upub/routes/src/activitypub/activity.rs

@@ -25,7 +25,7 @@ pub async fn view(
 
 	let row = upub::Query::feed(auth.my_id())
 		.filter(model::activity::Column::Id.eq(&aid))
-		.filter(auth.filter())
+		.filter(auth.filter_activities())
 		.into_model::<RichActivity>()
 		.one(ctx.db())
 		.await?

upub/routes/src/activitypub/actor/outbox.rs

@@ -19,18 +19,14 @@ pub async fn page(
 	AuthIdentity(auth): AuthIdentity,
 ) -> crate::ApiResult<JsonLD<serde_json::Value>> {
 	let uid = ctx.uid(&id);
-	let mut filter = Condition::all()
-		.add(
-			Condition::any()
-				.add(model::activity::Column::Actor.eq(&uid))
-				.add(model::object::Column::AttributedTo.eq(&uid))
-		);
-	if !auth.is(&uid) {
-		filter = filter.add(auth.filter());
-	}
 	crate::builders::paginate_feed(
 		upub::url!(ctx, "/actors/{id}/outbox/page"),
-		filter,
+		Condition::all()
+			.add(auth.filter_activities())
+			.add(Condition::any()
+				.add(model::activity::Column::Actor.eq(&uid))
+				.add(model::object::Column::AttributedTo.eq(&uid))
+			),
 		ctx.db(),
 		page,
 		auth.my_id(),

upub/routes/src/activitypub/inbox.rs

@@ -21,7 +21,7 @@ pub async fn page(
 ) -> crate::ApiResult<JsonLD<serde_json::Value>> {
 	crate::builders::paginate_feed(
 		upub::url!(ctx, "/inbox/page"),
-		auth.filter(),
+		auth.filter_activities(),
 		ctx.db(),
 		page,
 		auth.my_id(),

upub/routes/src/activitypub/outbox.rs

@@ -16,7 +16,7 @@ pub async fn page(
 	crate::builders::paginate_feed(
 		upub::url!(ctx, "/outbox/page"),
 		Condition::all()
-			.add(auth.filter())
+			.add(auth.filter_activities())
 			.add(upub::model::actor::Column::Domain.eq(ctx.domain().to_string())),
 		ctx.db(),
 		page,

upub/routes/src/auth.rs

@@ -20,7 +20,7 @@ pub enum Identity {
 }
 
 impl Identity {
-	pub fn filter(&self) -> Condition {
+	pub fn filter_activities(&self) -> Condition {
 		let base_cond = Condition::any().add(upub::model::addressing::Column::Actor.is_null());
 		match self {
 			Identity::Anonymous => base_cond,
@@ -29,6 +29,18 @@ impl Identity {
 		}
 	}
 
+	pub fn filter_objects(&self) -> Condition {
+		let base_cond = Condition::any().add(upub::model::addressing::Column::Actor.is_null());
+		match self {
+			Identity::Anonymous => base_cond,
+			Identity::Remote { internal, .. } => base_cond.add(upub::model::addressing::Column::Instance.eq(*internal)),
+			// TODO should we allow all users on same server to see? or just specific user??
+			Identity::Local { id, internal } => base_cond
+				.add(upub::model::addressing::Column::Actor.eq(*internal))
+				.add(upub::model::object::Column::AttributedTo.eq(id)),
+		}
+	}
+
 	pub fn my_id(&self) -> Option<i64> {
 		match self {
 			Identity::Local { internal, .. } => Some(*internal),