Changeset 73a10c2 in Klonkt

Timestamp:

07/30/2026 08:40:28 AM (6 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

aa189d1

Parents:

094f7d0

Message:

Vrienden krijgen de geschiedenis mee, en een block blijft een dichte deur

Robins besluit (30-7): wie later vriend wordt, moet de oudere friends-only
posts alsnog kunnen zien. Dat kon niet: friends-only was een moment-opname
(bezorgd aan de volgers van dat moment) en de outbox verborg fan-only juist,
dus de backfill die bij een nieuw volgen draait had niets op te halen.

Drie stukken, samen de lus:

1. De outbox antwoordt naar PUBLIEK: outboxAudience beslist per lezer. De eigenaar (bearer) en een geverifieerde geaccepteerde volger of guardian krijgen de friends-only geschiedenis mee; anoniem en een vreemde met alleen een handtekening krijgen de publieke set, precies als voorheen. Bijvangst: de auteur ziet nu ook zijn EIGEN friends-only posts in de app.
2. De backfill identificeert zich: signedGetJson tekent de GET als de volgende site ((request-target) host date, wat verifyRequest checkt), dus de servende kant herkent de vriend. Een server die de handtekening negeert gedraagt zich exact als vroeger.
3. Het moment dat de vriendschap ontstaat is het moment dat de geschiedenis meekomt: op de Accept van onze Follow draait de backfill.

En Robins scherpe toevoeging: een geverifieerde caller die deze instance
BLOKKEERT krijgt een LEGE collectie, niet eens de publieke set. Een block is
een dichte deur, en een gesigneerde fetch is aankloppen met je naam erop. De
block wint ook van een verweesd volger-rijtje.

Changed files:
src/services/ActivityPubService.js

• signedGetJson; backfill gesigneerd; backfill op Accept(Follow); outboxAudience als pure, testbare beslissing

src/routes/activitypub.js

• de outbox-route beslist via outboxAudience; blocked = lege set

New file:
test/friends-history.test.js

• anoniem blijft publiek; identificatie is geen vriendschap; volger en eigenaar lezen de geschiedenis; block wint van alles, ook van een stale volger-rij

remarks: 341 tests groen, server start.

-robo
Co-Authored-By: Claude Opus 5 <noreply@…>

Files:

• src/routes/activitypub.js (modified) (2 diffs)
• src/services/ActivityPubService.js (modified) (5 diffs)
• test/friends-history.test.js (added)

src/routes/activitypub.js

@@ -82 +82 @@
   const site = publicSite(req.params.slug);
   if (!site) return res.status(404).end();
-  // Authorized fetch (FEP-633c §5.3 note): a committed guardian doing a SIGNED
-  // GET may read the ward's fan-only history too, without appearing as a
-  // follower. Unsigned / non-guardian callers get the public collection only.
-  let asGuardian = false;
-  if (req.headers['signature']) {
+  // Authorized fetch (30-7): who is asking decides what they see.
+  //  - the owner's own app (bearer) and a verified accepted follower or
+  //    guardian get the friends-only history too, so a NEW friend's backfill
+  //    brings the past along (Robins besluit: vrienden krijgen de
+  //    geschiedenis mee);
+  //  - a verified caller this instance BLOCKS gets an EMPTY collection, not
+  //    even the public set: a block is a closed door, and a signed fetch is
+  //    the caller knocking with their name on it;
+  //  - everyone else gets the public collection, exactly as before.
+  const bearer = OAuth.verifyBearer(req.headers.authorization);
+  let verifiedActor = null;
+  if (!bearer && req.headers['signature']) {
     const verified = await AP.verifyRequest(req).catch(() => null);
-    asGuardian = !!(verified && AP.isWardGuardian(req.params.slug, verified.id));
-  }
-  const fanClause = asGuardian ? '' : "AND (fan_only IS NULL OR fan_only = 0)";
+    verifiedActor = verified && verified.id;
+  }
+  const audience = AP.outboxAudience(req.params.slug, {
+    bearerSlug: bearer ? bearer.site.slug : null,
+    verifiedActor,
+  });
+  if (audience === 'blocked') {
+    return AP.sendAP(res, AP.buildOutbox(baseUrl(req), site, []), 'private, no-store');
+  }
+  const fanClause = audience === 'friend' ? '' : "AND (fan_only IS NULL OR fan_only = 0)";
   const posts = db.prepare(
     `SELECT id, slug, title, content, cover_image_url, cover_video_url, nsfw, content_warning, published_at, created_at
@@ -96 +110 @@
      ORDER BY COALESCE(published_at, created_at) DESC LIMIT 20`
   ).all(site.id);
-  AP.sendAP(res, AP.buildOutbox(baseUrl(req), site, posts), asGuardian ? 'private, no-store' : undefined);
+  AP.sendAP(res, AP.buildOutbox(baseUrl(req), site, posts), audience === 'friend' ? 'private, no-store' : undefined);
 });
 

src/services/ActivityPubService.js

@@ -1854 +1854 @@
     if (fid) { try { fwStmts().acc.run(fid); } catch { /* ignore */ } }
     console.log('[AP] follow accepted', actorUri);
+    // The moment a friendship exists is the moment the history comes along
+    // (Robins besluit, 30-7): delivery cannot reach into the past, so the
+    // fresh follower pulls the outbox, signed, and the other side now serves
+    // the friends-only posts too.
+    if (slugParam && actorUri) backfillFromOutbox(slugParam, actorUri).catch(() => { /* best-effort */ });
     return 202;
   }
@@ -3238 +3243 @@
 
