Merge branch 'develop' into paradedb-search-backend

test/mix/tasks/pleroma/config_test.exs

@@ -144,7 +144,13 @@ defmodule Mix.Tasks.Pleroma.ConfigTest do
           quarantined_instances: [],
           managed_config: true,
           static_dir: "instance/static/",
-          allowed_post_formats: ["text/plain", "text/html", "text/markdown", "text/bbcode"],
+          allowed_post_formats: [
+            "text/plain",
+            "text/html",
+            "text/markdown",
+            "text/bbcode",
+            "text/x.misskeymarkdown"
+          ],
           autofollowed_nicknames: [],
           max_pinned_statuses: 1,
           attachment_links: false,

test/pleroma/pleroma_ctl_test.exs

@@ -0,0 +1,293 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.PleromaCtlTest do
+  use ExUnit.Case, async: false
+
+  @pleroma_ctl Path.expand("../../rel/files/bin/pleroma_ctl", __DIR__)
+
+  setup do
+    tmp_dir =
+      Path.join(System.tmp_dir!(), "pleroma_ctl_test_#{System.unique_integer([:positive])}")
+
+    release_root = Path.join(tmp_dir, "release")
+    bin_dir = Path.join(release_root, "bin")
+
+    File.mkdir_p!(bin_dir)
+    File.cp!(@pleroma_ctl, Path.join(bin_dir, "pleroma_ctl"))
+    File.chmod!(Path.join(bin_dir, "pleroma_ctl"), 0o755)
+
+    on_exit(fn -> File.rm_rf!(tmp_dir) end)
+
+    {:ok, tmp_dir: tmp_dir, release_root: release_root, bin_dir: bin_dir}
+  end
+
+  test "update downloads branch-scoped latest OTP package", %{
+    tmp_dir: tmp_dir,
+    bin_dir: bin_dir,
+    release_root: release_root
+  } do
+    stubs_dir = Path.join(tmp_dir, "stubs")
+    curl_args_path = Path.join(tmp_dir, "curl.args")
+    File.mkdir_p!(stubs_dir)
+    write_update_stubs(stubs_dir, curl_args_path, "unused", "glibc")
+
+    update_tmp_dir = Path.join(tmp_dir, "update_tmp")
+    File.mkdir_p!(update_tmp_dir)
+
+    {output, status} =
+      System.cmd(
+        Path.join(bin_dir, "pleroma_ctl"),
+        [
+          "update",
+          "--branch",
+          "develop",
+          "--flavour",
+          "amd64",
+          "--tmp-dir",
+          update_tmp_dir,
+          "--no-rm"
+        ],
+        env: [{"PATH", stubs_dir <> ":" <> System.get_env("PATH", "")}],
+        stderr_to_stdout: true
+      )
+
+    assert status == 0, output
+    assert File.exists?(Path.join(release_root, "bin/marker"))
+
+    assert ["-fL", url, "-o", artifact_path] =
+             curl_args_path
+             |> File.read!()
+             |> String.split("\n", trim: true)
+
+    assert url ==
+             "https://git.pleroma.social/api/packages/pleroma/generic/pleroma-otp-develop-amd64/latest/pleroma.zip"
+
+    assert artifact_path == Path.join(update_tmp_dir, "pleroma.zip")
+  end
+
+  test "update detects stable branch and local flavour", %{
+    tmp_dir: tmp_dir,
+    bin_dir: bin_dir,
+    release_root: release_root
+  } do
+    stubs_dir = Path.join(tmp_dir, "stubs")
+    curl_args_path = Path.join(tmp_dir, "curl.args")
+    File.mkdir_p!(stubs_dir)
+    write_update_stubs(stubs_dir, curl_args_path, "x86_64", "glibc")
+    write_start_erl_data(release_root, "2.10.0")
+
+    {output, status} =
+      System.cmd(
+        Path.join(bin_dir, "pleroma_ctl"),
+        ["update", "--tmp-dir", create_update_tmp_dir(tmp_dir), "--no-rm"],
+        env: [{"PATH", stubs_dir <> ":" <> System.get_env("PATH", "")}],
+        stderr_to_stdout: true
+      )
+
+    assert status == 0, output
+
+    assert curl_url(curl_args_path) ==
+             "https://git.pleroma.social/api/packages/pleroma/generic/pleroma-otp-stable-amd64/latest/pleroma.zip"
+  end
+
+  test "update detects develop branch and musl arm flavour", %{
+    tmp_dir: tmp_dir,
+    bin_dir: bin_dir,
+    release_root: release_root
+  } do
+    stubs_dir = Path.join(tmp_dir, "stubs")
+    curl_args_path = Path.join(tmp_dir, "curl.args")
+    File.mkdir_p!(stubs_dir)
+    write_update_stubs(stubs_dir, curl_args_path, "armv7l", "musl")
+    write_start_erl_data(release_root, "2.10.0.develop")
+
+    {output, status} =
+      System.cmd(
+        Path.join(bin_dir, "pleroma_ctl"),
+        ["update", "--tmp-dir", create_update_tmp_dir(tmp_dir), "--no-rm"],
+        env: [{"PATH", stubs_dir <> ":" <> System.get_env("PATH", "")}],
+        stderr_to_stdout: true
+      )
+
+    assert status == 0, output
+
+    assert curl_url(curl_args_path) ==
+             "https://git.pleroma.social/api/packages/pleroma/generic/pleroma-otp-develop-arm-musl/latest/pleroma.zip"
+  end
+
+  test "update with zip URL bypasses branch and flavour detection", %{
+    tmp_dir: tmp_dir,
+    bin_dir: bin_dir,
+    release_root: release_root
+  } do
+    stubs_dir = Path.join(tmp_dir, "stubs")
+    curl_args_path = Path.join(tmp_dir, "curl.args")
+    File.mkdir_p!(stubs_dir)
+    write_update_stubs(stubs_dir, curl_args_path, "unsupported-arch", "unsupported-libc")
+    write_start_erl_data(release_root, "2.10.0.custombranch")
+
+    custom_url = "https://example.test/custom.zip"
+
+    {output, status} =
+      System.cmd(
+        Path.join(bin_dir, "pleroma_ctl"),
+        [
+          "update",
+          "--zip-url",
+          custom_url,
+          "--tmp-dir",
+          create_update_tmp_dir(tmp_dir),
+          "--no-rm"
+        ],
+        env: [{"PATH", stubs_dir <> ":" <> System.get_env("PATH", "")}],
+        stderr_to_stdout: true
+      )
+
+    assert status == 0, output
+    assert curl_url(curl_args_path) == custom_url
+  end
+
+  test "passes arguments with spaces and Elixir string metacharacters", %{
+    tmp_dir: tmp_dir,
+    bin_dir: bin_dir
+  } do
+    capture_path = Path.join(tmp_dir, "captured_args")
+    eval_path = Path.join(tmp_dir, "pleroma_ctl_eval.exs")
+
+    write_executable(Path.join(bin_dir, "pleroma"), """
+    #!/bin/sh
+    {
+      printf '%s\n' 'defmodule Pleroma.ReleaseTasks do'
+      printf '%s\n' '  def run(args), do: File.write!(System.fetch_env!("PLEROMA_CTL_CAPTURE"), :erlang.term_to_binary(args))'
+      printf '%s\n' 'end'
+      printf '%s\n' "$2"
+    } > "$PLEROMA_CTL_EVAL_FILE"
+
+    exec elixir "$PLEROMA_CTL_EVAL_FILE"
+    """)
+
+    {output, status} =
+      System.cmd(
+        Path.join(bin_dir, "pleroma_ctl"),
+        [
+          "user",
+          "",
+          "has space",
+          ~s(has "quote"),
+          ~s(has \\ backslash),
+          ~S(#{:not_interpolated})
+        ],
+        env: [
+          {"PLEROMA_CTL_CAPTURE", capture_path},
+          {"PLEROMA_CTL_EVAL_FILE", eval_path}
+        ],
+        stderr_to_stdout: true
+      )
+
+    assert status == 0, output
+
+    assert capture_path
+           |> File.read!()
+           |> :erlang.binary_to_term() == [
+             "user",
+             "",
+             "has space",
+             ~s(has "quote"),
+             ~s(has \\ backslash),
+             ~S(#{:not_interpolated})
+           ]
+  end
+
+  defp write_executable(path, contents) do
+    File.write!(path, contents)
+    File.chmod!(path, 0o755)
+  end
+
+  defp write_start_erl_data(release_root, version) do
+    releases_dir = Path.join(release_root, "releases")
+    File.mkdir_p!(releases_dir)
+    File.write!(Path.join(releases_dir, "start_erl.data"), "erts-15.0 #{version}\n")
+  end
+
+  defp create_update_tmp_dir(tmp_dir) do
+    update_tmp_dir = Path.join(tmp_dir, "update_tmp")
+    File.mkdir_p!(update_tmp_dir)
+    update_tmp_dir
+  end
+
+  defp write_update_stubs(stubs_dir, curl_args_path, arch, libc) do
+    write_executable(Path.join(stubs_dir, "curl"), """
+    #!/bin/sh
+    printf '%s\n' "$@" > "#{curl_args_path}"
+
+    while [ $# -gt 0 ]; do
+      case "$1" in
+        -o)
+          artifact="$2"
+          shift 2
+          ;;
+        *)
+          shift
+          ;;
+      esac
+    done
+
+    : > "$artifact"
+    """)
+
+    write_executable(Path.join(stubs_dir, "unzip"), """
+    #!/bin/sh
+    while [ $# -gt 0 ]; do
+      case "$1" in
+        -d)
+          dest="$2"
+          shift 2
+          ;;
+        *)
+          shift
+          ;;
+      esac
+    done
+
+    mkdir -p "$dest/release/bin"
+    printf 'marker' > "$dest/release/bin/marker"
+    """)
+
+    write_executable(Path.join(stubs_dir, "uname"), """
+    #!/bin/sh
+    printf '%s\n' '#{arch}'
+    """)
+
+    write_executable(Path.join(stubs_dir, "getconf"), getconf_stub(libc))
+
+    write_executable(Path.join(stubs_dir, "ldd"), """
+    #!/bin/sh
+    printf '%s\n' 'musl libc (mock)'
+    """)
+  end
+
+  defp getconf_stub("glibc") do
+    """
+    #!/bin/sh
+    printf '%s\n' 'glibc 2.40'
+    """
+  end
+
+  defp getconf_stub(_libc) do
+    """
+    #!/bin/sh
+    exit 1
+    """
+  end
+
+  defp curl_url(curl_args_path) do
+    ["-fL", url, "-o", _artifact_path] =
+      curl_args_path
+      |> File.read!()
+      |> String.split("\n", trim: true)
+
+    url
+  end
+end

test/pleroma/signature_test.exs

@@ -11,6 +11,7 @@ defmodule Pleroma.SignatureTest do
   import Mock
 
   alias Pleroma.Signature
+  alias Pleroma.StubbedHTTPSignaturesMock, as: HTTPSignaturesMock
 
   setup do
     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
@@ -103,6 +104,18 @@ defmodule Pleroma.SignatureTest do
     end
   end
 
