@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/lib/post-visibility.ts

@@ -8,11 +8,17 @@
 
 import { and, eq } from "drizzle-orm";
 import type { Database } from "../../db/index.ts";
-import { blocks, follows } from "../../db/index.ts";
+import { follows, objectRecipients } from "../../db/index.ts";
 import { canViewerReadObject } from "./community-visibility.ts";
 import { safeJsonParse } from "../federation-helpers.ts";
+import {
+  personalActorIsBlockedBy,
+  personalActorIsSuppressedBy,
+} from "./personal-actor-moderation.ts";
+import { isActorBlockedStrict } from "./blocklist.ts";
 
 export type ReadGateObject = {
+  apId?: string;
   visibility: string;
   attributedTo: string;
   toJson: string;
@@ -65,6 +71,26 @@ async function hasAcceptedFollow(
   return Boolean(row);
 }
 
+/** Resolve a private bto/bcc recipient without exposing that identity in JSON. */
+async function hasProjectedRecipient(
+  db: Database,
+  objectApId: string,
+  viewerApId: string,
+): Promise<boolean> {
+  const row = await db
+    .select({ objectApId: objectRecipients.objectApId })
+    .from(objectRecipients)
+    .where(
+      and(
+        eq(objectRecipients.objectApId, objectApId),
+        eq(objectRecipients.recipientApId, viewerApId),
+        eq(objectRecipients.type, "to"),
+      ),
+    )
+    .get();
+  return Boolean(row);
+}
+
 /**
  * Per-post visibility decision EXCLUDING the private-community membership gate.
  * This is the single source of truth for the public / unlisted / followers /
@@ -83,6 +109,7 @@ export function passesPostVisibilitySync(
   obj: ReadGateObject,
   viewerApId: string | null | undefined,
   isAcceptedFollower: (authorApId: string) => boolean,
+  isProjectedRecipient: (objectApId: string) => boolean = () => false,
   now: string = new Date().toISOString(),
 ): boolean {
   // A Story's stored visibility ("public") does NOT encode its reach: a personal
@@ -99,17 +126,21 @@ export function passesPostVisibilitySync(
   if (obj.visibility === "direct") {
     if (!viewerApId) return false;
     if (obj.attributedTo === viewerApId) return true;
-    return isExplicitRecipient(obj, viewerApId);
+    return (
+      isExplicitRecipient(obj, viewerApId) ||
+      (!!obj.apId && isProjectedRecipient(obj.apId))
+    );
   }
 
   if (obj.visibility === "followers") {
     if (!viewerApId) return false;
     if (obj.attributedTo === viewerApId) return true;
     if (isExplicitRecipient(obj, viewerApId)) return true;
+    if (obj.apId && isProjectedRecipient(obj.apId)) return true;
     return isAcceptedFollower(obj.attributedTo);
   }
 
-  return true; // public / unlisted
+  return obj.visibility === "public" || obj.visibility === "unlisted";
 }
 
 /**
@@ -130,6 +161,13 @@ export async function canViewerReadObjectFull(
 ): Promise<boolean> {
   const now = new Date().toISOString();
 
+  // Instance moderation is a read boundary, not only an ingest/delivery
+  // boundary. A failed or partial purge intentionally leaves retained objects
+  // for retry/reversible unblock; while their author is operator-blocked those
+  // rows must be inert through every single-object reader and interaction that
+  // consumes this canonical gate.
+  if (await isActorBlockedStrict(db, obj.attributedTo)) return false;
+
   // Story author + expiry shortcuts need no community/follow query.
   if (obj.type === "Story") {
     if (viewerApId && obj.attributedTo === viewerApId) return true;
@@ -150,18 +188,36 @@ export async function canViewerReadObjectFull(
   // Resolve the single accepted-follow edge only when a follower-gated branch
   // actually needs it (personal story, or a followers-only post with no explicit
   // to/cc recipient), then defer to the shared per-post predicate.
+  const needsProjection =
+    !!viewerApId &&
+    !!obj.apId &&
+    obj.attributedTo !== viewerApId &&
+    obj.type !== "Story" &&
+    (obj.visibility === "direct" || obj.visibility === "followers") &&
+    !isExplicitRecipient(obj, viewerApId);
+  const projectedRecipient = needsProjection
+    ? await hasProjectedRecipient(db, obj.apId!, viewerApId!)
+    : false;
+
   const needsFollow =
     !!viewerApId &&
     obj.attributedTo !== viewerApId &&
     ((obj.type === "Story" && !obj.communityApId) ||
       (obj.type !== "Story" &&
         obj.visibility === "followers" &&
-        !isExplicitRecipient(obj, viewerApId)));
+        !isExplicitRecipient(obj, viewerApId) &&
+        !projectedRecipient));
   const following = needsFollow
     ? await hasAcceptedFollow(db, viewerApId, obj.attributedTo)
     : false;
 
