@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/follow-helpers.ts

@@ -1,13 +1,14 @@
 import type { Context } from "hono";
 import { and, eq, sql } from "drizzle-orm";
 import type { Env, Variables } from "../types.ts";
-import type { Database } from "../../db/index.ts";
+import type { D1Statement, Database } from "../../db/index.ts";
 import {
   activities,
   actorCache,
   actors,
   follows,
   inbox,
+  runBatch,
 } from "../../db/index.ts";
 import {
   activityApId,
@@ -16,6 +17,9 @@ import {
   isSafeRemoteUrl,
 } from "../federation-helpers.ts";
 import { enqueueDeliveryToActor } from "../lib/delivery/queue.ts";
+import { prepareDeliveryResolutionJobs } from "../lib/delivery/resolution-outbox.ts";
+import { isActorBlockedStrict } from "../lib/blocklist.ts";
+import { isTrustedRemoteActivityId } from "../lib/remote-activity-id.ts";
 import {
   isUniqueConstraintError,
   parseJsonObject,
@@ -29,10 +33,6 @@ import { logger } from "../lib/logger.ts";
 
 const log = logger.child({ component: "follow.helpers" });
 
-// `.batch` lives only on the concrete D1/libsql subclasses, not the Database
-// union; reach it through a narrow structural cast (matching the other routes).
-type Batchable = { batch: (stmts: unknown[]) => Promise<unknown> };
-
 const REMOTE_FETCH_TIMEOUT_MS = 10000;
 
 export type HonoContext = Context<{ Bindings: Env; Variables: Variables }>;
@@ -121,9 +121,16 @@ export function isResponse(
 // ---------------------------------------------------------------------------
 
 /**
- * Creates an outbound AP activity record and enqueues it for delivery.
+ * Prepare an outbound Activity and its durable first-hop delivery intent so a
+ * relationship mutation can co-commit them in one D1 batch.
  */
-export async function createAndDeliverActivity(
+export type PreparedActivityDelivery = {
+  readonly id: string;
+  readonly statements: readonly [D1Statement, ...D1Statement[]];
+  publish(): Promise<void>;
+};
+
+export async function prepareActivityDelivery(
   env: Env,
   db: Database,
   baseUrl: string,
@@ -132,20 +139,119 @@ export async function createAndDeliverActivity(
   object: unknown,
   recipientApId: string,
   objectApId?: string | null,
-): Promise<void> {
+): Promise<PreparedActivityDelivery> {
   const id = activityApId(baseUrl, generateId());
   const activity = buildApActivity(type, actorId, object, id);
+  const recipientBlocked = await isActorBlockedStrict(db, recipientApId);
+  const preparedResolution = recipientBlocked
+    ? { statements: [] }
+    : await prepareDeliveryResolutionJobs(db, [
+        { activityId: id, recipientActorApId: recipientApId },
+      ]);
 
-  await db.insert(activities).values({
-    apId: id,
+  return {
+    id,
+    statements: [
+      db.insert(activities).values({
+        apId: id,
+        type,
+        actorApId: actorId,
+        objectApId: objectApId || undefined,
+        rawJson: JSON.stringify(activity),
+        direction: "outbound",
+      }) as D1Statement,
+      ...preparedResolution.statements,
+    ],
+    async publish() {
+      if (recipientBlocked) return;
+      try {
+        await enqueueDeliveryToActor(env, id, recipientApId);
+      } catch (error) {
+        log.error("Failed to publish prepared activity delivery wakeup", {
+          event: "follow.activity.delivery_wakeup_failed",
+          activityType: type,
+          activityId: id,
+          recipient: recipientApId,
+          error,
+        });
+      }
+    },
+  };
+}
+
+/** Creates an outbound AP activity and durable delivery intent. */
+export async function createAndDeliverActivity(
+  env: Env,
+  db: Database,
+  baseUrl: string,
+  type: string,
+  actorId: string,
+  object: unknown,
+  recipientApId: string,
+  objectApId?: string | null,
+): Promise<void> {
+  const prepared = await prepareActivityDelivery(
+    env,
+    db,
+    baseUrl,
     type,
-    actorApId: actorId,
-    objectApId: objectApId || undefined,
-    rawJson: JSON.stringify(activity),
-    direction: "outbound",
-  });
+    actorId,
+    object,
+    recipientApId,
+    objectApId,
+  );
+  await runBatch(db, prepared.statements);
+  await prepared.publish();
+}
 
