repo_description: Node.js based forum software built for the modern web
repo_topics: community forum javascript mongodb node nodebb nodejs postgresql redis socket-io websockets
code: 'use strict';
  
  /**
   * This method deals unilaterally with federating activities outward.
   * There _shouldn't_ be any activities sent out that don't go through this file
   * This _should_ be the only file that calls activitypub.send()
   *
   * YMMV.
   */
  
  const winston = require('winston');
  const nconf = require('nconf');
  
  const db = require('../database');
  const user = require('../user');
  const categories = require('../categories');
  const meta = require('../meta');
  const privileges = require('../privileges');
  const topics = require('../topics');
  const posts = require('../posts');
  const messaging = require('../messaging');
  const utils = require('../utils');
  const activitypub = module.parent.exports;
  
  const Out = module.exports;
  
  function enabledCheck(next) {
  	return async function (...args) {
  		if (meta.config.activitypubEnabled) {
  			try {
  				await next.apply(null, args);
  			} catch (e) {
  				winston.error(`[activitypub/api] Error\n${e.stack}`);
  			}
  		}
  	};
  }
  
  Out.follow = enabledCheck(async (type, id, actor) => {
  	// Privilege checks should be done upstream
  	const acceptedTypes = ['uid', 'cid'];
  	const assertion = await activitypub.actors.assert(actor);
  	if (!acceptedTypes.includes(type) || !assertion || (Array.isArray(assertion) && assertion.length)) {
  		throw new Error('[[error:activitypub.invalid-id]]');
  	}
  
  	if (actor.includes('@')) {
  		const [uid, cid] = await Promise.all([
  			user.getUidByUserslug(actor),
  			categories.getCidByHandle(actor),
  		]);
  
  		actor = uid || cid;
  	}
  
  	const isFollowing = await db.isSortedSetMember(type === 'uid' ? `followingRemote:${id}` : `cid:${id}:following`, actor);
  	if (isFollowing) { // already following
  		return;
  	}
  
  	const timestamp = Date.now();
  
  	await db.sortedSetAdd(`followRequests:${type}.${id}`, timestamp, actor);
  	try {
  		await activitypub.send(type, id, [actor], {
  			id: `${nconf.get('url')}/${type}/${id}#activity/follow/${encodeURIComponent(actor)}/${timestamp}`,
  			type: 'Follow',
  			object: actor,
  		});
  	} catch (e) {
  		await db.sortedSetRemove(`followRequests:${type}.${id}`, actor);
  		throw e;
  	}
  });
  
  Out.create = {};
  
  Out.create.note = enabledCheck(async (uid, post) => {
  	if (utils.isNumber(post)) {
  		post = (await posts.getPostSummaryByPids([post], uid, { stripTags: false })).pop();
  		if (!post) {
  			return;
  		}
  	}
  	const { pid } = post;
  	const allowed = await privileges.posts.can('topics:read', pid, activitypub._constants.uid);
  	if (!allowed) {
  		activitypub.helpers.log(`[activitypub/api] Not federating creation of pid ${pid} to the fediverse due to privileges.`);
  		return;
  	}
  
  	const { activity, targets } = await activitypub.mocks.activities.create(pid, uid, post);
  
  	await Promise.all([
  		activitypub.send('uid', uid, Array.from(targets), activity),
  		activitypub.feps.announce(pid, activity),
  		// utils.isNumber(post.cid) ? activitypubApi.add(caller, { pid }) : undefined,
  	]);
  });
  
  Out.create.privateNote = enabledCheck(async (messageObj) => {
  	const { roomId } = messageObj;
  	let targets = await messaging.getUidsInRoom(roomId, 0, -1);
  	targets = targets.filter(uid => !utils.isNumber(uid)); // remote uids only
  
  	const object = await activitypub.mocks.notes.private({ messageObj });
  
  	const payload = {
  		id: `${object.id}#activity/create/${Date.now()}`,
  		type: 'Create',
  		actor: object.attributedTo,
  		to: object.to,
  		object,
  	};
  
  	await activitypub.send('uid', messageObj.fromuid, targets, payload);
  });
  
  Out.update = {};
  
