@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/routes/posts/interactions.ts

@@ -11,6 +11,7 @@ import {
   follows,
   inbox as inboxTable,
   likes,
+  objectRecipients,
   objects,
 } from "../../../db/index.ts";
 import { and, desc, eq, gt, inArray, or, sql } from "drizzle-orm";
@@ -38,6 +39,11 @@ import {
   passesPostVisibilitySync,
 } from "../../lib/post-visibility.ts";
 import { logger } from "../../lib/logger.ts";
+import { excludeModeratedActors } from "../../lib/feed-exclude.ts";
+import { isActorBlockedStrict } from "../../lib/blocklist.ts";
+import { activityDeleteCascadeStatements } from "../../lib/activity-delete-cascade.ts";
+import { setPostLike } from "./like-mutation.ts";
+import { prepareDeliveryFanoutJob } from "../../lib/delivery/fanout-outbox.ts";
 
 const log = logger.child({ component: "posts.interactions" });
 
@@ -113,6 +119,29 @@ async function deliverToRemote(
   }
 }
 
+async function publishDurableFollowerFanoutWakeup(
+  env: Env,
+  activityId: string,
+  actorApId: string,
+  operation: "repost" | "unrepost",
+): Promise<void> {
+  try {
+    await enqueueFanoutToFollowers(env, activityId, actorApId);
+  } catch (error) {
+    // The route has already committed the interaction, Activity, and fanout
+    // intent atomically. A Queue RPC is only a wakeup; leave the row pending so
+    // scheduled/startup recovery can publish it without turning a successful
+    // user mutation into a misleading HTTP 500.
+    log.error("Failed to publish durable repost fanout wakeup", {
+      event: "posts.repost.fanout_wakeup_failed",
+      operation,
+      activityId,
+      actor: actorApId,
+      error,
+    });
+  }
+}
+
 /**
  * Atomic multi-statement commit.
  *
@@ -148,7 +177,6 @@ posts.post("/:id/like", async (c) => {
   if (!post) return c.json({ error: "Post not found" }, 404);
 
   const db = c.get("db");
-  const baseUrl = c.env.APP_URL;
 
   // Only a post the actor can actually read may be liked: without this an authed
   // user who learns a post's apId could "like" a followers-only / direct /
@@ -165,77 +193,14 @@ posts.post("/:id/like", async (c) => {
     return c.json({ error: "Post not found" }, 404);
   }
 
-  const existingLike = await db
-    .select({ actorApId: likes.actorApId })
-    .from(likes)
-    .where(
-      and(eq(likes.actorApId, actor.ap_id), eq(likes.objectApId, post.apId)),
-    )
-    .get();
-  if (existingLike) return c.json({ error: "Already liked" }, 400);
-
-  const likeId = generateId();
-  const likeActivityId = activityApId(baseUrl, likeId);
-  const likeActivityRaw = {
-    "@context": "https://www.w3.org/ns/activitystreams",
-    id: likeActivityId,
-    type: "Like",
-    actor: actor.ap_id,
-    object: post.apId,
-  };
-  const now = new Date().toISOString();
-  const shouldNotifyLocal =
-    post.attributedTo !== actor.ap_id && isLocal(post.attributedTo, baseUrl);
-
-  // D1 has no interactive transactions; group the child-row insert, counter
-  // bump, activity row, and (optional) inbox row into a single atomic batch so
-  // the like row and likeCount can never diverge on a mid-request failure.
-  const likeStatements: BatchStatement[] = [
-    db.insert(likes).values({
-      actorApId: actor.ap_id,
-      objectApId: post.apId,
-      activityApId: likeActivityId,
-    }),
-    db
-      .update(objects)
-      .set({ likeCount: sql`${objects.likeCount} + 1` })
-      .where(eq(objects.apId, post.apId)),
-    db.insert(activities).values({
-      apId: likeActivityId,
-      type: "Like",
-      actorApId: actor.ap_id,
-      objectApId: post.apId,
-      rawJson: JSON.stringify(likeActivityRaw),
-      createdAt: now,
-    }),
-  ];
-
-  if (shouldNotifyLocal) {
-    likeStatements.push(
-      db.insert(inboxTable).values({
-        actorApId: post.attributedTo,
-        activityApId: likeActivityId,
-        read: 0,
-        createdAt: now,
-      }),
-    );
-  }
-
-  try {
-    await runBatch(db, likeStatements as [BatchStatement, ...BatchStatement[]]);
-  } catch (e) {
-    // Two concurrent likes (two tabs / a retried slow request) both pass the
-    // SELECT above; the loser's composite-PK insert hits a UNIQUE constraint.
-    // That is the idempotent "already liked" case, not a 500.
-    if (isUniqueConstraintError(e)) {
-      return c.json({ error: "Already liked" }, 400);
-    }
-    throw e;
-  }
-
-  if (!isLocal(post.apId, baseUrl)) {
-    await deliverToRemote(c.env, likeActivityId, post.attributedTo);
-  }
+  const result = await setPostLike({
+    db,
+    env: c.env,
+    actorApId: actor.ap_id,
+    post,
+    active: true,
+  });
+  if (!result.changed) return c.json({ error: "Already liked" }, 400);
 
