88 integration tests drive the Mastodon client API through the whole server
(PrivaPubHost), with remote actors on an in-process Peer and deliveries read
from the job queue. Helpers live in Support/Host/MastodonHelpers.cs.
Coverage:
- Accounts: verify_credentials (no root id or login name); update_credentials
with indexed and array fields_attributes (form and JSON), source[*],
quote_policy, locked/bot, avatar and header uploads resized and stripped of
EXIF and XMP; lookup (local, @domain, remote; a circle, the instance actor
and a circle's id answer 404); search with and without resolve (only a
signed-in persona resolves, the Peer is untouched otherwise), by post and
actor address, hashtags, undiscoverable personas; account statuses with
pinned, exclude_replies, exclude_reblogs, only_media, tagged and Link paging
both ways; followers-only posts for followers (local and remote authors);
community accounts; followers/following only to their owner; follow (open,
locked, remote Follow delivery), unfollow and Undo; follow requests from
local and remote followers answered with the original Follow;
remove_from_followers; blocks with Reject and Block/Undo deliveries; mutes
with duration and the notifications choice, never federated; domain blocks;
relationships with junk ids; a banned login's tokens; reports forwarded as a
Flag from the instance actor only; account stub routes.
- Statuses: each visibility's to/cc as delivered; CW as summary; replies to
local and remote posts (mention, inReplyTo, the author's inbox); polls and
votes (local, and remote votes only to the author without published); media
attached only by its owner; quotes, the quotes list and revocation; edit
history, source and the Update delivery; delete for redraft, the 410
Tombstone and the Delete delivery; favourite/reblog counts with Like,
Announce and their Undos; favourited_by, reblogged_by; bookmarks; pins;
interaction_policy matching canQuote in the note and in the Update;
strangers get 404 for followers-only and direct posts; a located post is
unreachable by id for anyone else on every route; statuses?id[];
Idempotency-Key; scopes; deleting a reblog.
- Timelines: home paging with max_id, since_id and min_id; public local and
remote; tag (anonymous); list stub; favourites; conversations and read;
markers; notifications with types[], exclude_types[], account_id, paging,
get, dismiss, clear and unread_count.
- Instance: v1 and v2 (4.2.0 (compatible; PrivaPub)), peers, activity, rules,
extended_description, apps and every stub route.
- Media: v1 and v2 uploads, owner-only GET and PUT, 422 for unsupported or
unreadable files, video and audio made with ffmpeg lavfi sources and checked
with ffprobe; every remote media address goes through the proxy; the proxy
refuses unsigned URLs, streams ranges as 206 without caching, caches whole
downloads and serves them with ranges, and streams anything over
Media:MaxProxiedBytes (a SmallProxyHost) without caching.
- Provenance of local, delivered (signature) and fetched (instance actor,
no signature, the trigger as activity) posts, visibility of provenance,
instance descriptions; reading any of them makes no outbound request.
Pleroma reactions with EmojiReact and Undo deliveries, and local reaction
notifications.
Bugs fixed:
- remove_from_followers deleted the Follower row but never told a remote
follower. It now sends Reject{Follow} with the stored Follow id, through
RelationshipService.RemoveFollower, which Block now shares.
- VisibilityPolicy.CanSee refused followers-only posts to accepted followers,
so a post in their home timeline answered 404 to GET, context, favourite and
reply. Followers of the author (local or remote) may now see them.
- Account statuses of a remote account hid followers-only posts from
personas that follow it.
- exclude_replies dropped the author's own threads; like Mastodon it now
drops only replies to other accounts.
- A community account's statuses were always empty: they are now the posts
addressed to the community.
- Pinning someone else's visible post answered 404; it answers 422 like
Mastodon.
