@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/activitypub/handlers/actor-inbox-handlers.ts

@@ -2,7 +2,6 @@ import { and, eq, isNull, or, sql } from "drizzle-orm";
 import {
   activities,
   communities,
-  communityMembers,
   follows,
   objectRecipients,
   objects,
@@ -10,19 +9,26 @@ import {
 import {
   activityApId,
   generateId,
-  getDomain,
   isLocal,
-  objectApId,
 } from "../../../federation-helpers.ts";
 import { enqueueDeliveryToActor } from "../../../lib/delivery/queue.ts";
-import { communityRequiresMembership } from "../../../lib/community-visibility.ts";
+import { isSameActivityPubActor } from "../../../lib/activitypub-actor-identity.ts";
+import { severFollowDirection } from "../../../lib/follow-edge-mutations.ts";
 import { isMemberBanned } from "../../communities/membership-shared.ts";
 import {
-  boundAttachmentsJson,
   boundInboundContent,
+  boundInboundNoteAttachmentsJson,
   boundInboundSummary,
+  boundInboundTagsJson,
 } from "../../posts/transformers.ts";
 import { normalizeInboundTimestamp } from "./inbound-timestamp.ts";
+import { canActorPostToInboundCommunity } from "./inbound-community-scope.ts";
+import { validateInboundObjectIdentity } from "./inbound-object-identity.ts";
+import {
+  findFollowByActivityId,
+  findFollowByFollowerIdentity,
+  runBatch,
+} from "./inbox-shared-helpers.ts";
 import type { InstanceActorResult } from "../query-helpers.ts";
 import {
   type Activity,
@@ -67,12 +73,11 @@ export async function handleGroupFollow(
     followingApId: group.apId,
   };
 
-  const existing = await db.query.follows.findFirst({
-    where: and(
-      eq(follows.followerApId, followerKey.followerApId),
-      eq(follows.followingApId, followerKey.followingApId),
-    ),
-  });
+  const existing = await findFollowByFollowerIdentity(
+    db,
+    followerKey.followerApId,
+    followerKey.followingApId,
+  );
 
   // A banned actor re-Following an OPEN community must NOT auto-rejoin: force a
   // Reject and record no edge (durable kick — mirrors the local open-join ban
@@ -173,30 +178,24 @@ export async function handleGroupUndo(
   const objectId = getActivityObjectId(activity);
   if (!objectId) return;
 
-  // Try exact match by activity AP ID first.
-  const follow = await db.query.follows.findFirst({
-    where: and(
-      eq(follows.activityApId, objectId),
-      eq(follows.followingApId, group.apId),
-    ),
+  // Resolve either the retained local ledger IRI or the peer's wire id within
+  // the verified signer. This also makes a bare-string Undo(Follow) work for a
+  // Group instead of requiring an embedded typed Follow object.
+  const follow = await findFollowByActivityId(db, objectId, {
+    actorApId: actorApIdStr,
+    localBaseUrl: c.env.APP_URL,
   });
 
   if (follow) {
+    if (follow.followingApId !== group.apId) return;
     // Bind to the VERIFIED signer: only the follow's own follower may undo it.
     // The activity id is public (it appears in the follower's outbox), so
     // without this check a remote attacker who signs an Undo as any actor on
     // their own domain could resolve a VICTIM's follow by that id and sever the
     // victim's follow/membership edge — the same cross-actor forgery already
     // guarded in the user-inbox undoFollow handler.
-    if (follow.followerApId !== actorApIdStr) return;
-    await db
-      .delete(follows)
-      .where(
-        and(
-          eq(follows.followerApId, follow.followerApId),
-          eq(follows.followingApId, follow.followingApId),
-        ),
-      );
+    if (!isSameActivityPubActor(follow.followerApId, actorApIdStr)) return;
+    await severFollowDirection(db, follow.followerApId, follow.followingApId);
     return;
   }
 
@@ -204,14 +203,17 @@ export async function handleGroupUndo(
   // the verified signer, so it can only remove the signer's OWN follow.
   if (getActivityObject(activity)?.type !== "Follow") return;
 
-  await db
-    .delete(follows)
-    .where(
-      and(
-        eq(follows.followerApId, actorApIdStr),
-        eq(follows.followingApId, group.apId),
-      ),
-    );
+  const retainedFollow = await findFollowByFollowerIdentity(
+    db,
+    actorApIdStr,
+    group.apId,
+  );
+  if (!retainedFollow) return;
+  await severFollowDirection(
+    db,
+    retainedFollow.followerApId,
+    retainedFollow.followingApId,
+  );
 }
 
 export async function handleGroupCreate(
@@ -225,18 +227,12 @@ export async function handleGroupCreate(
   const object = getActivityObject(activity);
   if (!object || !typeIncludes(object.type, "Note")) return;
 