   return c.json({ success: true, liked: true });
 });
@@ -248,76 +213,15 @@ posts.delete("/:id/like", async (c) => {
   if (!post) return c.json({ error: "Post not found" }, 404);
 
   const db = c.get("db");
-  const baseUrl = c.env.APP_URL;
-
-  const like = await db
-    .select({
-      actorApId: likes.actorApId,
-      activityApId: likes.activityApId,
-    })
-    .from(likes)
-    .where(
-      and(eq(likes.actorApId, actor.ap_id), eq(likes.objectApId, post.apId)),
-    )
-    .get();
-  if (!like) return c.json({ error: "Not liked" }, 400);
-
-  // D1 has no interactive transactions; group the like-row delete and the
-  // counter decrement into a single atomic batch so they cannot diverge. Also
-  // reap the original like's notification: the like mints a FRESH activity id
-  // each time and the dedup guard only checks the `likes` edge, so without this
-  // a like→unlike→like cycle would leave the first notification behind and add a
-  // second — duplicate "X liked your post" rows (and a phantom unread +1). The
-  // inbound-federated path already gates its notify on the existing edge; this
-  // gives the local path the same idempotency.
-  const reapLikeNotification: BatchStatement[] = like.activityApId
-    ? [
-        db
-          .delete(inboxTable)
-          .where(eq(inboxTable.activityApId, like.activityApId)),
-        db.delete(activities).where(eq(activities.apId, like.activityApId)),
-      ]
-    : [];
-  await runBatch(db, [
-    db
-      .delete(likes)
-      .where(
-        and(eq(likes.actorApId, actor.ap_id), eq(likes.objectApId, post.apId)),
-      ),
-    db
-      .update(objects)
-      .set({ likeCount: sql`${objects.likeCount} - 1` })
-      .where(and(eq(objects.apId, post.apId), gt(objects.likeCount, 0))),
-    ...reapLikeNotification,
-  ]);
-
-  if (!isLocal(post.apId, baseUrl)) {
-    const undoObject = like.activityApId
-      ? like.activityApId
-      : { type: "Like", actor: actor.ap_id, object: post.apId };
-
-    const undoActivity = {
-      "@context": "https://www.w3.org/ns/activitystreams",
-      id: activityApId(baseUrl, generateId()),
-      type: "Undo",
-      actor: actor.ap_id,
-      object: undoObject,
-    };
 
-    await db
-      .insert(activities)
-      .values({
-        apId: undoActivity.id,
-        type: "Undo",
-        actorApId: actor.ap_id,
-        objectApId: post.apId,
-        rawJson: JSON.stringify(undoActivity),
-        direction: "outbound",
-      })
-      .onConflictDoNothing();
-
-    await deliverToRemote(c.env, undoActivity.id, post.attributedTo);
-  }
+  const result = await setPostLike({
+    db,
+    env: c.env,
+    actorApId: actor.ap_id,
+    post,
+    active: false,
+  });
+  if (!result.changed) return c.json({ error: "Not liked" }, 400);
 
   return c.json({ success: true, liked: false });
 });
@@ -336,6 +240,13 @@ posts.post("/:id/repost", async (c) => {
   const db = c.get("db");
   const baseUrl = c.env.APP_URL;
 