- GET /api/v1/notifications/:id answered 200 with null when the notification's
post was gone; it answers 404.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2
211 lines
9.4 KiB
C#
211 lines
9.4 KiB
C#
using MongoDB.Driver;
|
|
using MongoDB.Entities;
|
|
|
|
using PrivaPub.Domain.Social;
|
|
using PrivaPub.Federation.Actors;
|
|
using PrivaPub.Federation.Outbox;
|
|
using PrivaPub.Federation.Rendering;
|
|
using PrivaPub.Models.Federation;
|
|
using PrivaPub.Models.Social;
|
|
using PrivaPub.StaticServices;
|
|
|
|
using System.Text.Json.Nodes;
|
|
|
|
namespace PrivaPub.Domain.Relationships
|
|
{
|
|
public interface IRelationshipService
|
|
{
|
|
Task Block(LocalActor me, string targetActorUri, string targetAccountId, CancellationToken token);
|
|
Task Unblock(LocalActor me, string targetActorUri, CancellationToken token);
|
|
Task RemoveFollower(LocalActor me, string followerActorUri, string followerAccountId, CancellationToken token);
|
|
Task Mute(LocalActor me, string targetActorUri, string targetAccountId, bool hideNotifications, TimeSpan? duration, CancellationToken token);
|
|
Task Unmute(LocalActor me, string targetActorUri, CancellationToken token);
|
|
Task BlockDomain(LocalActor me, string domain, CancellationToken token);
|
|
Task UnblockDomain(LocalActor me, string domain, CancellationToken token);
|
|
}
|
|
|
|
public class RelationshipService : IRelationshipService
|
|
{
|
|
readonly DbEntities _dbEntities;
|
|
readonly IFollowService _follows;
|
|
readonly IDeliveryService _delivery;
|
|
|
|
public RelationshipService(DbEntities dbEntities, IFollowService follows, IDeliveryService delivery)
|
|
{
|
|
_dbEntities = dbEntities;
|
|
_follows = follows;
|
|
_delivery = delivery;
|
|
}
|
|
|
|
public async Task Block(LocalActor me, string targetActorUri, string targetAccountId, CancellationToken token)
|
|
{
|
|
var block = new Block { AvatarId = me.Id, TargetAccountId = targetAccountId, TargetActorURI = targetActorUri };
|
|
try
|
|
{
|
|
await DB.Default.SaveAsync(block, token);
|
|
}
|
|
catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
|
|
{
|
|
block = await DB.Default.Find<Block>().Match(b => b.AvatarId == me.Id && b.TargetActorURI == targetActorUri).ExecuteFirstAsync(token);
|
|
}
|
|
|
|
await _follows.UnfollowAs(me, targetActorUri, token);
|
|
await RemoveFollower(me, targetActorUri, targetAccountId, token);
|
|
await Forget(me, targetAccountId, token);
|
|
if (block != default)
|
|
await Tell(me, targetActorUri, BlockActivity(me, block), token);
|
|
}
|
|
|
|
public async Task RemoveFollower(LocalActor me, string followerActorUri, string followerAccountId, CancellationToken token)
|
|
{
|
|
var follower = await _dbEntities.Followers.Match(f => f.LocalActorId == me.Id && f.ActorURI == followerActorUri).ExecuteFirstAsync(token);
|
|
if (follower == default)
|
|
return;
|
|
await DB.Default.DeleteAsync<Follower>(follower.ID);
|
|
if (!followerActorUri.StartsWith(me.BaseAddress + "/", StringComparison.OrdinalIgnoreCase) && !string.IsNullOrEmpty(follower.FollowActivityURI))
|
|
{
|
|
var reject = new JsonObject
|
|
{
|
|
["@context"] = ActivityPubRenderer.ActivityStreams,
|
|
["id"] = me.ActivityUri($"reject-{follower.ID}-{DateTime.UtcNow.Ticks}"),
|
|
["type"] = "Reject",
|
|
["actor"] = me.Uri,
|
|
