@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/auth-helpers.ts

@@ -23,6 +23,9 @@ import {
   MAX_PROFILE_URL_LENGTH,
 } from "./actors-helpers.ts";
 import { logger } from "../lib/logger.ts";
+import type { VerifiedTakosumiWorkspaceGrant } from "../lib/oidc-id-token.ts";
+
+export type { VerifiedTakosumiWorkspaceGrant } from "../lib/oidc-id-token.ts";
 
 /**
  * Bound + validate an OAuth/OIDC provider's `name` / `picture` before they are
@@ -55,6 +58,29 @@ function sanitizeOAuthProfile(userInfo: { name?: string; picture?: string }): {
 
 const log = logger.child({ component: "auth.helpers" });
 
+function isExplicitlyEnabled(value: string | undefined): boolean {
+  return ["1", "true", "yes", "on"].includes(
+    (value ?? "").trim().toLowerCase(),
+  );
+}
+
+/**
+ * OAuth identities are persisted as `<provider>:<subject>`, while an operator
+ * may only know the issuer's bare subject when configuring the first login.
+ * Accept either spelling without broadening the match to another subject.
+ */
+function configuredSubjectMatches(
+  configuredSubject: string,
+  providerUserId: string,
+): boolean {
+  if (configuredSubject === providerUserId) return true;
+  const namespaceSeparator = providerUserId.indexOf(":");
+  return (
+    namespaceSeparator >= 0 &&
+    configuredSubject === providerUserId.slice(namespaceSeparator + 1)
+  );
+}
+
 // Upper bound for the OAuth token-exchange / userinfo fetches so a hung provider
 // can't stall the login request (the self-host runtime has no wall-clock cap).
 export const OAUTH_FETCH_TIMEOUT_MS = 10_000;
@@ -337,6 +363,7 @@ export async function createActorFromOAuth(
     username?: string;
   },
   providerUserId: string,
+  verifiedTakosumiGrant?: VerifiedTakosumiWorkspaceGrant,
 ) {
   const baseUsername =
     userInfo.username ||
@@ -353,22 +380,36 @@ export async function createActorFromOAuth(
   // When `OIDC_OWNER_SUB` (the operator's pinned Takosumi subject) is configured,
   // ONLY that subject may take the owner slot; any other first-login is REFUSED
   // (not downgraded to member — that would consume the owner slot and lock the
-  // real operator out forever). With no pin set we keep first-login-owner but warn.
+  // real operator out forever). An unpinned bootstrap must be explicitly enabled
+  // because otherwise any valid issuer subject could win this authority race.
   if (actorCount === 0) {
     const ownerSub =
       parseNonEmptyString(env.OIDC_OWNER_SUB) ??
       parseNonEmptyString(env.TAKOSUMI_ACCOUNTS_OWNER_SUB);
     if (ownerSub) {
-      if (providerUserId !== ownerSub) {
+      if (!configuredSubjectMatches(ownerSub, providerUserId)) {
         log.warn(
           "refused OAuth owner creation: subject does not match OIDC_OWNER_SUB pin",
         );
         return null;
       }
-    } else {
+    } else if (
+      !(
+        providerUserId.startsWith("takos:") &&
+        verifiedTakosumiGrant?.role === "owner"
+      ) &&
+      !isExplicitlyEnabled(env.ALLOW_UNPINNED_OWNER_CLAIM)
+    ) {
+      log.warn(
+        "refused OAuth owner creation: no owner subject pin, verified " +
+          "Takosumi Workspace owner grant, or explicit " +
+          "ALLOW_UNPINNED_OWNER_CLAIM bootstrap opt-in is configured",
+      );
+      return null;
+    } else if (verifiedTakosumiGrant?.role !== "owner") {
       log.warn(
-        "first OAuth login is taking the owner slot with no OIDC_OWNER_SUB pin set; " +
-          "set OIDC_OWNER_SUB to the operator's subject to prevent an owner-slot race",
+        "explicit unpinned OAuth bootstrap is taking the owner slot; " +
+          "pin OIDC_OWNER_SUB and clear ALLOW_UNPINNED_OWNER_CLAIM after login",
       );
     }
   }
@@ -393,8 +434,9 @@ export async function createActorFromOAuth(
         .map((s) => s.trim())
         .filter(Boolean),
     );
-    if (ownerSub) allowed.add(ownerSub);
-    if (!allowed.has(providerUserId)) {
+    const matchesOwner =
+      ownerSub != null && configuredSubjectMatches(ownerSub, providerUserId);
+    if (!matchesOwner && !allowed.has(providerUserId)) {
       log.warn(
         "refused OAuth member auto-provisioning: registration is closed " +
           "(subject not the owner pin and not in OIDC_ALLOWED_SUBS)",
@@ -515,6 +557,7 @@ export async function findOrCreateOAuthActor(
     picture?: string;
     username?: string;
   },
+  verifiedTakosumiGrant?: VerifiedTakosumiWorkspaceGrant,
 ) {
   // Namespace EVERY provider's subject by its provider id (`takos:<sub>`,
   // `google:<id>`, `x:<id>`). Previously the `takos` subject was stored verbatim
@@ -539,8 +582,13 @@ export async function findOrCreateOAuthActor(
     // (-> actor_creation_failed) covers both the refusal and a missing row.
     try {
       actorData =
-        (await createActorFromOAuth(db, env, userInfo, providerUserId)) ??
-        undefined;
+        (await createActorFromOAuth(
+          db,
+          env,
+          userInfo,
+          providerUserId,
+          verifiedTakosumiGrant,
+        )) ?? undefined;
     } catch (e) {
       // Lost a concurrent first-login race for the same subject: the UNIQUE on
       // takosUserId fired because the other request already created the actor.

