@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/communities/membership-requests.ts

@@ -1,31 +1,27 @@
 import type { Context, Hono } from "hono";
 import { and, count, desc, eq, sql } from "drizzle-orm";
 import {
-  activities,
   communities,
   communityJoinRequests,
-  communityMembers,
   follows,
+  runBatch,
+  type D1Statement,
 } from "../../../db/index.ts";
 import type { Env, Variables } from "../../types.ts";
+import { formatUsername, isLocal } from "../../federation-helpers.ts";
 import {
-  activityApId,
-  formatUsername,
-  generateId,
-  isLocal,
-} from "../../federation-helpers.ts";
-import { enqueueDeliveryToActor } from "../../lib/delivery/queue.ts";
+  isActorBlockedStrict,
+  operatorActorNotBlockedSql,
+} from "../../lib/blocklist.ts";
+import { prepareResponseIfRemote } from "../follow-helpers.ts";
 import {
-  addMemberAtomic,
   batchLoadActorInfo,
   fetchCommunityId,
-  memberWhere,
+  prepareAddMemberStatements,
+  prepareUnbanMemberStatement,
   requireManager,
-  unbanMember,
 } from "./membership-shared.ts";
 
-const AS_CONTEXT = "https://www.w3.org/ns/activitystreams";
-
 export function registerMembershipRequestRoutes(
   communitiesRouter: Hono<{ Bindings: Env; Variables: Variables }>,
 ) {
@@ -61,6 +57,7 @@ export function registerMembershipRequestRoutes(
           and(
             eq(communityJoinRequests.communityApId, community.apId),
             eq(communityJoinRequests.status, "pending"),
+            operatorActorNotBlockedSql(sql`${communityJoinRequests.actorApId}`),
           ),
         )
         .orderBy(desc(communityJoinRequests.createdAt))
@@ -75,6 +72,7 @@ export function registerMembershipRequestRoutes(
           and(
             eq(follows.followingApId, community.apId),
             eq(follows.status, "pending"),
+            operatorActorNotBlockedSql(sql`${follows.followerApId}`),
           ),
         )
         .orderBy(desc(follows.createdAt))
@@ -96,7 +94,7 @@ export function registerMembershipRequestRoutes(
         const actorInfo = actorInfoMap.get(apId);
         return {
           ap_id: apId,
-          username: formatUsername(apId),
+          username: formatUsername(apId, actorInfo?.preferredUsername),
           preferred_username: actorInfo?.preferredUsername || null,
           name: actorInfo?.name || null,
           icon_url: actorInfo?.iconUrl || null,
@@ -132,6 +130,9 @@ export function registerMembershipRequestRoutes(
       if (!manager) {
         return c.json({ error: "Forbidden" }, 403);
       }
+      if (await isActorBlockedStrict(db, body.actor_ap_id)) {
+        return c.json({ error: "Join request not found" }, 404);
+      }
 
       // A pending request is EITHER a community_join_requests row (local
       // approval-join) OR a pending follows edge to the Group (remote
@@ -165,22 +166,32 @@ export function registerMembershipRequestRoutes(
       const now = new Date().toISOString();
 
