net10, the refactor finished, and federation that works

The tree had not compiled since its first commit: Group, DmGroup and
IGroupUsersService were referenced and never written, an IDE rename had
turned the user-settings DTO into the ViewAvatarServer enum, and the settings
were saved as an entity they no longer were.

Built now:
- Group (an ActivityPub Group actor with its own keys, members, invitation
  code and optional password) and DmGroup (a conversation), with
  /clientapi/group/{list,insert,update,join,leave,approve}.
- Posts and DMs: /clientapi/post/{list,insert,delete}, /clientapi/dm/{list,insert};
  DM recipients are local usernames or user@host handles resolved by WebFinger.
- Invitation sign-up and login against the group's invitation code, checking
  the password before any account is created.
- Federation: WebFinger, NodeInfo 2.0, actors at /peasants/{name} (Person,
  Group, and an Application instance actor) with SPKI keys, draft-cavage
  RSA-SHA256 HTTP signatures both ways, an inbox handling Follow (+Accept),
  Undo, Create, Delete and Update, an outbox, notes at /posts/{id}, and a
  persisted, retried, signed delivery queue. A post to a group is announced
  by the group to its followers (FEP-1b12).
- The unused, broken typed ActivityPub models are replaced by a renderer;
  NSign's HMAC setup, which could not federate, is gone.

Upgrade: net10.0, MongoDB.Entities 25.1 (instance DB API, Standard GUIDs),
Swashbuckle 10 / OpenApi 2, Serilog.AspNetCore 10, MailKit 4.18,
PasswordGenerator 3. The JWT keys are 64 bytes (IdentityModel 8 refuses
shorter for HS512). Production runs its own mongod on 127.0.0.1:27022, as
Sintopia's apps do, and deploys to privapub.thepra.dev from the build runner.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Controllers/ServerToServer/PeasantsController.cs

@@ -1,110 +1,154 @@
-using Markdig;
-
 using Microsoft.AspNetCore.Mvc;
 
-using PrivaPub.ClientModels.Resources;
-using PrivaPub.Extensions;
-using PrivaPub.Models.ActivityPub;
-using PrivaPub.Services;
+using MongoDB.Entities;
 
-using System.ComponentModel.DataAnnotations;
-using System.Text.Json;
+using PrivaPub.Models.Federation;
+using PrivaPub.Services.Federation;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using PostEntity = PrivaPub.Models.Post.Post;
 
 namespace PrivaPub.Controllers.ServerToServer
 {
-	[ApiController,
-		Route("peasants"), Produces("application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"; charset=utf-8")]
+	[ApiController, Route("peasants")]
 	public class PeasantsController : ControllerBase
 	{
-		readonly IGroupUsersService _groupUsersService;
+		const string ActivityContentType = "application/activity+json; charset=utf-8";
+		const int OutboxSize = 20;
 
-		public PeasantsController(IGroupUsersService groupUsersService)
+		readonly ILocalActorService _localActors;
+		readonly IInboxService _inbox;
+		readonly DbEntities _dbEntities;
+		readonly ILogger<PeasantsController> _logger;
+
+		public PeasantsController(ILocalActorService localActors, IInboxService inbox, DbEntities dbEntities,
+			ILogger<PeasantsController> logger)
 		{
-			_groupUsersService = groupUsersService;
+			_localActors = localActors;
+			_inbox = inbox;
+			_dbEntities = dbEntities;
+			_logger = logger;
 		}
 
