From c62696c8e7a28390880a68392bbd14929b66a56d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?marcin=20miko=C5=82ajczak?= <git@mkljczk.pl>
Date: Mon, 23 Oct 2023 16:31:29 +0200
Subject: [PATCH 01/18] Support /authorize-interaction route used by Mastodon
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
---
 changelog.d/authorize-interaction.add         |  1 +
 lib/pleroma/web/router.ex                     |  2 ++
 .../controllers/remote_follow_controller.ex   |  7 ++++
 .../web/plugs/frontend_static_plug_test.exs   |  1 +
 .../remote_follow_controller_test.exs         | 34 +++++++++++++++++++
 5 files changed, 45 insertions(+)
 create mode 100644 changelog.d/authorize-interaction.add

diff --git a/changelog.d/authorize-interaction.add b/changelog.d/authorize-interaction.add
new file mode 100644
index 0000000000..8692209e12
--- /dev/null
+++ b/changelog.d/authorize-interaction.add
@@ -0,0 +1 @@
+Support /authorize-interaction route used by Mastodon
\ No newline at end of file
diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index 6b9e158a3f..93a28c9ada 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -465,6 +465,8 @@ defmodule Pleroma.Web.Router do
     get("/main/ostatus", UtilController, :show_subscribe_form)
     get("/ostatus_subscribe", RemoteFollowController, :follow)
     post("/ostatus_subscribe", RemoteFollowController, :do_follow)
+
+    get("/authorize_interaction", RemoteFollowController, :authorize_interaction)
   end
 
   scope "/api/pleroma", Pleroma.Web.TwitterAPI do
diff --git a/lib/pleroma/web/twitter_api/controllers/remote_follow_controller.ex b/lib/pleroma/web/twitter_api/controllers/remote_follow_controller.ex
index 6229d5d05b..178ad2b43f 100644
--- a/lib/pleroma/web/twitter_api/controllers/remote_follow_controller.ex
+++ b/lib/pleroma/web/twitter_api/controllers/remote_follow_controller.ex
@@ -121,6 +121,13 @@ def do_follow(%{assigns: %{user: nil}} = conn, _) do
     render(conn, "followed.html", %{error: "Insufficient permissions: follow | write:follows."})
   end
 
+  # GET /authorize_interaction
+  #
+  def authorize_interaction(conn, %{"uri" => uri}) do
+    conn
+    |> redirect(to: Routes.remote_follow_path(conn, :follow, %{acct: uri}))
+  end
+
   defp handle_follow_error(conn, {:mfa_token, followee, _} = _) do
     render(conn, "follow_login.html", %{error: "Wrong username or password", followee: followee})
   end
diff --git a/test/pleroma/web/plugs/frontend_static_plug_test.exs b/test/pleroma/web/plugs/frontend_static_plug_test.exs
index ab31c5f228..d845c0d09b 100644
--- a/test/pleroma/web/plugs/frontend_static_plug_test.exs
+++ b/test/pleroma/web/plugs/frontend_static_plug_test.exs
@@ -82,6 +82,7 @@ test "api routes are detected correctly" do
       "api",
       "main",
       "ostatus_subscribe",
+      "authorize_interaction",
       "oauth",
       "objects",
       "activities",
diff --git a/test/pleroma/web/twitter_api/remote_follow_controller_test.exs b/test/pleroma/web/twitter_api/remote_follow_controller_test.exs
index 1194e0afea..5901140570 100644
--- a/test/pleroma/web/twitter_api/remote_follow_controller_test.exs
+++ b/test/pleroma/web/twitter_api/remote_follow_controller_test.exs
@@ -455,4 +455,38 @@ test "local avatar is not proxied" do
       assert avatar_url == "#{Pleroma.Web.Endpoint.url()}/localuser/avatar.png"
     end
   end
+
+  describe "GET /authorize_interaction - authorize_interaction/2" do
+    test "redirects to /ostatus_subscribe", %{conn: conn} do
+      Tesla.Mock.mock(fn
+        %{method: :get, url: "https://mastodon.social/users/emelie"} ->
+          %Tesla.Env{
+            status: 200,
+            headers: [{"content-type", "application/activity+json"}],
+            body: File.read!("test/fixtures/tesla_mock/emelie.json")
+          }
+
+        %{method: :get, url: "https://mastodon.social/users/emelie/collections/featured"} ->
+          %Tesla.Env{
+            status: 200,
+            headers: [{"content-type", "application/activity+json"}],
+            body:
+              File.read!("test/fixtures/users_mock/masto_featured.json")
+              |> String.replace("{{domain}}", "mastodon.social")
+              |> String.replace("{{nickname}}", "emelie")
+          }
+      end)
+
+      conn =
+        conn
+        |> get(
+          remote_follow_path(conn, :authorize_interaction, %{
+            uri: "https://mastodon.social/users/emelie"
+          })
+        )
+
+      assert redirected_to(conn) ==
+               remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"})
+    end
+  end
 end

From 074b31d9ab30bbecba3fff4335dfec39af5cf9b8 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Thu, 7 Dec 2023 22:27:19 -0500
Subject: [PATCH 02/18] Optimistic Inbox

Rework inbound federation to accept requests optimistically. The HTTP Signatures Plug will not attempt to fetch the actor or key and will fail early.

