@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/moderation.ts

@@ -28,6 +28,8 @@ import {
 import {
   blockActor,
   blockDomain,
+  domainSuffixCandidates,
+  normalizeDomain,
   unblockActor,
   unblockDomain,
 } from "../lib/blocklist.ts";
@@ -91,6 +93,29 @@ function readReason(body: unknown): string | null {
   return typeof reason === "string" && reason.length > 0 ? reason : null;
 }
 
+function domainBlockCoversLocalHost(
+  domainOrUrl: string,
+  appUrl: string,
+): boolean {
+  const requestedDomain = normalizeDomain(domainOrUrl);
+  const localDomain = normalizeDomain(appUrl);
+  return (
+    requestedDomain !== null &&
+    localDomain !== null &&
+    domainSuffixCandidates(localDomain).includes(requestedDomain)
+  );
+}
+
+function actorBlockTargetsLocalHost(
+  actorApId: string,
+  appUrl: string,
+): boolean {
+  if (isLocal(actorApId, appUrl)) return true;
+  const actorDomain = normalizeDomain(actorApId);
+  const localDomain = normalizeDomain(appUrl);
+  return actorDomain !== null && actorDomain === localDomain;
+}
+
 // ---------------------------------------------------------------------------
 // Blocked domains
 // ---------------------------------------------------------------------------
@@ -125,6 +150,14 @@ moderationRoutes.post("/domains", async (c) => {
 
   const parsed = await readApIdBody(c, "domain");
   if ("error" in parsed) return parsed.error;
+  // A domain block immediately purges already-ingested content. Blocking the
+  // local host (or one of its parent domains) would therefore turn an operator
+  // typo into irreversible deletion of local posts and Activity rows. Reject
+  // before writing the blocklist row; this is a destructive safety boundary,
+  // not merely a delivery preference.
+  if (domainBlockCoversLocalHost(parsed.value, c.env.APP_URL)) {
+    return c.json({ error: "Cannot block the local domain" }, 400);
+  }
 
   try {
     await blockDomain(c.get("db"), parsed.value, readReason(parsed.body));
@@ -133,8 +166,24 @@ moderationRoutes.post("/domains", async (c) => {
   }
   // Defederation also purges the domain's already-ingested content so it stops
   // being served (the blocklist is otherwise ingest/delivery-only).
-  await purgeDomainContent(c.get("db"), parsed.value, c.env.MEDIA);
-  return c.json({ success: true });
+  const purge = await purgeDomainContent(
+    c.get("db"),
+    parsed.value,
+    c.env.MEDIA,
+  );
+  if (!purge.complete) {
+    c.header("Retry-After", "1");
+    return c.json(
+      {
+        error:
+          "Domain block is active, but retained content cleanup did not finish. Retry this block to complete cleanup.",
+        block_applied: true,
+        cleanup_complete: false,
+      },
+      503,
+    );
+  }
+  return c.json({ success: true, cleanup_complete: true });
 });
 
 moderationRoutes.delete("/domains", async (c) => {
@@ -186,6 +235,13 @@ moderationRoutes.post("/actors", async (c) => {
 
   const parsed = await readApIdBody(c, "ap_id");
   if ("error" in parsed) return parsed.error;
+  // Operator actor blocks use the same destructive retained-content purge.
+  // They are only for remote actors; never let a local AP ID reach the block
+  // mutation or purge path. The normalized-host check also catches cosmetic
+  // trailing-root-dot spellings that URL-origin comparison alone misses.
+  if (actorBlockTargetsLocalHost(parsed.value, c.env.APP_URL)) {
+    return c.json({ error: "Cannot block a local actor" }, 400);
+  }
 
