A group's owner sees its members and requests, declines and removes
/clientapi/group had no way to see who is in a group or asks to join it, so a circle's owner could not answer a request from elsewhere. Now: - GET /clientapi/group/members: the members (local and remote, with their role) and the pending requests, for the group's owner and moderators only; - POST /clientapi/group/reject: declines a request, telling the asker's server with a Reject of its Follow; - POST /clientapi/group/remove: takes a member out (never the owner): a persona here stops following the group, one elsewhere gets a Reject of its Follow, as Mastodon removes a follower. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw
This commit is contained in:
thepraandClaude Opus 5.5 committed
1 parent
f38ac73615
commit
1265611f9e
6 files changed
+222
-1
No files matched your search
@@ -48,6 +48,18 @@ namespace PrivaPub.Controllers.ClientToServer
|
||||
public async Task<IActionResult> Approve(GroupMembershipForm form, CancellationToken token) =>
|
||||
!ModelState.IsValid ? Invalid() : Answer(await _groupUsersService.ApproveMember(User.GetUserId(), form, token));
|
||||
|
||||
[HttpGet, Route("/clientapi/group/members")]
|
||||
public async Task<IActionResult> Members([FromQuery] string avatarId, [FromQuery] string groupId, CancellationToken token) =>
|
||||
Answer(await _groupUsersService.GetMembers(User.GetUserId(), avatarId, groupId, token));
|
||||
|
||||
[HttpPost, Route("/clientapi/group/reject")]
|
||||
public async Task<IActionResult> Reject(GroupMembershipForm form, CancellationToken token) =>
|
||||
!ModelState.IsValid ? Invalid() : Answer(await _groupUsersService.RejectMember(User.GetUserId(), form, token));
|
||||
|
||||
[HttpPost, Route("/clientapi/group/remove")]
|
||||
public async Task<IActionResult> Remove(GroupMembershipForm form, CancellationToken token) =>
|
||||
!ModelState.IsValid ? Invalid() : Answer(await _groupUsersService.RemoveMember(User.GetUserId(), form, token));
|
||||
|
||||
IActionResult Invalid() => BadRequest(new WebResult().Invalidate(_localizer["Invalid model."]));
|
||||
|
||||
IActionResult Answer(WebResult result) => result.IsValid ? Ok(result.Data) : StatusCode(result.StatusCode, result);
|
||||
|
||||
@@ -25,6 +25,9 @@ namespace PrivaPub.Services
|
||||
Task<WebResult> JoinGroup(string rootUserId, JoinGroupForm form, CancellationToken token);
|
||||
Task<WebResult> LeaveGroup(string rootUserId, GroupMembershipForm form, CancellationToken token);
|
||||
Task<WebResult> ApproveMember(string rootUserId, GroupMembershipForm form, CancellationToken token);
|
||||
Task<WebResult> GetMembers(string rootUserId, string avatarId, string groupId, CancellationToken token);
|
||||
Task<WebResult> RejectMember(string rootUserId, GroupMembershipForm form, CancellationToken token);
|
||||
Task<WebResult> RemoveMember(string rootUserId, GroupMembershipForm form, CancellationToken token);
|
||||
Task<WebResult> GetInvitation(string invitationCode, string invitationPassword, CancellationToken token);
|
||||
}
|
||||
|
||||
@@ -338,6 +341,148 @@ namespace PrivaPub.Services
|
||||
return result;
|
||||
}
|
||||
|
||||
// the group's members and the requests to join it, for its owner and moderators only: members are never shown to
|
||||
// anyone else (FEDERATION.md, followers' members are never public)
|
||||
public async Task<WebResult> GetMembers(string rootUserId, string avatarId, string groupId, CancellationToken token)
|
||||
{
|
||||
var result = new WebResult();
|
||||
try
|
||||
{
|
||||
var group = await ManagedGroup(rootUserId, avatarId, groupId, token);
|
||||
if (group == default)
