Shared-Inbox: Add support for public activity delivery to all users (#2349)

Author: pfefferle

.github/changelog/2349-from-description

@@ -0,0 +1,4 @@
+Significance: minor
+Type: changed
+
+Improved delivery of public and follower activities by expanding local recipient handling to include all ActivityPub-capable users and follower collections.

includes/collection/class-actors.php

@@ -370,38 +370,45 @@ public static function get_collection() {
 	/**
 	 * Get all active actors, including the Blog actor if enabled.
 	 *
-	 * @return array Array of User and Blog actor objects.
+	 * @return int[] Array of User and Blog actor IDs.
 	 */
-	public static function get_all() {
-		$return = array();
+	public static function get_all_ids() {
+		$user_ids = array();
 
 		if ( ! is_user_type_disabled( 'user' ) ) {
-			$users = \get_users(
+			$user_ids = \get_users(
 				array(
+					'fields'         => 'ID',
 					'capability__in' => array( 'activitypub' ),
 				)
 			);
-
-			foreach ( $users as $user ) {
-				$actor = User::from_wp_user( $user->ID );
-
-				if ( \is_wp_error( $actor ) ) {
-					continue;
-				}
-
-				$return[] = $actor;
-			}
 		}
 
 		// Also include the blog actor if active.
 		if ( ! is_user_type_disabled( 'blog' ) ) {
-			$blog_actor = self::get_by_id( self::BLOG_USER_ID );
-			if ( ! \is_wp_error( $blog_actor ) ) {
-				$return[] = $blog_actor;
-			}
+			$user_ids[] = self::BLOG_USER_ID;
 		}
 
-		return $return;
+		return array_map( 'intval', $user_ids );
+	}
+
+	/**
+	 * Get all active actors, including the Blog actor if enabled.
+	 *
+	 * @return Actor[] Array of User and Blog actor objects.
+	 */
+	public static function get_all() {
+		$user_ids = self::get_all_ids();
+
+		$actors = array_map( array( self::class, 'get_by_id' ), $user_ids );
+
+		// Filter out any WP_Error instances.
+		return array_filter(
+			$actors,
+			function ( $actor ) {
+				return ! \is_wp_error( $actor );
+			}
+		);
 	}
 
 	/**

includes/collection/class-following.php

@@ -419,6 +419,27 @@ public static function check_status( $user_id, $post_id ) {
 		return false;
 	}
 
+	/**
+	 * Get local user IDs following a given remote actor.
+	 *
+	 * @param string $actor_url The actor URL.
+	 *
+	 * @return int[] List of local user IDs following the actor.
+	 */
+	public static function get_follower_ids( $actor_url ) {
+		$actor = Remote_Actors::get_by_uri( $actor_url );
+		if ( \is_wp_error( $actor ) ) {
+			return array();
+		}
+
+		$user_ids = \get_post_meta( $actor->ID, self::FOLLOWING_META_KEY, false );
+		if ( ! is_array( $user_ids ) || empty( $user_ids ) ) {
+			return array();
+		}
+
+		return array_map( 'intval', $user_ids );
+	}
+
 	/**
 	 * Remove blocked actors from following list.
 	 *

includes/functions.php

@@ -1712,6 +1712,26 @@ function is_actor( $data ) {
 	return _is_type_of( $data, $types );
 }
 
