From b7ff7be28ff008b67b0589ce2f8b463ec4123469 Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Mon, 15 Apr 2024 13:37:00 -0400
Subject: [PATCH] fix: actors.assert should return false if webfinger cannot
 resolve to an id

---
 src/activitypub/actors.js | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/activitypub/actors.js b/src/activitypub/actors.js
index 95ad08c852..5aa64ee1e8 100644
--- a/src/activitypub/actors.js
+++ b/src/activitypub/actors.js
@@ -20,8 +20,13 @@ Actors.assert = async (ids, options = {}) => {
 		ids = [ids];
 	}
 
+	// Existance in failure cache is automatic assertion failure
+	if (ids.some(id => failedWebfingerCache.has(id))) {
+		return false;
+	}
+
 	// Filter out uids if passed in
-	ids = ids.filter(id => !utils.isNumber(id) && !failedWebfingerCache.has(id));
+	ids = ids.filter(id => !utils.isNumber(id));
 
 	// Translate webfinger handles to uris
 	ids = (await Promise.all(ids.map(async (id) => {
@@ -38,7 +43,12 @@ Actors.assert = async (ids, options = {}) => {
 			failedWebfingerCache.set(originalId, true);
 		}
 		return id;
-	}))).filter(Boolean);
+	})));
+
+	// Webfinger failures = assertion failure
+	if (!ids.every(Boolean)) {
+		return false;
+	}
 
 	// Filter out loopback uris
 	ids = ids.filter((uri) => {