jojo/routers/web/user
Gergely Nagy 0295658650 Federated user activity following (#4767)
This is a implementation of #4277.

The core idea is that any activity (where activity is defined as anything that ends up in the `action` table) will be wrapped in an `ap.Note`, and sent to followers. Similarly, the inbox of local users now accepts such Notes. Additionally, there's now a "Feeds" tab on the user profile page, which displays the received notes.

# Preview

![Preview](/attachments/9ce6a138-a748-447e-8e8b-d6143564ee4e)

# How to Try?

The PR can be tried using a single Forgejo instance, but two distinct ones probably shows how it works better. For the sake of simplicity, lets try with a single instance. This is how to get started:

1. Enable federation
2. Subscribe one user to another (or to themselves):
    ```
    curl -s -H "authorization: Bearer ${TOKEN}" -XPOST \
         http://localhost:3000/api/v1/user/activitypub/follow \
         --json '{"target": "http://localhost:3000/api/v1/activitypub/user-id/1"}'
    ```

    This makes the first user follow themselves.
3. Create a repo, open an issue, or basically do anything that results in an activity recorded.
4. Visit `http://localhost:3000/{username}?tab=feed` to see the feed in action.

If you want to try with multiple instances, then it's very similar: you just change the `actor_id` to the IRI of the user you want to follow the first instance's user with, and then you can look at the feed tab of this user on the second instance, after you performed some activity on the first.

## Trying with Mastodon / GoToSocial

To try with Mastodon or GoToSocial, you will likely need to bring your Forgejo instance public, and behind https. Once your Forgejo instance is up, you can search for `@yourusername@forgejo.your.domain.example.com`, and simply follow your Forgejo account. Creating any activity will then happily federate to Mastodon & GoToSocial.

You can also copy & paste the Forge user's web profile URL (eg, `https://forgejo.your.domain.example.com/yourusername`) into your fedi client of choice, and it will discover the profile that way too.

# Testing

* test: https://codeberg.org/meissa/federation/src/branch/federated-user-activity-following/doc/user-activity-following/manual-test.md
* Proof of gts->forgejo: https://social.meissa-gmbh.de/@meissa/114499541149466596
* Proof of forgejo->gts: https://social.meissa-gmbh.de/@meissa/114505225265720094

## Architecture decisions

There are a number of ways user activity federation could be implemented. One way - which I explored first - is to wrap each activity, and send those, and let the client render it. The advantage of this would be that we'd be able to have references to other objects (comments, repos, etc). The disadvantage is that doing this requires making all of these things addressable, and that's a lot of work. Another disadvantage is that this requires every client to know how to display it.

Another way, chosen here, is to send a rendered HTML `ap.Note` instead, with an `AttributedTo` (`ap.Person`) property, which describes the activity that happened in a HTML note. This is much simpler to implement, and has the huge advantage that it is also easier to display. In fact, once we have http signatures, we should be able to federate user activity to Mastodon, too! (Though this also requires figuring out how Mastodon wants to follow a user...)

Since user activity federation is mostly cosmetic, as in, it's there for the user to see, rather than for programs to take actions based upon this activity, I believe that sending an `ap.Note` is preferable over a more machine-oriented approach.

## Limitations & TODO

### FederatedUser

We should be caching the Avatar in a similar way. For that, though, we also need to store the last activity of a federated user, so we can expire old avatars from the cache. The avatar refresh part will be covered by #4778.

### Notes

While sending out notes, the `AttributedTo` property is set to an `ap.Person`, based on the originating local user. This is currently unused. The idea is that once following is implemented properly (see above), we'll be able to link this  to a FederatedUser (and thus to ExternalUser & User), which will allow us to display avatars and such, too.

### Display

The template used for displaying the received activities is currently incredibly simplistic. That's probably ok, it doesn't need to be fantastic.

### TODO

- [x] Fix the crashes on certain ops:
  - [x] Issue/PR close & reopen
- [x] Figure out a better way to implement follows
- [x] Store the `AttributedTo` part of the note, too, the ID of it.
- [x] Make sure only those activities are sent out that need to be.
      Currently, pretty much any activity is sent out, even private ones. We should be a bit smarter about that.
- [x] Make the ids used in the AP messages deterministic
      The IDs used in the AP messages are currently UUIDs, and we do not store them, so all the IRIs are "invalid": the objects they refer to don't exist outside of the AP message itself. We should be able to reconstruct the Note objects and Create activities from their IDs.
- [x] Make it possible to follow Forgejo account from Mastodon and GtS
  - [x] Mastodon without `AUTHORIZED_FETCH` works
  - [x] GoToSocial can follow
  - [x] Mastodon with `AUTHORIZED_FETCH` can follow
- ~~Create a cron job to refresh federated user avatars~~
- [x] Implement unfollowing
- [x] Add a `<link rel="alternate" type="application/activity+json" href="...">` to profile pages
      This lets Mastodon & most other Fedi frontends discover the AP profile just by pasting a Forgejo user's web profile page into a search box, without having to know the corresponding AP actor URL
- [x] Make it easier to make a local user follow a remote AP actor
- ~~Rebase on top of #4778 by @realaravinth, once that is ready~~
- [x] Create an API endpoint to list the AP feed
- [x] Create a DB migration for the new stuff
- [x] Make swagger stuff happy
- [x] Clean up the commit history
- [x] ~~Tests~~ Opting for manual testing for now.

Co-authored-by: Michael Jerger <michael.jerger@meissa-gmbh.de>
Co-authored-by: famfo <famfo@famfo.xyz>
Co-authored-by: jerger <jerger@noreply.codeberg.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/4767
Reviewed-by: jerger <jerger@noreply.codeberg.org>
Reviewed-by: elle <0xllx0@noreply.codeberg.org>
2026-05-08 08:08:10 +02:00
..
setting refactor: change authentication to return structured data (#12202) 2026-04-22 21:00:26 +02:00
avatar.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
code.go chore: minor code cleanup in search (#10549) 2025-12-23 00:38:51 +01:00
home.go Exclude SSH certificate principals from output when viewing user's SSH keys (#12079) 2026-04-17 17:17:29 +02:00
home_test.go fix: Allow SHA-256 in PR commit URLs (#10309) 2025-12-16 00:45:00 +01:00
main_test.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
notification.go chore: add modernizer linter (#11936) 2026-04-02 03:29:37 +02:00
package.go chore: add modernizer linter (#11936) 2026-04-02 03:29:37 +02:00
profile.go Federated user activity following (#4767) 2026-05-08 08:08:10 +02:00
search.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
stop_watch.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
task.go feat(build): improve lint-locale-usage further (#8736) 2025-08-27 23:47:34 +02:00