From 759d69e06c59255cf9ad8ef08a3704096e70f3dd Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Wed, 3 Jan 2024 13:54:17 -0500
Subject: [PATCH] fix: accept and undo logic saving improper id into database,
 updated follow logic so remote follow is not added to collection until an
 accept is received

---
 src/activitypub/inbox.js | 14 +++++++++-----
 src/api/activitypub.js   |  8 +-------
 2 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/src/activitypub/inbox.js b/src/activitypub/inbox.js
index 40f45f43d7..ac91ad239d 100644
--- a/src/activitypub/inbox.js
+++ b/src/activitypub/inbox.js
@@ -48,9 +48,11 @@ inbox.isFollowed = async (actorId, uid) => {
 };
 
 inbox.accept = async (req) => {
-	const { actor, object } = req.body;
+	let { actor, object } = req.body;
 	const { type } = object;
 
+	actor = await activitypub.getActor(actor);
+
 	if (type === 'Follow') {
 		// todo: should check that actor and object.actor are the same person?
 		const uid = await helpers.resolveLocalUid(object.actor);
@@ -60,25 +62,27 @@ inbox.accept = async (req) => {
 
 		const now = Date.now();
 		await Promise.all([
-			db.sortedSetAdd(`followingRemote:${uid}`, now, actor.name),
+			db.sortedSetAdd(`followingRemote:${uid}`, now, actor.id),
 			db.incrObjectField(`user:${uid}`, 'followingRemoteCount'),
 		]);
 	}
 };
 
 inbox.undo = async (req) => {
-	const { actor, object } = req.body;
+	let { actor, object } = req.body;
 	const { type } = object;
 
+	actor = await activitypub.getActor(actor);
+
 	if (type === 'Follow') {
 		// todo: should check that actor and object.actor are the same person?
-		const uid = await helpers.resolveLocalUid(object.actor);
+		const uid = await helpers.resolveLocalUid(object.object);
 		if (!uid) {
 			throw new Error('[[error:invalid-uid]]');
 		}
 
 		await Promise.all([
-			db.sortedSetRemove(`followingRemote:${uid}`, actor.name),
+			db.sortedSetRemove(`followingRemote:${uid}`, actor.id),
 			db.decrObjectField(`user:${uid}`, 'followingRemoteCount'),
 		]);
 	}
diff --git a/src/api/activitypub.js b/src/api/activitypub.js
index 22426b1f64..8e843b2857 100644
--- a/src/api/activitypub.js
+++ b/src/api/activitypub.js
@@ -26,12 +26,6 @@ activitypubApi.follow = async (caller, { actorId } = {}) => {
 		type: 'Follow',
 		object: object.id,
 	});
-
-	const now = Date.now();
-	await Promise.all([
-		db.sortedSetAdd(`followingRemote:${caller.uid}`, now, actorId),
-		db.incrObjectField(`user:${caller.uid}`, 'followingRemoteCount'),
-	]);
 };
 
 activitypubApi.unfollow = async (caller, { actorId }) => {
@@ -51,7 +45,7 @@ activitypubApi.unfollow = async (caller, { actorId }) => {
 	});
 
 	await Promise.all([
-		db.sortedSetRemove(`followingRemote:${caller.uid}`, actorId),
+		db.sortedSetRemove(`followingRemote:${caller.uid}`, object.id),
 		db.decrObjectField(`user:${caller.uid}`, 'followingRemoteCount'),
 	]);
 };