@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/follow.ts

@@ -2,42 +2,40 @@ import { Hono } from "hono";
 import { and, desc, eq, gt, inArray, sql } from "drizzle-orm";
 import type { Env, Variables } from "../types.ts";
 import {
-  activities,
   actorCache,
   actors,
   follows,
   inbox,
+  runBatch,
+  type D1Statement,
 } from "../../db/index.ts";
 import {
-  activityApId,
   formatUsername,
-  generateId,
   isLocal,
   isSafeRemoteUrl,
   parseLimit,
   parseOffset,
 } from "../federation-helpers.ts";
-import { enqueueDeliveryToActor } from "../lib/delivery/queue.ts";
 import {
-  buildApActivity,
-  createAndDeliverActivity,
-  deliverResponseIfRemote,
+  filterBlockedActorApIdsStrict,
+  isActorBlockedStrict,
+  operatorActorNotBlockedSql,
+} from "../lib/blocklist.ts";
+import {
   findPendingFollow,
   handleLocalFollow,
   handleRemoteFollow,
   isResponse,
   parseNonEmptyString,
   parseStringArray,
+  prepareActivityDelivery,
+  prepareResponseIfRemote,
   requireActorAndBody,
 } from "./follow-helpers.ts";
 import { logger } from "../lib/logger.ts";
 
 const log = logger.child({ component: "follow" });
 
-// `.batch` lives only on the concrete D1/libsql subclasses, not the Database
-// union; reach it through a narrow structural cast (matching the other routes).
-type Batchable = { batch: (stmts: unknown[]) => Promise<unknown> };
-
 // Capped at 90 (not 100): the accepted ids are re-queried via
 // `inArray(follows.followerApId, requesterApIds)` and Cloudflare D1 allows at
 // most 100 bound parameters per query (libsql, used by the tests, allows ~32k).
@@ -62,6 +60,17 @@ follow.post("/", async (c) => {
     return c.json({ error: "Cannot follow yourself" }, 400);
   }
 
+  // An operator block is an instance-wide authority boundary, not merely an
+  // outbound delivery filter. Reject before reading/cleaning an existing edge
+  // or resolving a remote actor so the request cannot report success while the
+  // queue silently drops it, create an inert Follow ledger row, fetch the
+  // defederated host, or mutate a retained relationship that unblock restores.
+  // Match the personal-block route's not-found response to avoid presenting a
+  // blocked target through this mutation surface.
+  if (await isActorBlockedStrict(db, targetApId)) {
+    return c.json({ error: "Target actor not found" }, 404);
+  }
+
   const existing = await db
     .select()
     .from(follows)
@@ -125,6 +134,23 @@ follow.delete("/", async (c) => {
   const wasAccepted = existingFollow.status === "accepted";
   const targetIsLocal = isLocal(targetApId, baseUrl);
 
+  const preparedUndo = targetIsLocal
+    ? null
+    : await prepareActivityDelivery(
+        c.env,
+        db,
+        baseUrl,
+        "Undo",
+        actor.ap_id,
+        {
+          type: "Follow",
+          actor: actor.ap_id,
+          object: targetApId,
+        },
+        targetApId,
+        targetApId,
+      );
+
   const deleteEdge = db
     .delete(follows)
     .where(
@@ -134,13 +160,14 @@ follow.delete("/", async (c) => {
       ),
     );
 
