@takosjp/yurucommu-core 3.4.3 → 3.4.4

package/src/backend/lib/activitypub-actor-identity-sql.ts

@@ -0,0 +1,179 @@
+import { sql, type SQL } from "drizzle-orm";
+
+function expandedActorIdentitiesSql(
+  rawActorIds: SQL,
+  targetActorId: SQL | undefined,
+  finalSelect: SQL,
+): SQL {
+  const targetValue = targetActorId ?? sql`NULL`;
+  return sql`
+    WITH
+    actor_identity_candidates(actor_id) AS MATERIALIZED (
+      ${rawActorIds}
+    ),
+    actor_identity_target(actor_id) AS MATERIALIZED (
+      SELECT ${targetValue}
+    ),
+    actor_identity_raw(source, raw_actor_id, actor_id) AS MATERIALIZED (
+      SELECT 0, actor_id, actor_id
+      FROM actor_identity_candidates
+      UNION ALL
+      SELECT 1, actor_id, actor_id
+      FROM actor_identity_target
+      WHERE actor_id IS NOT NULL
+    ),
+    actor_identity_fragmentless(source, raw_actor_id, actor_id) AS MATERIALIZED (
+      SELECT
+        source,
+        raw_actor_id,
+        CASE WHEN instr(actor_id, '#') > 0
+          THEN substr(actor_id, 1, instr(actor_id, '#') - 1)
+          ELSE actor_id
+        END
+      FROM actor_identity_raw
+    ),
+    actor_identity_clean(source, raw_actor_id, actor_id) AS MATERIALIZED (
+      SELECT
+        source,
+        raw_actor_id,
+        CASE WHEN substr(actor_id, -1) = '/'
+          THEN substr(actor_id, 1, length(actor_id) - 1)
+          ELSE actor_id
+        END
+      FROM actor_identity_fragmentless
+    ),
+    actor_identity_split(
+      source, raw_actor_id, actor_id, separator, tail
+    ) AS MATERIALIZED (
+      SELECT
+        source,
+        raw_actor_id,
+        actor_id,
+        instr(actor_id, '://'),
+        substr(actor_id, instr(actor_id, '://') + 3)
+      FROM actor_identity_clean
+    ),
+    actor_identity_bounds(
+      source, raw_actor_id, actor_id, separator, tail, boundary
+    ) AS MATERIALIZED (
+      SELECT
+        source,
+        raw_actor_id,
+        actor_id,
+        separator,
+        tail,
+        CASE
+          WHEN instr(tail, '/') = 0 THEN instr(tail, '?')
+          WHEN instr(tail, '?') = 0 THEN instr(tail, '/')
+          WHEN instr(tail, '/') < instr(tail, '?') THEN instr(tail, '/')
+          ELSE instr(tail, '?')
+        END
+      FROM actor_identity_split
+    ),
+    actor_identity_components(
+      source, raw_actor_id, separator, scheme, authority, path_query
+    ) AS MATERIALIZED (
+      SELECT
+        source,
+        raw_actor_id,
+        separator,
+        lower(substr(actor_id, 1, separator - 1)),
+        CASE WHEN boundary = 0
+          THEN tail
+          ELSE substr(tail, 1, boundary - 1)
+        END,
+        CASE
+          WHEN boundary = 0 THEN ''
+          WHEN substr(tail, boundary, 1) = '?'
+            THEN '/' || substr(tail, boundary)
+          ELSE substr(tail, boundary)
+        END
+      FROM actor_identity_bounds
+    ),
+    actor_identity_normalized(
+      source, raw_actor_id, separator, scheme, authority, path_query
+    ) AS MATERIALIZED (
+      SELECT
+        source,
+        raw_actor_id,
+        separator,
+        scheme,
+        CASE
+          WHEN scheme = 'https' AND substr(lower(authority), -4) = ':443'
+            THEN substr(lower(authority), 1, length(authority) - 4)
+          WHEN scheme = 'http' AND substr(lower(authority), -3) = ':80'
+            THEN substr(lower(authority), 1, length(authority) - 3)
+          ELSE lower(authority)
+        END,
+        path_query
+      FROM actor_identity_components
+      WHERE instr(authority, '@') = 0
+    ),
+    actor_identity_values(source, raw_actor_id, actor_id) AS MATERIALIZED (
+      SELECT source, raw_actor_id, actor_id
+      FROM actor_identity_raw
+      UNION
+      SELECT
+        source,
+        raw_actor_id,
+        scheme || '://' || authority || path_query
+      FROM actor_identity_normalized
+      WHERE separator > 1
+        AND scheme IN ('http', 'https')
+        AND length(authority) > 0
+    )
+    ${finalSelect}
+  `;
+}
+
+/**
+ * Expand an uncorrelated one-column actor-ID query into its raw spellings plus
+ * the canonical HTTP(S) spellings accepted by the signature boundary.
+ *
+ * Feed callers compare their actor column to this set with `NOT IN`. The CTE is
+ * independent of the outer feed row, so SQLite computes the small personal
+ * moderation set once instead of reparsing actor URLs for every post or
+ * notification. Raw IDs stay in the result for malformed legacy values and
+ * content retained under the exact historical spelling. The canonical branch
+ * preserves path/query bytes while folding only scheme/authority case,
+ * default ports, fragments, and one trailing slash.
+ *
+ * Keep the parsing stages MATERIALIZED. Letting SQLite flatten this expression
+ * chain causes workerd's D1 engine to exhaust memory even for a tiny relation
+ * set; explicit materialization also keeps runtime bounded as the set grows.
+ */
+export function activityPubActorIdentitySetSql(rawActorIds: SQL): SQL {
+  return expandedActorIdentitiesSql(
+    rawActorIds,
+    undefined,
+    sql`
+      SELECT DISTINCT actor_id
+      FROM actor_identity_values
+      WHERE source = 0
+    `,
+  );
+}
+
+/**
+ * Return the retained raw spellings from `rawActorIds` that identify
+ * `targetActorId`. This is the mutation counterpart to the identity-set read
+ * predicate: callers can retain an existing primary-key spelling or delete all
+ * historical spellings without loading/scanning the whole relation set in JS.
+ */
+export function activityPubActorIdentityMatchesSql(
+  rawActorIds: SQL,
+  targetActorId: string | SQL,
+): SQL {
+  return expandedActorIdentitiesSql(
+    rawActorIds,
+    typeof targetActorId === "string" ? sql`${targetActorId}` : targetActorId,
+    sql`
+      SELECT DISTINCT candidate.raw_actor_id AS actor_id
+      FROM actor_identity_values AS candidate
+      INNER JOIN actor_identity_values AS target
+        ON target.source = 1
+        AND target.actor_id = candidate.actor_id
+      WHERE candidate.source = 0
+    `,
+  );
+}

