deletePersonalActorBlock(
+  db: Database,
+  blockerApId: string,
+  blockedApId: string,
+): Promise<void> {
+  const matches = activityPubActorIdentityMatchesSql(
+    sql`
+      SELECT ${blocks.blockedApId}
+      FROM ${blocks}
+      WHERE ${blocks.blockerApId} = ${blockerApId}
+    `,
+    blockedApId,
+  );
+  await db
+    .delete(blocks)
+    .where(
+      and(
+        eq(blocks.blockerApId, blockerApId),
+        sql`${blocks.blockedApId} IN (${matches})`,
+      ),
+    );
+}
+
+export async function deletePersonalActorMute(
+  db: Database,
+  muterApId: string,
+  mutedApId: string,
+): Promise<void> {
+  const matches = activityPubActorIdentityMatchesSql(
+    sql`
+      SELECT ${mutes.mutedApId}
+      FROM ${mutes}
+      WHERE ${mutes.muterApId} = ${muterApId}
+    `,
+    mutedApId,
+  );
+  await db
+    .delete(mutes)
+    .where(
+      and(
+        eq(mutes.muterApId, muterApId),
+        sql`${mutes.mutedApId} IN (${matches})`,
+      ),
+    );
+}