If the signature cannot be validated we pass the required data into the Oban job with a reduced priority and increase the timeout to 20 seconds. The Oban job will handle the actor and key fetching before attempting to validate the activity again. This job will be retried 5 times by default.

Another welcome side effect is that actors who change their keys can federate to Pleroma instances immediately instead of needing to wait the default value of 86400s / 24 hours before the key will be fetched again.
---
 lib/pleroma/signature.ex                      |  2 +-
 lib/pleroma/user.ex                           | 11 ++++++-
 .../activity_pub/activity_pub_controller.ex   |  7 ++--
 lib/pleroma/web/federator.ex                  |  7 ++++
 lib/pleroma/workers/receiver_worker.ex        | 33 +++++++++++++++++--
 test/pleroma/user_test.exs                    |  9 +++--
 6 files changed, 58 insertions(+), 11 deletions(-)

diff --git a/lib/pleroma/signature.ex b/lib/pleroma/signature.ex
index 5cfdae051b..42cceba28b 100644
--- a/lib/pleroma/signature.ex
+++ b/lib/pleroma/signature.ex
@@ -58,7 +58,7 @@ def refetch_public_key(conn) do
     with %{"keyId" => kid} <- HTTPSignatures.signature_for_conn(conn),
          {:ok, actor_id} <- key_id_to_actor_id(kid),
          {:ok, _user} <- ActivityPub.make_user_from_ap_id(actor_id),
-         {:ok, public_key} <- User.get_public_key_for_ap_id(actor_id) do
+         {:ok, public_key} <- User.get_or_fetch_public_key_for_ap_id(actor_id) do
       {:ok, public_key}
     else
       e ->
diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index ce125d6081..4c9aeffcb9 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -2135,7 +2135,7 @@ def public_key(%{public_key: public_key_pem}) when is_binary(public_key_pem) do
 
   def public_key(_), do: {:error, "key not found"}
 
-  def get_public_key_for_ap_id(ap_id) do
+  def get_or_fetch_public_key_for_ap_id(ap_id) do
     with {:ok, %User{} = user} <- get_or_fetch_by_ap_id(ap_id),
          {:ok, public_key} <- public_key(user) do
       {:ok, public_key}
@@ -2144,6 +2144,15 @@ def get_public_key_for_ap_id(ap_id) do
     end
   end
 
+  def get_public_key_for_ap_id(ap_id) do
+    with {:ok, %User{} = user} <- get_cached_by_ap_id(ap_id),
+         {:ok, public_key} <- public_key(user) do
+      {:ok, public_key}
+    else
+      _ -> :error
+    end
+  end
+
   @doc "Gets or fetch a user by uri or nickname."
   @spec get_or_fetch(String.t()) :: {:ok, User.t()} | {:error, String.t()}
   def get_or_fetch("http://" <> _host = uri), do: get_or_fetch_by_ap_id(uri)
diff --git a/lib/pleroma/web/activity_pub/activity_pub_controller.ex b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
index 1357c379c2..3b2193ca3e 100644
--- a/lib/pleroma/web/activity_pub/activity_pub_controller.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
@@ -287,10 +287,9 @@ def inbox(%{assigns: %{valid_signature: true}} = conn, params) do
     json(conn, "ok")
   end
 
-  def inbox(%{assigns: %{valid_signature: false}} = conn, _params) do
-    conn
-    |> put_status(:bad_request)
-    |> json("Invalid HTTP Signature")
+  def inbox(%{assigns: %{valid_signature: false}, req_headers: req_headers} = conn, params) do
+    Federator.incoming_ap_doc(%{req_headers: req_headers, params: params})
+    json(conn, "ok")
   end
 
   # POST /relay/inbox -or- POST /internal/fetch/inbox
diff --git a/lib/pleroma/web/federator.ex b/lib/pleroma/web/federator.ex
index 84b77cda16..1b8b22b7e6 100644
--- a/lib/pleroma/web/federator.ex
+++ b/lib/pleroma/web/federator.ex
@@ -35,6 +35,13 @@ def allowed_thread_distance?(distance) do
   end
 