+  describe "validate_signature/1" do
+    test "treats HTTP signature errors as failed validation" do
+      conn = %Plug.Conn{method: "GET", request_path: "/inbox", req_headers: []}
+
+      Mox.expect(HTTPSignaturesMock, :validate_conn, fn _conn ->
+        {:error, :request_target_header}
+      end)
+
+      assert Signature.validate_signature(conn) == false
+    end
+  end
+
   describe "key_id_to_actor_id/1" do
     test "it properly deduces the actor id for misskey" do
       assert Signature.key_id_to_actor_id("https://example.com/users/1234/publickey") ==

test/pleroma/user/search_test.exs

@@ -0,0 +1,195 @@
+# Pleroma: A lightweight social networking server
+# Copyright © Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.User.SearchTest do
+  use Pleroma.DataCase, async: false
+
+  import Pleroma.Factory
+
+  alias Pleroma.Instances
+  alias Pleroma.Repo
+  alias Pleroma.User
+
+  describe "search/2 mention suggestions" do
+    test "prioritizes followed/follower users before others" do
+      user = insert(:user)
+
+      related =
+        insert(:user,
+          local: false,
+          nickname: "hj@real.example",
+          ap_id: "https://real.example/users/hj",
+          last_status_at: ~N[2020-01-01 00:00:00]
+        )
+
+      other = insert(:user, nickname: "hj", last_status_at: ~N[2020-01-02 00:00:00])
+
+      {:ok, _related, _user} = User.follow(related, user)
+
+      results = User.search("hj", for_user: user) |> Enum.map(& &1.id)
+
+      assert results == [related.id, other.id]
+    end
+
+    test "orders followed/follower users by most recent activity" do
+      user = insert(:user)
+
+      older =
+        insert(:user,
+          local: false,
+          nickname: "ali@remote.example",
+          ap_id: "https://remote.example/users/ali",
+          last_status_at: ~N[2020-01-01 00:00:00]
+        )
+
+      newer =
+        insert(:user,
+          local: false,
+          nickname: "alia@remote.example",
+          ap_id: "https://remote.example/users/alia",
+          last_status_at: ~N[2020-01-02 00:00:00]
+        )
+
+      {:ok, _user, _older} = User.follow(user, older)
+      {:ok, _user, _newer} = User.follow(user, newer)
+
+      assert [newer.id, older.id] ==
+               User.search("ali", for_user: user)
+               |> Enum.map(& &1.id)
+    end
+
+    test "groups followed/follower users first and sorts them by recency" do
+      user = insert(:user)
+
+      following_newest =
+        insert(:user,
+          local: false,
+          nickname: "mentiontesta@related.example",
+          ap_id: "https://related.example/users/mentiontesta",
+          last_status_at: ~N[2020-01-03 00:00:00]
+        )
+
+      follower_middle =
+        insert(:user,
+          local: false,
+          nickname: "mentiontestb@related.example",
+          ap_id: "https://related.example/users/mentiontestb",
+          last_status_at: ~N[2020-01-02 00:00:00]
+        )
+
+      mutual_oldest =
+        insert(:user,
+          local: false,
+          nickname: "mentiontestc@related.example",
+          ap_id: "https://related.example/users/mentiontestc",
+          last_status_at: ~N[2020-01-01 00:00:00]
+        )
+
+      unrelated_newer =
+        insert(:user,
+          local: false,
+          nickname: "mentiontestd@unrelated.example",
+          ap_id: "https://unrelated.example/users/mentiontestd",
+          last_status_at: ~N[2020-01-04 00:00:00]
+        )
+
+      {:ok, _user, _following_newest} = User.follow(user, following_newest)
+      {:ok, _follower_middle, _user} = User.follow(follower_middle, user)
+
+      {:ok, _user, _mutual_oldest} = User.follow(user, mutual_oldest)
+      {:ok, _mutual_oldest, _user} = User.follow(mutual_oldest, user)
+
+      results = User.search("mentiontest", for_user: user)
+
+      assert Enum.map(results, & &1.id) ==
+               [following_newest.id, follower_middle.id, mutual_oldest.id, unrelated_newer.id]
+    end
+
+    test "uses last_active_at when last_status_at is missing" do
+      user = insert(:user)
+
+      older =
+        insert(:user,
+          local: false,
+          nickname: "activefallbacka@remote.example",
+          ap_id: "https://remote.example/users/activefallbacka",
+          last_status_at: nil,
+          last_active_at: ~N[2020-01-01 00:00:00]
+        )
+
+      newer =
+        insert(:user,
+          local: false,
+          nickname: "activefallbackb@remote.example",
+          ap_id: "https://remote.example/users/activefallbackb",
+          last_status_at: nil,
+          last_active_at: ~N[2020-01-02 00:00:00]
+        )
+
+      {:ok, _user, _older} = User.follow(user, older)
+      {:ok, _user, _newer} = User.follow(user, newer)
+
+      assert [newer.id, older.id] ==
+               User.search("activefallback", for_user: user)
+               |> Enum.map(& &1.id)
+    end
+
+    test "does not return deactivated users even if related" do
+      user = insert(:user)
+
+      active =
+        insert(:user,
+          local: false,
+          nickname: "deactivatedtesta@remote.example",
+          ap_id: "https://remote.example/users/deactivatedtesta",
+          last_status_at: ~N[2020-01-02 00:00:00]
+        )
+
+      deactivated =
+        insert(:user,
+          local: false,
+          nickname: "deactivatedtestb@remote.example",
+          ap_id: "https://remote.example/users/deactivatedtestb",
+          last_status_at: ~N[2020-01-03 00:00:00]
+        )
+
+      {:ok, _user, _active} = User.follow(user, active)
+      {:ok, _user, _deactivated} = User.follow(user, deactivated)
+      Repo.update!(Ecto.Changeset.change(deactivated, is_active: false))
+
+      results = User.search("deactivatedtest", for_user: user) |> Enum.map(& &1.id)
+
+      assert results == [active.id]
+    end
+
+    test "does not return users from unreachable instances" do
+      user = insert(:user)
+
+      {:ok, _instance} = Instances.set_unreachable("dead.example")
+
+      dead =
+        insert(:user,
+          local: false,
+          nickname: "ali@dead.example",
+          ap_id: "https://dead.example/users/ali",
+          last_status_at: ~N[2020-01-02 00:00:00]
+        )
+
+      alive =
+        insert(:user,
+          local: false,
+          nickname: "ali@alive.example",
+          ap_id: "https://alive.example/users/ali",
+          last_status_at: ~N[2020-01-02 00:00:00]
+        )
+
+      {:ok, _user, _alive} = User.follow(user, alive)
+      {:ok, _user, _dead} = User.follow(user, dead)
+
+      results = User.search("ali", for_user: user) |> Enum.map(& &1.id)
+
+      assert results == [alive.id]
+    end
+  end
+end

test/pleroma/user_test.exs

@@ -876,17 +876,17 @@ defmodule Pleroma.UserTest do
   describe "get_or_fetch/1 remote users with tld, while BE is running on a subdomain" do
     setup do: clear_config([Pleroma.Web.WebFinger, :update_nickname_on_user_fetch], true)
 
-    test "for mastodon" do
-      ap_id = "a@mastodon.example"
-      {:ok, fetched_user} = User.get_or_fetch(ap_id)
+    test "fetches a mastodon split-domain nickname" do
+      nickname = "a@mastodon.example"
+      {:ok, fetched_user} = User.get_or_fetch(nickname)
 
       assert fetched_user.ap_id == "https://sub.mastodon.example/users/a"
       assert fetched_user.nickname == "a@mastodon.example"
     end
 
-    test "for pleroma" do
-      ap_id = "a@pleroma.example"
-      {:ok, fetched_user} = User.get_or_fetch(ap_id)
+    test "fetches a pleroma split-domain nickname" do
+      nickname = "a@pleroma.example"
+      {:ok, fetched_user} = User.get_or_fetch(nickname)
 
       assert fetched_user.ap_id == "https://sub.pleroma.example/users/a"
       assert fetched_user.nickname == "a@pleroma.example"
@@ -936,6 +936,89 @@ defmodule Pleroma.UserTest do
       assert fetched_user == "not found nonexistent"
     end
 
+    test "does not rename an existing remote actor from rogue WebFinger data" do
+      clear_config([Pleroma.Web.WebFinger, :update_nickname_on_user_fetch], true)
+
+      actor_id = "https://legit-actor.example/users/alice"
+
+      Tesla.Mock.mock(fn
+        %{url: "https://evil-webfinger.example/.well-known/host-meta"} ->
+          {:ok, %Tesla.Env{status: 404}}
+
+        %{
+          url:
+            "https://evil-webfinger.example/.well-known/webfinger?resource=acct:claimed@evil-webfinger.example"
+        } ->
+          Tesla.Mock.json(%{
+            "subject" => "acct:claimed@evil-webfinger.example",
+            "links" => [
+              %{
+                "rel" => "self",
+                "type" => "application/activity+json",
+                "href" => actor_id
+              }
+            ]
+          })
+
+        %{url: ^actor_id} ->
+          {:ok,
+           %Tesla.Env{
+             status: 200,
+             headers: [{"content-type", "application/activity+json"}],
+             body:
+               Jason.encode!(%{
+                 "id" => actor_id,
+                 "type" => "Person",
+                 "preferredUsername" => "alice",
+                 "name" => "Alice",
+                 "summary" => "",
+                 "inbox" => "https://legit-actor.example/users/alice/inbox",
+                 "outbox" => "https://legit-actor.example/users/alice/outbox",
+                 "followers" => "https://legit-actor.example/users/alice/followers",
+                 "following" => "https://legit-actor.example/users/alice/following"
+               })
+           }}
+
+        %{url: "https://legit-actor.example/.well-known/host-meta"} ->
+          {:ok, %Tesla.Env{status: 404}}
+
+        %{
+          url:
+            "https://legit-actor.example/.well-known/webfinger?resource=acct:alice@legit-actor.example"
+        } ->
+          Tesla.Mock.json(%{
+            "subject" => "acct:alice@legit-actor.example",
+            "links" => [
+              %{
+                "rel" => "self",
+                "type" => "application/activity+json",
+                "href" => actor_id
+              }
+            ]
+          })
+      end)
+
+      assert {:error, {:webfinger_actor_mismatch, "claimed@evil-webfinger.example", ^actor_id}} =
+               ActivityPub.make_user_from_nickname("claimed@evil-webfinger.example")
+
+      refute User.get_by_ap_id(actor_id)
+      refute User.get_by_nickname("claimed@evil-webfinger.example")
+
+      orig_user =
+        insert(:user,
+          local: false,
+          nickname: "alice@legit-actor.example",
+          ap_id: actor_id
+        )
+
+      assert {:error, {:webfinger_actor_mismatch, "claimed@evil-webfinger.example", ^actor_id}} =
+               ActivityPub.make_user_from_nickname("claimed@evil-webfinger.example")
+
+      assert {:error, _} = User.get_or_fetch_by_nickname("claimed@evil-webfinger.example")
+      assert User.get_by_id(orig_user.id).nickname == "alice@legit-actor.example"
+      refute User.get_by_nickname("claimed@evil-webfinger.example")
+    end
+
     test "updates an existing user, if stale" do
       a_week_ago = NaiveDateTime.add(NaiveDateTime.utc_now(), -604_800)
 

test/pleroma/web/activity_pub/activity_pub_controller_test.exs

@@ -19,6 +19,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
   alias Pleroma.Web.CommonAPI
   alias Pleroma.Web.Endpoint
   alias Pleroma.Workers.ReceiverWorker
+  alias Pleroma.Workers.SignatureRetryWorker
 
   import Pleroma.Factory
 
@@ -36,6 +37,36 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
   setup do: clear_config([:instance, :federating], true)
 
