@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/activitypub/handlers/inbox-shared-helpers.ts

@@ -10,6 +10,10 @@ import {
   objects,
 } from "../../../../db/index.ts";
 import { isLocal } from "../../../federation-helpers.ts";
+import { activityPubActorIdentityMatchesSql } from "../../../lib/activitypub-actor-identity-sql.ts";
+import { isSameActivityPubActor } from "../../../lib/activitypub-actor-identity.ts";
+import { isBoundedHttpActivityId } from "../../../lib/remote-activity-id.ts";
+import { resolveInboundActivityReference } from "../inbound-activity-reference.ts";
 import type { Activity } from "../inbox-types.ts";
 
 // ---------------------------------------------------------------------------
@@ -83,50 +87,190 @@ const INTERACTION_TABLES: Record<"like" | "announce", InteractionTable> = {
   announce: announces,
 };
 
-/** Find a follow by activityApId and return it (or null). */
-export async function findFollowByActivityId(
+/**
+ * Resolve a follow edge owned by the verified follower identity. Exact DB keys
+ * are the steady-state path; the fallback keeps every pre-invariant row
+ * reachable without treating a same-origin sibling as the same actor.
+ */
+export async function findFollowByFollowerIdentity(
   db: Database,
-  activityApIdValue: string,
-): Promise<{
+  followerApId: string,
+  followingApId: string,
+) {
+  const exact = await db
+    .select()
+    .from(follows)
+    .where(
+      and(
+        eq(follows.followerApId, followerApId),
+        eq(follows.followingApId, followingApId),
+      ),
+    )
+    .get();
+  if (exact) return exact;
+
+  const retainedFollowers = activityPubActorIdentityMatchesSql(
+    sql`
+      SELECT ${follows.followerApId}
+      FROM ${follows}
+      WHERE ${follows.followingApId} = ${followingApId}
+    `,
+    followerApId,
+  );
+  return await db
+    .select()
+    .from(follows)
+    .where(
+      and(
+        eq(follows.followingApId, followingApId),
+        sql`${follows.followerApId} IN (${retainedFollowers})`,
+      ),
+    )
+    .limit(1)
+    .get();
+}
+
+/** Same compatibility lookup when the verified actor owns the followee side. */
+export async function findFollowByFollowingIdentity(
+  db: Database,
+  followerApId: string,
+  followingApId: string,
+) {
+  const exact = await db
+    .select()
+    .from(follows)
+    .where(
+      and(
+        eq(follows.followerApId, followerApId),
+        eq(follows.followingApId, followingApId),
+      ),
+    )
+    .get();
+  if (exact) return exact;
+
+  const retainedFollowing = activityPubActorIdentityMatchesSql(
+    sql`
+      SELECT ${follows.followingApId}
+      FROM ${follows}
+      WHERE ${follows.followerApId} = ${followerApId}
+    `,
+    followingApId,
+  );
+  return await db
+    .select()
+    .from(follows)
+    .where(
+      and(
+        eq(follows.followerApId, followerApId),
+        sql`${follows.followingApId} IN (${retainedFollowing})`,
+      ),
+    )
+    .limit(1)
+    .get();
+}
+
+type FollowLookupRow = {
   followerApId: string;
   followingApId: string;
   status: string;
-} | null> {
-  let row = await db
-    .select({
-      followerApId: follows.followerApId,
-      followingApId: follows.followingApId,
-      status: follows.status,
-    })
+};
+
+async function findActorOwnedFollowByActivityId(
+  db: Database,
+  activityApIdValue: string,
+  actorApId: string,
+): Promise<FollowLookupRow | null> {
+  const columns = {
+    followerApId: follows.followerApId,
+    followingApId: follows.followingApId,
+    status: follows.status,
+  };
+  const exact = await db
+    .select(columns)
     .from(follows)
-    .where(eq(follows.activityApId, activityApIdValue))
+    .where(
+      and(
+        eq(follows.activityApId, activityApIdValue),
+        eq(follows.followerApId, actorApId),
+      ),
+    )
     .get();
-  if (!row) {
-    // Inbound envelopes use an origin-bound internal activities.apId. Undo
-    // carries the peer's protocol id, so resolve that bounded raw-json id back