|
||||
return result.Invalidate(_localizer["Group not found."], StatusCodes.Status404NotFound);
|
||||
|
||||
var members = new List<ViewGroupMember>();
|
||||
foreach (var member in group.Members)
|
||||
{
|
||||
if (member.IsForeign)
|
||||
{
|
||||
var foreign = await _dbEntities.ForeignAvatars.Match(a => a.ActorURI == member.AvatarId).ExecuteFirstAsync(token);
|
||||
members.Add(Remote(member.AvatarId, foreign, member.Role, member.JoinedAt, pending: false));
|
||||
continue;
|
||||
}
|
||||
if (await _localActors.FindById(LocalActorKind.Person, member.AvatarId, token) is { } local)
|
||||
members.Add(new ViewGroupMember
|
||||
{
|
||||
ActorUri = local.Uri, Handle = local.Handle, Name = local.Name ?? local.UserName, PictureUrl = local.PictureURL,
|
||||
IsLocal = true, Role = member.Role.ToString().ToLowerInvariant(), Since = member.JoinedAt
|
||||
});
|
||||
}
|
||||
var asking = await _dbEntities.Followers
|
||||
.Match(f => f.LocalActorId == group.ID && f.LocalActorKind == LocalActorKind.Group && !f.IsAccepted)
|
||||
.Sort(f => f.CreationDate, Order.Ascending)
|
||||
.ExecuteAsync(token);
|
||||
foreach (var request in asking.Where(r => members.All(m => m.ActorUri != r.ActorURI)))
|
||||
{
|
||||
var foreign = await _dbEntities.ForeignAvatars.Match(a => a.ActorURI == request.ActorURI).ExecuteFirstAsync(token);
|
||||
members.Add(Remote(request.ActorURI, foreign, GroupRole.Member, request.CreationDate, pending: true));
|
||||
}
|
||||
result.Data = members;
|
||||
return result;
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger.LogError(ex, $"{nameof(GroupUsersService)}.{nameof(GetMembers)}");
|
||||
return result.Invalidate(_localizer["Something went wrong."], exception: ex);
|
||||
}
|
||||
}
|
||||
|
||||
static ViewGroupMember Remote(string actorUri, Models.User.ForeignAvatar foreign, GroupRole role, DateTime since, bool pending) => new()
|
||||
{
|
||||
ActorUri = actorUri,
|
||||
Handle = foreign == default ? actorUri : $"{foreign.UserName}@{foreign.Domain}",
|
||||
Name = foreign?.Name ?? foreign?.UserName,
|
||||
PictureUrl = foreign?.PictureURL,
|
||||
IsPending = pending,
|
||||
Role = role.ToString().ToLowerInvariant(),
|
||||
Since = since
|
||||
};
|
||||
|
||||
// a request to join declined: the asker's server is told with a Reject of its Follow
|
||||
public async Task<WebResult> RejectMember(string rootUserId, GroupMembershipForm form, CancellationToken token)
|
||||
{
|
||||
var result = new WebResult();
|
||||
try
|
||||
{
|
||||
var group = await ManagedGroup(rootUserId, form.AvatarId, form.GroupId, token);
|
||||
if (group == default)
|
||||
return result.Invalidate(_localizer["Group not found."], StatusCodes.Status404NotFound);
|
||||
var request = await _dbEntities.Followers
|
||||
.Match(f => f.LocalActorId == group.ID && f.LocalActorKind == LocalActorKind.Group && f.ActorURI == form.MemberActorURI && !f.IsAccepted)
|
||||
.ExecuteFirstAsync(token);
|
||||
if (request == default)
|
||||
return result.Invalidate(_localizer["Request not found."], StatusCodes.Status404NotFound);
|
||||
await DB.Default.DeleteAsync<Follower>(request.ID);
|
||||
await RejectFollow(group, request, token);
|
||||
return result;
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger.LogError(ex, $"{nameof(GroupUsersService)}.{nameof(RejectMember)}");
|
||||
return result.Invalidate(_localizer["Something went wrong."], exception: ex);
|
||||
}
|
||||
}
|
||||
|
||||
// a member taken out of the group: a persona here stops following it, someone elsewhere is told with a Reject of
|
||||
// their Follow (as Mastodon removes a follower). The owner stays.
