[bugfix] small editing tweaks (#3631)

* ensure edited_at isn't set on boost wrapper statuses

* improve handling of remote status updated_at to fix previous cases

* formatting

* add remote status published / updated field validation checks, handle appropriately in handleStatusEdit()

* specifically allowed updated to be equal to published

* only check creation date change when an existing status

2 files changed, 14 insertions, 5 deletions

diff --git a/internal/typeutils/astointernal.go b/internal/typeutils/astointernal.go
index 1a7098673..a473317ff 100644
--- a/internal/typeutils/astointernal.go
+++ b/internal/typeutils/astointernal.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"errors"
 	"net/url"
+	"time"
 
 	"github.com/miekg/dns"
 	"github.com/superseriousbusiness/gotosocial/internal/ap"
@@ -357,15 +358,21 @@ func (c *Converter) ASStatusToStatus(ctx context.Context, statusable ap.Statusab
 		status.CreatedAt = pub
 	} else {
 		log.Warnf(ctx, "unusable published property on %s", uri)
+		status.CreatedAt = time.Now()
 	}
 
 	// status.Updated
 	//
-	// Extract updated time for status, defaults to Published.
-	if upd := ap.GetUpdated(statusable); !upd.IsZero() {
+	// Extract and validate update time for status. Defaults to published.
+	if upd := ap.GetUpdated(statusable); !upd.Before(status.CreatedAt) {
 		status.UpdatedAt = upd
-	} else {
+	} else if upd.IsZero() {
 		status.UpdatedAt = status.CreatedAt
+	} else {
+
+		// This is a malformed status that will likely break our systems.
+		err := gtserror.Newf("status %s 'updated' predates 'published'", uri)
+		return nil, gtserror.SetMalformed(err)
 	}
 
 	// status.AccountURI
diff --git a/internal/typeutils/internaltofrontend.go b/internal/typeutils/internaltofrontend.go
index 3208fcb51..0d5e15078 100644
--- a/internal/typeutils/internaltofrontend.go
+++ b/internal/typeutils/internaltofrontend.go
@@ -1383,11 +1383,13 @@ func (c *Converter) baseStatusToFrontend(
 		InteractionPolicy:  *apiInteractionPolicy,
 	}
 
-	// Nullable fields.
-	if !s.UpdatedAt.Equal(s.CreatedAt) {
+	// Only set edited_at if this is a non-boost-wrapper
+	// with an updated_at date different to creation date.
+	if !s.UpdatedAt.Equal(s.CreatedAt) && s.BoostOfID == "" {
 		timestamp := util.FormatISO8601(s.UpdatedAt)
 		apiStatus.EditedAt = util.Ptr(timestamp)
 	}
+
 	apiStatus.InReplyToID = util.PtrIf(s.InReplyToID)
 	apiStatus.InReplyToAccountID = util.PtrIf(s.InReplyToAccountID)
 	apiStatus.Language = util.PtrIf(s.Language)