Changeset 04d5aeb in Klonkt

Timestamp:

08/02/2026 09:42:34 PM (5 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

5327324

Parents:

f3a58a4

Message:

Replies op friends-only posts: de deur die nooit open kon

De hangende reply-klacht (Robins schermafdruk, 2-8: 502
cannot_resolve_inReplyTo) bleek een keten van drie schakels. Een
friends-post slaat fan_only = 1 op. De /ap/notes-route verborg elke
fan_only post voor IEDEREEN, zonder ooit naar de Signature-header te
kijken. En resolveRemoteNote haalde zelfs de eigen notes over publiek
HTTPS op. De gesigneerde resolutie die het reply-pad sinds 30-7 doet
klopte dus aan bij een deur die niet open kon: elke reply op een
friends-only post (Shaers standaard!) stierf voor de aflevering.
Publieke posts deden het wel, vandaar dat het grillig leek.

Twee reparaties. EEN: een note die hier woont verlaat het pand niet
meer. resolveRemoteNote bouwt hem uit de database (localNoteObject,
localActorObject, ook in de thread-klim), waarbij de eigen host in
ASCII vergeleken wordt: xn--zz9h.example IS het hart-domein, Barts
WebFinger-les van vanochtend, nu ook op het reply-pad en in
postIdFromNoteUrl. Niet-publieke notes alleen voor de eigen C2S-caller
(forSlug); een hairpin-fetch die op een thuisserver achter een tunnel
faalt is er niet meer.

TWEE: authorized fetch op GET /ap/notes/:id. Een geverifieerde follower
verdient de friends-only Note (noteAudience/mayReadNote); een vreemde
krijgt exact dezelfde 404 als vroeger, een geblokkeerde actor ook (de
staande regel: gesigneerde fetch van een geblokkeerde verdient de lege
verzameling, domein-blocks incluis) en direct wordt nooit over GET
geserveerd.

Changed files:
src/services/ActivityPubService.js

• asciiOrigin/isOwnUrl: hostvergelijking via WHATWG URL, geen bytes
• postIdFromNoteUrl: ASCII-origins in plaats van startsWith
• localNoteObject/localActorObject: eigen notes en actors uit de DB
• resolveRemoteNote: kortsluiting op alle drie de fetch-punten
• noteAudience/mayReadNote: de leespoort, ook in de default-export

src/routes/activitypub.js

• /ap/notes/:id: fan_only niet meer in de SELECT maar achter de poort; verifyRequest beslist, try eromheen (Express 4 vangt een async rejection niet: een fout werd een eeuwig hangende request, precies zo gevonden tijdens het bouwen)

New file:
test/reply-friends-only.test.js

• reply op eigen friends-post resolvet lokaal (geen server achter het testdomein: HTTP zou 502 geven) en threadt onder de post
• unicode- en punycode-spelling zijn een host
• onbestaande note blijft luid 502
• mayReadNote-matrix: follower/vreemde/blocked/domein-block/direct
• route: vreemde 404, garbage-signature 404, direct 404, publiek 200

remarks: de suite staat op 384. Wat dit NIET oplost: een reply waarvan
de parent op een derde server staat die zelf geen authorized fetch
doet; dat is de andere kant van dezelfde deur en die is van hen.

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

Files:

• src/routes/activitypub.js (modified) (1 diff)
• src/services/ActivityPubService.js (modified) (6 diffs)
• test/reply-friends-only.test.js (added)