-    // to the internal row before looking up the follow edge. The direct lookup
-    // above preserves compatibility with legacy rows.
-    const source = await db
-      .select({ apId: activities.apId })
-      .from(activities)
+  if (exact) return exact;
+
+  // Current ingress stores the verified key-owner spelling, so this only
+  // serves rows created before that invariant. Match the complete retained set:
+  // a public activity id may be repeated and must not make an older legitimate
+  // edge unreachable or authorize a same-origin sibling.
+  const retainedFollowers = activityPubActorIdentityMatchesSql(
+    sql`
+      SELECT ${follows.followerApId}
+      FROM ${follows}
+      WHERE ${follows.activityApId} = ${activityApIdValue}
+    `,
+    actorApId,
+  );
+  return (
+    (await db
+      .select(columns)
+      .from(follows)
       .where(
         and(
-          eq(activities.direction, "inbound"),
-          sql`json_extract(${activities.rawJson}, '$.id') = ${activityApIdValue}`,
+          eq(follows.activityApId, activityApIdValue),
+          sql`${follows.followerApId} IN (${retainedFollowers})`,
         ),
       )
-      .limit(2);
-    for (const candidate of source) {
-      row = await db
+      .limit(1)
+      .get()) ?? null
+  );
+}
+
+/**
+ * Find a follow by its retained activity IRI. When `source` is present, a peer
+ * wire ID may also resolve through that verified actor's inbound ledger row.
+ */
+export async function findFollowByActivityId(
+  db: Database,
+  activityApIdValue: string,
+  source?: { actorApId: string; localBaseUrl: string },
+): Promise<{
+  followerApId: string;
+  followingApId: string;
+  status: string;
+} | null> {
+  if (!isBoundedHttpActivityId(activityApIdValue)) return null;
+
+  let row = source
+    ? await findActorOwnedFollowByActivityId(
+        db,
+        activityApIdValue,
+        source.actorApId,
+      )
+    : await db
         .select({
           followerApId: follows.followerApId,
           followingApId: follows.followingApId,
           status: follows.status,
         })
         .from(follows)
-        .where(eq(follows.activityApId, candidate.apId))
+        .where(eq(follows.activityApId, activityApIdValue))
         .get();
-      if (row) break;
+  if (!row && source) {
+    // Inbound envelopes use an origin-bound internal activities.apId. Undo
+    // carries the peer's protocol id, so resolve that bounded raw-json id back
+    // to the internal row before looking up the follow edge. The direct lookup
+    // above preserves compatibility with legacy rows.
+    const internalActivityApId = await resolveInboundActivityReference(
+      db,
+      activityApIdValue,
+      source.actorApId,
+      source.localBaseUrl,
+    );
+    if (internalActivityApId) {
+      row = await findActorOwnedFollowByActivityId(
+        db,
+        internalActivityApId,
+        source.actorApId,
+      );
     }
   }
   return row ?? null;
@@ -224,6 +368,15 @@ export async function undoInteraction(
   const cf = countField ?? COUNT_FIELDS[kind];
 
   if (directObjectId) {
+    const retainedActors = activityPubActorIdentityMatchesSql(
+      sql`
+        SELECT ${table.actorApId}
+        FROM ${table}
+        WHERE ${table.objectApId} = ${directObjectId}
+      `,
+      actor,
+    );
+
     // Delete the edge and recompute the counter from the remaining edge rows
     // atomically. A duplicate Undo (or an Undo of an interaction we never
     // recorded) deletes 0 rows and the recompute is a no-op against the
@@ -232,7 +385,10 @@ export async function undoInteraction(
       db
         .delete(table)
         .where(
-          and(eq(table.actorApId, actor), eq(table.objectApId, directObjectId)),
+          and(
+            eq(table.objectApId, directObjectId),
+            sql`${table.actorApId} IN (${retainedActors})`,
+          ),
         ),
       db
         .update(objects)
@@ -248,27 +404,59 @@ export async function undoInteraction(
 
