Changeset ccaa530 in Klonkt for src/services/ActivityPubService.js

Timestamp:

07/31/2026 01:34:46 PM (6 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

5462bab

Parents:

2dd1dc4

Message:

Account-verhuizingen: inkomende Move plus alsoKnownAs-aliassen (FEP-7628)

De ontvangende helft van accountverhuizingen, in twee delen die samen een
verhuizing NAAR Klonkt mogelijk maken (shaer-0j2, slice 1).

Deel 1: een account dat onze sites volgen verhuist. Op een geldige Move volgt
elke lokale volger automatisch mee naar het nieuwe adres, met behoud van de
eigen auto-boost-keuze. Geldigheid heeft twee onafhankelijke benen en beide
zijn verplicht: de ondertekenaar is zelf partij in de verhuizing (oude actor
in push-modus of nieuwe actor in pull-modus), en de nieuwe actor claimt de
oude identiteit in alsoKnownAs. Zonder het eerste kan elke ondertekende
vreemde onze follows ompointen; zonder het tweede kan wie een kant beheerst
de volgers van de andere kant kapen. Herbezorging is idempotent, een
geblokkeerde bestemming wordt geweigerd, en guardianship-relaties worden
bewust NIET geretarget: een guardian is een beveiligingsanker en verhuist
pas onder de regels van shaer-tge.

Deel 2: eigen aliassen instellen via Beheer, Sites, site bewerken. Een regel
per oud account, als @naam@server of als actor-URL. Handles resolven via
WebFinger op het moment van opslaan, zodat een typfout direct zichtbaar is
in plaats van pas bij een mislukkende Move op de oude server. De aliassen
verschijnen als alsoKnownAs op de publieke actor; dat is de claim die de
oude server controleert voor hij volgers hierheen verhuist.

Let op: FEP-7628 heeft status DRAFT. De vorm is sinds 2019 de facto
Mastodon-standaard, maar de spec kan nog wijzigen.

Changed files:
src/services/ActivityPubService.js

• Move toegevoegd aan de GATED-lijst (handtekening verplicht)
• dispatch-blok voor Move, voor de Follow-afhandeling (geen race met de re-Follow-golf van de nieuwe actor)
• handleMoveInbox met injecteerbare afhankelijkheden voor de tests
• alsoKnownAs en movedTo als JSON-LD-termen in de context
• buildActor publiceert alsoKnownAs uit sites.ap_aliases, eigen id en niet-URLs gefilterd

src/config/database.js

• kolom sites.ap_aliases (JSON-array van actor-URIs)

src/routes/admin-sites.js

• parseApAliases: max 5, dedupe, WebFinger-resolutie bij opslaan, fout met de betreffende regel terug naar het formulier
• save-route asynchroon; ap_aliases in de UPDATE
• actor-Update naar volgers wanneer de lijst wijzigt (best-effort)

src/views/pages/admin-site-edit.ejs

• veld Fediverse-aliassen onder de profiel-links

src/services/i18n.js

• asite.aliases en asite.aliases_hint in nl, en en de

New file:
test/move-actor.test.js

• 11 tests: derde-partij-weigering, ontbrekend aliasbewijs, push- en pull-modus, idempotentie, al-volgend overslaan, geblokkeerd doel, misvormde activiteiten, ongesigneerd, actor-publicatie met filtering

-robo
Co-Authored-By: Claude Fable 5 <noreply@…>

File:

