From 0feb23a3082b65915e0abbe09c2df83f6014d6c3 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 16 Jan 2026 23:16:51 +0400
Subject: [PATCH 01/11] AP ingest: accept object type as list

---
 .../web/activity_pub/transmogrifier.ex        |  6 +++
 .../fedidev.fun/object_type_list.json         | 28 ++++++++++
 .../fedidev_fun_object_type_list_test.exs     | 53 +++++++++++++++++++
 3 files changed, 87 insertions(+)
 create mode 100644 test/fixtures/fedidev.fun/object_type_list.json
 create mode 100644 test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_object_type_list_test.exs

diff --git a/lib/pleroma/web/activity_pub/transmogrifier.ex b/lib/pleroma/web/activity_pub/transmogrifier.ex
index ba6f4030d..6b3194709 100644
--- a/lib/pleroma/web/activity_pub/transmogrifier.ex
+++ b/lib/pleroma/web/activity_pub/transmogrifier.ex
@@ -433,9 +433,15 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
   def handle_incoming(data, options \\ []) do
     data
     |> fix_recursive(&strip_internal_fields/1)
+    |> fix_recursive(&fix_type_as_string/1)
     |> handle_incoming_normalized(options)
   end
 
+  defp fix_type_as_string(%{"type" => [type | _]} = data) when is_binary(type),
+    do: Map.put(data, "type", type)
+
+  defp fix_type_as_string(data), do: data
+
   # Flag objects are placed ahead of the ID check because Mastodon 2.8 and earlier send them
   # with nil ID.
   defp handle_incoming_normalized(
diff --git a/test/fixtures/fedidev.fun/object_type_list.json b/test/fixtures/fedidev.fun/object_type_list.json
new file mode 100644
index 000000000..f4ab00578
--- /dev/null
+++ b/test/fixtures/fedidev.fun/object_type_list.json
@@ -0,0 +1,28 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/object-type-list",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:43:32Z",
+  "object": {
+    "type": [
+      "Note"
+    ],
+    "id": "https://fedidev.fun/objects/note-object-type-list",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:43:32Z",
+    "name": "name",
+    "summary": "summary",
+    "content": "content"
+  }
+}
diff --git a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_object_type_list_test.exs b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_object_type_list_test.exs
new file mode 100644
index 000000000..619e6f477
--- /dev/null
+++ b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_object_type_list_test.exs
@@ -0,0 +1,53 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunObjectTypeListTest do
+  use Oban.Testing, repo: Pleroma.Repo
+  use Pleroma.DataCase
+
+  alias Pleroma.Object
+  alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.Transmogrifier
+
+  import Pleroma.Factory
+
+  setup_all do
+    Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
+    :ok
+  end
+
+  defp ensure_remote_actor!(ap_id) when is_binary(ap_id) do
+    case User.get_cached_by_ap_id(ap_id) do
+      %User{} ->
+        :ok
+
+      _ ->
+        insert(:user,
+          local: false,
+          ap_id: ap_id,
+          follower_address: ap_id <> "/followers",
+          following_address: ap_id <> "/following",
+          featured_address: ap_id <> "/collections/featured",
+          inbox: ap_id <> "/inbox"
+        )
+
+        :ok
+    end
+  end
+
+  defp ingest_fixture!(rel_path) do
+    data = rel_path |> File.read!() |> Jason.decode!()
+    ensure_remote_actor!(data["actor"])
+
+    assert {:ok, activity} = Transmogrifier.handle_incoming(data)
+    object = Object.normalize(activity.data["object"], fetch: false)
+
+    {activity, object}
+  end
+
+  test "accepts object type as a list and stores the first type" do
+    {_activity, object} = ingest_fixture!("test/fixtures/fedidev.fun/object_type_list.json")
+    assert object.data["type"] == "Note"
+  end
+end

From 39817fa54727204dc997e9211bae57d5fd625583 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 16 Jan 2026 23:25:07 +0400
Subject: [PATCH 02/11] AP ingest: normalize object url list

---
 .../article_note_page_validator.ex            | 27 +++++++++-
 test/fixtures/fedidev.fun/url_list.json       | 27 ++++++++++
 .../fedidev_fun_url_list_test.exs             | 53 +++++++++++++++++++
 3 files changed, 106 insertions(+), 1 deletion(-)
 create mode 100644 test/fixtures/fedidev.fun/url_list.json
 create mode 100644 test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_url_list_test.exs

diff --git a/lib/pleroma/web/activity_pub/object_validators/article_note_page_validator.ex b/lib/pleroma/web/activity_pub/object_validators/article_note_page_validator.ex
index c0626ce4d..b0cdee552 100644
--- a/lib/pleroma/web/activity_pub/object_validators/article_note_page_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/article_note_page_validator.ex
@@ -46,7 +46,32 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.ArticleNotePageValidator do
   end
 
   defp fix_url(%{"url" => url} = data) when is_bitstring(url), do: data
-  defp fix_url(%{"url" => url} = data) when is_map(url), do: Map.put(data, "url", url["href"])
+
+  defp fix_url(%{"url" => url} = data) when is_map(url) do
+    if is_binary(url["href"]) do
+      Map.put(data, "url", url["href"])
+    else
+      Map.delete(data, "url")
+    end
+  end
+
+  defp fix_url(%{"url" => url} = data) when is_list(url) do
+    first_element = Enum.at(url, 0)
+
+    url_string =
+      cond do
+        is_bitstring(first_element) -> first_element
+        is_map(first_element) -> first_element["href"]
+        true -> nil
+      end
+
+    if is_binary(url_string) do
+      Map.put(data, "url", url_string)
+    else
+      Map.delete(data, "url")
+    end
+  end
+
   defp fix_url(data), do: data
 
   defp fix_tag(%{"tag" => tag} = data) when is_list(tag) do
diff --git a/test/fixtures/fedidev.fun/url_list.json b/test/fixtures/fedidev.fun/url_list.json
new file mode 100644
index 000000000..b4cfd4cd6
--- /dev/null
+++ b/test/fixtures/fedidev.fun/url_list.json
@@ -0,0 +1,27 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/url-list",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:39:06Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-url-list",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:39:06Z",
+    "content": "text",
+    "url": [
+      "https://fedidev.fun/objects/123"
+    ]
+  }
+}
diff --git a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_url_list_test.exs b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_url_list_test.exs
new file mode 100644
index 000000000..bc084a622
--- /dev/null
+++ b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_url_list_test.exs
@@ -0,0 +1,53 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunUrlListTest do
+  use Oban.Testing, repo: Pleroma.Repo
+  use Pleroma.DataCase
+
+  alias Pleroma.Object
+  alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.Transmogrifier
+
+  import Pleroma.Factory
+
+  setup_all do
+    Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
+    :ok
+  end
+
+  defp ensure_remote_actor!(ap_id) when is_binary(ap_id) do
+    case User.get_cached_by_ap_id(ap_id) do
+      %User{} ->
+        :ok
+
+      _ ->
+        insert(:user,
+          local: false,
+          ap_id: ap_id,
+          follower_address: ap_id <> "/followers",
+          following_address: ap_id <> "/following",
+          featured_address: ap_id <> "/collections/featured",
+          inbox: ap_id <> "/inbox"
+        )
+
+        :ok
+    end
+  end
+
+  defp ingest_fixture!(rel_path) do
+    data = rel_path |> File.read!() |> Jason.decode!()
+    ensure_remote_actor!(data["actor"])
+
+    assert {:ok, activity} = Transmogrifier.handle_incoming(data)
+    object = Object.normalize(activity.data["object"], fetch: false)
+
+    {activity, object}
+  end
+
+  test "normalizes object url list to a string" do
+    {_activity, object} = ingest_fixture!("test/fixtures/fedidev.fun/url_list.json")
+    assert object.data["url"] == "https://fedidev.fun/objects/123"
+  end
+end

From 6701f6199006b52a70288d2c90cd93aa97ce34ff Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 16 Jan 2026 23:27:06 +0400
Subject: [PATCH 03/11] AP ingest: normalize quoteUrl fields

---
 .../object_validators/common_fixes.ex         | 27 ++++++--
 .../fedidev.fun/misskey_quote_list.json       | 28 +++++++++
 test/fixtures/fedidev.fun/quote_uri_list.json | 28 +++++++++
 test/fixtures/fedidev.fun/quote_url_list.json | 28 +++++++++
 .../fedidev_fun_quote_url_list_test.exs       | 63 +++++++++++++++++++
 5 files changed, 170 insertions(+), 4 deletions(-)
 create mode 100644 test/fixtures/fedidev.fun/misskey_quote_list.json
 create mode 100644 test/fixtures/fedidev.fun/quote_uri_list.json
 create mode 100644 test/fixtures/fedidev.fun/quote_url_list.json
 create mode 100644 test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_quote_url_list_test.exs

diff --git a/lib/pleroma/web/activity_pub/object_validators/common_fixes.ex b/lib/pleroma/web/activity_pub/object_validators/common_fixes.ex
index 2e0f7a8a0..f34a4327f 100644
--- a/lib/pleroma/web/activity_pub/object_validators/common_fixes.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/common_fixes.ex
@@ -96,23 +96,37 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes do
     Map.put(data, "to", to)
   end
 
-  def fix_quote_url(%{"quoteUrl" => _quote_url} = data), do: data
+  def fix_quote_url(%{"quoteUrl" => quote_url} = data) do
+    case normalize_object_id(quote_url) do
+      quote_url when is_binary(quote_url) -> Map.put(data, "quoteUrl", quote_url)
+      _ -> Map.delete(data, "quoteUrl")
+    end
+  end
 
   # Fedibird
   # https://github.com/fedibird/mastodon/commit/dbd7ae6cf58a92ec67c512296b4daaea0d01e6ac
   def fix_quote_url(%{"quoteUri" => quote_url} = data) do
-    Map.put(data, "quoteUrl", quote_url)
+    case normalize_object_id(quote_url) do
+      quote_url when is_binary(quote_url) -> Map.put(data, "quoteUrl", quote_url)
+      _ -> data
+    end
   end
 
   # Old Fedibird (bug)
   # https://github.com/fedibird/mastodon/issues/9
   def fix_quote_url(%{"quoteURL" => quote_url} = data) do
-    Map.put(data, "quoteUrl", quote_url)
+    case normalize_object_id(quote_url) do
+      quote_url when is_binary(quote_url) -> Map.put(data, "quoteUrl", quote_url)
+      _ -> data
+    end
   end
 
   # Misskey fallback
   def fix_quote_url(%{"_misskey_quote" => quote_url} = data) do
-    Map.put(data, "quoteUrl", quote_url)
+    case normalize_object_id(quote_url) do
+      quote_url when is_binary(quote_url) -> Map.put(data, "quoteUrl", quote_url)
+      _ -> data
+    end
   end
 
   def fix_quote_url(%{"tag" => [_ | _] = tags} = data) do
@@ -128,6 +142,11 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes do
 