+  // Repost has a public-reach gate rather than the canonical read gate below,
+  // so enforce instance moderation explicitly before it can persist/fan out an
+  // Announce for a retained object from a defederated actor/domain.
+  if (await isActorBlockedStrict(db, post.attributedTo)) {
+    return c.json({ error: "Post not found" }, 404);
+  }
+
   // A repost is always an Announce addressed to Public + the booster's
   // followers (see the activity built below), so it re-broadcasts the object to
   // a wider audience than the original. Only a post whose reach is ALREADY
@@ -387,6 +298,11 @@ posts.post("/:id/repost", async (c) => {
   const now = new Date().toISOString();
   const shouldNotifyLocal =
     post.attributedTo !== actor.ap_id && isLocal(post.attributedTo, baseUrl);
+  const preparedFanout = await prepareDeliveryFanoutJob(db, {
+    kind: "followers",
+    activityId: announceActivityId,
+    targetApId: actor.ap_id,
+  });
 
   // D1 has no interactive transactions; group the child-row insert, counter
   // bump, activity row, and (optional) inbox row into a single atomic batch so
@@ -409,6 +325,7 @@ posts.post("/:id/repost", async (c) => {
       rawJson: JSON.stringify(announceActivityRaw),
       createdAt: now,
     }),
+    preparedFanout.statement as BatchStatement,
   ];
 
   if (shouldNotifyLocal) {
@@ -438,7 +355,12 @@ posts.post("/:id/repost", async (c) => {
   // The Announce is cc'd to the booster's own followers collection, so fan it
   // out to them — otherwise a repost only ever reached the original author's
   // inbox and was invisible to the booster's remote followers.
-  await enqueueFanoutToFollowers(c.env, announceActivityId, actor.ap_id);
+  await publishDurableFollowerFanoutWakeup(
+    c.env,
+    announceActivityId,
+    actor.ap_id,
+    "repost",
+  );
 
   if (!isLocal(post.apId, baseUrl)) {
     await deliverToRemote(c.env, announceActivityId, post.attributedTo);
@@ -472,17 +394,33 @@ posts.delete("/:id/repost", async (c) => {
     .get();
   if (!announce) return c.json({ error: "Not reposted" }, 400);
 
+  const undoActivity = {
+    "@context": "https://www.w3.org/ns/activitystreams",
+    id: activityApId(baseUrl, generateId()),
+    type: "Undo",
+    actor: actor.ap_id,
+    to: ["https://www.w3.org/ns/activitystreams#Public"],
+    cc: [actor.ap_id + "/followers"],
+    object: { type: "Announce", actor: actor.ap_id, object: post.apId },
+  };
+  const preparedFanout = await prepareDeliveryFanoutJob(db, {
+    kind: "followers",
+    activityId: undoActivity.id,
+    targetApId: actor.ap_id,
+  });
+
   // D1 has no interactive transactions; group the announce-row delete and the
   // counter decrement into a single atomic batch so they cannot diverge. Also
-  // reap the original repost's notification (same duplicate-notification issue
-  // as unlike: each repost mints a fresh Announce activity id and the guard only
-  // checks the edge, so repost→unrepost→repost would stack notifications).
+  // reap the original repost activity plus all durable projections (same
+  // duplicate-notification issue as unlike: each repost mints a fresh Announce
+  // activity id and the guard only checks the edge, so
+  // repost→unrepost→repost would stack notifications and queue residue).
   const reapRepostNotification: BatchStatement[] = announce.activityApId
     ? [
-        db
-          .delete(inboxTable)
-          .where(eq(inboxTable.activityApId, announce.activityApId)),
-        db.delete(activities).where(eq(activities.apId, announce.activityApId)),
+        ...activityDeleteCascadeStatements(
+          db,
+          eq(activities.apId, announce.activityApId),
+        ),
       ]
     : [];
   await runBatch(db, [
@@ -499,33 +437,28 @@ posts.delete("/:id/repost", async (c) => {
       .set({ announceCount: sql`${objects.announceCount} - 1` })
       .where(and(eq(objects.apId, post.apId), gt(objects.announceCount, 0))),
     ...reapRepostNotification,
+    db
+      .insert(activities)
+      .values({
+        apId: undoActivity.id,
+        type: "Undo",
+        actorApId: actor.ap_id,
+        objectApId: post.apId,
+        rawJson: JSON.stringify(undoActivity),
+        direction: "outbound",
+      })
+      .onConflictDoNothing(),
+    preparedFanout.statement as BatchStatement,
   ]);
 
