Skip to content

Accept Public aliases in incoming ActivityPub data#6466

Open
dahlia wants to merge 1 commit intoLemmyNet:mainfrom
dahlia:fix/public-addressing-aliases
Open

Accept Public aliases in incoming ActivityPub data#6466
dahlia wants to merge 1 commit intoLemmyNet:mainfrom
dahlia:fix/public-addressing-aliases

Conversation

@dahlia
Copy link
Copy Markdown

@dahlia dahlia commented Apr 22, 2026

Fixes #6465.

ActivityPub allows the public collection to be represented as the canonical IRI, as:Public, or Public. As described in #6465, Lemmy only handled the canonical form on some incoming paths.

This PR normalizes Public and as:Public to the canonical ActivityStreams public URL when deserializing incoming to and cc recipients. It applies that handling across incoming object and activity protocol structs, so the existing visibility checks continue to work without broader logic changes.

It also adds regression tests for post parsing and visibility, plus direct unit tests for the new deserialization helper.

Note

This patch was developed with assistance from GPT-5.4. I reviewed the final changes myself, verified the behavior locally, and ran the relevant tests before opening this PR.

@dahlia dahlia requested a review from Nutomic as a code owner April 22, 2026 02:20
@dahlia dahlia force-pushed the fix/public-addressing-aliases branch 2 times, most recently from eb02ca2 to f5e91c1 Compare April 22, 2026 02:29
Normalize `Public` and `as:Public` to the canonical
ActivityStreams public collection URL during recipient
deserialization.

Apply the helper across incoming `to` and `cc` fields in
ActivityPub object and activity protocol structs so existing
visibility checks accept all three spec-compliant public
representations.

Add regression tests for bare and prefixed public addressing,
and direct unit tests for the helper's single-value and array
forms.

Fixes LemmyNet#6465

Assisted-by: Codex:gpt-5.4
@dahlia dahlia force-pushed the fix/public-addressing-aliases branch from f5e91c1 to 6aa63a8 Compare April 22, 2026 03:49
@dahlia
Copy link
Copy Markdown
Author

dahlia commented Apr 22, 2026

@Nutomic run_federation_tests is failing on this PR with these two tests:

I checked Delete a post locally on this branch in the federation test setup, and it passed for me. The image proxy failure also seems unrelated, since this patch only touches incoming ActivityPub to/cc deserialization for Public/as:Public.

Would you mind taking a quick look and letting me know if these seem unrelated to this PR?

@Nutomic
Copy link
Copy Markdown
Member

Nutomic commented Apr 22, 2026

This makes sense! But instead of making the change here in Lemmy, it would be better to change it directly in the activitypub-federation library. Then it will also benefit other projects.

The test failures look unrelated, probably just random errors.

@dahlia
Copy link
Copy Markdown
Author

dahlia commented Apr 22, 2026

At first, I also thought I could solve this issue at the activitypub-federation library level, so I looked into it a bit. But honestly, I couldn't come up with a solution at all, so I ended up submitting this PR to Lemmy. If we were to solve this issue at the activitypub-federation library level, could you let me know how we should approach it?

@Nutomic
Copy link
Copy Markdown
Member

Nutomic commented Apr 22, 2026

Check the file I linked above. You can put the same code from your deserialize_public_aware_one_or_many() method into the existing deserialize_one_or_many(), and also the other methods in that file.

dahlia added a commit to dahlia/fedify-fork that referenced this pull request Apr 22, 2026
Replace the WARNING callout in *Making the community actor Lemmy-
compatible* that previously labelled outbound
`Announce(Create(Page))` as blocked by Lemmy's
`object_is_not_public` check.  Now that Fedify 2.2 serializes the
public audience as the full `https://www.w3.org/ns/activitystreams#Public`
URI (and Lemmy's upstream fix in [LemmyNet/lemmy#6466] is on the
way), the community's fan-out lands in subscribers' feeds on Lemmy,
and replies and votes ride the same path back.  Rewritten as a NOTE
with the historical context preserved so readers encountering older
Fedify or Lemmy versions can still diagnose the original symptom.

Also bump the `fedify --version` prerequisite from 2.1.0 to 2.2.0,
since that's the release that ships the sender-side workaround this
tutorial now relies on for the Lemmy walkthrough.

[LemmyNet/lemmy#6466]: LemmyNet/lemmy#6466

Assisted-By: Claude Code:claude-opus-4-7
@dahlia
Copy link
Copy Markdown
Author

dahlia commented Apr 22, 2026

Following the suggestion to move this into activitypub-federation, I opened a corresponding upstream PR here:

LemmyNet/activitypub-federation-rust#165

If that PR is merged, I can update this PR to use the upstream helper instead of keeping the deserialization logic locally.

@Nutomic
Copy link
Copy Markdown
Member

Nutomic commented Apr 22, 2026

Actually the easiest solution is to change this line and have it compare with other valid Public values too.

dahlia added a commit to dahlia/fedify-fork that referenced this pull request Apr 23, 2026
Replace the WARNING callout in *Making the community actor Lemmy-
compatible* that previously labelled outbound
`Announce(Create(Page))` as blocked by Lemmy's
`object_is_not_public` check.  Now that Fedify 2.2 serializes the
public audience as the full `https://www.w3.org/ns/activitystreams#Public`
URI (and Lemmy's upstream fix in [LemmyNet/lemmy#6466] is on the
way), the community's fan-out lands in subscribers' feeds on Lemmy,
and replies and votes ride the same path back.  Rewritten as a NOTE
with the historical context preserved so readers encountering older
Fedify or Lemmy versions can still diagnose the original symptom.

Also bump the `fedify --version` prerequisite from 2.1.0 to 2.2.0,
since that's the release that ships the sender-side workaround this
tutorial now relies on for the Lemmy walkthrough.

[LemmyNet/lemmy#6466]: LemmyNet/lemmy#6466

Assisted-By: Claude Code:claude-opus-4-7
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Accept all three ActivityPub §5.6 Public addressing representations

2 participants