   # Client API
+  def incoming_ap_doc(%{params: params, req_headers: req_headers}) do
+    ReceiverWorker.enqueue(
+      "incoming_ap_doc",
+      %{"req_headers" => req_headers, "params" => params, "timeout" => :timer.seconds(20)},
+      priority: 5
+    )
+  end
 
   def incoming_ap_doc(params) do
     ReceiverWorker.enqueue("incoming_ap_doc", %{"params" => params})
diff --git a/lib/pleroma/workers/receiver_worker.ex b/lib/pleroma/workers/receiver_worker.ex
index cf1bb62b44..b04e2974a2 100644
--- a/lib/pleroma/workers/receiver_worker.ex
+++ b/lib/pleroma/workers/receiver_worker.ex
@@ -3,24 +3,51 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 
 defmodule Pleroma.Workers.ReceiverWorker do
+  alias Pleroma.Signature
+  alias Pleroma.User
   alias Pleroma.Web.Federator
 
   use Pleroma.Workers.WorkerHelper, queue: "federator_incoming"
 
   @impl Oban.Worker
+
+  def perform(%Job{
+        args: %{"op" => "incoming_ap_doc", "req_headers" => req_headers, "params" => params}
+      }) do
+    conn_data = %{params: params, req_headers: req_headers}
+
+    with {:ok, %User{} = _actor} <- User.get_or_fetch_by_ap_id(conn_data.params["actor"]),
+         {:ok, _public_key} <- Signature.refetch_public_key(conn_data),
+         {:signature, true} <- {:signature, HTTPSignatures.validate_conn(conn_data)},
+         {:ok, res} <- Federator.perform(:incoming_ap_doc, params) do
+      {:ok, res}
+    else
+      e -> process_errors(e)
+    end
+  end
+
   def perform(%Job{args: %{"op" => "incoming_ap_doc", "params" => params}}) do
     with {:ok, res} <- Federator.perform(:incoming_ap_doc, params) do
       {:ok, res}
     else
+      e -> process_errors(e)
+    end
+  end
+
+  @impl Oban.Worker
+  def timeout(%_{args: %{"timeout" => timeout}}), do: timeout
+
+  def timeout(_job), do: :timer.seconds(5)
+
+  defp process_errors(errors) do
+    case errors do
       {:error, :origin_containment_failed} -> {:cancel, :origin_containment_failed}
       {:error, :already_present} -> {:cancel, :already_present}
       {:error, {:validate_object, reason}} -> {:cancel, reason}
       {:error, {:error, {:validate, reason}}} -> {:cancel, reason}
       {:error, {:reject, reason}} -> {:cancel, reason}
+      {:signature, false} -> {:error, :invalid_signature}
       e -> e
     end
   end
-
-  @impl Oban.Worker
-  def timeout(_job), do: :timer.seconds(5)
 end
diff --git a/test/pleroma/user_test.exs b/test/pleroma/user_test.exs
index b9df527a08..c0b576c3c4 100644
--- a/test/pleroma/user_test.exs
+++ b/test/pleroma/user_test.exs
@@ -1951,8 +1951,13 @@ test "unsuggests a user" do
     end
   end
 
-  test "get_public_key_for_ap_id fetches a user that's not in the db" do
-    assert {:ok, _key} = User.get_public_key_for_ap_id("http://mastodon.example.org/users/admin")
+  test "get_or_fetch_public_key_for_ap_id fetches a user that's not in the db" do
+    assert {:ok, _key} =
+             User.get_or_fetch_public_key_for_ap_id("http://mastodon.example.org/users/admin")
+  end
+
+  test "get_public_key_for_ap_id returns correctly for user that's not in the db" do
+    assert :error = User.get_public_key_for_ap_id("http://mastodon.example.org/users/admin")
   end
 
   describe "per-user rich-text filtering" do

From 0d3f1be2307c778c3f1e59139a45341a57433de2 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Fri, 8 Dec 2023 17:46:10 -0500
Subject: [PATCH 03/18] Fix test; log message no longer emitted here

---
 test/pleroma/signature_test.exs | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/test/pleroma/signature_test.exs b/test/pleroma/signature_test.exs
index b849cbee7f..f5a915fa8b 100644
--- a/test/pleroma/signature_test.exs
+++ b/test/pleroma/signature_test.exs
@@ -43,10 +43,7 @@ test "it returns key" do
     end
 
     test "it returns error when not found user" do
-      assert capture_log(fn ->
-               assert Signature.fetch_public_key(make_fake_conn("https://test-ap-id")) ==
-                        {:error, :error}
-             end) =~ "[error] Could not decode user"
+      assert Signature.fetch_public_key(make_fake_conn("https://test-ap-id")) == {:error, :error}
     end
 
     test "it returns error if public key is nil" do

From ce5acd4158a351c59a79a4a0692eb2ef9775b554 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Fri, 8 Dec 2023 18:10:22 -0500
Subject: [PATCH 04/18] get_cached_by_ap_id/1 returns a single result, not a
 tuple