   def fix_quote_url(data), do: data
 
+  defp normalize_object_id(object_id) when is_binary(object_id), do: object_id
+  defp normalize_object_id(%{"id" => object_id}) when is_binary(object_id), do: object_id
+  defp normalize_object_id([object_id | _]) when is_binary(object_id), do: object_id
+  defp normalize_object_id(_), do: nil
+
   # On Mastodon, `"likes"` attribute includes an inlined `Collection` with `totalItems`,
   # not a list of users.
   # https://github.com/mastodon/mastodon/pull/32007
diff --git a/test/fixtures/fedidev.fun/misskey_quote_list.json b/test/fixtures/fedidev.fun/misskey_quote_list.json
new file mode 100644
index 000000000..b9ea08691
--- /dev/null
+++ b/test/fixtures/fedidev.fun/misskey_quote_list.json
@@ -0,0 +1,28 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/misskey-quote-list",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:43:53Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-misskey-quote-list",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:43:53Z",
+    "content": "_misskey_quote attribute as list",
+    "_misskey_quote": [
+      "https://fedidev.fun/assets/note1.jsonap",
+      "https://fedidev.fun/assets/note2.jsonap"
+    ]
+  }
+}
diff --git a/test/fixtures/fedidev.fun/quote_uri_list.json b/test/fixtures/fedidev.fun/quote_uri_list.json
new file mode 100644
index 000000000..9245077e6
--- /dev/null
+++ b/test/fixtures/fedidev.fun/quote_uri_list.json
@@ -0,0 +1,28 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/quote-uri-list",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:43:52Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-quote-uri-list",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:43:52Z",
+    "content": "quoteUri attribute as list",
+    "quoteUri": [
+      "https://fedidev.fun/assets/note1.jsonap",
+      "https://fedidev.fun/assets/note2.jsonap"
+    ]
+  }
+}
diff --git a/test/fixtures/fedidev.fun/quote_url_list.json b/test/fixtures/fedidev.fun/quote_url_list.json
new file mode 100644
index 000000000..eecd0dd35
--- /dev/null
+++ b/test/fixtures/fedidev.fun/quote_url_list.json
@@ -0,0 +1,28 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/quote-url-list",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:43:52Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-quote-url-list",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:43:52Z",
+    "content": "quoteUrl attribute as list",
+    "quoteUrl": [
+      "https://fedidev.fun/assets/note1.jsonap",
+      "https://fedidev.fun/assets/note2.jsonap"
+    ]
+  }
+}
diff --git a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_quote_url_list_test.exs b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_quote_url_list_test.exs
new file mode 100644
index 000000000..9607fabdd
--- /dev/null
+++ b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_quote_url_list_test.exs
@@ -0,0 +1,63 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunQuoteUrlListTest do
+  use Oban.Testing, repo: Pleroma.Repo
+  use Pleroma.DataCase
+
+  alias Pleroma.Object
+  alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.Transmogrifier
+
+  import Pleroma.Factory
+
+  setup_all do
+    Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
+    :ok
+  end
+
+  defp ensure_remote_actor!(ap_id) when is_binary(ap_id) do
+    case User.get_cached_by_ap_id(ap_id) do
+      %User{} ->
+        :ok
+
+      _ ->
+        insert(:user,
+          local: false,
+          ap_id: ap_id,
+          follower_address: ap_id <> "/followers",
+          following_address: ap_id <> "/following",
+          featured_address: ap_id <> "/collections/featured",
+          inbox: ap_id <> "/inbox"
+        )
+
+        :ok
+    end
+  end
+
+  defp ingest_fixture!(rel_path) do
+    data = rel_path |> File.read!() |> Jason.decode!()
+    ensure_remote_actor!(data["actor"])
+
+    assert {:ok, activity} = Transmogrifier.handle_incoming(data)
+    object = Object.normalize(activity.data["object"], fetch: false)
+
+    {activity, object}
+  end
+
+  test "normalizes quoteUri list to the first object ID" do
+    {_activity, object} = ingest_fixture!("test/fixtures/fedidev.fun/quote_uri_list.json")
+    assert object.data["quoteUrl"] == "https://fedidev.fun/assets/note1.jsonap"
+  end
+
+  test "normalizes quoteUrl list to the first object ID" do
+    {_activity, object} = ingest_fixture!("test/fixtures/fedidev.fun/quote_url_list.json")
+    assert object.data["quoteUrl"] == "https://fedidev.fun/assets/note1.jsonap"
+  end
+
+  test "normalizes _misskey_quote list to the first object ID" do
+    {_activity, object} = ingest_fixture!("test/fixtures/fedidev.fun/misskey_quote_list.json")
+    assert object.data["quoteUrl"] == "https://fedidev.fun/assets/note1.jsonap"
+  end
+end

From bff67650e109b8f2064c4b6570164da06fe90ac4 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 16 Jan 2026 23:57:01 +0400
Subject: [PATCH 04/11] AP ingest: normalize inReplyTo shapes

---
 .../object_validators/common_fixes.ex         | 30 +++++---
 .../web/activity_pub/transmogrifier.ex        | 30 +++++++-
 .../fedidev.fun/in_reply_to_collection.json   | 30 ++++++++
 .../in_reply_to_embedded_note.json            | 35 +++++++++
 .../fedidev.fun/in_reply_to_link.json         | 28 ++++++++
 .../fedidev.fun/in_reply_to_list.json         | 28 ++++++++
 .../fedidev_fun_in_reply_to_test.exs          | 72 +++++++++++++++++++
 .../transmogrifier/note_handling_test.exs     |  4 +-
 8 files changed, 245 insertions(+), 12 deletions(-)
 create mode 100644 test/fixtures/fedidev.fun/in_reply_to_collection.json
 create mode 100644 test/fixtures/fedidev.fun/in_reply_to_embedded_note.json
 create mode 100644 test/fixtures/fedidev.fun/in_reply_to_link.json
 create mode 100644 test/fixtures/fedidev.fun/in_reply_to_list.json
 create mode 100644 test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_in_reply_to_test.exs

diff --git a/lib/pleroma/web/activity_pub/object_validators/common_fixes.ex b/lib/pleroma/web/activity_pub/object_validators/common_fixes.ex
index f34a4327f..631f301af 100644
--- a/lib/pleroma/web/activity_pub/object_validators/common_fixes.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/common_fixes.ex
@@ -41,22 +41,34 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes do
   def fix_object_defaults(data) do
     data = Maps.filter_empty_values(data)
 
+    in_reply_to_id = in_reply_to_id(data["inReplyTo"])
+
     context =
       Utils.maybe_create_context(
-        data["context"] || data["conversation"] || data["inReplyTo"] || data["id"]
+        data["context"] || data["conversation"] || in_reply_to_id || data["id"]
       )
 
-    %User{follower_address: follower_collection} = User.get_cached_by_ap_id(data["attributedTo"])
+    data = Map.put(data, "context", context)
 
-    data
-    |> Map.put("context", context)
-    |> cast_and_filter_recipients("to", follower_collection)
-    |> cast_and_filter_recipients("cc", follower_collection)
-    |> cast_and_filter_recipients("bto", follower_collection)
-    |> cast_and_filter_recipients("bcc", follower_collection)
-    |> Transmogrifier.fix_implicit_addressing(follower_collection)
+    with attributed_to when is_binary(attributed_to) <- data["attributedTo"],
+         %User{follower_address: follower_collection} <- User.get_cached_by_ap_id(attributed_to) do
+      data
+      |> cast_and_filter_recipients("to", follower_collection)
+      |> cast_and_filter_recipients("cc", follower_collection)
+      |> cast_and_filter_recipients("bto", follower_collection)
+      |> cast_and_filter_recipients("bcc", follower_collection)
+      |> Transmogrifier.fix_implicit_addressing(follower_collection)
+    else
+      _ -> data
+    end
   end
 
+  defp in_reply_to_id(in_reply_to) when is_binary(in_reply_to), do: in_reply_to
+  defp in_reply_to_id(%{"id" => in_reply_to}) when is_binary(in_reply_to), do: in_reply_to
+  defp in_reply_to_id(%{"href" => in_reply_to}) when is_binary(in_reply_to), do: in_reply_to
+  defp in_reply_to_id([in_reply_to | _]), do: in_reply_to_id(in_reply_to)
+  defp in_reply_to_id(_), do: nil
+
   def fix_activity_addressing(activity) do
     %User{follower_address: follower_collection} = User.get_cached_by_ap_id(activity["actor"])
 
diff --git a/lib/pleroma/web/activity_pub/transmogrifier.ex b/lib/pleroma/web/activity_pub/transmogrifier.ex
index 6b3194709..43d991a22 100644
--- a/lib/pleroma/web/activity_pub/transmogrifier.ex
+++ b/lib/pleroma/web/activity_pub/transmogrifier.ex
@@ -201,9 +201,29 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
   def fix_in_reply_to(%{"inReplyTo" => in_reply_to} = object, options)
       when not is_nil(in_reply_to) do
     in_reply_to_id = prepare_in_reply_to(in_reply_to)
+
+    object =
+      cond do
+        is_list(in_reply_to) ->
+          if not_empty_string(in_reply_to_id) do
+            Map.put(object, "inReplyTo", in_reply_to_id)
+          else
+            Map.delete(object, "inReplyTo")
+          end
+
+        is_map(in_reply_to) and is_nil(in_reply_to["id"]) and is_binary(in_reply_to["href"]) ->
+          Map.put(object, "inReplyTo", in_reply_to["href"])
+
+        is_map(in_reply_to) and is_nil(in_reply_to["id"]) and is_nil(in_reply_to["href"]) ->
+          Map.delete(object, "inReplyTo")
+
+        true ->
+          object
+      end
+
     depth = (options[:depth] || 0) + 1
 
-    if Federator.allowed_thread_distance?(depth) do
+    if not_empty_string(in_reply_to_id) and Federator.allowed_thread_distance?(depth) do
       with {:ok, replied_object} <- get_obj_helper(in_reply_to_id, options),
            %Activity{} <- Activity.get_create_by_object_ap_id(replied_object.data["id"]) do
         object
@@ -249,9 +269,17 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
       is_map(in_reply_to) && is_bitstring(in_reply_to["id"]) ->
         in_reply_to["id"]
 
+      is_map(in_reply_to) && is_bitstring(in_reply_to["href"]) ->
+        in_reply_to["href"]
+
       is_list(in_reply_to) && is_bitstring(Enum.at(in_reply_to, 0)) ->
         Enum.at(in_reply_to, 0)
 
+      is_list(in_reply_to) && is_map(Enum.at(in_reply_to, 0)) ->
+        in_reply_to
+        |> Enum.at(0)
+        |> prepare_in_reply_to()
+
       true ->
         ""
     end
diff --git a/test/fixtures/fedidev.fun/in_reply_to_collection.json b/test/fixtures/fedidev.fun/in_reply_to_collection.json
new file mode 100644
index 000000000..4deb7ed9a
--- /dev/null
+++ b/test/fixtures/fedidev.fun/in_reply_to_collection.json
@@ -0,0 +1,30 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/in-reply-to-collection",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:40:08Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-in-reply-to-collection",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:40:08Z",
+    "content": "collection",
+    "inReplyTo": {
+      "type": "Collection",
+      "items": [
+        "https://fedidev.fun/users/alice"
+      ]
+    }
+  }
+}
diff --git a/test/fixtures/fedidev.fun/in_reply_to_embedded_note.json b/test/fixtures/fedidev.fun/in_reply_to_embedded_note.json
new file mode 100644
index 000000000..de66f144f
--- /dev/null
+++ b/test/fixtures/fedidev.fun/in_reply_to_embedded_note.json
@@ -0,0 +1,35 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/in-reply-to-embedded-note",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:40:21Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-in-reply-to-embedded-note",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:40:21Z",
+    "content": "embedded note",
+    "inReplyTo": {
+      "@context": "https://www.w3.org/ns/activitystreams",
+      "type": "Note",
+      "id": "https://fedidev.fun/assets/note1.jsonap",
+      "to": [
+        "https://www.w3.org/ns/activitystreams#Public"
+      ],
+      "attributedTo": "https://fedidev.fun/users/alice",
+      "content": "One",
+      "published": "2024-01-06T13:11:45Z"
+    }
+  }
+}
diff --git a/test/fixtures/fedidev.fun/in_reply_to_link.json b/test/fixtures/fedidev.fun/in_reply_to_link.json
new file mode 100644
index 000000000..f000ddcac
--- /dev/null
+++ b/test/fixtures/fedidev.fun/in_reply_to_link.json
@@ -0,0 +1,28 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/in-reply-to-link",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:39:56Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-in-reply-to-link",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:39:56Z",
+    "content": "Link in inReplyTo",
+    "inReplyTo": {
+      "type": "Link",
+      "href": "https://fedidev.fun/assets/note1.jsonap"
+    }
+  }
+}
diff --git a/test/fixtures/fedidev.fun/in_reply_to_list.json b/test/fixtures/fedidev.fun/in_reply_to_list.json
new file mode 100644
index 000000000..7242558b3
--- /dev/null
+++ b/test/fixtures/fedidev.fun/in_reply_to_list.json
@@ -0,0 +1,28 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/in-reply-to-list",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:40:08Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-in-reply-to-list",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:40:08Z",
+    "content": "two elements in inReplyTo",
+    "inReplyTo": [
+      "https://fedidev.fun/assets/note1.jsonap",
+      "https://fedidev.fun/assets/note2.jsonap"
+    ]
+  }
+}
diff --git a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_in_reply_to_test.exs b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_in_reply_to_test.exs
new file mode 100644
index 000000000..b720a5441
--- /dev/null
+++ b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_in_reply_to_test.exs
@@ -0,0 +1,72 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunInReplyToTest do
+  use Oban.Testing, repo: Pleroma.Repo
+  use Pleroma.DataCase
+
+  alias Pleroma.Object
+  alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.Transmogrifier
+
+  import Pleroma.Factory
+
+  setup_all do
+    Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
+    :ok
+  end
+
+  defp ensure_remote_actor!(ap_id) when is_binary(ap_id) do
+    case User.get_cached_by_ap_id(ap_id) do
+      %User{} ->
+        :ok
+
+      _ ->
+        insert(:user,
+          local: false,
+          ap_id: ap_id,
+          follower_address: ap_id <> "/followers",
+          following_address: ap_id <> "/following",
+          featured_address: ap_id <> "/collections/featured",
+          inbox: ap_id <> "/inbox"
+        )
+
+        :ok
+    end
+  end
+
+  defp ingest_fixture!(rel_path) do
+    data = rel_path |> File.read!() |> Jason.decode!()
+    ensure_remote_actor!(data["actor"])
+
+    assert {:ok, activity} = Transmogrifier.handle_incoming(data)
+    object = Object.normalize(activity.data["object"], fetch: false)
+
+    {activity, object}
+  end
+
+  test "normalizes Link inReplyTo to a string" do
+    {_activity, object} = ingest_fixture!("test/fixtures/fedidev.fun/in_reply_to_link.json")
+    assert object.data["inReplyTo"] == "https://fedidev.fun/assets/note1.jsonap"
+  end
+
+  test "normalizes list inReplyTo to the first object ID" do
+    {_activity, object} = ingest_fixture!("test/fixtures/fedidev.fun/in_reply_to_list.json")
+    assert object.data["inReplyTo"] == "https://fedidev.fun/assets/note1.jsonap"
+  end
+
+  test "drops invalid map shapes in inReplyTo" do
+    {_activity, object} =
+      ingest_fixture!("test/fixtures/fedidev.fun/in_reply_to_collection.json")
+
+    assert object.data["inReplyTo"] == nil
+  end
+
+  test "accepts embedded objects in inReplyTo" do
+    {_activity, object} =
+      ingest_fixture!("test/fixtures/fedidev.fun/in_reply_to_embedded_note.json")
+
+    assert object.data["inReplyTo"] == "https://fedidev.fun/assets/note1.jsonap"
+  end
+end
diff --git a/test/pleroma/web/activity_pub/transmogrifier/note_handling_test.exs b/test/pleroma/web/activity_pub/transmogrifier/note_handling_test.exs
index 403c98a2d..f28d4f771 100644
--- a/test/pleroma/web/activity_pub/transmogrifier/note_handling_test.exs
+++ b/test/pleroma/web/activity_pub/transmogrifier/note_handling_test.exs
@@ -572,11 +572,11 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.NoteHandlingTest do
         Map.put(data["object"], "inReplyTo", ["https://shitposter.club/notice/2827873"])
 