+  defp assign_valid_signature_for_actor(conn, %User{ap_id: actor_id}) do
+    assign_valid_signature_for_actor(conn, actor_id)
+  end
+
+  defp assign_valid_signature_for_actor(conn, actor) do
+    actor_id = Utils.get_ap_id(actor)
+
+    conn
+    |> assign(:valid_signature, true)
+    |> put_req_header("signature", "keyId=\"#{actor_id}#main-key\"")
+  end
+
+  defp expect_signature_retry_from(%User{} = signer) do
+    signer_json = UserView.render("user.json", %{user: signer}) |> Map.delete("featured")
+
+    Tesla.Mock.mock(fn
+      %{url: url} when url == signer.ap_id ->
+        %Tesla.Env{
+          status: 200,
+          body: Jason.encode!(signer_json),
+          headers: HttpRequestMock.activitypub_object_headers()
+        }
+
+      env ->
+        apply(HttpRequestMock, :request, [env])
+    end)
+
+    Mox.expect(Pleroma.StubbedHTTPSignaturesMock, :validate_conn, fn _conn -> true end)
+  end
+
   describe "/relay" do
     setup do: clear_config([:instance, :allow_relay])
 
@@ -688,7 +719,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       conn =
         conn
-        |> assign(:valid_signature, true)
+        |> assign_valid_signature_for_actor(data["actor"])
         |> put_req_header("content-type", "application/activity+json")
         |> post("/inbox", data)
 
@@ -716,7 +747,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       conn =
         conn
-        |> assign(:valid_signature, true)
+        |> assign_valid_signature_for_actor(data["actor"])
         |> put_req_header("content-type", "application/activity+json")
         |> post("/inbox", data)
 
@@ -726,6 +757,199 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
       assert Activity.get_by_ap_id(data["id"])
     end
 
+    test "does not create a forged post after failed signature retry", %{conn: conn} do
+      alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+      bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+      object_id = "https://two.com/objects/inbox-forged-note"
+
+      data = %{
+        "type" => "Create",
+        "actor" => bob.ap_id,
+        "id" => "https://two.com/activities/inbox-forged-create",
+        "context" => "https://two.com/contexts/inbox-forged-create",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => [],
+        "object" => %{
+          "type" => "Note",
+          "id" => object_id,
+          "actor" => bob.ap_id,
+          "attributedTo" => bob.ap_id,
+          "context" => "https://two.com/contexts/inbox-forged-create",
+          "content" => "forged post",
+          "published" => "2024-07-25T13:33:31Z",
+          "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+          "cc" => []
+        }
+      }
+
+      expect_signature_retry_from(alice)
+
+      conn =
+        conn
+        |> assign(:valid_signature, false)
+        |> put_req_header("content-type", "application/activity+json")
+        |> put_req_header("signature", "keyId=\"https://one.com/users/alice#main-key\"")
+        |> post("/inbox", data)
+
+      assert "ok" == json_response(conn, 200)
+
+      assert [{:cancel, :actor_signature_mismatch}] =
+               ObanHelpers.perform(all_enqueued(worker: SignatureRetryWorker))
+
+      refute Activity.get_by_ap_id(data["id"])
+      refute Object.get_by_ap_id(object_id)
+    end
+
+    test "does not create a forged like after failed signature retry", %{conn: conn} do
+      alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+      bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+      note = insert(:note)
+
+      data = %{
+        "type" => "Like",
+        "actor" => bob.ap_id,
+        "id" => "https://two.com/activities/inbox-forged-like",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => [],
+        "object" => note.data["id"]
+      }
+
+      expect_signature_retry_from(alice)
+
+      conn =
+        conn
+        |> assign(:valid_signature, false)
+        |> put_req_header("content-type", "application/activity+json")
+        |> put_req_header("signature", "keyId=\"https://one.com/users/alice#main-key\"")
+        |> post("/inbox", data)
+
+      assert "ok" == json_response(conn, 200)
+
+      assert [{:cancel, :actor_signature_mismatch}] =
+               ObanHelpers.perform(all_enqueued(worker: SignatureRetryWorker))
+
+      refute Activity.get_by_ap_id(data["id"])
+    end
+
+    test "does not delete an object after failed signature retry", %{conn: conn} do
+      alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+      bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+      note = insert(:note)
+      object_id = note.data["id"]
+
+      data = %{
+        "type" => "Delete",
+        "actor" => bob.ap_id,
+        "id" => "https://two.com/activities/inbox-forged-delete",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => [],
+        "object" => object_id
+      }
+
+      expect_signature_retry_from(alice)
+
+      conn =
+        conn
+        |> assign(:valid_signature, false)
+        |> put_req_header("content-type", "application/activity+json")
+        |> put_req_header("signature", "keyId=\"https://one.com/users/alice#main-key\"")
+        |> post("/inbox", data)
+
+      assert "ok" == json_response(conn, 200)
+
+      assert [{:cancel, :actor_signature_mismatch}] =
+               ObanHelpers.perform(all_enqueued(worker: SignatureRetryWorker))
+
+      refute Activity.get_by_ap_id(data["id"])
+      assert %Object{data: %{"type" => "Note"}} = Object.get_by_ap_id(object_id)
+    end
+
+    test "does not create a forged post signed by a different actor", %{conn: conn} do
+      alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+      bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+      object_id = "https://two.com/objects/inbox-signed-forged-note"
+
+      data = %{
+        "@context" => "https://www.w3.org/ns/activitystreams",
+        "type" => "Create",
+        "actor" => bob.ap_id,
+        "id" => "https://two.com/activities/inbox-signed-forged-create",
+        "context" => "https://two.com/contexts/inbox-signed-forged-create",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => [],
+        "object" => %{
+          "type" => "Note",
+          "id" => object_id,
+          "actor" => bob.ap_id,
+          "attributedTo" => bob.ap_id,
+          "context" => "https://two.com/contexts/inbox-signed-forged-create",
+          "content" => "forged post",
+          "published" => "2024-07-25T13:33:31Z",
+          "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+          "cc" => []
+        }
+      }
+
+      expect_signature_retry_from(alice)
+
+      conn =
+        conn
+        |> put_req_header("content-type", "application/activity+json")
+        |> put_req_header("date", "Thu, 25 Jul 2024 13:33:31 GMT")
+        |> put_req_header("digest", "SHA-256=fake-digest")
+        |> put_req_header(
+          "signature",
+          "keyId=\"#{alice.ap_id}#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) host date digest content-type\",signature=\"fake-signature\""
+        )
+        |> post("/inbox", data)
+
+      assert conn.assigns.valid_signature == false
+      assert "ok" == json_response(conn, 200)
+
+      assert [{:cancel, :actor_signature_mismatch}] =
+               ObanHelpers.perform(all_enqueued(worker: SignatureRetryWorker))
+
+      refute Activity.get_by_ap_id(data["id"])
+      refute Object.get_by_ap_id(object_id)
+    end
+
+    test "does not create a forged like signed by a different actor", %{conn: conn} do
+      alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+      bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+      note = insert(:note)
+
+      data = %{
+        "@context" => "https://www.w3.org/ns/activitystreams",
+        "type" => "Like",
+        "actor" => bob.ap_id,
+        "id" => "https://two.com/activities/inbox-signed-forged-like",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => [],
+        "object" => note.data["id"]
+      }
+
+      expect_signature_retry_from(alice)
+
+      conn =
+        conn
+        |> put_req_header("content-type", "application/activity+json")
+        |> put_req_header("date", "Thu, 25 Jul 2024 13:33:31 GMT")
+        |> put_req_header("digest", "SHA-256=fake-digest")
+        |> put_req_header(
+          "signature",
+          "keyId=\"#{alice.ap_id}#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) host date digest content-type\",signature=\"fake-signature\""
+        )
+        |> post("/inbox", data)
+
+      assert conn.assigns.valid_signature == false
+      assert "ok" == json_response(conn, 200)
+
+      assert [{:cancel, :actor_signature_mismatch}] =
+               ObanHelpers.perform(all_enqueued(worker: SignatureRetryWorker))
+
+      refute Activity.get_by_ap_id(data["id"])
+    end
+
     test "accept follow activity", %{conn: conn} do
       clear_config([:instance, :federating], true)
       relay = Relay.get_actor()
@@ -742,7 +966,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       assert "ok" ==
                conn
-               |> assign(:valid_signature, true)
+               |> assign_valid_signature_for_actor(followed_relay)
                |> put_req_header("content-type", "application/activity+json")
                |> post("/inbox", accept)
                |> json_response(200)
@@ -822,16 +1046,19 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
     test "Unknown activity types are discarded", %{conn: conn} do
       unknown_types = ["Poke", "Read", "Dazzle"]
 
+      actor =
+        insert(:user, local: false, ap_id: "https://unknown.mastodon.instance/users/somebody")
+
       Enum.each(unknown_types, fn bad_type ->
         params =
           %{
             "type" => bad_type,
-            "actor" => "https://unknown.mastodon.instance/users/somebody"
+            "actor" => actor.ap_id
           }
           |> Jason.encode!()
 
         conn
-        |> assign(:valid_signature, true)
+        |> assign_valid_signature_for_actor(actor)
         |> put_req_header("content-type", "application/activity+json")
         |> post("/inbox", params)
         |> json_response(400)
@@ -900,7 +1127,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       assert "ok" ==
                conn
-               |> assign(:valid_signature, true)
+               |> assign_valid_signature_for_actor(data["actor"])
                |> put_req_header("content-type", "application/activity+json")
                |> post("/inbox", data)
                |> json_response(200)
@@ -921,7 +1148,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       assert "ok" ==
                conn
-               |> assign(:valid_signature, true)
+               |> assign_valid_signature_for_actor(data["actor"])
                |> put_req_header("content-type", "application/activity+json")
                |> post("/inbox", data)
                |> json_response(200)
@@ -990,7 +1217,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       assert "ok" ==
                conn
-               |> assign(:valid_signature, true)
+               |> assign_valid_signature_for_actor(data["actor"])
                |> put_req_header("content-type", "application/activity+json")
                |> post("/inbox", data)
                |> json_response(200)
@@ -1009,7 +1236,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       assert "ok" ==
                conn
-               |> assign(:valid_signature, true)
+               |> assign_valid_signature_for_actor(data["actor"])
                |> put_req_header("content-type", "application/activity+json")
                |> post("/inbox", data)
                |> json_response(200)
@@ -1040,7 +1267,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       conn =
         conn
-        |> assign(:valid_signature, true)
+        |> assign_valid_signature_for_actor(data["actor"])
         |> put_req_header("content-type", "application/activity+json")
         |> post("/users/#{user.nickname}/inbox", data)
 