  Out.update.profile = enabledCheck(async (uid, actorUid) => {
  	// Local users only
  	if (!utils.isNumber(uid)) {
  		return;
  	}
  
  	const [object, targets] = await Promise.all([
  		activitypub.mocks.actors.user(uid),
  		db.getSortedSetMembers(`followersRemote:${uid}`),
  	]);
  
  	await activitypub.send('uid', actorUid || uid, targets, {
  		id: `${object.id}#activity/update/${Date.now()}`,
  		type: 'Update',
  		actor: object.id,
  		to: [activitypub._constants.publicAddress],
  		cc: [],
  		object,
  	});
  });
  
  Out.update.category = enabledCheck(async (cid) => {
  	// Local categories only
  	if (!utils.isNumber(cid)) {
  		return;
  	}
  
  	const [object, targets] = await Promise.all([
  		activitypub.mocks.actors.category(cid),
  		activitypub.notes.getCategoryFollowers(cid),
  	]);
  
  	await activitypub.send('cid', cid, targets, {
  		id: `${object.id}#activity/update/${Date.now()}`,
  		type: 'Update',
  		actor: object.id,
  		to: [activitypub._constants.publicAddress],
  		cc: [],
  		object,
  	});
  });
  
  Out.update.note = enabledCheck(async (uid, post) => {
  	// Only applies to local posts
  	if (!utils.isNumber(post.pid)) {
  		return;
  	}
  
  	const object = await activitypub.mocks.notes.public(post);
  	const { to, cc, targets } = await activitypub.buildRecipients(object, { pid: post.pid, uid: post.user.uid });
  	object.to = to;
  	object.cc = cc;
  
  	const allowed = await privileges.posts.can('topics:read', post.pid, activitypub._constants.uid);
  	if (!allowed) {
  		activitypub.helpers.log(`[activitypub/api] Not federating update of pid ${post.pid} to the fediverse due to privileges.`);
  		return;
  	}
  
  	const payload = {
  		id: `${object.id}#activity/update/${post.edited || Date.now()}`,
  		type: 'Update',
  		actor: object.attributedTo,
  		to,
  		cc,
  		object,
  	};
  
  	await Promise.all([
  		activitypub.send('uid', uid, Array.from(targets), payload),
  		activitypub.feps.announce(post.pid, payload),
  	]);
  });
  
  Out.update.privateNote = enabledCheck(async (uid, messageObj) => {
  	if (!utils.isNumber(messageObj.mid)) {
  		return;
  	}
  
  	const { roomId } = messageObj;
  	let uids = await messaging.getUidsInRoom(roomId, 0, -1);
  	uids = uids.filter(uid => String(uid) !== String(messageObj.fromuid)); // no author
  	const to = uids.map(uid => (utils.isNumber(uid) ? `${nconf.get('url')}/uid/${uid}` : uid));
  	const targets = uids.filter(uid => !utils.isNumber(uid)); // remote uids only
  
  	const object = await activitypub.mocks.notes.private({ messageObj });
  
  	const payload = {
  		id: `${object.id}#activity/create/${Date.now()}`,
  		type: 'Update',
  		actor: object.attributedTo,
  		to,
  		object,
  	};
  
  	await activitypub.send('uid', uid, targets, payload);
  });
  
  Out.delete = {};
  
  Out.delete.note = enabledCheck(async (uid, pid) => {
  	// Only applies to local posts
  	if (!utils.isNumber(pid)) {
  		return;
  	}
  
  	const id = `${nconf.get('url')}/post/${pid}`;
  	const post = (await posts.getPostSummaryByPids([pid], uid, { stripTags: false })).pop();
  	const object = await activitypub.mocks.notes.public(post);
  	const { to, cc, targets } = await activitypub.buildRecipients(object, { pid, uid: post.user.uid });
  
  	const allowed = await privileges.posts.can('topics:read', pid, activitypub._constants.uid);
  	if (!allowed) {
  		activitypub.helpers.log(`[activitypub/api] Not federating update of pid ${pid} to the fediverse due to privileges.`);
  		return;
  	}
  
  	const payload = {
  		id: `${id}#activity/delete/${Date.now()}`,
  		type: 'Delete',
  		actor: object.attributedTo,
  		to,
  		cc,
  		object: id,
  		origin: object.context,
  	};
  
  	await Promise.all([
  		activitypub.send('uid', uid, Array.from(targets), payload),
  		activitypub.feps.announce(pid, payload),
  	]);
  });
  
  Out.like = {};
  
