Add hashing for activity ids by uOJackDu · Pull Request #6366 · LemmyNet/lemmy

uOJackDu · 2026-02-27T00:17:43Z

For issue #6341.

Add hashing for activity ids so that the ids of the activity objects do not change on every request.

uOJackDu · 2026-02-27T01:54:01Z


    let mut ordered_items = vec![];
    for post_view in post_views {
+      let post_ap_id = post_view.post.ap_id.clone();


This is the only place where I am passing in the object_id. I think it makes the ids for Announce and Create stable. Not sure where else I could use it.

Also needs to be in crates/apub/activities/src/create_or_update/post.rs so both code paths generate the same id.

Nutomic · 2026-02-27T13:56:58Z


    let create_or_update =
-      CreateOrUpdatePage::new(post.into(), &person, &community, kind, &context).await?;
+      CreateOrUpdatePage::new(post.into(), &person, &community, kind, None, &context).await?;


Suggested change

CreateOrUpdatePage::new(post.into(), &person, &community, kind, None, &context).await?;

CreateOrUpdatePage::new(post.into(), &person, &community, kind, Some(post.ap_id), &context).await?;

Actually this can be a problem when editing the post, then each Update activity will have the same id. So you also need to hash the timestamp (published_at or updated_at).

Nutomic · 2026-02-27T13:59:48Z

      .into();

-    let id = generate_activity_id(kind.clone(), &context)?;
+    let id = generate_activity_id(kind.clone(), None, &context)?;


Suggested change

let id = generate_activity_id(kind.clone(), None, &context)?;

let id = generate_activity_id(kind.clone(), Some(comment.ap_id), &context)?;

Do we need to use the timestamps here for Update as well?

Nutomic · 2026-02-27T14:01:25Z

 /// Generate a unique ID for an activity, in the format:
 /// `http(s)://example.com/receive/create/202daf0a-1489-45df-8d2e-c8a3173fed36`
-fn generate_activity_id<T>(kind: T, context: &LemmyContext) -> Result<Url, ParseError>
+fn generate_activity_id<T>(


To avoid passing None in so many places, you could do:

fn generate_activity_id_with_object_id(kind, context) { generate_activity_id(kind, None, context) } fn generate_activity_id(kind, object_id, context) { generate_activity_id(kind, context) }

dessalines · 2026-03-02T21:15:44Z

What is the minimum amount of info needed to create uniqueness for these generated ap_ids?

Seems like kind/action, numeric_object_id should be enough right?

Nutomic · 2026-03-03T10:35:55Z

That is not enough, because if you edit a post, it is federated as Update<Page> activity each time. So the kind and object id will be identical every time, but the generated ap_id must be different (otherwise it will be ignored as duplicate on the receiving side). So the object created_at/updated_at timestamp also needs to go into the hash.

dessalines · 2026-04-06T13:56:23Z

Bump on this to address the comments above. As stated you'll probably need to hash the object id as well as the published / updated time.

uOJackDu · 2026-04-07T19:01:02Z

Hi, should we use timestamps for Update comments as well? Or it's not needed since I don't see any comment-related actions when making a request to the outbox of a community?
I don't see any update activities showing up in the outbox either, but we still use hashed timestamps to ensure they are unique, so just wanna know if we should do that for comments or other objects as well.

uOJackDu · 2026-04-08T01:43:41Z

  ) -> LemmyResult<()> {
-    let announce = AnnounceActivity::new(object.clone(), community, context)?;
+    let announce = AnnounceActivity::new(object.clone(), community, None, context)?;
    let inboxes = ActivitySendTargets::to_local_community_followers(community.id);


Are we sure we want the activity id for Announce activities to be the hash in the outbox, and a random UUID in the sent_activity table? For Create activities, both are the same.

The same activity must always have the same ID.

Nutomic · 2026-04-13T10:10:17Z

+      .get(..16) // should not fail
+      .ok_or(UntranslatedError::CouldntGenerateHash)?
+      .try_into()?,
+  ))


You dont really need a Uuid but can return digest.to_string() and probably get rid of this new error. Also move this code inline as the method is only called in a single place.