   // Resolve the edge by its activity ID, then commit the delete + recompute in
   // one batch keyed on the resolved objectApId.
-  const record = await db
+  let record = await db
     .select({
       actorApId: table.actorApId,
       objectApId: table.objectApId,
     })
     .from(table)
-    .where(eq(table.activityApId, activityId))
+    .where(and(eq(table.activityApId, activityId), eq(table.actorApId, actor)))
     .get();
+  if (!record) {
+    const retainedActors = activityPubActorIdentityMatchesSql(
+      sql`
+        SELECT ${table.actorApId}
+        FROM ${table}
+        WHERE ${table.activityApId} = ${activityId}
+      `,
+      actor,
+    );
+    record = await db
+      .select({
+        actorApId: table.actorApId,
+        objectApId: table.objectApId,
+      })
+      .from(table)
+      .where(
+        and(
+          eq(table.activityApId, activityId),
+          sql`${table.actorApId} IN (${retainedActors})`,
+        ),
+      )
+      .limit(1)
+      .get();
+  }
   if (record) {
     // Bind the undo to the VERIFIED signer. The activity id is public, so a
     // resolved edge whose owner != the signing actor is a cross-actor forgery
     // (a remote attacker undoing someone else's like/announce by id). The
     // directObjectId branch above already keys its delete on `actor`; mirror it.
-    if (record.actorApId !== actor) return false;
+    if (!isSameActivityPubActor(record.actorApId, actor)) return false;
+    const retainedActors = activityPubActorIdentityMatchesSql(
+      sql`
+        SELECT ${table.actorApId}
+        FROM ${table}
+        WHERE ${table.objectApId} = ${record.objectApId}
+      `,
+      actor,
+    );
     await runBatch(db, [
       db
         .delete(table)
         .where(
           and(
-            eq(table.actorApId, record.actorApId),
             eq(table.objectApId, record.objectApId),
+            sql`${table.actorApId} IN (${retainedActors})`,
           ),
         ),
       db

package/src/backend/routes/activitypub/inbound-activity-identity.ts

@@ -0,0 +1,16 @@
+import { activityApId } from "../../federation-helpers.ts";
+import { normalizeActivityPubActorId } from "../../lib/activitypub-actor-identity.ts";
+import { sha256Hex } from "../../lib/delivery/transformers.ts";
+
+/** Build the fixed-size, actor-scoped local ledger IRI for an inbound source. */
+export async function internalInboundActivityId(
+  baseUrl: string,
+  actor: string,
+  source: string,
+): Promise<string> {
+  const actorIdentity = normalizeActivityPubActorId(actor) ?? actor;
+  return activityApId(
+    baseUrl,
+    `inbound-${await sha256Hex(`${actorIdentity}\0${source}`)}`,
+  );
+}