-  return passesPostVisibilitySync(obj, viewerApId, () => following, now);
+  return passesPostVisibilitySync(
+    obj,
+    viewerApId,
+    () => following,
+    () => projectedRecipient,
+    now,
+  );
 }
 
 /**
@@ -176,15 +232,22 @@ export async function actorIsBlockedBy(
   targetApId: string,
   actorApId: string,
 ): Promise<boolean> {
-  const row = await db
-    .select({ blockerApId: blocks.blockerApId })
-    .from(blocks)
-    .where(
-      and(
-        eq(blocks.blockerApId, targetApId),
-        eq(blocks.blockedApId, actorApId),
-      ),
-    )
-    .get();
-  return Boolean(row);
+  return personalActorIsBlockedBy(db, targetApId, actorApId);
+}
+
+/**
+ * True if `targetApId` has blocked OR muted `actorApId` and therefore does not
+ * want an inbound write from that actor reflected on a locally-owned object.
+ * Keep this separate from `actorIsBlockedBy`: block remains the existence-
+ * hiding authorization rule used by reads and direct local API responses,
+ * while mute is an owner-selected write-suppression rule for federated
+ * interactions and other targeted inbound writes such as Like, Announce,
+ * Follow, Reply, DM, and Mention.
+ */
+export async function actorSuppressesInteractionFrom(
+  db: Database,
+  targetApId: string,
+  actorApId: string,
+): Promise<boolean> {
+  return personalActorIsSuppressedBy(db, targetApId, actorApId);
 }

package/src/backend/lib/remote-activity-id.ts

@@ -0,0 +1,61 @@
+import { isLocal } from "./ap-ids.ts";
+import { isSafeRemoteUrl } from "./ssrf.ts";
+
+export const MAX_REMOTE_ACTIVITY_ID_LENGTH = 2_048;
+
+/** A bounded HTTP(S) Activity IRI suitable for an indexed/local lookup. */
+export function isBoundedHttpActivityId(value: string): boolean {
+  if (
+    value.length === 0 ||
+    value.length > MAX_REMOTE_ACTIVITY_ID_LENGTH ||
+    value.trim() !== value ||
+    /[\u0000-\u001f\u007f]/u.test(value)
+  ) {
+    return false;
+  }
+  try {
+    const parsed = new URL(value);
+    return (
+      (parsed.protocol === "http:" || parsed.protocol === "https:") &&
+      !parsed.username &&
+      !parsed.password
+    );
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Return whether a peer-controlled Activity id is safe to reuse in an
+ * outbound protocol reference.
+ *
+ * HTTP-signature verification binds the envelope actor, not an arbitrary id.
+ * A reusable id must therefore be a bounded, credential-free HTTP(S) URL on
+ * that actor's exact URL origin. Comparing only `host` is insufficient: it
+ * treats an HTTPS downgrade, a non-HTTP scheme, and credential-bearing URL
+ * spellings as if the actor had authority over them.
+ */
+export function isTrustedRemoteActivityId(
+  value: string,
+  actorApId: string,
+  localBaseUrl?: string,
+): boolean {
+  if (
+    !isBoundedHttpActivityId(value) ||
+    actorApId.length === 0 ||
+    actorApId.length > MAX_REMOTE_ACTIVITY_ID_LENGTH ||
+    actorApId.trim() !== actorApId ||
+    /[\u0000-\u001f\u007f]/u.test(actorApId) ||
+    !isSafeRemoteUrl(value) ||
+    !isSafeRemoteUrl(actorApId)
+  ) {
+    return false;
+  }
+  if (localBaseUrl && isLocal(value, localBaseUrl)) return false;
+
+  try {
+    return new URL(value).origin === new URL(actorApId).origin;
+  } catch {
+    return false;
+  }
+}

package/src/backend/lib/unread-counts.ts

@@ -25,6 +25,7 @@ import {
   type Database,
 } from "../../db/index.ts";
 import { notificationEligibilityWhere } from "./notification-eligibility.ts";
+import { operatorActorNotBlockedSql } from "./blocklist.ts";
 