package/src/backend/lib/activitypub-actor-identity.ts

@@ -0,0 +1,39 @@
+/**
+ * Normalize the deliberately-small set of cosmetic actor-IRI differences that
+ * the HTTP-signature boundary accepts.
+ *
+ * URL parsing lowercases the scheme/host and removes default ports. Fragments
+ * never identify an ActivityPub actor, and a single trailing slash is treated
+ * as cosmetic. Path case, query strings, and every other component remain
+ * identity-significant so sibling actors on one origin are never conflated.
+ */
+export function normalizeActivityPubActorId(value: string): string | null {
+  try {
+    const url = new URL(value);
+    url.hash = "";
+    let normalized = `${url.protocol}//${url.host}${url.pathname}${url.search}`;
+    if (normalized.endsWith("/")) normalized = normalized.slice(0, -1);
+    return normalized;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Compare two actor IRIs using exactly the equivalence accepted when binding
+ * an Activity actor to its verified HTTP-signature key owner.
+ */
+export function isSameActivityPubActor(
+  left: string | null | undefined,
+  right: string | null | undefined,
+): boolean {
+  if (!left || !right) return false;
+  if (left === right) return true;
+  const normalizedLeft = normalizeActivityPubActorId(left);
+  const normalizedRight = normalizeActivityPubActorId(right);
+  return (
+    normalizedLeft !== null &&
+    normalizedRight !== null &&
+    normalizedLeft === normalizedRight
+  );
+}