-  const undoActivity = {
-    "@context": "https://www.w3.org/ns/activitystreams",
-    id: activityApId(baseUrl, generateId()),
-    type: "Undo",
-    actor: actor.ap_id,
-    to: ["https://www.w3.org/ns/activitystreams#Public"],
-    cc: [actor.ap_id + "/followers"],
-    object: { type: "Announce", actor: actor.ap_id, object: post.apId },
-  };
-
-  await db
-    .insert(activities)
-    .values({
-      apId: undoActivity.id,
-      type: "Undo",
-      actorApId: actor.ap_id,
-      objectApId: post.apId,
-      rawJson: JSON.stringify(undoActivity),
-      direction: "outbound",
-    })
-    .onConflictDoNothing();
-
   // Mirror the Announce reach: the Undo must reach the booster's followers (who
   // saw the repost) regardless of whether the boosted post was local or remote.
-  await enqueueFanoutToFollowers(c.env, undoActivity.id, actor.ap_id);
+  await publishDurableFollowerFanoutWakeup(
+    c.env,
+    undoActivity.id,
+    actor.ap_id,
+    "unrepost",
+  );
 
   // The boosted post's author instance is only an extra recipient for a remote post.
   if (!isLocal(post.apId, baseUrl)) {
@@ -640,20 +573,28 @@ posts.get("/bookmarks", async (c) => {
   // Fetch limit+1 and advance the cursor by the last SCANNED row, so the
   // visibility gate dropping rows can only shorten a page, never make a readable
   // bookmark permanently unreachable (load-more continues past the dropped ones).
-  const scanned = await db.query.bookmarks.findMany({
-    where: cursorPredicate
-      ? and(eq(bookmarks.actorApId, actor.ap_id), cursorPredicate)
-      : eq(bookmarks.actorApId, actor.ap_id),
-    with: { object: true },
-    orderBy: [desc(bookmarks.createdAt), desc(bookmarks.objectApId)],
-    limit: limit + 1,
-  });
+  const scanned = await db
+    .select({ bookmark: bookmarks, object: objects })
+    .from(bookmarks)
+    .innerJoin(objects, eq(bookmarks.objectApId, objects.apId))
+    .where(
+      and(
+        eq(bookmarks.actorApId, actor.ap_id),
+        cursorPredicate,
+        excludeModeratedActors(actor.ap_id),
+      ),
+    )
+    .orderBy(desc(bookmarks.createdAt), desc(bookmarks.objectApId))
+    .limit(limit + 1);
   const hasMore = scanned.length > limit;
   const allBookmarkRows = hasMore ? scanned.slice(0, limit) : scanned;
   const lastScanned = allBookmarkRows[allBookmarkRows.length - 1];
   const nextCursor =
     hasMore && lastScanned
-      ? encodeFeedCursor(lastScanned.createdAt, lastScanned.objectApId)
+      ? encodeFeedCursor(
+          lastScanned.bookmark.createdAt,
+          lastScanned.bookmark.objectApId,
+        )
       : null;
 
   // Re-check read-access at read time so a bookmark can never resurface a post
@@ -700,11 +641,43 @@ posts.get("/bookmarks", async (c) => {
         )
       : new Set<string>();
 