 export interface YurumeUnreadCounts {
   readonly dm: number;
@@ -50,6 +51,7 @@ export async function yurumeUnreadCounts(
       AND o.type = 'Note'
       AND o.conversation IS NOT NULL
       AND o.attributed_to != ${actorApId}
+      AND ${operatorActorNotBlockedSql(sql.raw("o.attributed_to"))}
       AND o.published > COALESCE(r.last_read_at, '1970-01-01T00:00:00Z')
       AND o.conversation NOT IN (
         SELECT conversation_id FROM dm_archived_conversations
@@ -72,6 +74,7 @@ export async function yurumeUnreadCounts(
       ON r.community_ap_id = cm.community_ap_id
       AND r.actor_ap_id = ${actorApId}
     WHERE cm.actor_ap_id = ${actorApId}
+      AND ${operatorActorNotBlockedSql(sql.raw("o.attributed_to"))}
       AND o.published > COALESCE(
         r.last_read_at,
         cm.joined_at,

package/src/backend/retention.ts

@@ -1,14 +1,28 @@
 import type { Env } from "./types.ts";
 import { enqueuePendingNotificationPushJobs } from "./lib/notification-push.ts";
+import { enqueuePendingDeliveryFanoutJobs } from "./lib/delivery/fanout-outbox.ts";
+import { enqueuePendingDeliveryEndpointJobs } from "./lib/delivery/queue.ts";
+import { enqueuePendingDeliveryResolutionJobs } from "./lib/delivery/resolution-outbox.ts";
 import { reapDrainedTombstones } from "./routes/actors.ts";
 import { cleanupExpiredStories } from "./routes/stories/query-helpers.ts";
+import { reapRemoteActorFetchFailures } from "./lib/activitypub-actor-cache.ts";
 
 export type YurucommuRetentionStep =
-  "expired_stories" | "drained_tombstones" | "notification_push";
+  | "expired_stories"
+  | "drained_tombstones"
+  | "remote_actor_fetch_failures"
+  | "delivery_fanout"
+  | "delivery_endpoint"
+  | "delivery_resolution"
+  | "notification_push";
 
 export interface YurucommuRetentionResult {
   readonly expiredStories: number;
   readonly reapedTombstones: number;
+  readonly reapedRemoteActorFetchFailures: number;
+  readonly enqueuedDeliveryFanoutJobs: number;
+  readonly enqueuedDeliveryEndpointJobs: number;
+  readonly enqueuedDeliveryResolutionJobs: number;
   readonly enqueuedNotificationPushJobs: number;
 }
 
@@ -34,6 +48,9 @@ export class YurucommuRetentionError extends Error {
  * handling:
  * - Story expiry uses the canonical object cascade and purges its media last.
  * - Tombstones remain until every Delete delivery has drained.
+ * - Federation delivery republishes pending follower/community fanout,
+ *   due endpoint jobs, and unresolved-recipient outbox rows whose first Queue
+ *   RPC or owning worker was lost.
  * - Notification push performs bounded pusher/job retention, stale-job
  *   recovery, and enqueues due durable outbox rows when a queue is available.
  *
@@ -54,6 +71,22 @@ export async function runYurucommuRetention(
   const reapedTombstones = await retentionStep("drained_tombstones", () =>
     reapDrainedTombstones(env.DB_INSTANCE),
   );
+  const reapedRemoteActorFetchFailures = await retentionStep(
+    "remote_actor_fetch_failures",
+    () => reapRemoteActorFetchFailures(env.DB_INSTANCE),
+  );
+  const enqueuedDeliveryFanoutJobs = await retentionStep(
+    "delivery_fanout",
+    () => enqueuePendingDeliveryFanoutJobs(env),
+  );
+  const enqueuedDeliveryEndpointJobs = await retentionStep(
+    "delivery_endpoint",
+    () => enqueuePendingDeliveryEndpointJobs(env),
+  );
+  const enqueuedDeliveryResolutionJobs = await retentionStep(
+    "delivery_resolution",
+    () => enqueuePendingDeliveryResolutionJobs(env),
+  );
   const enqueuedNotificationPushJobs = await retentionStep(
     "notification_push",
     () => enqueuePendingNotificationPushJobs(env),
@@ -62,6 +95,10 @@ export async function runYurucommuRetention(
   return {
     expiredStories,
     reapedTombstones,
+    reapedRemoteActorFetchFailures,
+    enqueuedDeliveryFanoutJobs,
+    enqueuedDeliveryEndpointJobs,
+    enqueuedDeliveryResolutionJobs,
     enqueuedNotificationPushJobs,
   };
 }