package/src/backend/routes/activitypub/inbound-activity-reference.ts

@@ -0,0 +1,116 @@
+import { and, eq, sql } from "drizzle-orm";
+
+import type { Database } from "../../../db/index.ts";
+import { activities } from "../../../db/index.ts";
+import { isSameActivityPubActor } from "../../lib/activitypub-actor-identity.ts";
+import { activityPubActorIdentityMatchesSql } from "../../lib/activitypub-actor-identity-sql.ts";
+import {
+  isBoundedHttpActivityId,
+  isTrustedRemoteActivityId,
+} from "../../lib/remote-activity-id.ts";
+import { internalInboundActivityId } from "./inbound-activity-identity.ts";
+
+/**
+ * Resolve an Activity reference controlled by a verified remote actor to the
+ * canonical local ledger IRI.
+ *
+ * The direct path covers the local `inbound-<hash>` IRI we may have exposed as
+ * a fallback. The raw-envelope path covers a normal peer wire ID, but only
+ * within the signing actor and only when that actor owns the ID's exact origin.
+ * Actor scoping is essential because Activity IDs are origin-owned: sibling
+ * actors on one server may otherwise collide and make a legitimate Undo bind
+ * to whichever row SQLite happens to return first.
+ */
+export async function resolveInboundActivityReference(
+  db: Database,
+  reference: string,
+  actorApId: string,
+  localBaseUrl: string,
+): Promise<string | null> {
+  if (!isBoundedHttpActivityId(reference)) return null;
+
+  const direct = await db
+    .select({ apId: activities.apId, actorApId: activities.actorApId })
+    .from(activities)
+    .where(eq(activities.apId, reference))
+    .get();
+  if (direct && isSameActivityPubActor(direct.actorApId, actorApId)) {
+    return direct.apId;
+  }
+
+  if (!isTrustedRemoteActivityId(reference, actorApId, localBaseUrl)) {
+    return null;
+  }
+
+  // Current inbound rows use this deterministic actor+source key. Resolve it
+  // first so a sibling actor reusing the same public wire id can neither poison
+  // the lookup nor force a scan of retained envelopes.
+  const expectedInternalId = await internalInboundActivityId(
+    localBaseUrl,
+    actorApId,
+    reference,
+  );
+  const retainedCurrent = await db
+    .select({ apId: activities.apId, actorApId: activities.actorApId })
+    .from(activities)
+    .where(
+      and(
+        eq(activities.apId, expectedInternalId),
+        eq(activities.direction, "inbound"),
+      ),
+    )
+    .get();
+  if (
+    retainedCurrent &&
+    isSameActivityPubActor(retainedCurrent.actorApId, actorApId)
+  ) {
+    return retainedCurrent.apId;
+  }
+
+  // Preserve legacy rows whose primary key predates the deterministic key.
+  // Keep the common exact-spelling lookup indexed by actor first.
+  const retainedExact = await db
+    .select({ apId: activities.apId })
+    .from(activities)
+    .where(
+      and(
+        eq(activities.direction, "inbound"),
+        eq(activities.actorApId, actorApId),
+        // A corrupted/legacy raw_json row must not make the whole lookup throw.
+        sql`CASE WHEN json_valid(${activities.rawJson}) THEN json_extract(${activities.rawJson}, '$.id') ELSE NULL END = ${reference}`,
+      ),
+    )
+    .get();
+  if (retainedExact) return retainedExact.apId;
+
+  // Older rows may retain the same key owner under an accepted cosmetic actor
+  // spelling. Search the complete candidate set in SQL: a public wire id can
+  // collide across arbitrarily many same-origin sibling actors, so a fixed JS
+  // prefix made the legitimate signer-dependent row unreachable. The shared
+  // identity matcher keeps path case and sibling actor paths distinct while
+  // using a constant parameter count.
+  const retainedLegacyActors = activityPubActorIdentityMatchesSql(
+    sql`
+      SELECT ${activities.actorApId}
+      FROM ${activities}
+      WHERE ${activities.direction} = 'inbound'
+        AND CASE WHEN json_valid(${activities.rawJson})
+          THEN json_extract(${activities.rawJson}, '$.id')
+          ELSE NULL END = ${reference}
+    `,
+    actorApId,
+  );
+  const retainedLegacy = await db
+    .select({ apId: activities.apId, actorApId: activities.actorApId })
+    .from(activities)
+    .where(
+      and(
+        eq(activities.direction, "inbound"),
+        sql`CASE WHEN json_valid(${activities.rawJson}) THEN json_extract(${activities.rawJson}, '$.id') ELSE NULL END = ${reference}`,
+        sql`${activities.actorApId} IN (${retainedLegacyActors})`,
+      ),
+    )
+    .limit(1)
+    .get();
+  return retainedLegacy?.apId ?? null;
+}

