thepraandClaude Opus 5.5
128ff89426
LikeHandler.MaySee let a remote account interact with a followers-only post only when the post named it in to, cc or its mentions. Our own followers-only posts are addressed to the followers collection, never to each follower, and circle posts were not considered at all, so every like, reaction, downvote and poll vote from a follower on a followers-only post, and from a member on a circle post, was dropped as "not-visible". Likes, dislikes, reactions and poll votes now ask VisibilityPolicy.RemoteCanSee: anyone for public and unlisted posts, an addressed account for a DM, an accepted follower or an addressed account for followers-only, a foreign member for a circle post, and never a server's instance actor (SignedFetchAuthorizer's alias is for refetches only). Found by planning the town's multi-server interaction checks (G-0001). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw
55 lines
1.6 KiB
C#
55 lines
1.6 KiB
C#
using MongoDB.Driver;
|
|
using MongoDB.Entities;
|
|
|
|
using PrivaPub.Domain.Privacy;
|
|
using PrivaPub.Models.Social;
|
|
using PrivaPub.Models.User;
|
|
using PrivaPub.StaticServices;
|
|
|
|
using System.Text.Json.Nodes;
|
|
|
|
using static PrivaPub.Federation.Objects.ActivityJson;
|
|
|
|
using PostEntity = PrivaPub.Models.Post.Post;
|
|
|
|
namespace PrivaPub.Federation.Inbox.Handlers
|
|
{
|
|
public class DislikeHandler : IActivityHandler
|
|
{
|
|
readonly DbEntities _dbEntities;
|
|
|
|
public DislikeHandler(DbEntities dbEntities)
|
|
{
|
|
_dbEntities = dbEntities;
|
|
}
|
|
|
|
public string Type => "Dislike";
|
|
|
|
public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
|
|
{
|
|
var objectUri = Id(activity["object"]);
|
|
var post = objectUri == default
|
|
? default
|
|
: await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && !p.DeletedAt.HasValue && p.ReblogOfPostId == null).ExecuteFirstAsync(token);
|
|
if (post == default || !await VisibilityPolicy.RemoteCanSee(post, actor, token))
|
|
{
|
|
Arrival.Drop(post == default ? "unknown-object" : "not-visible");
|
|
return;
|
|
}
|
|
Arrival.About(post.ObjectType ?? "Note", post.Visibility, post.CreationDate);
|
|
|
|
try
|
|
{
|
|
await DB.Default.SaveAsync(new Downvote { AccountId = actor.ID, ActorURI = actor.ActorURI, PostId = post.ID, ActivityURI = Id(activity) }, token);
|
|
}
|
|
catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
|
|
{
|
|
Arrival.Drop("duplicate");
|
|
return;
|
|
}
|
|
Arrival.Accept("stored");
|
|
await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(b => b.Inc(p => p.DownvotesCount, 1)).ExecuteAsync(token);
|
|
}
|
|
}
|
|
}
|