web => AP: webmention follows aren't resolving URLs to actor ids

snarfed / bridgy-fed

🌉 A bridge between decentralized social network protocols

https://fed.brid.gy

Creative Commons Zero v1.0 Universal

663 stars 34 forks source link

web => AP: webmention follows aren't resolving URLs to actor ids #1172

Open snarfed opened 4 months ago

snarfed commented 4 months ago

When a web user follows via the web UI and IndieAuth, we resolve the AP @-@ handle or profile URL they enter to an actor id. Good. We evidently don't do it for follows via webmention though. We still do discovery and deliver the Follow to their inbox successfully, but we store the follow internally with the URL, not the actor id, so when a followed user delivers us a post, we don't route it internally.

Thanks to uxbrad.com for reporting!

snarfed commented 4 months ago

Temporary workaround until this is fixed: either follow with the UI, or if you follow via webmention, use the actor id (eg https://indieweb.social/users/snarfed) as the u-follow-of, not the profile URL (eg https://indieweb.social/@snarfed).

snarfed commented 4 months ago

This will be tricky internally, it's unclear where the best place is to do this.

Implement ActivityPub.key_for, detect when it couldn't load the user and fell through to the last return cls(id=id).key? That detection is awkward at best.
Special case Web to do this resolution, assume ids from other protocols come from the protocol level and not user input like here? Not ideal, but maybe ok?

snarfed commented 4 months ago

Also included here: cleanup for all of the existing bad stored follows. Sadly can't just replace /@ with /users/ because many servers use opaque ids instead of usernames in actor ids, eg https://misskey.yukineko.me/users/9ev3sgq0t0 / https://misskey.yukineko.me/@ddquino . (Good!...even if it makes life more difficult for us here.)

snarfed commented 3 weeks ago

Current idea is, in Protocol.load, if the fetched object has a different id, override Object.key.id with that fetched id. Made some progress on this in a stash, but it's delicate, and it'll probably take some time to work through all the test failures and downstream effects, so I'm deprioritizing for now.