package/src/backend/lib/activitypub-validators.ts

@@ -11,8 +11,11 @@
  * - ActivityPub is lenient about extension fields; parsers accept unknown
  *   extra fields and copy through only the keys we care about.
  * - Required-but-wrong-type fields fail closed.
- * - Optional fields that are present but malformed are dropped silently
- *   (treated as absent) rather than rejecting the whole document.
+ * - Optional display fields that are present but malformed are dropped
+ *   silently (treated as absent) rather than rejecting the whole document.
+ * - Optional authority fields whose presence changes behavior may be preserved
+ *   as `unknown` so their owning handler can reject them instead of confusing a
+ *   malformed value with omission.
  */
 
 /** Error thrown when a remote ActivityPub document violates our contract. */
@@ -204,9 +207,13 @@ export interface ActivityObjectDocument {
   id?: string;
   type?: string | string[];
   object?: string;
-  inReplyTo?: string;
+  /** Preserved raw so malformed explicit reply edges cannot become roots. */
+  inReplyTo?: unknown;
   to?: string[];
   cc?: string[];
+  bto?: string[];
+  bcc?: string[];
+  audience?: string[];
   conversation?: string;
   content?: string;
   summary?: string | null;
@@ -228,8 +235,17 @@ export interface ActivityDocument {
   type?: string;
   actor?: string;
   object?: string | ActivityObjectDocument;
+  /** Bounded IRI projection of scalar/embedded/array-valued AS2 `object`. */
+  objectIds?: string[];
   target?: string | ActivityObjectDocument;
+  /** Envelope-level Flag reason. */
+  content?: string;
   room?: string;
+  to?: string[];
+  cc?: string[];
+  bto?: string[];
+  bcc?: string[];
+  audience?: string[];
 }
 
 function parseActivityObjectFields(
@@ -240,9 +256,15 @@ function parseActivityObjectFields(
     id: getString(record, "id"),
     type: getStringOrStringArray(record, "type"),
     object: getString(record, "object"),
-    inReplyTo: getString(record, "inReplyTo"),
+    // This is an authority-bearing thread edge. Preserve a malformed explicit
+    // value for the Note ingress validator instead of silently converting it
+    // to absence (which would persist a root post or allow a partial Update).
+    inReplyTo: record["inReplyTo"],
     to: getStringArray(record, "to"),
     cc: getStringArray(record, "cc"),
+    bto: getStringArray(record, "bto"),
+    bcc: getStringArray(record, "bcc"),
+    audience: getStringArray(record, "audience"),
     conversation: getString(record, "conversation"),
     content: getString(record, "content"),
     summary:
@@ -269,6 +291,35 @@ function parseActivityObjectOrIri(
   return undefined;
 }
 
+// Below D1's 100-bound-parameter ceiling when a handler resolves all reported
+// entities in one IN (...) query. The request body itself is bounded separately.
+export const MAX_ACTIVITY_OBJECT_IDS = 64;
+
+/**
+ * Normalize every usable `object` reference without widening the existing
+ * scalar/embedded `Activity.object` model. In particular, Mastodon-compatible
+ * Flag activities carry `[reportedPost, reportedActor]`; the old parser dropped
+ * that array completely, leaving an unactionable target-less report.
+ */
+function parseActivityObjectIds(value: unknown): string[] | undefined {
+  const values = Array.isArray(value) ? value : [value];
+  const ids: string[] = [];
+  const seen = new Set<string>();
+  for (const item of values) {
+    const id =
+      typeof item === "string"
+        ? item
+        : isJsonRecord(item)
+          ? getString(item, "id")
+          : undefined;
+    if (!id || seen.has(id)) continue;
+    seen.add(id);
+    ids.push(id);
+    if (ids.length >= MAX_ACTIVITY_OBJECT_IDS) break;
+  }
+  return ids.length > 0 ? ids : undefined;
+}
+
 /**
  * Narrow an `unknown` (an already-`JSON.parse`d inbox body) into an
  * {@link ActivityDocument}. Throws if the value is not a JSON object.
@@ -283,8 +334,15 @@ export function parseActivity(value: unknown, path = "$"): ActivityDocument {
     type: getString(record, "type"),
     actor: getString(record, "actor"),
     object: parseActivityObjectOrIri(record["object"]),
+    objectIds: parseActivityObjectIds(record["object"]),
     target: parseActivityObjectOrIri(record["target"]),
+    content: getString(record, "content"),
     room: getString(record, "room"),
+    to: getStringArray(record, "to"),
+    cc: getStringArray(record, "cc"),
+    bto: getStringArray(record, "bto"),
+    bcc: getStringArray(record, "bcc"),
+    audience: getStringArray(record, "audience"),
   };
 }
 

