@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/activitypub/handlers/inbox-interaction-handlers.ts

@@ -1,8 +1,9 @@
-import { and, eq, gt, sql } from "drizzle-orm";
+import { and, eq, inArray, or, sql } from "drizzle-orm";
 import type { BatchItem } from "drizzle-orm/batch";
 import {
   actors,
   announces,
+  communities,
   follows,
   likes,
   objects,
@@ -19,15 +20,25 @@ import {
   type ActivityContext,
   getActivityObjectId,
 } from "../inbox-types.ts";
-import { notifyLocalObjectOwner } from "./inbox-shared-helpers.ts";
+import {
+  findFollowByFollowingIdentity,
+  notifyLocalObjectOwner,
+} from "./inbox-shared-helpers.ts";
 import { fetchAndPersistAnnouncedNote } from "./inbox-content-handlers.ts";
 import { isLocal } from "../../../lib/ap-ids.ts";
 import { notDeleted } from "../../../../db/index.ts";
 import {
-  actorIsBlockedBy,
+  actorSuppressesInteractionFrom,
   canViewerReadObjectFull,
 } from "../../../lib/post-visibility.ts";
 import { logger } from "../../../lib/logger.ts";
+import { isSameActivityPubActor } from "../../../lib/activitypub-actor-identity.ts";
+import { MAX_ACTIVITY_OBJECT_IDS } from "../../../lib/activitypub-validators.ts";
+import {
+  acceptRetainedFollowDirection,
+  severFollowDirection,
+  severFollowPair,
+} from "../../../lib/follow-edge-mutations.ts";
 
 type ActorRow = typeof actors.$inferSelect;
 
@@ -91,15 +102,16 @@ async function handleInteraction(
   const objectId = getActivityObjectId(activity);
   if (!objectId) return;
 
-  // Block + read gate for a LOCAL target. Every LOCAL interaction path (like /
-  // repost / reply / story like-vote-share) refuses an actor the owner has
-  // blocked or who cannot read the object; the inbound federated Like/Announce
-  // path did neither, so a personally-blocked remote could still bump the
-  // owner's like/boost counter AND deliver a "X liked your post" notification
-  // (defeating the block as a harassment remedy), and a remote that cannot read a
-  // restricted post could still interact with it. Mirror the local guards.
+  // Apply the canonical read gate to EVERY object retained by this instance,
+  // including a remote-authored object delivered to a local recipient. Limiting
+  // this check to locally-authored targets let an unrelated signer Like/Announce
+  // a cached remote DM or followers-only Note, mutating its edge/counter state
+  // despite having no read access. Personal blocks/mutes remain local-owner
+  // state, so that extra write-suppression guard only applies when the retained
+  // object's author is local.
   const target = await db
     .select({
+      apId: objects.apId,
       attributedTo: objects.attributedTo,
       visibility: objects.visibility,
       toJson: objects.toJson,
@@ -110,12 +122,26 @@ async function handleInteraction(
       endTime: objects.endTime,
     })
     .from(objects)
-    .where(eq(objects.apId, objectId))
+    .where(and(eq(objects.apId, objectId), notDeleted(objects)))
     .get();
-  if (target && isLocal(target.attributedTo, baseUrl)) {
-    if (await actorIsBlockedBy(db, target.attributedTo, actor)) return;
-    if (!(await canViewerReadObjectFull(db, target, actor))) return;
+  // Never retain a relationship to an object this instance does not currently
+  // retain as live. With no D1 FK (remote identities/relationships are
+  // intentionally app-managed), the old path inserted one permanent edge for
+  // every attacker-chosen object id even though the counter update matched no
+  // row. A signer could therefore grow likes/announces without bound, and a
+  // soft-deleted object could accumulate fresh interactions. An unknown
+  // Announce from a followed actor still gets its one bounded, validated fetch
+  // in handleAnnounce BEFORE reaching this guard; only a successfully persisted
+  // public/unlisted Note proceeds.
+  if (!target) return;
+
+  if (
+    isLocal(target.attributedTo, baseUrl) &&
+    (await actorSuppressesInteractionFrom(db, target.attributedTo, actor))
+  ) {
+    return;
   }
+  if (!(await canViewerReadObjectFull(db, target, actor))) return;
 
