remote AP assumes all actors have a corresponding following/followers collection

changed the description

changed title from Instance assumes all actors have a corresponding following collection to remote AP assumes all actors have a corresponding following collection

changed title from remote AP assumes all actors have a corresponding following collection to remote AP assumes all actors have a corresponding following/followers collection

Nice work! I've been annoyed by all those spammy logs.

Upstream was concerned about this because they caught it in their logs testing our security patches (I am assuming it has always been the case for them but since they were checking logs they noticed it). Perhaps we should tag @kakkokari-gtyih to see if upstream wants to fix this or if they'll accept a fix from us. (I am actually really happy that we're working together and I think it's sign of good faith for us to contribute upstream patches when we can assuming that it's not too complicated of a fix)

Anyway, the commands I used to confirm my suspicion (that the following/follower url was giving back an html response or no response)

curl -X GET -H 'Accept: application/activity+json' https://labyrinth.zone/internal/fetch/followers curl -X GET -H 'Accept: application/activity+json' https://labyrinth.zone/internal/fetch/following

(can be any akkoma instance, it's just this was an instance without a weird domain name. as you can see we are given an html page asking us to enable javascript)

At first I thought Akkoma was breaking spec, but knowing the fact that any time I assume things like that it blows up in my face I read through activitypub standards myself and found out we're breaking spec because of our assumption.

It gets more interesting. See, this bug report was under the assumption that misskey was at fault (i found it plausible that perhaps we append /following or /follower since they're common paths). I'm not sure if it's our end handling this case incorrectly. I am also not sure we do handle an actor without following/followers collection properly either (what happens after it fails? does the rest of the actor continue getting updated?). When doing curl -X GET -H 'Accept: application/activity+json' https://labyrinth.zone/internal/fetch I get the following response...

{
  "@context": [
    "https://www.w3.org/ns/activitystreams",
    "https://labyrinth.zone/schemas/litepub-0.1.jsonld",
    {
      "@language": "und"
    }
  ],
  "endpoints": {
    "oauthAuthorizationEndpoint": "https://labyrinth.zone/oauth/authorize",
    "oauthRegistrationEndpoint": "https://labyrinth.zone/api/v1/apps",
    "oauthTokenEndpoint": "https://labyrinth.zone/oauth/token",
    "sharedInbox": "https://labyrinth.zone/inbox"
  },
  "followers": "https://labyrinth.zone/internal/fetch/followers",
  "following": "https://labyrinth.zone/internal/fetch/following",
  "id": "https://labyrinth.zone/internal/fetch",
  "inbox": "https://labyrinth.zone/internal/fetch/inbox",
  "invisible": true,
  "manuallyApprovesFollowers": false,
  "name": "Pleroma",
  "outbox": "https://labyrinth.zone/internal/fetch/outbox",
  "preferredUsername": "internal.fetch",
  "publicKey": {
    "id": "https://labyrinth.zone/internal/fetch#main-key",
    "owner": "https://labyrinth.zone/internal/fetch",
    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAl61oi4/PA3A11g1tmPWa\nQ+dP6pb5TzjZPulBgwLDCn4zzUmkUj7TCtEyZfQ86XTccRHI/bFmQIfmu2oXETn2\nzt/npjdXQNhXpb9URU8vB58UeykaE+1SsV3i2uSTNyATfFX9VXnxiYHym5buDfh8\nQvlpNle9nHUAQ7Js+2B3yzy+Unh1Ff09bvU/1i+9N0/jz2/4PS37pR+TEN7nVjSL\n/A3L9Qx2uAkODWvK8HMwBiUy4nVN4shxRrdx8ZX+YClJRUDZBcgxA6k6WaXVsMXt\nrgDQwCKiF9q5BWxgarpz3NPDOwkJVPzOc+7hGACCK223hp2XetO8NXpufpLZfiT+\n+QIDAQAB\n-----END PUBLIC KEY-----\n\n"
  },
  "summary": "An internal service actor for this Pleroma instance.  No user-serviceable parts inside.",
  "type": "Application",
  "url": "https://labyrinth.zone/internal/fetch"
}

So... for some reason akkoma is specifying that the following and follower collections are on pages that do not exist? I'd need to double check the logic (is it only trying to resolve the collection because the actor contains the attributes, or does it do it anyway? What happens when we resolve an actor without those attributes would things break?). I'm keeping this issue open because there's a lot more questions than answers at this point.

And here we go. https://akkoma.dev/AkkomaGang/akkoma/issues/855

Okay, back to our side instead of akkoma. When enabling restricted visibility for followers/following

Misskey/Sharkey still actually includes the following/follower attributes. I set one of my accounts to have restricted follow visibility on an instance without authorized fetch. I got the following response after running the command curl -X GET -H 'Accept: application/activity+json' https://kitsunes.club/users/9y8o9tb53d

{
  "@context": [
    "https://www.w3.org/ns/activitystreams",
    "https://w3id.org/security/v1"
  ],
  "type": "Person",
  "id": "https://kitsunes.club/users/9y8o9tb53d",
  "inbox": "https://kitsunes.club/users/9y8o9tb53d/inbox",
  "outbox": "https://kitsunes.club/users/9y8o9tb53d/outbox",
  "followers": "https://kitsunes.club/users/9y8o9tb53d/followers",
  "following": "https://kitsunes.club/users/9y8o9tb53d/following",
  "featured": "https://kitsunes.club/users/9y8o9tb53d/collections/featured",
  "sharedInbox": "https://kitsunes.club/inbox",
  "endpoints": {
    "sharedInbox": "https://kitsunes.club/inbox"
  },
  "url": "https://kitsunes.club/@puppygirlhornypost2",
  "preferredUsername": "puppygirlhornypost2",
}

Note: this is stripped, but you can easily get the full object. What's interesting is that instead of straight up dropping "followers" "following" from the actor object we kinda just keep it there? And then of course making a request to https://kitsunes.club/users/9y8o9tb53d/followers gives you an empty body response. We handle empty body response fine for following/followers. I can attest to that, but I still have not ruled out what happens when it's "followers":null or not included at all. My head hurts already so I'm going to let other people do that part since I've done more than enough on this front.

Update to this, I found out that the bluesky bridge actually is a real world example of actors implementing NO following/follower collections. I can confirm that misskey handles this fine (at least for the bridge actors). I do not know what happens with "followers":null but I think it's safe to close this issue. I'll open it up if we need further discussion.

closed

remote AP assumes all actors have a corresponding following/followers collection

Designs

Child items ...

Activity