Timeline improvements (#41)

Tidying up.
Parent/child statuses now display correctly in status/id/context.

internal/visibility/filter.go

@@ -0,0 +1,33 @@
+package visibility
+
+import (
+	"github.com/sirupsen/logrus"
+	"github.com/superseriousbusiness/gotosocial/internal/db"
+	"github.com/superseriousbusiness/gotosocial/internal/gtsmodel"
+)
+
+// Filter packages up a bunch of logic for checking whether given statuses or accounts are visible to a requester.
+type Filter interface {
+	// StatusVisible returns true if targetStatus is visible to requestingAccount, based on the
+	// privacy settings of the status, and any blocks/mutes that might exist between the two accounts
+	// or account domains, and other relevant accounts mentioned in or replied to by the status.
+	StatusVisible(targetStatus *gtsmodel.Status, requestingAccount *gtsmodel.Account) (bool, error)
+
+	// StatusHometimelineable returns true if targetStatus should be in the home timeline of the requesting account.
+	//
+	// This function will call StatusVisible internally, so it's not necessary to call it beforehand.
+	StatusHometimelineable(targetStatus *gtsmodel.Status, requestingAccount *gtsmodel.Account) (bool, error)
+}
+
+type filter struct {
+	db  db.DB
+	log *logrus.Logger
+}
+
+// NewFilter returns a new Filter interface that will use the provided database and logger.
+func NewFilter(db db.DB, log *logrus.Logger) Filter {
+	return &filter{
+		db:  db,
+		log: log,
+	}
+}

internal/visibility/statushometimelineable.go

@@ -0,0 +1,75 @@
+package visibility
+
+import (
+	"fmt"
+
+	"github.com/sirupsen/logrus"
+	"github.com/superseriousbusiness/gotosocial/internal/gtsmodel"
+)
+
+func (f *filter) StatusHometimelineable(targetStatus *gtsmodel.Status, timelineOwnerAccount *gtsmodel.Account) (bool, error) {
+	l := f.log.WithFields(logrus.Fields{
+		"func":     "StatusHometimelineable",
+		"statusID": targetStatus.ID,
+	})
+
+	// status owner should always be able to see their own status in their timeline so we can return early if this is the case
+	if timelineOwnerAccount != nil && targetStatus.AccountID == timelineOwnerAccount.ID {
+		return true, nil
+	}
+
+	v, err := f.StatusVisible(targetStatus, timelineOwnerAccount)
+	if err != nil {
+		return false, fmt.Errorf("StatusHometimelineable: error checking visibility of status with id %s: %s", targetStatus.ID, err)
+	}
+
+	if !v {
+		l.Debug("status is not hometimelineable because it's not visible to the requester")
+		return false, nil
+	}
+
+	// Don't timeline a status whose parent hasn't been dereferenced yet or can't be dereferenced.
+	// If we have the reply to URI but don't have an ID for the replied-to account or the replied-to status in our database, we haven't dereferenced it yet.
+	if targetStatus.InReplyToURI != "" && (targetStatus.InReplyToID == "" || targetStatus.InReplyToAccountID == "") {
+		return false, nil
+	}
+
+	// if a status replies to an ID we know in the database, we need to make sure we also follow the replied-to status owner account
+	if targetStatus.InReplyToID != "" {
+		// pin the reply to status on to this status if it hasn't been done already
+		if targetStatus.GTSReplyToStatus == nil {
+			rs := &gtsmodel.Status{}
+			if err := f.db.GetByID(targetStatus.InReplyToID, rs); err != nil {
+				return false, fmt.Errorf("StatusHometimelineable: error getting replied to status with id %s: %s", targetStatus.InReplyToID, err)
+			}
+			targetStatus.GTSReplyToStatus = rs
+		}
+
+		// pin the reply to account on to this status if it hasn't been done already
+		if targetStatus.GTSReplyToAccount == nil {
+			ra := &gtsmodel.Account{}
+			if err := f.db.GetByID(targetStatus.InReplyToAccountID, ra); err != nil {
+				return false, fmt.Errorf("StatusHometimelineable: error getting replied to account with id %s: %s", targetStatus.InReplyToAccountID, err)
+			}
+			targetStatus.GTSReplyToAccount = ra
+		}
+
+		// if it's a reply to the timelineOwnerAccount, we don't need to check if the timelineOwnerAccount follows itself, just return true, they can see it
+		if targetStatus.AccountID == timelineOwnerAccount.ID {
+			return true, nil
+		}
+
+		// the replied-to account != timelineOwnerAccount, so make sure the timelineOwnerAccount follows the replied-to account
+		follows, err := f.db.Follows(timelineOwnerAccount, targetStatus.GTSReplyToAccount)
+		if err != nil {
+			return false, fmt.Errorf("StatusHometimelineable: error checking follow from account %s to account %s: %s", timelineOwnerAccount.ID, targetStatus.InReplyToAccountID, err)
+		}
+
+		// we don't want to timeline a reply to a status whose owner isn't followed by the requesting account
+		if !follows {
+			return false, nil
+		}
+	}
+
+	return true, nil
+}