       modified_object = Transmogrifier.fix_in_reply_to(object_with_reply)
-      assert modified_object["inReplyTo"] == ["https://shitposter.club/notice/2827873"]
+      assert modified_object["inReplyTo"] == "https://shitposter.club/notice/2827873"
 
       object_with_reply = Map.put(data["object"], "inReplyTo", [])
       modified_object = Transmogrifier.fix_in_reply_to(object_with_reply)
-      assert modified_object["inReplyTo"] == []
+      assert modified_object["inReplyTo"] == nil
     end
 
     test "returns modified object when allowed incoming reply", %{data: data} do

From e781a7ef9b231a62c9c3d93cde20841dca13abea Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Sat, 17 Jan 2026 00:08:19 +0400
Subject: [PATCH 05/11] AP ingest: harden attachment parsing

---
 .../article_note_page_validator.ex            |  5 +-
 .../web/activity_pub/transmogrifier.ex        | 11 ++-
 .../fedidev.fun/attachment_embedded_note.json | 32 +++++++++
 .../fedidev.fun/attachment_payto_link.json    | 31 +++++++++
 .../fedidev.fun/attachment_url_list.json      | 40 +++++++++++
 .../fedidev_fun_attachments_test.exs          | 69 +++++++++++++++++++
 6 files changed, 182 insertions(+), 6 deletions(-)
 create mode 100644 test/fixtures/fedidev.fun/attachment_embedded_note.json
 create mode 100644 test/fixtures/fedidev.fun/attachment_payto_link.json
 create mode 100644 test/fixtures/fedidev.fun/attachment_url_list.json
 create mode 100644 test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_attachments_test.exs

diff --git a/lib/pleroma/web/activity_pub/object_validators/article_note_page_validator.ex b/lib/pleroma/web/activity_pub/object_validators/article_note_page_validator.ex
index b0cdee552..f2df2250f 100644
--- a/lib/pleroma/web/activity_pub/object_validators/article_note_page_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/article_note_page_validator.ex
@@ -100,10 +100,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.ArticleNotePageValidator do
 
   defp fix_replies(data), do: Map.delete(data, "replies")
 
-  def fix_attachments(%{"attachment" => attachment} = data) when is_map(attachment),
-    do: Map.put(data, "attachment", [attachment])
-
-  def fix_attachments(data), do: data
+  def fix_attachments(data), do: Transmogrifier.fix_attachments(data)
 
   defp fix(data) do
     data
diff --git a/lib/pleroma/web/activity_pub/transmogrifier.ex b/lib/pleroma/web/activity_pub/transmogrifier.ex
index 43d991a22..cc84cf8af 100644
--- a/lib/pleroma/web/activity_pub/transmogrifier.ex
+++ b/lib/pleroma/web/activity_pub/transmogrifier.ex
@@ -293,6 +293,12 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
     |> Map.drop(["conversation"])
   end
 
+  defp valid_http_url?(href) when is_binary(href) do
+    match?({:ok, _}, ObjectValidators.Uri.cast(href))
+  end
+
+  defp valid_http_url?(_), do: false
+
   def fix_attachments(%{"attachment" => attachment} = object) when is_list(attachment) do
     attachments =
       Enum.map(attachment, fn data ->
@@ -305,7 +311,8 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
 
         media_type =
           cond do
-            is_map(url) && url =~ Pleroma.Constants.mime_regex() ->
+            is_map(url) && is_bitstring(url["mediaType"]) &&
+                url["mediaType"] =~ Pleroma.Constants.mime_regex() ->
               url["mediaType"]
 
             is_bitstring(data["mediaType"]) && data["mediaType"] =~ Pleroma.Constants.mime_regex() ->
@@ -326,7 +333,7 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
             true -> nil
           end
 
-        if href do
+        if href && valid_http_url?(href) do
           attachment_url =
             %{
               "href" => href,
diff --git a/test/fixtures/fedidev.fun/attachment_embedded_note.json b/test/fixtures/fedidev.fun/attachment_embedded_note.json
new file mode 100644
index 000000000..8e83762dc
--- /dev/null
+++ b/test/fixtures/fedidev.fun/attachment_embedded_note.json
@@ -0,0 +1,32 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/attachment-embedded-note",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:43:01Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-attachment-embedded-note",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:43:01Z",
+    "content": "Note with embedded Note attachment",
+    "attachment": {
+      "type": "Note",
+      "attributedTo": "https://fedidev.fun/users/alice",
+      "name": "attached note",
+      "content": "This is just a note",
+      "published": "2024-03-06T07:23:56Z"
+    }
+  }
+}
+
diff --git a/test/fixtures/fedidev.fun/attachment_payto_link.json b/test/fixtures/fedidev.fun/attachment_payto_link.json
new file mode 100644
index 000000000..1da324cb3
--- /dev/null
+++ b/test/fixtures/fedidev.fun/attachment_payto_link.json
@@ -0,0 +1,31 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/attachment-payto-link",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:43:00Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-attachment-payto-link",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:43:00Z",
+    "content": "Payment Link",
+    "attachment": {
+      "type": "Link",
+      "name": "Donate",
+      "href": "payto://iban/DE75512108001245126199",
+      "rel": "payment"
+    }
+  }
+}
+
diff --git a/test/fixtures/fedidev.fun/attachment_url_list.json b/test/fixtures/fedidev.fun/attachment_url_list.json
new file mode 100644
index 000000000..0efaeafdb
--- /dev/null
+++ b/test/fixtures/fedidev.fun/attachment_url_list.json
@@ -0,0 +1,40 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/attachment-url-list",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:43:02Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-attachment-url-list",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:43:02Z",
+    "content": "url is array of two Link objects",
+    "attachment": {
+      "type": "Image",
+      "url": [
+        {
+          "type": "Link",
+          "href": "https://fedidev.fun/images/007.png",
+          "mediaType": "image/png"
+        },
+        {
+          "type": "Link",
+          "href": "https://fedidev.fun/images/008.jpg",
+          "mediaType": "image/jpeg"
+        }
+      ]
+    }
+  }
+}
+
diff --git a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_attachments_test.exs b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_attachments_test.exs
new file mode 100644
index 000000000..a13912b08
--- /dev/null
+++ b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_attachments_test.exs
@@ -0,0 +1,69 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunAttachmentsTest do
+  use Oban.Testing, repo: Pleroma.Repo
+  use Pleroma.DataCase
+
+  alias Pleroma.Object
+  alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.Transmogrifier
+
+  import Pleroma.Factory
+
+  setup_all do
+    Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
+    :ok
+  end
+
+  defp ensure_remote_actor!(ap_id) when is_binary(ap_id) do
+    case User.get_cached_by_ap_id(ap_id) do
+      %User{} ->
+        :ok
+
+      _ ->
+        insert(:user,
+          local: false,
+          ap_id: ap_id,
+          follower_address: ap_id <> "/followers",
+          following_address: ap_id <> "/following",
+          featured_address: ap_id <> "/collections/featured",
+          inbox: ap_id <> "/inbox"
+        )
+
+        :ok
+    end
+  end
+
+  defp ingest_fixture!(rel_path) do
+    data = rel_path |> File.read!() |> Jason.decode!()
+    ensure_remote_actor!(data["actor"])
+
+    assert {:ok, activity} = Transmogrifier.handle_incoming(data)
+    object = Object.normalize(activity.data["object"], fetch: false)
+
+    {activity, object}
+  end
+
+  test "drops non-http(s) attachment href" do
+    {_activity, object} = ingest_fixture!("test/fixtures/fedidev.fun/attachment_payto_link.json")
+    assert object.data["attachment"] == []
+  end
+
+  test "drops embedded non-attachment objects" do
+    {_activity, object} =
+      ingest_fixture!("test/fixtures/fedidev.fun/attachment_embedded_note.json")
+
+    assert object.data["attachment"] == []
+  end
+
+  test "accepts attachment url as list and keeps the first link" do
+    {_activity, object} = ingest_fixture!("test/fixtures/fedidev.fun/attachment_url_list.json")
+
+    [attachment] = object.data["attachment"]
+    [%{"href" => href} | _] = attachment["url"]
+
+    assert href == "https://fedidev.fun/images/007.png"
+  end
+end

From e9e3d255e5349f913ed88a36e6ff38ec93c8544b Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Sat, 17 Jan 2026 00:12:48 +0400
Subject: [PATCH 06/11] AP ingest: infer tag type when missing

---
 .../object_validators/tag_validator.ex        | 21 ++++++
 .../fedidev.fun/tag_hashtag_missing_type.json | 30 +++++++++
 .../fedidev.fun/tag_mention_missing_type.json | 31 +++++++++
 .../fedidev_fun_tag_inference_test.exs        | 65 +++++++++++++++++++
 4 files changed, 147 insertions(+)
 create mode 100644 test/fixtures/fedidev.fun/tag_hashtag_missing_type.json
 create mode 100644 test/fixtures/fedidev.fun/tag_mention_missing_type.json
 create mode 100644 test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_tag_inference_test.exs

diff --git a/lib/pleroma/web/activity_pub/object_validators/tag_validator.ex b/lib/pleroma/web/activity_pub/object_validators/tag_validator.ex
index dc2770189..a412c8dea 100644
--- a/lib/pleroma/web/activity_pub/object_validators/tag_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/tag_validator.ex
@@ -80,6 +80,27 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.TagValidator do
     |> Map.put(:action, :ignore)
   end
 