• src/services/ActivityPubService.js (modified) (6 diffs)

src/services/ActivityPubService.js

@@ -46 +46 @@
     manuallyApprovesFollowers: 'as:manuallyApprovesFollowers',
     discoverable: 'toot:discoverable',
+    // FEP-7628 (account moves): same term declaration Mastodon ships.
+    alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' },
+    movedTo: { '@id': 'as:movedTo', '@type': '@id' },
     featured: { '@id': 'toot:featured', '@type': '@id' },
     PropertyValue: 'schema:PropertyValue',
@@ -221 +224 @@
   // Account creation date — shown by Mastodon + read by indexers (additive, standard AS2).
   if (site.created_at) { try { actor.published = new Date(site.created_at).toISOString(); } catch { /* skip bad date */ } }
+  // FEP-7628: former identities this account claims. The OLD server checks for
+  // exactly this back-reference before it will move followers here, so the
+  // list must be on the public actor, not tucked away in settings.
+  try {
+    const aka = JSON.parse(site.ap_aliases || '[]');
+    if (Array.isArray(aka)) {
+      const clean = aka.filter((u) => typeof u === 'string' && /^https?:\/\//i.test(u) && u !== id);
+      if (clean.length) actor.alsoKnownAs = clean;
+    }
+  } catch { /* skip malformed ap_aliases */ }
   // Profile links → PropertyValue rows: Mastodon/PeerTube/WordPress-ActivityPub render these as
   // profile metadata (rel=me enables link-back verification). Additive; ignored by simpler receivers.
@@ -1437 +1450 @@
   // Blocked actor/domain → silently drop (202, don't reveal the block).
   if (claimedActor && isBlockedAny(claimedActor)) { console.log('[AP] inbox dropped (blocked)', claimedActor, 'from', ip); return 202; }
-  const GATED = ['Create', 'Like', 'Announce', 'Follow', 'Delete', 'Undo', 'Accept', 'Reject', 'Add', 'Remove', 'Update', 'Flag', 'Offer'];
+  const GATED = ['Create', 'Like', 'Announce', 'Follow', 'Delete', 'Undo', 'Accept', 'Reject', 'Add', 'Remove', 'Update', 'Flag', 'Offer', 'Move'];
   if (GATED.includes(type)) {
     if (!verified || !claimedActor || verified.id !== claimedActor) {
@@ -1513 +1526 @@
     } catch { /* ignore */ }
     return 202;
+  }
+
+  // FEP-7628 (DRAFT): an account moved house. Handled before Follow on purpose:
+  // a Move often arrives seconds before the new actor's re-Follow wave, and the
+  // swap below must not race our own outgoing Follow of the target.
+  if (type === 'Move') {
+    return handleMoveInbox(act, { verifiedActor: claimedActor });
   }
 