   try {
     await blockActor(c.get("db"), parsed.value, readReason(parsed.body));
@@ -193,8 +249,20 @@ moderationRoutes.post("/actors", async (c) => {
     return c.json({ error: "Invalid actor" }, 400);
   }
   // Purge the blocked actor's already-ingested content so it stops being served.
-  await purgeActorContent(c.get("db"), parsed.value, c.env.MEDIA);
-  return c.json({ success: true });
+  const purge = await purgeActorContent(c.get("db"), parsed.value, c.env.MEDIA);
+  if (!purge.complete) {
+    c.header("Retry-After", "1");
+    return c.json(
+      {
+        error:
+          "Actor block is active, but retained content cleanup did not finish. Retry this block to complete cleanup.",
+        block_applied: true,
+        cleanup_complete: false,
+      },
+      503,
+    );
+  }
+  return c.json({ success: true, cleanup_complete: true });
 });
 
 moderationRoutes.delete("/actors", async (c) => {

package/src/backend/routes/notes.ts

@@ -5,7 +5,7 @@ import type { SQL } from "drizzle-orm";
 import { actorNotes, actors, follows, type Database } from "../../db/index.ts";
 import type { Env, Variables } from "../types.ts";
 import { formatUsername } from "../federation-helpers.ts";
-import { excludeBlockedMutedAuthors } from "../lib/feed-exclude.ts";
+import { excludeModeratedActors } from "../lib/feed-exclude.ts";
 
 const notes = new Hono<{ Bindings: Env; Variables: Variables }>();
 
@@ -64,7 +64,7 @@ function formatNote(row: NoteRow, viewerApId: string): NoteResponse {
   return {
     actor: {
       ap_id: row.actorApId,
-      username: formatUsername(row.actorApId),
+      username: formatUsername(row.actorApId, row.preferredUsername),
       preferred_username: row.preferredUsername,
       name: row.name,
       icon_url: row.iconUrl,
@@ -98,8 +98,7 @@ async function loadActiveNotes(
       inArray(actorNotes.actorApId, followingSubquery),
     )!,
   ];
-  const excludeAuthors = excludeBlockedMutedAuthors(
-    db,
+  const excludeAuthors = excludeModeratedActors(
     viewerApId,
     actorNotes.actorApId,
   );

package/src/backend/routes/notifications.ts

@@ -11,6 +11,7 @@ import {
   isNull,
   lt,
   or,
+  sql,
   type SQL,
 } from "drizzle-orm";
 import type { Env, Variables } from "../types.ts";
@@ -22,9 +23,11 @@ import {
 import type { Database } from "../../db/index.ts";
 import {
   activities,
+  affectedRowCount,
   follows,
   inbox as inboxTable,
   notificationArchived,
+  objectRecipients,
   objects,
 } from "../../db/index.ts";
 import { batchLoadActorInfo } from "./communities/membership-shared.ts";
@@ -39,6 +42,7 @@ import {
   emitUnreadSnapshot,
   runRealtimeAfterResponse,
 } from "../runtime/realtime-hub.ts";
+import { passesPostVisibilitySync } from "../lib/post-visibility.ts";
 
 const notifications = new Hono<{ Bindings: Env; Variables: Variables }>();
 
@@ -49,14 +53,43 @@ const ARCHIVED_CLEANUP_INTERVAL_MS = 5 * 60 * 1000;
 // at 100 bound parameters (libsql, used by tests, allows ~32k and hides this).
 const MAX_ARCHIVE_BATCH_SIZE = 90;
 const MAX_READ_BATCH_SIZE = 90;
-// Multi-row INSERT chunk: each archive row binds 3 columns, so a chunk of N
-// rows uses 3*N bound params. 30*3 = 90, under D1's 100-param ceiling.
+// INSERT ... SELECT chunk: each requested id is one bind, plus actor + archive
+// timestamp. Keep the established 30-id chunk comfortably under D1's
+// 100-parameter ceiling.
 const ARCHIVE_CREATE_BATCH_SIZE = 30;
 // Bound the opportunistic retention-cleanup per run so a user with a very large
 // archived backlog doesn't load + delete it all in one fired-from-read-path run;
 // the rest drains on later runs.
 const ARCHIVE_CLEANUP_BATCH = 200;
-const ARCHIVE_ALL_CAP = 1000;
+
+type ParsedNotificationIds =
+  | { readonly ok: true; readonly ids: string[] }
+  | { readonly ok: false; readonly reason: "invalid" | "too_long" };
+
+/**
+ * Runtime owner for notification mutation ID lists. JSON generic arguments do
+ * not validate input, and passing a string or mixed array to Drizzle's
+ * `inArray` can become a 500 or a partially applied write. Normalizing here
+ * keeps read, archive, and unarchive on one pre-write contract.
+ */
+function parseNotificationIds(
+  value: unknown,
+  maxSize: number,
+): ParsedNotificationIds {
+  if (!Array.isArray(value) || value.length === 0) {
+    return { ok: false, reason: "invalid" };
+  }
+  if (value.length > maxSize) {
+    return { ok: false, reason: "too_long" };
+  }
+  if (value.some((id) => typeof id !== "string" || id.trim().length === 0)) {
+    return { ok: false, reason: "invalid" };
+  }
+  return {
+    ok: true,
+    ids: [...new Set(value.map((id) => (id as string).trim()))],
+  };
+}
 