internal/visibility/statusvisible.go

@@ -0,0 +1,197 @@
+package visibility
+
+import (
+	"errors"
+
+	"fmt"
+
+	"github.com/sirupsen/logrus"
+	"github.com/superseriousbusiness/gotosocial/internal/db"
+	"github.com/superseriousbusiness/gotosocial/internal/gtsmodel"
+)
+
+func (f *filter) StatusVisible(targetStatus *gtsmodel.Status, requestingAccount *gtsmodel.Account) (bool, error) {
+	l := f.log.WithFields(logrus.Fields{
+		"func":                "StatusVisible",
+		"statusID":            targetStatus.ID,
+		"requestingAccountID": requestingAccount.ID,
+	})
+
+	relevantAccounts, err := f.pullRelevantAccountsFromStatus(targetStatus)
+	if err != nil {
+		l.Debugf("error pulling relevant accounts for status %s: %s", targetStatus.ID, err)
+	}
+	targetAccount := relevantAccounts.StatusAuthor
+
+	// if target account is suspended then don't show the status
+	if !targetAccount.SuspendedAt.IsZero() {
+		l.Trace("target account suspended at is not zero")
+		return false, nil
+	}
+
+	// if the target user doesn't exist (anymore) then the status also shouldn't be visible
+	// note: we only do this for local users
+	if targetAccount.Domain == "" {
+		targetUser := &gtsmodel.User{}
+		if err := f.db.GetWhere([]db.Where{{Key: "account_id", Value: targetAccount.ID}}, targetUser); err != nil {
+			l.Debug("target user could not be selected")
+			if _, ok := err.(db.ErrNoEntries); ok {
+				return false, nil
+			}
+			return false, fmt.Errorf("StatusVisible: db error selecting user for local target account %s: %s", targetAccount.ID, err)
+		}
+
+		// if target user is disabled, not yet approved, or not confirmed then don't show the status
+		// (although in the latter two cases it's unlikely they posted a status yet anyway, but you never know!)
+		if targetUser.Disabled || !targetUser.Approved || targetUser.ConfirmedAt.IsZero() {
+			l.Trace("target user is disabled, not approved, or not confirmed")
+			return false, nil
+		}
+	}
+
+	// if the requesting user doesn't exist (anymore) then the status also shouldn't be visible
+	// note: we only do this for local users
+	if requestingAccount.Domain == "" {
+		requestingUser := &gtsmodel.User{}
+		if err := f.db.GetWhere([]db.Where{{Key: "account_id", Value: requestingAccount.ID}}, requestingUser); err != nil {
+			// if the requesting account is local but doesn't have a corresponding user in the db this is a problem
+			l.Debug("requesting user could not be selected")
+			if _, ok := err.(db.ErrNoEntries); ok {
+				return false, nil
+			}
+			return false, fmt.Errorf("StatusVisible: db error selecting user for local requesting account %s: %s", requestingAccount.ID, err)
+		}
+		// okay, user exists, so make sure it has full privileges/is confirmed/approved
+		if requestingUser.Disabled || !requestingUser.Approved || requestingUser.ConfirmedAt.IsZero() {
+			l.Trace("requesting account is local but corresponding user is either disabled, not approved, or not confirmed")
+			return false, nil
+		}
+	}
+
+	// If requesting account is nil, that means whoever requested the status didn't auth, or their auth failed.
+	// In this case, we can still serve the status if it's public, otherwise we definitely shouldn't.
+	if requestingAccount == nil {
+		if targetStatus.Visibility == gtsmodel.VisibilityPublic {
+			return true, nil
+		}
+		l.Trace("requesting account is nil but the target status isn't public")
+		return false, nil
+	}
+
+	// if requesting account is suspended then don't show the status -- although they probably shouldn't have gotten
+	// this far (ie., been authed) in the first place: this is just for safety.
+	if !requestingAccount.SuspendedAt.IsZero() {
+		l.Trace("requesting account is suspended")
+		return false, nil
+	}
+
+	// if the target status belongs to the requesting account, they should always be able to view it at this point
+	if targetStatus.AccountID == requestingAccount.ID {
+		return true, nil
+	}
+
+	// At this point we have a populated targetAccount, targetStatus, and requestingAccount, so we can check for blocks and whathaveyou
