Changeset c8e03c6 in Klonkt

Timestamp:

07/29/2026 10:29:55 AM (6 weeks ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

6d5ce0c

Parents:

329873e

Message:

Het doorgestuurde voorstel werd geweigerd: verkeerde afzender

Robin meldde dat stap 2 niet gebeurt, en beta's log zegt waarom:

[AP] guardianship Offer got 401 from ​https://boiert.eu/ap/users/opie/inbox
[AP] guardianship Offer got 401 from ​https://boiert.eu/ap/users/boiert/inbox

Het doorsturen werkt dus wel, maar de ontvangers weigeren het, en terecht. Ik
stuurde door met de voorsteller in actor terwijl de sleutel van het kind
ondertekent. Het lichaam beweerde de ene afzender, de handtekening bewees de
andere: signer mismatch, 401, precies wat die controle hoort te doen.

5.3 doet het al goed en had het voorbeeld moeten zijn: een gated follow wordt
doorgestuurd ALS HET KIND. Nu deze ook, met de voorsteller in shaer:proposer
zodat het scherm van de guardian nog steeds de juiste naam toont.

En de test die dit had moeten vangen: die controleerde DAT er doorgestuurd
werd, niet namens wie. Hij stond groen terwijl er niets aankwam. Nu controleert
hij de afzender en de proposer, en hij faalt op de oude code.

Changed files:
src/services/guardianship/handshake.js

• doorsturen met actor = het kind, plus shaer:proposer
• de ontvanger leest de voorsteller uit shaer:proposer

src/routes/guardian.js

• hetzelfde op het lokale pad: ondertekenen en beweren moeten kloppen

test/gated-settings.test.js

• de afzender van het doorgestuurde voorstel is het kind; de proposer reist apart mee en komt op het scherm terecht

remarks: 322 tests groen. De 401's die in de bezorgwachtrij staan dragen nog de
oude vorm en blijven falen tot ze opgeven; een nieuw voorstel is de weg vooruit.

-robo
Co-Authored-By: Claude Opus 5 <noreply@…>

Files:

• src/routes/guardian.js (modified) (1 diff)
• src/services/guardianship/handshake.js (modified) (2 diffs)
• test/gated-settings.test.js (modified) (2 diffs)

src/routes/guardian.js

@@ -516 +516 @@
     // the proposal exists and a threshold of two can never be met.
     if (r.state === 'open') {
+      const wardActor = AP.actorId(base, localWard.slug);
       for (const g of Guardianship.listGuardians(localWard.slug).map((x) => x.other_uri)) {
         if (g === me) continue;
-        AP.deliverToActor(site, g, { ...offer, to: [g] }).catch(() => { /* queued */ });
+        // Signed by the ward, so the body must say the ward: anything else is
+        // a signer mismatch and the receiver answers 401 (as it should).
+        AP.deliverToActor(
+          db.prepare('SELECT * FROM sites WHERE slug = ?').get(localWard.slug),
+          g,
+          { ...offer, actor: wardActor, to: [g], 'shaer:proposer': me },
+        ).catch(() => { /* queued */ });
       }
     }

src/services/guardianship/handshake.js

@@ -317 +317 @@
           for (const g of relations.listGuardians(site.slug).map((x) => x.other_uri)) {
             if (g === actor) continue;   // the proposer already answered
+            // The forward goes out AS THE WARD, because the ward's key signs
+            // it. Keeping the proposer in `actor` made every receiver answer
+            // 401 signer mismatch, and rightly so: the body claimed one author
+            // and the signature proved another. §5.3 forwards a gated follow
+            // the same way. Who proposed it rides along separately, for the
+            // guardian's screen.
             deps.deliverTo(site, g, {
-              id: offerId, type: 'Offer', actor, to: [g], object: activity.object,
+              id: offerId, type: 'Offer', actor: me, to: [g], object: activity.object,
+              'shaer:proposer': actor,
             }).catch(() => { /* the delivery queue retries */ });
           }
@@ -333 +340 @@
         gated.recordGatedReview(site.slug, {
           id: offerId, wardUri: gs.ward, wardInbox: wardDoc && wardDoc.inbox,
-          proposer: actor, feature: gs.feature, value: gs.value,
+          // A forward is signed by the ward, so `actor` is the ward; the
+          // guardian who opened it travels in shaer:proposer.
+          proposer: (typeof activity['shaer:proposer'] === 'string' ? activity['shaer:proposer'] : actor),
+          feature: gs.feature, value: gs.value,
         });
         notify(site.slug, { kind: 'gated_review', feature: gs.feature, value: gs.value, ward: gs.ward });

test/gated-settings.test.js

@@ -116 +116 @@
 
   // The forward: B and C are told, A is not asked twice.
-  const told = sent.filter((x) => x.act.object && x.act.object['shaer:feature']).map((x) => x.to).sort();
-  assert.deepEqual(told, [B, C].sort(), 'both other guardians must receive the proposal');
+  const fwd = sent.filter((x) => x.act.object && x.act.object['shaer:feature']);
+  assert.deepEqual(fwd.map((x) => x.to).sort(), [B, C].sort(), 'both other guardians must receive the proposal');
+  // And it must go out AS THE WARD, because the ward's key signs it. Sending
+  // it with the proposer still in `actor` is a signer mismatch: every receiver
+  // answers 401 and the proposal silently never arrives. Live proof, from
+  // beta's log: "guardianship Offer got 401 from boiert.eu/.../inbox". The
+  // first version of this test checked THAT a forward happened and not on
+  // whose behalf, so it passed while nothing worked.
+  for (const x of fwd) {
+    assert.equal(x.act.actor, WARD, 'the forward is signed by the ward, so it must say the ward');
+    assert.equal(x.act['shaer:proposer'], A, 'and it carries who actually proposed it');
+  }
 
   // B receives its copy on its own server and can answer it.
@@ -123 +133 @@
   database.prepare("INSERT OR IGNORE INTO ap_guardianships (slug, role, other_uri, status, offer_id) VALUES ('gb','guardian',?, 'accepted','o')").run(WARD);
   const gbSite = database.prepare('SELECT * FROM sites WHERE slug = ?').get('gb');
-  assert.equal(await G.handleGuardianshipInbox(gbSite, { ...offer, actor: A, to: ['https://test.example/ap/users/gb'] }), true);
+  // Exactly the shape the ward sends: actor = the ward, proposer alongside.
+  assert.equal(await G.handleGuardianshipInbox(gbSite, {
+    ...offer, actor: WARD, 'shaer:proposer': A, to: ['https://test.example/ap/users/gb'],
+  }), true);
   const review = G.gated.listGatedReviews('gb')[0];
   assert.ok(review, 'the guardian stores a copy it can answer');
+  assert.equal(review.proposer, A, 'the screen names who proposed it, not the ward that relayed it');
   assert.equal(review.feature, 'shaer:externalEmbeds');
   assert.equal(review.ward_uri, WARD);