package/src/backend/routes/auth.ts

@@ -10,7 +10,10 @@ import {
   getMobileOidcAudience,
   getProvider,
 } from "../lib/oauth-providers.ts";
-import { verifyOidcIdToken } from "../lib/oidc-id-token.ts";
+import {
+  readVerifiedTakosumiWorkspaceGrant,
+  verifyOidcIdToken,
+} from "../lib/oidc-id-token.ts";
 import {
   deleteOAuthState,
   generateCodeChallenge,
@@ -121,7 +124,7 @@ auth.get("/me", async (c) => {
   return c.json({
     actor: {
       ap_id: actor.ap_id,
-      username: formatUsername(actor.ap_id),
+      username: formatUsername(actor.ap_id, actor.preferred_username),
       preferred_username: actor.preferred_username,
       name: actor.name,
       summary: actor.summary,
@@ -314,6 +317,7 @@ auth.post("/mobile/oidc", async (c) => {
         email: claims.email,
         username: claims.preferred_username,
       },
+      readVerifiedTakosumiWorkspaceGrant(claims),
     );
     if (!actorData) return c.json({ error: "actor_creation_failed" }, 403);
     const sessionId = await rotateSession(
@@ -462,6 +466,8 @@ auth.get("/callback/:provider", async (c) => {
   // a provider the id_token MUST be present and valid — a token response that
   // simply omits it must NOT fall through to unverified userinfo (that would skip
   // the aud + nonce binding the rest of this flow enforces). Fail closed.
+  let verifiedTakosumiGrant:
+    ReturnType<typeof readVerifiedTakosumiWorkspaceGrant> | undefined;
   if (provider.issuer && provider.jwksUrl) {
     if (!tokens.id_token) {
       log.error("OIDC provider returned no id_token", {
@@ -478,6 +484,7 @@ auth.get("/callback/:provider", async (c) => {
         jwksUrl: provider.jwksUrl,
         expectedNonce: storedState.nonce,
       });
+      verifiedTakosumiGrant = readVerifiedTakosumiWorkspaceGrant(claims);
       userInfo = {
         ...userInfo,
         id: claims.sub || userInfo.id,
@@ -500,6 +507,7 @@ auth.get("/callback/:provider", async (c) => {
     c.env,
     providerId,
     userInfo,
+    providerId === "takos" ? verifiedTakosumiGrant : undefined,
   );
   if (!actorData) return c.redirect("/?error=actor_creation_failed");
 

package/src/backend/routes/communities/membership-invites.ts

@@ -59,7 +59,10 @@ export function registerMembershipInviteRoutes(
           invited_ap_id: inv.invitedApId,
           invited_by: {
             ap_id: inv.invitedByApId,
-            username: formatUsername(inv.invitedByApId),
+            username: formatUsername(
+              inv.invitedByApId,
+              invitedByInfo?.preferredUsername,
+            ),
             preferred_username: invitedByInfo?.preferredUsername || null,
             name: invitedByInfo?.name || null,
           },