-  if (object.id) {
-    try {
-      if (
-        isLocal(object.id, baseUrl) ||
-        getDomain(object.id) !== getDomain(actorApIdStr)
-      ) {
-        return;
-      }
-    } catch {
-      return;
-    }
-  }
+  const identity = validateInboundObjectIdentity(
+    object.id,
+    actorApIdStr,
+    baseUrl,
+  );
+  if (!identity.ok) return;
 
   const roomUrl = object.room || activity.room;
   if (!roomUrl || typeof roomUrl !== "string") return;
@@ -273,40 +269,13 @@ export async function handleGroupCreate(
     .get();
   if (!community) return;
 
-  const memberFollow = await db.query.follows.findFirst({
-    where: and(
-      eq(follows.followerApId, actorApIdStr),
-      eq(follows.followingApId, community.apId),
-      eq(follows.status, "accepted"),
-    ),
-  });
-  const memberRow = await db.query.communityMembers.findFirst({
-    where: and(
-      eq(communityMembers.communityApId, community.apId),
-      eq(communityMembers.actorApId, actorApIdStr),
-    ),
-    columns: { role: true },
-  });
-  const isMember = Boolean(memberFollow) || Boolean(memberRow);
-  const role = memberRow?.role;
-  const isManager = role === "owner" || role === "moderator";
-  const policy = community.postPolicy || "members";
-
-  // A non-public community requires membership to post regardless of policy.
-  if (communityRequiresMembership(community.visibility) && !isMember) return;
-  if (policy !== "anyone" && !isMember) return;
-  if (policy === "mods" && !isManager) return;
-  if (policy === "owners" && role !== "owner") return;
+  if (!(await canActorPostToInboundCommunity(db, actorApIdStr, community))) {
+    return;
+  }
 
-  const newObjectId = object.id || objectApId(baseUrl, generateId());
-  const existingObj = await db.query.objects.findFirst({
-    where: eq(objects.apId, newObjectId),
-  });
-  if (existingObj) return;
+  const newObjectId = identity.objectId;
+  const audienceJson = JSON.stringify([community.apId]);
 
-  const attachments = object.attachment
-    ? JSON.stringify(object.attachment)
-    : "[]";
   // Clamp + normalize the remote-controlled `published` exactly like the other
   // inbound Note paths (handleCreate / insertDirectNote / handleCreateStory). The
   // community chat reader sorts + keyset-paginates on `desc(objects.published)`
@@ -325,31 +294,61 @@ export async function handleGroupCreate(
   // from the feed object-set (which carries `communityApId`). Leave
   // `communityApId` NULL here so the message surfaces in the group chat and
   // unread count rather than being misrouted into the community feed.
-  await db.insert(objects).values({
-    apId: newObjectId,
-    type: "Note",
-    attributedTo: actorApIdStr,
-    content: boundInboundContent(object.content),
-    summary: boundInboundSummary(object.summary),
-    attachmentsJson: boundAttachmentsJson(attachments),
-    visibility: "group",
-    // Record the community in audienceJson too (not just the object_recipients
-    // row): the canonical single-object read-gate (canViewerReadObject) keys on
-    // audienceJson/communityApId and does NOT consult object_recipients, so
-    // without this a federated chat message in a PRIVATE community was served to
-    // ANY (even anonymous) caller via GET /api/posts/:id. The local chat POST sets
-    // this for the same reason. Safe for the chat reader (joins on
-    // object_recipients + communityApId IS NULL, not audienceJson) and the feed
-    // (audienceJson != "[]" already excludes it).
-    audienceJson: JSON.stringify([community.apId]),
-    communityApId: null,
-    published: now,
-    isLocal: 0,
-  });
-
-  // Using raw SQL with INSERT OR IGNORE since ObjectRecipient FK expects Actor, not Community
-  await db.run(sql`
-    INSERT OR IGNORE INTO object_recipients (object_ap_id, recipient_ap_id, type, created_at)
-    VALUES (${newObjectId}, ${community.apId}, 'audience', ${now})
-  `);
+  // The object and its audience membership are one logical message. Commit
+  // them atomically so an isolate failure cannot leave an invisible object;
+  // both statements are idempotent so a retry also repairs partial rows left by
+  // older deployments. Migration 0010 deliberately removed the incorrect
+  // object_recipients -> actors FK, so a community ap_id is valid here.
+  await runBatch(db, [
+    db
+      .insert(objects)
+      .values({
+        apId: newObjectId,
+        type: "Note",
+        attributedTo: actorApIdStr,
+        content: boundInboundContent(object.content),
+        summary: boundInboundSummary(object.summary),
+        attachmentsJson: boundInboundNoteAttachmentsJson(object.attachment),
+        tagsJson: boundInboundTagsJson(object.tag),
+        visibility: "group",
+        // Record the community in audienceJson too (not just the
+        // object_recipients row): the canonical single-object read-gate
+        // (canViewerReadObject) keys on audienceJson/communityApId and does NOT
+        // consult object_recipients, so without this a federated chat message in
+        // a PRIVATE community was served to ANY caller via GET /api/posts/:id.
+        audienceJson,
+        communityApId: null,
+        published: now,
+        isLocal: 0,
+      })
+      .onConflictDoNothing(),
+    db
+      .insert(objectRecipients)
+      // Select from the object that ACTUALLY exists after the preceding insert,
+      // rather than trusting the attempted values. This closes the concurrent
+      // id-reuse race: if another community won the object-id insert, its
+      // different audience shape cannot be linked into this room.
+      .select(
+        db
+          .select({
+            objectApId: objects.apId,
+            recipientApId: sql<string>`${community.apId}`.as("recipient_ap_id"),
+            type: sql<string>`'audience'`.as("type"),
+            createdAt: sql<string>`${now}`.as("created_at"),
+          })
+          .from(objects)
+          .where(
+            and(
+              eq(objects.apId, newObjectId),
+              eq(objects.type, "Note"),
+              eq(objects.attributedTo, actorApIdStr),
+              eq(objects.visibility, "group"),
+              eq(objects.audienceJson, audienceJson),
+              isNull(objects.communityApId),
+              eq(objects.isLocal, 0),
+            ),
+          ),
+      )
+      .onConflictDoNothing(),
+  ]);
 }