       if (isLocal(body.actor_ap_id, c.env.APP_URL)) {
-        const existingMember = await db
-          .select()
-          .from(communityMembers)
-          .where(memberWhere(community.apId, body.actor_ap_id))
-          .get();
-        if (!existingMember) {
-          // Atomic insert + guarded increment so a crash between them, or a
-          // concurrent double-accept, can't leave the count under/over the truth.
-          await addMemberAtomic(
+        const statements: D1Statement[] = [
+          ...prepareAddMemberStatements(
             db,
             community.apId,
             body.actor_ap_id,
             "member",
             now,
+          ),
+          // Accepting a join request is an explicit re-admission.
+          prepareUnbanMemberStatement(db, community.apId, body.actor_ap_id),
+        ];
+        if (localRequest) {
+          statements.push(
+            db
+              .update(communityJoinRequests)
+              .set({ status: "accepted", processedAt: now })
+              .where(
+                and(
+                  eq(communityJoinRequests.communityApId, community.apId),
+                  eq(communityJoinRequests.actorApId, body.actor_ap_id),
+                  eq(communityJoinRequests.status, "pending"),
+                ),
+              ) as D1Statement,
           );
         }
+        await runBatch(db, statements as [D1Statement, ...D1Statement[]]);
       } else {
         // A REMOTE member's membership IS the pending follows edge to the Group
         // actor — NOT a communityMembers row (which would diverge from how the
@@ -189,51 +200,51 @@ export function registerMembershipRequestRoutes(
         // was approved and our handleGroupCreate (which requires status=accepted)
         // starts relaying its posts. The pending edge carries the original Follow
         // activity id the Accept must reference.
-        await db
-          .update(follows)
-          .set({ status: "accepted", acceptedAt: now })
-          .where(
-            and(
-              eq(follows.followerApId, body.actor_ap_id),
-              eq(follows.followingApId, community.apId),
-            ),
+        const preparedResponse = pendingEdge?.activityApId
+          ? await prepareResponseIfRemote(
+              c.env,
+              db,
+              c.env.APP_URL,
+              "Accept",
+              community.apId,
+              body.actor_ap_id,
+              pendingEdge.activityApId,
+            )
+          : null;
+        const statements: D1Statement[] = [
+          db
+            .update(follows)
+            .set({ status: "accepted", acceptedAt: now })
+            .where(
+              and(
+                eq(follows.followerApId, body.actor_ap_id),
+                eq(follows.followingApId, community.apId),
+                eq(follows.status, "pending"),
+              ),
+            ) as D1Statement,
+        ];
+        if (preparedResponse) statements.push(...preparedResponse.statements);
+        statements.push(
+          prepareUnbanMemberStatement(db, community.apId, body.actor_ap_id),
+        );
+        if (localRequest) {
+          statements.push(
+            db
+              .update(communityJoinRequests)
+              .set({ status: "accepted", processedAt: now })
+              .where(
+                and(
+                  eq(communityJoinRequests.communityApId, community.apId),
+                  eq(communityJoinRequests.actorApId, body.actor_ap_id),
+                  eq(communityJoinRequests.status, "pending"),
+                ),
+              ) as D1Statement,
           );
-        if (pendingEdge?.activityApId) {
-          const acceptId = activityApId(c.env.APP_URL, generateId());
-          const acceptActivity = {
-            "@context": AS_CONTEXT,
-            id: acceptId,
-            type: "Accept",
-            actor: community.apId,
-            object: pendingEdge.activityApId,
-          };
-          await db.insert(activities).values({
-            apId: acceptId,
-            type: "Accept",
-            actorApId: community.apId,
-            objectApId: pendingEdge.activityApId,
-            rawJson: JSON.stringify(acceptActivity),
-            direction: "outbound",
-          });
-          // Delivery resolves the community's signing key from actor=community.apId.
-          await enqueueDeliveryToActor(c.env, acceptId, body.actor_ap_id);
         }
-      }
-
-      // Accepting a join request is an explicit re-admission — lift any ban.
-      await unbanMember(db, community.apId, body.actor_ap_id);
-
-      // Mark the local join-request row processed (a remote accept has none).
-      if (localRequest) {
-        await db
-          .update(communityJoinRequests)
-          .set({ status: "accepted", processedAt: now })
-          .where(
-            and(
-              eq(communityJoinRequests.communityApId, community.apId),
-              eq(communityJoinRequests.actorApId, body.actor_ap_id),
-            ),
-          );
+        await runBatch(db, statements as [D1Statement, ...D1Statement[]]);
+        // The durable intent is committed above; Queue is only a best-effort
+        // wakeup, so an outage cannot turn a committed approval into a 500.
+        await preparedResponse?.publish();
       }
 
       return c.json({ success: true });
@@ -265,7 +276,7 @@ export function registerMembershipRequestRoutes(
         return c.json({ error: "Forbidden" }, 403);
       }
 