package/src/backend/routes/communities/membership-members.ts

@@ -1,28 +1,122 @@
 import type { Context, Hono } from "hono";
-import { and, asc, count, desc, eq, inArray, or } from "drizzle-orm";
-import { communities, communityMembers, follows } from "../../../db/index.ts";
+import { and, eq, inArray, sql, type SQL } from "drizzle-orm";
+import {
+  communities,
+  communityMembers,
+  follows,
+  runBatch,
+  type Database,
+  type D1Statement,
+} from "../../../db/index.ts";
 import { chunkForInClause } from "../../lib/chunk.ts";
 import { communityRequiresMembership } from "../../lib/community-visibility.ts";
+import { operatorActorNotBlockedSql } from "../../lib/blocklist.ts";
 import type { Env, Variables } from "../../types.ts";
 import {
+  formatPreferredUsername,
   formatUsername,
   parseLimit,
   parseOffset,
 } from "../../federation-helpers.ts";
+import { prepareResponseIfRemote } from "../follow-helpers.ts";
 import {
-  banMember,
   batchLoadActorInfo,
+  communityWhere,
   demoteOwnerIfAnotherExists,
   fetchCommunityId,
   memberWhere,
-  removeMemberAtomic,
-  removeOwnerIfAnotherExists,
+  removeMemberAndBanAtomic,
+  removeOwnerAndBanIfAnotherExists,
+  prepareRemoveRemoteMemberAndBanStatements,
   requireManager,
   resolveCommunityApId,
 } from "./membership-shared.ts";
 
 const MAX_MEMBER_BATCH_SIZE = 100;
 
+type CommunityRosterRow = {
+  actor_ap_id: string;
+  role: "owner" | "moderator" | "member";
+  joined_at: string;
+  can_change_role: number | boolean;
+};
+
+type RawSqlDatabase = {
+  all(query: SQL): Promise<unknown[]>;
+};
+
+/**
+ * The community roster has two authority sources: role-bearing local rows and
+ * accepted ActivityPub Follow edges to the Group. Keep the union in SQL so
+ * limit/offset and total describe the same complete roster. An exact local row
+ * wins over a retained Follow edge and is never presented twice.
+ */
+function communityRosterSql(communityApIdVal: string): SQL {
+  return sql`
+    SELECT
+      ${communityMembers.actorApId} AS actor_ap_id,
+      ${communityMembers.role} AS role,
+      ${communityMembers.joinedAt} AS joined_at,
+      1 AS can_change_role
+    FROM ${communityMembers}
+    WHERE ${communityMembers.communityApId} = ${communityApIdVal}
+
+    UNION ALL
+
+    SELECT
+      ${follows.followerApId} AS actor_ap_id,
+      'member' AS role,
+      COALESCE(${follows.acceptedAt}, ${follows.createdAt}) AS joined_at,
+      0 AS can_change_role
+    FROM ${follows}
+    WHERE ${follows.followingApId} = ${communityApIdVal}
+      AND ${follows.status} = 'accepted'
+      AND ${operatorActorNotBlockedSql(sql`${follows.followerApId}`)}
+      AND NOT EXISTS (
+        SELECT 1
+        FROM ${communityMembers}
+        WHERE ${communityMembers.communityApId} = ${communityApIdVal}
+          AND ${communityMembers.actorApId} = ${follows.followerApId}
+      )
+  `;
+}
+
+async function removeFollowBackedMemberAndBan(
+  env: Env,
+  db: Database,
+  communityApIdVal: string,
+  actorApId: string,
+  originalFollowActivityApId: string | null,
+): Promise<void> {
+  const preparedResponse = originalFollowActivityApId
+    ? await prepareResponseIfRemote(
+        env,
+        db,
+        env.APP_URL,
+        "Reject",
+        communityApIdVal,
+        actorApId,
+        originalFollowActivityApId,
+      )
+    : null;
+  const statements: [D1Statement, ...D1Statement[]] = [
+    ...prepareRemoveRemoteMemberAndBanStatements(
+      db,
+      communityApIdVal,
+      actorApId,
+    ),
+  ];
+  if (preparedResponse) statements.push(...preparedResponse.statements);
+
+  // Ban, relay-edge removal, Reject Activity, and durable first-hop delivery
+  // intent are one D1 commit. A persistence failure leaves the original edge
+  // available for an exact retry.
+  await runBatch(db, statements);
+  // Queue is only a post-commit wakeup. The durable intent remains for the
+  // normal sweep when publication is temporarily unavailable.
+  await preparedResponse?.publish();
+}
+
 function validateBatchApIds(ids: unknown): string | null {
   if (!Array.isArray(ids) || ids.length === 0) {
     return "actor_ap_ids array is required";
@@ -82,13 +176,14 @@ export function registerMembershipMemberRoutes(
         // fan-out and the members-only post gate (handleGroupCreate) key on.
         // Deleting that edge is the moderation lever over a remote member: it
         // immediately drops them from the relay and makes their inbound posts
-        // fail the members-only gate (no outbound Reject is required for the
-        // removal to take effect locally). Pending join follows are cleared too.
+        // fail the members-only gate. The Group-signed Reject below also tells
+        // the peer to remove its corresponding following edge. Pending join
+        // follows are cleared the same way.
         // A durable ban (below) auto-Rejects a re-Follow into an open community,
         // so the kick sticks; an approval re-request or invite lets a mod
         // re-admit (which lifts the ban).
         const remoteFollow = await db
-          .select({ followerApId: follows.followerApId })
+          .select({ activityApId: follows.activityApId })
           .from(follows)
           .where(
             and(
@@ -100,17 +195,13 @@ export function registerMembershipMemberRoutes(
         if (!remoteFollow) {
           return c.json({ error: "User is not a member" }, 404);
         }
-        await db
-          .delete(follows)
-          .where(
-            and(
-              eq(follows.followerApId, targetApId),
-              eq(follows.followingApId, community.apId),
-            ),
-          );
-        // Durable ban so the removed remote actor cannot simply re-Follow back
-        // into an open community (handleGroupFollow consults it).
-        await banMember(db, community.apId, targetApId);
+        await removeFollowBackedMemberAndBan(
+          c.env,
+          db,
+          community.apId,
+          targetApId,
+          remoteFollow.activityApId,
+        );
         return c.json({ success: true });
       }
 