package/src/backend/routes/activitypub/inbound-addressing.ts

@@ -0,0 +1,87 @@
+import type { Activity, ActivityObject } from "./inbox-types.ts";
+
+export const MAX_INBOUND_ADDRESS_ENTRIES = 64;
+export const MAX_INBOUND_ADDRESS_LENGTH = 2048;
+
+const ADDRESS_FIELDS = ["to", "cc", "bto", "bcc", "audience"] as const;
+type AddressField = (typeof ADDRESS_FIELDS)[number];
+type AddressSource = Pick<
+  Activity | ActivityObject,
+  "to" | "cc" | "bto" | "bcc" | "audience"
+>;
+
+export type InboundAddressingFailureReason = "too_many" | "too_long";
+
+export type InboundAddressingResult =
+  | { ok: true; addresses: string[] }
+  | {
+      ok: false;
+      reason: InboundAddressingFailureReason;
+      addresses: string[];
+    };
+
+// The ActivityStreams public-collection magic value, including legacy short
+// forms some implementations still emit.
+const PUBLIC_COLLECTION = new Set([
+  "https://www.w3.org/ns/activitystreams#Public",
+  "as:Public",
+  "Public",
+]);
+
+export function addressesPublic(addresses: readonly string[]): boolean {
+  return addresses.some((address) => PUBLIC_COLLECTION.has(address));
+}
+
+/**
+ * Validate one complete inbound addressing projection without truncation.
+ *
+ * A field/value pair is counted once across the envelope and embedded object,
+ * so peers that repeat the same projection in both places remain compatible.
+ * Field placement remains significant (`Public` in `to` and `cc` are distinct
+ * reach declarations), while duplicate entries inside one field do not create
+ * storage or lookup amplification. The returned flat list is de-duplicated for
+ * shared-inbox routing; callers retain their field-specific arrays separately.
+ */
+export function collectBoundedInboundAddresses(
+  sources: readonly AddressSource[],
+): InboundAddressingResult {
+  const seenByField = new Map<AddressField, Set<string>>();
+  const addresses = new Set<string>();
+  let entryCount = 0;
+
+  for (const source of sources) {
+    for (const field of ADDRESS_FIELDS) {
+      const raw = source[field] as unknown;
+      const candidates =
+        typeof raw === "string" ? [raw] : Array.isArray(raw) ? raw : [];
+      let seen = seenByField.get(field);
+      if (!seen) {
+        seen = new Set<string>();
+        seenByField.set(field, seen);
+      }
+      for (const candidate of candidates) {
+        if (typeof candidate !== "string" || candidate.length === 0) continue;
+        if (candidate.length > MAX_INBOUND_ADDRESS_LENGTH) {
+          return {
+            ok: false,
+            reason: "too_long",
+            addresses: [...addresses],
+          };
+        }
+        if (seen.has(candidate)) continue;
+        if (entryCount >= MAX_INBOUND_ADDRESS_ENTRIES) {
+          return {
+            ok: false,
+            reason: "too_many",
+            addresses: [...addresses],
+          };
+        }
+        seen.add(candidate);
+        addresses.add(candidate);
+        entryCount += 1;
+      }
+    }
+  }
+
+  return { ok: true, addresses: [...addresses] };
+}

package/src/backend/routes/activitypub/inbox-addressing.ts

@@ -29,8 +29,10 @@ import { isLocal } from "../../federation-helpers.ts";
 import type { Activity } from "./inbox-types.ts";
 import {
   addressesPublic,
-  MAX_ADDRESS_ENTRIES,
-} from "./handlers/inbox-content-handlers.ts";
+  collectBoundedInboundAddresses,
+  type InboundAddressingFailureReason,
+  type InboundAddressingResult,
+} from "./inbound-addressing.ts";
 
 export type ActorRow = typeof actors.$inferSelect;
 
