Validate actor consistency for inbound Undo activities

src/db.integration.test.ts

@@ -18,11 +18,11 @@ describe('Timestamp Test', () => {
                 .timestamp('created_at', { precision: 6 })
                 .defaultTo(client.fn.now(6));
         });
+    });
 
-        afterAll(async () => {
-            await client.schema.dropTableIfExists(TEST_TABLE);
-            await client.destroy();
-        });
+    afterAll(async () => {
+        await client?.schema.dropTableIfExists(TEST_TABLE);
+        await client?.destroy();
     });
 
     it('should insert and return UTC timestamp', async () => {

src/dispatchers.ts

@@ -1,4 +1,4 @@
 /**
  * TODO: Break this file into separate class-based handlers/dispatchers
  * @see ADR-0005: Class-based architecture
  *
@@ -502,6 +502,16 @@
                 return;
             }
 
+            if (
+                !undo.actorId ||
+                undo.actorId.href !== follow.actorId.href
+            ) {
+                ctx.data.logger.warn(
+                    'Undo actor does not match Follow actor - exiting',
+                );
+                return;
+            }
+
             const [unfollower, unfollowing] = await Promise.all([
                 accountService.getAccountByApId(follow.actorId.href),
                 accountService.getAccountByApId(follow.objectId.href),
@@ -519,6 +529,17 @@
 
             await accountService.recordAccountUnfollow(unfollowing, unfollower);
         } else if (object instanceof Announce) {
+            if (
+                !undo.actorId ||
+                !object.actorId ||
+                undo.actorId.href !== object.actorId.href
+            ) {
+                ctx.data.logger.warn(
+                    'Undo actor does not match Announce actor - exiting',
+                );
+                return;
+            }
+
             const sender = await object.getActor(ctx);
             if (sender === null || sender.id === null) {
                 ctx.data.logger.debug(

src/dispatchers.unit.test.ts

@@ -1,7 +1,13 @@
+import {
+    type Actor,
+    Announce,
+    exportJwk,
+    Follow,
+    type RequestContext,
+    Undo,
+} from '@fedify/fedify';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
-import { exportJwk, type RequestContext } from '@fedify/fedify';
-
 import type { Account, AccountEntity } from '@/account/account.entity';
 import type { AccountService } from '@/account/account.service';
 import type { Account as AccountType } from '@/account/types';
@@ -20,12 +26,14 @@
     createFollowingDispatcher,
     createOutboxCounter,
     createOutboxDispatcher,
+    createUndoHandler,
     keypairDispatcher,
     likedDispatcher,
     nodeInfoDispatcher,
 } from '@/dispatchers';
 import type { HostDataContextLoader } from '@/http/host-data-context-loader';
 import { OutboxType, Post, PostType } from '@/post/post.entity';
+import type { KnexPostRepository } from '@/post/post.repository.knex';
 import type { PostService } from '@/post/post.service';
 import type { Site } from '@/site/site.service';
 import { generateTestCryptoKeyPair } from '@/test/crypto-key-pair';
@@ -70,6 +78,176 @@
         vi.clearAllMocks();
     });
 