-      const request = await db
+      const localRequest = await db
         .select()
         .from(communityJoinRequests)
         .where(
@@ -276,19 +287,73 @@ export function registerMembershipRequestRoutes(
           ),
         )
         .get();
-      if (!request) {
-        return c.json({ error: "Join request not found" }, 404);
-      }
-
-      await db
-        .update(communityJoinRequests)
-        .set({ status: "rejected", processedAt: new Date().toISOString() })
+      const pendingEdge = await db
+        .select({ activityApId: follows.activityApId })
+        .from(follows)
         .where(
           and(
-            eq(communityJoinRequests.communityApId, community.apId),
-            eq(communityJoinRequests.actorApId, body.actor_ap_id),
+            eq(follows.followerApId, body.actor_ap_id),
+            eq(follows.followingApId, community.apId),
+            eq(follows.status, "pending"),
           ),
+        )
+        .get();
+      if (!localRequest && !pendingEdge) {
+        return c.json({ error: "Join request not found" }, 404);
+      }
+
+      const now = new Date().toISOString();
+      const statements: D1Statement[] = [];
+
+      if (pendingEdge) {
+        statements.push(
+          db
+            .delete(follows)
+            .where(
+              and(
+                eq(follows.followerApId, body.actor_ap_id),
+                eq(follows.followingApId, community.apId),
+                eq(follows.status, "pending"),
+              ),
+            ) as D1Statement,
         );
+      }
+
+      // A remote approval request exists as a pending Follow edge. Reject it
+      // with the Group actor and commit the edge removal, Activity, and durable
+      // delivery intent together so the local and remote states cannot diverge.
+      const preparedResponse = pendingEdge
+        ? await prepareResponseIfRemote(
+            c.env,
+            db,
+            c.env.APP_URL,
+            "Reject",
+            community.apId,
+            body.actor_ap_id,
+            pendingEdge.activityApId,
+          )
+        : null;
+      if (preparedResponse) statements.push(...preparedResponse.statements);
+
+      if (localRequest) {
+        statements.push(
+          db
+            .update(communityJoinRequests)
+            .set({ status: "rejected", processedAt: now })
+            .where(
+              and(
+                eq(communityJoinRequests.communityApId, community.apId),
+                eq(communityJoinRequests.actorApId, body.actor_ap_id),
+                eq(communityJoinRequests.status, "pending"),
+              ),
+            ) as D1Statement,
+        );
+      }
+
+      await runBatch(db, statements as [D1Statement, ...D1Statement[]]);
+      // The durable intent is committed above; Queue is only a best-effort
+      // wakeup, so an outage cannot turn a committed rejection into a 500.
+      await preparedResponse?.publish();
 
       return c.json({ success: true });
     },

package/src/backend/routes/communities/membership-shared.ts

@@ -1,16 +1,20 @@
 import type { Context } from "hono";
-import { and, eq, gt, inArray, or, sql } from "drizzle-orm";
-import type { Database } from "../../../db/index.ts";
+import { and, eq, gt, inArray, isNull, or, sql } from "drizzle-orm";
 import {
   actorCache,
   actors,
   communities,
   communityBans,
   communityMembers,
+  follows,
+  runBatch,
+  type D1Statement,
+  type Database,
 } from "../../../db/index.ts";
 import type { Env, Variables } from "../../types.ts";
 import { communityApId } from "../../federation-helpers.ts";
 import { chunkForInClause } from "../../lib/chunk.ts";
+import { activityPubActorIdentityMatchesSql } from "../../lib/activitypub-actor-identity-sql.ts";
 
 export const managerRoles = new Set(["owner", "moderator"]);
 
@@ -23,10 +27,27 @@ export async function banMember(
   communityApIdVal: string,
   bannedApId: string,
 ): Promise<void> {
-  await db
-    .insert(communityBans)
-    .values({ communityApId: communityApIdVal, bannedApId })
-    .onConflictDoNothing();
+  const retainedBans = activityPubActorIdentityMatchesSql(
+    sql`
+      SELECT ${communityBans.bannedApId}
+      FROM ${communityBans}
+      WHERE ${communityBans.communityApId} = ${communityApIdVal}
+    `,
+    bannedApId,
+  );
+  await db.run(sql`
+    INSERT INTO ${communityBans} (
+      community_ap_id, banned_ap_id, created_at
+    )
+    SELECT ${communityApIdVal}, ${bannedApId}, ${new Date().toISOString()}
+    WHERE NOT EXISTS (
+      SELECT 1
+      FROM ${communityBans}
+      WHERE ${communityBans.communityApId} = ${communityApIdVal}
+        AND ${communityBans.bannedApId} IN (${retainedBans})
+    )
+    ON CONFLICT DO NOTHING
+  `);
 }
 