 /**
  * Tracks the last cleanup timestamp per actor so cleanup is throttled to one
@@ -93,28 +126,111 @@ export const __archivedCleanupInternals = {
 };
 
 /**
- * Batch-insert archive rows with unique-constraint tolerance.
+ * Materialize archive markers only from rows in the authenticated actor's
+ * retained inbox. Keeping eligibility and insertion in the same statement
+ * prevents foreign, missing, or concurrently removed inbox rows from becoming
+ * durable markers. The unique constraint makes retries idempotent.
+ *
  * Returns the number of rows actually inserted.
  */
 async function batchArchiveInsert(
   db: Database,
-  rows: Array<{ actorApId: string; activityApId: string; archivedAt: string }>,
+  actorApId: string,
+  activityApIds: string[],
+  archivedAt: string,
   batchSize: number,
 ): Promise<number> {
   let inserted = 0;
 
-  for (let i = 0; i < rows.length; i += batchSize) {
-    const batch = rows.slice(i, i + batchSize);
+  for (let i = 0; i < activityApIds.length; i += batchSize) {
+    const batch = activityApIds.slice(i, i + batchSize);
+    const candidates = db
+      .select({
+        actorApId: inboxTable.actorApId,
+        activityApId: inboxTable.activityApId,
+        archivedAt: sql<string>`${archivedAt}`.as("archived_at"),
+      })
+      .from(inboxTable)
+      .where(
+        and(
+          eq(inboxTable.actorApId, actorApId),
+          inArray(inboxTable.activityApId, batch),
+        ),
+      );
     const result = await db
       .insert(notificationArchived)
-      .values(batch)
+      .select(candidates)
       .onConflictDoNothing();
-    inserted += (result as { meta?: { changes?: number } }).meta?.changes ?? 0;
+    inserted += affectedRowCount(result);
   }
 
