From 33edfc6a5fd86ddb7486b36a66fa27f00edbb634 Mon Sep 17 00:00:00 2001
From: Michael <heluecht@pirati.ca>
Date: Tue, 15 Feb 2022 23:51:13 +0000
Subject: [PATCH] Fix for private communities

---
 src/Model/Item.php                 | 36 +++++++++++++++++++-----------
 src/Module/ActivityPub/Objects.php | 25 ++++++---------------
 2 files changed, 30 insertions(+), 31 deletions(-)

diff --git a/src/Model/Item.php b/src/Model/Item.php
index 96cf5c488..69a967b2c 100644
--- a/src/Model/Item.php
+++ b/src/Model/Item.php
@@ -1442,26 +1442,36 @@ class Item
 		}
 
 		$post = Post::selectFirst(['uid', 'allow_cid', 'allow_gid', 'deny_cid', 'deny_gid', 'private'], ['uri-id' => $uriid, 'origin' => true]);
-		if (empty($post)) {
-			if (Post::exists(['uri-id' => $uriid, 'uid' => 0])) {
-				return 0;
-			} else {
+		if (!empty($post)) {
+			if (in_array($post['private'], [Item::PUBLIC, Item::UNLISTED])) {
+				return $post['uid'];
+			}
+
+			$pcid = Contact::getPublicIdByUserId($uid);
+			if (empty($pcid)) {
 				return null;
 			}
-		}
 
-		if (in_array($post['private'], [Item::PUBLIC, Item::UNLISTED])) {
-			return $post['uid'];
-		}
+			foreach (Item::enumeratePermissions($post, true) as $receiver) {
+				if ($receiver == $pcid) {
+					return $post['uid'];
+				}
+			}
 
-		$pcid = Contact::getPublicIdByUserId($uid);
-		if (empty($pcid)) {
 			return null;
 		}
 
-		foreach (Item::enumeratePermissions($post, true) as $receiver) {
-			if ($receiver == $pcid) {
-				return $post['uid'];
+		if (Post::exists(['uri-id' => $uriid, 'uid' => 0])) {
+			return 0;
+		}
+
+		// When the post belongs to a a forum then all forum users are allowed to access it
+		foreach (Tag::getByURIId($uriid, [Tag::EXCLUSIVE_MENTION]) as $tag) {
+			if (DBA::exists('contact', ['uid' => $uid, 'nurl' => Strings::normaliseLink($tag['url']), 'contact-type' => Contact::TYPE_COMMUNITY])) {
+				$target_uid = User::getIdForURL($tag['url']);
+				if (!empty($target_uid)) {
+					return $target_uid;
+				}
 			}
 		}
 
diff --git a/src/Module/ActivityPub/Objects.php b/src/Module/ActivityPub/Objects.php
index c085d8683..0a523ea43 100644
--- a/src/Module/ActivityPub/Objects.php
+++ b/src/Module/ActivityPub/Objects.php
@@ -70,9 +70,7 @@ class Objects extends BaseModule
 			}
 		}
 
-		$item = Post::selectFirst(['id', 'uid', 'origin', 'author-link', 'changed', 'private', 'psid', 'gravity', 'deleted', 'parent-uri-id'],
-			['uri-id' => $itemuri['id']], ['order' => ['origin' => true]]);
-
+		$item = Post::selectFirst([], ['uri-id' => $itemuri['id'], 'origin' => true]);
 		if (!DBA::isResult($item)) {
 			throw new HTTPException\NotFoundException();
 		}
@@ -81,25 +79,16 @@ class Objects extends BaseModule
 
 		if (!$validated) {
 			$requester = HTTPSignature::getSigner('', $_SERVER);
-			if (!empty($requester) && $item['origin']) {
-				$requester_id = Contact::getIdForURL($requester, $item['uid']);
-				if (!empty($requester_id)) {
-					$permissionSets = DI::permissionSet()->selectByContactId($requester_id, $item['uid']);
-					$psids = array_merge($permissionSets->column('id'), [PermissionSet::PUBLIC]);
-					$validated = in_array($item['psid'], $psids);
+			if (!empty($requester)) {
+				$receivers = Item::enumeratePermissions($item, false);
+
+				$validated = in_array(Contact::getIdForURL($requester, $item['uid']), $receivers);
+				if (!$validated) {
+					$validated = in_array(Contact::getIdForURL($requester), $receivers);
 				}
 			}
 		}
 
-		if ($validated) {
-			// Valid items are original post or posted from this node (including in the case of a forum)
-			$validated = ($item['origin'] || (parse_url($item['author-link'], PHP_URL_HOST) == parse_url(DI::baseUrl()->get(), PHP_URL_HOST)));
-
-			if (!$validated && $item['deleted']) {
-				$validated = Post::exists(['origin' => true, 'uri-id' => $item['parent-uri-id']]);
-			}
-		}
-
 		if (!$validated) {
 			throw new HTTPException\NotFoundException();
 		}