@@ -114,21 +116,11 @@ export function isHandledActivityType(
  * `bto`/`bcc` are included: a peer that strips them before delivery simply
  * contributes nothing, and one that does not must still be honoured.
  */
-export function collectAddresses(activity: Activity): string[] {
+export function collectAddresses(activity: Activity): InboundAddressingResult {
   const object = typeof activity.object === "string" ? null : activity.object;
-  const all = [
-    ...(activity.to ?? []),
-    ...(activity.cc ?? []),
-    ...(activity.bto ?? []),
-    ...(activity.bcc ?? []),
-    ...(activity.audience ?? []),
-    ...(object?.to ?? []),
-    ...(object?.cc ?? []),
-  ];
-  // Same bound the persisted addressing arrays use (policy defined once, in
-  // inbox-content-handlers): a remote must not be able to make one delivery
-  // cost an unbounded number of actor lookups.
-  return [...new Set(all)].slice(0, MAX_ADDRESS_ENTRIES);
+  return collectBoundedInboundAddresses(
+    object ? [activity, object] : [activity],
+  );
 }
 
 /**
@@ -146,6 +138,8 @@ export type AddressingResolution = {
   readonly recipients: readonly ActorRow[];
   /** Addressing IRIs read off the activity, for logging. */
   readonly addresses: readonly string[];
+  /** Invalid projections are undeliverable and must never be truncated. */
+  readonly invalidReason?: InboundAddressingFailureReason;
 };
 
 /**
@@ -160,8 +154,8 @@ async function resolveAddressedLocalActors(
     (a) => isLocal(a, baseUrl) && !addressesPublic([a]),
   );
   if (localIris.length === 0) return [];
-  // Bounded by MAX_ADDRESS_ENTRIES, but routed through inChunks anyway so the
-  // D1 parameter rule holds if that bound is ever raised.
+  // Bounded by the shared 64-entry contract, but routed through inChunks so
+  // the D1 parameter rule holds if that bound is ever raised.
   return await inChunks(localIris, (chunk) =>
     db.query.actors.findMany({ where: inArray(actors.apId, [...chunk]) }),
   );
@@ -214,7 +208,16 @@ export async function resolveAddressedRecipients(
   baseUrl: string,
   followerFanoutLimit: number,
 ): Promise<AddressingResolution> {
-  const addresses = collectAddresses(activity);
+  const collected = collectAddresses(activity);
+  if (!collected.ok) {
+    return {
+      cls: "addressed",
+      recipients: [],
+      addresses: collected.addresses,
+      invalidReason: collected.reason,
+    };
+  }
+  const addresses = collected.addresses;
   const addressed = await resolveAddressedLocalActors(db, addresses, baseUrl);
 
   const wantsAudience =

package/src/backend/routes/activitypub/inbox-types.ts

@@ -7,9 +7,13 @@ export type ActivityObject = {
   id?: string;
   type?: string | string[];
   object?: string;
-  inReplyTo?: string;
+  /** Raw ingress value; Note handlers must validate before SQL or storage. */
+  inReplyTo?: unknown;
   to?: string[];
   cc?: string[];
+  bto?: string[];
+  bcc?: string[];
+  audience?: string[];
   conversation?: string;
   content?: string;
   summary?: string | null;
@@ -27,7 +31,15 @@ export type Activity = {
   type?: string;
   actor?: string;
   object?: string | ActivityObject;
+  /**
+   * Bounded object references extracted from scalar, embedded, or array-valued
+   * AS2 `object`. Standard Flag activities use an array; keeping the normalized
+   * ids separately lets ordinary handlers retain their scalar/object model.
+   */
+  objectIds?: string[];
   target?: string | ActivityObject;
+  /** Envelope-level content, used by Flag as the moderation reason. */
+  content?: string;
   room?: string;
   // Envelope addressing, preserved by parseActivity. Shared-inbox routing is
   // derived from these (inbox-addressing.ts); before they were parsed the
@@ -76,7 +88,7 @@ export function getActivityObject(activity: Activity): ActivityObject | null {
 }
 
 export function getActivityObjectId(activity: Activity): string | null {
-  if (!activity.object) return null;
+  if (!activity.object) return activity.objectIds?.[0] ?? null;
   if (typeof activity.object === "string") return activity.object;
   return activity.object.id || null;
 }