+  const statements: D1Statement[] = [];
   if (wasAccepted) {
     // Co-commit the decrements + delete in ONE batch so a crash between them
     // can't leave the edge gone with un-decremented counts (permanent over-
     // count). Decrements run BEFORE the delete, guarded by EXISTS(accepted edge)
     // + count>0 (underflow) — mirrors the federated undoFollowEdge.
     const acceptedEdgeExists = sql`EXISTS (SELECT 1 FROM ${follows} WHERE ${follows.followerApId} = ${actor.ap_id} AND ${follows.followingApId} = ${targetApId} AND ${follows.status} = 'accepted')`;
-    const stmts: unknown[] = [
+    statements.push(
       db
         .update(actors)
         .set({ followingCount: sql`${actors.followingCount} - 1` })
@@ -150,10 +177,10 @@ follow.delete("/", async (c) => {
             gt(actors.followingCount, 0),
             acceptedEdgeExists,
           ),
-        ),
-    ];
+        ) as D1Statement,
+    );
     if (targetIsLocal) {
-      stmts.push(
+      statements.push(
         db
           .update(actors)
           .set({ followerCount: sql`${actors.followerCount} - 1` })
@@ -163,32 +190,14 @@ follow.delete("/", async (c) => {
               gt(actors.followerCount, 0),
               acceptedEdgeExists,
             ),
-          ),
+          ) as D1Statement,
       );
     }
-    stmts.push(deleteEdge);
-    await (db as unknown as Batchable).batch(stmts);
-  } else {
-    await deleteEdge;
-  }
-
-  if (!targetIsLocal) {
-    const undoObject = {
-      type: "Follow",
-      actor: actor.ap_id,
-      object: targetApId,
-    };
-    await createAndDeliverActivity(
-      c.env,
-      db,
-      baseUrl,
-      "Undo",
-      actor.ap_id,
-      undoObject,
-      targetApId,
-      targetApId,
-    );
   }
+  statements.push(deleteEdge as D1Statement);
+  if (preparedUndo) statements.push(...preparedUndo.statements);
+  await runBatch(db, statements as [D1Statement, ...D1Statement[]]);
+  await preparedUndo?.publish();
 
   return c.json({ success: true });
 });
@@ -209,8 +218,10 @@ follow.post("/accept", async (c) => {
       400,
     );
   }
+  if (await isActorBlockedStrict(db, requesterApId)) {
+    return c.json({ error: "No pending follow request" }, 404);
+  }
 
-  let pendingFollow: Awaited<ReturnType<typeof findPendingFollow>>;
   try {
     // Read the pending edge first (we need its activityApId for the Accept
     // delivery below), then co-commit the flip + both increments in ONE batch.
@@ -223,21 +234,34 @@ follow.post("/accept", async (c) => {
     // count nor under-count. Mirrors the federated handleAccept.
     const pending = await findPendingFollow(db, requesterApId, actor.ap_id);
     if (!pending) {
-      pendingFollow = undefined;
+      return c.json({ error: "No pending follow request" }, 404);
     } else {
+      const preparedResponse = await prepareResponseIfRemote(
+        c.env,
+        db,
+        baseUrl,
+        "Accept",
+        actor.ap_id,
+        requesterApId,
+        pending.activityApId,
+      );
       const pendingExists = sql`EXISTS (SELECT 1 FROM ${follows} WHERE ${follows.followerApId} = ${requesterApId} AND ${follows.followingApId} = ${actor.ap_id} AND ${follows.status} = 'pending')`;
-      const stmts: unknown[] = [
+      const stmts: D1Statement[] = [
         db
           .update(actors)
           .set({ followerCount: sql`${actors.followerCount} + 1` })
-          .where(and(eq(actors.apId, actor.ap_id), pendingExists)),
+          .where(
+            and(eq(actors.apId, actor.ap_id), pendingExists),
+          ) as D1Statement,
       ];
       if (isLocal(requesterApId, baseUrl)) {
         stmts.push(
           db
             .update(actors)
             .set({ followingCount: sql`${actors.followingCount} + 1` })
-            .where(and(eq(actors.apId, requesterApId), pendingExists)),
+            .where(
+              and(eq(actors.apId, requesterApId), pendingExists),
+            ) as D1Statement,
         );
       }
       stmts.push(
@@ -250,10 +274,11 @@ follow.post("/accept", async (c) => {
               eq(follows.followingApId, actor.ap_id),
               eq(follows.status, "pending"),
             ),
-          ),
+          ) as D1Statement,
       );
-      await (db as unknown as Batchable).batch(stmts);
-      pendingFollow = pending;
+      if (preparedResponse) stmts.push(...preparedResponse.statements);
+      await runBatch(db, stmts as [D1Statement, ...D1Statement[]]);
+      await preparedResponse?.publish();
     }
   } catch (e) {
     log.error("Error in accept", {
@@ -263,20 +288,6 @@ follow.post("/accept", async (c) => {
     return c.json({ error: "Internal error" }, 500);
   }
 