package/src/backend/routes/activitypub/handlers/inbound-community-scope.ts

@@ -0,0 +1,121 @@
+import { and, eq, inArray, isNull } from "drizzle-orm";
+
+import type { Database } from "../../../../db/index.ts";
+import { communities, communityMembers } from "../../../../db/index.ts";
+import { communityRequiresMembership } from "../../../lib/community-visibility.ts";
+import { isMemberBanned } from "../../communities/membership-shared.ts";
+import { findFollowByFollowerIdentity } from "./inbox-shared-helpers.ts";
+
+export type InboundCommunityTarget = {
+  apId: string;
+  visibility: string | null;
+  postPolicy: string | null;
+};
+
+export type InboundCommunityScope =
+  | { allowed: true; communityApId: string | null }
+  | { allowed: false; communityApId: null };
+
+/**
+ * Apply the same posting authority to every inbound community projection.
+ *
+ * Remote membership is an accepted Follow of the community Group; local
+ * membership carries a role in community_members. A durable ban wins before
+ * either representation. Keeping this decision in one helper prevents the
+ * Group inbox and user-inbox Note/Story paths from drifting into different
+ * definitions of who may inject content into a community feed.
+ */
+export async function canActorPostToInboundCommunity(
+  db: Database,
+  actorApId: string,
+  community: InboundCommunityTarget,
+): Promise<boolean> {
+  const [banned, memberFollow, memberRow] = await Promise.all([
+    isMemberBanned(db, community.apId, actorApId),
+    findFollowByFollowerIdentity(db, actorApId, community.apId),
+    db.query.communityMembers.findFirst({
+      where: and(
+        eq(communityMembers.communityApId, community.apId),
+        eq(communityMembers.actorApId, actorApId),
+      ),
+      columns: { role: true },
+    }),
+  ]);
+  if (banned) return false;
+
+  const isMember = memberFollow?.status === "accepted" || Boolean(memberRow);
+  const role = memberRow?.role;
+  const isManager = role === "owner" || role === "moderator";
+  const policy = community.postPolicy || "members";
+
+  if (communityRequiresMembership(community.visibility) && !isMember) {
+    return false;
+  }
+  if (policy !== "anyone" && !isMember) return false;
+  if (policy === "mods" && !isManager) return false;
+  if (policy === "owners" && role !== "owner") return false;
+  return true;
+}
+
+/**
+ * Resolve a bounded AS2 audience against local live communities and authorize
+ * the signer for the one matching scope.
+ *
+ * Unknown/external audiences are preserved by the caller but do not acquire a
+ * local community_ap_id. More than one local match is ambiguous and rejected.
+ * The ap_id and followers_url lookups are intentionally separate: with the
+ * 64-address ingress cap, combining both IN lists would compile to 128 bound
+ * parameters and fail on production D1's 100-variable ceiling.
+ */
+export async function resolveInboundCommunityScope(
+  db: Database,
+  actorApId: string,
+  audience: readonly string[],
+): Promise<InboundCommunityScope> {
+  const addresses = [...new Set(audience)].filter(Boolean).slice(0, 64);
+  if (addresses.length === 0) {
+    return { allowed: true, communityApId: null };
+  }
+
+  const columns = {
+    apId: communities.apId,
+    visibility: communities.visibility,
+    postPolicy: communities.postPolicy,
+  };
+  const [byApId, byFollowersUrl] = await Promise.all([
+    db
+      .select(columns)
+      .from(communities)
+      .where(
+        and(
+          inArray(communities.apId, addresses),
+          isNull(communities.deletedAt),
+        ),
+      ),
+    db
+      .select(columns)
+      .from(communities)
+      .where(
+        and(
+          inArray(communities.followersUrl, addresses),
+          isNull(communities.deletedAt),
+        ),
+      ),
+  ]);
+  const matches = new Map<string, InboundCommunityTarget>();
+  for (const community of [...byApId, ...byFollowersUrl]) {
+    matches.set(community.apId, community);
+  }
+  if (matches.size === 0) {
+    return { allowed: true, communityApId: null };
+  }
+  if (matches.size !== 1) {
+    return { allowed: false, communityApId: null };
+  }
+
+  const community = [...matches.values()][0]!;
+  if (!(await canActorPostToInboundCommunity(db, actorApId, community))) {
+    return { allowed: false, communityApId: null };
+  }
+  return { allowed: true, communityApId: community.apId };
+}