  Out.like.note = enabledCheck(async (uid, pid) => {
  	const payload = await activitypub.mocks.activities.like(pid, uid);
  
  	if (!activitypub.helpers.isUri(pid)) { // only 1b12 announce for local likes
  		await activitypub.feps.announce(pid, payload);
  		return;
  	}
  
  	const recipient = await posts.getPostField(pid, 'uid');
  	if (!activitypub.helpers.isUri(recipient)) {
  		return;
  	}
  
  	await Promise.all([
  		activitypub.send('uid', uid, [recipient], payload),
  		activitypub.feps.announce(pid, payload),
  	]);
  });
  
  Out.dislike = {};
  
  Out.dislike.note = enabledCheck(async (uid, pid) => {
  	const payload = activitypub.mocks.activities.dislike(pid, uid);
  
  	if (!activitypub.helpers.isUri(pid)) { // only 1b12 announce for local likes
  		await activitypub.feps.announce(pid, payload);
  		return;
  	}
  
  	const recipient = await posts.getPostField(pid, 'uid');
  	if (!activitypub.helpers.isUri(recipient)) {
  		return;
  	}
  
  	await Promise.all([
  		activitypub.send('uid', uid, [recipient], payload),
  		activitypub.feps.announce(pid, payload),
  	]);
  });
  
  Out.announce = {};
  
  Out.announce.topic = enabledCheck(async (tid, uid) => {
  	const { mainPid: pid, cid } = await topics.getTopicFields(tid, ['mainPid', 'cid']);
  
  	if (uid) {
  		const exists = await user.exists(uid);
  		if (!exists) {
  			return;
  		}
  	} else {
  		// Only local categories can announce
  		if (!utils.isNumber(cid) || parseInt(cid, 10) < 1) {
  			return;
  		}
  	}
  
  	const allowed = await privileges.posts.can('topics:read', pid, activitypub._constants.uid);
  	if (!allowed) {
  		activitypub.helpers.log(`[activitypub/api] Not federating announce of pid ${pid} to the fediverse due to privileges.`);
  		return;
  	}
  
  	const { activity, targets } = await activitypub.mocks.activities.announce(tid, uid);
  	await activitypub.send(uid ? 'uid' : 'cid', uid || cid, Array.from(targets), activity);
  });
  
  Out.flag = enabledCheck(async (uid, flag) => {
  	if (!activitypub.helpers.isUri(flag.targetId)) {
  		return;
  	}
  	const reportedIds = [flag.targetId];
  	if (flag.type === 'post' && activitypub.helpers.isUri(flag.targetUid)) {
  		reportedIds.push(flag.targetUid);
  	}
  	const reason = flag.reason ||
  		(flag.reports && flag.reports.filter(report => report.reporter.uid === uid).at(-1).value);
  	await activitypub.send('uid', uid, reportedIds, {
  		id: `${nconf.get('url')}/${flag.type}/${encodeURIComponent(flag.targetId)}#activity/flag/${uid}`,
  		type: 'Flag',
  		actor: `${nconf.get('url')}/uid/${uid}`,
  		object: reportedIds,
  		content: reason,
  	});
  	await db.sortedSetAdd(`flag:${flag.flagId}:remote`, Date.now(), uid);
  });
  
  Out.remove = {};
  
  Out.remove.context = enabledCheck(async (uid, tid) => {
  	// Federates Remove(Context); where Context is the tid
  	const now = new Date();
  	const cid = await topics.getTopicField(tid, 'oldCid');
  
  	// Only local categories
  	if (!utils.isNumber(cid) || parseInt(cid, 10) < 1) {
  		return;
  	}
  
  	const allowed = await privileges.categories.can('topics:read', cid, activitypub._constants.uid);
  	if (!allowed) {
  		activitypub.helpers.log(`[activitypub/api] Not federating deletion of tid ${tid} to the fediverse due to privileges.`);
  		return;
  	}
  
  	const { to, cc, targets } = await activitypub.buildRecipients({
  		to: [activitypub._constants.publicAddress],
  		cc: [],
  	}, { cid });
  
  	await activitypub.send('uid', uid, Array.from(targets), {
  		id: `${nconf.get('url')}/topic/${tid}#activity/remove/${now.getTime()}`,
  		type: 'Remove',
  		actor: `${nconf.get('url')}/uid/${uid}`,
  		to,
  		cc,
  		object: `${nconf.get('url')}/topic/${tid}`,
  		target: `${nconf.get('url')}/category/${cid}`,
  	});
  });
  