-  await enqueueDeliveryToActor(env, id, recipientApId);
+/**
+ * Resolve the peer-facing id for a follow edge's stored activity id.
+ *
+ * Inbound follow edges persist the origin-bound INTERNAL activity id (the
+ * inbox stamps `activity.id` before dispatch so no remote string escapes into
+ * internal keys). An Accept/Reject crosses the boundary in the OTHER
+ * direction: the remote peer matches `object` against the Follow id IT
+ * minted, so echoing our internal `.../inbound-<hash>` id leaves the peer's
+ * edge pending forever. The original envelope survives in
+ * activities.raw_json — echo its id, but only when it is a bounded id on the
+ * requester's own origin (the same trust rule the inbox applies on the way
+ * in). Anything else falls back to the stored id, which is already correct
+ * for local requesters and for the outbound-follow edges we minted ourselves.
+ */
+export async function resolvePeerFollowActivityId(
+  db: Database,
+  requesterApId: string,
+  storedActivityApId: string | null,
+): Promise<string | null> {
+  if (!storedActivityApId) return storedActivityApId;
+  let rawJson: string | null | undefined;
+  try {
+    const row = await db
+      .select({ rawJson: activities.rawJson })
+      .from(activities)
+      .where(eq(activities.apId, storedActivityApId))
+      .get();
+    rawJson = row?.rawJson;
+  } catch {
+    return storedActivityApId;
+  }
+  if (!rawJson) return storedActivityApId;
+  let wireId: string;
+  try {
+    const parsed: unknown = JSON.parse(rawJson);
+    const candidate =
+      parsed && typeof parsed === "object"
+        ? (parsed as { id?: unknown }).id
+        : undefined;
+    if (typeof candidate !== "string") return storedActivityApId;
+    wireId = candidate;
+  } catch {
+    return storedActivityApId;
+  }
+  if (!isTrustedRemoteActivityId(wireId, requesterApId)) {
+    return storedActivityApId;
+  }
+  return wireId;
 }
 
 /**
@@ -161,17 +267,45 @@ export async function deliverResponseIfRemote(
   requesterApId: string,
   originalActivityApId: string | null,
 ): Promise<void> {
-  if (isLocal(requesterApId, baseUrl)) return;
-  await createAndDeliverActivity(
+  const prepared = await prepareResponseIfRemote(
     env,
     db,
     baseUrl,
     type,
     actorId,
+    requesterApId,
     originalActivityApId,
+  );
+  if (!prepared) return;
+  await runBatch(db, prepared.statements);
+  await prepared.publish();
+}
+
+export async function prepareResponseIfRemote(
+  env: Env,
+  db: Database,
+  baseUrl: string,
+  type: "Accept" | "Reject",
+  actorId: string,
+  requesterApId: string,
+  originalActivityApId: string | null,
+): Promise<PreparedActivityDelivery | null> {
+  if (isLocal(requesterApId, baseUrl)) return null;
+  const peerActivityApId = await resolvePeerFollowActivityId(
+    db,
     requesterApId,
     originalActivityApId,
   );
+  return await prepareActivityDelivery(
+    env,
+    db,
+    baseUrl,
+    type,
+    actorId,
+    peerActivityApId,
+    requesterApId,
+    peerActivityApId,
+  );
 }
 