---
 lib/pleroma/user.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index 4c9aeffcb9..3f729fdcc7 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -2145,7 +2145,7 @@ def get_or_fetch_public_key_for_ap_id(ap_id) do
   end
 
   def get_public_key_for_ap_id(ap_id) do
-    with {:ok, %User{} = user} <- get_cached_by_ap_id(ap_id),
+    with %User{} = user <- get_cached_by_ap_id(ap_id),
          {:ok, public_key} <- public_key(user) do
       {:ok, public_key}
     else

From 1b5964979feb7bc105c5b96d3be6d50a5968740a Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Fri, 8 Dec 2023 18:13:43 -0500
Subject: [PATCH 05/18] Optimistic Inbox

---
 changelog.d/optimistic-inbox.change | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/optimistic-inbox.change

diff --git a/changelog.d/optimistic-inbox.change b/changelog.d/optimistic-inbox.change
new file mode 100644
index 0000000000..2cf1ce92c4
--- /dev/null
+++ b/changelog.d/optimistic-inbox.change
@@ -0,0 +1 @@
+Optimistic Inbox reduces the processing overhead of incoming activities without instantly verifiable signatures.

From 97cf78f63d312d0475ac8908d0b093cb5eff18d5 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Fri, 8 Dec 2023 18:24:30 -0500
Subject: [PATCH 06/18] Remove unnecessary forced refresh of user

---
 lib/pleroma/user.ex | 20 ++++----------------
 1 file changed, 4 insertions(+), 16 deletions(-)

diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index 3f729fdcc7..c7753ca5d4 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -1037,16 +1037,6 @@ defp maybe_send_registration_email(%User{email: email} = user) when is_binary(em
 
   defp maybe_send_registration_email(_), do: {:ok, :noop}
 
-  def needs_update?(%User{local: true}), do: false
-
-  def needs_update?(%User{local: false, last_refreshed_at: nil}), do: true
-
-  def needs_update?(%User{local: false} = user) do
-    NaiveDateTime.diff(NaiveDateTime.utc_now(), user.last_refreshed_at) >= 86_400
-  end
-
-  def needs_update?(_), do: true
-
   @spec maybe_direct_follow(User.t(), User.t()) :: {:ok, User.t()} | {:error, String.t()}
 
   # "Locked" (self-locked) users demand explicit authorization of follow requests
@@ -2059,15 +2049,13 @@ def html_filter_policy(_), do: Config.get([:markup, :scrub_policy])
   def fetch_by_ap_id(ap_id), do: ActivityPub.make_user_from_ap_id(ap_id)
 
   def get_or_fetch_by_ap_id(ap_id) do
-    cached_user = get_cached_by_ap_id(ap_id)
+    user = get_cached_by_ap_id(ap_id) || fetch_by_ap_id(ap_id)
 
-    maybe_fetched_user = needs_update?(cached_user) && fetch_by_ap_id(ap_id)
-
-    case {cached_user, maybe_fetched_user} do
-      {_, {:ok, %User{} = user}} ->
+    case user do
+      %User{} = user ->
         {:ok, user}
 
-      {%User{} = user, _} ->
+      {:ok, %User{} = user} ->
         {:ok, user}
 
       _ ->

From 1d417d2a364eb8ae2035275927f6284951fe128b Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Fri, 8 Dec 2023 21:49:25 -0500
Subject: [PATCH 07/18] Our version of Oban only supports priorities 0-3

---
 lib/pleroma/web/federator.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/pleroma/web/federator.ex b/lib/pleroma/web/federator.ex
index 1b8b22b7e6..669a5bb0b0 100644
--- a/lib/pleroma/web/federator.ex
+++ b/lib/pleroma/web/federator.ex
@@ -39,7 +39,7 @@ def incoming_ap_doc(%{params: params, req_headers: req_headers}) do
     ReceiverWorker.enqueue(
       "incoming_ap_doc",
       %{"req_headers" => req_headers, "params" => params, "timeout" => :timer.seconds(20)},
-      priority: 5
+      priority: 2
     )
   end
 

From 4039106500ed0adba3ac6dbd480954aa76ce6bc3 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Fri, 8 Dec 2023 21:51:36 -0500
Subject: [PATCH 08/18] Fix the req_headers formatting

---
 lib/pleroma/workers/receiver_worker.ex | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/pleroma/workers/receiver_worker.ex b/lib/pleroma/workers/receiver_worker.ex
index b04e2974a2..562112dd25 100644
--- a/lib/pleroma/workers/receiver_worker.ex
+++ b/lib/pleroma/workers/receiver_worker.ex
@@ -14,6 +14,10 @@ defmodule Pleroma.Workers.ReceiverWorker do
   def perform(%Job{
         args: %{"op" => "incoming_ap_doc", "req_headers" => req_headers, "params" => params}
       }) do
+    # Oban's serialization converts our tuple headers to lists.
+    # Revert it for the signature validation.
+    req_headers = Enum.into(req_headers, [], &List.to_tuple(&1))
+
     conn_data = %{params: params, req_headers: req_headers}
 
     with {:ok, %User{} = _actor} <- User.get_or_fetch_by_ap_id(conn_data.params["actor"]),