-  if (!pendingFollow) {
-    return c.json({ error: "No pending follow request" }, 404);
-  }
-
-  await deliverResponseIfRemote(
-    c.env,
-    db,
-    baseUrl,
-    "Accept",
-    actor.ap_id,
-    requesterApId,
-    pendingFollow.activityApId,
-  );
-
   return c.json({ success: true });
 });
 
@@ -308,32 +319,31 @@ follow.post("/accept/batch", async (c) => {
     );
   }
 
-  const pendingFollows = await db
-    .select()
-    .from(follows)
-    .where(
-      and(
-        inArray(follows.followerApId, requesterApIds),
-        eq(follows.followingApId, actor.ap_id),
-        eq(follows.status, "pending"),
-      ),
-    );
+  const blockedRequesterApIds = await filterBlockedActorApIdsStrict(
+    db,
+    requesterApIds,
+  );
+  const visibleRequesterApIds = requesterApIds.filter(
+    (requesterApId) => !blockedRequesterApIds.has(requesterApId),
+  );
+  const pendingFollows =
+    visibleRequesterApIds.length === 0
+      ? []
+      : await db
+          .select()
+          .from(follows)
+          .where(
+            and(
+              inArray(follows.followerApId, visibleRequesterApIds),
+              eq(follows.followingApId, actor.ap_id),
+              eq(follows.status, "pending"),
+            ),
+          );
   const pendingFollowMap = new Map(
     pendingFollows.map((f) => [f.followerApId, f]),
   );
 
   const results: { ap_id: string; success: boolean; error?: string }[] = [];
-  const activitiesToCreate: Array<{
-    apId: string;
-    type: string;
-    actorApId: string;
-    objectApId: string | undefined;
-    rawJson: string;
-    direction: string;
-  }> = [];
-  const remoteEnqueues: Array<{ activityId: string; recipientApId: string }> =
-    [];
-
   for (const requesterApId of requesterApIds) {
     const pendingFollow = pendingFollowMap.get(requesterApId);
     if (!pendingFollow) {
@@ -352,19 +362,36 @@ follow.post("/accept/batch", async (c) => {
       // accumulated increments for already-flipped rows. Increments guarded by
       // EXISTS(pending) before the flip; the flip keeps its pending predicate.
       const requesterIsLocal = isLocal(requesterApId, baseUrl);
+      const requesterIsSafeRemote =
+        !requesterIsLocal && isSafeRemoteUrl(requesterApId);
+      const preparedResponse = requesterIsSafeRemote
+        ? await prepareResponseIfRemote(
+            c.env,
+            db,
+            baseUrl,
+            "Accept",
+            actor.ap_id,
+            requesterApId,
+            pendingFollow.activityApId,
+          )
+        : null;
       const pendingExists = sql`EXISTS (SELECT 1 FROM ${follows} WHERE ${follows.followerApId} = ${requesterApId} AND ${follows.followingApId} = ${actor.ap_id} AND ${follows.status} = 'pending')`;
-      const stmts: unknown[] = [
+      const stmts: D1Statement[] = [
         db
           .update(actors)
           .set({ followerCount: sql`${actors.followerCount} + 1` })
-          .where(and(eq(actors.apId, actor.ap_id), pendingExists)),
+          .where(
+            and(eq(actors.apId, actor.ap_id), pendingExists),
+          ) as D1Statement,
       ];
       if (requesterIsLocal) {
         stmts.push(
           db
             .update(actors)
             .set({ followingCount: sql`${actors.followingCount} + 1` })
-            .where(and(eq(actors.apId, requesterApId), pendingExists)),
+            .where(
+              and(eq(actors.apId, requesterApId), pendingExists),
+            ) as D1Statement,
         );
       }
       stmts.push(
@@ -377,31 +404,15 @@ follow.post("/accept/batch", async (c) => {
               eq(follows.followingApId, actor.ap_id),
               eq(follows.status, "pending"),
             ),
-          ),
+          ) as D1Statement,
       );
-      await (db as unknown as Batchable).batch(stmts);
+      if (preparedResponse) stmts.push(...preparedResponse.statements);
+      await runBatch(db, stmts as [D1Statement, ...D1Statement[]]);
+      await preparedResponse?.publish();
 