  Out.move = {};
  
  Out.move.context = enabledCheck(async (uid, tid) => {
  	// Federates Move(Context); where Context is the tid
  	const now = new Date();
  	const { cid, oldCid } = await topics.getTopicFields(tid, ['cid', 'oldCid']);
  
  	// This check may be revised if inter-community moderation becomes real.
  	const isLocal = id => utils.isNumber(id) && parseInt(id, 10) > 0;
  	if (isLocal(oldCid) && !isLocal(cid)) { // moving to remote/uncategorized
  		return Out.remove.context(uid, tid);
  	} else if (
  		(isLocal(cid) && !isLocal(oldCid)) || // stealing, or
  		[cid, oldCid].every(id => !isLocal(id)) // remote-to-remote
  	) {
  		return;
  	}
  
  	const allowed = await privileges.categories.can('topics:read', cid, activitypub._constants.uid);
  	if (!allowed) {
  		activitypub.helpers.log(`[activitypub/api] Not federating move of tid ${tid} to the fediverse due to privileges.`);
  		return;
  	}
  
  	const { to, cc, targets } = await activitypub.buildRecipients({
  		to: [activitypub._constants.publicAddress],
  		cc: [],
  	}, { cid: [cid, oldCid] });
  
  	await activitypub.send('uid', uid, Array.from(targets), {
  		id: `${nconf.get('url')}/topic/${tid}#activity/move/${now.getTime()}`,
  		type: 'Move',
  		actor: `${nconf.get('url')}/uid/${uid}`,
  		to,
  		cc,
  		object: `${nconf.get('url')}/topic/${tid}`,
  		origin: `${nconf.get('url')}/category/${oldCid}`,
  		target: `${nconf.get('url')}/category/${cid}`,
  	});
  });
  
  Out.undo = {};
  
  Out.undo.follow = enabledCheck(async (type, id, actor) => {
  	const acceptedTypes = ['uid', 'cid'];
  	const assertion = await activitypub.actors.assert(actor);
  	if (!acceptedTypes.includes(type) || !assertion) {
  		throw new Error('[[error:activitypub.invalid-id]]');
  	}
  
  	if (actor.includes('@')) {
  		const [uid, cid] = await Promise.all([
  			user.getUidByUserslug(actor),
  			categories.getCidByHandle(actor),
  		]);
  
  		actor = uid || cid;
  	}
  
  	const [isFollowing, isPending] = await Promise.all([
  		db.isSortedSetMember(type === 'uid' ? `followingRemote:${id}` : `cid:${id}:following`, actor),
  		db.isSortedSetMember(`followRequests:${type === 'uid' ? 'uid' : 'cid'}.${id}`, actor),
  	]);
  
  	if (!isFollowing && !isPending) { // already not following/pending
  		return;
  	}
  
  	const timestamps = await db.sortedSetsScore([
  		`followRequests:${type}.${id}`,
  		type === 'uid' ? `followingRemote:${id}` : `cid:${id}:following`,
  	], actor);
  	const timestamp = timestamps[0] || timestamps[1];
  
  	const object = {
  		id: `${nconf.get('url')}/${type}/${id}#activity/follow/${encodeURIComponent(actor)}/${timestamp}`,
  		type: 'Follow',
  		object: actor,
  	};
  	if (type === 'uid') {
  		object.actor = `${nconf.get('url')}/uid/${id}`;
  	} else if (type === 'cid') {
  		object.actor = `${nconf.get('url')}/category/${id}`;
  	}
  
  	await activitypub.send(type, id, [actor], {
  		id: `${nconf.get('url')}/${type}/${id}#activity/undo:follow/${encodeURIComponent(actor)}/${timestamp}`,
  		type: 'Undo',
  		actor: object.actor,
  		object,
  	});
  
  	if (type === 'uid') {
  		await Promise.all([
  			db.sortedSetRemove(`followingRemote:${id}`, actor),
  			db.sortedSetRemove(`followRequests:uid.${id}`, actor),
  			db.sortedSetRemove(`followersRemote:${actor}`, id),
  			user.syncFollowCounts(id, true, false),
  			user.syncFollowCounts(actor, false, true),
  		]);
  	} else if (type === 'cid') {
  		await Promise.all([
  			db.sortedSetRemove(`cid:${id}:following`, actor),
  			db.sortedSetRemove(`followRequests:cid.${id}`, actor),
  			db.sortedSetRemove(`followersRemote:${actor}`, `cid|${id}`),
  		]);
  	}
  	activitypub.actors._followerCache.del(actor);
  });
  