@@ -1061,7 +1288,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       conn =
         conn
-        |> assign(:valid_signature, true)
+        |> assign_valid_signature_for_actor(data["actor"])
         |> put_req_header("content-type", "application/activity+json")
         |> post("/users/#{user.nickname}/inbox", data)
 
@@ -1082,7 +1309,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       conn =
         conn
-        |> assign(:valid_signature, true)
+        |> assign_valid_signature_for_actor(data["actor"])
         |> put_req_header("content-type", "application/activity+json")
         |> post("/users/#{user.nickname}/inbox", data)
 
@@ -1106,7 +1333,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       conn =
         conn
-        |> assign(:valid_signature, true)
+        |> assign_valid_signature_for_actor(data["actor"])
         |> put_req_header("content-type", "application/activity+json")
         |> post("/users/#{user.nickname}/inbox", data)
 
@@ -1133,7 +1360,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       conn =
         conn
-        |> assign(:valid_signature, true)
+        |> assign_valid_signature_for_actor(data["actor"])
         |> put_req_header("content-type", "application/activity+json")
         |> post("/users/#{user.nickname}/inbox", data)
 
@@ -1163,7 +1390,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       conn =
         conn
-        |> assign(:valid_signature, true)
+        |> assign_valid_signature_for_actor(data["actor"])
         |> put_req_header("content-type", "application/activity+json")
         |> post("/users/#{recipient.nickname}/inbox", data)
 
@@ -1228,7 +1455,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
       }
 
       conn
-      |> assign(:valid_signature, true)
+      |> assign_valid_signature_for_actor(data["actor"])
       |> put_req_header("content-type", "application/activity+json")
       |> post("/users/#{recipient.nickname}/inbox", data)
       |> json_response(200)
@@ -1318,7 +1545,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
       }
 
       conn
-      |> assign(:valid_signature, true)
+      |> assign_valid_signature_for_actor(data["actor"])
       |> put_req_header("content-type", "application/activity+json")
       |> post("/users/#{reported_user.nickname}/inbox", data)
       |> json_response(200)
@@ -1372,7 +1599,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
       }
 
       conn
-      |> assign(:valid_signature, true)
+      |> assign_valid_signature_for_actor(data["actor"])
       |> put_req_header("content-type", "application/activity+json")
       |> post("/users/#{reported_user.nickname}/inbox", data)
       |> json_response(200)
@@ -1405,7 +1632,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       conn =
         conn
-        |> assign(:valid_signature, true)
+        |> assign_valid_signature_for_actor(data["actor"])
         |> put_req_header("content-type", "application/activity+json")
         |> post("/users/#{user.nickname}/inbox", data)
 
@@ -1428,7 +1655,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       conn =
         conn
-        |> assign(:valid_signature, true)
+        |> assign_valid_signature_for_actor(data["actor"])
         |> put_req_header("content-type", "application/activity+json")
         |> post("/users/#{user.nickname}/inbox", data)
 
@@ -1451,7 +1678,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
 
       conn =
         conn
-        |> assign(:valid_signature, true)
+        |> assign_valid_signature_for_actor(data["actor"])
         |> put_req_header("content-type", "application/activity+json")
         |> post("/users/#{user.nickname}/inbox", data)
 
@@ -2571,6 +2798,8 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
     setup do: clear_config([:media_proxy])
     setup do: clear_config([Pleroma.Upload])
 
+    # majic's libmagic port is unavailable on local Darwin runs; Linux CI still runs this test.
+    @tag :skip_darwin
     test "POST /api/ap/upload_media", %{conn: conn} do
       user = insert(:user)
 

test/pleroma/web/activity_pub/mrf_test.exs

@@ -10,7 +10,7 @@ defmodule Pleroma.Web.ActivityPub.MRFTest do
 
   alias Pleroma.Web.ActivityPub.MRF
 
-  defp regexes_match!([],[]), do: true
+  defp regexes_match!([], []), do: true
 
   defp regexes_match!([authority | authority_rest], [checked | checked_rest]) do
     authority.source == checked.source and regexes_match!(authority_rest, checked_rest)

test/pleroma/web/activity_pub/object_validators/article_note_page_validator_test.exs

@@ -149,6 +149,171 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.ArticleNotePageValidatorTest
     %{valid?: true} = ArticleNotePageValidator.cast_and_validate(note)
   end
 
+  test "a Misskey MFM note is rendered from source content" do
+    user = insert(:user, ap_id: "https://misskey.example/users/alice")
+
+    note = %{
+      "id" => "https://misskey.example/notes/1",
+      "type" => "Note",
+      "actor" => user.ap_id,
+      "attributedTo" => user.ap_id,
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "content" => "original content",
+      "context" => Utils.generate_context_id(),
+      "source" => %{
+        "content" => "$[spin.speed=1s mfm goes here] <script>alert('xss')</script>",
+        "mediaType" => "text/x.misskeymarkdown"
+      }
+    }
+
+    %{valid?: true, changes: %{content: content, source: source}} =
+      ArticleNotePageValidator.cast_and_validate(note)
+
+    assert source["mediaType"] == "text/x.misskeymarkdown"
+    assert content =~ ~s(class="mfm-spin")
+    assert content =~ ~s(data-mfm-speed="1s")
+    assert content =~ "mfm goes here"
+    refute content =~ "original content"
+    refute content =~ "<script"
+  end
+
+  test "a Misskey MFM note resolves only cached AP mention tags" do
+    remote_user = insert(:user, ap_id: "https://misskey.example/users/carol")
+    local_user = insert(:user, nickname: "local_user")
+
+    note = %{
+      "id" => "https://misskey.example/notes/3",
+      "type" => "Note",
+      "actor" => remote_user.ap_id,
+      "attributedTo" => remote_user.ap_id,
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "content" => "original content",
+      "context" => Utils.generate_context_id(),
+      "tag" => [
+        %{
+          "type" => "Mention",
+          "name" => "@local_user",
+          "href" => local_user.ap_id
+        },
+        %{
+          "type" => "Mention",
+          "name" => "@uncached",
+          "href" => "https://misskey.example/users/uncached"
+        }
+      ],
+      "source" => %{
+        "content" => "@local_user @uncached $[spin hello]",
+        "mediaType" => "text/x.misskeymarkdown"
+      }
+    }
+
+    %{valid?: true, changes: %{content: content}} =
+      ArticleNotePageValidator.cast_and_validate(note)
+
+    assert content =~ local_user.ap_id
+    assert content =~ "@uncached"
+  end
+
+  test "a Misskey MFM note drops oversized source content instead of parsing it" do
+    user = insert(:user, ap_id: "https://misskey.example/users/oversized")
+
+    note = %{
+      "id" => "https://misskey.example/notes/4",
+      "type" => "Note",
+      "actor" => user.ap_id,
+      "attributedTo" => user.ap_id,
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "content" => "<span class=\"mfm-spin\">safe fallback</span>",
+      "context" => Utils.generate_context_id(),
+      "source" => %{
+        "content" => String.duplicate("x", 5_001),
+        "mediaType" => "text/x.misskeymarkdown"
+      }
+    }
+
+    %{valid?: true, changes: %{content: content, source: source}} =
+      ArticleNotePageValidator.cast_and_validate(note)
+
+    assert content == "<span class=\"mfm-spin\">safe fallback</span>"
+    refute Map.has_key?(source, "content")
+  end
+
+  test "a note drops oversized non-MFM source content" do
+    user = insert(:user, ap_id: "https://example.com/users/source")
+
+    note = %{
+      "id" => "https://example.com/notes/1",
+      "type" => "Note",
+      "actor" => user.ap_id,
+      "attributedTo" => user.ap_id,
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "content" => "regular content",
+      "context" => Utils.generate_context_id(),
+      "source" => %{
+        "content" => String.duplicate("x", 5_001),
+        "mediaType" => "text/markdown"
+      }
+    }
+
+    %{valid?: true, changes: %{source: source}} = ArticleNotePageValidator.cast_and_validate(note)
+
+    assert source == %{"mediaType" => "text/markdown"}
+  end
+
+  test "a Misskey MFM note with legacy _misskey_content is rendered" do
+    user = insert(:user, ap_id: "https://misskey.example/users/legacy")
+
+    note = %{
+      "id" => "https://misskey.example/notes/5",
+      "type" => "Note",
+      "actor" => user.ap_id,
+      "attributedTo" => user.ap_id,
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "content" => "original content",
+      "context" => Utils.generate_context_id(),
+      "_misskey_content" => "$[spin legacy]"
+    }
+
+    %{valid?: true, changes: %{content: content, source: source}} =
+      ArticleNotePageValidator.cast_and_validate(note)
+
+    assert source == %{"content" => "$[spin legacy]", "mediaType" => "text/x.misskeymarkdown"}
+    assert content =~ ~s(class="mfm-spin")
+    assert content =~ "legacy"
+  end
+
+  test "a Misskey MFM note with htmlMfm is scrubbed but not rendered from source content" do
+    user = insert(:user, ap_id: "https://misskey.example/users/bob")
+
+    note = %{
+      "id" => "https://misskey.example/notes/2",
+      "type" => "Note",
+      "actor" => user.ap_id,
+      "attributedTo" => user.ap_id,
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "content" =>
+        "<span class=\"mfm-spin\">already rendered</span><script>alert('xss')</script>",
+      "htmlMfm" => true,
+      "context" => Utils.generate_context_id(),
+      "source" => %{
+        "content" => String.duplicate("x", 5_001),
+        "mediaType" => "text/x.misskeymarkdown"
+      }
+    }
+
+    %{valid?: true, changes: %{content: content, htmlMfm: true, source: source}} =
+      ArticleNotePageValidator.cast_and_validate(note)
+
+    assert content == "<span class=\"mfm-spin\">already rendered</span>alert(&#39;xss&#39;)"
+    refute Map.has_key?(source, "content")
+  end
+
   test "a Note with validated likes collection validates" do
     insert(:user, ap_id: "https://pol.social/users/mkljczk")
 

test/pleroma/web/activity_pub/object_validators/update_handling_test.exs

@@ -29,7 +29,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.UpdateHandlingTest do
       assert {:ok, _update, []} = ObjectValidator.validate(valid_update, [])
     end
 
-    test "returns an error if the object can't be updated by the actor", %{
+    test "returns an error if the object can't be updated by the actor (different domain)", %{
       valid_update: valid_update
     } do
       other_user = insert(:user, local: false)
@@ -41,27 +41,72 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.UpdateHandlingTest do
       assert {:error, _cng} = ObjectValidator.validate(update, [])
     end
 
