ActivityPubController: Don't return local only objects

This commit is contained in:
lain 2020-11-17 13:11:39 +01:00
parent af3f00292c
commit 81293e5aad
2 changed files with 41 additions and 2 deletions

View file

@ -82,7 +82,8 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
def object(conn, _) do def object(conn, _) do
with ap_id <- Endpoint.url() <> conn.request_path, with ap_id <- Endpoint.url() <> conn.request_path,
%Object{} = object <- Object.get_cached_by_ap_id(ap_id), %Object{} = object <- Object.get_cached_by_ap_id(ap_id),
{_, true} <- {:public?, Visibility.is_public?(object)} do {_, true} <- {:public?, Visibility.is_public?(object)},
{_, false} <- {:local?, Visibility.is_local_public?(object)} do
conn conn
|> assign(:tracking_fun_data, object.id) |> assign(:tracking_fun_data, object.id)
|> set_cache_ttl_for(object) |> set_cache_ttl_for(object)
@ -92,6 +93,9 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
else else
{:public?, false} -> {:public?, false} ->
{:error, :not_found} {:error, :not_found}
{:local?, true} ->
{:error, :not_found}
end end
end end
@ -108,7 +112,8 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
def activity(conn, _params) do def activity(conn, _params) do
with ap_id <- Endpoint.url() <> conn.request_path, with ap_id <- Endpoint.url() <> conn.request_path,
%Activity{} = activity <- Activity.normalize(ap_id), %Activity{} = activity <- Activity.normalize(ap_id),
{_, true} <- {:public?, Visibility.is_public?(activity)} do {_, true} <- {:public?, Visibility.is_public?(activity)},
{_, false} <- {:local?, Visibility.is_local_public?(activity)} do
conn conn
|> maybe_set_tracking_data(activity) |> maybe_set_tracking_data(activity)
|> set_cache_ttl_for(activity) |> set_cache_ttl_for(activity)
@ -117,6 +122,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
|> render("object.json", object: activity) |> render("object.json", object: activity)
else else
{:public?, false} -> {:error, :not_found} {:public?, false} -> {:error, :not_found}
{:local?, true} -> {:error, :not_found}
nil -> {:error, :not_found} nil -> {:error, :not_found}
end end
end end

View file

@ -213,6 +213,23 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
end end
describe "/objects/:uuid" do describe "/objects/:uuid" do
test "it doesn't return a local-only object", %{conn: conn} do
user = insert(:user)
{:ok, post} = CommonAPI.post(user, %{status: "test", visibility: "local"})
assert Pleroma.Web.ActivityPub.Visibility.is_local_public?(post)
object = Object.normalize(post, false)
uuid = String.split(object.data["id"], "/") |> List.last()
conn =
conn
|> put_req_header("accept", "application/json")
|> get("/objects/#{uuid}")
assert json_response(conn, 404)
end
test "it returns a json representation of the object with accept application/json", %{ test "it returns a json representation of the object with accept application/json", %{
conn: conn conn: conn
} do } do
@ -326,6 +343,22 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
end end
describe "/activities/:uuid" do describe "/activities/:uuid" do
test "it doesn't return a local-only activity", %{conn: conn} do
user = insert(:user)
{:ok, post} = CommonAPI.post(user, %{status: "test", visibility: "local"})
assert Pleroma.Web.ActivityPub.Visibility.is_local_public?(post)
uuid = String.split(post.data["id"], "/") |> List.last()
conn =
conn
|> put_req_header("accept", "application/json")
|> get("/activities/#{uuid}")
assert json_response(conn, 404)
end
test "it returns a json representation of the activity", %{conn: conn} do test "it returns a json representation of the activity", %{conn: conn} do
activity = insert(:note_activity) activity = insert(:note_activity)
uuid = String.split(activity.data["id"], "/") |> List.last() uuid = String.split(activity.data["id"], "/") |> List.last()