P5, first batch: summaries stop hiding articles, personas get reachable names, blocks federate

- A remote `summary` is a content warning only on a Note or Question, or when `sensitive` is set. On Articles,
  Events, Videos, Pages and Audio it is an excerpt (WordPress teasers, Mobilizon dates and places, Mbin titles) and
  is now kept as `Post.Excerpt` instead of hiding the post. `Post.ObjectType` records the remote type, and the
  Mastodon API shows a remote non-Note object's title above its body again.
- Persona usernames must match `^[a-z0-9_]+$`, as groups already did; a name outside it was unreachable from
  Mastodon and Misskey.
- `postingRestrictedToMods` is defined in our JSON-LD context (Iceshrimp.NET drops undefined terms).
- `Vary: Accept` on actor and object URLs.
- Owner decision: blocks federate. A block sends `Block`, an unblock `Undo{Block}`; checked live against GoToSocial.
- Owner decision: a persona's and a group's `published`, and the day in new ids, is a random day up to two weeks
  before creation, so personas made the same day no longer share a date. Migration _007 gives existing ones theirs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Api/Mastodon/Mappers/MastodonMapper.cs

@@ -225,9 +225,12 @@ namespace PrivaPub.Api.Mastodon.Mappers
 		public static string Content(PostEntity post)
 		{
 			var content = post.ContentHtml ?? ActivityPubRenderer.Html(post.Text);
-			return string.IsNullOrEmpty(post.Title) || post.IsFederatedCopy
-				? content ?? string.Empty
-				: $"<p><strong>{WebUtility.HtmlEncode(post.Title)}</strong></p>{content}";
+			if (post.IsFederatedCopy && string.IsNullOrWhiteSpace(content) && !string.IsNullOrEmpty(post.Excerpt))
+				content = $"<p>{WebUtility.HtmlEncode(post.Excerpt)}</p>";
+			var titled = !string.IsNullOrEmpty(post.Title) && (!post.IsFederatedCopy || post.ObjectType is not (null or "Note" or "Question"));
+			return titled
+				? $"<p><strong>{WebUtility.HtmlEncode(post.Title)}</strong></p>{content}"
+				: content ?? string.Empty;
 		}
 
 		public static string Visibility(PostVisibility visibility) => visibility switch

PrivaPub/Domain/Relationships/RelationshipService.cs

@@ -38,12 +38,14 @@ namespace PrivaPub.Domain.Relationships
 
 		public async Task Block(LocalActor me, string targetActorUri, string targetAccountId, CancellationToken token)
 		{
+			var block = new Block { AvatarId = me.Id, TargetAccountId = targetAccountId, TargetActorURI = targetActorUri };
 			try
 			{
-				await DB.Default.SaveAsync(new Block { AvatarId = me.Id, TargetAccountId = targetAccountId, TargetActorURI = targetActorUri }, token);
+				await DB.Default.SaveAsync(block, token);
 			}
 			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
 			{
+				block = await DB.Default.Find<Block>().Match(b => b.AvatarId == me.Id && b.TargetActorURI == targetActorUri).ExecuteFirstAsync(token);
 			}
 
 			await _follows.UnfollowAs(me, targetActorUri, token);
@@ -67,10 +69,44 @@ namespace PrivaPub.Domain.Relationships
 					await DB.Default.DeleteAsync<Following>(f => f.TargetActorURI == me.Uri && f.AvatarId == targetAccountId);
 			}
 			await Forget(me, targetAccountId, token);
+			if (block != default)
+				await Tell(me, targetActorUri, BlockActivity(me, block), token);
 		}
 
-		public async Task Unblock(LocalActor me, string targetActorUri, CancellationToken token) =>
-			await DB.Default.DeleteAsync<Block>(b => b.AvatarId == me.Id && b.TargetActorURI == targetActorUri);
+		public async Task Unblock(LocalActor me, string targetActorUri, CancellationToken token)
+		{
+			var block = await DB.Default.Find<Block>().Match(b => b.AvatarId == me.Id && b.TargetActorURI == targetActorUri).ExecuteFirstAsync(token);
+			if (block == default)
+				return;
+			await DB.Default.DeleteAsync<Block>(block.ID);
+			await Tell(me, targetActorUri, new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.ActivityStreams,
+				["id"] = me.ActivityUri($"undo-block-{block.ID}"),
+				["type"] = "Undo",
+				["actor"] = me.Uri,
+				["object"] = BlockActivity(me, block)
+			}, token);
+		}
+
+		static JsonObject BlockActivity(LocalActor me, Block block) => new()
+		{
+			["@context"] = ActivityPubRenderer.ActivityStreams,
+			["id"] = me.ActivityUri($"block-{block.ID}"),
+			["type"] = "Block",
+			["actor"] = me.Uri,
+			["object"] = block.TargetActorURI,
+			["to"] = new JsonArray(block.TargetActorURI)
+		};
+
+		async Task Tell(LocalActor me, string targetActorUri, JsonObject activity, CancellationToken token)
+		{
+			if (targetActorUri.StartsWith(me.BaseAddress + "/", StringComparison.OrdinalIgnoreCase))
+				return;
+			var target = await _dbEntities.ForeignAvatars.Match(f => f.ActorURI == targetActorUri).ExecuteFirstAsync(token);
+			if (!string.IsNullOrEmpty(target?.InboxURL))
+				await _delivery.Enqueue(me, new[] { target.InboxURL }, activity, token);
+		}
 
 		public async Task Mute(LocalActor me, string targetActorUri, string targetAccountId, bool hideNotifications, TimeSpan? duration, CancellationToken token)
 		{