+	// First check if a block exists directly between the target account (which authored the status) and the requesting account.
+	if blocked, err := f.db.Blocked(targetAccount.ID, requestingAccount.ID); err != nil {
+		l.Debugf("something went wrong figuring out if the accounts have a block: %s", err)
+		return false, err
+	} else if blocked {
+		// don't allow the status to be viewed if a block exists in *either* direction between these two accounts, no creepy stalking please
+		l.Trace("a block exists between requesting account and target account")
+		return false, nil
+	}
+
+	// status replies to account id
+	if relevantAccounts.ReplyToAccount != nil && relevantAccounts.ReplyToAccount.ID != requestingAccount.ID {
+		if blocked, err := f.db.Blocked(relevantAccounts.ReplyToAccount.ID, requestingAccount.ID); err != nil {
+			return false, err
+		} else if blocked {
+			l.Trace("a block exists between requesting account and reply to account")
+			return false, nil
+		}
+
+		// check reply to ID
+		if targetStatus.InReplyToID != "" && (targetStatus.Visibility == gtsmodel.VisibilityFollowersOnly || targetStatus.Visibility == gtsmodel.VisibilityDirect) {
+			followsRepliedAccount, err := f.db.Follows(requestingAccount, relevantAccounts.ReplyToAccount)
+			if err != nil {
+				return false, err
+			}
+			if !followsRepliedAccount {
+				l.Trace("target status is a followers-only reply to an account that is not followed by the requesting account")
+				return false, nil
+			}
+		}
+	}
+
+	// status boosts accounts id
+	if relevantAccounts.BoostedAccount != nil {
+		if blocked, err := f.db.Blocked(relevantAccounts.BoostedAccount.ID, requestingAccount.ID); err != nil {
+			return false, err
+		} else if blocked {
+			l.Trace("a block exists between requesting account and boosted account")
+			return false, nil
+		}
+	}
+
+	// status boosts a reply to account id
+	if relevantAccounts.BoostedReplyToAccount != nil {
+		if blocked, err := f.db.Blocked(relevantAccounts.BoostedReplyToAccount.ID, requestingAccount.ID); err != nil {
+			return false, err
+		} else if blocked {
+			l.Trace("a block exists between requesting account and boosted reply to account")
+			return false, nil
+		}
+	}
+
+	// status mentions accounts
+	for _, a := range relevantAccounts.MentionedAccounts {
+		if blocked, err := f.db.Blocked(a.ID, requestingAccount.ID); err != nil {
+			return false, err
+		} else if blocked {
+			l.Trace("a block exists between requesting account and a mentioned account")
+			return false, nil
+		}
+	}
+
+	// if the requesting account is mentioned in the status it should always be visible
+	for _, acct := range relevantAccounts.MentionedAccounts {
+		if acct.ID == requestingAccount.ID {
+			return true, nil // yep it's mentioned!
+		}
+	}
+
+	// at this point we know neither account blocks the other, or another account mentioned or otherwise referred to in the status
+	// that means it's now just a matter of checking the visibility settings of the status itself
+	switch targetStatus.Visibility {
+	case gtsmodel.VisibilityPublic, gtsmodel.VisibilityUnlocked:
+		// no problem here, just return OK
+		return true, nil
+	case gtsmodel.VisibilityFollowersOnly:
+		// check one-way follow
+		follows, err := f.db.Follows(requestingAccount, targetAccount)
+		if err != nil {
+			return false, err
+		}
+		if !follows {
+			l.Trace("requested status is followers only but requesting account is not a follower")
+			return false, nil
+		}
+		return true, nil
+	case gtsmodel.VisibilityMutualsOnly:
+		// check mutual follow
+		mutuals, err := f.db.Mutuals(requestingAccount, targetAccount)
+		if err != nil {
+			return false, err
+		}
+		if !mutuals {
+			l.Trace("requested status is mutuals only but accounts aren't mufos")
+			return false, nil
+		}
+		return true, nil
+	case gtsmodel.VisibilityDirect:
+		l.Trace("requesting account requests a status it's not mentioned in")
+		return false, nil // it's not mentioned -_-
+	}
+
+	return false, errors.New("reached the end of StatusVisible with no result")
+}

