Federate community reports, and send report create/update/resolve activities to report creator's instance #5496

dullbananas · 2025-03-11T03:08:09Z

Closes #4897

…reports

…ject_id

…e or community, and add SiteOrCommunity::local_community

Nutomic · 2025-03-18T09:25:59Z

crates/apub/src/fetcher/report.rs

+      }
+    })
+  }
+}


You can directly use Either via get dependency in Cargo.toml:

activitypub_federation = { git = "https://github.com/LemmyNet/activitypub-federation-rust.git", branch = "object-either", default-features = false, features = [ "actix-web", ] }

Nutomic · 2025-03-18T09:32:55Z

crates/apub/src/activities/block/mod.rs

@@ -107,13 +107,57 @@ impl Object for SiteOrCommunity {
  }
 }

+impl Actor for SiteOrCommunity {


I also implemented Either for Actor.

Does that mean this should come after LemmyNet/activitypub-federation-rust#139, or that its just something to keep in mind.

I published those changes as 0.6.4 now.

https://github.com/LemmyNet/activitypub-federation-rust/releases/tag/0.6.4

dessalines · 2025-03-18T21:39:12Z

crates/apub/src/activities/block/mod.rs

@@ -107,13 +107,57 @@ impl Object for SiteOrCommunity {
  }
 }

+impl Actor for SiteOrCommunity {


Does that mean this should come after LemmyNet/activitypub-federation-rust#139, or that its just something to keep in mind.

dessalines · 2025-03-18T21:42:09Z

crates/apub/src/activities/mod.rs

+) -> LemmyResult<()> {
+  // admin action comes from the correct instance, so it was presumably done
+  // by an instance admin.
+  // TODO: federate instance admin status and check it here


So this would need to be skipped until we federate admins?

We currently assume that any user who is on the same instance as a user or community can perform admin actions on them. This is also in the existing code. It works fine because the remote Lemmy instance performs its own permission checks, and admin actions only federate for users/communities from the same instance.

dessalines · 2025-03-24T20:30:17Z

Just needs above comments addressed, and conflicts, then we can merge.

Nutomic · 2025-05-15T09:32:37Z

crates/apub/src/protocol/activities/community/report.rs

+  ) -> LemmyResult<Either<ApubSite, ApubCommunity>> {
+    let receiver = self.to[0].dereference(context).await?;
+    Ok(receiver)
+  }


Doesnt need a separate function.

crates/apub/src/protocol/activities/community/report.rs

Nutomic · 2025-05-15T09:34:35Z

crates/apub/src/activity_lists.rs

@@ -91,7 +91,7 @@ impl InCommunity for AnnouncableActivities {
      LockPost(a) => a.community(context).await,
      UndoLockPost(a) => a.community(context).await,
      Report(a) => a.community(context).await,
-      ResolveReport(a) => a.community(context).await,
+      ResolveReport(a) => a.object.community(context).await,


Good idea, we can probably remove InCommunity impls for all the Undo activities in this way too.

Might wanna make an issue for that so you don't forget.

Nutomic · 2025-05-15T09:37:19Z

crates/apub_objects/src/utils/functions.rs

+  let admin = admin_id.dereference(context).await?;
+  let local_user_view = LocalUserView::read_person(&mut context.pool(), admin.id).await?;
+  is_admin(&local_user_view)
+}


This function is only called once inside of verify_mod_or_admin_action so you can move the logic directly there.

Nutomic · 2025-05-15T09:37:57Z

crates/apub/src/activities/mod.rs

@@ -98,6 +102,17 @@ pub(crate) async fn verify_mod_action(
  .await
 }

+pub(crate) async fn verify_mod_or_admin_action(


Suggested change

pub(crate) async fn verify_mod_or_admin_action(

async fn verify_mod_or_admin_action(

Can also be moved down one level into community/mod.rs

Nutomic · 2025-05-15T09:40:49Z

crates/apub/src/activities/community/mod.rs

+  inboxes.add_inbox(report_creator_site.inbox_url.into());
+
+  Ok(inboxes)
+}


Dont see why this needs a new function, you can add the logic into report_inboxes

Nutomic · 2025-05-15T09:46:57Z

api_tests/src/community.spec.ts

+    ))! as CommunityReportView
+  ).community_report;
+  expect(resolvedReport).toBeDefined();
+  expect(resolvedReport.resolved).toBe(true);


If the community was not removed then the report should stay unresolved, right?

https://github.com/LemmyNet/lemmy/pull/5496/files#diff-59b565f03f82044908e9c09f294e4a28c6a7e32ef9894527ca70cb027ed0943dR377

For admins on the report creator's instance, that's close enough to what happens, because it stays in the unresolved reports list. But the updated resolved and resolver fields from the remote instance are preserved, so local admins can still see it.