   return inserted;
 }
 
+/**
+ * Archive the authenticated actor's complete retained inbox as one set-based
+ * authority transition. A client-side or server-side page loop would expose a
+ * partial-success state between batches; INSERT ... SELECT gives SQLite/D1 one
+ * atomic statement, binds only actor + timestamp, and stays idempotent under
+ * retries through the archive primary key.
+ */
+async function archiveAllInboxRows(
+  db: Database,
+  actorApId: string,
+  archivedAt: string,
+): Promise<number> {
+  const candidates = db
+    .select({
+      actorApId: inboxTable.actorApId,
+      activityApId: inboxTable.activityApId,
+      archivedAt: sql<string>`${archivedAt}`.as("archived_at"),
+    })
+    .from(inboxTable)
+    .where(eq(inboxTable.actorApId, actorApId));
+  const result = await db
+    .insert(notificationArchived)
+    .select(candidates)
+    .onConflictDoNothing();
+  return affectedRowCount(result);
+}
+
+/**
+ * Mark every currently visible social notification read using the same
+ * authority predicate as the list and unread badge. Inbox also retains rows
+ * for DMs, archived history, self activity, and non-user-facing ActivityPub
+ * types; a broad actor-only UPDATE would silently mutate those other domains.
+ */
+async function markAllEligibleNotificationsRead(
+  db: Database,
+  actorApId: string,
+): Promise<void> {
+  const eligibleActivityIds = db
+    .select({ activityApId: inboxTable.activityApId })
+    .from(inboxTable)
+    .innerJoin(activities, eq(inboxTable.activityApId, activities.apId))
+    .leftJoin(objects, eq(activities.objectApId, objects.apId))
+    .where(
+      and(
+        eq(inboxTable.actorApId, actorApId),
+        eq(inboxTable.read, 0),
+        ...notificationEligibilityWhere(db, actorApId, {
+          direct: "exclude",
+        }),
+      ),
+    );
+
+  await db
+    .update(inboxTable)
+    .set({ read: 1 })
+    .where(
+      and(
+        eq(inboxTable.actorApId, actorApId),
+        eq(inboxTable.read, 0),
+        inArray(inboxTable.activityApId, eligibleActivityIds),
+      ),
+    );
+}
+
 async function cleanupArchivedNotifications(
   db: Database,
   actorApId: string,
@@ -383,6 +499,9 @@ notifications.get("/", async (c) => {
             communityApId: objects.communityApId,
             visibility: objects.visibility,
             attributedTo: objects.attributedTo,
+            toJson: objects.toJson,
+            ccJson: objects.ccJson,
+            endTime: objects.endTime,
           })
           .from(objects)
           .where(inArray(objects.apId, objectApIds))
@@ -411,7 +530,10 @@ notifications.get("/", async (c) => {
     ...new Set(
       objectRows
         .filter(
-          (o) => o.visibility === "followers" && o.attributedTo !== actor.ap_id,
+          (o) =>
+            o.attributedTo !== actor.ap_id &&
+            ((o.type === "Story" && !o.communityApId) ||
+              (o.type !== "Story" && o.visibility === "followers")),
         )
         .map((o) => o.attributedTo),
     ),
@@ -434,22 +556,46 @@ notifications.get("/", async (c) => {
         )
       : new Set<string>();
 
-  const followersGateAllows = (o: {
-    visibility: string;
-    attributedTo: string;
-  }): boolean => {
-    if (o.visibility !== "followers") return true;
-    return (
-      o.attributedTo === actor.ap_id || followedAuthors.has(o.attributedTo)
-    );
-  };
+  const projectionCandidates = objectRows
+    .filter(
+      (o) =>
+        o.attributedTo !== actor.ap_id &&
+        (o.visibility === "followers" || o.visibility === "direct"),
+    )
+    .map((o) => o.apId);
+  const projectedRecipientIds =
+    projectionCandidates.length > 0
+      ? new Set(
+          (
+            await db
+              .select({ objectApId: objectRecipients.objectApId })
+              .from(objectRecipients)
+              .where(
+                and(
+                  eq(objectRecipients.recipientApId, actor.ap_id),
+                  eq(objectRecipients.type, "to"),
+                  inArray(objectRecipients.objectApId, projectionCandidates),
+                ),
+              )
+          ).map((row) => row.objectApId),
+        )
+      : new Set<string>();
+
+  const visibilityReadableRows = objectRows.filter((object) =>
+    passesPostVisibilitySync(
+      object,
+      actor.ap_id,
+      (authorApId) => followedAuthors.has(authorApId),
+      (objectApId) => projectedRecipientIds.has(objectApId),
+    ),
+  );
 
   // Apply the synchronous followers-gate first, then resolve the community
   // read-gate for all survivors in ONE batched call (2 queries) rather than
   // 1-2 queries per row.
   const readableObjectIds = await communityReadableApIds(
     db,
-    objectRows.filter(followersGateAllows),
+    visibilityReadableRows,
     actor.ap_id,
   );
 
