附件上传限制

src/activitypub.ts

@@ -157,7 +157,9 @@ export async function outbox(request: Request, env: Env, username: string): Prom
   if (!user) return json({ error: "not_found" }, 404);
   const url = new URL(request.url);
   const wantsPage = url.searchParams.has("page");
-  const totalRow = await env.DB.prepare("SELECT COUNT(*) AS count FROM statuses WHERE user_id = ?").bind(user.id).first<{ count: number }>();
+  const totalRow = await env.DB.prepare(
+    "SELECT COUNT(*) AS count FROM statuses WHERE user_id = ? AND visibility IN ('public', 'unlisted')"
+  ).bind(user.id).first<{ count: number }>();
   const totalItems = totalRow?.count ?? 0;
   const base = `${actorUrl(env, user)}/outbox`;
 
@@ -172,7 +174,9 @@ export async function outbox(request: Request, env: Env, username: string): Prom
   }
 
   const limit = clampLimit(url.searchParams.get("limit"), 20, 40);
-  const rows = await env.DB.prepare("SELECT * FROM statuses WHERE user_id = ? ORDER BY created_at DESC LIMIT ?").bind(user.id, limit).all<Status>();
+  const rows = await env.DB.prepare(
+    "SELECT * FROM statuses WHERE user_id = ? AND visibility IN ('public', 'unlisted') ORDER BY created_at DESC LIMIT ?"
+  ).bind(user.id, limit).all<Status>();
   const items = rows.results.map((status) => createActivity(env, user, status));
   return activityJson({
     "@context": ACTIVITY_CONTEXT,
@@ -211,6 +215,7 @@ export async function followingCollection(env: Env, username: string): Promise<R
 export async function activityObject(env: Env, objectId: string): Promise<Response> {
   const status = await getStatus(env, objectId);
   if (status) {
+    if (status.visibility !== "public" && status.visibility !== "unlisted") return json({ error: "not_found" }, 404);
     const user = await env.DB.prepare("SELECT * FROM users WHERE id = ?").bind(status.user_id).first<User>();
     if (!user) return json({ error: "not_found" }, 404);
     return activityJson(noteObject(env, user, status));
@@ -513,8 +518,9 @@ async function localUserFromTarget(env: Env, actorId: string | null): Promise<Us
 }
 
 export function createActivity(env: Env, user: User, status: Status, extra: { to?: string[]; cc?: string[] } = {}): Json {
-  const to = extra.to ?? [PUBLIC_COLLECTION];
-  const cc = extra.cc ?? [`${actorUrl(env, user)}/followers`];
+  const audience = statusAudience(env, user, status);
+  const to = extra.to ?? audience.to;
+  const cc = extra.cc ?? audience.cc;
   return {
     "@context": [ACTIVITY_CONTEXT, SECURITY_CONTEXT],
     id: status.activity_id,
@@ -527,13 +533,28 @@ export function createActivity(env: Env, user: User, status: Status, extra: { to
   };
 }
 
-export function deleteActivity(env: Env, user: User, status: Status): Json {
+function statusAudience(env: Env, user: User, status: Status): { to: string[]; cc: string[] } {
+  if (status.visibility === "unlisted") {
+    return { to: [`${actorUrl(env, user)}/followers`], cc: [PUBLIC_COLLECTION] };
+  }
+  if (status.visibility === "private") {
+    return { to: [`${actorUrl(env, user)}/followers`], cc: [] };
+  }
+  if (status.visibility === "direct") {
+    return { to: [], cc: [] };
+  }
+  return { to: [PUBLIC_COLLECTION], cc: [`${actorUrl(env, user)}/followers`] };
+}
+
+export function deleteActivity(env: Env, user: User, status: Status, extra: { to?: string[]; cc?: string[] } = {}): Json {
+  const audience = statusAudience(env, user, status);
   return {
     "@context": [ACTIVITY_CONTEXT, SECURITY_CONTEXT],
     id: activityUrl(env, id()),
     type: "Delete",
     actor: actorUrl(env, user),
-    to: [PUBLIC_COLLECTION],
+    to: extra.to ?? audience.to,
+    cc: extra.cc ?? audience.cc,
     object: {
       id: status.object_id,
       type: "Tombstone"
@@ -596,6 +617,7 @@ export function updatePersonActivity(env: Env, user: User, doc: Json): Json {
 }
 
 export function noteObject(env: Env, user: User, status: Status, opts: { to?: string[]; cc?: string[]; attachments?: Json[]; tag?: Json[] } = {}): Json {
+  const audience = statusAudience(env, user, status);
   return {
     id: status.object_id,
     type: "Note",
@@ -606,8 +628,8 @@ export function noteObject(env: Env, user: User, status: Status, opts: { to?: st
     content: status.content,
     published: status.created_at,
     url: status.url,
-    to: opts.to ?? [PUBLIC_COLLECTION],
-    cc: opts.cc ?? [`${actorUrl(env, user)}/followers`],
+    to: opts.to ?? audience.to,
+    cc: opts.cc ?? audience.cc,
     attachment: opts.attachments ?? [],
     tag: opts.tag ?? []
   };