@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/activitypub/handlers/inbox-follow-handlers.ts

@@ -1,5 +1,5 @@
 import type { Database } from "../../../../db/index.ts";
-import { and, eq, gt, or, sql } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 import { activities, actors, follows } from "../../../../db/index.ts";
 import {
   activityApId,
@@ -7,8 +7,14 @@ import {
   isLocal,
 } from "../../../federation-helpers.ts";
 import { enqueueDeliveryToActor } from "../../../lib/delivery/queue.ts";
-import { actorIsBlockedBy } from "../../../lib/post-visibility.ts";
+import { isSameActivityPubActor } from "../../../lib/activitypub-actor-identity.ts";
+import { actorSuppressesInteractionFrom } from "../../../lib/post-visibility.ts";
 import { logger } from "../../../lib/logger.ts";
+import { resolveInboundActivityReference } from "../inbound-activity-reference.ts";
+import {
+  acceptRetainedFollowDirection,
+  severFollowDirection,
+} from "../../../lib/follow-edge-mutations.ts";
 import {
   type Activity,
   type ActivityContext,
@@ -18,15 +24,49 @@ import {
 } from "../inbox-types.ts";
 import {
   findFollowByActivityId,
+  findFollowByFollowerIdentity,
   runBatch,
   undoInteraction,
   upsertActivityAndNotify,
 } from "./inbox-shared-helpers.ts";
 
 type ActorRow = typeof actors.$inferSelect;
+type FollowReference = {
+  followerApId: string;
+  followingApId: string;
+  status: string;
+};
 
 const log = logger.child({ component: "activitypub.inbox.follow" });
 
+function authorizesFollowUndo(
+  follow: FollowReference,
+  actor: string,
+  recipientApId: string,
+  activityId: string | null,
+): boolean {
+  if (!isSameActivityPubActor(follow.followerApId, actor)) {
+    log.warn("Undo(Follow) actor mismatch", {
+      event: "ap.undo.follow.actor_mismatch",
+      actor,
+      followOwner: follow.followerApId,
+      activityId,
+    });
+    return false;
+  }
+  if (follow.followingApId !== recipientApId) {
+    log.warn("Undo(Follow) recipient mismatch", {
+      event: "ap.undo.follow.recipient_mismatch",
+      actor,
+      recipient: recipientApId,
+      followedActor: follow.followingApId,
+      activityId,
+    });
+    return false;
+  }
+  return true;
+}
+
 // ---------------------------------------------------------------------------
 // Follow handler
 // ---------------------------------------------------------------------------
@@ -41,15 +81,15 @@ export async function handleFollow(
 ) {
   const db = c.get("db");
 
-  // A Follow from an actor the recipient has personally BLOCKED must be dropped —
-  // mirror the local follow guard (handleLocalFollow's actorIsBlockedBy 404).
-  // Without this, a blocked remote could re-follow (auto-accepting on a public
-  // recipient → followerCount++ + a follow notification + an Accept, so the
-  // blocked actor resumes receiving fan-out), or surface in the owner's
+  // A Follow from an actor the recipient has personally blocked OR muted must be
+  // dropped at write time. Without this, a suppressed remote could re-follow
+  // (auto-accepting on a public recipient → followerCount++ + a follow
+  // notification + an Accept, so the remote actor resumes receiving fan-out),
+  // or surface in the owner's
   // follow-request list. `actor` is the HTTP-signature-verified signer. The inbox
   // already ACKs, so dropping here causes no retry storm and does not leak the
-  // block to the sender.
-  if (await actorIsBlockedBy(db, recipient.apId, actor)) {
+  // recipient's moderation choice to the sender.
+  if (await actorSuppressesInteractionFrom(db, recipient.apId, actor)) {
     return;
   }
 
@@ -59,20 +99,17 @@ export async function handleFollow(
   const status = recipient.isPrivate ? "pending" : "accepted";
   const now = new Date().toISOString();
 