+/**
+ * Check if an `$data` is a Collection.
+ *
+ * @see https://www.w3.org/ns/activitystreams#collections
+ *
+ * @param array|object|string $data The data to check.
+ *
+ * @return boolean True if the `$data` is a Collection, false otherwise.
+ */
+function is_collection( $data ) {
+	/**
+	 * Filters the collection types.
+	 *
+	 * @param array $types The collection types.
+	 */
+	$types = apply_filters( 'activitypub_collection_types', array( 'Collection', 'OrderedCollection', 'CollectionPage', 'OrderedCollectionPage' ) );
+
+	return _is_type_of( $data, $types );
+}
+
 /**
  * Private helper to check if $data is of a given type set.
  *

includes/rest/class-inbox-controller.php

@@ -9,10 +9,14 @@
 
 use Activitypub\Activity\Activity;
 use Activitypub\Collection\Actors;
+use Activitypub\Collection\Following;
+use Activitypub\Http;
 use Activitypub\Moderation;
 
 use function Activitypub\camel_to_snake_case;
 use function Activitypub\extract_recipients_from_activity;
+use function Activitypub\is_activity_public;
+use function Activitypub\is_collection;
 use function Activitypub\is_same_domain;
 use function Activitypub\user_can_activitypub;
 
@@ -284,13 +288,29 @@ public function get_item_schema() {
 	 * @return array An array of user IDs who are the recipients of the activity.
 	 */
 	private function get_local_recipients( $activity ) {
+		// Public activity, deliver to all local ActivityPub users.
+		if ( is_activity_public( $activity ) ) {
+			return Actors::get_all_ids();
+		}
+
 		$recipients = extract_recipients_from_activity( $activity );
 		$user_ids   = array();
 
 		foreach ( $recipients as $recipient ) {
 
 			if ( ! is_same_domain( $recipient ) ) {
-				continue;
+				$collection = Http::get_remote_object( $recipient );
+
+				// If it is a remote actor we can skip it.
+				if ( \is_wp_error( $collection ) ) {
+					continue;
+				}
+
+				if ( is_collection( $collection ) ) {
+					$_user_ids = Following::get_follower_ids( $activity['actor'] );
+					$user_ids  = array_merge( $user_ids, $_user_ids );
+					continue;
+				}
 			}
 
 			$user_id = Actors::get_id_by_resource( $recipient );
@@ -306,6 +326,6 @@ private function get_local_recipients( $activity ) {
 			$user_ids[] = $user_id;
 		}
 
-		return $user_ids;
+		return array_unique( array_map( 'intval', $user_ids ) );
 	}
 }

tests/phpunit/tests/includes/collection/class-test-following.php

@@ -441,6 +441,49 @@ public function test_unfollow() {
 		$this->assertCount( 1, $posts );
 	}
 
+	/**
+	 * Test get_follower_ids method.
+	 *
+	 * @covers ::get_follower_ids
+	 */
+	public function test_get_follower_ids() {
+		\add_filter( 'activitypub_pre_http_get_remote_object', array( $this, 'mock_remote_actor' ), 10, 2 );
+
+		// Create a remote actor by fetching (which will use the mock).
+		$remote_actor = Remote_Actors::fetch_by_uri( 'https://example.com/actor/1' );
+		$this->assertNotWPError( $remote_actor );
+
+		// Test with no followers.
+		$user_ids = Following::get_follower_ids( 'https://example.com/actor/1' );
+		$this->assertIsArray( $user_ids );
+		$this->assertEmpty( $user_ids );
+
+		// Add some followers.
+		$user_id_1 = 1;
+		$user_id_2 = 2;
+		$user_id_3 = 3;
+
+		\add_post_meta( $remote_actor->ID, Following::FOLLOWING_META_KEY, $user_id_1 );
+		\add_post_meta( $remote_actor->ID, Following::FOLLOWING_META_KEY, $user_id_2 );
+		\add_post_meta( $remote_actor->ID, Following::FOLLOWING_META_KEY, $user_id_3 );
+
+		// Get user IDs.
+		$user_ids = Following::get_follower_ids( 'https://example.com/actor/1' );
+		$this->assertIsArray( $user_ids );
+		$this->assertCount( 3, $user_ids );
+		$this->assertContains( $user_id_1, $user_ids );
+		$this->assertContains( $user_id_2, $user_ids );
+		$this->assertContains( $user_id_3, $user_ids );
+
+		// Test with non-existent actor URL.
+		$user_ids = Following::get_follower_ids( 'https://example.com/actor/nonexistent' );
+		$this->assertIsArray( $user_ids );
+		$this->assertEmpty( $user_ids );
+
+		\wp_delete_post( $remote_actor->ID );
+		\remove_filter( 'activitypub_pre_http_get_remote_object', array( $this, 'mock_remote_actor' ) );
+	}
+
 	/**
 	 * Mock remote actor.
 	 *

