Fix: (Pixelfed) Follow (#1501)

* Fix: Pixelfed Follow

* fix test

* Add changelog

* cleanup other fields too

* Test that `set_to` will not be replaced by object if already set by activity

* improve tests

props @obenland

---------

Co-authored-by: Automattic Bot <sysops+ghmatticbot@automattic.com>

Author: pfefferle

.github/changelog/1501-from-description

@@ -0,0 +1,4 @@
+Significance: patch
+Type: fixed
+
+Properly set `to` audience of `Activity` instead of changing the `Follow` Object.

includes/activity/class-activity.php

@@ -148,7 +148,10 @@ public function set_object( $data ) {
 		}
 
 		foreach ( array( 'to', 'bto', 'cc', 'bcc', 'audience' ) as $i ) {
-			$this->set( $i, $data->get( $i ) );
+			$value = $data->get( $i );
+			if ( $value && ! $this->get( $i ) ) {
+				$this->set( $i, $value );
+			}
 		}
 
 		if ( $data->get_published() && ! $this->get_published() ) {
@@ -163,7 +166,7 @@ public function set_object( $data ) {
 			$this->set( 'actor', $data->get_attributed_to() );
 		}
 
-		if ( $data->get_in_reply_to() ) {
+		if ( $data->get_in_reply_to() && ! $this->get_in_reply_to() ) {
 			$this->set( 'in_reply_to', $data->get_in_reply_to() );
 		}
 

includes/handler/class-follow.php

@@ -8,6 +8,7 @@
 namespace Activitypub\Handler;
 
 use Activitypub\Notification;
+use Activitypub\Activity\Activity;
 use Activitypub\Collection\Actors;
 use Activitypub\Collection\Followers;
 
@@ -102,9 +103,12 @@ public static function queue_accept( $actor, $activity_object, $user_id, $follow
 			)
 		);
 
-		// Send response only to the Follower.
-		$activity_object['to'] = array( $actor );
+		$activity = new Activity();
+		$activity->set_type( 'Accept' );
+		$activity->set_actor( Actors::get_by_id( $user_id )->get_id() );
+		$activity->set_object( $activity_object );
+		$activity->set_to( array( $actor ) );
 
-		add_to_outbox( $activity_object, 'Accept', $user_id, ACTIVITYPUB_CONTENT_VISIBILITY_PRIVATE );
+		add_to_outbox( $activity, null, $user_id, ACTIVITYPUB_CONTENT_VISIBILITY_PRIVATE );
 	}
 }

tests/includes/activity/class-test-activity.php

@@ -8,6 +8,7 @@
 namespace Activitypub\Tests\Activity;
 
 use Activitypub\Activity\Activity;
+use Activitypub\Collection\Actors;
 use DMS\PHPUnitExtensions\ArraySubset\Assert;
 
 /**
@@ -132,4 +133,40 @@ public function test_activity_object_id() {
 
 		$this->assertTrue( str_starts_with( $activity->get_id(), 'https://example.com/author/123#activity-update-' ) );
 	}
+
+	/**
+	 * Test activity object.
+	 */
+	public function test_activity_object_in_reply_to() {
+		// Create user with `activitypub` capabilities.
+		$user_id = self::factory()->user->create(
+			array(
+				'role' => 'author',
+			)
+		);
+
+		// Only send minimal data.
+		$activity_object = array(
+			'id'     => 'https://example.com/post/123',
+			'type'   => 'Follow',
+			'actor'  => 'https://example.com/author/123',
+			'object' => 'https://example.com/post/123',
+			'to'     => array( 'https://example.com/author/123' ),
+		);
+
+		$activity = new Activity();
+		$activity->set_type( 'Accept' );
+		$activity->set_actor( Actors::get_by_id( $user_id )->get_id() );
+		$activity->set_object( $activity_object );
+
+		$this->assertContains( 'https://example.com/author/123', $activity->get_to() );
+
+		$activity->set_to( array( 'https://example.com/author/456' ) );
+		$activity->set_object( $activity_object );
+
+		$this->assertContains( 'https://example.com/author/456', $activity->get_to() );
+
+		// Delete user.
+		\wp_delete_user( $user_id );
+	}
 }

tests/includes/handler/class-test-follow.php

@@ -115,7 +115,7 @@ public function test_queue_accept() {
 
 		$this->assertEquals( 'Follow', $activity_json['object']['type'] );
 		$this->assertEquals( 'https://example.com/user/1', $activity_json['object']['object'] );
-		$this->assertEquals( array( $actor ), $activity_json['object']['to'] );
+		$this->assertEquals( array( $actor ), $activity_json['to'] );
 		$this->assertEquals( $actor, $activity_json['object']['actor'] );
 
 		// Clean up.