@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/activitypub/inbox.ts

@@ -18,7 +18,9 @@ import {
 } from "../../federation-helpers.ts";
 import { sha256Hex } from "../../lib/delivery/transformers.ts";
 import { getInstanceActor, loadFederatedCommunity } from "./query-helpers.ts";
-import { communityApId, getDomain } from "../../lib/ap-ids.ts";
+import { communityApId } from "../../lib/ap-ids.ts";
+import { isTrustedRemoteActivityId } from "../../lib/remote-activity-id.ts";
+import { isSameActivityPubActor } from "../../lib/activitypub-actor-identity.ts";
 import type { Activity } from "./inbox-types.ts";
 import {
   getActivityObject,
@@ -39,10 +41,11 @@ import {
 import {
   fetchAndUpsertActorCache,
   getInstanceFetchSignerByDb,
+  isRemoteActorTombstoned,
 } from "../../lib/activitypub-actor-cache.ts";
 import { logger } from "../../lib/logger.ts";
 import { verifyHttpSignature } from "../../lib/ap-verify.ts";
-import { isActorBlocked, isDomainBlocked } from "../../lib/blocklist.ts";
+import { isActorBlockedStrict } from "../../lib/blocklist.ts";
 import {
   consumeRateLimitProgrammatic,
   RateLimitConfigs,
@@ -68,13 +71,13 @@ import {
   handleUndo,
   handleUpdate,
 } from "./handlers/user-inbox-handlers.ts";
+import { internalInboundActivityId } from "./inbound-activity-identity.ts";
 
 const log = logger.child({ component: "activitypub.inbox" });
 
 type HonoContext = Context<{ Bindings: Env; Variables: Variables }>;
 
 const MAX_PAYLOAD_BYTES = 512 * 1024;
-const MAX_REMOTE_ACTIVITY_ID_LENGTH = 2_048;
 const INBOUND_DISPATCH_LEASE_MS = 2 * 60 * 1000;
 const TEXT_DECODER = new TextDecoder("utf-8", { fatal: true });
 
@@ -132,26 +135,6 @@ export function signingActorFromKeyId(
   return keyId.includes("#") ? keyId.split("#")[0] : keyId;
 }
 
-/**
- * Normalize an actor URL for identity comparison: lowercase the host (host names
- * are case-insensitive) and drop a single trailing slash + any fragment, leaving
- * the (case-sensitive) path intact. Used to compare the signing-key owner with
- * the activity actor without rejecting cosmetically-different-but-identical IRIs
- * (trailing slash / host case) that conformant peers occasionally emit. Returns
- * null for an unparseable URL.
- */
-function normalizeActorUrl(url: string): string | null {
-  try {
-    const u = new URL(url);
-    u.hash = "";
-    let normalized = `${u.protocol}//${u.host}${u.pathname}${u.search}`;
-    if (normalized.endsWith("/")) normalized = normalized.slice(0, -1);
-    return normalized;
-  } catch {
-    return null;
-  }
-}
-
 /**
  * Returns true when the HTTP-signature signing key does NOT belong to exactly
  * the activity actor (after URL normalization).
@@ -181,18 +164,7 @@ export function isActorMismatch(
   actor: string,
 ): boolean {
   if (!signingActorUrl) return true;
-  if (signingActorUrl === actor) return false;
-
-  const normalizedSigner = normalizeActorUrl(signingActorUrl);
-  const normalizedActor = normalizeActorUrl(actor);
-  if (
-    normalizedSigner !== null &&
-    normalizedActor !== null &&
-    normalizedSigner === normalizedActor
-  ) {
-    return false;
-  }
-  return true;
+  return !isSameActivityPubActor(signingActorUrl, actor);
 }
 
 type ParsedActivity = {
@@ -208,26 +180,6 @@ type ParsedActivity = {
   activityObjectId: string | null;
 };
 
-function isBoundedProtocolActivityId(value: string): boolean {
-  return (
-    value.length > 0 &&
-    value.length <= MAX_REMOTE_ACTIVITY_ID_LENGTH &&
-    !/[\u0000-\u001f\u007f]/u.test(value)
-  );
-}
-
-async function internalInboundActivityId(
-  baseUrl: string,
-  actor: string,
-  source: string,
-): Promise<string> {
-  const actorIdentity = normalizeActorUrl(actor) ?? actor;
-  return activityApId(
-    baseUrl,
-    `inbound-${await sha256Hex(`${actorIdentity}\0${source}`)}`,
-  );
-}
-
 /**
  * Shared pipeline for both inbox endpoints: size check, signature verification,
  * JSON parse, field extraction, and actor-mismatch check. Returns either a
@@ -285,42 +237,60 @@ async function verifyAndParseInbox(
     return c.json({ error: "Invalid JSON" }, 400);
   }
 