So the report is still shown despite being resolved? How can admins hide it then without removing the community?

Resolving it again will remove it from the list, since the filter checks if the resolver is local.

That seems unintuitive. Besides the same reasoning could be applied to local reports for remote posts or comments. Its better to keep them all consistent, and make a separate issue/pull request to handle this case.

Co-authored-by: Nutomic <[email protected]>

dessalines · 2025-05-19T20:34:54Z

crates/db_views/report_combined/src/impls.rs

+      // if a local user reported a remote community, and the remote admin chose to not remove it,
+      // then maybe a local admin wants to do something about it (for example, remove the community
+      // locally, or block the instance)
+      resolver_is_local.or(community::removed),


I think this is the logic referred to above. We should probably remove this check, and not make special cases for community removals.

Either way this should be handled at the apub receiving the resolve report, and if its not sent, then its up to each site to resolve it on their own.

I changed it so reports to remote communities are never listed. Resolve from remote admin is still received, so a future PR can either use or overwrite the stored resolved status.

Opened issue #5697 also.

…reports

crates/apub/src/activities/community/mod.rs

Nutomic

Looks good, only a minor thing about using Either::right. I also restarted CI in case that was a random failure.

dessalines · 2025-05-20T15:03:50Z

crates/db_views/report_combined/src/impls.rs

+      // Hide reports of remote communities
+      query = query.filter(
+        report_combined::community_report_id
+          .is_null()
+          .or(community::local),


We aren't doing this for remote posts or comments, so I don't see why this should be a special case either.

If a federated community gets reported, and resolved, that should get sent out and received, then your below filter should work.

If it doesn't get resolved, then its up to each instance to decide what to do with it, just like comments and posts.

I got rid of this filter, so it should now be consistent with posts and comments.

…reports

dullbananas · 2025-05-22T21:16:10Z

If I understand the code correctly, the current behavior for resolve federation is to only send the resolve to the reporter's instance if the community of the reported post or comment has a moderator on the reporter's instance, and this has an effect on what admins see. That seems like a bug. In this PR, I changed the report_inboxes function so it unconditionally sends the resolve activity to the reporter's instance, so that more information is available to filters, which is required for implementing a filter that's similar to @Nothing4You's suggestion. Without changing the report query filters, this means that, in the list of unresolved reports, local admins will never see reports resolved by a remote admin, and I don't know if this is the correct behavior. This makes a difference for anything where filter_violates_instance_rules returns true.

dessalines · 2025-05-23T00:59:18Z

In this PR, I changed the report_inboxes function so it unconditionally sends the resolve activity to the reporter's instance, so that more information is available to filters, which is required for implementing a filter that's similar to @Nothing4You's suggestion

Without changing the report query filters, this means that, in the list of unresolved reports, local admins will never see reports resolved by a remote admin, and I don't know if this is the correct behavior. This makes a difference for anything where filter_violates_instance_rules returns true.

This is really complicated to think about...

The only possible attack I see here, is if a community adds a lot of federated mods to a troll instance, and admins there then just resolve every report no matter what. That could be an issue if its really bad content.

Isn't the main thing that we just need to be doing a community.local check for the item reported, both on send and receive? After that's done then it should be safe to send the resolutions out anyway.

Nutomic · 2025-05-23T08:30:50Z

Resolve actions are only accepted if they are sent by a mod or admin of the corresponding community/instance. This seems to be checked properly in verify.

The change in report_inboxes to send resolve actions to the original reporter also makes sense. In my opinion we can merge this, and if necessary make adjustments in separate PRs.

…reports

…ivities to report creator's instance (#5496) * add calls to submit_activity and use SiteOrCommunity * add send_activity imports * use separate CreateReportToSite and SendResolveReportToSite variants * fix api compile errors * allow apub Report struct to represent community report * change argument types of Report::new, Report::send, and report_inboxes * impl Object for ReportableObjects * impl Actor for SiteOrCommunity * change return types of ReportObject::dereference and ReportObject::object_id * Add verify_person_in_site_or_community * replace Report::community with Report::recipient to return either site or community, and add SiteOrCommunity::local_community * fix Report::receive * fix ResolveReport::send * fix ResolveReport * fix match_outgoing_activities * replace recipient with receiver * lint * update cargo.toml files * start removing new custom enums * Revert "start removing new custom enums" This reverts commit 8208c8a. * remove new trait impls on enums * change reportableobjects to type alias that uses either * fix fetcher::report * find and replace reportableobjects variant names * delete crates/utils/translations * remove uses of custom siteorcommunity enum * clippy * dont use separate module for reportableobjects * remove ResolveReport::reciever * replace match in activity_lists with Report::community * combine variants for community and site in SendActivityData enum * add reportCommunity function to shared.ts * fix rust errors * lint * change the condition for community reports when listing unresolved reports * update lemmy-js-client * fix pnpm-lock.yaml * api test * use same null check that's used elsewhere * federate report activities to report creator's instance * Apply suggestions from code review Co-authored-by: Nutomic <[email protected]> * remove report_remote_inboxes * remove Report::receiver * remove verify_admin_action * move verify_mod_or_admin_action * always hide reports of remote communities * refactor local_community * remove unconditional hiding of reports of remote communities --------- Co-authored-by: Nutomic <[email protected]>