   const { table, countField, activityType } = INTERACTION_CONFIG[kind];
   const activityId = activity.id || activityApId(baseUrl, generateId());
@@ -232,10 +258,9 @@ export async function handleAnnounce(
   // still surfaces in feeds (previously the Announce only left a dangling
   // announce edge + a counter no-op). Strictly gated: the target must be
   // remote and unknown, and the booster must have at least one local follower
-  // (no open-relay amplification). On any fetch/validation failure the
-  // Announce degrades to exactly the old behavior — handleInteraction records
-  // the edge idempotently and the counter recompute no-ops on the absent row,
-  // so a later Create of the same object retroactively completes the boost.
+  // (no open-relay amplification). On any fetch/validation failure,
+  // handleInteraction drops the Announce because there is no live retained
+  // target; it must not create a dangling edge for an attacker-chosen id.
   const db = c.get("db");
   const objectId = getActivityObjectId(activity);
   if (objectId && !isLocal(objectId, baseUrl)) {
@@ -277,6 +302,18 @@ export async function handleAdd(
 
   const db = c.get("db");
   const now = new Date().toISOString();
+  const retainedEdge = await findFollowByFollowingIdentity(
+    db,
+    recipient.apId,
+    followingApId,
+  );
+  if (
+    !retainedEdge ||
+    (retainedEdge.status !== "pending" && retainedEdge.status !== "accepted")
+  ) {
+    return;
+  }
+  const retainedFollowingApId = retainedEdge.followingApId;
 
   // SECURITY (consent — federated follow-graph forgery): an `Add <local user>
   // to <remote>/followers` is the remote CONFIRMING the local user's OWN Follow
@@ -289,32 +326,16 @@ export async function handleAdd(
   // inflating the victim's followingCount and routing the sender's posts into
   // the victim's home feed — all without the victim ever following anyone.
   //
-  // #COUNTER-SYM: like handleAccept, the two +1s run BEFORE the flip, each
-  // guarded by a correlated `EXISTS(... status='pending')` subquery, and the
-  // flip's own `status='pending'` predicate makes a duplicate/already-accepted
-  // (or absent) edge a total no-op — so counters can neither double-bump,
-  // under-count on retry, nor bump for an edge that was never pending.
-  const pendingEdgeExists = sql`EXISTS (SELECT 1 FROM ${follows} WHERE ${follows.followerApId} = ${recipient.apId} AND ${follows.followingApId} = ${followingApId} AND ${follows.status} = 'pending')`;
-  await runBatch(db, [
-    db
-      .update(actors)
-      .set({ followingCount: sql`${actors.followingCount} + 1` })
-      .where(and(eq(actors.apId, recipient.apId), pendingEdgeExists)),
-    db
-      .update(actors)
-      .set({ followerCount: sql`${actors.followerCount} + 1` })
-      .where(and(eq(actors.apId, followingApId), pendingEdgeExists)),
-    db
-      .update(follows)
-      .set({ status: "accepted", acceptedAt: now })
-      .where(
-        and(
-          eq(follows.followerApId, recipient.apId),
-          eq(follows.followingApId, followingApId),
-          eq(follows.status, "pending"),
-        ),
-      ),
-  ]);
+  // Like Accept, collapse cosmetic duplicates and derive the counter delta from
+  // the retained accepted-row set. This preserves the consent requirement (an
+  // existing pending/accepted edge is mandatory) while making retries and
+  // legacy duplicate rows converge to one logical relation.
+  await acceptRetainedFollowDirection(
+    db,
+    recipient.apId,
+    retainedFollowingApId,
+    now,
+  );
 }
 