  Out.undo.like = enabledCheck(async (uid, pid) => {
  	if (!activitypub.helpers.isUri(pid)) {
  		return;
  	}
  
  	const author = await posts.getPostField(pid, 'uid');
  	if (!activitypub.helpers.isUri(author)) {
  		return;
  	}
  
  	const payload = {
  		id: `${nconf.get('url')}/uid/${uid}#activity/undo:like/${encodeURIComponent(pid)}/${Date.now()}`,
  		type: 'Undo',
  		actor: `${nconf.get('url')}/uid/${uid}`,
  		object: {
  			actor: `${nconf.get('url')}/uid/${uid}`,
  			id: `${nconf.get('url')}/uid/${uid}#activity/like/${encodeURIComponent(pid)}`,
  			type: 'Like',
  			object: pid,
  		},
  	};
  
  	await Promise.all([
  		activitypub.send('uid', uid, [author], payload),
  		activitypub.feps.announce(pid, payload),
  	]);
  });
  
  Out.undo.flag = enabledCheck(async (uid, flag) => {
  	if (!activitypub.helpers.isUri(flag.targetId)) {
  		return;
  	}
  	const reportedIds = [flag.targetId];
  	if (flag.type === 'post' && activitypub.helpers.isUri(flag.targetUid)) {
  		reportedIds.push(flag.targetUid);
  	}
  	const reason = flag.reason ||
  		(flag.reports && flag.reports.filter(report => report.reporter.uid === uid).at(-1).value);
  	await activitypub.send('uid', uid, reportedIds, {
  		id: `${nconf.get('url')}/${flag.type}/${encodeURIComponent(flag.targetId)}#activity/undo:flag/${uid}/${Date.now()}`,
  		type: 'Undo',
  		actor: `${nconf.get('url')}/uid/${uid}`,
  		object: {
  			id: `${nconf.get('url')}/${flag.type}/${encodeURIComponent(flag.targetId)}#activity/flag/${uid}`,
  			actor: `${nconf.get('url')}/uid/${uid}`,
  			type: 'Flag',
  			object: reportedIds,
  			content: reason,
  		},
  	});
  	await db.sortedSetRemove(`flag:${flag.flagId}:remote`, uid);
  });
  
  Out.undo.announce = enabledCheck(async (type, id, tid) => {
  	if (!utils.isNumber(id) || !['uid', 'cid'].includes(type)) {
  		throw new Error('[[error:invalid-data]]');
  	}
  
  	const exists = await Promise.all([
  		topics.exists(tid),
  		type === 'uid' ? user.exists(id) : categories.exists(id),
  	]);
  	if (!exists.every(Boolean)) {
  		throw new Error('[[error:invalid-data]]');
  	}
  
  	const baseUrl = `${nconf.get('url')}/${type === 'uid' ? 'uid' : 'category'}/${id}`;
  	const { uid, mainPid: pid } = await topics.getTopicFields(tid, ['uid', 'mainPid']);
  	const allowed = await privileges.topics.can('topics:read', tid, activitypub._constants.uid);
  	if (!allowed) {
  		activitypub.helpers.log(`[activitypub/api] Not federating announce of pid ${pid} to the fediverse due to privileges.`);
  		return;
  	}
  
  	const { to, cc, targets } = await activitypub.buildRecipients({
  		id: pid,
  		to: [activitypub._constants.publicAddress],
  		cc: [`${baseUrl}/followers`, uid],
  	}, {
  		uid: type === 'uid' && id,
  		cid: type === 'cid' && id,
  	});
  
  
  	// Just undo the announce.
  	await activitypub.send(type, id, Array.from(targets), {
  		id: `${nconf.get('url')}/post/${encodeURIComponent(pid)}#activity/undo:announce/${type}/${id}`,
  		type: 'Undo',
  		actor: baseUrl,
  		to,
  		cc,
  		object: {
  			id: `${nconf.get('url')}/post/${encodeURIComponent(pid)}#activity/announce/${type}/${id}`,
  			type: 'Announce',
  			actor: baseUrl,
  			to,
  			cc,
  			object: pid,
  		},
  	});
  });