-  const actor = typeof activity.actor === "string" ? activity.actor : null;
+  const claimedActor =
+    typeof activity.actor === "string" ? activity.actor : null;
   const activityType = typeof activity.type === "string" ? activity.type : null;
 
-  if (!actor || !activityType) {
+  if (!claimedActor || !activityType) {
     return c.json({ error: "Invalid activity" }, 400);
   }
 
+  const signingActor = signingActorFromKeyId(signatureResult.keyId);
+  if (isActorMismatch(signingActor, claimedActor)) {
+    log.warn("Actor mismatch between activity and signing key", {
+      event: "ap.signature.actor_mismatch",
+      actor: claimedActor,
+      signingActor,
+      keyId: signatureResult.keyId,
+    });
+    return c.json({ error: "Actor mismatch" }, 401);
+  }
+
+  // From this point onward the key owner is the authoritative actor spelling.
+  // The actor document fetched during signature verification asserts this exact
+  // URL as its id, whereas the envelope may carry an accepted cosmetic variant.
+  // Keeping the original body in rawActivityJson preserves protocol evidence;
+  // normalizing the dispatched Activity prevents one verified identity from
+  // creating separate relationship keys merely by toggling host case or `/`.
+  const actor = signingActor!;
+  activity.actor = actor;
+
   // A peer controls Activity.id. Never use that unbounded string as our primary
   // key, queue key, or structured-log identifier. First validate the protocol
   // id against the signature-bound actor origin, then derive a fixed-size local
   // id from actor + source. The original envelope remains in rawJson (bounded by
   // MAX_PAYLOAD_BYTES) for protocol evidence.
   const rawActivityId = typeof activity.id === "string" ? activity.id : null;
-  let activityIdTrusted = false;
-  if (
+  const trustedActivityId =
     rawActivityId !== null &&
-    isBoundedProtocolActivityId(rawActivityId) &&
-    !isLocal(rawActivityId, baseUrl)
-  ) {
-    try {
-      activityIdTrusted = getDomain(rawActivityId) === getDomain(actor);
-    } catch {
-      activityIdTrusted = false;
-    }
-  }
-  const sourceActivityId =
-    rawActivityId !== null && activityIdTrusted
+    isTrustedRemoteActivityId(rawActivityId, actor, baseUrl)
       ? rawActivityId
+      : null;
+  const identitySource =
+    trustedActivityId !== null
+      ? trustedActivityId
       : `synthetic:${await sha256Hex(
           `${actor}\0${activityType}\0${getActivityObjectId(activity) ?? ""}\0${body}`,
         )}`;
   const activityId = await internalInboundActivityId(
     baseUrl,
     actor,
-    sourceActivityId,
+    identitySource,
   );
+  // Only a safe, actor-owned wire id may cross back out in an Accept/Reject.
+  // When the peer omitted or supplied an unsafe id, use our stable retained
+  // ledger IRI instead of leaking an invalid `synthetic:<hash>` pseudo-IRI.
+  const sourceActivityId = trustedActivityId ?? activityId;
 
   // Handlers persist activity ids on interaction/follow edges. Stamp the
   // canonical internal id before dispatch so no remote string escapes into
@@ -328,28 +298,33 @@ async function verifyAndParseInbox(
   // source-id lookup in the Undo helpers and therefore still resolve.
   activity.id = activityId;
 
-  const signingActor = signingActorFromKeyId(signatureResult.keyId);
-  if (isActorMismatch(signingActor, actor)) {
-    log.warn("Actor mismatch between activity and signing key", {
-      event: "ap.signature.actor_mismatch",
-      actor,
-      signingActor,
-      keyId: signatureResult.keyId,
-    });
-    return c.json({ error: "Actor mismatch" }, 401);
-  }
-
   // Central federation blocklist gate. Applied once here so every activity
   // type (Follow / Like / Announce / Undo / content / group inbox / ...) is
   // covered regardless of which handler dispatches it. Blocked traffic is
   // silently discarded with a 202 ACK (never 4xx) — a 4xx would make the
   // sending instance retry on a backoff and keep redelivering blocked
-  // traffic. The blocklist helpers fail open on a DB read error (see
-  // lib/blocklist.ts), so a transient DB fault never black-holes federation.
+  // traffic. A blocklist read failure propagates as 5xx so the peer retries;
+  // acknowledging while moderation authority is unavailable could admit a
+  // sender the operator has blocked.
   if (await isActivityBlocked(c, actor, activityType)) {
     return c.body(null, 202);
   }
 