-    test "validates as long as the object is same-origin with the actor", %{
+    test "returns an error if the object can't be updated by the actor (same domain)", %{
+      user: user,
       valid_update: valid_update
     } do
-      other_user = insert(:user)
+      user_ap_id = user.ap_id
+      user_domain = URI.parse(user_ap_id).host
+      other_user = insert(:user, local: false, domain: user_domain)
 
       update =
         valid_update
         |> Map.put("actor", other_user.ap_id)
 
-      assert {:ok, _update, []} = ObjectValidator.validate(update, [])
+      assert {:error, _cng} = ObjectValidator.validate(update, [])
     end
 
-    test "validates if the object is not of an Actor type" do
-      note = insert(:note)
+    test "validates if the object is not of an Actor type", %{user: user} do
+      note = insert(:note, user: user)
       updated_note = note.data |> Map.put("content", "edited content")
-      other_user = insert(:user)
 
-      {:ok, update, _} = Builder.update(other_user, updated_note)
+      {:ok, update, _} = Builder.update(user, updated_note)
 
       assert {:ok, _update, _} = ObjectValidator.validate(update, [])
     end
+
+    test "returns an error if the remote update target is unknown" do
+      remote_user = insert(:user, local: false, ap_id: "https://example.com/users/alice")
+
+      update = %{
+        "type" => "Update",
+        "actor" => remote_user.ap_id,
+        "id" => "https://example.com/activities/update-unknown-object",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => [],
+        "object" => %{
+          "type" => "Note",
+          "id" => "https://example.com/objects/unknown",
+          "actor" => remote_user.ap_id,
+          "content" => "edited content",
+          "published" => "2024-07-25T13:33:31Z",
+          "updated" => "2024-07-25T13:34:31Z",
+          "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+          "cc" => []
+        }
+      }
+
+      assert {:error, %Ecto.Changeset{} = cng} = ObjectValidator.validate(update, local: false)
+      refute cng.valid?
+      assert Keyword.has_key?(cng.errors, :object)
+    end
+
+    test "returns an error if the remote update target IRI is unknown" do
+      remote_user = insert(:user, local: false, ap_id: "https://example.com/users/alice")
+
+      update = %{
+        "type" => "Update",
+        "actor" => remote_user.ap_id,
+        "id" => "https://example.com/activities/update-unknown-object-iri",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => [],
+        "object" => "https://example.com/objects/unknown-iri"
+      }
+
+      assert {:error, %Ecto.Changeset{} = cng} = ObjectValidator.validate(update, local: false)
+      refute cng.valid?
+      assert Keyword.has_key?(cng.errors, :object)
+    end
   end
 
   describe "update note" do

test/pleroma/web/activity_pub/transmogrifier_test.exs

@@ -86,6 +86,43 @@ defmodule Pleroma.Web.ActivityPub.TransmogrifierTest do
       assert activity.data["cc"] == [user.ap_id]
     end
 
+    test "it rejects Flag activities when both reporter and reported account are remote" do
+      reporter = insert(:user, local: false, domain: "mastodon.cat")
+      reported = insert(:user, local: false, domain: "nicecrew.digital")
+
+      message = %{
+        "@context" => "https://www.w3.org/ns/activitystreams",
+        "actor" => reporter.ap_id,
+        "content" => "blocked AND reported!!!",
+        "object" => [reported.ap_id, "https://nicecrew.digital/objects/report-status"],
+        "type" => "Flag"
+      }
+
+      assert {:reject, reason} = Transmogrifier.handle_incoming(message)
+      assert reason =~ "third-party report"
+      refute "Flag" |> Pleroma.Activity.Queries.by_type() |> Pleroma.Repo.one()
+    end
+
+    test "it accepts Flag activities with just actor id as object" do
+      user = insert(:user)
+      other_user = insert(:user)
+
+      message = %{
+        "@context" => "https://www.w3.org/ns/activitystreams",
+        "cc" => [user.ap_id],
+        "object" => user.ap_id,
+        "type" => "Flag",
+        "content" => "blocked AND reported!!!",
+        "actor" => other_user.ap_id
+      }
+
+      assert {:ok, activity} = Transmogrifier.handle_incoming(message)
+
+      assert activity.data["content"] == "blocked AND reported!!!"
+      assert activity.data["actor"] == other_user.ap_id
+      assert activity.data["cc"] == [user.ap_id]
+    end
+
     test "it accepts Move activities" do
       old_user = insert(:user)
       new_user = insert(:user)

test/pleroma/web/activity_pub/utils_test.exs

@@ -180,7 +180,8 @@ defmodule Pleroma.Web.ActivityPub.UtilsTest do
                  "https://www.w3.org/ns/activitystreams",
                  "http://localhost:4001/schemas/litepub-0.1.jsonld",
                  %{
-                   "@language" => "und"
+                   "@language" => "und",
+                   "htmlMfm" => "https://w3id.org/fep/c16b#htmlMfm"
                  }
                ]
              }
@@ -192,7 +193,8 @@ defmodule Pleroma.Web.ActivityPub.UtilsTest do
                  "https://www.w3.org/ns/activitystreams",
                  "http://localhost:4001/schemas/litepub-0.1.jsonld",
                  %{
-                   "@language" => "pl"
+                   "@language" => "pl",
+                   "htmlMfm" => "https://w3id.org/fep/c16b#htmlMfm"
                  }
                ]
              }

test/pleroma/web/common_api_test.exs

@@ -709,6 +709,47 @@ defmodule Pleroma.Web.CommonAPITest do
       assert object.data["source"]["content"] == post
     end
 
+    test "it renders MFM posts and marks their ActivityPub representation" do
+      user = insert(:user)
+
+      post = "<p class='scrub-this'>$[spin.speed=1s 13:37]</p>"
+
+      {:ok, activity} =
+        CommonAPI.post(user, %{
+          status: post,
+          content_type: "text/x.misskeymarkdown"
+        })
+
+      object = Object.normalize(activity, fetch: false)
+
+      assert object.data["htmlMfm"] == true
+
+      assert object.data["source"] == %{
+               "content" => post,
+               "mediaType" => "text/x.misskeymarkdown"
+             }
+
+      assert object.data["content"] =~ ~s(class="mfm-spin")
+      assert object.data["content"] =~ ~s(data-mfm-speed="1s")
+      assert object.data["content"] =~ "13:37"
+      refute object.data["content"] =~ "scrub-this"
+    end
+
+    test "it falls back safely for malformed MFM" do
+      user = insert(:user)
+
+      {:ok, activity} =
+        CommonAPI.post(user, %{
+          status: "$[spin malformed",
+          content_type: "text/x.misskeymarkdown"
+        })
+
+      object = Object.normalize(activity, fetch: false)
+
+      refute object.data["content"] =~ ~s(class="mfm-spin")
+      assert object.data["content"] =~ "malformed"
+    end
+
     test "it does not allow replies to direct messages that are not direct messages themselves" do
       user = insert(:user)
 

test/pleroma/web/mastodon_api/controllers/account_controller_test.exs

@@ -1815,7 +1815,10 @@ defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
     test "returns lists to which the account belongs" do
       %{user: user, conn: conn} = oauth_access(["read:lists"])
       other_user = insert(:user)
-      assert {:ok, %Pleroma.List{id: _list_id} = list} = Pleroma.List.create(%{title: "Test List"}, user)
+
+      assert {:ok, %Pleroma.List{id: _list_id} = list} =
+               Pleroma.List.create(%{title: "Test List"}, user)
+
       {:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)
 
       assert [%{"id" => _list_id, "title" => "Test List"}] =

test/pleroma/web/mastodon_api/views/poll_view_test.exs

@@ -180,4 +180,179 @@ defmodule Pleroma.Web.MastodonAPI.PollViewTest do
 
     assert result[:pleroma][:non_anonymous] == true
   end
+
+  test "prefers votersCount over voters list when both are present" do
+    user = insert(:user)
+
+    {:ok, activity} =
+      CommonAPI.post(user, %{
+        status: "Which flavor?",
+        poll: %{options: ["chocolate", "vanilla"], expires_in: 20}
+      })
+
+    object = Object.normalize(activity, fetch: false)
+
+    voter = insert(:user)
+    {:ok, _, object} = CommonAPI.vote(object, voter, [0])
+
+    assert object.data["votersCount"] == 1
+    assert length(object.data["voters"]) == 1
+
+    object = %{
+      object
+      | data: Map.put(object.data, "votersCount", 42)
+    }
+
+    result = PollView.render("show.json", %{object: object})
+
+    assert result[:voters_count] == 42
+  end
+
+  test "falls back to voters list when votersCount is absent" do
+    user = insert(:user)
+
+    {:ok, activity} =
+      CommonAPI.post(user, %{
+        status: "Which flavor?",
+        poll: %{options: ["chocolate", "vanilla"], expires_in: 20}
+      })
+
+    object = Object.normalize(activity, fetch: false)
+
+    voter = insert(:user)
+    {:ok, _, object} = CommonAPI.vote(object, voter, [0])
+
+    assert length(object.data["voters"]) == 1
+
+    data = Map.delete(object.data, "votersCount")
+    object = %{object | data: data}
+
+    result = PollView.render("show.json", %{object: object})
+
+    assert result[:voters_count] == 1
+  end
+
+  test "returns 0 when both votersCount and voters are absent" do
+    user = insert(:user)
+
+    {:ok, activity} =
+      CommonAPI.post(user, %{
+        status: "Which flavor?",
+        poll: %{options: ["chocolate", "vanilla"], expires_in: 20}
+      })
+
+    object = Object.normalize(activity, fetch: false)
+
+    data =
+      object.data
+      |> Map.delete("votersCount")
+      |> Map.delete("voters")
+
+    object = %{object | data: data}
+
+    result = PollView.render("show.json", %{object: object})
+
+    assert result[:voters_count] == 0
+  end
+
+  test "returns 0 when voters list is empty" do
+    user = insert(:user)
+
+    {:ok, activity} =
+      CommonAPI.post(user, %{
+        status: "Which flavor?",
+        poll: %{options: ["chocolate", "vanilla"], expires_in: 20}
+      })
+
+    object = Object.normalize(activity, fetch: false)
+
+    data =
+      object.data
+      |> Map.delete("votersCount")
+      |> Map.put("voters", [])
+
+    object = %{object | data: data}
+
+    result = PollView.render("show.json", %{object: object})
+
+    assert result[:voters_count] == 0
+  end
+
+  test "does not inflate votersCount when same voter picks multiple options" do
+    user = insert(:user)
+
+    {:ok, activity} =
+      CommonAPI.post(user, %{
+        status: "Pick several",
+        poll: %{options: ["a", "b", "c"], expires_in: 20, multiple: true}
+      })
+
+    object = Object.normalize(activity, fetch: false)
+
+    voter = insert(:user)
+    {:ok, _, object} = CommonAPI.vote(object, voter, [0, 2])
+
+    assert object.data["votersCount"] == 1
+    assert length(object.data["voters"]) == 1
+  end
+
+  test "preserves votersCount from remote source when existing voter picks another option" do
+    user = insert(:user)
+
+    {:ok, activity} =
+      CommonAPI.post(user, %{
+        status: "Pick several",
+        poll: %{options: ["a", "b"], expires_in: 20, multiple: true}
+      })
+
+    object = Object.normalize(activity, fetch: false)
+
+    voter = insert(:user)
+    {:ok, _, object} = CommonAPI.vote(object, voter, [0, 1])
+
+    object = %{object | data: Map.put(object.data, "votersCount", 14)}
+
+    result = PollView.render("show.json", %{object: object})
+
+    assert result[:voters_count] == 14
+  end
+
+  test "returns 0 when votersCount is explicitly 0" do
+    user = insert(:user)
+
+    {:ok, activity} =
+      CommonAPI.post(user, %{
+        status: "Pick one",
+        poll: %{options: ["a", "b"], expires_in: 20}
+      })
+
+    object = Object.normalize(activity, fetch: false)
+
+    object = %{object | data: Map.put(object.data, "votersCount", 0)}
+
+    result = PollView.render("show.json", %{object: object})
+
+    assert result[:voters_count] == 0
+  end
+
+  test "falls back to voters list when votersCount is nil" do
+    user = insert(:user)
+
+    {:ok, activity} =
+      CommonAPI.post(user, %{
+        status: "Pick one",
+        poll: %{options: ["a", "b"], expires_in: 20}
+      })
+
+    object = Object.normalize(activity, fetch: false)
+
+    voter = insert(:user)
+    {:ok, _, object} = CommonAPI.vote(object, voter, [0])
+
+    object = %{object | data: Map.put(object.data, "votersCount", nil)}
+
+    result = PollView.render("show.json", %{object: object})
+
+    assert result[:voters_count] == length(object.data["voters"])
+  end
 end