 // A generic SSRF-safe AP GET (collections / pages).
+/**
+ * A signed GET as one of our local actors (friends-history, 30-7): the remote
+ * server can then recognise the caller and serve what THAT caller may see,
+ * exactly like the guardian's authorized fetch. The signature covers
+ * (request-target) host date, the set verifyRequest checks.
+ */
+async function signedGetJson(slug, url) {
+  try {
+    const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, '');
+    if (!base || !slug) return apGetJson(url);
+    const me = actorId(base, slug);
+    const keys = getOrCreateKeys(slug);
+    const u = new URL(url);
+    const date = new Date().toUTCString();
+    const target = `${u.pathname}${u.search || ''}`;
+    const signingString = `(request-target): get ${target}\nhost: ${u.host}\ndate: ${date}`;
+    const signature = crypto.sign('sha256', Buffer.from(signingString), keys.private_pem).toString('base64');
+    const sig = `keyId="${me}#main-key",algorithm="rsa-sha256",headers="(request-target) host date",signature="${signature}"`;
+    const r = await safeFetch(url, { headers: { Accept: 'application/activity+json', Date: date, Signature: sig } });
+    if (!r.ok) return null;
+    const len = Number(r.headers.get('content-length') || 0);
+    if (len > 3_000_000) return null;
+    return await r.json();
+  } catch { return null; }
+}
+
 async function apGetJson(url) {
   try {
@@ -3256 +3287 @@
     const actor = await fetchActor(actorUri);
     if (!actor || !actor.outbox) return 0;
-    let page = await apGetJson(typeof actor.outbox === 'string' ? actor.outbox : actor.outbox.id);
+    // Signed as the follower (30-7): the serving side recognises an accepted
+    // friend and hands the friends-only history along; an anonymous GET only
+    // ever sees the public set. A server that ignores the signature behaves
+    // exactly as before.
+    let page = await signedGetJson(slug, typeof actor.outbox === 'string' ? actor.outbox : actor.outbox.id);
     let items = (page && (page.orderedItems || page.items)) || [];
     if (!items.length && page && page.first) {
-      page = await apGetJson(typeof page.first === 'string' ? page.first : page.first.id);
+      page = await signedGetJson(slug, typeof page.first === 'string' ? page.first : page.first.id);
       items = (page && (page.orderedItems || page.items)) || [];
     }
@@ -3548 +3583 @@
 
 // FEP-633c §5.3 note (authorized fetch): true when `actorUri` is a committed
+/**
+ * Who is reading this outbox, and what may they see (30-7)?
+ *  - 'blocked': a verified caller this instance blocks. They get an EMPTY
+ *    collection, not even the public set (Robins eis): a block is a closed
+ *    door, and a signed fetch is the caller knocking with their name on it.
+ *  - 'friend': the owner (bearer) or a verified accepted follower or
+ *    guardian: the fan-only history rides along.
+ *  - 'public': everyone else: the public set.
+ */
+export function outboxAudience(slug, { bearerSlug = null, verifiedActor = null } = {}) {
+  if (bearerSlug && bearerSlug === slug) return 'friend';
+  if (!verifiedActor) return 'public';
+  if (isBlockedAny(verifiedActor)) return 'blocked';
+  try {
+    if (db.prepare('SELECT 1 FROM ap_followers WHERE slug = ? AND actor_uri = ?').get(slug, verifiedActor)) return 'friend';
+  } catch { /* table absent on fresh init */ }
+  if (isWardGuardian(slug, verifiedActor)) return 'friend';
+  return 'public';
+}
+
 // guardian of the local ward `wardSlug` — so a signed GET from it may read the
 // ward's non-public history without the guardian appearing as a follower.
@@ -4044 +4099 @@
   listOutbox, deliverOutboxDelete, deliverOutboxUpdate, deliverDirectNote,
   webfingerResolve, followActor, resolveRemoteActor, unfollowActor, listFollowing, setAutoBoost, backfillFromOutbox, getTimeline, getDirectMessages, isoStamp, timelineAttachments, timelineEmojis, timelineObjectLinks, timelineQuote, timelineEmbed, applyQuoteProps, deliverToActor, sendInteraction, voteOnPoll, voteOnRemotePoll,
-  acceptGatedFollow, rejectGatedFollow, isWardGuardian, sendFollowDecision,
+  acceptGatedFollow, rejectGatedFollow, isWardGuardian, outboxAudience, sendFollowDecision,
   parseOwnPoll, pollTally, ownPollView, deliverPollUpdate, maybeCrawlThread, sendReport, localMentionSlugs,
   autoBoostCount, boostedCount, markBoosted, unmarkBoosted, markLiked, unmarkLiked, getTimelineReaction, upsertBoostedNote, getCirkelPosts, getCirkelMembers, selfHealTimeline,