src/routes/activitypub.js

@@ -585 +585 @@
 
 // ── Note ──────────────────────────────────────────────────────────
-router.get('/ap/notes/:id', (req, res) => {
+router.get('/ap/notes/:id', async (req, res) => {
+  // No fan_only filter in the SELECT anymore: a friends-only post is not
+  // absent, it is GATED. The old route hid it from EVERYONE, also from the
+  // follower whose friendship earns it — so the signed resolution the reply
+  // path performs knocked on a door that could never open, and every reply
+  // to a friends-only post (Shaer's default!) died in
+  // cannot_resolve_inReplyTo. Strangers still get the exact same 404, so a
+  // note's existence stays as private as before.
   const post = db.prepare(
-    "SELECT * FROM posts WHERE id = ? AND status = 'published' AND (fan_only IS NULL OR fan_only = 0)"
+    "SELECT * FROM posts WHERE id = ? AND status = 'published'"
   ).get(req.params.id);
+  if (post && AP.noteAudience(post) !== 'public') {
+    // The whole gate in a try: this is the only async route in this file,
+    // and Express 4 does not catch an async rejection — the request would
+    // hang forever instead of failing (which is exactly how the missing
+    // default-export entry manifested while building this). Any error here
+    // reads as "not authorized", never as silence.
+    try {
+      if (AP.noteAudience(post) === 'direct') return res.status(404).end();
+      const gsite = db.prepare('SELECT * FROM sites WHERE id = ?').get(post.site_id);
+      const actor = await AP.verifyRequest(req).catch(() => null);
+      if (!actor || !AP.mayReadNote(gsite, post, actor.id)) return res.status(404).end();
+    } catch { return res.status(404).end(); }
+  }
   if (!post) {
     // Could be one of OUR outbound replies (ap_outbox), not a post.

src/services/ActivityPubService.js

@@ -947 +947 @@
 const localPostExists = (id) => { try { return !!db.prepare('SELECT 1 FROM posts WHERE id = ?').get(id); } catch { return false; } };
 // Extract our local post id from a note URL, but only if it's ours (base match).
+// One host, two spellings (Barts WebFinger-les, 2-8): a URL the client hands
+// back may carry the punycoded host (every URL parser silently punycodes)
+// while PUBLIC_BASE_URL carries the typed one. WHATWG URL does the IDNA, so
+// compare origins in ASCII and never the bytes the client happened to send.
+function asciiOrigin(u) {
+  try { const x = new URL(String(u)); return `${x.protocol}//${x.host}`.toLowerCase(); } catch { return null; }
+}
+function isOwnUrl(u) {
+  const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
+  if (!base) return false;
+  const a = asciiOrigin(u);
+  return !!a && a === asciiOrigin(base);
+}
 function postIdFromNoteUrl(url, base) {
   const s = String(url || '');
-  if (base && !s.startsWith(base)) return null;
+  // ASCII origins, not startsWith: xn--zz9h.example IS 🩵.example, and a
+  // byte comparison read our own note as a stranger's.
+  if (base) { const a = asciiOrigin(s); if (!a || a !== asciiOrigin(base)) return null; }
   const m = s.match(/\/ap\/notes\/([^/?#]+)/);
   return m ? decodeURIComponent(m[1]) : null;
@@ -1262 +1277 @@
   }
   return ok ? actor : null;
+}
+
+// ── Authorized fetch for a single Note (2-8) ─────────────────────
+// Who may read this post's Note over AP GET? 'public' needs nobody;
+// friends-only (fan_only, Shaer's DEFAULT) needs a verified follower;
+// 'direct' is addressed to people and is never served over a GET at all.
+export function noteAudience(post) {
+  if (!post) return 'direct';
+  if (post.ap_visibility === 'direct') return 'direct';
+  if (post.fan_only || post.ap_visibility === 'friends') return 'followers';
+  return 'public';
+}
+// A follower earns the friends-only Note; a blocked actor gets the same
+// nothing as a stranger (the standing rule: a blocked actor's signed fetch
+// earns the empty set, gated server-side at serialisation).
+export function mayReadNote(site, post, actorUri) {
+  const aud = noteAudience(post);
+  if (aud === 'public') return true;
+  if (aud === 'direct' || !site || !actorUri) return false;
+  try {
+    const blocked = db.prepare("SELECT 1 FROM ap_blocks WHERE slug = ? AND kind = 'actor' AND target = ?").get(site.slug, actorUri);
+    if (blocked) return false;
+    let host = null; try { host = new URL(actorUri).host; } catch { /* geen host, geen domein-block */ }
+    if (host) {
+      const dom = db.prepare("SELECT 1 FROM ap_blocks WHERE slug = ? AND kind = 'domain' AND target = ?").get(site.slug, host);
+      if (dom) return false;
+    }
+    return !!db.prepare('SELECT 1 FROM ap_followers WHERE slug = ? AND actor_uri = ?').get(site.slug, actorUri);
+  } catch { return false; }
 }
 
