[feature] Support new model of interaction flow for forward compat with v0.21.0 (#4394)

~~Still WIP!~~

This PR allows v0.20.0 of GtS to be forward-compatible with the interaction request / authorization flow that will fully replace the current flow in v0.21.0.

Basically, this means we need to recognize LikeRequest, ReplyRequest, and AnnounceRequest, and in response to those requests, deliver either a Reject or an Accept, with the latter pointing towards a LikeAuthorization, ReplyAuthorization, or AnnounceAuthorization, respectively. This can then be used by the remote instance to prove to third parties that the interaction has been accepted by the interactee. These Authorization types need to be dereferencable to third parties, so we need to serve them.

As well as recognizing the above "polite" interaction request types, we also need to still serve appropriate responses to "impolite" interaction request types, where an instance that's unaware of interaction policies tries to interact with a post by sending a reply, like, or boost directly, without wrapping it in a WhateverRequest type.

Doesn't fully close https://codeberg.org/superseriousbusiness/gotosocial/issues/4026 but gets damn near (just gotta update the federating with GtS documentation).

Migrations tested on both Postgres and SQLite.

Co-authored-by: kim <grufwub@gmail.com>
Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4394
Co-authored-by: tobi <tobi.smethurst@protonmail.com>
Co-committed-by: tobi <tobi.smethurst@protonmail.com>

3 files changed, 114 insertions, 35 deletions

diff --git a/internal/processing/fedi/accept.go b/internal/processing/fedi/accept.go
index e63b460db..97e36fbb3 100644
--- a/internal/processing/fedi/accept.go
+++ b/internal/processing/fedi/accept.go
@@ -19,10 +19,8 @@ package fedi
 
 import (
 	"context"
-	"errors"
 
 	"code.superseriousbusiness.org/gotosocial/internal/ap"
-	"code.superseriousbusiness.org/gotosocial/internal/db"
 	"code.superseriousbusiness.org/gotosocial/internal/gtserror"
 )
 
@@ -34,44 +32,18 @@ import (
 func (p *Processor) AcceptGet(
 	ctx context.Context,
 	requestedUser string,
-	reqID string,
-) (interface{}, gtserror.WithCode) {
-	// Authenticate incoming request, getting related accounts.
-	auth, errWithCode := p.authenticate(ctx, requestedUser)
+	intReqID string,
+) (any, gtserror.WithCode) {
+	// Ensure valid request, intReq exists, etc.
+	intReq, errWithCode := p.validateIntReqRequest(ctx, requestedUser, intReqID)
 	if errWithCode != nil {
 		return nil, errWithCode
 	}
 
-	if auth.handshakingURI != nil {
-		// We're currently handshaking, which means
-		// we don't know this account yet. This should
-		// be a very rare race condition.
-		err := gtserror.Newf("network race handshaking %s", auth.handshakingURI)
-		return nil, gtserror.NewErrorInternalError(err)
-	}
-
-	receivingAcct := auth.receivingAcct
-
-	req, err := p.state.DB.GetInteractionRequestByID(ctx, reqID)
-	if err != nil && !errors.Is(err, db.ErrNoEntries) {
-		err := gtserror.Newf("db error getting interaction request %s: %w", reqID, err)
-		return nil, gtserror.NewErrorInternalError(err)
-	}
-
-	if req == nil || !req.IsAccepted() {
-		// Request doesn't exist or hasn't been accepted.
-		err := gtserror.Newf("interaction request %s not found", reqID)
-		return nil, gtserror.NewErrorNotFound(err)
-	}
-
-	if req.TargetAccountID != receivingAcct.ID {
-		const text = "interaction request does not belong to receiving account"
-		return nil, gtserror.NewErrorNotFound(errors.New(text))
-	}
-
-	accept, err := p.converter.InteractionReqToASAccept(ctx, req)
+	// Convert + serialize the Accept.
+	accept, err := p.converter.InteractionReqToASAccept(ctx, intReq)
 	if err != nil {
-		err := gtserror.Newf("error converting accept: %w", err)
+		err := gtserror.Newf("error converting to accept: %w", err)
 		return nil, gtserror.NewErrorInternalError(err)
 	}
 