dullbananas added 10 commits March 10, 2025 20:06

add calls to submit_activity and use SiteOrCommunity

d67cb19

Merge remote-tracking branch 'upstream/main' into federate-community-…

60203ac

…reports

add send_activity imports

97f9ba0

use separate CreateReportToSite and SendResolveReportToSite variants

eb46faa

Merge remote-tracking branch 'upstream/main' into federate-community-…

1699e17

…reports

fix api compile errors

8df24fb

allow apub Report struct to represent community report

580151c

Merge remote-tracking branch 'upstream/main' into federate-community-…

97ba710

…reports

change argument types of Report::new, Report::send, and report_inboxes

7b4604c

impl Object for ReportableObjects

9446e8a

dullbananas mentioned this pull request Mar 17, 2025

Use Either enum, instead of creating multiple enums and manually implementing traits for each one #5513

Closed

dullbananas added 10 commits March 16, 2025 20:24

impl Actor for SiteOrCommunity

b7ad063

change return types of ReportObject::dereference and ReportObject::ob…

2980197

…ject_id

Add verify_person_in_site_or_community

8561dd0

replace Report::community with Report::recipient to return either sit…

f2fa0ed

…e or community, and add SiteOrCommunity::local_community

fix Report::receive

8e18194

fix ResolveReport::send

43a671d

fix ResolveReport

bba0869

fix match_outgoing_activities

a851ffd

replace recipient with receiver

6c8c22f

lint

137e966

dullbananas marked this pull request as ready for review March 18, 2025 04:23

dullbananas requested review from Nutomic, dessalines, phiresky and SleeplessOne1917 as code owners March 18, 2025 04:23

Nutomic reviewed Mar 18, 2025

View reviewed changes

dessalines reviewed Mar 19, 2025

View reviewed changes

Nutomic reviewed May 15, 2025

View reviewed changes

crates/apub/src/protocol/activities/community/report.rs Outdated Show resolved Hide resolved

Nutomic reviewed May 15, 2025

View reviewed changes

dullbananas and others added 5 commits May 15, 2025 21:27

Apply suggestions from code review

8eabe3f

Co-authored-by: Nutomic <[email protected]>

remove report_remote_inboxes

3fd185d

remove Report::receiver

3403505

remove verify_admin_action

ed910c0

move verify_mod_or_admin_action

3289042

dessalines reviewed May 19, 2025

View reviewed changes

Merge remote-tracking branch 'upstream/main' into federate-community-…

628cd41

…reports

dullbananas mentioned this pull request May 20, 2025

Allow local admins to be involved for reports of remote communities #5697

Open

5 tasks

always hide reports of remote communities

3fc1350

Nutomic mentioned this pull request May 20, 2025

Remove unnecessary InCommunity impls for Undo activities #5700

Closed

Nutomic reviewed May 20, 2025

View reviewed changes

crates/apub/src/activities/community/mod.rs Show resolved Hide resolved

Nutomic approved these changes May 20, 2025

View reviewed changes

dessalines reviewed May 20, 2025

View reviewed changes

dullbananas added 3 commits May 22, 2025 11:32

Merge remote-tracking branch 'upstream/main' into federate-community-…

6258ea6

…reports

refactor local_community

93f4461

remove unconditional hiding of reports of remote communities

775f28c

Merge remote-tracking branch 'upstream/main' into federate-community-…

f78a36c

…reports

dessalines approved these changes May 27, 2025

View reviewed changes

dessalines merged commit cbf16c4 into LemmyNet:main May 27, 2025
1 check passed

	pub(crate) async fn verify_mod_or_admin_action(
	async fn verify_mod_or_admin_action(

Uh oh!

Federate community reports, and send report create/update/resolve activities to report creator's instance #5496

Federate community reports, and send report create/update/resolve activities to report creator's instance #5496

Uh oh!

Conversation

dullbananas commented Mar 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dessalines commented Mar 24, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dessalines May 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Nutomic left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dullbananas commented May 22, 2025

Uh oh!

dessalines commented May 23, 2025

Uh oh!

Nutomic commented May 23, 2025

Uh oh!

Uh oh!

Uh oh!

dullbananas commented Mar 11, 2025 •

edited

Loading

dessalines May 19, 2025 •

edited

Loading