 // ---------------------------------------------------------------------------
@@ -331,49 +352,19 @@ export async function handleRemove(
   if (!followingApId) return;
 
   const db = c.get("db");
-
-  // #COUNTER-SYM (crash-retry convergence): the edge delete and both -1s MUST
-  // commit together. Previously the delete committed first and the decrements
-  // were SEPARATE statements; a crash between them left the edge gone but the
-  // counts un-decremented, and the peer's retry matched 0 rows so the decrements
-  // were SKIPPED → a permanent OVER-count. Co-commit them in one atomic batch.
-  //
-  // The two decrements run BEFORE the delete and are each guarded by a
-  // correlated `EXISTS(... status='accepted')` subquery (so a pending /
-  // never-counted edge, a duplicate Remove, or an unknown edge does not drift
-  // the counts) plus a `count > 0` underflow guard (mirrors the local API delete
-  // paths in posts/interactions.ts which batch + guard both sides).
-  const acceptedEdgeExists = sql`EXISTS (SELECT 1 FROM ${follows} WHERE ${follows.followerApId} = ${recipient.apId} AND ${follows.followingApId} = ${followingApId} AND ${follows.status} = 'accepted')`;
-  await runBatch(db, [
-    db
-      .update(actors)
-      .set({ followingCount: sql`${actors.followingCount} - 1` })
-      .where(
-        and(
-          eq(actors.apId, recipient.apId),
-          gt(actors.followingCount, 0),
-          acceptedEdgeExists,
-        ),
-      ),
-    db
-      .update(actors)
-      .set({ followerCount: sql`${actors.followerCount} - 1` })
-      .where(
-        and(
-          eq(actors.apId, followingApId),
-          gt(actors.followerCount, 0),
-          acceptedEdgeExists,
-        ),
-      ),
-    db
-      .delete(follows)
-      .where(
-        and(
-          eq(follows.followerApId, recipient.apId),
-          eq(follows.followingApId, followingApId),
-        ),
-      ),
-  ]);
+  const retainedEdge = await findFollowByFollowingIdentity(
+    db,
+    recipient.apId,
+    followingApId,
+  );
+  if (!retainedEdge) return;
+  const retainedFollowingApId = retainedEdge.followingApId;
+
+  // Remove every retained spelling of this logical edge. The shared mutation
+  // co-commits deletion with count reconciliation and remains bounded to the
+  // exact local follower, so a cosmetic duplicate cannot keep feed-delivery
+  // authority after the remote collection removes the member.
+  await severFollowDirection(db, recipient.apId, retainedFollowingApId);
 }
 
 // ---------------------------------------------------------------------------
@@ -393,61 +384,9 @@ export async function handleBlock(
   // Only act when the recipient is being blocked.
   if (blockedId !== recipient.apId) return;
 
-  // Best-effort: sever follow relations in both directions. #COUNTER-SYM
-  // (crash-retry convergence): handle each direction as its own atomic
-  // edge-delete + counter reconcile so a crash between the delete and the
-  // decrements cannot leave a counter permanently over-counted (the peer's
-  // retry would otherwise match 0 rows and skip the decrement).
-  await severFollowEdge(db, recipient.apId, actor); // recipient follows actor
-  await severFollowEdge(db, actor, recipient.apId); // actor follows recipient
-}
-
-/**
- * Atomically delete a (followerApId -> followingApId) follow edge and reconcile
- * both denormalized counters in a single batch.
- *
- * #COUNTER-SYM: the decrements run BEFORE the delete, each guarded by a
- * correlated `EXISTS(... status='accepted')` subquery (pending edges were never
- * counted) plus a `count > 0` underflow guard, so a pending edge, a duplicate
- * Block, a never-existing edge, or a crash-then-retry is a clean no-op rather
- * than permanently over-counting.
- */
-export async function severFollowEdge(
-  db: Database,
-  followerApId: string,
-  followingApId: string,
-): Promise<void> {
-  const acceptedEdgeExists = sql`EXISTS (SELECT 1 FROM ${follows} WHERE ${follows.followerApId} = ${followerApId} AND ${follows.followingApId} = ${followingApId} AND ${follows.status} = 'accepted')`;
-  await runBatch(db, [
-    db
-      .update(actors)
-      .set({ followingCount: sql`${actors.followingCount} - 1` })
-      .where(
-        and(
-          eq(actors.apId, followerApId),
-          gt(actors.followingCount, 0),
-          acceptedEdgeExists,
-        ),
-      ),
-    db
-      .update(actors)
-      .set({ followerCount: sql`${actors.followerCount} - 1` })
-      .where(
-        and(
-          eq(actors.apId, followingApId),
-          gt(actors.followerCount, 0),
-          acceptedEdgeExists,
-        ),
-      ),
-    db
-      .delete(follows)
-      .where(
-        and(
-          eq(follows.followerApId, followerApId),
-          eq(follows.followingApId, followingApId),
-        ),
-      ),
-  ]);
+  // Commit both directions together. The inbox dispatch retries failures, but
+  // there must be no interval where only one direction has been severed.
+  await severFollowPair(db, recipient.apId, actor);
 }
 