@@ -522,7 +668,10 @@ notifications.get("/", async (c) => {
       created_at: entry.createdAt,
       actor: {
         ap_id: entry.activityActorApId,
-        username: formatUsername(entry.activityActorApId),
+        username: formatUsername(
+          entry.activityActorApId,
+          actorInfo?.preferredUsername,
+        ),
         preferred_username: actorInfo?.preferredUsername ?? null,
         name: actorInfo?.name ?? null,
         icon_url: actorInfo?.iconUrl ?? null,
@@ -585,23 +734,31 @@ notifications.post("/read", async (c) => {
   if (actor instanceof Response) return actor;
 
   const db = c.get("db");
-  // A literal `null`/primitive JSON body parses without throwing, then field
-  // access throws a TypeError that the global handler maps to 500 (not 400).
-  // Guard the body shape so a malformed request is a clean 400.
-  const body = await c.req
-    .json<{ ids?: string[]; read_all?: boolean }>()
-    .catch(() => null);
-  if (!body || typeof body !== "object") {
+  // JSON's static type parameter is not runtime validation. Accept exactly one
+  // operation and validate every value before any write, so truthy strings or
+  // mixed arrays cannot trigger a broad or partially applied update.
+  const body = await c.req.json<Record<string, unknown>>().catch(() => null);
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
     return c.json({ error: "Invalid request body" }, 400);
   }
 
-  if (body.read_all) {
-    await db
-      .update(inboxTable)
-      .set({ read: 1 })
-      .where(eq(inboxTable.actorApId, actor.ap_id));
-  } else if (body.ids && body.ids.length > 0) {
-    if (body.ids.length > MAX_READ_BATCH_SIZE) {
+  const hasReadAll = Object.hasOwn(body, "read_all");
+  const hasIds = Object.hasOwn(body, "ids");
+  if (hasReadAll === hasIds) {
+    return c.json({ error: "Exactly one of ids or read_all is required" }, 400);
+  }
+
+  if (hasReadAll) {
+    if (body.read_all !== true) {
+      return c.json({ error: "read_all must be true" }, 400);
+    }
+    await markAllEligibleNotificationsRead(db, actor.ap_id);
+  } else {
+    const parsedIds = parseNotificationIds(body.ids, MAX_READ_BATCH_SIZE);
+    if (!parsedIds.ok && parsedIds.reason === "invalid") {
+      return c.json({ error: "ids must be a non-empty array of strings" }, 400);
+    }
+    if (!parsedIds.ok) {
       return c.json(
         {
           error: "array_too_long",
@@ -616,14 +773,9 @@ notifications.post("/read", async (c) => {
       .where(
         and(
           eq(inboxTable.actorApId, actor.ap_id),
-          inArray(inboxTable.activityApId, body.ids),
+          inArray(inboxTable.activityApId, parsedIds.ids),
         ),
       );
-  } else {
-    return c.json(
-      { error: "Either ids array or read_all flag is required" },
-      400,
-    );
   }
 
   // Sync the reader's OTHER tabs/devices: push the fresh authoritative badge.
@@ -640,20 +792,16 @@ notifications.post("/archive", async (c) => {
   if (actor instanceof Response) return actor;
 
   const db = c.get("db");
-  const body = await c.req.json<{ ids: string[] }>().catch(() => null);
-  if (!body || typeof body !== "object") {
+  const body = await c.req.json<Record<string, unknown>>().catch(() => null);
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
     return c.json({ error: "Invalid request body" }, 400);
   }
 
-  if (
-    !body.ids ||
-    !Array.isArray(body.ids) ||
-    body.ids.length === 0 ||
-    body.ids.some((id) => typeof id !== "string" || id.trim().length === 0)
-  ) {
+  const parsedIds = parseNotificationIds(body.ids, MAX_ARCHIVE_BATCH_SIZE);
+  if (!parsedIds.ok && parsedIds.reason === "invalid") {
     return c.json({ error: "ids array is required" }, 400);
   }
-  if (body.ids.length > MAX_ARCHIVE_BATCH_SIZE) {
+  if (!parsedIds.ok) {
     return c.json(
       {
         error: `Batch size exceeds maximum of ${MAX_ARCHIVE_BATCH_SIZE}`,
@@ -663,30 +811,12 @@ notifications.post("/archive", async (c) => {
   }
 
   const now = new Date().toISOString();
-  const uniqueIds = [...new Set(body.ids.map((id) => id.trim()))];
 