@@ -2722 +2766 @@
 // Resolve a remote post URL (any fediverse/Klonkt post) into a reply target.
 // Returns a parent-shaped object usable by deliverReply(), or null.
+// The server's own note, built straight from the DB. resolveRemoteNote used
+// to fetch EVERYTHING over HTTPS, including notes living right here: a
+// hairpin fetch fails on home setups (a Klonkt on a Mac behind a tunnel), the
+// /ap/notes route rightly hides friends-only posts, and a punycode-spelled
+// own URL read as remote on a byte comparison. For the authenticated C2S
+// caller none of those walls apply; the DB is one prepare() away.
+// `forSlug` is that caller: only the post's own site gets its non-public
+// notes on this shortcut (public ones anyone, same as the route serves).
+function localNoteObject(url, forSlug) {
+  if (!isOwnUrl(url)) return null;
+  const m = String(url).match(/\/ap\/notes\/([^/?#]+)/);
+  if (!m) return null;
+  const id = decodeURIComponent(m[1]);
+  const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
+  const post = db.prepare("SELECT * FROM posts WHERE id = ? AND status = 'published'").get(id);
+  if (post) {
+    const site = db.prepare('SELECT * FROM sites WHERE id = ?').get(post.site_id);
+    if (!site) return null;
+    const nonPublic = post.fan_only || post.ap_visibility === 'friends' || post.ap_visibility === 'direct';
+    if (nonPublic && (!forSlug || forSlug !== site.slug)) return null;
+    return buildNote(base, site, post);
+  }
+  return getOutboxNote(base, id);   // our own outbound replies
+}
+// The own actor document, same shortcut, same reason.
+function localActorObject(uri) {
+  if (!isOwnUrl(uri)) return null;
+  const m = String(uri).match(/\/ap\/users\/([^/?#]+)/);
+  const site = m ? db.prepare('SELECT * FROM sites WHERE slug = ?').get(decodeURIComponent(m[1])) : null;
+  return site ? buildActor((process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, ''), site) : null;
+}
+
 export async function resolveRemoteNote(url, opts = {}) {
   if (!/^https?:\/\//i.test(String(url || ''))) return null;
@@ -2730 +2806 @@
   // the other server sees WHO asks and serves what the friendship earns.
   const get = (u) => (opts.asSlug ? signedGetJson(opts.asSlug, u) : fetchActor(u).catch(() => null));
-  const note = await get(url); // AP GET (content-negotiates)
+  const note = localNoteObject(url, opts.asSlug) || await get(url); // own DB first, then AP GET
   if (!note || !note.id) return null;
   const att = note.attributedTo;
   const actorUri = actorUriOf(att);
   if (!actorUri) return null;
-  const actor = await get(actorUri);
+  const actor = localActorObject(actorUri) || await get(actorUri);
   const ai = actorInfo(actor, actorUri);
   // Is what we're replying to a post (or a comment) on one of OUR posts? If so,
@@ -2749 +2825 @@
     const url = typeof cursor === 'string' ? cursor : (cursor && cursor.id);
     if (!url) break;
-    const pn = await get(url);
+    const pn = localNoteObject(url, opts.asSlug) || await get(url);
     if (!pn) break;
     const pa = actorUriOf(pn.attributedTo);
@@ -4432 +4508 @@
   buildActor, buildNote, buildCreate, buildOutbox, buildFollowers, buildFollowing, buildFeatured,
   followerCount, deliver, fetchActor, verifyRequest, handleInbox, deliverCreate, deliverDelete, deliverUpdate, deliverActorUpdate, resyncFeaturedPins,
-  getInteractions, getInteractionById, setInteractionBoosted, setInteractionLiked, setMyReaction, getMyReactions, buildReplyNote, getOutboxNote, getSentNotes, deliverReply, resolveRemoteNote,
+  getInteractions, getInteractionById, setInteractionBoosted, setInteractionLiked, setMyReaction, getMyReactions, buildReplyNote, getOutboxNote, getSentNotes, deliverReply, resolveRemoteNote, noteAudience, mayReadNote,
   listOutbox, deliverOutboxDelete, deliverOutboxUpdate, deliverDirectNote,
   webfingerResolve, followActor, resolveRemoteActor, unfollowActor, handleMoveInbox, moveAccount, listFollowing, setAutoBoost, backfillFromOutbox, getTimeline, getDirectMessages, isoStamp, timelineAttachments, timelineEmojis, timelineObjectLinks, timelineQuote, timelineEmbed, applyQuoteProps, deliverToActor, sendInteraction, voteOnPoll, voteOnRemotePoll,