From 32929f09096653ca07a669104de2a211e61ee047 Mon Sep 17 00:00:00 2001
From: alemi <me@alemi.dev>
Date: Wed, 3 Jul 2024 04:19:11 +0200
Subject: [PATCH] fix: include audience in outbox

this allows lemmy groups to work in current upub frontend without
changes, and it kind of makes sense as group broadcast everything they
do. however just doing it like this is unsafe: anyone could send me
stuff with audience "my_id" and have it be on my outbox, broadcasted by
me
---
 upub/routes/src/activitypub/actor/audience.rs | 2 +-
 upub/routes/src/activitypub/actor/mod.rs      | 2 +-
 upub/routes/src/activitypub/actor/outbox.rs   | 1 +
 upub/routes/src/activitypub/mod.rs            | 4 ++--
 4 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/upub/routes/src/activitypub/actor/audience.rs b/upub/routes/src/activitypub/actor/audience.rs
index 3aef4d8..d72c79c 100644
--- a/upub/routes/src/activitypub/actor/audience.rs
+++ b/upub/routes/src/activitypub/actor/audience.rs
@@ -3,7 +3,7 @@ use sea_orm::{Condition, ColumnTrait};
 
 use upub::Context;
 
-use crate::{activitypub::Pagination, builders::JsonLD, AuthIdentity, Identity};
+use crate::{activitypub::Pagination, builders::JsonLD, AuthIdentity};
 
 pub async fn get(
 	State(ctx): State<Context>,
diff --git a/upub/routes/src/activitypub/actor/mod.rs b/upub/routes/src/activitypub/actor/mod.rs
index 6f01d8b..83e185d 100644
--- a/upub/routes/src/activitypub/actor/mod.rs
+++ b/upub/routes/src/activitypub/actor/mod.rs
@@ -2,7 +2,7 @@ pub mod inbox;
 pub mod outbox;
 pub mod following;
 pub mod notifications;
-pub mod audience;
+// pub mod audience;
 
 use axum::extract::{Path, Query, State};
 
diff --git a/upub/routes/src/activitypub/actor/outbox.rs b/upub/routes/src/activitypub/actor/outbox.rs
index a0e062c..2a7c46c 100644
--- a/upub/routes/src/activitypub/actor/outbox.rs
+++ b/upub/routes/src/activitypub/actor/outbox.rs
@@ -24,6 +24,7 @@ pub async fn page(
 			Condition::any()
 				.add(model::activity::Column::Actor.eq(&uid))
 				.add(model::object::Column::AttributedTo.eq(&uid))
+				.add(model::object::Column::Audience.eq(&uid))
 		);
 	if !auth.is(&uid) {
 		filter = filter.add(auth.filter());
diff --git a/upub/routes/src/activitypub/mod.rs b/upub/routes/src/activitypub/mod.rs
index 7e08cb3..ad82650 100644
--- a/upub/routes/src/activitypub/mod.rs
+++ b/upub/routes/src/activitypub/mod.rs
@@ -55,8 +55,8 @@ impl ActivityPubRouter for Router<upub::Context> {
 			.route("/actors/:id/followers/page", get(ap::actor::following::page::<false>))
 			.route("/actors/:id/following", get(ap::actor::following::get::<true>))
 			.route("/actors/:id/following/page", get(ap::actor::following::page::<true>))
-			.route("/actors/:id/audience", get(ap::actor::audience::get))
-			.route("/actors/:id/audience/page", get(ap::actor::audience::page))
+			// .route("/actors/:id/audience", get(ap::actor::audience::get))
+			// .route("/actors/:id/audience/page", get(ap::actor::audience::page))
 			// activities
 			.route("/activities/:id", get(ap::activity::view))
 			// specific object routes