["object"] = new JsonObject { ["id"] = follower.FollowActivityURI, ["type"] = "Follow", ["actor"] = followerActorUri, ["object"] = me.Uri }
|
|
};
|
|
await _delivery.Enqueue(me, new[] { follower.InboxURL }, reject, token);
|
|
}
|
|
else
|
|
await DB.Default.DeleteAsync<Following>(f => f.TargetActorURI == me.Uri && f.AvatarId == followerAccountId);
|
|
}
|
|
|
|
public async Task Unblock(LocalActor me, string targetActorUri, CancellationToken token)
|
|
{
|
|
var block = await DB.Default.Find<Block>().Match(b => b.AvatarId == me.Id && b.TargetActorURI == targetActorUri).ExecuteFirstAsync(token);
|
|
if (block == default)
|
|
return;
|
|
await DB.Default.DeleteAsync<Block>(block.ID);
|
|
await Tell(me, targetActorUri, new JsonObject
|
|
{
|
|
["@context"] = ActivityPubRenderer.ActivityStreams,
|
|
["id"] = me.ActivityUri($"undo-block-{block.ID}"),
|
|
["type"] = "Undo",
|
|
["actor"] = me.Uri,
|
|
["object"] = BlockActivity(me, block)
|
|
}, token);
|
|
}
|
|
|
|
static JsonObject BlockActivity(LocalActor me, Block block) => new()
|
|
{
|
|
["@context"] = ActivityPubRenderer.ActivityStreams,
|
|
["id"] = me.ActivityUri($"block-{block.ID}"),
|
|
["type"] = "Block",
|
|
["actor"] = me.Uri,
|
|
["object"] = block.TargetActorURI,
|
|
["to"] = new JsonArray(block.TargetActorURI)
|
|
};
|
|
|
|
async Task Tell(LocalActor me, string targetActorUri, JsonObject activity, CancellationToken token)
|
|
{
|
|
if (targetActorUri.StartsWith(me.BaseAddress + "/", StringComparison.OrdinalIgnoreCase))
|
|
return;
|
|
var target = await _dbEntities.ForeignAvatars.Match(f => f.ActorURI == targetActorUri).ExecuteFirstAsync(token);
|
|
if (!string.IsNullOrEmpty(target?.InboxURL))
|
|
await _delivery.Enqueue(me, new[] { target.InboxURL }, activity, token);
|
|
}
|
|
|
|
public async Task Mute(LocalActor me, string targetActorUri, string targetAccountId, bool hideNotifications, TimeSpan? duration, CancellationToken token)
|
|
{
|
|
await DB.Default.Update<Mute>()
|
|
.Match(m => m.AvatarId == me.Id && m.TargetActorURI == targetActorUri)
|
|
.Modify(m => m.TargetAccountId, targetAccountId)
|
|
.Modify(m => m.HideNotifications, hideNotifications)
|
|
.Modify(m => m.ExpiresAt, duration.HasValue && duration > TimeSpan.Zero ? DateTime.UtcNow + duration : null)
|
|
.Modify(b => b.SetOnInsert(m => m.CreatedAt, DateTime.UtcNow))
|
|
.Option(o => o.IsUpsert = true)
|
|
.ExecuteAsync(token);
|
|
await Forget(me, targetAccountId, token);
|
|
}
|
|
|
|
public async Task Unmute(LocalActor me, string targetActorUri, CancellationToken token) =>
|
|
await DB.Default.DeleteAsync<Mute>(m => m.AvatarId == me.Id && m.TargetActorURI == targetActorUri);
|
|
|
|
public async Task BlockDomain(LocalActor me, string domain, CancellationToken token)
|
|
{
|
|
domain = domain?.Trim().ToLowerInvariant();
|
|
if (string.IsNullOrEmpty(domain) || Uri.CheckHostName(domain) != UriHostNameType.Dns)
|
|
return;
|
|
try
|
|
{
|
|
await DB.Default.SaveAsync(new AccountDomainBlock { AvatarId = me.Id, Domain = domain }, token);
|
|
}
|
|
catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
|
|
{
|
|
}
|
|
foreach (var following in await _dbEntities.Followings.Match(f => f.AvatarId == me.Id && !f.TargetIsLocal).ExecuteAsync(token))
|
|
if (Hidden.HostMatches(following.TargetActorURI, domain))
|
|
await _follows.UnfollowAs(me, following.TargetActorURI, token);
|
|