 /**
@@ -38,14 +59,33 @@ export async function unbanMember(
   communityApIdVal: string,
   bannedApId: string,
 ): Promise<void> {
-  await db
+  await runBatch(db, [
+    prepareUnbanMemberStatement(db, communityApIdVal, bannedApId),
+  ]);
+}
+
+/** Prepare explicit re-admission so callers can co-commit its authority state. */
+export function prepareUnbanMemberStatement(
+  db: Database,
+  communityApIdVal: string,
+  bannedApId: string,
+): D1Statement {
+  const retainedBans = activityPubActorIdentityMatchesSql(
+    sql`
+      SELECT ${communityBans.bannedApId}
+      FROM ${communityBans}
+      WHERE ${communityBans.communityApId} = ${communityApIdVal}
+    `,
+    bannedApId,
+  );
+  return db
     .delete(communityBans)
     .where(
       and(
         eq(communityBans.communityApId, communityApIdVal),
-        eq(communityBans.bannedApId, bannedApId),
+        sql`${communityBans.bannedApId} IN (${retainedBans})`,
       ),
-    );
+    ) as D1Statement;
 }
 
 /** Whether `actorApId` is banned from the community. */
@@ -64,7 +104,28 @@ export async function isMemberBanned(
       ),
     )
     .get();
-  return !!row;
+  if (row) return true;
+
+  const retainedBans = activityPubActorIdentityMatchesSql(
+    sql`
+      SELECT ${communityBans.bannedApId}
+      FROM ${communityBans}
+      WHERE ${communityBans.communityApId} = ${communityApIdVal}
+    `,
+    actorApId,
+  );
+  const retained = await db
+    .select({ bannedApId: communityBans.bannedApId })
+    .from(communityBans)
+    .where(
+      and(
+        eq(communityBans.communityApId, communityApIdVal),
+        sql`${communityBans.bannedApId} IN (${retainedBans})`,
+      ),
+    )
+    .limit(1)
+    .get();
+  return retained !== undefined;
 }
 
 // `Database` is a union whose `.batch` lives only on the concrete D1/libsql
@@ -102,6 +163,68 @@ export async function removeMemberAtomic(
   ]);
 }
 