Nutomic · 2026-04-13T10:11:31Z

+  };
+
+  let id = format!("{}/activities/{}/{}", hostname, kind_str, uuid);
+  Url::parse(&id).map_err(|e| LemmyError::from(anyhow::anyhow!(e)))


Suggested change

Url::parse(&id).map_err(|e| LemmyError::from(anyhow::anyhow!(e)))

Ok(Url::parse(&id)?)

Nutomic · 2026-04-13T10:21:23Z

+        seed_url.set_fragment(Some(&timestamp.to_rfc3339()));
+        Some(&seed_url.clone())
+      }
+    };


Private message also needs the same logic. Best generate_activity_id() to take an optional timestamp param (or make a separate method), to avoid duplicate code. Theres nothing wrong with hashing the timestamp for create activities as well so it will be simpler.

And you dont need to change anything in this file, it only needs to be in CreateOrUpdatePage::new

dessalines · 2026-04-16T13:50:38Z

+        let timestamp = comment.updated_at.unwrap_or(comment.published_at); // use the latest timestamp
+        let mut seed_url = ap_id;
+        seed_url.set_fragment(Some(&timestamp.to_rfc3339()));


Doesn't need to be in this PR, but these things should be trait functions.

Actors have a ApubActor trait, which defines functions like generate_local_actor_url, read_from_name, etc.

There's no reason why that couldn't also be done for the other types, and activities on them also.

uOJackDu commented Feb 27, 2026

View reviewed changes

uOJackDu marked this pull request as ready for review February 27, 2026 09:10

uOJackDu requested review from Nutomic, SleeplessOne1917, dessalines, dullbananas and phiresky as code owners February 27, 2026 09:10

Nutomic reviewed Feb 27, 2026

View reviewed changes

Comment thread crates/apub/activities/Cargo.toml Outdated

Nutomic reviewed Feb 27, 2026

View reviewed changes

Comment thread crates/apub/activities/src/lib.rs Outdated

Nutomic reviewed Feb 27, 2026

View reviewed changes

uOJackDu added 5 commits March 28, 2026 20:24

add md5 hashing for generate_announce_activity_id

7cf9223

modify parameter order

36f48fe

add md5 hashing to generate_activity_id

b4bab81

modify object_id type

a9f4195

remove as_bytes calls on input string when hashing

91f043f

uOJackDu force-pushed the outbox-activity-id branch from 18c6db2 to 91f043f Compare March 29, 2026 00:29

modify object_id type from str to url

b6a25e9

ensure unique activity ids for posts for Create and Update

0a619de

uOJackDu commented Apr 8, 2026

View reviewed changes

uOJackDu and others added 5 commits April 8, 2026 00:20

switch to sha2 for hashing

99d0782

change hashing input format to adhere to the issue

5ae79aa

add comment

ef854ef

edit comments

73db584

Merge branch 'main' into outbox-activity-id

f2d4584

uOJackDu and others added 4 commits April 10, 2026 02:13

ensure unique activity ids for comments for Create and Update

5a72720

modify naming

de6b70c

Merge branch 'main' into outbox-activity-id

2205372

add convenient function

b7ac661

Nutomic reviewed Apr 13, 2026

View reviewed changes

dessalines reviewed Apr 16, 2026

View reviewed changes

uOJackDu added 2 commits April 17, 2026 20:34

modify hashing to use digest to string directly

f1b062f

use timestamps for create activities

3195399

	CreateOrUpdatePage::new(post.into(), &person, &community, kind, None, &context).await?;
	CreateOrUpdatePage::new(post.into(), &person, &community, kind, Some(post.ap_id), &context).await?;

	let id = generate_activity_id(kind.clone(), None, &context)?;
	let id = generate_activity_id(kind.clone(), Some(comment.ap_id), &context)?;

	Url::parse(&id).map_err(\|e\| LemmyError::from(anyhow::anyhow!(e)))
	Ok(Url::parse(&id)?)

Uh oh!

Conversation

uOJackDu commented Feb 27, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dessalines commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Nutomic commented Mar 3, 2026

Uh oh!

dessalines commented Apr 6, 2026

Uh oh!

uOJackDu commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

uOJackDu Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dessalines commented Mar 2, 2026 •

edited

Loading

uOJackDu commented Apr 7, 2026 •

edited

Loading

uOJackDu Apr 8, 2026 •

edited

Loading