-  // Was the edge already present BEFORE this dispatch? This gates the one-shot
-  // owner notification / Accept reply below so a duplicate (re)delivery does not
-  // spam them — it does NOT gate the counter, which is reconciled atomically in
-  // the batch below against the edge table's pre-insert state.
-  const existingEdge = await db
-    .select({ followerApId: follows.followerApId })
-    .from(follows)
-    .where(
-      and(
-        eq(follows.followerApId, actor),
-        eq(follows.followingApId, recipient.apId),
-      ),
-    )
-    .get();
+  // Was the edge already present BEFORE this dispatch? Exact keys are the
+  // steady-state path; the helper also recognizes a pre-invariant cosmetic
+  // spelling so a retry cannot create a second logical edge. The original
+  // insert + counter transition committed atomically, so a retained edge means
+  // there is nothing left to reconcile or notify.
+  const existingEdge = await findFollowByFollowerIdentity(
+    db,
+    actor,
+    recipient.apId,
+  );
+  if (existingEdge) return;
 
   // #COUNTER-SYM (crash-retry convergence): the followers-edge insert and the
   // recipient.followerCount +1 MUST commit together. Previously the edge was
@@ -122,11 +159,6 @@ export async function handleFollow(
       .onConflictDoNothing();
   }
 
-  // If the edge already existed, this is a duplicate (re)delivery: the counter is
-  // already correct (the batch's no-op insert kept the NOT-EXISTS guard false),
-  // so do not re-notify the owner or re-send an Accept.
-  if (existingEdge) return;
-
   // Store activity and add to inbox (AP Native notification)
   await upsertActivityAndNotify(
     db,
@@ -181,58 +213,30 @@ export async function handleAccept(
   if (!followId) return;
 
   const follow = await findFollowByActivityId(db, followId);
-  if (!follow || follow.status === "accepted") return;
+  if (
+    !follow ||
+    (follow.status !== "pending" && follow.status !== "accepted")
+  ) {
+    return;
+  }
 
   // Only the followed party may Accept the follow. The signing actor is bound to
   // its domain upstream, so without this a different-domain actor that learned
   // the follow activity id could flip someone else's pending follow to accepted.
-  if (!actor || follow.followingApId !== actor) return;
+  if (!isSameActivityPubActor(follow.followingApId, actor)) return;
 
   const now = new Date().toISOString();
 
-  try {
-    // #COUNTER-SYM (crash-retry convergence): the pending->accepted flip and
-    // both +1s MUST commit together. Previously the flip committed first and the
-    // increments were SEPARATE statements; a crash between them left the edge
-    // 'accepted' while the counts were un-bumped, and the peer's retry saw an
-    // already-accepted edge (the early-return above) so the increments were
-    // SKIPPED → a permanent UNDER-count. Co-commit the flip and the increments
-    // in one atomic batch so the whole transition is all-or-nothing.
-    //
-    // The two increments run BEFORE the flip and are each guarded by a
-    // correlated `EXISTS(... status='pending')` subquery, so they fire only when
-    // THIS batch is the one performing the transition (the still-pending edge is
-    // observed in pre-flip state). A concurrent duplicate Accept, or a retry
-    // after the flip already committed, sees a non-pending edge → both guards
-    // are false and the flip's `status='pending'` predicate is a no-op, so the
-    // counts can neither double-bump nor (on retry) under-count.
-    const pendingEdgeExists = sql`EXISTS (SELECT 1 FROM ${follows} WHERE ${follows.followerApId} = ${follow.followerApId} AND ${follows.followingApId} = ${follow.followingApId} AND ${follows.status} = 'pending')`;
-    await runBatch(db, [
-      db
-        .update(actors)
-        .set({ followingCount: sql`${actors.followingCount} + 1` })
-        .where(and(eq(actors.apId, follow.followerApId), pendingEdgeExists)),
-      db
-        .update(actors)
-        .set({ followerCount: sql`${actors.followerCount} + 1` })
-        .where(and(eq(actors.apId, follow.followingApId), pendingEdgeExists)),
-      db
-        .update(follows)
-        .set({ status: "accepted", acceptedAt: now })
-        .where(
-          and(
-            eq(follows.followerApId, follow.followerApId),
-            eq(follows.followingApId, follow.followingApId),
-            eq(follows.status, "pending"),
-          ),
-        ),
-    ]);
-  } catch (e) {
-    log.error("Error in handleAccept", {
-      event: "ap.accept.handler_error",
-      error: e,
-    });
-  }
+  // Converge legacy cosmetic duplicates to one logical accepted relation. The
+  // shared mutation derives the counter delta from the accepted rows that
+  // actually exist, so pending->accepted adds one, a retry adds zero, and two
+  // accepted spellings repair back to one in the same atomic batch.
+  await acceptRetainedFollowDirection(
+    db,
+    follow.followerApId,
+    follow.followingApId,
+    now,
+  );
 }
 