+/**
+ * Atomically remove a LOCAL member, reconcile memberCount, and record the
+ * durable community ban that makes a moderator removal stick. This is distinct
+ * from removeMemberAtomic because a voluntary leave must not ban the actor.
+ *
+ * Put the idempotent ban insert inside the same D1 batch as the removal. If the
+ * ban cannot commit, neither the member row nor the count is changed, avoiding
+ * an expelled-but-immediately-rejoinable partial state.
+ */
+export async function removeMemberAndBanAtomic(
+  db: Database,
+  communityApIdVal: string,
+  actorApIdVal: string,
+): Promise<void> {
+  const memberExists = sql`EXISTS (SELECT 1 FROM ${communityMembers} WHERE ${communityMembers.communityApId} = ${communityApIdVal} AND ${communityMembers.actorApId} = ${actorApIdVal})`;
+  await (db as unknown as Batchable).batch([
+    db
+      .update(communities)
+      .set({ memberCount: sql`${communities.memberCount} - 1` })
+      .where(
+        and(
+          eq(communities.apId, communityApIdVal),
+          gt(communities.memberCount, 0),
+          memberExists,
+        ),
+      ),
+    db
+      .insert(communityBans)
+      .values({ communityApId: communityApIdVal, bannedApId: actorApIdVal })
+      .onConflictDoNothing(),
+    db
+      .delete(communityMembers)
+      .where(memberWhere(communityApIdVal, actorApIdVal)),
+  ]);
+}
+
+/**
+ * Prepare removal of a REMOTE community member's accepted/pending Follow and
+ * the same durable ban used for local removals. The route composes these with
+ * the peer-facing Reject Activity and delivery intent in one D1 batch.
+ */
+export function prepareRemoveRemoteMemberAndBanStatements(
+  db: Database,
+  communityApIdVal: string,
+  actorApIdVal: string,
+): [D1Statement, D1Statement] {
+  return [
+    db
+      .insert(communityBans)
+      .values({ communityApId: communityApIdVal, bannedApId: actorApIdVal })
+      .onConflictDoNothing() as D1Statement,
+    db
+      .delete(follows)
+      .where(
+        and(
+          eq(follows.followerApId, actorApIdVal),
+          eq(follows.followingApId, communityApIdVal),
+        ),
+      ) as D1Statement,
+  ];
+}
+
 /**
  * Atomically remove an OWNER only if ANOTHER owner still remains. Returns false
  * (nothing removed) when the actor is the last owner.
@@ -113,14 +236,15 @@ export async function removeMemberAtomic(
  * statement closes the window: D1 serializes the two deletes, so the second one
  * to execute sees the first already gone and matches 0 rows.
  */
-export async function removeOwnerIfAnotherExists(
+async function removeOwnerIfAnotherExistsInternal(
   db: Database,
   communityApIdVal: string,
   actorApIdVal: string,
+  banOnRemove: boolean,
 ): Promise<boolean> {
   const anotherOwnerExists = sql`EXISTS (SELECT 1 FROM ${communityMembers} WHERE ${communityMembers.communityApId} = ${communityApIdVal} AND ${communityMembers.role} = 'owner' AND ${communityMembers.actorApId} <> ${actorApIdVal})`;
   const memberExists = sql`EXISTS (SELECT 1 FROM ${communityMembers} WHERE ${communityMembers.communityApId} = ${communityApIdVal} AND ${communityMembers.actorApId} = ${actorApIdVal})`;
-  await (db as unknown as Batchable).batch([
+  const statements: unknown[] = [
     db
       .update(communities)
       .set({ memberCount: sql`${communities.memberCount} - 1` })
@@ -132,12 +256,35 @@ export async function removeOwnerIfAnotherExists(
           anotherOwnerExists,
         ),
       ),
+  ];
+  if (banOnRemove) {
+    // The ban must be conditional on the SAME last-owner predicate as the
+    // delete. Insert it before the delete so the target row still exists for
+    // the SELECT. Under D1's atomic batch serialization, a concurrent removal
+    // that would leave zero owners matches neither this insert nor the delete.
+    const banCandidate = db
+      .select({
+        communityApId: sql<string>`${communityApIdVal}`.as("community_ap_id"),
+        bannedApId: sql<string>`${actorApIdVal}`.as("banned_ap_id"),
+        createdAt: sql<string>`${new Date().toISOString()}`.as("created_at"),
+      })
+      .from(communityMembers)
+      .where(
+        and(memberWhere(communityApIdVal, actorApIdVal), anotherOwnerExists),
+      )
+      .limit(1);
+    statements.push(
+      db.insert(communityBans).select(banCandidate).onConflictDoNothing(),
+    );
+  }
+  statements.push(
     db
       .delete(communityMembers)
       .where(
         and(memberWhere(communityApIdVal, actorApIdVal), anotherOwnerExists),
       ),
-  ]);
+  );
+  await (db as unknown as Batchable).batch(statements);
   // Re-read whether the row is gone rather than trusting a batch affected-row
   // count (its shape differs between D1 and the libsql test driver). The member
   // row is keyed by (community, actor) and only this actor's leave touches it,
@@ -151,6 +298,37 @@ export async function removeOwnerIfAnotherExists(
   return !stillMember;
 }
 