From 82724f6664c05e746eb241fb60aefd9a931b372d Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Sat, 9 Dec 2023 17:43:54 -0500
Subject: [PATCH 09/18] Do not retry fetching deleted objects

---
 lib/pleroma/workers/receiver_worker.ex | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/pleroma/workers/receiver_worker.ex b/lib/pleroma/workers/receiver_worker.ex
index 562112dd25..d4e8e715e0 100644
--- a/lib/pleroma/workers/receiver_worker.ex
+++ b/lib/pleroma/workers/receiver_worker.ex
@@ -51,6 +51,7 @@ defp process_errors(errors) do
       {:error, {:error, {:validate, reason}}} -> {:cancel, reason}
       {:error, {:reject, reason}} -> {:cancel, reason}
       {:signature, false} -> {:error, :invalid_signature}
+      {:error, {:error, reason = "Object has been deleted"}} -> {:cancel, reason}
       e -> e
     end
   end

From 94daa3e8c1ec42f40214dc13f061f4319764f715 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Sat, 9 Dec 2023 18:21:00 -0500
Subject: [PATCH 10/18] Revert "Remove unnecessary forced refresh of user"

This reverts commit 97cf78f63d312d0475ac8908d0b093cb5eff18d5.
---
 lib/pleroma/user.ex | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index c7753ca5d4..3f729fdcc7 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -1037,6 +1037,16 @@ defp maybe_send_registration_email(%User{email: email} = user) when is_binary(em
 
   defp maybe_send_registration_email(_), do: {:ok, :noop}
 
+  def needs_update?(%User{local: true}), do: false
+
+  def needs_update?(%User{local: false, last_refreshed_at: nil}), do: true
+
+  def needs_update?(%User{local: false} = user) do
+    NaiveDateTime.diff(NaiveDateTime.utc_now(), user.last_refreshed_at) >= 86_400
+  end
+
+  def needs_update?(_), do: true
+
   @spec maybe_direct_follow(User.t(), User.t()) :: {:ok, User.t()} | {:error, String.t()}
 
   # "Locked" (self-locked) users demand explicit authorization of follow requests
@@ -2049,13 +2059,15 @@ def html_filter_policy(_), do: Config.get([:markup, :scrub_policy])
   def fetch_by_ap_id(ap_id), do: ActivityPub.make_user_from_ap_id(ap_id)
 
   def get_or_fetch_by_ap_id(ap_id) do
-    user = get_cached_by_ap_id(ap_id) || fetch_by_ap_id(ap_id)
+    cached_user = get_cached_by_ap_id(ap_id)
 
-    case user do
-      %User{} = user ->
+    maybe_fetched_user = needs_update?(cached_user) && fetch_by_ap_id(ap_id)
+
+    case {cached_user, maybe_fetched_user} do
+      {_, {:ok, %User{} = user}} ->
         {:ok, user}
 
-      {:ok, %User{} = user} ->
+      {%User{} = user, _} ->
         {:ok, user}
 
       _ ->

From d417f7321801890381de4daa53c1a78ef4650d2c Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Sat, 9 Dec 2023 18:40:29 -0500
Subject: [PATCH 11/18] Process inbound Delete activities at lowest priority

---
 lib/pleroma/web/federator.ex | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/pleroma/web/federator.ex b/lib/pleroma/web/federator.ex
index 669a5bb0b0..8621d984c2 100644
--- a/lib/pleroma/web/federator.ex
+++ b/lib/pleroma/web/federator.ex
@@ -43,6 +43,10 @@ def incoming_ap_doc(%{params: params, req_headers: req_headers}) do
     )
   end
 
+  def incoming_ap_doc(%{"type" => "Delete"} = params) do
+    ReceiverWorker.enqueue("incoming_ap_doc", %{"params" => params}, priority: 3)
+  end
+
   def incoming_ap_doc(params) do
     ReceiverWorker.enqueue("incoming_ap_doc", %{"params" => params})
   end

From 223c1bac8dcbfd6b2454b79077545d3465688d7f Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Sun, 10 Dec 2023 12:55:41 -0500
Subject: [PATCH 12/18] Cancel the job if the signature is still invalid after
 a refetch of the public key

---
 lib/pleroma/workers/receiver_worker.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/pleroma/workers/receiver_worker.ex b/lib/pleroma/workers/receiver_worker.ex
index d4e8e715e0..1dddd8d2e3 100644
--- a/lib/pleroma/workers/receiver_worker.ex
+++ b/lib/pleroma/workers/receiver_worker.ex
@@ -50,7 +50,7 @@ defp process_errors(errors) do
       {:error, {:validate_object, reason}} -> {:cancel, reason}
       {:error, {:error, {:validate, reason}}} -> {:cancel, reason}
       {:error, {:reject, reason}} -> {:cancel, reason}
-      {:signature, false} -> {:error, :invalid_signature}
+      {:signature, false} -> {:cancel, :invalid_signature}
       {:error, {:error, reason = "Object has been deleted"}} -> {:cancel, reason}
       e -> e
     end