@@ -136,7 +227,7 @@ export function registerMembershipMemberRoutes(
       // last-owner LEAVE guard. D1 serializes the deletes, so the second sees
       // the first already gone and matches 0 rows.
       if (targetMembership.role === "owner") {
-        const removed = await removeOwnerIfAnotherExists(
+        const removed = await removeOwnerAndBanIfAnotherExists(
           db,
           community.apId,
           targetApId,
@@ -144,12 +235,10 @@ export function registerMembershipMemberRoutes(
         if (!removed) {
           return c.json({ error: "Cannot remove the last owner" }, 400);
         }
-        await banMember(db, community.apId, targetApId);
         return c.json({ success: true });
       }
 
-      await removeMemberAtomic(db, community.apId, targetApId);
-      await banMember(db, community.apId, targetApId);
+      await removeMemberAndBanAtomic(db, community.apId, targetApId);
 
       return c.json({ success: true });
     },
@@ -238,12 +327,7 @@ export function registerMembershipMemberRoutes(
       const community = await db
         .select({ apId: communities.apId, visibility: communities.visibility })
         .from(communities)
-        .where(
-          or(
-            eq(communities.apId, apId),
-            eq(communities.preferredUsername, identifier),
-          ),
-        )
+        .where(communityWhere(apId, identifier))
         .get();
       if (!community) {
         return c.json({ members: [] });
@@ -265,42 +349,56 @@ export function registerMembershipMemberRoutes(
         }
       }
 
-      // Fetch limit+1 to signal whether more members exist beyond this page —
-      // previously the roster was silently truncated at the page size with no
-      // has_more, so a client could not tell a >page community from a complete
-      // one. `total` is an accurate COUNT (the indexed communityApId scan is
-      // cheap) so the UI can show the real member count.
-      const [scanned, countRow] = await Promise.all([
-        db
-          .select()
-          .from(communityMembers)
-          .where(eq(communityMembers.communityApId, community.apId))
-          .orderBy(desc(communityMembers.role), asc(communityMembers.joinedAt))
-          .limit(limit + 1)
-          .offset(offset),
-        db
-          .select({ c: count() })
-          .from(communityMembers)
-          .where(eq(communityMembers.communityApId, community.apId))
-          .get(),
+      // Fetch limit+1 to signal whether more members exist beyond this page.
+      // Both the page and total use the same union, so federated members cannot
+      // disappear from the manager roster or its pagination metadata.
+      const roster = communityRosterSql(community.apId);
+      const rawDb = db as unknown as RawSqlDatabase;
+      const [scannedRows, countRows] = await Promise.all([
+        rawDb.all(sql`
+          SELECT actor_ap_id, role, joined_at, can_change_role
+          FROM (${roster}) AS community_roster
+          ORDER BY
+            CASE role
+              WHEN 'owner' THEN 0
+              WHEN 'moderator' THEN 1
+              ELSE 2
+            END,
+            joined_at ASC,
+            actor_ap_id ASC
+          LIMIT ${limit + 1}
+          OFFSET ${offset}
+        `),
+        rawDb.all(sql`
+          SELECT COUNT(*) AS total
+          FROM (${roster}) AS community_roster
+        `),
       ]);
+      const scanned = scannedRows as CommunityRosterRow[];
+      const countRow = countRows[0] as { total?: number } | undefined;
       const hasMore = scanned.length > limit;
       const members = hasMore ? scanned.slice(0, limit) : scanned;
-      const total = countRow?.c ?? members.length;
+      const total = countRow?.total ?? members.length;
 