 // ---------------------------------------------------------------------------
@@ -252,39 +256,15 @@ export async function handleReject(
   if (!follow) return;
 
   // Only the followed party may Reject the follow (see handleAccept).
-  if (!actor || follow.followingApId !== actor) return;
+  if (!isSameActivityPubActor(follow.followingApId, actor)) return;
 
   // A remote followee can Reject an ALREADY-ACCEPTED follow to terminate it
-  // (Mastodon does this on lock + remove-follower). handleAccept incremented the
-  // local follower's followingCount when the edge became accepted, so a Reject of
-  // an accepted edge MUST decrement it — otherwise the follower's following_count
-  // stays permanently +1 over its true value (the edge IS correctly deleted, only
-  // the denormalized count drifts). Co-commit the accepted-gated decrement with
-  // the delete, mirroring undoFollowEdge: a pending (never-counted) reject and a
-  // duplicate are no-ops via the EXISTS(... status='accepted') + gt(>0) guards.
-  // (followingApId — the rejecting followee — is the remote signer with no local
-  // actors row, so only the local follower's followingCount is reconciled.)
-  const acceptedEdgeExists = sql`EXISTS (SELECT 1 FROM ${follows} WHERE ${follows.followerApId} = ${follow.followerApId} AND ${follows.followingApId} = ${follow.followingApId} AND ${follows.status} = 'accepted')`;
-  await runBatch(db, [
-    db
-      .update(actors)
-      .set({ followingCount: sql`${actors.followingCount} - 1` })
-      .where(
-        and(
-          eq(actors.apId, follow.followerApId),
-          gt(actors.followingCount, 0),
-          acceptedEdgeExists,
-        ),
-      ),
-    db
-      .delete(follows)
-      .where(
-        and(
-          eq(follows.followerApId, follow.followerApId),
-          eq(follows.followingApId, follow.followingApId),
-        ),
-      ),
-  ]);
+  // (Mastodon does this on lock + remove-follower). Remove every cosmetically
+  // equivalent retained edge: deleting only the first activity-id match left a
+  // second row authorized to receive posts. The shared mutation subtracts the
+  // number of accepted rows and deletes them atomically; pending and duplicate
+  // Reject deliveries remain counter-safe no-ops.
+  await severFollowDirection(db, follow.followerApId, follow.followingApId);
 }
 
 // ---------------------------------------------------------------------------
@@ -306,7 +286,7 @@ export async function handleUndo(
   activity: Activity,
   recipient: ActorRow | null,
   actor: string,
-  _baseUrl: string,
+  baseUrl: string,
 ) {
   const db = c.get("db");
   const activityObject = getActivityObject(activity);
@@ -320,6 +300,7 @@ export async function handleUndo(
       objectId,
       actor,
       recipient,
+      baseUrl,
     );
     if (resolved) return;
   }
@@ -333,7 +314,7 @@ export async function handleUndo(
       });
       return;
     }
-    await undoFollow(db, objectId, actor, recipient);
+    await undoFollow(db, objectId, actor, recipient, baseUrl);
   } else if (typeIncludes(objectType, "Like")) {
     await undoLike(db, objectId, activityObject, actor);
   } else if (typeIncludes(objectType, "Announce")) {
@@ -355,7 +336,16 @@ async function resolveUndoByActivityId(
   objectId: string,
   actor: string,
   recipient: ActorRow | null,
+  baseUrl: string,
 ): Promise<boolean> {
+  const resolvedActivityId = await resolveInboundActivityReference(
+    db,
+    objectId,
+    actor,
+    baseUrl,
+  );
+  if (!resolvedActivityId) return false;
+
   const originalActivity = await db
     .select({
       apId: activities.apId,
@@ -364,19 +354,14 @@ async function resolveUndoByActivityId(
       actorApId: activities.actorApId,
     })
     .from(activities)
-    .where(
-      or(
-        eq(activities.apId, objectId),
-        and(
-          eq(activities.direction, "inbound"),
-          sql`json_extract(${activities.rawJson}, '$.id') = ${objectId}`,
-        ),
-      ),
-    )
+    .where(eq(activities.apId, resolvedActivityId))
     .get();
   if (!originalActivity) return false;
 