+  def changeset(struct, data) when is_map(data) do
+    data = infer_type(data)
+
+    if Map.has_key?(data, "type") do
+      changeset(struct, data)
+    else
+      struct
+      |> cast(data, [])
+      |> Map.put(:action, :ignore)
+    end
+  end
+
+  defp infer_type(%{"type" => _} = data), do: data
+  defp infer_type(%{"name" => "#" <> _} = data), do: Map.put(data, "type", "Hashtag")
+  defp infer_type(%{"name" => "@" <> _} = data), do: Map.put(data, "type", "Mention")
+
+  defp infer_type(%{"mediaType" => _media_type, "href" => _href} = data),
+    do: Map.put(data, "type", "Link")
+
+  defp infer_type(data), do: data
+
   def icon_changeset(struct, data) do
     struct
     |> cast(data, [:type, :url])
diff --git a/test/fixtures/fedidev.fun/tag_hashtag_missing_type.json b/test/fixtures/fedidev.fun/tag_hashtag_missing_type.json
new file mode 100644
index 000000000..74f9d91b8
--- /dev/null
+++ b/test/fixtures/fedidev.fun/tag_hashtag_missing_type.json
@@ -0,0 +1,30 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/tag-hashtag-missing-type",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:41:00Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-tag-hashtag-missing-type",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:41:00Z",
+    "content": "hashtag without type",
+    "tag": [
+      {
+        "name": "#Test"
+      }
+    ]
+  }
+}
+
diff --git a/test/fixtures/fedidev.fun/tag_mention_missing_type.json b/test/fixtures/fedidev.fun/tag_mention_missing_type.json
new file mode 100644
index 000000000..d290be6c2
--- /dev/null
+++ b/test/fixtures/fedidev.fun/tag_mention_missing_type.json
@@ -0,0 +1,31 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/tag-mention-missing-type",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:41:01Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-tag-mention-missing-type",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:41:01Z",
+    "content": "mention without type",
+    "tag": [
+      {
+        "name": "@bob",
+        "href": "https://remote.example/users/bob"
+      }
+    ]
+  }
+}
+
diff --git a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_tag_inference_test.exs b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_tag_inference_test.exs
new file mode 100644
index 000000000..ef7feb8ad
--- /dev/null
+++ b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_tag_inference_test.exs
@@ -0,0 +1,65 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunTagInferenceTest do
+  use Oban.Testing, repo: Pleroma.Repo
+  use Pleroma.DataCase
+
+  alias Pleroma.Object
+  alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.Transmogrifier
+
+  import Pleroma.Factory
+
+  setup_all do
+    Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
+    :ok
+  end
+
+  defp ensure_remote_actor!(ap_id) when is_binary(ap_id) do
+    case User.get_cached_by_ap_id(ap_id) do
+      %User{} ->
+        :ok
+
+      _ ->
+        insert(:user,
+          local: false,
+          ap_id: ap_id,
+          follower_address: ap_id <> "/followers",
+          following_address: ap_id <> "/following",
+          featured_address: ap_id <> "/collections/featured",
+          inbox: ap_id <> "/inbox"
+        )
+
+        :ok
+    end
+  end
+
+  defp ingest_fixture!(rel_path) do
+    data = rel_path |> File.read!() |> Jason.decode!()
+    ensure_remote_actor!(data["actor"])
+
+    assert {:ok, activity} = Transmogrifier.handle_incoming(data)
+    object = Object.normalize(activity.data["object"], fetch: false)
+
+    {activity, object}
+  end
+
+  test "infers Hashtag type when missing" do
+    {_activity, object} =
+      ingest_fixture!("test/fixtures/fedidev.fun/tag_hashtag_missing_type.json")
+
+    assert "test" in Object.hashtags(object)
+  end
+
+  test "infers Mention type when missing" do
+    {_activity, object} =
+      ingest_fixture!("test/fixtures/fedidev.fun/tag_mention_missing_type.json")
+
+    assert Enum.any?(object.data["tag"], fn
+             %{"type" => "Mention", "href" => "https://remote.example/users/bob"} -> true
+             _ -> false
+           end)
+  end
+end

From 9912a9f603b1d0816f95491b67a9ba12553123ce Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Sat, 17 Jan 2026 01:33:21 +0400
Subject: [PATCH 07/11] AP ingest: accept Emoji icon variants

---
 .../object_validators/tag_validator.ex        | 62 ++++++++++++++++--
 .../web/activity_pub/transmogrifier.ex        | 30 ++++++++-
 .../fedidev.fun/emoji_icon_string.json        | 32 +++++++++
 .../emoji_icon_url_missing_type.json          | 34 ++++++++++
 .../fedidev.fun/emoji_missing_icon.json       | 31 +++++++++
 .../transmogrifier/fedidev_fun_emoji_test.exs | 65 +++++++++++++++++++
 6 files changed, 246 insertions(+), 8 deletions(-)
 create mode 100644 test/fixtures/fedidev.fun/emoji_icon_string.json
 create mode 100644 test/fixtures/fedidev.fun/emoji_icon_url_missing_type.json
 create mode 100644 test/fixtures/fedidev.fun/emoji_missing_icon.json
 create mode 100644 test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_emoji_test.exs

diff --git a/lib/pleroma/web/activity_pub/object_validators/tag_validator.ex b/lib/pleroma/web/activity_pub/object_validators/tag_validator.ex
index a412c8dea..cdab8d78d 100644
--- a/lib/pleroma/web/activity_pub/object_validators/tag_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/tag_validator.ex
@@ -59,12 +59,29 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.TagValidator do
   end
 
   def changeset(struct, %{"type" => "Emoji"} = data) do
-    data = Map.put(data, "name", String.trim(data["name"], ":"))
+    data =
+      data
+      |> Map.put("name", String.trim(data["name"], ":"))
+      |> normalize_emoji_icon()
 
-    struct
-    |> cast(data, [:type, :name, :updated, :id])
-    |> cast_embed(:icon, with: &icon_changeset/2)
-    |> validate_required([:type, :name, :icon])
+    case data["icon"] do
+      %{"url" => url} when is_binary(url) ->
+        if valid_http_url?(url) do
+          struct
+          |> cast(data, [:type, :name, :updated, :id])
+          |> cast_embed(:icon, with: &icon_changeset/2)
+          |> validate_required([:type, :name, :icon])
+        else
+          struct
+          |> cast(data, [])
+          |> Map.put(:action, :ignore)
+        end
+
+      _ ->
+        struct
+        |> cast(data, [])
+        |> Map.put(:action, :ignore)
+    end
   end
 
   def changeset(struct, %{"type" => "Link"} = data) do
@@ -101,6 +118,41 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.TagValidator do
 
   defp infer_type(data), do: data
 
+  defp normalize_emoji_icon(%{"icon" => icon} = data) when is_binary(icon) do
+    Map.put(data, "icon", %{"type" => "Image", "url" => icon})
+  end
+
+  defp normalize_emoji_icon(%{"icon" => icon} = data) when is_map(icon) do
+    case extract_icon_url(icon) do
+      url when is_binary(url) -> Map.put(data, "icon", %{"type" => "Image", "url" => url})
+      _ -> Map.delete(data, "icon")
+    end
+  end
+
+  defp normalize_emoji_icon(data), do: data
+
+  defp extract_icon_url(%{"url" => url}) when is_binary(url), do: url
+
+  defp extract_icon_url(%{"url" => %{"href" => href}}) when is_binary(href), do: href
+
+  defp extract_icon_url(%{"url" => [first | _]}) do
+    cond do
+      is_binary(first) -> first
+      is_map(first) -> first["href"]
+      true -> nil
+    end
+  end
+
+  defp extract_icon_url(%{"href" => href}) when is_binary(href), do: href
+
+  defp extract_icon_url(_), do: nil
+
+  defp valid_http_url?(url) when is_binary(url) do
+    match?({:ok, _}, ObjectValidators.Uri.cast(url))
+  end
+
+  defp valid_http_url?(_), do: false
+
   def icon_changeset(struct, data) do
     struct
     |> cast(data, [:type, :url])
diff --git a/lib/pleroma/web/activity_pub/transmogrifier.ex b/lib/pleroma/web/activity_pub/transmogrifier.ex
index cc84cf8af..55b70b881 100644
--- a/lib/pleroma/web/activity_pub/transmogrifier.ex
+++ b/lib/pleroma/web/activity_pub/transmogrifier.ex
@@ -386,6 +386,24 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
 
   def fix_url(object), do: object
 
+  defp emoji_icon_url(icon) when is_binary(icon), do: icon
+
+  defp emoji_icon_url(%{"url" => url}) when is_binary(url), do: url
+
+  defp emoji_icon_url(%{"url" => %{"href" => href}}) when is_binary(href), do: href
+
+  defp emoji_icon_url(%{"url" => [first | _]}) do
+    cond do
+      is_binary(first) -> first
+      is_map(first) -> first["href"] || first["url"] || first["id"]
+      true -> nil
+    end
+  end
+
+  defp emoji_icon_url(%{"href" => href}) when is_binary(href), do: href
+
+  defp emoji_icon_url(_), do: nil
+
   def fix_emoji(%{"tag" => tags} = object) when is_list(tags) do
     emoji =
       tags
@@ -393,7 +411,10 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
       |> Enum.reduce(%{}, fn data, mapping ->
         name = String.trim(data["name"], ":")
 
-        Map.put(mapping, name, data["icon"]["url"])
+        case emoji_icon_url(data["icon"]) do
+          url when is_binary(url) -> Map.put(mapping, name, url)
+          _ -> mapping
+        end
       end)
 
     Map.put(object, "emoji", emoji)
@@ -401,9 +422,12 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
 
   def fix_emoji(%{"tag" => %{"type" => "Emoji"} = tag} = object) do
     name = String.trim(tag["name"], ":")
-    emoji = %{name => tag["icon"]["url"]}
 
-    Map.put(object, "emoji", emoji)
+    with url when is_binary(url) <- emoji_icon_url(tag["icon"]) do
+      Map.put(object, "emoji", %{name => url})
+    else
+      _ -> object
+    end
   end
 
   def fix_emoji(object), do: object
diff --git a/test/fixtures/fedidev.fun/emoji_icon_string.json b/test/fixtures/fedidev.fun/emoji_icon_string.json
new file mode 100644
index 000000000..0be3deb8c
--- /dev/null
+++ b/test/fixtures/fedidev.fun/emoji_icon_string.json
@@ -0,0 +1,32 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/emoji-icon-string",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:40:00Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-emoji-icon-string",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:40:00Z",
+    "content": "emoji icon as string :cow:",
+    "tag": [
+      {
+        "type": "Emoji",
+        "name": ":cow:",
+        "icon": "https://fedidev.fun/static/cow.png"
+      }
+    ]
+  }
+}
+
diff --git a/test/fixtures/fedidev.fun/emoji_icon_url_missing_type.json b/test/fixtures/fedidev.fun/emoji_icon_url_missing_type.json
new file mode 100644
index 000000000..2837872eb
--- /dev/null
+++ b/test/fixtures/fedidev.fun/emoji_icon_url_missing_type.json
@@ -0,0 +1,34 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/emoji-icon-url-missing-type",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:40:01Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-emoji-icon-url-missing-type",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:40:01Z",
+    "content": "emoji icon url missing type :cow2:",
+    "tag": [
+      {
+        "type": "Emoji",
+        "name": ":cow2:",
+        "icon": {
+          "url": "https://fedidev.fun/static/cow.png"
+        }
+      }
+    ]
+  }
+}
+
diff --git a/test/fixtures/fedidev.fun/emoji_missing_icon.json b/test/fixtures/fedidev.fun/emoji_missing_icon.json
new file mode 100644
index 000000000..69af01a73
--- /dev/null
+++ b/test/fixtures/fedidev.fun/emoji_missing_icon.json
@@ -0,0 +1,31 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/emoji-missing-icon",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:40:02Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-emoji-missing-icon",
+    "attributedTo": "https://fedidev.fun/users/alice",
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:40:02Z",
+    "content": "emoji missing icon :cow3:",
+    "tag": [
+      {
+        "type": "Emoji",
+        "name": ":cow3:"
+      }
+    ]
+  }
+}
+
diff --git a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_emoji_test.exs b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_emoji_test.exs
new file mode 100644
index 000000000..56c305352
--- /dev/null
+++ b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_emoji_test.exs
@@ -0,0 +1,65 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunEmojiTest do
+  use Oban.Testing, repo: Pleroma.Repo
+  use Pleroma.DataCase
+
+  alias Pleroma.Object
+  alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.Transmogrifier
+
+  import Pleroma.Factory
+
+  setup_all do
+    Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
+    :ok
+  end
+
+  defp ensure_remote_actor!(ap_id) when is_binary(ap_id) do
+    case User.get_cached_by_ap_id(ap_id) do
+      %User{} ->
+        :ok
+
+      _ ->
+        insert(:user,
+          local: false,
+          ap_id: ap_id,
+          follower_address: ap_id <> "/followers",
+          following_address: ap_id <> "/following",
+          featured_address: ap_id <> "/collections/featured",
+          inbox: ap_id <> "/inbox"
+        )
+
+        :ok
+    end
+  end
+
+  defp ingest_fixture!(rel_path) do
+    data = rel_path |> File.read!() |> Jason.decode!()
+    ensure_remote_actor!(data["actor"])
+
+    assert {:ok, activity} = Transmogrifier.handle_incoming(data)
+    object = Object.normalize(activity.data["object"], fetch: false)
+
+    {activity, object}
+  end
+
+  test "ingests Emoji tag with string icon" do
+    {_activity, object} = ingest_fixture!("test/fixtures/fedidev.fun/emoji_icon_string.json")
+    assert object.data["emoji"]["cow"] == "https://fedidev.fun/static/cow.png"
+  end
+
+  test "ingests Emoji tag with icon missing type" do
+    {_activity, object} =
+      ingest_fixture!("test/fixtures/fedidev.fun/emoji_icon_url_missing_type.json")
+
+    assert object.data["emoji"]["cow2"] == "https://fedidev.fun/static/cow.png"
+  end
+
+  test "ignores Emoji tag missing icon" do
+    {_activity, object} = ingest_fixture!("test/fixtures/fedidev.fun/emoji_missing_icon.json")
+    assert object.data["emoji"] == %{}
+  end
+end