PrivaPub/Federation/Actors/LocalActorService.cs

@@ -202,7 +202,7 @@ namespace PrivaPub.Federation.Actors
 			ThumbnailURL = avatar.ThumbnailURL,
 			PrivateKeyPem = avatar.PrivateKey,
 			PublicKeyPem = avatar.PublicKey,
-			Published = avatar.CreatedAt,
+			Published = avatar.PublishedOn,
 			Fields = avatar.Fields ?? new Dictionary<string, string>(),
 			ManuallyApprovesFollowers = avatar.Settings?.IsLocked == true,
 			Discoverable = avatar.Settings?.IsDiscoverable != false,
@@ -227,7 +227,7 @@ namespace PrivaPub.Federation.Actors
 			ManuallyApprovesFollowers = group.Kind == GroupKind.Circle || group.ManuallyApprovesMembers,
 			IsCircle = group.Kind == GroupKind.Circle,
 			PostingRestrictedToModerators = group.PostingPolicy == PostingPolicy.Moderators,
-			Published = group.CreationDate,
+			Published = group.PublishedOn,
 			BaseAddress = BaseAddress
 		};
 	}

PrivaPub/Federation/Controllers/PeasantsController.cs

@@ -317,6 +317,8 @@ namespace PrivaPub.Federation.Controllers
 		[NonAction]
 		public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
 		{
+			if (HttpMethods.IsGet(Request.Method))
+				Response.Headers.Vary = "Accept";
 			if (_federation.CurrentValue.SecureMode && HttpMethods.IsGet(Request.Method)
 				&& !string.Equals(context.RouteData.Values["actor"] as string, LocalActorService.InstanceUserName, StringComparison.OrdinalIgnoreCase)
 				&& await _fetches.Requester(Request, HttpContext.RequestAborted) == default)

PrivaPub/Federation/Inbox/Handlers/UpdateHandler.cs

@@ -72,6 +72,7 @@ namespace PrivaPub.Federation.Inbox.Handlers
 
 			post.Title = note.Title;
 			post.SpoilerText = note.SpoilerText;
+			post.Excerpt = note.Excerpt;
 			post.HasContentWarning = note.Sensitive;
 			post.Text = note.ContentHtml;
 			post.ContentHtml = note.ContentHtml;

PrivaPub/Federation/Inbox/RemotePosts.cs

@@ -70,8 +70,10 @@ namespace PrivaPub.Federation.Inbox
 				Url = note.Url,
 				ContextURI = note.Context,
 				QuoteURI = note.QuoteUri,
+				ObjectType = note.Type,
 				Title = note.Title,
 				SpoilerText = note.SpoilerText,
+				Excerpt = note.Excerpt,
 				HasContentWarning = note.Sensitive,
 				Text = note.ContentHtml,
 				ContentHtml = note.ContentHtml,

PrivaPub/Federation/Objects/NoteParser.cs

@@ -15,6 +15,7 @@ namespace PrivaPub.Federation.Objects
 		public string ContentHtml { get; init; }
 		public string Title { get; init; }
 		public string SpoilerText { get; init; }
+		public string Excerpt { get; init; }
 		public bool Sensitive { get; init; }
 		public string Language { get; init; }
 		public string Url { get; init; }
@@ -48,6 +49,8 @@ namespace PrivaPub.Federation.Objects
 
 			var (contentHtml, language) = Content(note);
 			var summary = Value(note, "summary");
+			var sensitive = note["sensitive"] is JsonValue flag && flag.TryGetValue<bool>(out var marked) && marked;
+			var summaryWarns = type is "Note" or "Question" || sensitive;
 			return new NoteDocument
 			{
 				Id = id,
@@ -55,9 +58,9 @@ namespace PrivaPub.Federation.Objects
 				AttributedTo = Attribution(note["attributedTo"]),
 				ContentHtml = ContentSanitizer.Html(contentHtml),
 				Title = Plain(Value(note, "name"), 500),
-				SpoilerText = Plain(summary, 500),
-				Sensitive = note["sensitive"] is JsonValue sensitive && sensitive.TryGetValue<bool>(out var s) && s
-					|| !string.IsNullOrWhiteSpace(summary),
+				SpoilerText = summaryWarns ? Plain(summary, 500) : default,
+				Excerpt = summaryWarns ? default : Plain(summary, 1000),
+				Sensitive = sensitive || summaryWarns && !string.IsNullOrWhiteSpace(summary),
 				Language = language,
 				Url = UrlOf(note["url"]) ?? id,
 				InReplyTo = Id(note["inReplyTo"]),