+  // A verified self-Delete is durable identity authority. Signature
+  // verification still runs first (so an attacker cannot use an unverified
+  // actor spelling as an oracle), then every inbox shape silently discards
+  // later traffic before dedup allocation or handler effects. As with an
+  // operator block, 202 prevents a peer from retrying traffic that can never
+  // become admissible under this actor id.
+  if (await isRemoteActorTombstoned(c.get("db"), actor)) {
+    log.info("Discarding activity from tombstoned actor", {
+      event: "ap.actor_tombstone.discard",
+      actor,
+      activityType,
+    });
+    return c.body(null, 202);
+  }
+
   return {
     activity,
     activityId,
@@ -374,32 +349,14 @@ async function isActivityBlocked(
 ): Promise<boolean> {
   const db = c.get("db");
 
-  if (await isActorBlocked(db, actor)) {
-    log.info("Discarding activity from blocked actor", {
+  if (await isActorBlockedStrict(db, actor)) {
+    log.info("Discarding activity from blocked actor or domain", {
       event: "ap.blocklist.actor_discard",
       actor,
       activityType,
     });
     return true;
   }
-
-  let hostname: string | null = null;
-  try {
-    hostname = new URL(actor).hostname;
-  } catch {
-    return false;
-  }
-
-  if (await isDomainBlocked(db, hostname)) {
-    log.info("Discarding activity from blocked domain", {
-      event: "ap.blocklist.domain_discard",
-      actor,
-      domain: hostname,
-      activityType,
-    });
-    return true;
-  }
-
   return false;
 }
 
@@ -1185,7 +1142,15 @@ async function resolveObjectActorTarget(
       }
       const innerId = getActivityObjectId(activity);
       if (innerId) {
-        const follow = await findFollowByActivityId(c.get("db"), innerId);
+        const sourceActor =
+          typeof activity.actor === "string" ? activity.actor : null;
+        const follow = await findFollowByActivityId(
+          c.get("db"),
+          innerId,
+          sourceActor
+            ? { actorApId: sourceActor, localBaseUrl: baseUrl }
+            : undefined,
+        );
         if (follow && isLocal(follow.followingApId, baseUrl)) {
           return {
             scoped: true,
@@ -1318,6 +1283,17 @@ ap.post("/ap/inbox", async (c) => {
       MAX_SHARED_INBOX_FANOUT,
     );
 
+    if (resolution.invalidReason) {
+      log.warn("Shared-inbox activity has invalid addressing", {
+        event: "ap.shared_inbox.addressing_invalid",
+        activityType,
+        actor,
+        reason: resolution.invalidReason,
+      });
+      await commitActivityDispatch(c, claim, PROCESSED_UNDELIVERABLE);
+      return c.json({ error: "Invalid or oversized addressing" }, 422);
+    }
+
     if (resolution.recipients.length === 0) {
       if (resolution.cls === "audience") {
         // The activity addressed a COLLECTION (Public / followers) and nobody

package/src/backend/routes/activitypub.ts

@@ -440,13 +440,14 @@ ap.get(
       following: showCollections ? actor.followingUrl : undefined,
       // Advertise sharedInbox so remote servers can deduplicate fan-out
       // delivery (Mastodon convention). The endpoint accepts signed
-      // activities just like the per-actor inbox. `rtcSignal` advertises the
-      // call-signaling ingest so a caller's instance can reach this user
-      // directly (yurucommu extension; peers that don't recognize it just fall
-      // back to deriving it from the inbox origin).
+      // activities just like the per-actor inbox. `rtcSignal` is a Yurucommu
+      // extension and must be advertised only when this exact deployment has a
+      // signaling namespace; otherwise peers are sent to a permanent 503.
       endpoints: {
         sharedInbox: `${baseUrl}/ap/inbox`,
-        rtcSignal: `${baseUrl}/ap/rtc/signal`,
+        ...(c.env.CALL_SIGNALING
+          ? { rtcSignal: `${baseUrl}/ap/rtc/signal` }
+          : {}),
       },
       publicKey: buildPublicKey(actor.apId, actor.publicKeyPem),
       discoverable: !actor.isPrivate,

package/src/backend/routes/actors-helpers.ts

@@ -20,6 +20,8 @@ import {
   parseLimit,
   parseOffset,
 } from "../federation-helpers.ts";
+import { canonicalPersonalModerationActorId } from "../lib/personal-actor-moderation.ts";
+import { operatorActorNotBlockedSql } from "../lib/blocklist.ts";
 