+    describe('createUndoHandler', () => {
+        const attackerApId = new URL('https://evil.example/users/attacker');
+        const aliceApId = new URL('https://example.com/users/alice');
+        const ghostApId = new URL(
+            'https://ghost.example/.ghost/activitypub/users/index',
+        );
+        const postApId = new URL('https://ghost.example/post/123');
+
+        let accountService: AccountService;
+        let postRepository: KnexPostRepository;
+        let postService: PostService;
+        let undoCtx: FedifyContext;
+        let handler: ReturnType<typeof createUndoHandler>;
+        let aliceAccount: Account;
+        let ghostAccount: Account;
+
+        beforeEach(() => {
+            aliceAccount = {
+                id: 1,
+                apId: aliceApId,
+            } as Account;
+
+            ghostAccount = {
+                id: 2,
+                apId: ghostApId,
+            } as Account;
+
+            accountService = {
+                getAccountByApId: vi.fn(async (apId: string) => {
+                    if (apId === aliceApId.href) {
+                        return aliceAccount;
+                    }
+                    if (apId === ghostApId.href) {
+                        return ghostAccount;
+                    }
+                    return null;
+                }),
+                getByApId: vi.fn(async (apId: URL) => {
+                    if (apId.href === aliceApId.href) {
+                        return aliceAccount;
+                    }
+                    return null;
+                }),
+                recordAccountUnfollow: vi.fn(),
+            } as unknown as AccountService;
+
+            postRepository = {
+                save: vi.fn(),
+            } as unknown as KnexPostRepository;
+
+            postService = {
+                getByApId: vi.fn(),
+            } as unknown as PostService;
+
+            undoCtx = {
+                data: {
+                    logger: {
+                        debug: vi.fn(),
+                        warn: vi.fn(),
+                    },
+                    globaldb: {
+                        set: vi.fn(),
+                    },
+                },
+            } as unknown as FedifyContext;
+
+            handler = createUndoHandler(
+                accountService,
+                postRepository,
+                postService,
+            );
+        });
+
+        it('ignores Undo(Follow) when the outer actor does not match the Follow actor', async () => {
+            const follow = new Follow({
+                id: new URL('https://example.com/activities/follow'),
+                actor: aliceApId,
+                object: ghostApId,
+            });
+            const undo = new Undo({
+                id: new URL('https://evil.example/activities/undo'),
+                actor: attackerApId,
+                object: follow,
+            });
+
+            await handler(undoCtx, undo);
+
+            expect(accountService.getAccountByApId).not.toHaveBeenCalled();
+            expect(accountService.recordAccountUnfollow).not.toHaveBeenCalled();
+            expect(undoCtx.data.globaldb.set).not.toHaveBeenCalled();
+        });
+
+        it('processes Undo(Follow) when the outer actor matches the Follow actor', async () => {
+            const follow = new Follow({
+                id: new URL('https://example.com/activities/follow'),
+                actor: aliceApId,
+                object: ghostApId,
+            });
+            const undo = new Undo({
+                id: new URL('https://example.com/activities/undo'),
+                actor: aliceApId,
+                object: follow,
+            });
+
+            await handler(undoCtx, undo);
+
+            expect(accountService.getAccountByApId).toHaveBeenCalledWith(
+                aliceApId.href,
+            );
+            expect(accountService.getAccountByApId).toHaveBeenCalledWith(
+                ghostApId.href,
+            );
+            expect(undoCtx.data.globaldb.set).toHaveBeenCalledWith(
+                [undo.id?.href],
+                await undo.toJsonLd(),
+            );
+            expect(accountService.recordAccountUnfollow).toHaveBeenCalledWith(
+                ghostAccount,
+                aliceAccount,
+            );
+        });
+
+        it('ignores Undo(Announce) when the outer actor does not match the Announce actor', async () => {
+            const announce = new Announce({
+                id: new URL('https://example.com/activities/announce'),
+                actor: aliceApId,
+                object: postApId,
+            });
+            const undo = new Undo({
+                id: new URL('https://evil.example/activities/undo'),
+                actor: attackerApId,
+                object: announce,
+            });
+
+            await handler(undoCtx, undo);
+
+            expect(accountService.getByApId).not.toHaveBeenCalled();
+            expect(postService.getByApId).not.toHaveBeenCalled();
+            expect(postRepository.save).not.toHaveBeenCalled();
+        });
+
+        it('processes Undo(Announce) when the outer actor matches the Announce actor', async () => {
+            const announce = new Announce({
+                id: new URL('https://example.com/activities/announce'),
+                actor: aliceApId,
+                object: postApId,
+            });
+            vi.spyOn(announce, 'getActor').mockResolvedValue({
+                id: aliceApId,
+            } as Actor);
+            const undo = new Undo({
+                id: new URL('https://example.com/activities/undo'),
+                actor: aliceApId,
+                object: announce,
+            });
+            const post = {
+                removeRepost: vi.fn(),
+            } as unknown as Post;
+
+            vi.mocked(postService.getByApId).mockResolvedValue(ok(post));
+
+            await handler(undoCtx, undo);
+
+            expect(accountService.getByApId).toHaveBeenCalledWith(aliceApId);
+            expect(postService.getByApId).toHaveBeenCalledWith(postApId);
+            expect(post.removeRepost).toHaveBeenCalledWith(aliceAccount);
+            expect(postRepository.save).toHaveBeenCalledWith(post);
+        });
+    });
+
     describe('likedDispatcher', () => {
         it('returns an empty array', async () => {
             const ctx = {

src/ghost/ghost-post.service.integration.test.ts

@@ -102,7 +102,7 @@ describe('GhostPostService', () => {
 
     afterEach(async () => {
         // Clean up database connections
-        await db.destroy();
+        await db?.destroy();
     });
 
     describe('updateArticleFromGhostPost', () => {

src/http/api/views/blocks.view.integration.test.ts

@@ -21,7 +21,7 @@ describe('BlocksView', () => {
     });
 
     afterAll(async () => {
-        await db.destroy();
+        await db?.destroy();
     });
 
     describe('getBlockedAccounts', () => {

src/http/api/views/explore.view.integration.test.ts

@@ -23,7 +23,7 @@ describe('ExploreView', () => {
     });
 
     afterAll(async () => {
-        await db.destroy();
+        await db?.destroy();
     });
 
     describe('getAccountsInTopic', () => {

src/http/api/views/recommendations.view.integration.test.ts

@@ -22,7 +22,7 @@ describe('RecommendationsView', () => {
     });
 
     afterAll(async () => {
-        await db.destroy();
+        await db?.destroy();
     });
 
     describe('getRecommendations', () => {

src/http/api/views/topic.view.integration.test.ts

@@ -22,7 +22,7 @@ describe('TopicView', () => {
     });
 
     afterAll(async () => {
-        await db.destroy();
+        await db?.destroy();
     });
 
     describe('getTopics', () => {

src/post/post.service.integration.test.ts

@@ -142,7 +142,7 @@ describe('PostService', () => {
 
     afterEach(async () => {
         // Clean up database connections
-        await db.destroy();
+        await db?.destroy();
     });
 
     describe('createNote', () => {

vitest.config.ts

@@ -4,6 +4,9 @@ import { defineConfig } from 'vitest/config';
 export default defineConfig({
     plugins: [tsconfigPaths()],
     test: {
-        testTimeout: 1000 * 10,
+        testTimeout: 1000 * 30,
+        hookTimeout: 1000 * 60,
+        minWorkers: 1,
+        maxWorkers: 4,
     },
 });