package/src/backend/routes/activitypub/handlers/inbound-object-identity.ts

@@ -0,0 +1,54 @@
+import { isLocal, isSafeRemoteUrl } from "../../../federation-helpers.ts";
+
+export const MAX_INBOUND_OBJECT_ID_LENGTH = 2048;
+
+export type InboundObjectIdentityResult =
+  | { ok: true; objectId: string }
+  | {
+      ok: false;
+      reason:
+        | "missing"
+        | "too_long"
+        | "unsafe"
+        | "local_origin"
+        | "actor_origin_mismatch";
+    };
+
+/**
+ * Bind an inbound object's durable identity to the verified remote actor.
+ *
+ * Server-to-server Create needs a stable remote object IRI: minting a local IRI
+ * for an anonymous remote object would make this instance appear to own bytes
+ * controlled by another server and would generate a different row on retry.
+ * Exact URL origin (scheme + host + port), credential-free HTTP(S), the local
+ * origin exclusion, and a storage-safe length are all one ownership decision.
+ */
+export function validateInboundObjectIdentity(
+  objectId: unknown,
+  actorApId: string,
+  baseUrl: string,
+): InboundObjectIdentityResult {
+  if (objectId === undefined || objectId === null || objectId === "") {
+    return { ok: false, reason: "missing" };
+  }
+  if (typeof objectId !== "string") {
+    return { ok: false, reason: "unsafe" };
+  }
+  if (objectId.length > MAX_INBOUND_OBJECT_ID_LENGTH) {
+    return { ok: false, reason: "too_long" };
+  }
+  if (!isSafeRemoteUrl(objectId)) {
+    return { ok: false, reason: "unsafe" };
+  }
+  if (isLocal(objectId, baseUrl)) {
+    return { ok: false, reason: "local_origin" };
+  }
+  try {
+    if (new URL(objectId).origin !== new URL(actorApId).origin) {
+      return { ok: false, reason: "actor_origin_mismatch" };
+    }
+  } catch {
+    return { ok: false, reason: "unsafe" };
+  }
+  return { ok: true, objectId };
+}

package/src/backend/routes/activitypub/handlers/inbound-reply-target.ts

@@ -0,0 +1,34 @@
+import { isSafeRemoteUrl } from "../../../federation-helpers.ts";
+
+export const MAX_INBOUND_REPLY_TARGET_LENGTH = 2048;
+
+export type InboundReplyTargetResult =
+  | { ok: true; parentId: string | null | undefined }
+  | {
+      ok: false;
+      reason: "malformed" | "too_long" | "unsafe";
+    };
+
+/**
+ * Normalize one inbound Note reply edge before it reaches storage or SQL.
+ *
+ * Absence preserves partial-Update compatibility and explicit null clears an
+ * existing edge. A concrete parent must be one bounded, credential-free
+ * HTTP(S) IRI. Unlike remote object identity, the parent may be local or on a
+ * different remote origin: cross-origin replies are the normal federation
+ * case. Unknown parents remain valid links and are never fetched here.
+ */
+export function validateInboundReplyTarget(
+  value: unknown,
+): InboundReplyTargetResult {
+  if (value === undefined) return { ok: true, parentId: undefined };
+  if (value === null) return { ok: true, parentId: null };
+  if (typeof value !== "string" || value.length === 0) {
+    return { ok: false, reason: "malformed" };
+  }
+  if (value.length > MAX_INBOUND_REPLY_TARGET_LENGTH) {
+    return { ok: false, reason: "too_long" };
+  }
+  if (!isSafeRemoteUrl(value)) return { ok: false, reason: "unsafe" };
+  return { ok: true, parentId: value };
+}