Changeset 67c1f24 in Klonkt for src/services/ActivityPubService.js

Timestamp:

07/17/2026 12:38:54 AM (8 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

92a2c46

Parents:

3778ddb

git-author:

Robin <roboburr@…> (07/17/2026 12:38:34 AM)

git-committer:

Robin <roboburr@…> (07/17/2026 12:38:54 AM)

Message:

Feature: owner moderation of incoming replies (remove + tombstone + report)

The site owner could not remove an incoming reply, and thread-filling would
re-fetch a locally deleted one (crawlThread seeds its dedup set from
ap_interactions). New ap_rejected_objects table: rejectInteraction() (tenancy-
scoped to the owner's site) deletes the row and tombstones the object URI;
handleInbox and crawlThread skip tombstoned URIs, so a removed reply never
returns via re-delivery or thread-filling. A report action feeds sendReport
from the locally stored object/actor URIs, so flagging also works for private
notes that authorize_interaction cannot fetch (401/404). Thread nodes get
owner-only report + remove buttons (confirm via the global data-confirm
handler); i18n NL/EN/DE. Covered by test/reply-moderation.test.js (59 tests
green); full flow verified in a browser: buttons render for the logged-in
owner, remove deletes the reply and writes the tombstone. Beads: klonkt-demo-qul.

Co-Authored-By: Claude Opus 4.8 <noreply@…>

File:

• src/services/ActivityPubService.js (modified) (5 diffs)

src/services/ActivityPubService.js

@@ -596 +596 @@
 // ── inbound interactions store (replies / likes / boosts) + our outbound replies ──
 let _insI, _delLA, _delReply, _listI, _getI, _insO, _listO, _getO;
+// ── moderation tombstones (ap_rejected_objects) ───────────────────
+// A reply the owner removed stays removed: its object URI is tombstoned and
+// checked at ingest AND by the thread-crawler (else thread-filling would
+// re-fetch it). Owner moderation acts on the LOCAL copy, so it also works for
+// private notes that authorize_interaction can't fetch (401/404).
+let _insRj, _hasRj;
+function rjStmts() {
+  if (!_insRj) {
+    _insRj = db.prepare('INSERT OR IGNORE INTO ap_rejected_objects (object_uri, post_id, reason) VALUES (?,?,?)');
+    _hasRj = db.prepare('SELECT 1 FROM ap_rejected_objects WHERE object_uri = ?');
+  }
+  return { ins: _insRj, has: _hasRj };
+}
+export function isRejectedObject(uri) {
+  if (!uri) return false;
+  try { return !!rjStmts().has.get(String(uri)); } catch { return false; }
+}
+// Owner removes an incoming reply: tombstone + delete. Tenancy-scoped: the
+// interaction's post must belong to the caller's site.
+export function rejectInteraction(site, interactionId, reason) {
+  if (!site || !site.slug) return { error: 'forbidden' };
+  const row = iStmts().getI.get(interactionId);
+  if (!row) return { error: 'not_found' };
+  const owns = db.prepare('SELECT 1 FROM posts WHERE id = ? AND site_id = (SELECT id FROM sites WHERE slug = ?)')
+    .get(row.post_id, site.slug);
+  if (!owns) return { error: 'forbidden' };
+  if (row.object_uri) { try { rjStmts().ins.run(row.object_uri, row.post_id, reason || 'removed by site owner'); } catch { /* non-fatal */ } }
+  db.prepare('DELETE FROM ap_interactions WHERE id = ?').run(interactionId);
+  console.log('[AP] interaction removed by owner', site.slug, row.object_uri || row.actor_uri);
+  return { ok: true, object_uri: row.object_uri || null, actor_uri: row.actor_uri || null };
+}
+// Stored URIs of an interaction (tenancy-scoped) → feed sendReport for flagging
+// from the local copy (works for private notes; no remote fetch needed to target).
+export function interactionReportTarget(site, interactionId) {
+  if (!site || !site.slug) return null;
+  const row = iStmts().getI.get(interactionId);
+  if (!row) return null;
+  const owns = db.prepare('SELECT 1 FROM posts WHERE id = ? AND site_id = (SELECT id FROM sites WHERE slug = ?)')
+    .get(row.post_id, site.slug);
+  if (!owns) return null;
+  return { objectUri: row.object_uri || null, actorUri: row.actor_uri || null };
+}
+
 // AP addressing → visibility: 'public' | 'unlisted' | 'followers' | 'direct'.
 // Mastodon-conventie: Public in `to` = public, Public in `cc` = unlisted, een
@@ -1165 +1208 @@
       const ai = actorInfo(await resolveActor(actorUri), actorUri);
       const html = HtmlSanitizerService.sanitize(o.content || '');
+      if (isRejectedObject(o.id)) { console.log('[AP] reply skipped (tombstoned)', o.id); return 202; }
       iStmts().ins.run('reply', tgt.post_id, o.id || '', actorUri, ai.name, ai.handle, ai.url, ai.icon, html, o.published || null, tgt.parent_uri, noteVisibility(o));
       console.log('[AP] reply', actorUri, '→', tgt.post_id);
@@ -2131 +2175 @@
   const seeds = [...known].filter((u) => /^https?:\/\//i.test(u));
   if (!seeds.length) return; // nothing remote to expand
+  // Owner-removed replies (tombstones) join the dedup set AFTER seeding, so the
+  // crawler never re-adds them via thread-filling (they're gone from the seeds
+  // already because rejectInteraction deleted their ap_interactions row).
+  try { for (const r of db.prepare('SELECT object_uri FROM ap_rejected_objects WHERE post_id = ?').all(postId)) known.add(r.object_uri); }
+  catch { /* table always exists after boot migration */ }
 
   let fetches = 0;
@@ -2151 +2200 @@
         const child = await budget.get(cu);
         if (!child || !child.id || (child.type !== 'Note' && child.type !== 'Article')) continue;
+        if (isRejectedObject(child.id)) continue; // note id can differ from the collection URI (redirects)
         const actorUri = actorUriOf(child.attributedTo);
         if (!actorUri || isBlockedAny(actorUri)) continue; // skip blocked authors
@@ -2544 +2594 @@
   getReplyUris, markNotificationsSeen, countUnseenNotifications, hasPlayableAudio,
   linkifyBody, bakePostContent, bakePostContentWithMentions, listFollowers, removeFollower, listConnections,
-  noteVisibility,
+  noteVisibility, isRejectedObject, rejectInteraction, interactionReportTarget,
 };