PrivaPub/Federation/Rendering/ActivityPubRenderer.cs

@@ -41,7 +41,9 @@ namespace PrivaPub.Federation.Rendering
 				["schema"] = "http://schema.org#",
 				["PropertyValue"] = "schema:PropertyValue",
 				["value"] = "schema:value",
-				["webfinger"] = "https://purl.archive.org/socialweb/webfinger#webfinger"
+				["webfinger"] = "https://purl.archive.org/socialweb/webfinger#webfinger",
+				["lemmy"] = "https://join-lemmy.org/ns#",
+				["postingRestrictedToMods"] = "lemmy:postingRestrictedToMods"
 			});
 
 		public static string Html(string markdown) =>

PrivaPub/Infrastructure/Data/Migrations/_007_personas_publish_a_spread_day.cs

@@ -0,0 +1,23 @@
+using MongoDB.Bson;
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Infrastructure.Ids;
+using PrivaPub.Models.User;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Infrastructure.Data.Migrations
+{
+	public class _007_personas_publish_a_spread_day : IMigration
+	{
+		public async Task UpgradeAsync()
+		{
+			var missing = new BsonDocument(nameof(Avatar.PublishedOn), new BsonDocument("$exists", false));
+			foreach (var avatar in await DB.Default.Collection<Avatar>().Find(missing).ToListAsync())
+				await DB.Default.Update<Avatar>().MatchID(avatar.ID).Modify(a => a.PublishedOn, PrivacyIds.PublishedDay(avatar.CreatedAt)).ExecuteAsync();
+			foreach (var group in await DB.Default.Collection<GroupEntity>().Find(missing).ToListAsync())
+				await DB.Default.Update<GroupEntity>().MatchID(group.ID).Modify(g => g.PublishedOn, PrivacyIds.PublishedDay(group.CreationDate)).ExecuteAsync();
+		}
+	}
+}

PrivaPub/Infrastructure/Ids/PrivacyIds.cs

@@ -9,6 +9,11 @@ namespace PrivaPub.Infrastructure.Ids
 	{
 		public static string ForDay(DateTime when) => At(DateTime.SpecifyKind(when, DateTimeKind.Utc).Date);
 
+		public static DateTime PublishedDay(DateTime created) =>
+			DateTime.SpecifyKind(created, DateTimeKind.Utc).Date.AddDays(-RandomNumberGenerator.GetInt32(0, PublishedSpreadDays));
+
+		const int PublishedSpreadDays = 14;
+
 		public static string Arrived(DateTime published) =>
 			DateTime.SpecifyKind(published, DateTimeKind.Utc) > DateTime.UtcNow - LiveWindow ? ObjectId.GenerateNewId().ToString() : At(published);
 

PrivaPub/Models/Group/Group.cs

@@ -31,10 +31,11 @@ namespace PrivaPub.Models.Group
 		public string HashedInvitationPassword { get; set; }
 
 		public DateTime CreationDate { get; set; } = DateTime.UtcNow;
+		public DateTime PublishedOn { get; set; } = PrivacyIds.PublishedDay(DateTime.UtcNow);
 		public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
 		public DateTime? DeletionAt { get; set; }
 
-		public override object GenerateNewID() => PrivacyIds.ForDay(DateTime.UtcNow);
+		public override object GenerateNewID() => PrivacyIds.ForDay(PublishedOn);
 	}
 
 	public class GroupMember

PrivaPub/Models/Post/Post.cs

@@ -17,6 +17,7 @@ namespace PrivaPub.Models.Post
 		public PostVisibility Visibility { get; set; }
 		public string Title { get; set; }
 		public string SpoilerText { get; set; }
+		public string Excerpt { get; set; }//a non-Note's summary: a teaser, a description, an event's date and place
 		public string Text { get; set; }
 		public string ContentHtml { get; set; }
 		public ContentFormat ContentFormat { get; set; }
@@ -35,6 +36,7 @@ namespace PrivaPub.Models.Post
 
 		public bool IsFederatedCopy { get; set; }
 		public string ObjectURI { get; set; }//the Note's id
+		public string ObjectType { get; set; }//the remote object's type: Note, Article, Page, Video, Event…; null for local posts
 		public string ActivityURI { get; set; }//the Create's id
 		public string ActorURI { get; set; }//attributedTo
 		public string Url { get; set; }

PrivaPub/Models/User/Avatar.cs

@@ -32,12 +32,13 @@ namespace PrivaPub.Models.User
 
 		public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
 		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+		public DateTime PublishedOn { get; set; } = PrivacyIds.PublishedDay(DateTime.UtcNow);//the actor's published: a few days before CreatedAt, so same-day personas differ
 		public DateTime? SilencedAt { get; set; }
 		public DateTime? SuspendedAt { get; set; }
 		public DateTime? BannedAt { get; set; }
 		public DateTime? DeletionAt { get; set; }
 
-		public override object GenerateNewID() => PrivacyIds.ForDay(DateTime.UtcNow);
+		public override object GenerateNewID() => PrivacyIds.ForDay(PublishedOn);
 	}
 
 	public class ForeignAvatar : Entity