       if (requesterIsLocal) {
         // local follower's followingCount already bumped in the batch above
-      } else if (isSafeRemoteUrl(requesterApId)) {
-        const id = activityApId(baseUrl, generateId());
-        const activity = buildApActivity(
-          "Accept",
-          actor.ap_id,
-          pendingFollow.activityApId,
-          id,
-        );
-
-        activitiesToCreate.push({
-          apId: id,
-          type: "Accept",
-          actorApId: actor.ap_id,
-          objectApId: pendingFollow.activityApId || undefined,
-          rawJson: JSON.stringify(activity),
-          direction: "outbound",
-        });
-        remoteEnqueues.push({ activityId: id, recipientApId: requesterApId });
-      } else {
+      } else if (!requesterIsSafeRemote) {
         log.warn("Blocked unsafe remote actor", {
           event: "follow.accept.unsafe_remote_actor",
           actor: requesterApId,
@@ -421,18 +432,6 @@ follow.post("/accept/batch", async (c) => {
   // (Counts are bumped per-request inside the loop's batch — no aggregate
   // post-loop increment, which could be lost on a mid-loop crash.)
 
-  if (activitiesToCreate.length > 0) {
-    await db.insert(activities).values(activitiesToCreate);
-  }
-
-  if (remoteEnqueues.length > 0) {
-    await Promise.allSettled(
-      remoteEnqueues.map((e) =>
-        enqueueDeliveryToActor(c.env, e.activityId, e.recipientApId),
-      ),
-    );
-  }
-
   return c.json({
     results,
     accepted_count: results.filter((r) => r.success).length,
@@ -468,28 +467,7 @@ follow.post("/reject", async (c) => {
   // the INBOUND reject path (handleReject -> deleteFollowByCompoundKey) and the
   // community join-request re-pend behaviour, letting a fresh Follow start clean.
   // A pending edge was never counted, so no counter reconcile is needed.
-  await db
-    .delete(follows)
-    .where(
-      and(
-        eq(follows.followerApId, requesterApId),
-        eq(follows.followingApId, actor.ap_id),
-      ),
-    );
-
-  if (pendingFollow.activityApId) {
-    await db
-      .update(inbox)
-      .set({ read: 1 })
-      .where(
-        and(
-          eq(inbox.actorApId, actor.ap_id),
-          eq(inbox.activityApId, pendingFollow.activityApId),
-        ),
-      );
-  }
-
-  await deliverResponseIfRemote(
+  const preparedResponse = await prepareResponseIfRemote(
     c.env,
     db,
     baseUrl,
@@ -498,6 +476,33 @@ follow.post("/reject", async (c) => {
     requesterApId,
     pendingFollow.activityApId,
   );
+  const statements: D1Statement[] = [
+    db
+      .delete(follows)
+      .where(
+        and(
+          eq(follows.followerApId, requesterApId),
+          eq(follows.followingApId, actor.ap_id),
+        ),
+      ) as D1Statement,
+  ];
+
+  if (pendingFollow.activityApId) {
+    statements.push(
+      db
+        .update(inbox)
+        .set({ read: 1 })
+        .where(
+          and(
+            eq(inbox.actorApId, actor.ap_id),
+            eq(inbox.activityApId, pendingFollow.activityApId),
+          ),
+        ) as D1Statement,
+    );
+  }
+  if (preparedResponse) statements.push(...preparedResponse.statements);
+  await runBatch(db, statements as [D1Statement, ...D1Statement[]]);
+  await preparedResponse?.publish();
 