 // Hono context with our app's bindings and variables
 export type AppContext = Context<
@@ -153,7 +155,7 @@ export function formatActorSummary(
 } {
   return {
     ap_id: apId,
-    username: formatUsername(apId),
+    username: formatUsername(apId, info?.preferredUsername),
     preferred_username: info?.preferredUsername || null,
     name: info?.name || null,
     icon_url: info?.iconUrl || null,
@@ -353,6 +355,11 @@ export async function createRelation(
     targetApId: string,
   ) => Promise<unknown>,
   countExisting: (db: Database, actorApIdVal: string) => Promise<number>,
+  relationExists: (
+    db: Database,
+    actorApIdVal: string,
+    targetApId: string,
+  ) => Promise<boolean>,
 ): Promise<Response> {
   const result = requireActor(c);
   if (result instanceof Response) return result;
@@ -360,17 +367,27 @@ export async function createRelation(
 
   const body = await c.req.json<{ ap_id: string }>();
   if (!body.ap_id) return c.json({ error: "ap_id required" }, 400);
-  if (body.ap_id === actor.ap_id) {
+  const canonicalTargetApId = canonicalPersonalModerationActorId(body.ap_id);
+  if (canonicalTargetApId === canonicalPersonalModerationActorId(actor.ap_id)) {
     return c.json({ error: `Cannot ${verb} yourself` }, 400);
   }
 
   const db = c.get("db");
   // Bound the per-actor relation set (soft cap; a small concurrent overshoot is
-  // harmless). onConflictDoNothing means re-blocking an existing target is a
-  // no-op, so this only rejects genuinely-new rows past the limit.
-  if ((await countExisting(db, actor.ap_id)) >= MAX_RELATIONS_PER_ACTOR) {
+  // harmless). Existing identities remain idempotent at the cap, including a
+  // legacy raw spelling that is cosmetically equivalent to the presented ID.
+  // Check identity only on the full-cap path so ordinary creates retain the
+  // existing one-count + one-upsert query shape.
+  if (
+    (await countExisting(db, actor.ap_id)) >= MAX_RELATIONS_PER_ACTOR &&
+    !(await relationExists(db, actor.ap_id, body.ap_id))
+  ) {
     return c.json({ error: `${verb} limit reached` }, 429);
   }
+  // Retain the exact actor spelling the user acted on. Feed queries expand
+  // this one row to raw + canonical identity, so historical content under the
+  // presented spelling and future canonical content are both suppressed
+  // without storing duplicate moderation rows or consuming the relation quota.
   await upsert(db, actor.ap_id, body.ap_id);
 
   return c.json({ success: true });
@@ -394,9 +411,10 @@ export async function deleteRelation(
 
   const body = await c.req.json<{ ap_id: string }>();
   if (!body.ap_id) return c.json({ error: "ap_id required" }, 400);
+  const targetApId = canonicalPersonalModerationActorId(body.ap_id);
 
   const db = c.get("db");
-  await remove(db, actor.ap_id, body.ap_id);
+  await remove(db, actor.ap_id, targetApId);
 
   return c.json({ success: true });
 }
@@ -419,8 +437,16 @@ export async function listFollowRelation(
 
   const isFollowers = direction === "followers";
   const whereCondition = isFollowers
-    ? and(eq(follows.followingApId, apId), eq(follows.status, "accepted"))
-    : and(eq(follows.followerApId, apId), eq(follows.status, "accepted"));
+    ? and(
+        eq(follows.followingApId, apId),
+        eq(follows.status, "accepted"),
+        operatorActorNotBlockedSql(sql`${follows.followerApId}`),
+      )
+    : and(
+        eq(follows.followerApId, apId),
+        eq(follows.status, "accepted"),
+        operatorActorNotBlockedSql(sql`${follows.followingApId}`),
+      );
 
   // A private (locked) account's follower/following LIST is owner-only — mirror
   // the ActivityPub collection gate (canViewPrivateActorCollections), which this