From 18deea59b441a89c1e6870d29dd0a6c0f3070f55 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Sun, 10 Dec 2023 13:22:55 -0500
Subject: [PATCH 13/18] ActivityPub.make_user_from_ap_id/1 fetches the whole
 actor object including updating the public key for us

---
 lib/pleroma/signature.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/pleroma/signature.ex b/lib/pleroma/signature.ex
index 42cceba28b..5cfdae051b 100644
--- a/lib/pleroma/signature.ex
+++ b/lib/pleroma/signature.ex
@@ -58,7 +58,7 @@ def refetch_public_key(conn) do
     with %{"keyId" => kid} <- HTTPSignatures.signature_for_conn(conn),
          {:ok, actor_id} <- key_id_to_actor_id(kid),
          {:ok, _user} <- ActivityPub.make_user_from_ap_id(actor_id),
-         {:ok, public_key} <- User.get_or_fetch_public_key_for_ap_id(actor_id) do
+         {:ok, public_key} <- User.get_public_key_for_ap_id(actor_id) do
       {:ok, public_key}
     else
       e ->

From c0a50b7c3e340cd621827922200daa0f29dc6e15 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Sun, 10 Dec 2023 13:24:04 -0500
Subject: [PATCH 14/18] User.get_or_fetch_public_key_for_ap_id/1 is no longer
 required.

---
 lib/pleroma/user.ex        | 9 ---------
 test/pleroma/user_test.exs | 5 -----
 2 files changed, 14 deletions(-)

diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index 3f729fdcc7..0706f56070 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -2135,15 +2135,6 @@ def public_key(%{public_key: public_key_pem}) when is_binary(public_key_pem) do
 
   def public_key(_), do: {:error, "key not found"}
 
-  def get_or_fetch_public_key_for_ap_id(ap_id) do
-    with {:ok, %User{} = user} <- get_or_fetch_by_ap_id(ap_id),
-         {:ok, public_key} <- public_key(user) do
-      {:ok, public_key}
-    else
-      _ -> :error
-    end
-  end
-
   def get_public_key_for_ap_id(ap_id) do
     with %User{} = user <- get_cached_by_ap_id(ap_id),
          {:ok, public_key} <- public_key(user) do
diff --git a/test/pleroma/user_test.exs b/test/pleroma/user_test.exs
index c0b576c3c4..77ca9198b7 100644
--- a/test/pleroma/user_test.exs
+++ b/test/pleroma/user_test.exs
@@ -1951,11 +1951,6 @@ test "unsuggests a user" do
     end
   end
 
-  test "get_or_fetch_public_key_for_ap_id fetches a user that's not in the db" do
-    assert {:ok, _key} =
-             User.get_or_fetch_public_key_for_ap_id("http://mastodon.example.org/users/admin")
-  end
-
   test "get_public_key_for_ap_id returns correctly for user that's not in the db" do
     assert :error = User.get_public_key_for_ap_id("http://mastodon.example.org/users/admin")
   end

From 600364f4fd42c42bb82a7a95634cc51b3b936a9f Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Mon, 11 Dec 2023 12:47:59 +0400
Subject: [PATCH 15/18] Gitlab CI: Build using system provided libvips

---
 .gitlab-ci.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 10a843af24..cc4dc0ff29 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,6 +1,7 @@
 image: git.pleroma.social:5050/pleroma/pleroma/ci-base
 
 variables: &global_variables
+  # Only used for the release
   ELIXIR_VER: 1.12.3
   POSTGRES_DB: pleroma_test
   POSTGRES_USER: postgres
@@ -319,8 +320,9 @@ amd64:
           - deps
   variables: &release-variables
     MIX_ENV: prod
+    VIX_COMPILATION_MODE: PLATFORM_PROVIDED_LIBVIPS
   before_script: &before-release
-  - apt-get update && apt-get install -y cmake libmagic-dev
+  - apt-get update && apt-get install -y cmake libmagic-dev libvips-dev erlang-dev
   - echo "import Config" > config/prod.secret.exs
   - mix local.hex --force
   - mix local.rebar --force
@@ -341,7 +343,7 @@ amd64-musl:
   cache: *release-cache
   variables: *release-variables
   before_script: &before-release-musl
-  - apk add git build-base cmake file-dev openssl
+  - apk add git build-base cmake file-dev openssl vips-dev
   - echo "import Config" > config/prod.secret.exs
   - mix local.hex --force
   - mix local.rebar --force