+  // Hidden bto/bcc identities cannot live in to_json/cc_json. Resolve the
+  // indexed recipient projection once for this page so a hidden recipient who
+  // successfully bookmarked a readable post does not lose it on list refresh.
+  const projectedCandidateIds = allBookmarkRows
+    .filter(
+      (b) =>
+        b.object.attributedTo !== actor.ap_id &&
+        (b.object.visibility === "direct" ||
+          b.object.visibility === "followers"),
+    )
+    .map((b) => b.object.apId);
+  const projectedRecipientIds =
+    projectedCandidateIds.length > 0
+      ? new Set(
+          (
+            await db
+              .select({ objectApId: objectRecipients.objectApId })
+              .from(objectRecipients)
+              .where(
+                and(
+                  eq(objectRecipients.recipientApId, actor.ap_id),
+                  eq(objectRecipients.type, "to"),
+                  inArray(objectRecipients.objectApId, projectedCandidateIds),
+                ),
+              )
+          ).map((row) => row.objectApId),
+        )
+      : new Set<string>();
+
   // Sync visibility-gate first, then ONE batched community read-gate over the
   // survivors (2 queries instead of 1-2 per bookmarked post).
   const visibilityOk = allBookmarkRows.filter((b) =>
-    passesPostVisibilitySync(b.object, actor.ap_id, (a) =>
-      followedAuthors.has(a),
+    passesPostVisibilitySync(
+      b.object,
+      actor.ap_id,
+      (a) => followedAuthors.has(a),
+      (objectApId) => projectedRecipientIds.has(objectApId),
     ),
   );
   const communityReadable = await communityReadableApIds(
@@ -768,7 +741,10 @@ posts.get("/bookmarks", async (c) => {
       type: obj.type,
       author: {
         ap_id: obj.attributedTo,
-        username: formatUsername(obj.attributedTo),
+        username: formatUsername(
+          obj.attributedTo,
+          authorInfo?.preferredUsername,
+        ),
         preferred_username: authorInfo?.preferredUsername ?? null,
         name: authorInfo?.name ?? null,
         icon_url: authorInfo?.iconUrl ?? null,