|
||||
public async Task<WebResult> RemoveMember(string rootUserId, GroupMembershipForm form, CancellationToken token)
|
||||
{
|
||||
var result = new WebResult();
|
||||
try
|
||||
{
|
||||
var group = await ManagedGroup(rootUserId, form.AvatarId, form.GroupId, token);
|
||||
if (group == default)
|
||||
return result.Invalidate(_localizer["Group not found."], StatusCodes.Status404NotFound);
|
||||
var localMember = await _localActors.FindByUri(form.MemberActorURI, token);
|
||||
var member = group.Members.FirstOrDefault(m => localMember is { Kind: LocalActorKind.Person }
|
||||
? !m.IsForeign && m.AvatarId == localMember.Id
|
||||
: m.IsForeign && m.AvatarId == form.MemberActorURI);
|
||||
if (member == default)
|
||||
return result.Invalidate(_localizer["Member not found."], StatusCodes.Status404NotFound);
|
||||
if (member.Role == GroupRole.Owner)
|
||||
return result.Invalidate(_localizer["The owner cannot leave the group."]);
|
||||
|
||||
group.Members.Remove(member);
|
||||
group.UpdatedAt = DateTime.UtcNow;
|
||||
await DB.Default.SaveAsync(group, token);
|
||||
var follower = await _dbEntities.Followers
|
||||
.Match(f => f.LocalActorId == group.ID && f.LocalActorKind == LocalActorKind.Group && f.ActorURI == form.MemberActorURI)
|
||||
.ExecuteFirstAsync(token);
|
||||
if (follower != default)
|
||||
await DB.Default.DeleteAsync<Follower>(follower.ID);
|
||||
if (localMember is { Kind: LocalActorKind.Person })
|
||||
{
|
||||
var groupUri = _localActors.FromGroup(group).Uri;
|
||||
await DB.Default.DeleteAsync<Models.Social.Following>(f => f.AvatarId == localMember.Id && f.TargetActorURI == groupUri);
|
||||
}
|
||||
else if (follower != default)
|
||||
await RejectFollow(group, follower, token);
|
||||
return result;
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger.LogError(ex, $"{nameof(GroupUsersService)}.{nameof(RemoveMember)}");
|
||||
return result.Invalidate(_localizer["Something went wrong."], exception: ex);
|
||||
}
|
||||
}
|
||||
|
||||
async Task RejectFollow(GroupEntity group, Follower follower, CancellationToken token)
|
||||
{
|
||||
if (string.IsNullOrEmpty(follower.InboxURL))
|
||||
return;
|
||||
var actor = _localActors.FromGroup(group);
|
||||
var follow = new System.Text.Json.Nodes.JsonObject
|
||||
{
|
||||
["id"] = follower.FollowActivityURI,
|
||||
["type"] = "Follow",
|
||||
["actor"] = follower.ActorURI,
|
||||
["object"] = actor.Uri
|
||||
};
|
||||
var reject = ActivityPubRenderer.Accept(actor, follow, $"reject-{follower.ID}-{DateTime.UtcNow.Ticks}");
|
||||
reject["type"] = "Reject";
|
||||
await _delivery.Enqueue(actor, new[] { follower.InboxURL }, reject, token);
|
||||
}
|
||||
|
||||
async Task<GroupEntity> ManagedGroup(string rootUserId, string avatarId, string groupId, CancellationToken token)
|
||||
{
|
||||
if (!await OwnsAvatar(rootUserId, avatarId, token))
|
||||
|
||||
Reference in new issue
Block a user