From 3b3e369f83940db06da4030242c9ccc2ba8897cf Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Sat, 17 Jan 2026 02:46:59 +0400
Subject: [PATCH 08/11] AP ingest: fill missing attributedTo from activity

---
 lib/pleroma/object/containment.ex             | 30 ++++++++----
 .../web/activity_pub/object_validator.ex      |  2 +
 .../object_validators/common_fixes.ex         | 11 +++++
 .../fedidev.fun/missing_attributed_to.json    | 25 ++++++++++
 ...fedidev_fun_missing_attributed_to_test.exs | 49 +++++++++++++++++++
 5 files changed, 108 insertions(+), 9 deletions(-)
 create mode 100644 test/fixtures/fedidev.fun/missing_attributed_to.json
 create mode 100644 test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_missing_attributed_to_test.exs

diff --git a/lib/pleroma/object/containment.ex b/lib/pleroma/object/containment.ex
index 77fac12c0..b90d68636 100644
--- a/lib/pleroma/object/containment.ex
+++ b/lib/pleroma/object/containment.ex
@@ -15,12 +15,28 @@ defmodule Pleroma.Object.Containment do
     actor
   end
 
+  def get_actor(%{"actor" => nil, "attributedTo" => actor}) when not is_nil(actor) do
+    get_actor(%{"actor" => actor})
+  end
+
+  def get_actor(%{"actor" => nil}), do: nil
+
+  def get_actor(%{"actor" => []}), do: nil
+
   def get_actor(%{"actor" => actor}) when is_list(actor) do
-    if is_binary(Enum.at(actor, 0)) do
-      Enum.at(actor, 0)
-    else
-      Enum.find(actor, fn %{"type" => type} -> type in ["Person", "Service", "Application"] end)
-      |> Map.get("id")
+    case actor do
+      [first | _] when is_binary(first) ->
+        first
+
+      _ ->
+        Enum.find_value(actor, fn
+          %{"type" => type, "id" => id}
+          when type in ["Person", "Service", "Application"] and is_binary(id) ->
+            id
+
+          _ ->
+            nil
+        end)
     end
   end
 
@@ -28,10 +44,6 @@ defmodule Pleroma.Object.Containment do
     id
   end
 
-  def get_actor(%{"actor" => nil, "attributedTo" => actor}) when not is_nil(actor) do
-    get_actor(%{"actor" => actor})
-  end
-
   def get_object(%{"object" => id}) when is_binary(id) do
     id
   end
diff --git a/lib/pleroma/web/activity_pub/object_validator.ex b/lib/pleroma/web/activity_pub/object_validator.ex
index 17652a0de..0254d6dc1 100644
--- a/lib/pleroma/web/activity_pub/object_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validator.ex
@@ -118,6 +118,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidator do
       when objtype in ~w[Question Answer Audio Video Image Event Article Note Page] do
     with {:ok, object_data} <-
            object
+           |> CommonFixes.maybe_set_attributed_to_from_activity(create_activity)
            |> CommonFixes.maybe_add_language_from_activity(create_activity)
            |> cast_and_apply_and_stringify_with_history(),
          meta = Keyword.put(meta, :object_data, object_data),
@@ -172,6 +173,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidator do
          {_, {:ok, object_data, _}} <-
            {:object_validation,
             object
+            |> CommonFixes.maybe_set_attributed_to_from_activity(update_activity)
             |> CommonFixes.maybe_add_language_from_activity(update_activity)
             |> validate(meta)},
          meta = Keyword.put(meta, :object_data, object_data),
diff --git a/lib/pleroma/web/activity_pub/object_validators/common_fixes.ex b/lib/pleroma/web/activity_pub/object_validators/common_fixes.ex
index 631f301af..c5defd6f4 100644
--- a/lib/pleroma/web/activity_pub/object_validators/common_fixes.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/common_fixes.ex
@@ -91,6 +91,17 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes do
     |> Map.put("attributedTo", actor)
   end
 
+  def maybe_set_attributed_to_from_activity(object, activity) when is_map(object) do
+    if is_nil(object["attributedTo"]) and is_nil(object["actor"]) do
+      case Containment.get_actor(activity) do
+        actor when is_binary(actor) -> Map.put(object, "attributedTo", actor)
+        _ -> object
+      end
+    else
+      object
+    end
+  end
+
   def fix_activity_context(data, %Object{data: %{"context" => object_context}}) do
     data
     |> Map.put("context", object_context)
diff --git a/test/fixtures/fedidev.fun/missing_attributed_to.json b/test/fixtures/fedidev.fun/missing_attributed_to.json
new file mode 100644
index 000000000..c2e644e84
--- /dev/null
+++ b/test/fixtures/fedidev.fun/missing_attributed_to.json
@@ -0,0 +1,25 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams"
+  ],
+  "type": "Create",
+  "id": "https://fedidev.fun/activity/missing-attributedto",
+  "actor": "https://fedidev.fun/users/alice",
+  "to": [
+    "https://www.w3.org/ns/activitystreams#Public"
+  ],
+  "cc": [],
+  "published": "2025-11-21T14:42:00Z",
+  "object": {
+    "type": "Note",
+    "id": "https://fedidev.fun/objects/note-missing-attributedto",
+    "attributedTo": null,
+    "to": [
+      "https://www.w3.org/ns/activitystreams#Public"
+    ],
+    "cc": [],
+    "published": "2025-11-21T14:42:00Z",
+    "content": "object without attributedTo"
+  }
+}
+
diff --git a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_missing_attributed_to_test.exs b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_missing_attributed_to_test.exs
new file mode 100644
index 000000000..c08e20fc9
--- /dev/null
+++ b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_missing_attributed_to_test.exs
@@ -0,0 +1,49 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunMissingAttributedToTest do
+  use Oban.Testing, repo: Pleroma.Repo
+  use Pleroma.DataCase
+
+  alias Pleroma.Object
+  alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.Transmogrifier
+
+  import Pleroma.Factory
+
+  setup_all do
+    Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
+    :ok
+  end
+
+  defp ensure_remote_actor!(ap_id) when is_binary(ap_id) do
+    case User.get_cached_by_ap_id(ap_id) do
+      %User{} ->
+        :ok
+
+      _ ->
+        insert(:user,
+          local: false,
+          ap_id: ap_id,
+          follower_address: ap_id <> "/followers",
+          following_address: ap_id <> "/following",
+          featured_address: ap_id <> "/collections/featured",
+          inbox: ap_id <> "/inbox"
+        )
+
+        :ok
+    end
+  end
+
+  test "inherits attributedTo from surrounding activity" do
+    data = File.read!("test/fixtures/fedidev.fun/missing_attributed_to.json") |> Jason.decode!()
+    ensure_remote_actor!(data["actor"])
+
+    assert {:ok, activity} = Transmogrifier.handle_incoming(data)
+    object = Object.normalize(activity.data["object"], fetch: false)
+
+    assert object.data["attributedTo"] == data["actor"]
+    assert object.data["actor"] == data["actor"]
+  end
+end

From e676ec350713d766b653f60f906fceec34c2c6a1 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 29 May 2026 18:35:15 +0400
Subject: [PATCH 09/11] Reject unsupported HTTP Message Signatures

---
 .../activitypub-bot-rfc9421-fallback.fix      |  1 +
 .../activity_pub/activity_pub_controller.ex   | 33 ++++++--
 .../activity_pub_controller_test.exs          | 77 +++++++++++++++++++
 3 files changed, 103 insertions(+), 8 deletions(-)
 create mode 100644 changelog.d/activitypub-bot-rfc9421-fallback.fix

diff --git a/changelog.d/activitypub-bot-rfc9421-fallback.fix b/changelog.d/activitypub-bot-rfc9421-fallback.fix
new file mode 100644
index 000000000..22642fee1
--- /dev/null
+++ b/changelog.d/activitypub-bot-rfc9421-fallback.fix
@@ -0,0 +1 @@
+Reject unsupported RFC 9421 inbox signatures instead of queueing a doomed failed-signature retry, allowing clients to fall back to legacy HTTP Signatures.
diff --git a/lib/pleroma/web/activity_pub/activity_pub_controller.ex b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
index 3d1875599..dd644c132 100644
--- a/lib/pleroma/web/activity_pub/activity_pub_controller.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
@@ -353,15 +353,21 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
   end
 
   def inbox(%{assigns: %{valid_signature: false}} = conn, params) do
-    Federator.incoming_failed_signature_ap_doc(%{
-      method: conn.method,
-      req_headers: conn.req_headers,
-      request_path: conn.request_path,
-      params: params,
-      query_string: conn.query_string
-    })
+    if unsupported_http_message_signature?(conn) do
+      conn
+      |> put_status(:unauthorized)
+      |> json("error, unsupported HTTP Message Signature")
+    else
+      Federator.incoming_failed_signature_ap_doc(%{
+        method: conn.method,
+        req_headers: conn.req_headers,
+        request_path: conn.request_path,
+        params: params,
+        query_string: conn.query_string
+      })
 
-    json(conn, "ok")
+      json(conn, "ok")
+    end
   end
 
   # POST /relay/inbox -or- POST /internal/fetch/inbox
@@ -381,6 +387,17 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
     |> json("error, missing HTTP Signature")
   end
 
+  defp unsupported_http_message_signature?(conn) do
+    Plug.Conn.get_req_header(conn, "signature-input") != [] and
+      not cavage_signature?(conn)
+  end
+
+  defp cavage_signature?(conn) do
+    conn
+    |> Plug.Conn.get_req_header("signature")
+    |> Enum.any?(&Regex.match?(~r/(^|,)\s*keyId\s*=/, &1))
+  end
+
   defp post_inbox_relayed_create(conn, params) do
     Logger.debug(
       "Signature missing or not from author, relayed Create message, fetching object from source"
diff --git a/test/pleroma/web/activity_pub/activity_pub_controller_test.exs b/test/pleroma/web/activity_pub/activity_pub_controller_test.exs
index 68e39b3a0..e9a777758 100644
--- a/test/pleroma/web/activity_pub/activity_pub_controller_test.exs
+++ b/test/pleroma/web/activity_pub/activity_pub_controller_test.exs
@@ -757,6 +757,83 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
       assert Activity.get_by_ap_id(data["id"])
     end
 