tests/phpunit/tests/includes/rest/class-test-inbox-controller.php

@@ -542,4 +542,158 @@ public function test_get_local_recipients_with_malformed_urls() {
 		$result = $method->invoke( $this->inbox_controller, $activity );
 		$this->assertEmpty( $result, 'Should handle malformed URLs gracefully' );
 	}
+
+	/**
+	 * Test get_local_recipients with public activity.
+	 *
+	 * @covers ::get_local_recipients
+	 */
+	public function test_get_local_recipients_public_activity() {
+		// Enable actor mode to allow user actors.
+		\update_option( 'activitypub_actor_mode', ACTIVITYPUB_ACTOR_MODE );
+
+		// Create additional test users (authors have activitypub capability by default).
+		$user_id_1 = self::factory()->user->create( array( 'role' => 'author' ) );
+		$user_id_2 = self::factory()->user->create( array( 'role' => 'author' ) );
+		$user_id_3 = self::factory()->user->create( array( 'role' => 'editor' ) );
+
+		// Create a remote actor and make our users follow them.
+		$remote_actor_url = 'https://example.com/actor/1';
+
+		// Mock the remote actor fetch.
+		\add_filter(
+			'activitypub_pre_http_get_remote_object',
+			function ( $pre, $url ) use ( $remote_actor_url ) {
+				if ( $url === $remote_actor_url ) {
+					return array(
+						'@context'          => 'https://www.w3.org/ns/activitystreams',
+						'id'                => $remote_actor_url,
+						'type'              => 'Person',
+						'preferredUsername' => 'testactor',
+						'name'              => 'Test Actor',
+						'inbox'             => 'https://example.com/actor/1/inbox',
+					);
+				}
+				return $pre;
+			},
+			10,
+			2
+		);
+
+		$remote_actor = \Activitypub\Collection\Remote_Actors::fetch_by_uri( $remote_actor_url );
+
+		// Make users follow the remote actor.
+		\add_post_meta( $remote_actor->ID, '_activitypub_followers', self::$user_id );
+		\add_post_meta( $remote_actor->ID, '_activitypub_followers', $user_id_1 );
+		\add_post_meta( $remote_actor->ID, '_activitypub_followers', $user_id_2 );
+		\add_post_meta( $remote_actor->ID, '_activitypub_followers', $user_id_3 );
+
+		// Public activity with "to" containing the public collection.
+		$activity = array(
+			'type'  => 'Create',
+			'actor' => $remote_actor_url,
+			'to'    => array( 'https://www.w3.org/ns/activitystreams#Public' ),
+			'cc'    => array( 'https://external.example.com/followers' ),
+		);
+
+		// Use reflection to test the private method.
+		$reflection = new \ReflectionClass( $this->inbox_controller );
+		$method     = $reflection->getMethod( 'get_local_recipients' );
+		$method->setAccessible( true );
+
+		$result = $method->invoke( $this->inbox_controller, $activity );
+
+		// Should return users who follow the remote actor.
+		$this->assertNotEmpty( $result, 'Should return users for public activity' );
+		$this->assertContains( self::$user_id, $result, 'Should contain test user' );
+		$this->assertContains( $user_id_1, $result, 'Should contain user 1' );
+		$this->assertContains( $user_id_2, $result, 'Should contain user 2' );
+		$this->assertContains( $user_id_3, $result, 'Should contain user 3' );
+
+		// Verify it returns exactly the followers we added.
+		// Note: May include blog user (0) if blog mode is enabled.
+		$this->assertGreaterThanOrEqual( 4, count( $result ), 'Should return at least 4 followers' );