package/src/backend/lib/ap-ids.ts

@@ -91,11 +91,41 @@ export function isLocal(apId: string, baseUrl: string): boolean {
   }
 }
 
-export function formatUsername(apId: string): string {
-  const url = new URL(apId);
-  const match = apId.match(/\/users\/([^\/]+)$/);
-  if (match) {
-    return `${match[1]}@${url.host}`;
+function cleanPreferredUsername(value: string | null | undefined) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : null;
+}
+
+/**
+ * Render an actor handle without treating the actor-id path as fresher than
+ * ActivityPub's preferredUsername. Actor ids are stable across a profile rename,
+ * so `/users/old-name` may legitimately describe `preferredUsername=new-name`.
+ */
+export function formatUsername(
+  apId: string,
+  preferredUsername?: string | null,
+): string {
+  const preferred = cleanPreferredUsername(preferredUsername);
+  try {
+    const url = new URL(apId);
+    if (preferred) return `${preferred}@${url.host}`;
+    const match = url.pathname.match(/\/(?:users|groups)\/([^/]+)\/?$/u);
+    if (match) return `${match[1]}@${url.host}`;
+  } catch {
+    // Retained legacy rows must remain displayable/removable even if their id
+    // predates the current absolute-URL validation boundary.
   }
-  return apId;
+  return preferred || apId;
+}
+
+/** Always return a non-empty primary label for an actor roster row. */
+export function formatPreferredUsername(
+  apId: string,
+  preferredUsername?: string | null,
+): string {
+  const preferred = cleanPreferredUsername(preferredUsername);
+  if (preferred) return preferred;
+  const formatted = formatUsername(apId);
+  const separator = formatted.lastIndexOf("@");
+  return separator > 0 ? formatted.slice(0, separator) : formatted;
 }

package/src/backend/lib/ap-verify.ts

@@ -21,7 +21,7 @@ import {
 } from "../federation-helpers.ts";
 import { tryParseRemoteActor } from "./activitypub-validators.ts";
 import {
-  buildActorCacheFields,
+  cacheRemoteActorDocument,
   getInstanceFetchSignerByDb,
 } from "./activitypub-actor-cache.ts";
 import { logger } from "./logger.ts";
@@ -339,22 +339,12 @@ export async function fetchActorPublicKey(
         isSafeRemoteUrl(actorData.id) &&
         isSafeRemoteUrl(actorData.inbox)
       ) {
-        // Reuse the already-fetched signature actor document and write it
-        // through the ONE canonical superset cache shape, so this opportunistic
-        // upsert populates `outbox` / `followersUrl` / `sharedInbox` identically
-        // to every other entry path.
-        const cacheFields = buildActorCacheFields(actorData);
-        // Single atomic upsert. A check-then-insert/update is racy across
-        // Worker isolates: two isolates racing the same cold actor can both
-        // miss the existence check and then both INSERT, and the loser hits a
-        // primary-key violation that would null out a successfully-fetched
-        // key and spuriously reject a validly-signed activity.
-        // `onConflictDoUpdate` collapses that to one race-safe statement
-        // (same pattern as fetchAndCacheRemoteActor in queue-batching.ts).
-        await db
-          .insert(actorCache)
-          .values({ apId: actorData.id, ...cacheFields })
-          .onConflictDoUpdate({ target: actorCache.apId, set: cacheFields });
+        // Reuse the already-fetched signature actor document through the one
+        // successful persistence boundary. This atomically refreshes the
+        // canonical cache shape and clears any older fetch-failure authority.
+        await cacheRemoteActorDocument(db, actorUrl, rawActor, {
+          publicKey: "require-key",
+        });
       }
 
       return result.publicKeyPem;