tests: add a testcase for user collision

test/support/httpoison_mock.ex

@@ -756,6 +756,14 @@ def get("https://niu.moe/users/rye", [Accept: "application/activity+json"], _) d
      }}
   end
 
+  def get("https://n1u.moe/users/rye", [Accept: "application/activity+json"], _) do
+    {:ok,
+     %Response{
+       status_code: 200,
+       body: File.read!("test/fixtures/httpoison_mock/rye.json")
+     }}
+  end
+
   def get(
         "https://mst3k.interlinked.me/users/luciferMysticus",
         [Accept: "application/activity+json"],

test/web/activity_pub/transmogrifier_test.exs

@@ -955,5 +955,17 @@ test "contain_origin_from_id() allows matching IDs" do
           data
         )
     end
+
+    test "users cannot be collided through fake direction spoofing attempts" do
+      user =
+        insert(:user, %{
+          nickname: "rye@niu.moe",
+          local: false,
+          ap_id: "https://niu.moe/users/rye",
+          follower_address: User.ap_followers(%User{nickname: "rye@niu.moe"})
+        })
+
+      {:error, _} = User.get_or_fetch_by_ap_id("https://n1u.moe/users/rye")
+    end
   end
 end