+export async function removeOwnerIfAnotherExists(
+  db: Database,
+  communityApIdVal: string,
+  actorApIdVal: string,
+): Promise<boolean> {
+  return removeOwnerIfAnotherExistsInternal(
+    db,
+    communityApIdVal,
+    actorApIdVal,
+    false,
+  );
+}
+
+/**
+ * Moderation counterpart to removeOwnerIfAnotherExists: remove a co-owner only
+ * when another owner survives, and atomically record the durable ban. A failed
+ * last-owner guard records no ban and leaves the owner untouched.
+ */
+export async function removeOwnerAndBanIfAnotherExists(
+  db: Database,
+  communityApIdVal: string,
+  actorApIdVal: string,
+): Promise<boolean> {
+  return removeOwnerIfAnotherExistsInternal(
+    db,
+    communityApIdVal,
+    actorApIdVal,
+    true,
+  );
+}
+
 /**
  * Atomically demote an OWNER to `newRole` only if ANOTHER owner (besides this
  * target) still remains, preserving the ">=1 owner" invariant. Returns true when
@@ -200,12 +378,34 @@ export async function addMemberAtomic(
   role: string,
   joinedAt: string,
 ): Promise<void> {
+  await runBatch(
+    db,
+    prepareAddMemberStatements(
+      db,
+      communityApIdVal,
+      actorApIdVal,
+      role,
+      joinedAt,
+    ),
+  );
+}
+
+/** Prepare retry-safe member insertion and its guarded count increment. */
+export function prepareAddMemberStatements(
+  db: Database,
+  communityApIdVal: string,
+  actorApIdVal: string,
+  role: string,
+  joinedAt: string,
+): readonly [D1Statement, D1Statement] {
   const memberAbsent = sql`NOT EXISTS (SELECT 1 FROM ${communityMembers} WHERE ${communityMembers.communityApId} = ${communityApIdVal} AND ${communityMembers.actorApId} = ${actorApIdVal})`;
-  await (db as unknown as Batchable).batch([
+  return [
     db
       .update(communities)
       .set({ memberCount: sql`${communities.memberCount} + 1` })
-      .where(and(eq(communities.apId, communityApIdVal), memberAbsent)),
+      .where(
+        and(eq(communities.apId, communityApIdVal), memberAbsent),
+      ) as D1Statement,
     db
       .insert(communityMembers)
       .values({
@@ -214,8 +414,8 @@ export async function addMemberAtomic(
         role,
         joinedAt,
       })
-      .onConflictDoNothing(),
-  ]);
+      .onConflictDoNothing() as D1Statement,
+  ];
 }
 
 export function resolveCommunityApId(
@@ -227,11 +427,18 @@ export function resolveCommunityApId(
     : communityApId(baseUrl, identifier);
 }
 
-/** Shared WHERE clause for looking up a community by identifier or apId. */
+/**
+ * Shared WHERE clause for looking up a live community by identifier or AP-ID.
+ * Soft-deleted communities are absent from every ordinary route, including
+ * direct identifier calls that bypass discovery.
+ */
 export function communityWhere(apId: string, identifier: string) {
-  return or(
-    eq(communities.apId, apId),
-    eq(communities.preferredUsername, identifier),
+  return and(
+    or(
+      eq(communities.apId, apId),
+      eq(communities.preferredUsername, identifier),
+    ),
+    isNull(communities.deletedAt),
   );
 }
 

package/src/backend/routes/communities/messages.ts

@@ -41,6 +41,7 @@ import {
   memberWhere,
   resolveCommunityApId,
 } from "./membership-shared.ts";
+import { operatorActorNotBlockedSql } from "../../lib/blocklist.ts";
 
 const MAX_COMMUNITY_MESSAGE_LENGTH = 5000;
 const MAX_COMMUNITY_MESSAGES_LIMIT = 100;
@@ -158,6 +159,9 @@ messagesRouter.get("/:identifier/messages", async (c) => {
     eq(objectRecipients.type, "audience"),
     eq(objects.type, "Note"),
     isNull(objects.communityApId),
+    // A partial purge may retain remote chat objects. Defederation must hide
+    // them before cursor/limit so they cannot consume or shorten the page.
+    operatorActorNotBlockedSql(sql`${objects.attributedTo}`),
   ];
   // Composite (published, apId) cursor so same-millisecond messages aren't
   // skipped on a load-older boundary (see lib/feed-cursor.ts).
@@ -191,7 +195,10 @@ messagesRouter.get("/:identifier/messages", async (c) => {
       id: msg.apId,
       sender: {
         ap_id: msg.attributedTo,
-        username: formatUsername(msg.attributedTo),
+        username: formatUsername(
+          msg.attributedTo,
+          senderInfo?.preferredUsername,
+        ),
         preferred_username: senderInfo?.preferredUsername || null,
         name: senderInfo?.name || null,
         icon_url: senderInfo?.iconUrl || null,
@@ -418,7 +425,7 @@ messagesRouter.post(
       id: objectApId,
       sender: {
         ap_id: actor.ap_id,
-        username: formatUsername(actor.ap_id),
+        username: formatUsername(actor.ap_id, actor.preferred_username),
         preferred_username: actor.preferred_username,
         name: actor.name,
         icon_url: actor.icon_url,