diff --git a/internal/processing/fedi/authorization.go b/internal/processing/fedi/authorization.go
new file mode 100644
index 000000000..bbba6a2d8
--- /dev/null
+++ b/internal/processing/fedi/authorization.go
@@ -0,0 +1,57 @@
+// GoToSocial
+// Copyright (C) GoToSocial Authors admin@gotosocial.org
+// SPDX-License-Identifier: AGPL-3.0-or-later
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package fedi
+
+import (
+	"context"
+
+	"code.superseriousbusiness.org/gotosocial/internal/ap"
+	"code.superseriousbusiness.org/gotosocial/internal/gtserror"
+)
+
+// AuthorizationGet handles the getting of a fedi/activitypub
+// representation of a local interaction authorization.
+//
+// It performs appropriate authentication before
+// returning a JSON serializable interface.
+func (p *Processor) AuthorizationGet(
+	ctx context.Context,
+	requestedUser string,
+	intReqID string,
+) (any, gtserror.WithCode) {
+	// Ensure valid request, intReq exists, etc.
+	intReq, errWithCode := p.validateIntReqRequest(ctx, requestedUser, intReqID)
+	if errWithCode != nil {
+		return nil, errWithCode
+	}
+
+	// Convert + serialize the Authorization.
+	authorization, err := p.converter.InteractionReqToASAuthorization(ctx, intReq)
+	if err != nil {
+		err := gtserror.Newf("error converting to authorization: %w", err)
+		return nil, gtserror.NewErrorInternalError(err)
+	}
+
+	data, err := ap.Serialize(authorization)
+	if err != nil {
+		err := gtserror.Newf("error serializing accept: %w", err)
+		return nil, gtserror.NewErrorInternalError(err)
+	}
+
+	return data, nil
+}
diff --git a/internal/processing/fedi/common.go b/internal/processing/fedi/common.go
index 9059aef39..fc783f93e 100644
--- a/internal/processing/fedi/common.go
+++ b/internal/processing/fedi/common.go
@@ -20,6 +20,7 @@ package fedi
 import (
 	"context"
 	"errors"
+	"fmt"
 	"net/url"
 
 	"code.superseriousbusiness.org/gotosocial/internal/db"
@@ -81,3 +82,52 @@ func (p *Processor) authenticate(ctx context.Context, requestedUser string) (*co
 		receivingAcct:  receiver,
 	}, nil
 }
+
+// validateIntReqRequest is a shortcut function
+// for returning an accepted interaction request
+// targeting `requestedUser`.
+func (p *Processor) validateIntReqRequest(
+	ctx context.Context,
+	requestedUser string,
+	intReqID string,
+) (*gtsmodel.InteractionRequest, gtserror.WithCode) {
+	// Authenticate incoming request, getting related accounts.
+	auth, errWithCode := p.authenticate(ctx, requestedUser)
+	if errWithCode != nil {
+		return nil, errWithCode
+	}
+
+	if auth.handshakingURI != nil {
+		// We're currently handshaking, which means we don't know
+		// this account yet. This should be a very rare race condition.
+		err := gtserror.Newf("network race handshaking %s", auth.handshakingURI)
+		return nil, gtserror.NewErrorInternalError(err)
+	}
+
+	// Fetch interaction request with the given ID.
+	req, err := p.state.DB.GetInteractionRequestByID(ctx, intReqID)
+	if err != nil && !errors.Is(err, db.ErrNoEntries) {
+		err := gtserror.Newf("db error getting interaction request %s: %w", intReqID, err)
+		return nil, gtserror.NewErrorInternalError(err)
+	}
+
+	// Ensure that this is an existing
+	// and *accepted* interaction request.
+	if req == nil || !req.IsAccepted() {
+		const text = "interaction request not found"
+		return nil, gtserror.NewErrorNotFound(errors.New(text))
+	}
+
+	// Ensure interaction request was accepted
+	// by the account in the request path.
+	if req.TargetAccountID != auth.receivingAcct.ID {
+		text := fmt.Sprintf(
+			"account %s is not targeted by interaction request %s and therefore can't accept it",
+			requestedUser, intReqID,
+		)
+		return nil, gtserror.NewErrorNotFound(errors.New(text))
+	}
+
+	// All fine.
+	return req, nil
+}