internal/visibility/util.go

@@ -0,0 +1,81 @@
+package visibility
+
+import (
+	"fmt"
+
+	"github.com/superseriousbusiness/gotosocial/internal/gtsmodel"
+)
+
+func (f *filter) pullRelevantAccountsFromStatus(targetStatus *gtsmodel.Status) (*relevantAccounts, error) {
+	accounts := &relevantAccounts{
+		MentionedAccounts: []*gtsmodel.Account{},
+	}
+
+	// get the author account
+	if targetStatus.GTSAuthorAccount == nil {
+		statusAuthor := &gtsmodel.Account{}
+		if err := f.db.GetByID(targetStatus.AccountID, statusAuthor); err != nil {
+			return accounts, fmt.Errorf("PullRelevantAccountsFromStatus: error getting statusAuthor with id %s: %s", targetStatus.AccountID, err)
+		}
+		targetStatus.GTSAuthorAccount = statusAuthor
+	}
+	accounts.StatusAuthor = targetStatus.GTSAuthorAccount
+
+	// get the replied to account from the status and add it to the pile
+	if targetStatus.InReplyToAccountID != "" {
+		repliedToAccount := &gtsmodel.Account{}
+		if err := f.db.GetByID(targetStatus.InReplyToAccountID, repliedToAccount); err != nil {
+			return accounts, fmt.Errorf("PullRelevantAccountsFromStatus: error getting repliedToAcount with id %s: %s", targetStatus.InReplyToAccountID, err)
+		}
+		accounts.ReplyToAccount = repliedToAccount
+	}
+
+	// get the boosted account from the status and add it to the pile
+	if targetStatus.BoostOfID != "" {
+		// retrieve the boosted status first
+		boostedStatus := &gtsmodel.Status{}
+		if err := f.db.GetByID(targetStatus.BoostOfID, boostedStatus); err != nil {
+			return accounts, fmt.Errorf("PullRelevantAccountsFromStatus: error getting boostedStatus with id %s: %s", targetStatus.BoostOfID, err)
+		}
+		boostedAccount := &gtsmodel.Account{}
+		if err := f.db.GetByID(boostedStatus.AccountID, boostedAccount); err != nil {
+			return accounts, fmt.Errorf("PullRelevantAccountsFromStatus: error getting boostedAccount with id %s: %s", boostedStatus.AccountID, err)
+		}
+		accounts.BoostedAccount = boostedAccount
+
+		// the boosted status might be a reply to another account so we should get that too
+		if boostedStatus.InReplyToAccountID != "" {
+			boostedStatusRepliedToAccount := &gtsmodel.Account{}
+			if err := f.db.GetByID(boostedStatus.InReplyToAccountID, boostedStatusRepliedToAccount); err != nil {
+				return accounts, fmt.Errorf("PullRelevantAccountsFromStatus: error getting boostedStatusRepliedToAccount with id %s: %s", boostedStatus.InReplyToAccountID, err)
+			}
+			accounts.BoostedReplyToAccount = boostedStatusRepliedToAccount
+		}
+	}
+
+	// now get all accounts with IDs that are mentioned in the status
+	for _, mentionID := range targetStatus.Mentions {
+
+		mention := &gtsmodel.Mention{}
+		if err := f.db.GetByID(mentionID, mention); err != nil {
+			return accounts, fmt.Errorf("PullRelevantAccountsFromStatus: error getting mention with id %s: %s", mentionID, err)
+		}
+
+		mentionedAccount := &gtsmodel.Account{}
+		if err := f.db.GetByID(mention.TargetAccountID, mentionedAccount); err != nil {
+			return accounts, fmt.Errorf("PullRelevantAccountsFromStatus: error getting mentioned account: %s", err)
+		}
+		accounts.MentionedAccounts = append(accounts.MentionedAccounts, mentionedAccount)
+	}
+
+	return accounts, nil
+}
+
+// relevantAccounts denotes accounts that are replied to, boosted by, or mentioned in a status.
+type relevantAccounts struct {
+	StatusAuthor          *gtsmodel.Account
+	ReplyToAccount        *gtsmodel.Account
+	BoostedAccount        *gtsmodel.Account
+	BoostedReplyToAccount *gtsmodel.Account
+	MentionedAccounts     []*gtsmodel.Account
+}