   return c.json({ success: true });
 });
@@ -525,6 +530,7 @@ follow.get("/requests", async (c) => {
       and(
         eq(follows.followingApId, actor.ap_id),
         eq(follows.status, "pending"),
+        operatorActorNotBlockedSql(sql`${follows.followerApId}`),
       ),
     )
     // followerApId is the PK discriminator (followingApId is fixed = me); add it
@@ -574,7 +580,7 @@ follow.get("/requests", async (c) => {
     const actorInfo = actorInfoMap.get(f.followerApId);
     return {
       ap_id: f.followerApId,
-      username: formatUsername(f.followerApId),
+      username: formatUsername(f.followerApId, actorInfo?.preferredUsername),
       preferred_username: actorInfo?.preferredUsername || null,
       name: actorInfo?.name || null,
       icon_url: actorInfo?.iconUrl || null,

package/src/backend/routes/media.ts

@@ -6,13 +6,12 @@ import {
   actors,
   communities,
   communityMembers,
-  follows,
   mediaUploads,
   objects,
 } from "../../db/index.ts";
-import { generateId, safeJsonParse } from "../federation-helpers.ts";
+import { generateId } from "../federation-helpers.ts";
 import { canViewerReadObject } from "../lib/community-visibility.ts";
-import { isExplicitRecipient } from "../lib/post-visibility.ts";
+import { canViewerReadObjectFull } from "../lib/post-visibility.ts";
 import { stripImageMetadata } from "../lib/strip-image-metadata.ts";
 import { logger } from "../lib/logger.ts";
 
@@ -311,6 +310,7 @@ type ReferencingObject = {
   visibility: string;
   toJson: string;
   ccJson: string;
+  audienceJson: string;
   communityApId: string | null;
   endTime: string | null;
 };
@@ -364,6 +364,7 @@ async function findReferencingObject(
       visibility: objects.visibility,
       toJson: objects.toJson,
       ccJson: objects.ccJson,
+      audienceJson: objects.audienceJson,
       communityApId: objects.communityApId,
       endTime: objects.endTime,
       attachmentsJson: objects.attachmentsJson,
@@ -389,6 +390,7 @@ async function findReferencingObject(
         visibility: row.visibility,
         toJson: row.toJson,
         ccJson: row.ccJson,
+        audienceJson: row.audienceJson,
         communityApId: row.communityApId,
         endTime: row.endTime,
       };
@@ -518,102 +520,26 @@ async function checkMediaAuthorization(
     return ALLOW_PRIVATE;
   }
 
-  // Stories are ephemeral (24h endTime). Once expired, the blob must not be
-  // served to anyone but the author (handled just above) — mirror the feed /
-  // single-object gates (gt(endTime, now)) so the media lifetime matches the
-  // content lifetime instead of lingering until the best-effort reap fires.
-  if (
-    obj.type === "Story" &&
-    obj.endTime &&
-    obj.endTime <= new Date().toISOString()
-  ) {
+  // Delegate object reach to the same gate used by post detail, replies,
+  // interactions and ActivityPub object reads. This includes community scope,
+  // Story expiry, accepted follows, visible to/cc recipients, and private
+  // bto/bcc recipient projections. Keeping one authority prevents the post body
+  // and its attachment from disagreeing about who may read them.
+  if (!(await canViewerReadObjectFull(db, obj, currentActorApId))) {
     return currentActorApId ? DENY_NOT_AUTHORIZED : DENY_AUTH_REQUIRED;
   }
 