From 7cf65cfeea0a6e1a43028e55c974fa8e20b4d3ce Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Mon, 11 Dec 2023 12:48:53 +0400
Subject: [PATCH 16/18] Changelog

---
 changelog.d/build-release-with-local-libvips.skip | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 changelog.d/build-release-with-local-libvips.skip

diff --git a/changelog.d/build-release-with-local-libvips.skip b/changelog.d/build-release-with-local-libvips.skip
new file mode 100644
index 0000000000..e69de29bb2

From 8b4a78626642590fc52b8183204624ec639c065b Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Mon, 11 Dec 2023 17:25:21 +0400
Subject: [PATCH 17/18] Use version of vix that compiles correctly under arm32

---
 mix.exs  | 2 +-
 mix.lock | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/mix.exs b/mix.exs
index 99074b4339..45de96187b 100644
--- a/mix.exs
+++ b/mix.exs
@@ -181,7 +181,7 @@ defp deps do
       {:majic, "~> 1.0"},
       {:open_api_spex, "~> 3.16"},
       {:ecto_psql_extras, "~> 0.6"},
-      {:vix, "~> 0.25.0"},
+      {:vix, github: "akash-akya/vix", ref: "23b6c31c751dfe45998144fe3528e6348a29cbbb"},
       {:elixir_make, "~> 0.7.7", override: true},
       {:blurhash, "~> 0.1.0", hex: :rinpatch_blurhash},
 
diff --git a/mix.lock b/mix.lock
index a5afb46d5c..7616db49e9 100644
--- a/mix.lock
+++ b/mix.lock
@@ -137,7 +137,7 @@
   "ueberauth": {:hex, :ueberauth, "0.10.5", "806adb703df87e55b5615cf365e809f84c20c68aa8c08ff8a416a5a6644c4b02", [:mix], [{:plug, "~> 1.5", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "3efd1f31d490a125c7ed453b926f7c31d78b97b8a854c755f5c40064bf3ac9e1"},
   "unicode_util_compat": {:hex, :unicode_util_compat, "0.7.0", "bc84380c9ab48177092f43ac89e4dfa2c6d62b40b8bd132b1059ecc7232f9a78", [:rebar3], [], "hexpm", "25eee6d67df61960cf6a794239566599b09e17e668d3700247bc498638152521"},
   "unsafe": {:hex, :unsafe, "1.0.1", "a27e1874f72ee49312e0a9ec2e0b27924214a05e3ddac90e91727bc76f8613d8", [:mix], [], "hexpm", "6c7729a2d214806450d29766abc2afaa7a2cbecf415be64f36a6691afebb50e5"},
-  "vix": {:hex, :vix, "0.25.0", "b294ca3140c0357b262d86e9966949949844282b81923bb990668c1ee5a35337", [:make, :mix], [{:castore, "~> 0.1 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: false]}, {:cc_precompiler, "~> 0.1.4 or ~> 0.2", [hex: :cc_precompiler, repo: "hexpm", optional: false]}, {:elixir_make, "~> 0.7.3 or ~> 0.8", [hex: :elixir_make, repo: "hexpm", optional: false]}, {:kino, "~> 0.7", [hex: :kino, repo: "hexpm", optional: true]}], "hexpm", "be09c96982978bc2d0c501a73e0b65ba58ec94c1afb94e3617029d6ce7ae8c3f"},
+  "vix": {:git, "https://github.com/akash-akya/vix.git", "23b6c31c751dfe45998144fe3528e6348a29cbbb", [ref: "23b6c31c751dfe45998144fe3528e6348a29cbbb"]},
   "web_push_encryption": {:hex, :web_push_encryption, "0.3.1", "76d0e7375142dfee67391e7690e89f92578889cbcf2879377900b5620ee4708d", [:mix], [{:httpoison, "~> 1.0", [hex: :httpoison, repo: "hexpm", optional: false]}, {:jose, "~> 1.11.1", [hex: :jose, repo: "hexpm", optional: false]}], "hexpm", "4f82b2e57622fb9337559058e8797cb0df7e7c9790793bdc4e40bc895f70e2a2"},
   "websock": {:hex, :websock, "0.5.3", "2f69a6ebe810328555b6fe5c831a851f485e303a7c8ce6c5f675abeb20ebdadc", [:mix], [], "hexpm", "6105453d7fac22c712ad66fab1d45abdf049868f253cf719b625151460b8b453"},
   "websock_adapter": {:hex, :websock_adapter, "0.5.5", "9dfeee8269b27e958a65b3e235b7e447769f66b5b5925385f5a569269164a210", [:mix], [{:bandit, ">= 0.6.0", [hex: :bandit, repo: "hexpm", optional: true]}, {:plug, "~> 1.14", [hex: :plug, repo: "hexpm", optional: false]}, {:plug_cowboy, "~> 2.6", [hex: :plug_cowboy, repo: "hexpm", optional: true]}, {:websock, "~> 0.5", [hex: :websock, repo: "hexpm", optional: false]}], "hexpm", "4b977ba4a01918acbf77045ff88de7f6972c2a009213c515a445c48f224ffce9"},

From 6c5ebcded52ba89f4e963fbbaa28430fe17e79e4 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Tue, 12 Dec 2023 08:59:47 +0400
Subject: [PATCH 18/18] Mix: Update vix.

