Changeset d5aa7c8 in Klonkt

Timestamp:

06/30/2026 01:24:56 PM (2 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

462a931

Parents:

61514f2

Message:

fix(federation): clear ap_my_reactions when a boosted/liked remote post is deleted

The inbound Delete handler cleaned ap_interactions + ap_timeline but not ap_my_reactions, so a
boost/like you made of a remote post (via the interact page) stayed stuck as "boosted" after
that post was deleted upstream. Now also remove the ap_my_reactions record, host-scoped so a
remote actor can only clear reactions to its OWN domain's notes.

• src/services/ActivityPubService.js — Delete handler clears ap_my_reactions (host-guarded)

Co-Authored-By: Claude <noreply@…>

File:

• src/services/ActivityPubService.js (modified) (1 diff)

src/services/ActivityPubService.js

@@ -881 +881 @@
       try { db.prepare('DELETE FROM ap_interactions WHERE object_uri = ? AND actor_uri = ?').run(oid, claimedActor); } catch { /* ignore */ }
       try { db.prepare('DELETE FROM ap_timeline WHERE id = ? AND author_uri = ?').run(oid, claimedActor); } catch { /* ignore */ }
+      // Also clear a boost/like YOU made of this now-deleted remote post (the interact-page
+      // ap_my_reactions state), so it can't stay stuck as "boosted" on a post that's gone.
+      // Guard: only when the deleter owns the note's domain (B mustn't clear your reactions
+      // to A's posts).
+      try {
+        let sameHost = false;
+        try { sameHost = new URL(oid).host === new URL(claimedActor).host; } catch { sameHost = false; }
+        if (sameHost) db.prepare('DELETE FROM ap_my_reactions WHERE target_uri = ?').run(oid);
+      } catch { /* ignore */ }
     }
     return 202;