 		[HttpGet, Route("{actor}")]
-		public async Task<IActionResult> GetActor(
-			[Required(ErrorMessageResourceName = "Required",
-			ErrorMessageResourceType = typeof(FieldsNameResource))] string actor,
-			CancellationToken cancellation)
+		public async Task<IActionResult> GetActor(string actor, CancellationToken token)
 		{
-			var getResult = await _groupUsersService.GetGroup(actor, cancellation);
-			if (!getResult.IsValid)
-				return StatusCode(getResult.StatusCode, getResult);
-
-			var actorResponse = new ActivityPubActor();
-			actorResponse.Context[1] = string.Format(actorResponse.Context[1].ToString(), HttpContext.Request.PathBase);
-			actorResponse.Id = HttpContext.GetHostWithPath();
-			actorResponse.ProfileURL = HttpContext.GetHostWithPath();
-			actorResponse.Inbox = $"{HttpContext.GetHostWithPath()}/mouth";
-			actorResponse.Outbox = $"{HttpContext.GetHostWithPath()}/anus";
-			actorResponse.Endpoints = new()
-			{
-				SharedInboxURL = $"{HttpContext.GetHostWithPath()}/human-centipede",
-				OAuthAuthorizationEndpoint = $"{HttpContext.GetHost()}/sniff/again",
-			};
-			actorResponse.PreferredUsername = actor;
-			actorResponse.Name = actor;
-
-			if (getResult.Data is DmGroup dmGroup)
-			{
-				actorResponse.Summary = Markdown.ToHtml(dmGroup.Description);
-				actorResponse.Published = dmGroup.CreationDate;
-			}
-			else if (getResult.Data is Group dbGroup)
-			{
-				actorResponse.Summary = Markdown.ToHtml(dbGroup.Description);
-				actorResponse.Published = dbGroup.CreationDate;
-			}
-
-			return Ok(actorResponse);
+			var local = await _localActors.FindByUserName(actor, token);
+			return local == default ? NotFound() : Activity(ActivityPubRenderer.Actor(local));
 		}
 
 		[HttpGet, Route("{actor}/anus")]
-		public async Task<IActionResult> Anus(
-			[FromQuery] bool? page,
-			[Required(ErrorMessageResourceName = "Required",
-			ErrorMessageResourceType = typeof(FieldsNameResource))] string actor)
+		public async Task<IActionResult> Outbox(string actor, CancellationToken token)
 		{
-			if (!page.HasValue)
-				return Ok(new ActivityPubOrderedCollection
+			var local = await _localActors.FindByUserName(actor, token);
+			if (local == default)
+				return NotFound();
+
+			var total = local.Kind == LocalActorKind.Group
+				? await DB.Default.CountAsync<PostEntity>(p => p.GroupId == local.Id, token)
+				: await DB.Default.CountAsync<PostEntity>(p => p.GroupUserId == local.Id && !p.IsFederatedCopy, token);
+
+			var latest = await (local.Kind == LocalActorKind.Group
+					? _dbEntities.Posts.Match(p => p.GroupId == local.Id)
+					: _dbEntities.Posts.Match(p => p.GroupUserId == local.Id && !p.IsFederatedCopy))
+				.Sort(p => p.CreationDate, Order.Descending)
+				.Limit(OutboxSize)
+				.ExecuteAsync(token);
+
+			var items = new List<JsonNode>();
+			foreach (var post in latest)
+			{
+				if (local.Kind == LocalActorKind.Group)
 				{
-					Id = HttpContext.Request.Path,
-					FirstItem = $"{HttpContext.GetHostWithPath()}?page=true",
-				});
+					items.Add(ActivityPubRenderer.Announce(local, post.ObjectURI, $"announce-{post.ID}"));
+					continue;
+				}
+				var group = string.IsNullOrEmpty(post.GroupId) ? default : await _localActors.FindById(LocalActorKind.Group, post.GroupId, token);
+				var note = ActivityPubRenderer.Note(post, local, group, default);
+				items.Add(ActivityPubRenderer.Create(local, note, $"create-{post.ID}"));
+			}
 
+			return Activity(ActivityPubRenderer.OrderedCollection(local.Outbox, (int)total, items));
+		}
 