+    test "rejects unsupported HTTP Message Signatures so clients can fall back", %{conn: conn} do
+      data = %{
+        "type" => "Create",
+        "actor" => "https://activitypubbot.example/user/ok",
+        "id" => "https://activitypubbot.example/activities/rfc9421-create",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => [],
+        "object" => %{
+          "type" => "Note",
+          "id" => "https://activitypubbot.example/objects/rfc9421-note",
+          "actor" => "https://activitypubbot.example/user/ok",
+          "attributedTo" => "https://activitypubbot.example/user/ok",
+          "content" => "hello from activitypub-bot",
+          "published" => "2026-05-29T13:33:31Z",
+          "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+          "cc" => []
+        }
+      }
+
+      Mox.expect(Pleroma.StubbedHTTPSignaturesMock, :validate_conn, fn _conn -> false end)
+
+      conn =
+        conn
+        |> put_req_header("content-type", "application/activity+json")
+        |> put_req_header("date", "Fri, 29 May 2026 13:33:31 GMT")
+        |> put_req_header("content-digest", "sha-256=:fake-digest:")
+        |> put_req_header(
+          "signature-input",
+          "sig1=(\"@method\" \"@target-uri\" \"date\" \"content-type\" \"content-digest\");keyid=\"https://activitypubbot.example/user/ok/publickey\";alg=\"rsa-v1_5-sha256\";created=1780061611"
+        )
+        |> put_req_header("signature", "sig1=:fake-signature:")
+        |> post("/inbox", data)
+
+      assert "error, unsupported HTTP Message Signature" == json_response(conn, 401)
+      assert [] == all_enqueued(worker: SignatureRetryWorker)
+    end
+
+    test "keeps failed-signature retry for legacy signatures with Signature-Input", %{conn: conn} do
+      data = %{
+        "type" => "Create",
+        "actor" => "https://activitypubbot.example/user/ok",
+        "id" => "https://activitypubbot.example/activities/legacy-create",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => [],
+        "object" => %{
+          "type" => "Note",
+          "id" => "https://activitypubbot.example/objects/legacy-note",
+          "actor" => "https://activitypubbot.example/user/ok",
+          "attributedTo" => "https://activitypubbot.example/user/ok",
+          "content" => "hello from activitypub-bot",
+          "published" => "2026-05-29T13:33:31Z",
+          "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+          "cc" => []
+        }
+      }
+
+      Mox.expect(Pleroma.StubbedHTTPSignaturesMock, :validate_conn, fn _conn -> false end)
+
+      conn =
+        conn
+        |> put_req_header("content-type", "application/activity+json")
+        |> put_req_header("date", "Fri, 29 May 2026 13:33:31 GMT")
+        |> put_req_header("digest", "SHA-256=fake-digest")
+        |> put_req_header(
+          "signature-input",
+          "sig1=(\"@method\" \"@target-uri\" \"date\" \"content-type\" \"digest\");keyid=\"https://activitypubbot.example/user/ok/publickey\";alg=\"rsa-v1_5-sha256\";created=1780061611"
+        )
+        |> put_req_header(
+          "signature",
+          "keyId=\"https://activitypubbot.example/user/ok#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) host date digest content-type\",signature=\"fake-signature\""
+        )
+        |> post("/inbox", data)
+
+      assert "ok" == json_response(conn, 200)
+      assert [_] = all_enqueued(worker: SignatureRetryWorker)
+    end
+
     test "does not create a forged post after failed signature retry", %{conn: conn} do
       alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
       bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")

From 9df50eea82e4141bca673750448c5e795d31fa49 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Sun, 26 Jul 2026 12:26:35 +0400
Subject: [PATCH 10/11] fix: reject duplicate Signature headers

---
 .../activitypub-bot-rfc9421-fallback.fix      |  2 +-
 .../activity_pub/activity_pub_controller.ex   | 42 ++++++++----
 .../activity_pub_controller_test.exs          | 67 +++++++++++++++++++
 3 files changed, 97 insertions(+), 14 deletions(-)

diff --git a/changelog.d/activitypub-bot-rfc9421-fallback.fix b/changelog.d/activitypub-bot-rfc9421-fallback.fix
index 22642fee1..a04940bfe 100644
--- a/changelog.d/activitypub-bot-rfc9421-fallback.fix
+++ b/changelog.d/activitypub-bot-rfc9421-fallback.fix
@@ -1 +1 @@
-Reject unsupported RFC 9421 inbox signatures instead of queueing a doomed failed-signature retry, allowing clients to fall back to legacy HTTP Signatures.
+Reject unsupported or ambiguous inbox signatures instead of queueing a doomed failed-signature retry, allowing clients to fall back to legacy HTTP Signatures.
diff --git a/lib/pleroma/web/activity_pub/activity_pub_controller.ex b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
index dd644c132..38b8b8bfc 100644
--- a/lib/pleroma/web/activity_pub/activity_pub_controller.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
@@ -309,7 +309,8 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
         } = conn,
         %{"nickname" => nickname} = params
       ) do
-    with {:recipient_exists, %User{} = recipient} <-
+    with false <- unsupported_http_message_signature?(conn),
+         {:recipient_exists, %User{} = recipient} <-
            {:recipient_exists, User.get_cached_by_nickname(nickname)},
          {:sender_exists, {:ok, %User{} = actor}} <-
            {:sender_exists, User.get_or_fetch_by_ap_id(params["actor"])},
@@ -320,6 +321,9 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
       Federator.incoming_ap_doc(params)
       json(conn, "ok")
     else
+      true ->
+        reject_unsupported_http_message_signature(conn)
+
       {:recipient_exists, _} ->
         conn
         |> put_status(:not_found)
@@ -348,15 +352,17 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
   end
 
   def inbox(%{assigns: %{valid_signature: true, valid_host_header: true}} = conn, params) do
-    Federator.incoming_ap_doc(params)
-    json(conn, "ok")
+    if unsupported_http_message_signature?(conn) do
+      reject_unsupported_http_message_signature(conn)
+    else
+      Federator.incoming_ap_doc(params)
+      json(conn, "ok")
+    end
   end
 
   def inbox(%{assigns: %{valid_signature: false}} = conn, params) do
     if unsupported_http_message_signature?(conn) do
-      conn
-      |> put_status(:unauthorized)
-      |> json("error, unsupported HTTP Message Signature")
+      reject_unsupported_http_message_signature(conn)
     else
       Federator.incoming_failed_signature_ap_doc(%{
         method: conn.method,
@@ -387,15 +393,25 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
     |> json("error, missing HTTP Signature")
   end
 
-  defp unsupported_http_message_signature?(conn) do
-    Plug.Conn.get_req_header(conn, "signature-input") != [] and
-      not cavage_signature?(conn)
+  defp reject_unsupported_http_message_signature(conn) do
+    conn
+    |> put_status(:unauthorized)
+    |> json("error, unsupported HTTP Message Signature")
   end
 
-  defp cavage_signature?(conn) do
-    conn
-    |> Plug.Conn.get_req_header("signature")
-    |> Enum.any?(&Regex.match?(~r/(^|,)\s*keyId\s*=/, &1))
+  defp unsupported_http_message_signature?(conn) do
+    signature_headers = Plug.Conn.get_req_header(conn, "signature")
+
+    multiple_signature_headers?(signature_headers) or
+      (Plug.Conn.get_req_header(conn, "signature-input") != [] and
+         not cavage_signature?(signature_headers))
+  end
+
+  defp multiple_signature_headers?([_, _ | _]), do: true
+  defp multiple_signature_headers?(_), do: false
+
+  defp cavage_signature?(signature_headers) do
+    Enum.any?(signature_headers, &Regex.match?(~r/(^|,)\s*keyId\s*=/, &1))
   end
 
   defp post_inbox_relayed_create(conn, params) do
diff --git a/test/pleroma/web/activity_pub/activity_pub_controller_test.exs b/test/pleroma/web/activity_pub/activity_pub_controller_test.exs
index e9a777758..0de9618d4 100644
--- a/test/pleroma/web/activity_pub/activity_pub_controller_test.exs
+++ b/test/pleroma/web/activity_pub/activity_pub_controller_test.exs
@@ -729,6 +729,22 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
       assert Activity.get_by_ap_id(data["id"])
     end
 
+    test "rejects duplicate Signature headers before processing signed inbox requests", %{
+      conn: conn
+    } do
+      data = File.read!("test/fixtures/mastodon-post-activity.json") |> Jason.decode!()
+
+      conn =
+        conn
+        |> assign_valid_signature_for_actor(data["actor"])
+        |> put_req_header("content-type", "application/activity+json")
+        |> Map.update!(:req_headers, &[{"signature", "sig1=:fake-signature:"} | &1])
+        |> post("/inbox", data)
+
+      assert "error, unsupported HTTP Message Signature" == json_response(conn, 401)
+      assert [] == all_enqueued(worker: ReceiverWorker)
+    end
+
     test "it inserts an incoming activity into the database" <>
            "even if we can't fetch the user but have it in our db",
          %{conn: conn} do
@@ -794,6 +810,43 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
       assert [] == all_enqueued(worker: SignatureRetryWorker)
     end
 
+    test "rejects duplicate Signature headers so clients can fall back", %{conn: conn} do
+      data = %{
+        "type" => "Create",
+        "actor" => "https://activitypubbot.example/user/ok",
+        "id" => "https://activitypubbot.example/activities/duplicate-signature-create",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => [],
+        "object" => %{
+          "type" => "Note",
+          "id" => "https://activitypubbot.example/objects/duplicate-signature-note",
+          "actor" => "https://activitypubbot.example/user/ok",
+          "attributedTo" => "https://activitypubbot.example/user/ok",
+          "content" => "hello from activitypub-bot",
+          "published" => "2026-05-29T13:33:31Z",
+          "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+          "cc" => []
+        }
+      }
+
+      legacy_signature =
+        "keyId=\"https://activitypubbot.example/user/ok#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) host date digest content-type\",signature=\"fake-signature\""
+
+      Mox.expect(Pleroma.StubbedHTTPSignaturesMock, :validate_conn, fn _conn -> false end)
+
+      conn =
+        conn
+        |> put_req_header("content-type", "application/activity+json")
+        |> put_req_header("date", "Fri, 29 May 2026 13:33:31 GMT")
+        |> put_req_header("digest", "SHA-256=fake-digest")
+        |> put_req_header("signature", "sig1=:fake-signature:")
+        |> Map.update!(:req_headers, &[{"signature", legacy_signature} | &1])
+        |> post("/inbox", data)
+
+      assert "error, unsupported HTTP Message Signature" == json_response(conn, 401)
+      assert [] == all_enqueued(worker: SignatureRetryWorker)
+    end
+
     test "keeps failed-signature retry for legacy signatures with Signature-Input", %{conn: conn} do
       data = %{
         "type" => "Create",
@@ -1397,6 +1450,20 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
       assert Activity.get_by_ap_id(data["id"])
     end
 
+    test "rejects duplicate Signature headers", %{conn: conn, data: data} do
+      user = insert(:user)
+
+      conn =
+        conn
+        |> assign_valid_signature_for_actor(data["actor"])
+        |> put_req_header("content-type", "application/activity+json")
+        |> Map.update!(:req_headers, &[{"signature", "sig1=:fake-signature:"} | &1])
+        |> post("/users/#{user.nickname}/inbox", data)
+
+      assert "error, unsupported HTTP Message Signature" == json_response(conn, 401)
+      assert [] == all_enqueued(worker: ReceiverWorker)
+    end
+
     test "it accepts messages with to as string instead of array", %{conn: conn, data: data} do
       user = insert(:user)
 

From ce5c1b4c15ef89b077f62cde6f75379af68ac601 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Sun, 26 Jul 2026 12:35:09 +0400
Subject: [PATCH 11/11] fix(activitypub): harden object normalization

---
 changelog.d/fedidev-federation-compat.add     |   1 +
 lib/pleroma/object/containment.ex             |   6 +-
 .../object_validators/tag_validator.ex        |  32 +++-
 .../web/activity_pub/transmogrifier.ex        | 146 ++++++++++++------
 test/pleroma/object/containment_test.exs      |   5 +
 .../fedidev_fun_attachments_test.exs          |  33 +++-
 .../transmogrifier/fedidev_fun_emoji_test.exs |  42 ++++-
 .../fedidev_fun_object_type_list_test.exs     |  11 ++
 .../fedidev_fun_tag_inference_test.exs        |  47 ++++++
 .../transmogrifier/note_handling_test.exs     |  38 ++++-
 .../user_update_handling_test.exs             |  19 +++
 11 files changed, 315 insertions(+), 65 deletions(-)
 create mode 100644 changelog.d/fedidev-federation-compat.add

diff --git a/changelog.d/fedidev-federation-compat.add b/changelog.d/fedidev-federation-compat.add
new file mode 100644
index 000000000..bb29925f9
--- /dev/null
+++ b/changelog.d/fedidev-federation-compat.add
@@ -0,0 +1 @@
+Accept more real-world ActivityPub object shapes collected by fedidev.fun
diff --git a/lib/pleroma/object/containment.ex b/lib/pleroma/object/containment.ex
index b90d68636..c4cc1f014 100644
--- a/lib/pleroma/object/containment.ex
+++ b/lib/pleroma/object/containment.ex
@@ -79,9 +79,11 @@ defmodule Pleroma.Object.Containment do
 
   def contain_origin(id, %{"actor" => _actor} = params) do
     id_uri = URI.parse(id)
-    actor_uri = URI.parse(get_actor(params))
 