test/pleroma/web/plugs/frontend_static_plug_test.exs

@@ -105,6 +105,7 @@ defmodule Pleroma.Web.Plugs.FrontendStaticPlugTest do
       "nodeinfo",
       "manifest.json",
       "auth",
+      "embed",
       "proxy",
       "test",
       "user_exists",

test/pleroma/web/plugs/mapped_signature_to_identity_plug_test.exs

@@ -47,13 +47,27 @@ defmodule Pleroma.Web.Plugs.MappedSignatureToIdentityPlugTest do
     assert %{valid_signature: false} == conn.assigns
   end
 
-  @tag skip: "known breakage; the testsuite presently depends on it"
   test "it considers a mapped identity to be invalid when the identity cannot be found" do
+    actor = "http://niu.moe/users/rye"
+
     conn =
-      build_conn(:post, "/doesntmattter", %{"actor" => "http://mastodon.example.org/users/admin"})
-      |> set_signature("http://niu.moe/users/rye")
+      build_conn(:post, "/doesntmattter", %{"actor" => actor})
+      |> set_signature(actor)
       |> MappedSignatureToIdentityPlug.call(%{})
 
-    assert %{valid_signature: false} == conn.assigns
+    assert conn.assigns.valid_signature == false
+    refute Map.has_key?(conn.assigns, :user)
+  end
+
+  test "it considers a mapped identity to be invalid when embedded actor identity cannot be found" do
+    actor = "http://niu.moe/users/rye"
+
+    conn =
+      build_conn(:post, "/doesntmattter", %{"actor" => %{"id" => actor}})
+      |> set_signature(actor)
+      |> MappedSignatureToIdentityPlug.call(%{})
+
+    assert conn.assigns.valid_signature == false
+    refute Map.has_key?(conn.assigns, :user)
   end
 end

test/pleroma/web/remote_interaction/remote_interaction_controller_test.exs

@@ -83,7 +83,9 @@ defmodule Pleroma.Web.RemoteInteraction.RemoteInteractionControllerTest do
 
       response =
         conn
-        |> get(remote_interaction_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
+        |> get(
+          remote_interaction_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"})
+        )
         |> html_response(200)
 
       assert response =~ "Log in to follow"
@@ -114,7 +116,9 @@ defmodule Pleroma.Web.RemoteInteraction.RemoteInteractionControllerTest do
       response =
         conn
         |> assign(:user, user)
-        |> get(remote_interaction_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
+        |> get(
+          remote_interaction_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"})
+        )
         |> html_response(200)
 
       assert response =~ "Remote follow"
@@ -157,7 +161,9 @@ defmodule Pleroma.Web.RemoteInteraction.RemoteInteractionControllerTest do
                  conn
                  |> assign(:user, user)
                  |> assign(:token, read_token)
-                 |> post(remote_interaction_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
+                 |> post(remote_interaction_path(conn, :do_follow), %{
+                   "user" => %{"id" => user2.id}
+                 })
                  |> response(200)
 
                assert response =~ "Error following account"
@@ -496,7 +502,9 @@ defmodule Pleroma.Web.RemoteInteraction.RemoteInteractionControllerTest do
         )
 
       assert redirected_to(conn) ==
-               remote_interaction_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"})
+               remote_interaction_path(conn, :follow, %{
+                 acct: "https://mastodon.social/users/emelie"
+               })
     end
   end
 

test/pleroma/workers/receiver_worker_test.exs

@@ -11,9 +11,27 @@ defmodule Pleroma.Workers.ReceiverWorkerTest do
 
   alias Pleroma.User
   alias Pleroma.Web.CommonAPI
-  alias Pleroma.Web.Federator
   alias Pleroma.Workers.ReceiverWorker
 
+  defp signature_headers_for(%User{} = signer) do
+    [
+      {"host", "local.test"},
+      {"date", "Thu, 25 Jul 2024 13:33:31 GMT"},
+      {"digest", "SHA-256=fake-digest"},
+      {"content-type", "application/activity+json"},
+      {
+        "signature",
+        "keyId=\"#{signer.ap_id}#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) host date digest content-type\",signature=\"fake-signature\""
+      }
+    ]
+  end
+
+  defp perform_incoming(params) do
+    ReceiverWorker.perform(%Oban.Job{
+      args: %{"op" => "incoming_ap_doc", "params" => params}
+    })
+  end
+
   test "it does not retry MRF reject" do
     params = insert(:note).data
 
@@ -81,16 +99,7 @@ defmodule Pleroma.Workers.ReceiverWorkerTest do
         insert(:note_activity).data
         |> Map.put("actor", "https://springfield.social/users/bart")
 
-      {:ok, oban_job} =
-        Federator.incoming_ap_doc(%{
-          method: "POST",
-          req_headers: [],
-          request_path: "/inbox",
-          params: params,
-          query_string: ""
-        })
-
-      assert {:cancel, {:error, :forbidden}} = ReceiverWorker.perform(oban_job)
+      assert {:cancel, {:error, :forbidden}} = perform_incoming(params)
     end
 
     test "when request returns a 404" do
@@ -98,16 +107,7 @@ defmodule Pleroma.Workers.ReceiverWorkerTest do
         insert(:note_activity).data
         |> Map.put("actor", "https://springfield.social/users/troymcclure")
 
-      {:ok, oban_job} =
-        Federator.incoming_ap_doc(%{
-          method: "POST",
-          req_headers: [],
-          request_path: "/inbox",
-          params: params,
-          query_string: ""
-        })
-
-      assert {:cancel, {:error, :not_found}} = ReceiverWorker.perform(oban_job)
+      assert {:cancel, {:error, :not_found}} = perform_incoming(params)
     end
 
     test "when request returns a 410" do
@@ -115,16 +115,7 @@ defmodule Pleroma.Workers.ReceiverWorkerTest do
         insert(:note_activity).data
         |> Map.put("actor", "https://springfield.social/users/hankscorpio")
 
-      {:ok, oban_job} =
-        Federator.incoming_ap_doc(%{
-          method: "POST",
-          req_headers: [],
-          request_path: "/inbox",
-          params: params,
-          query_string: ""
-        })
-
-      assert {:cancel, {:error, :not_found}} = ReceiverWorker.perform(oban_job)
+      assert {:cancel, {:error, :not_found}} = perform_incoming(params)
     end
 
     test "when user account is disabled" do
@@ -138,86 +129,16 @@ defmodule Pleroma.Workers.ReceiverWorkerTest do
 
       {:ok, %User{}} = User.set_activation(user, false)
 
-      {:ok, oban_job} =
-        Federator.incoming_ap_doc(%{
-          method: "POST",
-          req_headers: [],
-          request_path: "/inbox",
-          params: params,
-          query_string: ""
-        })
-
-      assert {:cancel, {:user_active, false}} = ReceiverWorker.perform(oban_job)
+      assert {:cancel, {:user_active, false}} = perform_incoming(params)
     end
   end
 
-  test "it can validate the signature" do
-    Tesla.Mock.mock(fn
-      %{url: "https://phpc.social/users/denniskoch"} ->
-        %Tesla.Env{
-          status: 200,
-          body: File.read!("test/fixtures/denniskoch.json"),
-          headers: [{"content-type", "application/activity+json"}]
-        }
-
-      %{url: "https://phpc.social/users/denniskoch/collections/featured"} ->
-        %Tesla.Env{
-          status: 200,
-          headers: [{"content-type", "application/activity+json"}],
-          body:
-            File.read!("test/fixtures/users_mock/masto_featured.json")
-            |> String.replace("{{domain}}", "phpc.social")
-            |> String.replace("{{nickname}}", "denniskoch")
-        }
-    end)
-
-    params =
-      File.read!("test/fixtures/receiver_worker_signature_activity.json") |> Jason.decode!()
-
-    req_headers = [
-      ["accept-encoding", "gzip"],
-      ["content-length", "5184"],
-      ["content-type", "application/activity+json"],
-      ["date", "Thu, 25 Jul 2024 13:33:31 GMT"],
-      ["digest", "SHA-256=ouge/6HP2/QryG6F3JNtZ6vzs/hSwMk67xdxe87eH7A="],
-      ["host", "bikeshed.party"],
-      [
-        "signature",
-        "keyId=\"https://mastodon.social/users/bastianallgeier#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) host date digest content-type\",signature=\"ymE3vn5Iw50N6ukSp8oIuXJB5SBjGAGjBasdTDvn+ahZIzq2SIJfmVCsIIzyqIROnhWyQoTbavTclVojEqdaeOx+Ejz2wBnRBmhz5oemJLk4RnnCH0lwMWyzeY98YAvxi9Rq57Gojuv/1lBqyGa+rDzynyJpAMyFk17XIZpjMKuTNMCbjMDy76ILHqArykAIL/v1zxkgwxY/+ELzxqMpNqtZ+kQ29znNMUBB3eVZ/mNAHAz6o33Y9VKxM2jw+08vtuIZOusXyiHbRiaj2g5HtN2WBUw1MzzfRfHF2/yy7rcipobeoyk5RvP5SyHV3WrIeZ3iyoNfmv33y8fxllF0EA==\""
-      ],
-      [
-        "user-agent",
-        "http.rb/5.2.0 (Mastodon/4.3.0-nightly.2024-07-25; +https://mastodon.social/)"
-      ]
-    ]
-
-    {:ok, oban_job} =
-      Federator.incoming_ap_doc(%{
-        method: "POST",
-        req_headers: req_headers,
-        request_path: "/inbox",
-        params: params,
-        query_string: ""
-      })
-
-    assert {:ok, %Pleroma.Activity{}} = ReceiverWorker.perform(oban_job)
-  end
-
   test "cancels due to origin containment" do
     params =
       insert(:note_activity).data
       |> Map.put("id", "https://notorigindomain.com/activity")
 