-			return Ok();
+		[HttpGet, Route("{actor}/followers")]
+		public async Task<IActionResult> Followers(string actor, CancellationToken token)
+		{
+			var local = await _localActors.FindByUserName(actor, token);
+			if (local == default)
+				return NotFound();
+			var count = await DB.Default.CountAsync<Follower>(
+				f => f.LocalActorId == local.Id && f.LocalActorKind == local.Kind && f.IsAccepted, token);
+			return Activity(ActivityPubRenderer.OrderedCollection(local.Followers, (int)count, default));
+		}
+
+		[HttpGet, Route("{actor}/following")]
+		public async Task<IActionResult> Following(string actor, CancellationToken token)
+		{
+			var local = await _localActors.FindByUserName(actor, token);
+			return local == default ? NotFound() : Activity(ActivityPubRenderer.OrderedCollection(local.Following, 0, Enumerable.Empty<JsonNode>()));
+		}
+
+		[HttpGet, Route("{actor}/posts/{postId}")]
+		public async Task<IActionResult> Post(string actor, string postId, CancellationToken token)
+		{
+			var local = await _localActors.FindByUserName(actor, token);
+			if (local == default || local.Kind != LocalActorKind.Person)
+				return NotFound();
+
+			var post = await _dbEntities.Posts
+				.Match(p => p.ID == postId && p.GroupUserId == local.Id && !p.IsFederatedCopy)
+				.ExecuteFirstAsync(token);
+			if (post == default)
+				return NotFound();
+
+			var group = string.IsNullOrEmpty(post.GroupId) ? default : await _localActors.FindById(LocalActorKind.Group, post.GroupId, token);
+			var replyTo = await ReplyTarget(post.AnsweringToPostId, token);
+			var note = ActivityPubRenderer.Note(post, local, group, replyTo);
+			note["@context"] = ActivityPubRenderer.ActivityStreams;
+			return Activity(note);
 		}
 
 		[HttpPost, Route("{actor}/mouth")]
-		public async Task<IActionResult> Month(
-			[Required(ErrorMessageResourceName = "Required",
-			ErrorMessageResourceType = typeof(FieldsNameResource))] string actor,
-			[FromBody] JsonDocument json)
+		public async Task<IActionResult> Inbox(string actor, CancellationToken token)
 		{
-
-			return Ok();
+			var local = await _localActors.FindByUserName(actor, token);
+			if (local == default)
+				return NotFound();
+			return Answer(await _inbox.Receive(Request, local, token));
 		}
 
 		[HttpPost, Route("{actor}/human-centipede")]
-		public async Task<IActionResult> HumanCentipede(
-			[Required(ErrorMessageResourceName = "Required",
-			ErrorMessageResourceType = typeof(FieldsNameResource))] string actor,
-			[FromBody] JsonDocument json)
-		{
-
-			return Ok();
-		}
+		public async Task<IActionResult> ActorSharedInbox(string actor, CancellationToken token) =>
+			Answer(await _inbox.Receive(Request, default, token));
 
 		[HttpPost, Route("/human-centipede")]
-		public async Task<IActionResult> PublicHumanCentipede(
-			[FromBody] JsonDocument json)
-		{
+		public async Task<IActionResult> SharedInbox(CancellationToken token) =>
+			Answer(await _inbox.Receive(Request, default, token));
 
-			return Ok();
+		async Task<string> ReplyTarget(string answeringToPostId, CancellationToken token)
+		{
+			if (string.IsNullOrEmpty(answeringToPostId))
+				return default;
+			if (answeringToPostId.StartsWith("https://", StringComparison.OrdinalIgnoreCase))
+				return answeringToPostId;
+			return (await _dbEntities.Posts.MatchID(answeringToPostId).ExecuteFirstAsync(token))?.ObjectURI;
 		}
 
+		IActionResult Answer(InboxResult result)
+		{
+			if (result.Error != default)
+				_logger.LogInformation("Inbox refused with {Status}: {Error}", result.StatusCode, result.Error);
+			return result.Error == default ? StatusCode(result.StatusCode) : StatusCode(result.StatusCode, result.Error);
+		}
+
+		ContentResult Activity(JsonObject document) => new()
+		{
+			Content = document.ToJsonString(),
+			ContentType = ActivityContentType,
+			StatusCode = StatusCodes.Status200OK
+		};
 	}
 }