 // ---------------------------------------------------------------------------
@@ -461,17 +400,25 @@ export async function handleFlag(
 ) {
   const objectId = getActivityObjectId(activity);
   const targetId = getActivityTargetId(activity);
-  // Flag activities carry a free-text reason in `content` (not part of the
-  // narrowed Activity type, so read it defensively).
-  const rawContent = (activity as { content?: unknown }).content;
+  // Flag activities carry a free-text reason at envelope-level `content`.
+  const rawContent = activity.content;
   // Cap the inbound reason length at ingest. The Flag `content` is fully
   // attacker-controlled free text, so without a bound the reports table grows
   // unbounded under report spam. 2000 chars is ample for a moderation reason.
   const content =
     typeof rawContent === "string" ? rawContent.slice(0, 2000) : null;
 
-  // The report target is the flagged object (preferred) or the activity target.
-  const reportTarget = objectId ?? targetId ?? null;
+  // Standard AS2 / Mastodon Flag uses an object ARRAY (usually the reported
+  // post followed by its actor). The parser projects those references into a
+  // bounded list; retain the scalar fallback for older callers/fixtures and the
+  // target fallback for peers that use it instead of object.
+  const reportedIds = [
+    ...(activity.objectIds ?? []),
+    ...(objectId ? [objectId] : []),
+    ...(targetId ? [targetId] : []),
+  ]
+    .filter((value, index, all) => all.indexOf(value) === index)
+    .slice(0, MAX_ACTIVITY_OBJECT_IDS);
 
   let instance: string | null = null;
   try {
@@ -480,18 +427,90 @@ export async function handleFlag(
     instance = null;
   }
 