-    compare_uris(actor_uri, id_uri)
+    case get_actor(params) do
+      actor when is_binary(actor) -> compare_uris(URI.parse(actor), id_uri)
+      _ -> :error
+    end
   end
 
   def contain_origin(id, %{"attributedTo" => actor} = params),
diff --git a/lib/pleroma/web/activity_pub/object_validators/tag_validator.ex b/lib/pleroma/web/activity_pub/object_validators/tag_validator.ex
index cdab8d78d..0659c93d7 100644
--- a/lib/pleroma/web/activity_pub/object_validators/tag_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/tag_validator.ex
@@ -12,6 +12,8 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.TagValidator do
   require Pleroma.Constants
 
   @primary_key false
+  @tag_types ~w[Mention Hashtag Emoji Link]
+
   embedded_schema do
     # Common
     field(:type, :string)
@@ -49,7 +51,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.TagValidator do
     |> validate_required([:type, :href])
   end
 
-  def changeset(struct, %{"type" => "Hashtag", "name" => name} = data) do
+  def changeset(struct, %{"type" => "Hashtag", "name" => name} = data) when is_binary(name) do
     name = String.downcase(name)
     data = Map.put(data, "name", name)
 
@@ -58,7 +60,13 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.TagValidator do
     |> validate_required([:type, :name])
   end
 
-  def changeset(struct, %{"type" => "Emoji"} = data) do
+  def changeset(struct, %{"type" => "Hashtag"} = data) do
+    struct
+    |> cast(data, [])
+    |> Map.put(:action, :ignore)
+  end
+
+  def changeset(struct, %{"type" => "Emoji", "name" => name} = data) when is_binary(name) do
     data =
       data
       |> Map.put("name", String.trim(data["name"], ":"))
@@ -84,6 +92,12 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.TagValidator do
     end
   end
 
+  def changeset(struct, %{"type" => "Emoji"} = data) do
+    struct
+    |> cast(data, [])
+    |> Map.put(:action, :ignore)
+  end
+
   def changeset(struct, %{"type" => "Link"} = data) do
     struct
     |> cast(data, [:type, :name, :mediaType, :href])
@@ -91,6 +105,10 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.TagValidator do
     |> validate_required([:type, :href, :mediaType])
   end
 
+  def changeset(struct, %{"type" => types} = data) when is_list(types) do
+    changeset(struct, infer_type(data))
+  end
+
   def changeset(struct, %{"type" => _} = data) do
     struct
     |> cast(data, [])
@@ -98,7 +116,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.TagValidator do
   end
 
   def changeset(struct, data) when is_map(data) do
-    data = infer_type(data)
+    data = normalize(data)
 
     if Map.has_key?(data, "type") do
       changeset(struct, data)
@@ -109,6 +127,14 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.TagValidator do
     end
   end
 
+  def normalize(data) when is_map(data), do: infer_type(data)
+
+  defp infer_type(%{"type" => types} = data) when is_list(types) do
+    type = Enum.find(types, &(&1 in @tag_types)) || Enum.find(types, &is_binary/1)
+
+    if type, do: Map.put(data, "type", type), else: Map.delete(data, "type")
+  end
+
   defp infer_type(%{"type" => _} = data), do: data
   defp infer_type(%{"name" => "#" <> _} = data), do: Map.put(data, "type", "Hashtag")
   defp infer_type(%{"name" => "@" <> _} = data), do: Map.put(data, "type", "Mention")
diff --git a/lib/pleroma/web/activity_pub/transmogrifier.ex b/lib/pleroma/web/activity_pub/transmogrifier.ex
index 61c585daa..33ab62ca3 100644
--- a/lib/pleroma/web/activity_pub/transmogrifier.ex
+++ b/lib/pleroma/web/activity_pub/transmogrifier.ex
@@ -19,6 +19,7 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
   alias Pleroma.Web.ActivityPub.Builder
   alias Pleroma.Web.ActivityPub.ObjectValidator
   alias Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes
+  alias Pleroma.Web.ActivityPub.ObjectValidators.TagValidator
   alias Pleroma.Web.ActivityPub.Pipeline
   alias Pleroma.Web.ActivityPub.Utils
   alias Pleroma.Web.ActivityPub.Visibility
@@ -28,6 +29,9 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
 
   require Pleroma.Constants
 
+  @supported_types Pleroma.Constants.activity_types() ++
+                     Pleroma.Constants.object_types() ++ Pleroma.Constants.actor_types()
+
   @doc """
   Modifies an incoming AP object (mastodon format) to our internal format.
   """
@@ -301,58 +305,66 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
 
   def fix_attachments(%{"attachment" => attachment} = object) when is_list(attachment) do
     attachments =
-      Enum.map(attachment, fn data ->
-        url =
-          cond do
-            is_list(data["url"]) -> List.first(data["url"])
-            is_map(data["url"]) -> data["url"]
-            true -> nil
-          end
+      Enum.map(attachment, fn
+        data when is_map(data) ->
+          url =
+            cond do
+              is_list(data["url"]) -> List.first(data["url"])
+              is_map(data["url"]) -> data["url"]
+              true -> nil
+            end
 
-        media_type =
-          cond do
-            is_map(url) && is_bitstring(url["mediaType"]) &&
-                url["mediaType"] =~ Pleroma.Constants.mime_regex() ->
-              url["mediaType"]
+          url_data = if is_map(url), do: url, else: %{}
 
-            is_bitstring(data["mediaType"]) && data["mediaType"] =~ Pleroma.Constants.mime_regex() ->
-              data["mediaType"]
+          media_type =
+            cond do
+              is_bitstring(url_data["mediaType"]) &&
+                  url_data["mediaType"] =~ Pleroma.Constants.mime_regex() ->
+                url_data["mediaType"]
 
-            is_bitstring(data["mimeType"]) && data["mimeType"] =~ Pleroma.Constants.mime_regex() ->
-              data["mimeType"]
+              is_bitstring(data["mediaType"]) &&
+                  data["mediaType"] =~ Pleroma.Constants.mime_regex() ->
+                data["mediaType"]
 
-            true ->
-              nil
-          end
+              is_bitstring(data["mimeType"]) && data["mimeType"] =~ Pleroma.Constants.mime_regex() ->
+                data["mimeType"]
 
-        href =
-          cond do
-            is_map(url) && is_binary(url["href"]) -> url["href"]
-            is_binary(data["url"]) -> data["url"]
-            is_binary(data["href"]) -> data["href"]
-            true -> nil
-          end
+              true ->
+                nil
+            end
+
+          href =
+            cond do
+              is_binary(url) -> url
+              is_binary(url_data["href"]) -> url_data["href"]
+              is_binary(data["url"]) -> data["url"]
+              is_binary(data["href"]) -> data["href"]
+              true -> nil
+            end
+
+          if href && valid_http_url?(href) do
+            attachment_url =
+              %{
+                "href" => href,
+                "type" => Map.get(url_data, "type", "Link")
+              }
+              |> Maps.put_if_present("mediaType", media_type)
+              |> Maps.put_if_present("width", url_data["width"] || data["width"])
+              |> Maps.put_if_present("height", url_data["height"] || data["height"])
 
-        if href && valid_http_url?(href) do
-          attachment_url =
             %{
-              "href" => href,
-              "type" => Map.get(url || %{}, "type", "Link")
+              "url" => [attachment_url],
+              "type" => data["type"] || "Document"
             }
             |> Maps.put_if_present("mediaType", media_type)
-            |> Maps.put_if_present("width", (url || %{})["width"] || data["width"])
-            |> Maps.put_if_present("height", (url || %{})["height"] || data["height"])
+            |> Maps.put_if_present("name", data["name"])
+            |> Maps.put_if_present("blurhash", data["blurhash"])
+          else
+            nil
+          end
 
-          %{
-            "url" => [attachment_url],
-            "type" => data["type"] || "Document"
-          }
-          |> Maps.put_if_present("mediaType", media_type)
-          |> Maps.put_if_present("name", data["name"])
-          |> Maps.put_if_present("blurhash", data["blurhash"])
-        else
+        _ ->
           nil
-        end
       end)
       |> Enum.filter(& &1)
 
@@ -404,14 +416,23 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
 
   defp emoji_icon_url(_), do: nil
 
+  defp valid_emoji_icon_url(icon) do
+    case emoji_icon_url(icon) do
+      url when is_binary(url) -> if valid_http_url?(url), do: url
+      _ -> nil
+    end
+  end
+
   def fix_emoji(%{"tag" => tags} = object) when is_list(tags) do
     emoji =
       tags
-      |> Enum.filter(fn data -> is_map(data) and data["type"] == "Emoji" and data["icon"] end)
+      |> Enum.filter(fn data ->
+        is_map(data) and data["type"] == "Emoji" and is_binary(data["name"]) and data["icon"]
+      end)
       |> Enum.reduce(%{}, fn data, mapping ->
         name = String.trim(data["name"], ":")
 
-        case emoji_icon_url(data["icon"]) do
+        case valid_emoji_icon_url(data["icon"]) do
           url when is_binary(url) -> Map.put(mapping, name, url)
           _ -> mapping
         end
@@ -420,10 +441,11 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
     Map.put(object, "emoji", emoji)
   end
 
-  def fix_emoji(%{"tag" => %{"type" => "Emoji"} = tag} = object) do
-    name = String.trim(tag["name"], ":")
+  def fix_emoji(%{"tag" => %{"type" => "Emoji", "name" => name} = tag} = object)
+      when is_binary(name) do
+    name = String.trim(name, ":")
 
-    with url when is_binary(url) <- emoji_icon_url(tag["icon"]) do
+    with url when is_binary(url) <- valid_emoji_icon_url(tag["icon"]) do
       Map.put(object, "emoji", %{name => url})
     else
       _ -> object
@@ -435,7 +457,9 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
   def fix_tag(%{"tag" => tag} = object) when is_list(tag) do
     tags =
       tag
-      |> Enum.filter(fn data -> data["type"] == "Hashtag" and data["name"] end)
+      |> Enum.filter(fn data ->
+        is_map(data) and data["type"] == "Hashtag" and is_binary(data["name"])
+      end)
       |> Enum.map(fn
         %{"name" => "#" <> hashtag} -> String.downcase(hashtag)
         %{"name" => hashtag} -> String.downcase(hashtag)
@@ -502,10 +526,32 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
     |> handle_incoming_normalized(options)
   end
 
-  defp fix_type_as_string(%{"type" => [type | _]} = data) when is_binary(type),
-    do: Map.put(data, "type", type)
+  defp fix_type_as_string(data) do
+    data
+    |> normalize_type()
+    |> normalize_tag_types()
+  end
 
-  defp fix_type_as_string(data), do: data
+  defp normalize_type(%{"type" => types} = data) when is_list(types) do
+    type = Enum.find(types, &(&1 in @supported_types)) || Enum.find(types, &is_binary/1)
+
+    if type, do: Map.put(data, "type", type), else: data
+  end
+
+  defp normalize_type(data), do: data
+
+  defp normalize_tag_types(%{"tag" => tags} = data) when is_list(tags) do
+    Map.put(data, "tag", Enum.map(tags, &normalize_tag_type/1))
+  end
+
+  defp normalize_tag_types(%{"tag" => tag} = data) when is_map(tag) do
+    Map.put(data, "tag", normalize_tag_type(tag))
+  end
+
+  defp normalize_tag_types(data), do: data
+
+  defp normalize_tag_type(tag) when is_map(tag), do: TagValidator.normalize(tag)
+  defp normalize_tag_type(tag), do: tag
 
