From 32929f09096653ca07a669104de2a211e61ee047 Mon Sep 17 00:00:00 2001
From: alemi <me@alemi.dev>
Date: Wed, 3 Jul 2024 04:19:11 +0200
Subject: [PATCH] fix: include audience in outbox

this allows lemmy groups to work in current upub frontend without
changes, and it kind of makes sense as group broadcast everything they
do. however just doing it like this is unsafe: anyone could send me
stuff with audience "my_id" and have it be on my outbox, broadcasted by
me
---
 upub/routes/src/activitypub/actor/audience.rs | 2 +-
 upub/routes/src/activitypub/actor/mod.rs      | 2 +-
 upub/routes/src/activitypub/actor/outbox.rs   | 1 +
 upub/routes/src/activitypub/mod.rs            | 4 ++--
 4 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/upub/routes/src/activitypub/actor/audience.rs b/upub/routes/src/activitypub/actor/audience.rs
index 3aef4d8c..d72c79c8 100644
--- a/upub/routes/src/activitypub/actor/audience.rs
+++ b/upub/routes/src/activitypub/actor/audience.rs
@@ -3,7 +3,7 @@ use sea_orm::{Condition, ColumnTrait};
 
 use upub::Context;
 
-use crate::{activitypub::Pagination, builders::JsonLD, AuthIdentity, Identity};
+use crate::{activitypub::Pagination, builders::JsonLD, AuthIdentity};
 
 pub async fn get(
 	State(ctx): State<Context>,
diff --git a/upub/routes/src/activitypub/actor/mod.rs b/upub/routes/src/activitypub/actor/mod.rs
index 6f01d8b0..83e185da 100644
--- a/upub/routes/src/activitypub/actor/mod.rs
+++ b/upub/routes/src/activitypub/actor/mod.rs
@@ -2,7 +2,7 @@ pub mod inbox;
 pub mod outbox;
 pub mod following;
 pub mod notifications;
-pub mod audience;
+// pub mod audience;
 
 use axum::extract::{Path, Query, State};
 
diff --git a/upub/routes/src/activitypub/actor/outbox.rs b/upub/routes/src/activitypub/actor/outbox.rs
index a0e062cb..2a7c46c1 100644
--- a/upub/routes/src/activitypub/actor/outbox.rs
+++ b/upub/routes/src/activitypub/actor/outbox.rs
@@ -24,6 +24,7 @@ pub async fn page(
 			Condition::any()
 				.add(model::activity::Column::Actor.eq(&uid))
 				.add(model::object::Column::AttributedTo.eq(&uid))
+				.add(model::object::Column::Audience.eq(&uid))
 		);
 	if !auth.is(&uid) {
 		filter = filter.add(auth.filter());
diff --git a/upub/routes/src/activitypub/mod.rs b/upub/routes/src/activitypub/mod.rs
index 7e08cb37..ad82650b 100644
--- a/upub/routes/src/activitypub/mod.rs
+++ b/upub/routes/src/activitypub/mod.rs
@@ -55,8 +55,8 @@ impl ActivityPubRouter for Router<upub::Context> {
 			.route("/actors/:id/followers/page", get(ap::actor::following::page::<false>))
 			.route("/actors/:id/following", get(ap::actor::following::get::<true>))
 			.route("/actors/:id/following/page", get(ap::actor::following::page::<true>))
-			.route("/actors/:id/audience", get(ap::actor::audience::get))
-			.route("/actors/:id/audience/page", get(ap::actor::audience::page))
+			// .route("/actors/:id/audience", get(ap::actor::audience::get))
+			// .route("/actors/:id/audience/page", get(ap::actor::audience::page))
 			// activities
 			.route("/activities/:id", get(ap::activity::view))
 			// specific object routes