Skip to content

Use ID instead of username in ActivityPub API #23802

Closed
@trwnh

Description

@trwnh

Feature Description

In #19133 a basic ActivityPub API was added to the router, allowing lookup of an actor document and POSTing to inbox. However, the API as present in Swagger currently depends on the username, which means that username changes are not possible without causing breakages in federation. This should be fixed before federation is ready. Further rationale is included in #19133 (comment) and quoted below for convenience:

You can avoid having to issue a Move if you just don't use the username in any ids. Move should be reserved for moving to different domains, not changing usernames. It's completely unnecessary and completely avoidable for local username changes. I heavily recommend using something like snowflake, hash, uuid, etc instead of plain usernames. You want the ActivityPub id to be as stable as possible and ideally never change.

Screenshots

Relevant code:

func Person(ctx *context.APIContext) {
// swagger:operation GET /activitypub/user/{username} activitypub activitypubPerson
// ---
// summary: Returns the Person actor for a user
// produces:
// - application/json
// parameters:
// - name: username
// in: path
// description: username of the user
// type: string
// required: true
// responses:
// "200":
// "$ref": "#/responses/ActivityPub"
link := strings.TrimSuffix(setting.AppURL, "/") + "/api/v1/activitypub/user/" + ctx.ContextUser.Name

I believe this should be ctx.ContextUser.ID or something similar.

Activity

added
type/featureCompletely new functionality. Can only be merged if feature freeze is not active.
type/proposalThe new feature has not been accepted yet but needs to be discussed first.
on Mar 29, 2023
lunny

lunny commented on Mar 30, 2023

@lunny
Member

But wouldn't the id be changed in a different system?

removed
type/featureCompletely new functionality. Can only be merged if feature freeze is not active.
on Mar 30, 2023
trwnh

trwnh commented on Mar 30, 2023

@trwnh
Author

No, the ActivityPub id is an HTTPS URI that should remain constant. For example, if we have something like https://example.com/userid then the username is free to change without breaking the id. But if we make the id something like https://example.com/username then a change from username to different_username will be seen as a completely different actor. All old comments, repos, etc. will no longer be linked, and all followers will have to be migrated to the "new" account.

ghost

ghost commented on Mar 30, 2023

@ghost

@trwnh Thanks for the reminder. I'll implement this soon in forgejo-federation.

added a commit that references this issue on Apr 4, 2023
17f2318
added a commit that references this issue on Apr 4, 2023
104b2ed
added a commit that references this issue on Apr 4, 2023
9836b7d
locked as resolved and limited conversation to collaborators on May 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    type/proposalThe new feature has not been accepted yet but needs to be discussed first.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

      Participants

      @lunny@trwnh

      Issue actions

        Use ID instead of username in ActivityPub API · Issue #23802 · go-gitea/gitea