   # Flag objects are placed ahead of the ID check because Mastodon 2.8 and earlier send them
   # with nil ID.
diff --git a/test/pleroma/object/containment_test.exs b/test/pleroma/object/containment_test.exs
index cf906ef47..5560dfce5 100644
--- a/test/pleroma/object/containment_test.exs
+++ b/test/pleroma/object/containment_test.exs
@@ -27,6 +27,11 @@ defmodule Pleroma.Object.ContainmentTest do
                })
     end
 
+    test "rejects an empty actor list without crashing" do
+      assert :error ==
+               Containment.contain_origin("https://example.com/objects/1", %{"actor" => []})
+    end
+
     test "contain_origin_from_id() catches obvious spoofing attempts" do
       data = %{
         "id" => "http://example.com/~alyssa/activities/1234.json"
diff --git a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_attachments_test.exs b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_attachments_test.exs
index a13912b08..9d15974fc 100644
--- a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_attachments_test.exs
+++ b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_attachments_test.exs
@@ -36,8 +36,7 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunAttachmentsTest do
     end
   end
 
-  defp ingest_fixture!(rel_path) do
-    data = rel_path |> File.read!() |> Jason.decode!()
+  defp ingest_data!(data) do
     ensure_remote_actor!(data["actor"])
 
     assert {:ok, activity} = Transmogrifier.handle_incoming(data)
@@ -46,6 +45,13 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunAttachmentsTest do
     {activity, object}
   end
 
+  defp ingest_fixture!(rel_path) do
+    rel_path
+    |> File.read!()
+    |> Jason.decode!()
+    |> ingest_data!()
+  end
+
   test "drops non-http(s) attachment href" do
     {_activity, object} = ingest_fixture!("test/fixtures/fedidev.fun/attachment_payto_link.json")
     assert object.data["attachment"] == []
@@ -66,4 +72,27 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunAttachmentsTest do
 
     assert href == "https://fedidev.fun/images/007.png"
   end
+
+  test "drops malformed attachment list entries" do
+    data = File.read!("test/fixtures/fedidev.fun/attachment_url_list.json") |> Jason.decode!()
+    data = update_in(data, ["object", "attachment"], &["malformed" | List.wrap(&1)])
+
+    {_activity, object} = ingest_data!(data)
+
+    assert length(object.data["attachment"]) == 1
+  end
+
+  test "accepts a URI string in an attachment url list" do
+    data = File.read!("test/fixtures/fedidev.fun/attachment_url_list.json") |> Jason.decode!()
+
+    data =
+      put_in(data, ["object", "attachment", "url"], [
+        "https://fedidev.fun/images/007.png"
+      ])
+
+    {_activity, object} = ingest_data!(data)
+
+    assert [%{"url" => [%{"href" => "https://fedidev.fun/images/007.png"}]}] =
+             object.data["attachment"]
+  end
 end
diff --git a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_emoji_test.exs b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_emoji_test.exs
index 56c305352..62e30f5af 100644
--- a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_emoji_test.exs
+++ b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_emoji_test.exs
@@ -36,8 +36,7 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunEmojiTest do
     end
   end
 
-  defp ingest_fixture!(rel_path) do
-    data = rel_path |> File.read!() |> Jason.decode!()
+  defp ingest_data!(data) do
     ensure_remote_actor!(data["actor"])
 
     assert {:ok, activity} = Transmogrifier.handle_incoming(data)
@@ -46,6 +45,13 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunEmojiTest do
     {activity, object}
   end
 
+  defp ingest_fixture!(rel_path) do
+    rel_path
+    |> File.read!()
+    |> Jason.decode!()
+    |> ingest_data!()
+  end
+
   test "ingests Emoji tag with string icon" do
     {_activity, object} = ingest_fixture!("test/fixtures/fedidev.fun/emoji_icon_string.json")
     assert object.data["emoji"]["cow"] == "https://fedidev.fun/static/cow.png"
@@ -62,4 +68,36 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunEmojiTest do
     {_activity, object} = ingest_fixture!("test/fixtures/fedidev.fun/emoji_missing_icon.json")
     assert object.data["emoji"] == %{}
   end
+
+  test "ignores Emoji tag missing a string name" do
+    data = File.read!("test/fixtures/fedidev.fun/emoji_icon_string.json") |> Jason.decode!()
+    data = put_in(data, ["object", "tag", Access.at(0), "name"], nil)
+
+    {_activity, object} = ingest_data!(data)
+
+    assert object.data["emoji"] == %{}
+  end
+
+  test "ignores Emoji tag with a non-http icon" do
+    data = File.read!("test/fixtures/fedidev.fun/emoji_icon_string.json") |> Jason.decode!()
+    data = put_in(data, ["object", "tag", Access.at(0), "icon"], "file:///tmp/cow.png")
+
+    {_activity, object} = ingest_data!(data)
+
+    assert object.data["emoji"] == %{}
+  end
+
+  test "normalizes a list-typed Emoji tag before building the emoji map" do
+    data = File.read!("test/fixtures/fedidev.fun/emoji_icon_string.json") |> Jason.decode!()
+
+    data =
+      put_in(data, ["object", "tag", Access.at(0), "type"], [
+        "https://example.com/ns#CustomTag",
+        "Emoji"
+      ])
+
+    {_activity, object} = ingest_data!(data)
+
+    assert object.data["emoji"]["cow"] == "https://fedidev.fun/static/cow.png"
+  end
 end
diff --git a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_object_type_list_test.exs b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_object_type_list_test.exs
index 619e6f477..b169dc181 100644
--- a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_object_type_list_test.exs
+++ b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_object_type_list_test.exs
@@ -50,4 +50,15 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunObjectTypeListTest do
     {_activity, object} = ingest_fixture!("test/fixtures/fedidev.fun/object_type_list.json")
     assert object.data["type"] == "Note"
   end
+
+  test "selects a supported type after an extension type" do
+    data = File.read!("test/fixtures/fedidev.fun/object_type_list.json") |> Jason.decode!()
+    data = put_in(data, ["object", "type"], ["https://example.com/ns#CustomType", "Note"])
+    ensure_remote_actor!(data["actor"])
+
+    assert {:ok, activity} = Transmogrifier.handle_incoming(data)
+    object = Object.normalize(activity.data["object"], fetch: false)
+
+    assert object.data["type"] == "Note"
+  end
 end
diff --git a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_tag_inference_test.exs b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_tag_inference_test.exs
index ef7feb8ad..0650dd38c 100644
--- a/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_tag_inference_test.exs
+++ b/test/pleroma/web/activity_pub/transmogrifier/fedidev_fun_tag_inference_test.exs
@@ -62,4 +62,51 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.FedidevFunTagInferenceTest do
              _ -> false
            end)
   end
+
+  test "normalizes a list-typed tag type" do
+    data =
+      File.read!("test/fixtures/fedidev.fun/tag_hashtag_missing_type.json") |> Jason.decode!()
+
+    data = put_in(data, ["object", "tag", Access.at(0), "type"], ["Hashtag"])
+    ensure_remote_actor!(data["actor"])
+
+    assert {:ok, activity} = Transmogrifier.handle_incoming(data)
+    object = Object.normalize(activity.data["object"], fetch: false)
+
+    assert "test" in Object.hashtags(object)
+  end
+
+  test "ignores a list-typed Hashtag without a string name" do
+    data =
+      File.read!("test/fixtures/fedidev.fun/tag_hashtag_missing_type.json") |> Jason.decode!()
+
+    data = put_in(data, ["object", "tag", Access.at(0), "type"], ["Hashtag"])
+    data = put_in(data, ["object", "tag", Access.at(0), "name"], nil)
+    ensure_remote_actor!(data["actor"])
+
+    assert {:ok, activity} = Transmogrifier.handle_incoming(data)
+    object = Object.normalize(activity.data["object"], fetch: false)
+
+    assert Object.hashtags(object) == []
+  end
+
+  test "infers a Link before deriving quoteUrl" do
+    data =
+      File.read!("test/fixtures/fedidev.fun/tag_hashtag_missing_type.json") |> Jason.decode!()
+
+    data =
+      put_in(data, ["object", "tag"], [
+        %{
+          "href" => "https://fedidev.fun/assets/note1.jsonap",
+          "mediaType" => "application/activity+json"
+        }
+      ])
+
+    ensure_remote_actor!(data["actor"])
+
+    assert {:ok, activity} = Transmogrifier.handle_incoming(data)
+    object = Object.normalize(activity.data["object"], fetch: false)
+
+    assert object.data["quoteUrl"] == "https://fedidev.fun/assets/note1.jsonap"
+  end
 end
diff --git a/test/pleroma/web/activity_pub/transmogrifier/note_handling_test.exs b/test/pleroma/web/activity_pub/transmogrifier/note_handling_test.exs
index 4cc199550..793293abd 100644
--- a/test/pleroma/web/activity_pub/transmogrifier/note_handling_test.exs
+++ b/test/pleroma/web/activity_pub/transmogrifier/note_handling_test.exs
@@ -671,13 +671,21 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.NoteHandlingTest do
     test "returns object with emoji when object contains list tags" do
       assert Transmogrifier.fix_emoji(%{
                "tag" => [
-                 %{"type" => "Emoji", "name" => ":bib:", "icon" => %{"url" => "/test"}},
+                 %{
+                   "type" => "Emoji",
+                   "name" => ":bib:",
+                   "icon" => %{"url" => "https://example.com/test"}
+                 },
                  %{"type" => "Hashtag"}
                ]
              }) == %{
-               "emoji" => %{"bib" => "/test"},
+               "emoji" => %{"bib" => "https://example.com/test"},
                "tag" => [
-                 %{"icon" => %{"url" => "/test"}, "name" => ":bib:", "type" => "Emoji"},
+                 %{
+                   "icon" => %{"url" => "https://example.com/test"},
+                   "name" => ":bib:",
+                   "type" => "Emoji"
+                 },
                  %{"type" => "Hashtag"}
                ]
              }
@@ -685,10 +693,28 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.NoteHandlingTest do
 
     test "returns object with emoji when object contains map tag" do
       assert Transmogrifier.fix_emoji(%{
-               "tag" => %{"type" => "Emoji", "name" => ":bib:", "icon" => %{"url" => "/test"}}
+               "tag" => %{
+                 "type" => "Emoji",
+                 "name" => ":bib:",
+                 "icon" => %{"url" => "https://example.com/test"}
+               }
              }) == %{
-               "emoji" => %{"bib" => "/test"},
-               "tag" => %{"icon" => %{"url" => "/test"}, "name" => ":bib:", "type" => "Emoji"}
+               "emoji" => %{"bib" => "https://example.com/test"},
+               "tag" => %{
+                 "icon" => %{"url" => "https://example.com/test"},
+                 "name" => ":bib:",
+                 "type" => "Emoji"
+               }
+             }
+    end
+  end
+
+  describe "fix_tag/1" do
+    test "ignores malformed Hashtag names and tag entries" do
+      tag = %{"type" => "Hashtag", "name" => 123}
+
+      assert Transmogrifier.fix_tag(%{"tag" => [tag, "malformed"]}) == %{
+               "tag" => [tag, "malformed"]
              }
     end
   end
diff --git a/test/pleroma/web/activity_pub/transmogrifier/user_update_handling_test.exs b/test/pleroma/web/activity_pub/transmogrifier/user_update_handling_test.exs
index 851c60850..cf995e143 100644
--- a/test/pleroma/web/activity_pub/transmogrifier/user_update_handling_test.exs
+++ b/test/pleroma/web/activity_pub/transmogrifier/user_update_handling_test.exs
@@ -50,6 +50,25 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.UserUpdateHandlingTest do
     assert user.bio == "<p>Some bio</p>"
   end
 
+  test "it selects an actor type after an extension type" do
+    user = insert(:user, local: false)
+    update_data = File.read!("test/fixtures/mastodon-update.json") |> Jason.decode!()
+
+    object =
+      update_data["object"]
+      |> Map.put("actor", user.ap_id)
+      |> Map.put("id", user.ap_id)
+      |> Map.put("type", ["https://example.com/ns#CustomActor", "Person"])
+
+    update_data =
+      update_data
+      |> Map.put("actor", user.ap_id)
+      |> Map.put("object", object)
+
+    assert {:ok, %Activity{local: false}} = Transmogrifier.handle_incoming(update_data)
+    assert User.get_cached_by_ap_id(user.ap_id).name == "gargle"
+  end
+
   test "it works with alsoKnownAs" do
     %{ap_id: actor} = insert(:user, local: false)