-  const alreadyArchived = await db
-    .select({ activityApId: notificationArchived.activityApId })
-    .from(notificationArchived)
-    .where(
-      and(
-        eq(notificationArchived.actorApId, actor.ap_id),
-        inArray(notificationArchived.activityApId, uniqueIds),
-      ),
-    );
-  const alreadyArchivedSet = new Set(
-    alreadyArchived.map((row) => row.activityApId),
-  );
-  const toArchive = uniqueIds.filter((id) => !alreadyArchivedSet.has(id));
-
-  const rows = toArchive.map((id) => ({
-    actorApId: actor.ap_id,
-    activityApId: id,
-    archivedAt: now,
-  }));
   const archived_count = await batchArchiveInsert(
     db,
-    rows,
+    actor.ap_id,
+    parsedIds.ids,
+    now,
     ARCHIVE_CREATE_BATCH_SIZE,
   );
 
@@ -704,14 +834,16 @@ notifications.delete("/archive", async (c) => {
   if (actor instanceof Response) return actor;
 
   const db = c.get("db");
-  const body = await c.req.json<{ ids: string[] }>().catch(() => null);
-  if (!body || typeof body !== "object") {
+  const body = await c.req.json<Record<string, unknown>>().catch(() => null);
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
     return c.json({ error: "Invalid request body" }, 400);
   }
-  if (!body.ids || body.ids.length === 0) {
+
+  const parsedIds = parseNotificationIds(body.ids, MAX_ARCHIVE_BATCH_SIZE);
+  if (!parsedIds.ok && parsedIds.reason === "invalid") {
     return c.json({ error: "ids array is required" }, 400);
   }
-  if (body.ids.length > MAX_ARCHIVE_BATCH_SIZE) {
+  if (!parsedIds.ok) {
     return c.json(
       {
         error: "array_too_long",
@@ -726,7 +858,7 @@ notifications.delete("/archive", async (c) => {
     .where(
       and(
         eq(notificationArchived.actorApId, actor.ap_id),
-        inArray(notificationArchived.activityApId, body.ids),
+        inArray(notificationArchived.activityApId, parsedIds.ids),
       ),
     );
 
@@ -745,38 +877,7 @@ notifications.post("/archive/all", async (c) => {
 
   const db = c.get("db");
   const now = new Date().toISOString();
-
-  const [alreadyArchived, inboxItems] = await Promise.all([
-    db
-      .select({ activityApId: notificationArchived.activityApId })
-      .from(notificationArchived)
-      .where(eq(notificationArchived.actorApId, actor.ap_id))
-      .limit(ARCHIVE_ALL_CAP),
-    db
-      .select({ activityApId: inboxTable.activityApId })
-      .from(inboxTable)
-      .where(eq(inboxTable.actorApId, actor.ap_id))
-      .limit(ARCHIVE_ALL_CAP),
-  ]);
-
-  const alreadyArchivedIds = new Set(
-    alreadyArchived.map((a) => a.activityApId),
-  );
-  const toArchive = inboxItems.filter(
-    (item) => !alreadyArchivedIds.has(item.activityApId),
-  );
-
-  const rows = toArchive.map((item) => ({
-    actorApId: actor.ap_id,
-    activityApId: item.activityApId,
-    archivedAt: now,
-  }));
-
-  const archived_count = await batchArchiveInsert(
-    db,
-    rows,
-    ARCHIVE_CREATE_BATCH_SIZE,
-  );
+  const archived_count = await archiveAllInboxRows(db, actor.ap_id, now);
 
   // Archive-all clears the whole badge; sync the reader's other tabs/devices.
   await runRealtimeAfterResponse(c, () =>