-    {:ok, oban_job} =
-      Federator.incoming_ap_doc(%{
-        method: "POST",
-        req_headers: [],
-        request_path: "/inbox",
-        params: params,
-        query_string: ""
-      })
-
-    assert {:cancel, :origin_containment_failed} = ReceiverWorker.perform(oban_job)
+    assert {:cancel, :origin_containment_failed} = perform_incoming(params)
   end
 
   test "canceled due to deleted object" do
@@ -233,16 +154,114 @@ defmodule Pleroma.Workers.ReceiverWorkerTest do
         }
     end)
 
-    {:ok, oban_job} =
-      Federator.incoming_ap_doc(%{
-        method: "POST",
-        req_headers: [],
-        request_path: "/inbox",
-        params: params,
-        query_string: ""
-      })
+    assert {:cancel, _} = perform_incoming(params)
+  end
 
-    assert {:cancel, _} = ReceiverWorker.perform(oban_job)
+  test "delegates legacy failed-signature metadata jobs instead of processing them as trusted" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+    object_id = "https://two.com/objects/legacy-forged-note"
+
+    create = %{
+      "type" => "Create",
+      "actor" => bob.ap_id,
+      "id" => "https://two.com/activities/legacy-forged-create",
+      "context" => "https://two.com/contexts/legacy-forged-create",
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "object" => %{
+        "type" => "Note",
+        "id" => object_id,
+        "actor" => bob.ap_id,
+        "attributedTo" => bob.ap_id,
+        "context" => "https://two.com/contexts/legacy-forged-create",
+        "content" => "forged post",
+        "published" => "2024-07-25T13:33:31Z",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => []
+      }
+    }
+
+    assert {:cancel, :actor_signature_mismatch} =
+             ReceiverWorker.perform(%Oban.Job{
+               args: %{
+                 "op" => "incoming_ap_doc",
+                 "method" => "POST",
+                 "params" => create,
+                 "req_headers" => signature_headers_for(alice),
+                 "request_path" => "/inbox",
+                 "query_string" => ""
+               }
+             })
+
+    refute Pleroma.Activity.get_by_ap_id(create["id"])
+    refute Pleroma.Object.get_by_ap_id(object_id)
+  end
+
+  test "fails closed for the old persisted failed-signature job shape" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+    object_id = "https://two.com/objects/old-shape-forged-note"
+
+    create = %{
+      "type" => "Create",
+      "actor" => bob.ap_id,
+      "id" => "https://two.com/activities/old-shape-forged-create",
+      "context" => "https://two.com/contexts/old-shape-forged-create",
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "object" => %{
+        "type" => "Note",
+        "id" => object_id,
+        "actor" => bob.ap_id,
+        "attributedTo" => bob.ap_id,
+        "context" => "https://two.com/contexts/old-shape-forged-create",
+        "content" => "forged post",
+        "published" => "2024-07-25T13:33:31Z",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => []
+      }
+    }
+
+    assert {:cancel, :missing_signature_retry_metadata} =
+             ReceiverWorker.perform(%Oban.Job{
+               args: %{
+                 "op" => "incoming_ap_doc",
+                 "params" => create,
+                 "req_headers" => signature_headers_for(alice),
+                 "timeout" => 20_000
+               }
+             })
+
+    refute Pleroma.Activity.get_by_ap_id(create["id"])
+    refute Pleroma.Object.get_by_ap_id(object_id)
+  end
+
+  test "fails closed for legacy retry jobs missing one metadata field" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    params = insert(:note_activity).data
+
+    assert {:cancel, :missing_signature_retry_metadata} =
+             ReceiverWorker.perform(%Oban.Job{
+               args: %{
+                 "op" => "incoming_ap_doc",
+                 "method" => "POST",
+                 "params" => params,
+                 "req_headers" => signature_headers_for(alice),
+                 "request_path" => "/inbox"
+               }
+             })
+  end
+
+  test "fails closed for malformed legacy metadata jobs without params" do
+    assert {:cancel, :missing_signature_retry_metadata} =
+             ReceiverWorker.perform(%Oban.Job{
+               args: %{
+                 "op" => "incoming_ap_doc",
+                 "req_headers" => [],
+                 "timeout" => 20_000
+               }
+             })
   end
 