-      const memberApIds = members.map((m) => m.actorApId);
+      const memberApIds = members.map((m) => m.actor_ap_id);
       const actorInfoMap = await batchLoadActorInfo(db, memberApIds);
 
       const result = members.map((m) => {
-        const actorInfo = actorInfoMap.get(m.actorApId);
+        const actorInfo = actorInfoMap.get(m.actor_ap_id);
+        const preferredUsername = formatPreferredUsername(
+          m.actor_ap_id,
+          actorInfo?.preferredUsername,
+        );
         return {
-          ap_id: m.actorApId,
-          username: formatUsername(m.actorApId),
-          preferred_username: actorInfo?.preferredUsername || null,
+          ap_id: m.actor_ap_id,
+          username: formatUsername(m.actor_ap_id, preferredUsername),
+          preferred_username: preferredUsername,
           name: actorInfo?.name || null,
           icon_url: actorInfo?.iconUrl || null,
           role: m.role,
-          joined_at: m.joinedAt,
+          joined_at: m.joined_at,
+          can_change_role:
+            m.can_change_role === true || m.can_change_role === 1,
         };
       });
 
@@ -344,22 +442,40 @@ export function registerMembershipMemberRoutes(
       // (<=100) plus the community param would otherwise exceed D1's 100-bound-
       // parameter cap.
       const membershipByApId = new Map<string, { role: string }>();
+      const followByApId = new Map<string, { activityApId: string | null }>();
       for (const chunk of chunkForInClause(body.actor_ap_ids)) {
-        const rows = await db
-          .select({
-            actorApId: communityMembers.actorApId,
-            role: communityMembers.role,
-          })
-          .from(communityMembers)
-          .where(
-            and(
-              eq(communityMembers.communityApId, community.apId),
-              inArray(communityMembers.actorApId, chunk),
+        const [memberRows, followRows] = await Promise.all([
+          db
+            .select({
+              actorApId: communityMembers.actorApId,
+              role: communityMembers.role,
+            })
+            .from(communityMembers)
+            .where(
+              and(
+                eq(communityMembers.communityApId, community.apId),
+                inArray(communityMembers.actorApId, chunk),
+              ),
+            ),
+          db
+            .select({
+              actorApId: follows.followerApId,
+              activityApId: follows.activityApId,
+            })
+            .from(follows)
+            .where(
+              and(
+                eq(follows.followingApId, community.apId),
+                inArray(follows.followerApId, chunk),
+              ),
             ),
-          );
-        for (const r of rows) {
+        ]);
+        for (const r of memberRows) {
           membershipByApId.set(r.actorApId, { role: r.role });
         }
+        for (const r of followRows) {
+          followByApId.set(r.actorApId, { activityApId: r.activityApId });
+        }
       }
 
       for (const targetApId of body.actor_ap_ids) {
@@ -375,11 +491,23 @@ export function registerMembershipMemberRoutes(
 
           const targetMembership = membershipByApId.get(targetApId);
           if (!targetMembership) {
-            results.push({
-              ap_id: targetApId,
-              success: false,
-              error: "Not a member",
-            });
+            const remoteFollow = followByApId.get(targetApId);
+            if (!remoteFollow) {
+              results.push({
+                ap_id: targetApId,
+                success: false,
+                error: "Not a member",
+              });
+              continue;
+            }
+            await removeFollowBackedMemberAndBan(
+              c.env,
+              db,
+              community.apId,
+              targetApId,
+              remoteFollow.activityApId,
+            );
+            results.push({ ap_id: targetApId, success: true });
             continue;
           }
 
@@ -402,7 +530,7 @@ export function registerMembershipMemberRoutes(
           // concurrently both succeeded → ZERO owners. Gate owner removals on
           // another owner still existing, exactly like the single DELETE path.
           if (targetMembership.role === "owner") {
-            const removed = await removeOwnerIfAnotherExists(
+            const removed = await removeOwnerAndBanIfAnotherExists(
               db,
               community.apId,
               targetApId,
@@ -419,7 +547,7 @@ export function registerMembershipMemberRoutes(
             continue;
           }
 
-          await removeMemberAtomic(db, community.apId, targetApId);
+          await removeMemberAndBanAtomic(db, community.apId, targetApId);
 
           results.push({ ap_id: targetApId, success: true });
         } catch {