-  // Persist the report so operators can triage it via the moderation API.
-  // Best-effort: never let a storage error 5xx the inbox (which would make
-  // the sender retry on a backoff). Log the failure for the operator.
+  // Persist only a target this instance can actually moderate:
+  //   - an object authored by a local actor;
+  //   - an object scoped to a live local community; or
+  //   - a local actor/community itself.
+  //
+  // Before this authority check, every signed Flag — including one containing
+  // no usable object at all — appended a permanent report row for an arbitrary
+  // attacker-chosen id. Besides filling the queue with unactionable noise, that
+  // made the append-only table a storage-amplification surface. Each IN list is
+  // capped by MAX_ACTIVITY_OBJECT_IDS, below D1's 100-bind ceiling.
+  //
+  // A storage failure MUST escape to the inbox route. The shared dispatch
+  // contract releases its fenced claim and returns retryable 503, leaving the
+  // activity ledger uncommitted so the peer can complete the report later.
+  // Swallowing this error would ACK 202 and mark the activity processed even
+  // though no moderation row exists, permanently losing a valid abuse report.
   try {
     const db = c.get("db");
-    await db.insert(reports).values({
-      id: generateId(),
-      reporterApId: actor,
-      targetApId: reportTarget,
-      content,
-      instance,
-    });
+    if (reportedIds.length === 0) {
+      log.info("Dropped inbound Flag with no reportable target", {
+        event: "ap.flag.no_target",
+        actor,
+      });
+      return;
+    }
+
+    const objectTargets = await db
+      .select({ apId: objects.apId })
+      .from(objects)
+      .where(
+        and(
+          inArray(objects.apId, reportedIds),
+          or(
+            sql`EXISTS (SELECT 1 FROM ${actors} WHERE ${actors.apId} = ${objects.attributedTo})`,
+            sql`EXISTS (
+              SELECT 1 FROM ${communities}
+              WHERE ${communities.apId} = ${objects.communityApId}
+                AND ${communities.deletedAt} IS NULL
+            )`,
+          ),
+        ),
+      );
+    const actorTargets = await db
+      .select({ apId: actors.apId })
+      .from(actors)
+      .where(inArray(actors.apId, reportedIds));
+    const communityTargets = await db
+      .select({ apId: communities.apId })
+      .from(communities)
+      .where(
+        and(inArray(communities.apId, reportedIds), notDeleted(communities)),
+      );
+
+    // Prefer a specific actionable object over its actor when both are present
+    // in a standard `[post, actor]` Flag array.
+    const actionableObjects = new Set(objectTargets.map((row) => row.apId));
+    const actionableEntities = new Set([
+      ...actorTargets.map((row) => row.apId),
+      ...communityTargets.map((row) => row.apId),
+    ]);
+    const reportTarget =
+      reportedIds.find((id) => actionableObjects.has(id)) ??
+      reportedIds.find((id) => actionableEntities.has(id));
+    if (!reportTarget) {
+      log.info("Dropped inbound Flag outside local moderation authority", {
+        event: "ap.flag.unowned_target",
+        actor,
+      });
+      return;
+    }
+
+    await db
+      .insert(reports)
+      .values({
+        // verifyAndParseInbox stamps an origin-bound internal activity id.
+        // Reusing it makes a dispatch retry idempotent instead of appending a
+        // second random report after a commit/lease failure.
+        id: activity.id || generateId(),
+        reporterApId: actor,
+        targetApId: reportTarget,
+        content,
+        instance,
+      })
+      .onConflictDoNothing();
   } catch (err) {
     log.warn("Failed to persist Flag report", {
       event: "ap.flag.persist_failed",
@@ -500,6 +519,7 @@ export async function handleFlag(
       target: targetId,
       error: err,
     });
+    throw err;
   }
 
   log.warn("Flag received", {
@@ -546,16 +566,13 @@ function resolveCollectionTarget(
   const followingApId = normalizeCollectionTarget(targetId || actor) || null;
   if (!followingApId) return null;
 
-  // SECURITY (federated follow-graph forgery): `activity.target` is
-  // attacker-controlled and only the signing actor is authenticated, NOT the
-  // target. Without this check a signed Add/Remove could forge or delete a local
-  // user's follow edge to an ARBITRARY third party (followingApId on any host).
-  // Constrain the resolved target to the signing actor's own origin, so an
-  // Add/Remove can only affect a relationship involving the sending actor.
-  try {
-    if (getDomain(followingApId) !== getDomain(actor)) return null;
-  } catch {
-    return null;
-  }
+  // SECURITY (same-host actor authority): `activity.target` is
+  // attacker-controlled and only the exact signing actor is authenticated.
+  // Same-origin is insufficient: one account on a multi-user remote host must
+  // not Accept or Remove a local user's follow edge to a sibling account. Once
+  // an optional `/followers` collection suffix is normalized, the target actor
+  // id must therefore identify the verified signer under the same narrow
+  // cosmetic equivalence used at the HTTP-signature boundary.
+  if (!isSameActivityPubActor(followingApId, actor)) return null;
   return followingApId;
 }