Followers and circle members may like, react, vote and downvote

LikeHandler.MaySee let a remote account interact with a followers-only
post only when the post named it in to, cc or its mentions. Our own
followers-only posts are addressed to the followers collection, never to
each follower, and circle posts were not considered at all, so every
like, reaction, downvote and poll vote from a follower on a
followers-only post, and from a member on a circle post, was dropped as
"not-visible". Likes, dislikes, reactions and poll votes now ask
VisibilityPolicy.RemoteCanSee: anyone for public and unlisted posts, an
addressed account for a DM, an accepted follower or an addressed account
for followers-only, a foreign member for a circle post, and never a
server's instance actor (SignedFetchAuthorizer's alias is for refetches
only).

Found by planning the town's multi-server interaction checks (G-0001).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

PrivaPub.Tests/Federation/InteractionTests.cs

@@ -3,8 +3,10 @@ using MongoDB.Entities;
 using PrivaPub.ClientModels.Post;
 using PrivaPub.ClientModels.Social;
 using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Group;
 using PrivaPub.Models.Post;
 using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
 using PrivaPub.Tests.Support;
 
 using System.Text.Json.Nodes;
@@ -74,6 +76,66 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal(0, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).FavouritesCount);
 		}
 
+		// Our followers-only posts are addressed to the followers collection, never to each follower, so a follower is found
+		// among our followers, not in to/cc. The town found every follower's like, reaction and downvote dropped (G-0001).
+		[Fact]
+		public async Task A_follower_likes_reacts_to_and_downvotes_a_followers_only_post()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, post) = await LocalPost("followersonly");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			await _harness.FollowedBy(_harness.Local.FromAvatar(await DB.Default.Find<Avatar>().OneAsync(post.GroupUserId, token)), carol);
+
+			await _harness.Deliver(carol, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(carol)}/likes/{Guid.NewGuid():N}", ["type"] = "Like", ["actor"] = carol.Id, ["object"] = post.ObjectURI
+			});
+			await _harness.Deliver(carol, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(carol)}/reactions/{Guid.NewGuid():N}", ["type"] = "EmojiReact", ["actor"] = carol.Id, ["object"] = post.ObjectURI,
+				["content"] = "🔥"
+			});
+			await _harness.Deliver(carol, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(carol)}/dislikes/{Guid.NewGuid():N}", ["type"] = "Dislike", ["actor"] = carol.Id, ["object"] = post.ObjectURI
+			});
+
+			var stored = await DB.Default.Find<Post>().OneAsync(post.ID, token);
+			Assert.Equal(1, stored.FavouritesCount);
+			Assert.Equal(1, stored.DownvotesCount);
+			Assert.True(await DB.Default.Find<Reaction>().Match(r => r.PostId == post.ID && r.ActorURI == carol.Id && r.Emoji == "🔥").ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task A_circle_member_likes_a_circle_post_and_an_outsider_cannot()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var carol = new RemoteActor(_harness.Peer, "carol");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			var circle = new Group
+			{
+				UserName = $"circle{Guid.NewGuid():N}"[..20], Name = "a circle", Kind = GroupKind.Circle, OwnerAvatarId = alice.Id,
+				Members = { new() { AvatarId = alice.Id }, new() { AvatarId = carol.Id, IsForeign = true } }
+			};
+			await DB.Default.SaveAsync(circle, token);
+			var post = new Post
+			{
+				GroupUserId = alice.Id, AuthorAccountId = alice.Id, GroupId = circle.ID, Visibility = PostVisibility.Circle, Text = "only us",
+				ObjectURI = $"{alice.Uri}/scribbles/{Guid.NewGuid():N}"
+			};
+			await DB.Default.SaveAsync(post, token);
+
+			foreach (var who in new[] { carol, mallory })
+				await _harness.Deliver(who, "/human-centipede", new JsonObject
+				{
+					["id"] = $"{Origin(who)}/likes/{Guid.NewGuid():N}", ["type"] = "Like", ["actor"] = who.Id, ["object"] = post.ObjectURI
+				});
+
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).FavouritesCount);
+			Assert.True(await DB.Default.Find<Favourite>().Match(f => f.PostId == post.ID && f.ActorURI == carol.Id).ExecuteAnyAsync(token));
+		}
+
 		[Fact]
 		public async Task A_boost_of_a_local_post_counts_notifies_and_can_be_undone()
 		{