@@ -3760 +3780 @@
 }
 
+/**
+ * FEP-7628 (DRAFT status — the shape is Mastodon's since 2019, but the FEP can
+ * still change): an account our sites follow says it moved to a new home.
+ *
+ * Validity has two independent legs, and both must hold:
+ *  1. The SIGNER is a party to the move: the old actor announcing its own move
+ *     (push mode) or the new actor doing it (pull mode). A third party
+ *     narrating someone else's move is refused — without this, any signed
+ *     stranger could re-point our follows.
+ *  2. The NEW actor claims the old identity in its `alsoKnownAs`. That is the
+ *     cross-side proof: the mover controls both ends. Without it, whoever
+ *     holds ONE end could hijack the other end's followers.
+ *
+ * Effect: every local site following the old actor unfollows it and follows
+ * the new one, keeping its auto-boost choice. Deliberately NOT retargeted:
+ * guardianship relations (FEP-633c) — a guardian is a security anchor, not a
+ * feed subscription, and moving one is shaer-tge's gated decision, not a
+ * side effect of an inbox event. We only log when a move touches one.
+ *
+ * Deps are injectable for tests (no network in node:test).
+ */
+export async function handleMoveInbox(act, { verifiedActor = null, fetchActorFn = null, followFn = null, unfollowFn = null } = {}) {
+  const oldUri = typeof act.object === 'string' ? act.object : (act.object && act.object.id);
+  const newUri = typeof act.target === 'string' ? act.target : (act.target && act.target.id);
+  if (!oldUri || !newUri || oldUri === newUri) return 400;
+  if (!verifiedActor || (verifiedActor !== oldUri && verifiedActor !== newUri)) {
+    console.warn('[AP] Move refused: signer is not a party to the move', verifiedActor || '(unsigned)', oldUri, '→', newUri);
+    return 401;
+  }
+  // Nobody here follows the old actor → nothing to move. This also makes
+  // redelivery idempotent: after the first swap the rows are gone.
+  let rows = [];
+  try { rows = db.prepare('SELECT * FROM ap_following WHERE actor_uri = ?').all(oldUri); } catch { /* fresh init */ }
+  if (!rows.length) return 202;
+  // A blocked destination is declined outright: the old follow stays (it goes
+  // stale on its own), and we will not open a door to a blocked house.
+  if (isBlockedAny(newUri)) { console.log('[AP] Move dropped: target is blocked', newUri); return 202; }
+  const target = await (fetchActorFn || fetchActor)(newUri);
+  const aka = [].concat((target && target.alsoKnownAs) || [])
+    .map((a) => (typeof a === 'string' ? a : (a && a.id))).filter(Boolean);
+  if (!target || !target.id || !aka.includes(oldUri)) {
+    console.warn('[AP] Move refused: target does not claim the old actor in alsoKnownAs', oldUri, '→', newUri);
+    return 202; // decline to act; no 4xx, the sender may be a well-meaning retrying server
+  }
+  for (const row of rows) {
+    const site = db.prepare('SELECT * FROM sites WHERE slug = ?').get(row.slug);
+    if (!site) continue;
+    try {
+      await (unfollowFn || unfollowActor)(site, oldUri);
+      const already = fwStmts().one.get(row.slug, newUri);
+      if (!already) await (followFn || followActor)(site, newUri, !!row.auto_boost);
+      console.log('[AP] follow moved', row.slug, ':', oldUri, '→', newUri);
+    } catch (e) {
+      console.warn('[AP] move re-follow failed for', row.slug, e && e.message);
+    }
+  }
+  try {
+    const g = db.prepare('SELECT slug, role FROM ap_guardianships WHERE other_uri = ? AND status = ?').all(oldUri, 'accepted');
+    if (g.length) console.warn('[AP] Move touches a guardianship party — left untouched (shaer-tge):', oldUri, '→', g.map((r) => `${r.role}:${r.slug}`).join(', '));
+  } catch { /* table absent on fresh init */ }
+  return 202;
+}
+
 // FEP-633c §5.3 note (authorized fetch): true when `actorUri` is a committed
 /**
@@ -4276 +4359 @@
   getInteractions, getInteractionById, setInteractionBoosted, setInteractionLiked, setMyReaction, getMyReactions, buildReplyNote, getOutboxNote, getSentNotes, deliverReply, resolveRemoteNote,
   listOutbox, deliverOutboxDelete, deliverOutboxUpdate, deliverDirectNote,
-  webfingerResolve, followActor, resolveRemoteActor, unfollowActor, listFollowing, setAutoBoost, backfillFromOutbox, getTimeline, getDirectMessages, isoStamp, timelineAttachments, timelineEmojis, timelineObjectLinks, timelineQuote, timelineEmbed, applyQuoteProps, deliverToActor, sendInteraction, voteOnPoll, voteOnRemotePoll,
+  webfingerResolve, followActor, resolveRemoteActor, unfollowActor, handleMoveInbox, listFollowing, setAutoBoost, backfillFromOutbox, getTimeline, getDirectMessages, isoStamp, timelineAttachments, timelineEmojis, timelineObjectLinks, timelineQuote, timelineEmbed, applyQuoteProps, deliverToActor, sendInteraction, voteOnPoll, voteOnRemotePoll,
   acceptGatedFollow, rejectGatedFollow, isWardGuardian, outboxAudience, sendFollowDecision,
   parseOwnPoll, pollTally, ownPollView, deliverPollUpdate, maybeCrawlThread, sendReport, localMentionSlugs,