P5 done: a key we cannot fetch for now gets 503, and follow/like/block ids stay private on purpose

- When a sender's key cannot be fetched because its server timed out or answered 5xx, the inbox answers 503 with
  Retry-After: 300 instead of 401, so Mastodon 4.7 retries rather than switching to RFC 9421 signatures we do not
  verify yet. The fetcher's failure cache now remembers whether a failure was temporary.
- Follow, Like, Block, Accept, Reject and Undo ids are deliberately not dereferenceable: serving them would publish
  who follows, likes and blocks whom. They are always sent with their object embedded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Federation/Actors/RemoteActorService.cs

@@ -19,6 +19,7 @@ namespace PrivaPub.Federation.Actors
 		Task<FetchedJson> FetchObject(string uri, CancellationToken token);
 		Task<ForeignAvatar> GetActor(string actorUri, bool refresh, CancellationToken token);
 		Task<ForeignAvatar> GetActorByKeyId(string keyId, bool refresh, CancellationToken token);
+		bool KeyTemporarilyUnavailable(string keyId) => false;
 		Task<string> ResolveHandle(string handle, CancellationToken token);
 	}
 
@@ -120,6 +121,8 @@ namespace PrivaPub.Federation.Actors
 			return await Upsert(actor, key, token);
 		}
 
+		public bool KeyTemporarilyUnavailable(string keyId) => Origin.Of(keyId) != default && _http.FailedTemporarily(StripFragment(keyId));
+
 		public async Task<string> ResolveHandle(string handle, CancellationToken token)
 		{
 			var parts = handle?.TrimStart('@').Split('@');

PrivaPub/Federation/Controllers/PeasantsController.cs

@@ -333,6 +333,8 @@ namespace PrivaPub.Federation.Controllers
 		{
 			if (result.Error != default)
 				_logger.LogInformation("Inbox refused with {Status}: {Error}", result.StatusCode, result.Error);
+			if (result.RetryAfterSeconds is { } seconds)
+				Response.Headers.RetryAfter = seconds.ToString(System.Globalization.CultureInfo.InvariantCulture);
 			return result.Error == default ? StatusCode(result.StatusCode) : StatusCode(result.StatusCode, result.Error);
 		}
 

PrivaPub/Federation/Inbox/InboxReceiver.cs

@@ -13,7 +13,7 @@ using static PrivaPub.Federation.Objects.ActivityJson;
 
 namespace PrivaPub.Federation.Inbox
 {
-	public sealed record InboxResult(int StatusCode, string Error = default);
+	public sealed record InboxResult(int StatusCode, string Error = default, int? RetryAfterSeconds = default);
 
 	public sealed record InboxPayload(string ActorURI, string Activity, string Inbox = default, string KeyId = default, string Algorithm = default,
 		string[] SignedHeaders = default, DateTime? ReceivedAt = default);
@@ -25,6 +25,8 @@ namespace PrivaPub.Federation.Inbox
 
 	public class InboxReceiver : IInboxReceiver
 	{
+		const int KeyRetrySeconds = 300;
+
 		const int MaxBodyBytes = 1024 * 1024;
 
 		readonly ILocalActorService _localActors;
@@ -88,6 +90,8 @@ namespace PrivaPub.Federation.Inbox
 			if (keyOwner == default || !HttpSignatures.Verify(keyOwner.PublicKey, signingString, parameters.Signature))
 			{
 				keyOwner = await _remoteActors.GetActorByKeyId(parameters.KeyId, refresh: true, token);
+				if (keyOwner == default && _remoteActors.KeyTemporarilyUnavailable(parameters.KeyId))
+					return new(StatusCodes.Status503ServiceUnavailable, "the signing key could not be fetched; try again later", KeyRetrySeconds);
 				if (keyOwner == default || !HttpSignatures.Verify(keyOwner.PublicKey, signingString, parameters.Signature))
 					return new(StatusCodes.Status401Unauthorized, "the signature does not verify");
 			}