-  // Community-scoped media (a Story / community post is stored
-  // `visibility = "public"` but addressed to a community): a PRIVATE community's
-  // blob must stay members-only, so the world-readable `ALLOW_PUBLIC` below
-  // would leak it. `canViewerReadObject` short-circuits to true for
-  // public / non-community objects (never widening access) and gates a private
-  // community on membership. Served PRIVATE (no shared cache) so a
-  // member-fetched private blob is never replayed to a non-member from CDN cache.
-  if (obj.communityApId) {
-    const allowed = await canViewerReadObject(
-      db,
-      { communityApId: obj.communityApId },
-      currentActorApId,
-    );
-    if (!allowed) {
-      return currentActorApId ? DENY_NOT_AUTHORIZED : DENY_AUTH_REQUIRED;
-    }
-    // Community membership is necessary but NOT sufficient: a community post
-    // created with visibility=followers/direct must ALSO pass that per-post gate
-    // so this blob matches the post-detail / outbox / feed gates (which all
-    // follower-gate such a post). Public / unlisted / Story community posts are
-    // member-readable; followers/direct fall through to the gates below.
-    if (obj.visibility !== "followers" && obj.visibility !== "direct") {
-      return ALLOW_PRIVATE;
-    }
-  }
-
-  // A personal Story is stored visibility="public" but its REACH is the author's
-  // followers (addressed to=<actor>/followers; it only surfaces in followers'
-  // story feed). The public short-circuit below would make its media blob
-  // world-readable to anyone with the URL, so gate it on follower status like a
-  // followers-only post. (Community stories were gated by the branch above; the
-  // author by the branch above that.)
-  if (obj.type === "Story") {
-    if (!currentActorApId) return DENY_AUTH_REQUIRED;
-    const follow = await db
-      .select()
-      .from(follows)
-      .where(
-        and(
-          eq(follows.followerApId, currentActorApId),
-          eq(follows.followingApId, obj.attributedTo),
-          eq(follows.status, "accepted"),
-        ),
-      )
-      .get();
-    return follow ? ALLOW_PRIVATE : DENY_NOT_AUTHORIZED;
-  }
-
-  if (obj.visibility === "public" || obj.visibility === "unlisted") {
+  // Only ordinary world-readable objects may use shared/public caching.
+  // Community content and Stories remain private-cache responses even when the
+  // canonical gate admits the current viewer.
+  if (
+    !obj.communityApId &&
+    obj.type !== "Story" &&
+    (obj.visibility === "public" || obj.visibility === "unlisted")
+  ) {
     return ALLOW_PUBLIC;
   }
-
-  // Non-public content requires authentication
-  if (!currentActorApId) return DENY_AUTH_REQUIRED;
-
-  if (obj.visibility === "followers") {
-    // An explicitly-addressed (to/cc) recipient — e.g. a mention — reads it even
-    // without a follow edge, matching the canonical canViewerReadObjectFull gate
-    // (this branch previously ignored to/cc and 403'd the blob for a legit
-    // recipient the post-detail view showed).
-    if (isExplicitRecipient(obj, currentActorApId)) return ALLOW_PRIVATE;
-    const follow = await db
-      .select()
-      .from(follows)
-      .where(
-        and(
-          eq(follows.followerApId, currentActorApId),
-          eq(follows.followingApId, obj.attributedTo),
-          eq(follows.status, "accepted"),
-        ),
-      )
-      .get();
-    return follow ? ALLOW_PRIVATE : DENY_NOT_AUTHORIZED;
-  }
-
-  if (obj.visibility === "direct") {
-    // Check both to AND cc (the canonical gate does), not toJson alone.
-    return isExplicitRecipient(obj, currentActorApId)
-      ? ALLOW_PRIVATE
-      : DENY_NOT_AUTHORIZED;
-  }
-
-  // Unknown visibility - deny by default
-  return DENY_NOT_AUTHORIZED;
+  return ALLOW_PRIVATE;
 }
 
 async function serveMediaByR2Key(c: MediaContext, r2Key: string) {