+		$this->assertLessThanOrEqual( 5, count( $result ), 'Should return at most 5 followers (4 users + optional blog)' );
+
+		// Clean up.
+		\wp_delete_post( $remote_actor->ID, true );
+		\wp_delete_user( $user_id_1 );
+		\wp_delete_user( $user_id_2 );
+		\wp_delete_user( $user_id_3 );
+		\delete_option( 'activitypub_actor_mode' );
+		\remove_all_filters( 'activitypub_pre_http_get_remote_object' );
+	}
+
+	/**
+	 * Test get_local_recipients with public activity using "cc" field.
+	 *
+	 * @covers ::get_local_recipients
+	 */
+	public function test_get_local_recipients_public_activity_in_cc() {
+		// Enable actor mode to allow user actors.
+		\update_option( 'activitypub_actor_mode', ACTIVITYPUB_ACTOR_MODE );
+
+		// Create a test user (authors have activitypub capability by default).
+		$user_id = self::factory()->user->create( array( 'role' => 'author' ) );
+
+		// Create a remote actor and make our users follow them.
+		$remote_actor_url = 'https://example.com/actor/1';
+
+		// Mock the remote actor fetch.
+		\add_filter(
+			'activitypub_pre_http_get_remote_object',
+			function ( $pre, $url ) use ( $remote_actor_url ) {
+				if ( $url === $remote_actor_url ) {
+					return array(
+						'@context'          => 'https://www.w3.org/ns/activitystreams',
+						'id'                => $remote_actor_url,
+						'type'              => 'Person',
+						'preferredUsername' => 'testactor',
+						'name'              => 'Test Actor',
+						'inbox'             => 'https://example.com/actor/1/inbox',
+					);
+				}
+				return $pre;
+			},
+			10,
+			2
+		);
+
+		$remote_actor = \Activitypub\Collection\Remote_Actors::fetch_by_uri( $remote_actor_url );
+
+		// Make users follow the remote actor.
+		\add_post_meta( $remote_actor->ID, '_activitypub_followers', self::$user_id );
+		\add_post_meta( $remote_actor->ID, '_activitypub_followers', $user_id );
+
+		// Public activity with "cc" containing the public collection.
+		$activity = array(
+			'type'  => 'Create',
+			'actor' => $remote_actor_url,
+			'to'    => array( 'https://external.example.com/user/specific' ),
+			'cc'    => array( 'https://www.w3.org/ns/activitystreams#Public' ),
+		);
+
+		// Use reflection to test the private method.
+		$reflection = new \ReflectionClass( $this->inbox_controller );
+		$method     = $reflection->getMethod( 'get_local_recipients' );
+		$method->setAccessible( true );
+
+		$result = $method->invoke( $this->inbox_controller, $activity );
+
+		// Should return users who follow the remote actor because activity is public.
+		$this->assertNotEmpty( $result, 'Should return users for public activity in cc' );
+		$this->assertContains( self::$user_id, $result, 'Should contain original test user' );
+		$this->assertContains( $user_id, $result, 'Should contain new test user' );
+
+		// Verify it returns exactly the followers we added.
+		// Note: May include blog user (0) if blog mode is enabled.
+		$this->assertGreaterThanOrEqual( 2, count( $result ), 'Should return at least 2 followers' );
+		$this->assertLessThanOrEqual( 3, count( $result ), 'Should return at most 3 followers (2 users + optional blog)' );
+
+		// Clean up.
+		\wp_delete_post( $remote_actor->ID, true );
+		\wp_delete_user( $user_id );
+		\delete_option( 'activitypub_actor_mode' );
+		\remove_all_filters( 'activitypub_pre_http_get_remote_object' );
+	}
 }