-  if (originalActivity.actorApId && originalActivity.actorApId !== actor) {
+  if (
+    originalActivity.actorApId &&
+    !isSameActivityPubActor(originalActivity.actorApId, actor)
+  ) {
     log.warn("Undo actor mismatch", {
       event: "ap.undo.actor_mismatch",
       actor,
@@ -399,12 +384,10 @@ async function resolveUndoByActivityId(
     }
     const follow = await findFollowByActivityId(db, originalActivity.apId);
     if (follow) {
-      await undoFollowEdge(
-        db,
-        follow.followerApId,
-        follow.followingApId,
-        recipient.apId,
-      );
+      if (!authorizesFollowUndo(follow, actor, recipient.apId, objectId)) {
+        return true;
+      }
+      await undoFollowEdge(db, follow.followerApId, follow.followingApId);
     }
     return true;
   }
@@ -457,29 +440,8 @@ async function undoFollowEdge(
   db: Database,
   followerApId: string,
   followingApId: string,
-  recipientApId: string,
 ): Promise<void> {
-  const acceptedEdgeExists = sql`EXISTS (SELECT 1 FROM ${follows} WHERE ${follows.followerApId} = ${followerApId} AND ${follows.followingApId} = ${followingApId} AND ${follows.status} = 'accepted')`;
-  await runBatch(db, [
-    db
-      .update(actors)
-      .set({ followerCount: sql`${actors.followerCount} - 1` })
-      .where(
-        and(
-          eq(actors.apId, recipientApId),
-          gt(actors.followerCount, 0),
-          acceptedEdgeExists,
-        ),
-      ),
-    db
-      .delete(follows)
-      .where(
-        and(
-          eq(follows.followerApId, followerApId),
-          eq(follows.followingApId, followingApId),
-        ),
-      ),
-  ]);
+  await severFollowDirection(db, followerApId, followingApId);
 }
 
 async function undoFollow(
@@ -487,8 +449,14 @@ async function undoFollow(
   objectId: string | null,
   actor: string,
   recipient: ActorRow,
+  baseUrl: string,
 ): Promise<void> {
-  const follow = objectId ? await findFollowByActivityId(db, objectId) : null;
+  const follow = objectId
+    ? await findFollowByActivityId(db, objectId, {
+        actorApId: actor,
+        localBaseUrl: baseUrl,
+      })
+    : null;
 
   // Bind the undo to the VERIFIED signer: an Undo(Follow) may only remove the
   // SIGNER's own follow edge. The activity id is public (it appears in the
@@ -496,13 +464,10 @@ async function undoFollow(
   // cross-actor forgery — an attacker severing a victim's follow + decrementing
   // their followerCount. The bare-string Undo path already enforces this via
   // resolveUndoByActivityId; the typed-object path must too.
-  if (follow && follow.followerApId !== actor) {
-    log.warn("Undo(Follow) actor mismatch", {
-      event: "ap.undo.follow.actor_mismatch",
-      actor,
-      followOwner: follow.followerApId,
-      activityId: objectId,
-    });
+  if (
+    follow &&
+    !authorizesFollowUndo(follow, actor, recipient.apId, objectId)
+  ) {
     return;
   }
 
@@ -514,7 +479,7 @@ async function undoFollow(
   // of permanently over-counting.
   const followerApId = follow ? follow.followerApId : actor;
   const followingApId = follow ? follow.followingApId : recipient.apId;
-  await undoFollowEdge(db, followerApId, followingApId, recipient.apId);
+  await undoFollowEdge(db, followerApId, followingApId);
 }
 
 /**