---
 mix.exs  | 2 +-
 mix.lock | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/mix.exs b/mix.exs
index 45de96187b..653e5694bb 100644
--- a/mix.exs
+++ b/mix.exs
@@ -181,7 +181,7 @@ defp deps do
       {:majic, "~> 1.0"},
       {:open_api_spex, "~> 3.16"},
       {:ecto_psql_extras, "~> 0.6"},
-      {:vix, github: "akash-akya/vix", ref: "23b6c31c751dfe45998144fe3528e6348a29cbbb"},
+      {:vix, "~> 0.26.0"},
       {:elixir_make, "~> 0.7.7", override: true},
       {:blurhash, "~> 0.1.0", hex: :rinpatch_blurhash},
 
diff --git a/mix.lock b/mix.lock
index 7616db49e9..81a05687ba 100644
--- a/mix.lock
+++ b/mix.lock
@@ -137,7 +137,7 @@
   "ueberauth": {:hex, :ueberauth, "0.10.5", "806adb703df87e55b5615cf365e809f84c20c68aa8c08ff8a416a5a6644c4b02", [:mix], [{:plug, "~> 1.5", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "3efd1f31d490a125c7ed453b926f7c31d78b97b8a854c755f5c40064bf3ac9e1"},
   "unicode_util_compat": {:hex, :unicode_util_compat, "0.7.0", "bc84380c9ab48177092f43ac89e4dfa2c6d62b40b8bd132b1059ecc7232f9a78", [:rebar3], [], "hexpm", "25eee6d67df61960cf6a794239566599b09e17e668d3700247bc498638152521"},
   "unsafe": {:hex, :unsafe, "1.0.1", "a27e1874f72ee49312e0a9ec2e0b27924214a05e3ddac90e91727bc76f8613d8", [:mix], [], "hexpm", "6c7729a2d214806450d29766abc2afaa7a2cbecf415be64f36a6691afebb50e5"},
-  "vix": {:git, "https://github.com/akash-akya/vix.git", "23b6c31c751dfe45998144fe3528e6348a29cbbb", [ref: "23b6c31c751dfe45998144fe3528e6348a29cbbb"]},
+  "vix": {:hex, :vix, "0.26.0", "027f10b6969b759318be84bd0bd8c88af877445e4e41cf96a0460392cea5399c", [:make, :mix], [{:castore, "~> 0.1 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: false]}, {:cc_precompiler, "~> 0.1.4 or ~> 0.2", [hex: :cc_precompiler, repo: "hexpm", optional: false]}, {:elixir_make, "~> 0.7.3 or ~> 0.8", [hex: :elixir_make, repo: "hexpm", optional: false]}, {:kino, "~> 0.7", [hex: :kino, repo: "hexpm", optional: true]}], "hexpm", "71b0a79ae7f199cacfc8e679b0e4ba25ee47dc02e182c5b9097efb29fbe14efd"},
   "web_push_encryption": {:hex, :web_push_encryption, "0.3.1", "76d0e7375142dfee67391e7690e89f92578889cbcf2879377900b5620ee4708d", [:mix], [{:httpoison, "~> 1.0", [hex: :httpoison, repo: "hexpm", optional: false]}, {:jose, "~> 1.11.1", [hex: :jose, repo: "hexpm", optional: false]}], "hexpm", "4f82b2e57622fb9337559058e8797cb0df7e7c9790793bdc4e40bc895f70e2a2"},
   "websock": {:hex, :websock, "0.5.3", "2f69a6ebe810328555b6fe5c831a851f485e303a7c8ce6c5f675abeb20ebdadc", [:mix], [], "hexpm", "6105453d7fac22c712ad66fab1d45abdf049868f253cf719b625151460b8b453"},
   "websock_adapter": {:hex, :websock_adapter, "0.5.5", "9dfeee8269b27e958a65b3e235b7e447769f66b5b5925385f5a569269164a210", [:mix], [{:bandit, ">= 0.6.0", [hex: :bandit, repo: "hexpm", optional: true]}, {:plug, "~> 1.14", [hex: :plug, repo: "hexpm", optional: false]}, {:plug_cowboy, "~> 2.6", [hex: :plug_cowboy, repo: "hexpm", optional: true]}, {:websock, "~> 0.5", [hex: :websock, repo: "hexpm", optional: false]}], "hexpm", "4b977ba4a01918acbf77045ff88de7f6972c2a009213c515a445c48f224ffce9"},