Commit Graph

19 Commits (staging)

Author SHA1 Message Date
Daniel Supernault 12a7c3ecfe
Fix AccountDelete federation 2 days ago
Daniel Supernault 56b96359c3
Fix fetching by properly retrying certain error responses 2 days ago
Daniel Supernault b6f30de378
Fix tests 3 days ago
Daniel Supernault e1f90b9704
Update tests 3 days ago
Daniel Supernault 80f792038c
Fix federation comment threading 4 days ago
Daniel Supernault 823efcaad7
Add FEP-044f: Consent-respecting quote posts 4 days ago
Daniel Supernault e3e5a05b47
Lint licker 5 days ago
Daniel Supernault dedfa67b70
Add FEP-8fcf followers collection synchronization
Sender: followers-only Create deliveries carry a signed
Collection-Synchronization header scoped to the authority of each inbox,
and the partial followers collection is served to authenticated instances
at /users/{username}/followers_synchronization.

Receiver: a signed Collection-Synchronization header whose digest differs
from our copy queues FollowersSyncPipeline, which fetches the partial
collection as the instance actor and reconciles followers, pending follow
requests and unknown follows.

Adds profiles.followers_url for the collectionId check.
5 days ago
Your Name 9b829ca56e Validate remote update attachments before detaching existing media 1 week ago
Your Name 68becbe2cc lint 2 weeks ago
Your Name 73fb5ed696 Fall back to stored profile when remote refresh fails 2 weeks ago
Your Name 0234a305ae Use intended-redirect session for authorize_interaction guest login 2 weeks ago
Shlee aa152372c9
Merge pull request #7121 from shleeable/fix/status-remote-update-ssrf
Harden remote status update media fetch against SSRF
2 weeks ago
Your Name 856f2f8f2d Harden remote status update media fetch against SSRF 2 weeks ago
Your Name 1905da723d Validate publicKey.id host on inbox actor ingest to prevent key_id poisoning 2 weeks ago
Your Name 0df4c7117d Add domain-mismatch metadata to Announce status fetch and stop noisy ERROR logs
storeStatus() now throws with JSON metadata (checked id/url hosts, expected
rule, and the full activity payload) when status domains mismatch. The Announce
inbox handler catches this, logs the context at debug level, and returns
gracefully instead of surfacing a full production ERROR stack trace.
3 weeks ago
Your Name 0d01d5a963 Fix duplicate-key violation when importing remote media attachments
Helpers::importNoteAttachment unconditionally inserted a new Media row per
attachment, so re-importing a remote status (an Announce racing another
inbox job, a re-fetch, or a duplicate url within one activity) hit the
media_status_id_media_path_unique constraint and crashed the queue job with
a 1062 UniqueConstraintViolationException, dropping the boost/import.

Make createMediaAttachment idempotent on (status_id, media_path): skip when
a row already exists, and catch the unique-constraint violation as a
lost-race no-op, returning null so the caller skips re-dispatching storage.

Adds regression tests (re-import no-op, distinct urls still stored,
concurrent-insert returns null).
4 weeks ago
Your Name c0cde2f682 refactor: move 52 legacy models from App\ to App\Models\
Move all Eloquent models from the app/ root directory to app/Models/
for consistency with modern Laravel conventions. The project already had
54 models in App\Models; this migrates the remaining 52 legacy models.

Changes:
- Move 52 model files from app/ to app/Models/
- Update namespace declarations in each model
- Update all ~1000 import references across the codebase
- Add Relation::morphMap() in AppServiceProvider for backward
  compatibility with existing polymorphic database records
- Add missing HasSnowflakePrimary imports for models that relied
  on same-namespace resolution
4 weeks ago
Your Name e1f883a41b test: add status, timeline, federation, and privacy tests (309 total)
Api/StatusTest: get/delete statuses, favourite/unfavourite, bookmark,
  status creation validation, ownership checks
Api/TimelineTest: public/home/hashtag timelines, private exclusion,
  pagination support
Federation/NodeInfoTest: nodeinfo, webfinger, host-meta endpoints
Account/PrivacyTest: private profile visibility, blocked user access,
  privacy settings toggle
4 weeks ago