foreach (var follower in await _dbEntities.Followers.Match(f => f.LocalActorId == me.Id).ExecuteAsync(token))
|
|
if (Hidden.HostMatches(follower.ActorURI, domain))
|
|
await DB.Default.DeleteAsync<Follower>(follower.ID);
|
|
}
|
|
|
|
public async Task UnblockDomain(LocalActor me, string domain, CancellationToken token)
|
|
{
|
|
domain = domain?.Trim().ToLowerInvariant();
|
|
await DB.Default.DeleteAsync<AccountDomainBlock>(b => b.AvatarId == me.Id && b.Domain == domain);
|
|
}
|
|
|
|
static async Task Forget(LocalActor me, string targetAccountId, CancellationToken token)
|
|
{
|
|
if (string.IsNullOrEmpty(targetAccountId))
|
|
return;
|
|
await DB.Default.DeleteAsync<TimelineEntry>(e => e.AvatarId == me.Id && e.AuthorAccountId == targetAccountId);
|
|
await DB.Default.DeleteAsync<Notification>(n => n.AvatarId == me.Id && n.FromAccountId == targetAccountId);
|
|
}
|
|
}
|
|
|
|
public static class Hidden
|
|
{
|
|
public static bool HostMatches(string actorUri, string domain) =>
|
|
Uri.TryCreate(actorUri, UriKind.Absolute, out var uri)
|
|
&& (uri.Host.Equals(domain, StringComparison.OrdinalIgnoreCase) || uri.Host.EndsWith("." + domain, StringComparison.OrdinalIgnoreCase));
|
|
|
|
public static async Task<HashSet<string>> AuthorsHiddenFrom(string avatarId, IEnumerable<string> actorUris, bool forNotifications, CancellationToken token)
|
|
{
|
|
var uris = actorUris.Where(u => !string.IsNullOrEmpty(u)).Distinct().ToList();
|
|
var hidden = new HashSet<string>(StringComparer.Ordinal);
|
|
if (string.IsNullOrEmpty(avatarId) || uris.Count == 0)
|
|
return hidden;
|
|
var now = DateTime.UtcNow;
|
|
foreach (var block in await DB.Default.Find<Block>().Match(b => b.AvatarId == avatarId && uris.Contains(b.TargetActorURI)).ExecuteAsync(token))
|
|
hidden.Add(block.TargetActorURI);
|
|
foreach (var mute in await DB.Default.Find<Mute>().Match(m => m.AvatarId == avatarId && uris.Contains(m.TargetActorURI)).ExecuteAsync(token))
|
|
if ((mute.ExpiresAt == null || mute.ExpiresAt > now) && (!forNotifications || mute.HideNotifications))
|
|
hidden.Add(mute.TargetActorURI);
|
|
var domains = await DB.Default.Find<AccountDomainBlock>().Match(b => b.AvatarId == avatarId).ExecuteAsync(token);
|
|
foreach (var uri in uris)
|
|
if (domains.Any(d => HostMatches(uri, d.Domain)))
|
|
hidden.Add(uri);
|
|
return hidden;
|
|
}
|
|
|
|
public static async Task<HashSet<string>> RecipientsHiding(IEnumerable<string> avatarIds, string actorUri, CancellationToken token)
|
|
{
|
|
var ids = avatarIds.Distinct().ToList();
|
|
var hiding = new HashSet<string>(StringComparer.Ordinal);
|
|
if (ids.Count == 0 || string.IsNullOrEmpty(actorUri))
|
|
return hiding;
|
|
var now = DateTime.UtcNow;
|
|
foreach (var block in await DB.Default.Find<Block>().Match(b => ids.Contains(b.AvatarId) && b.TargetActorURI == actorUri).ExecuteAsync(token))
|
|
hiding.Add(block.AvatarId);
|
|
foreach (var mute in await DB.Default.Find<Mute>().Match(m => ids.Contains(m.AvatarId) && m.TargetActorURI == actorUri).ExecuteAsync(token))
|
|
if (mute.ExpiresAt == null || mute.ExpiresAt > now)
|
|
hiding.Add(mute.AvatarId);
|
|
foreach (var block in await DB.Default.Find<AccountDomainBlock>().Match(b => ids.Contains(b.AvatarId)).ExecuteAsync(token))
|
|
if (HostMatches(actorUri, block.Domain))
|
|
hiding.Add(block.AvatarId);
|
|
return hiding;
|
|
}
|
|
}
|
|
}
|