 // ---------------------------------------------------------------------------
@@ -238,17 +372,31 @@ export async function handleLocalFollow(
       activityApId: id,
       acceptedAt: status === "accepted" ? now : null,
     });
+    const activityInsert = db.insert(activities).values({
+      apId: id,
+      type: "Follow",
+      actorApId: actor.ap_id,
+      objectApId: targetApId,
+      rawJson: JSON.stringify(followActivity),
+      direction: "local",
+    });
+    const inboxInsert = db.insert(inbox).values({
+      actorApId: targetApId,
+      activityApId: id,
+      read: 0,
+    });
 
     if (status === "accepted") {
-      // Co-commit the edge insert + both increments in ONE batch so a crash
-      // between them can't leave the edge accepted with un-bumped counts (the
-      // retry would see the existing edge and skip the increment → permanent
-      // under-count). Increments guarded by NOT EXISTS(edge) — evaluated before
-      // the in-batch insert — so a concurrent duplicate can't double-count; the
-      // bare insert still throws on a true duplicate, rolling back the whole
-      // batch so the catch below returns the "Already following" 400.
+      // Co-commit the edge, both increments, ActivityPub ledger row, and target
+      // inbox notification in ONE batch. A later activity/inbox failure used to
+      // return 500 after the accepted relationship and counts had already
+      // committed; the route's existing-edge guard then made every retry a 400,
+      // permanently hiding the missing activity/notification. The whole local
+      // follow is one authority mutation, so a failure leaves nothing behind.
+      // Increments stay guarded by NOT EXISTS(edge), evaluated before the
+      // in-batch insert, so a concurrent duplicate cannot double-count.
       const edgeAbsent = sql`NOT EXISTS (SELECT 1 FROM ${follows} WHERE ${follows.followerApId} = ${actor.ap_id} AND ${follows.followingApId} = ${targetApId})`;
-      await (db as unknown as Batchable).batch([
+      await runBatch(db, [
         db
           .update(actors)
           .set({ followingCount: sql`${actors.followingCount} + 1` })
@@ -258,25 +406,15 @@ export async function handleLocalFollow(
           .set({ followerCount: sql`${actors.followerCount} + 1` })
           .where(and(eq(actors.apId, targetApId), edgeAbsent)),
         followInsert,
+        activityInsert,
+        inboxInsert,
       ]);
     } else {
-      await followInsert;
+      // A private-account request is the same atomic authority mutation minus
+      // accepted-edge counters: never retain an invisible pending request when
+      // its activity or inbox notification could not be stored.
+      await runBatch(db, [followInsert, activityInsert, inboxInsert]);
     }
-
-    await db.insert(activities).values({
-      apId: id,
-      type: "Follow",
-      actorApId: actor.ap_id,
-      objectApId: targetApId,
-      rawJson: JSON.stringify(followActivity),
-      direction: "local",
-    });
-
-    await db.insert(inbox).values({
-      actorApId: targetApId,
-      activityApId: id,
-      read: 0,
-    });
   } catch (error) {
     if (isUniqueConstraintError(error)) {
       return c.json({ error: "Already following or pending" }, 400);
@@ -336,25 +474,27 @@ export async function handleRemoteFollow(
     return c.json({ error: "Invalid inbox URL" }, 400);
   }
 
-  const id = activityApId(baseUrl, generateId());
-  const followActivity = buildApActivity("Follow", actor.ap_id, targetApId, id);
+  const preparedDelivery = await prepareActivityDelivery(
+    c.env,
+    db,
+    baseUrl,
+    "Follow",
+    actor.ap_id,
+    targetApId,
+    targetApId,
+    targetApId,
+  );
 
   try {
-    await db.insert(follows).values({
-      followerApId: actor.ap_id,
-      followingApId: targetApId,
-      status: "pending",
-      activityApId: id,
-    });
-
-    await db.insert(activities).values({
-      apId: id,
-      type: "Follow",
-      actorApId: actor.ap_id,
-      objectApId: targetApId,
-      rawJson: JSON.stringify(followActivity),
-      direction: "outbound",
-    });
+    await runBatch(db, [
+      db.insert(follows).values({
+        followerApId: actor.ap_id,
+        followingApId: targetApId,
+        status: "pending",
+        activityApId: preparedDelivery.id,
+      }),
+      ...preparedDelivery.statements,
+    ]);
   } catch (e) {
     log.error("Failed to create remote follow", {
       event: "follow.remote.create_failed",
@@ -365,6 +505,6 @@ export async function handleRemoteFollow(
     return c.json({ error: "Failed to follow remote actor" }, 500);
   }
 
-  await enqueueDeliveryToActor(c.env, id, targetApId);
+  await preparedDelivery.publish();
   return c.json({ success: true, status: "pending" });
 }