package/src/backend/routes/posts/like-mutation.ts

@@ -0,0 +1,240 @@
+import { and, count, eq, sql } from "drizzle-orm";
+import type { BatchItem } from "drizzle-orm/batch";
+import type { Database } from "../../../db/index.ts";
+import { activities, inbox, likes, objects } from "../../../db/index.ts";
+import type { Env } from "../../types.ts";
+import { activityApId, generateId, isLocal } from "../../federation-helpers.ts";
+import { activityDeleteCascadeStatements } from "../../lib/activity-delete-cascade.ts";
+import { enqueueDeliveryToActor } from "../../lib/delivery/queue.ts";
+import { logger } from "../../lib/logger.ts";
+import { isUniqueConstraintError } from "../../lib/parse-helpers.ts";
+
+const log = logger.child({ component: "posts.like_mutation" });
+
+type BatchStatement = BatchItem<"sqlite">;
+type BatchableDb = {
+  batch(
+    statements: readonly [BatchStatement, ...BatchStatement[]],
+  ): Promise<unknown>;
+};
+
+export type LikeTarget = {
+  apId: string;
+  attributedTo: string;
+};
+
+export type PostLikeMutationResult = {
+  active: boolean;
+  changed: boolean;
+  likeCount: number;
+};
+
+async function readLikeCount(
+  db: Database,
+  objectApId: string,
+): Promise<number> {
+  const row = await db
+    .select({ count: count() })
+    .from(likes)
+    .where(eq(likes.objectApId, objectApId))
+    .get();
+  return row?.count ?? 0;
+}
+
+async function enqueueRemoteInteraction(
+  env: Env,
+  activityId: string,
+  recipientApId: string,
+  type: "Like" | "Undo",
+): Promise<void> {
+  try {
+    await enqueueDeliveryToActor(env, activityId, recipientApId);
+  } catch (error) {
+    log.error("Failed to enqueue post interaction", {
+      event: "posts.like_mutation.enqueue_failed",
+      type,
+      activityId,
+      recipient: recipientApId,
+      error,
+    });
+  }
+}
+
+/**
+ * Set one actor's Like edge and all of its durable Activity/notification state.
+ *
+ * Web and agent callers deliberately keep their own response semantics: this
+ * owner reports whether the requested state changed, so HTTP may reject a
+ * duplicate while the Takos tool remains safely idempotent.
+ */
+export async function setPostLike(input: {
+  db: Database;
+  env: Env;
+  actorApId: string;
+  post: LikeTarget;
+  active: boolean;
+}): Promise<PostLikeMutationResult> {
+  const { db, env, actorApId, post, active } = input;
+  const existing = await db
+    .select({ activityApId: likes.activityApId })
+    .from(likes)
+    .where(and(eq(likes.actorApId, actorApId), eq(likes.objectApId, post.apId)))
+    .get();
+
+  if (active) {
+    if (existing) {
+      return {
+        active: true,
+        changed: false,
+        likeCount: await readLikeCount(db, post.apId),
+      };
+    }
+
+    const now = new Date().toISOString();
+    const likeActivityId = activityApId(env.APP_URL, generateId());
+    const raw = {
+      "@context": "https://www.w3.org/ns/activitystreams",
+      id: likeActivityId,
+      type: "Like",
+      actor: actorApId,
+      object: post.apId,
+    };
+    const statements: BatchStatement[] = [
+      db.insert(likes).values({
+        actorApId,
+        objectApId: post.apId,
+        activityApId: likeActivityId,
+        createdAt: now,
+      }),
+      db
+        .update(objects)
+        .set({
+          likeCount: sql`(SELECT COUNT(*) FROM ${likes} WHERE ${likes.objectApId} = ${post.apId})`,
+        })
+        .where(eq(objects.apId, post.apId)),
+      db.insert(activities).values({
+        apId: likeActivityId,
+        type: "Like",
+        actorApId,
+        objectApId: post.apId,
+        rawJson: JSON.stringify(raw),
+        direction: "outbound",
+        createdAt: now,
+      }),
+    ];
+    if (
+      post.attributedTo !== actorApId &&
+      isLocal(post.attributedTo, env.APP_URL)
+    ) {
+      statements.push(
+        db.insert(inbox).values({
+          actorApId: post.attributedTo,
+          activityApId: likeActivityId,
+          read: 0,
+          createdAt: now,
+        }),
+      );
+    }
+
+    try {
+      await (db as unknown as BatchableDb).batch(
+        statements as [BatchStatement, ...BatchStatement[]],
+      );
+    } catch (error) {
+      if (!isUniqueConstraintError(error)) throw error;
+      return {
+        active: true,
+        changed: false,
+        likeCount: await readLikeCount(db, post.apId),
+      };
+    }
+
+    if (!isLocal(post.apId, env.APP_URL)) {
+      await enqueueRemoteInteraction(
+        env,
+        likeActivityId,
+        post.attributedTo,
+        "Like",
+      );
+    }
+    return {
+      active: true,
+      changed: true,
+      likeCount: await readLikeCount(db, post.apId),
+    };
+  }
+
+  if (!existing) {
+    return {
+      active: false,
+      changed: false,
+      likeCount: await readLikeCount(db, post.apId),
+    };
+  }
+
+  const remote = !isLocal(post.apId, env.APP_URL);
+  const undoActivityId = remote
+    ? activityApId(env.APP_URL, generateId())
+    : null;
+  const undoObject = existing.activityApId
+    ? existing.activityApId
+    : { type: "Like", actor: actorApId, object: post.apId };
+  const undoRaw = undoActivityId
+    ? {
+        "@context": "https://www.w3.org/ns/activitystreams",
+        id: undoActivityId,
+        type: "Undo",
+        actor: actorApId,
+        object: undoObject,
+      }
+    : null;
+  const reapOriginal = existing.activityApId
+    ? activityDeleteCascadeStatements(
+        db,
+        eq(activities.apId, existing.activityApId),
+      )
+    : [];
+  const statements: BatchStatement[] = [
+    db
+      .delete(likes)
+      .where(
+        and(eq(likes.actorApId, actorApId), eq(likes.objectApId, post.apId)),
+      ),
+    db
+      .update(objects)
+      .set({
+        likeCount: sql`(SELECT COUNT(*) FROM ${likes} WHERE ${likes.objectApId} = ${post.apId})`,
+      })
+      .where(eq(objects.apId, post.apId)),
+    ...reapOriginal,
+  ];
+  if (undoActivityId && undoRaw) {
+    statements.push(
+      db.insert(activities).values({
+        apId: undoActivityId,
+        type: "Undo",
+        actorApId,
+        objectApId: post.apId,
+        rawJson: JSON.stringify(undoRaw),
+        direction: "outbound",
+      }),
+    );
+  }
+  await (db as unknown as BatchableDb).batch(
+    statements as [BatchStatement, ...BatchStatement[]],
+  );
+
+  if (undoActivityId) {
+    await enqueueRemoteInteraction(
+      env,
+      undoActivityId,
+      post.attributedTo,
+      "Undo",
+    );
+  }
+  return {
+    active: false,
+    changed: true,
+    likeCount: await readLikeCount(db, post.apId),
+  };
+}