   describe "Server reachability:" do

test/pleroma/workers/signature_retry_worker_test.exs

@@ -0,0 +1,574 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Workers.SignatureRetryWorkerTest do
+  use Pleroma.DataCase, async: false
+  use Oban.Testing, repo: Pleroma.Repo
+
+  import ExUnit.CaptureLog
+  import Pleroma.Factory
+
+  @moduletag capture_log: true
+
+  alias Pleroma.Activity
+  alias Pleroma.Object
+  alias Pleroma.Signature
+  alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.UserView
+  alias Pleroma.Web.Federator
+  alias Pleroma.Workers.SignatureRetryWorker
+
+  defp signature_headers_for(%User{} = signer) do
+    [
+      {"host", "local.test"},
+      {"date", "Thu, 25 Jul 2024 13:33:31 GMT"},
+      {"digest", "SHA-256=fake-digest"},
+      {"content-type", "application/activity+json"},
+      {
+        "signature",
+        "keyId=\"#{signer.ap_id}#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) host date digest content-type\",signature=\"fake-signature\""
+      }
+    ]
+  end
+
+  defp stub_actor_fetch(%User{} = signer) do
+    signer_json = UserView.render("user.json", %{user: signer}) |> Map.delete("featured")
+
+    Tesla.Mock.mock(fn
+      %{url: url} when url == signer.ap_id ->
+        %Tesla.Env{
+          status: 200,
+          body: Jason.encode!(signer_json),
+          headers: HttpRequestMock.activitypub_object_headers()
+        }
+    end)
+  end
+
+  defp expect_signature_from(%User{} = signer) do
+    stub_actor_fetch(signer)
+    Mox.expect(Pleroma.StubbedHTTPSignaturesMock, :validate_conn, fn _conn -> true end)
+  end
+
+  defp enqueue_failed_signature(params, signer) do
+    Federator.incoming_failed_signature_ap_doc(%{
+      method: "POST",
+      req_headers: signature_headers_for(signer),
+      request_path: "/inbox",
+      params: params,
+      query_string: ""
+    })
+  end
+
+  defp failed_signature_job(params, req_headers, opts \\ []) do
+    %Oban.Job{
+      args: %{
+        "op" => "incoming_failed_signature_ap_doc",
+        "method" => Keyword.get(opts, :method, "POST"),
+        "req_headers" => req_headers,
+        "request_path" => Keyword.get(opts, :request_path, "/inbox"),
+        "params" => params,
+        "query_string" => Keyword.get(opts, :query_string, "")
+      }
+    }
+  end
+
+  defp assert_mismatched_signature_cancelled(params, signer) do
+    assert {:ok, oban_job} = enqueue_failed_signature(params, signer)
+
+    capture_log([level: :warning], fn ->
+      assert {:cancel, :actor_signature_mismatch} = SignatureRetryWorker.perform(oban_job)
+    end)
+  end
+
+  test "Federator preserves request metadata for failed-signature retry jobs" do
+    params = insert(:note_activity).data
+
+    req_headers = [
+      {"host", "local.test"},
+      {"signature", "keyId=\"https://one.com/users/alice#main-key\""}
+    ]
+
+    assert {:ok, oban_job} =
+             Federator.incoming_failed_signature_ap_doc(%{
+               method: "POST",
+               req_headers: req_headers,
+               request_path: "/inbox",
+               params: params,
+               query_string: "foo=bar"
+             })
+
+    assert oban_job.worker == "Pleroma.Workers.SignatureRetryWorker"
+
+    assert %{
+             "op" => "incoming_failed_signature_ap_doc",
+             "method" => "POST",
+             "req_headers" => ^req_headers,
+             "request_path" => "/inbox",
+             "params" => ^params,
+             "query_string" => "foo=bar"
+           } = oban_job.args
+  end
+
+  test "cancels retry jobs without request metadata" do
+    params = insert(:note_activity).data
+
+    log =
+      capture_log([level: :warning], fn ->
+        assert {:cancel, :missing_signature_retry_metadata} =
+                 SignatureRetryWorker.perform(%Oban.Job{
+                   args: %{"op" => "incoming_failed_signature_ap_doc", "params" => params}
+                 })
+      end)
+
+    assert log =~ "Failed-signature inbox retry rejected"
+    assert log =~ "reason=:missing_signature_retry_metadata"
+    assert log =~ "payload_actor=#{inspect(params["actor"])}"
+    assert log =~ "activity_id=#{inspect(params["id"])}"
+    assert log =~ "type=#{inspect(params["type"])}"
+    assert log =~ "request_path=nil"
+  end
+
+  test "cancels retry jobs with malformed serialized request headers" do
+    params = insert(:note_activity).data
+
+    log =
+      capture_log([level: :warning], fn ->
+        assert {:cancel, :invalid_signature_retry_metadata} =
+                 SignatureRetryWorker.perform(failed_signature_job(params, [["signature"]]))
+      end)
+
+    assert log =~ "Failed-signature inbox retry rejected"
+    assert log =~ "reason=:invalid_signature_retry_metadata"
+    assert log =~ "signature_actor=nil"
+    assert log =~ "request_path=\"/inbox\""
+  end
+
+  test "cancels retry jobs without a signature header" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    params = insert(:note_activity, user: alice).data
+
+    log =
+      capture_log([level: :warning], fn ->
+        assert {:cancel, :invalid_signature} =
+                 SignatureRetryWorker.perform(
+                   failed_signature_job(params, [{"host", "local.test"}])
+                 )
+      end)
+
+    assert log =~ "Failed-signature inbox retry rejected"
+    assert log =~ "reason=:invalid_signature"
+    assert log =~ "payload_actor=#{inspect(params["actor"])}"
+    assert log =~ "signature_actor=nil"
+    assert log =~ "request_path=\"/inbox\""
+  end
+
+  test "cancels missing signature before fetching an unavailable payload actor" do
+    params =
+      insert(:note_activity).data
+      |> Map.put("actor", "https://unavailable.example/users/bob")
+
+    assert {:cancel, :invalid_signature} =
+             SignatureRetryWorker.perform(failed_signature_job(params, [{"host", "local.test"}]))
+  end
+
+  test "cancels signer mismatch before fetching an unavailable payload actor" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+
+    params =
+      insert(:note_activity).data
+      |> Map.put("actor", "https://unavailable.example/users/bob")
+
+    assert {:cancel, :actor_signature_mismatch} =
+             SignatureRetryWorker.perform(
+               failed_signature_job(params, signature_headers_for(alice))
+             )
+  end
+
+  test "cancels retry jobs with a signature header without keyId" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    params = insert(:note_activity, user: alice).data
+
+    req_headers = [{"signature", "algorithm=\"rsa-sha256\",signature=\"fake-signature\""}]
+
+    assert {:cancel, :invalid_signature} =
+             SignatureRetryWorker.perform(failed_signature_job(params, req_headers))
+  end
+
+  test "cancels retry jobs with an unparsable signature keyId" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    params = insert(:note_activity, user: alice).data
+    req_headers = [{"signature", "keyId=\"not an activitypub id\",signature=\"fake-signature\""}]
+
+    assert {:cancel, :invalid_signature} =
+             SignatureRetryWorker.perform(failed_signature_job(params, req_headers))
+  end
+
+  test "cancels when the refetched key still cannot validate the signature" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+
+    create = %{
+      "type" => "Create",
+      "actor" => alice.ap_id,
+      "id" => "https://one.com/activities/invalid-signature-create",
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "object" => %{
+        "type" => "Note",
+        "id" => "https://one.com/objects/invalid-signature-note",
+        "actor" => alice.ap_id,
+        "attributedTo" => alice.ap_id,
+        "content" => "forged post",
+        "published" => "2024-07-25T13:33:31Z",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => []
+      }
+    }
+
+    stub_actor_fetch(alice)
+
+    assert {:ok, oban_job} = enqueue_failed_signature(create, alice)
+
+    log =
+      capture_log([level: :warning], fn ->
+        assert {:cancel, :invalid_signature} = SignatureRetryWorker.perform(oban_job)
+      end)
+
+    assert log =~ "Failed-signature inbox retry rejected"
+    assert log =~ "reason=:invalid_signature"
+    assert log =~ "payload_actor=\"https://one.com/users/alice\""
+    assert log =~ "signature_actor=\"https://one.com/users/alice\""
+    assert log =~ "activity_id=\"https://one.com/activities/invalid-signature-create\""
+    assert log =~ "type=\"Create\""
+    assert log =~ "request_path=\"/inbox\""
+
+    refute Activity.get_by_ap_id(create["id"])
+  end
+
+  test "processes the activity after refetching a valid matching signature" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+
+    create = %{
+      "type" => "Create",
+      "actor" => alice.ap_id,
+      "id" => "https://one.com/activities/valid-signature-create",
+      "context" => "https://one.com/contexts/valid-signature-create",
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "object" => %{
+        "type" => "Note",
+        "id" => "https://one.com/objects/valid-signature-note",
+        "actor" => alice.ap_id,
+        "attributedTo" => alice.ap_id,
+        "context" => "https://one.com/contexts/valid-signature-create",
+        "content" => "valid post",
+        "published" => "2024-07-25T13:33:31Z",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => []
+      }
+    }
+
+    expect_signature_from(alice)
+
+    assert {:ok, oban_job} = enqueue_failed_signature(create, alice)
+    assert {:ok, %Activity{}} = SignatureRetryWorker.perform(oban_job)
+    assert Activity.get_by_ap_id(create["id"])
+  end
+
+  test "processes the activity when a real signature validates with a query string" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+
+    create = %{
+      "type" => "Create",
+      "actor" => alice.ap_id,
+      "id" => "https://one.com/activities/valid-query-signature-create",
+      "context" => "https://one.com/contexts/valid-query-signature-create",
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "object" => %{
+        "type" => "Note",
+        "id" => "https://one.com/objects/valid-query-signature-note",
+        "actor" => alice.ap_id,
+        "attributedTo" => alice.ap_id,
+        "context" => "https://one.com/contexts/valid-query-signature-create",
+        "content" => "valid signed post",
+        "published" => "2024-07-25T13:33:31Z",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => []
+      }
+    }
+
+    stub_actor_fetch(alice)
+
+    date = "Thu, 25 Jul 2024 13:33:31 GMT"
+    digest = "SHA-256=fake-digest"
+
+    signature =
+      Signature.sign(alice, %{
+        "(request-target)" => "post /inbox?foo=bar",
+        "content-type" => "application/activity+json",
+        date: date,
+        digest: digest,
+        host: "local.test"
+      })
+
+    req_headers = [
+      ["host", "local.test"],
+      ["date", date],
+      ["digest", digest],
+      ["content-type", "application/activity+json"],
+      ["signature", signature]
+    ]
+
+    assert {:ok, %Activity{}} =
+             SignatureRetryWorker.perform(
+               failed_signature_job(create, req_headers, query_string: "foo=bar")
+             )
+
+    assert Activity.get_by_ap_id(create["id"])
+  end
+
+  test "cancels when signature actor does not match payload actor" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+
+    note =
+      insert(:note,
+        user: bob,
+        object_local: false,
+        data: %{"id" => "https://two.com/objects/malicious-update-note"}
+      )
+
+    update = %{
+      "type" => "Update",
+      "actor" => bob.ap_id,
+      "id" => "https://two.com/activities/malicious-update",
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "object" => note.data
+    }
+
+    assert_mismatched_signature_cancelled(update, alice)
+  end
+
+  test "cancels signature actor mismatch through Federator-created jobs" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+
+    note =
+      insert(:note,
+        user: bob,
+        object_local: false,
+        data: %{"id" => "https://two.com/objects/federator-malicious-note"}
+      )
+
+    update = %{
+      "type" => "Update",
+      "actor" => bob.ap_id,
+      "id" => "https://two.com/activities/federator-malicious-update",
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "object" => note.data
+    }
+
+    assert_mismatched_signature_cancelled(update, alice)
+  end
+
+  test "cancels signature actor mismatch before processing a forged Create" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+
+    create = %{
+      "type" => "Create",
+      "actor" => bob.ap_id,
+      "id" => "https://two.com/activities/forged-create",
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "object" => %{
+        "type" => "Note",
+        "id" => "https://two.com/objects/forged-note",
+        "actor" => bob.ap_id,
+        "attributedTo" => bob.ap_id,
+        "content" => "forged post",
+        "published" => "2024-07-25T13:33:31Z",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => []
+      }
+    }
+
+    assert_mismatched_signature_cancelled(create, alice)
+  end
+
+  test "cancels signature actor mismatch when payload actor is embedded" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+
+    create = %{
+      "type" => "Create",
+      "actor" => %{"id" => bob.ap_id},
+      "id" => "https://two.com/activities/embedded-actor-forged-create",
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "object" => %{
+        "type" => "Note",
+        "id" => "https://two.com/objects/embedded-actor-forged-note",
+        "actor" => bob.ap_id,
+        "attributedTo" => bob.ap_id,
+        "content" => "forged post",
+        "published" => "2024-07-25T13:33:31Z",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => []
+      }
+    }
+
+    assert_mismatched_signature_cancelled(create, alice)
+  end
+
+  test "logs signature actor mismatch retry rejections" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+
+    create = %{
+      "type" => "Create",
+      "actor" => bob.ap_id,
+      "id" => "https://two.com/activities/logged-forged-create",
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "object" => %{
+        "type" => "Note",
+        "id" => "https://two.com/objects/logged-forged-note",
+        "actor" => bob.ap_id,
+        "attributedTo" => bob.ap_id,
+        "content" => "forged post",
+        "published" => "2024-07-25T13:33:31Z",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => []
+      }
+    }
+
+    log = assert_mismatched_signature_cancelled(create, alice)
+
+    assert log =~ "Failed-signature inbox retry rejected"
+    assert log =~ "reason=:actor_signature_mismatch"
+    assert log =~ "payload_actor=\"https://two.com/users/bob\""
+    assert log =~ "signature_actor=\"https://one.com/users/alice\""
+    assert log =~ "activity_id=\"https://two.com/activities/logged-forged-create\""
+    assert log =~ "type=\"Create\""
+    assert log =~ "request_path=\"/inbox\""
+  end
+
+  test "cancels signature actor mismatch before actually creating a forged post" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+
+    object_id = "https://two.com/objects/actually-forged-note"
+
+    create = %{
+      "type" => "Create",
+      "actor" => bob.ap_id,
+      "id" => "https://two.com/activities/actually-forged-create",
+      "context" => "https://two.com/contexts/actually-forged-create",
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "object" => %{
+        "type" => "Note",
+        "id" => object_id,
+        "actor" => bob.ap_id,
+        "attributedTo" => bob.ap_id,
+        "context" => "https://two.com/contexts/actually-forged-create",
+        "content" => "forged post",
+        "published" => "2024-07-25T13:33:31Z",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => []
+      }
+    }
+
+    assert_mismatched_signature_cancelled(create, alice)
+    refute Object.get_by_ap_id(object_id)
+  end
+
+  test "cancels signature actor mismatch before processing a forged Like" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+    note = insert(:note)
+
+    like = %{
+      "type" => "Like",
+      "actor" => bob.ap_id,
+      "id" => "https://two.com/activities/forged-like",
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "object" => note.data["id"]
+    }
+
+    assert_mismatched_signature_cancelled(like, alice)
+  end
+
+  test "cancels signature actor mismatch before actually creating a forged Like" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+    note = insert(:note)
+
+    like = %{
+      "type" => "Like",
+      "actor" => bob.ap_id,
+      "id" => "https://two.com/activities/actually-forged-like",
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "object" => note.data["id"]
+    }
+
+    assert_mismatched_signature_cancelled(like, alice)
+    refute Activity.get_by_ap_id(like["id"])
+  end
+
+  test "cancels signature actor mismatch before processing a forged Announce" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+    note = insert(:note)
+
+    announce = %{
+      "type" => "Announce",
+      "actor" => bob.ap_id,
+      "id" => "https://two.com/activities/forged-announce",
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "object" => note.data["id"]
+    }
+
+    assert_mismatched_signature_cancelled(announce, alice)
+  end
+
+  test "cancels signature actor mismatch before processing a forged Follow" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+    followed = insert(:user)
+
+    follow = %{
+      "type" => "Follow",
+      "actor" => bob.ap_id,
+      "id" => "https://two.com/activities/forged-follow",
+      "to" => [followed.ap_id],
+      "cc" => [],
+      "object" => followed.ap_id
+    }
+
+    assert_mismatched_signature_cancelled(follow, alice)
+  end
+
+  test "cancels signature actor mismatch before processing a forged Undo" do
+    alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
+    bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")
+
+    undo = %{
+      "type" => "Undo",
+      "actor" => bob.ap_id,
+      "id" => "https://two.com/activities/forged-undo",
+      "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+      "cc" => [],
+      "object" => "https://two.com/activities/existing-bob-activity"
+    }
+
+    assert_mismatched_signature_cancelled(undo, alice)
+  end
+end