M6: provenance fixes, stored features, community edits that are real edits

- A fetched ObjectRecord no longer wears the signature, key, signed headers and @context
  of the activity that caused the fetch, and its ReceivedAt is the fetch's own time. Its
  activity fields now name the trigger. Provenance answers signature null and
  fetchedBy "instance-actor". Migration _008 clears the old fetched records.
- ObjectRecords store their ObjectFeatures extensions and context namespaces (migration
  _009 fills older records in batches), so statistics can count them. Provenance reads the
  stored lists.
- ForeignAvatar.Features records what an actor document uses (ActorFeatures): featured,
  shared inbox, FEP-521a, FEP-8b32, identity proofs, Misskey fields, indexable,
  undiscoverable, locked, key size, and more.
- RemoteEdits.Apply and RemoteDeletes.Remove are shared by the Update, Delete and Announce
  handlers. A community-wrapped Update is now an edit only when newer, refreshes polls
  and media otherwise, revises the ObjectRecord and re-resolves quotes. A
  community-wrapped Delete now tombstones the object, removes its ObjectRecord, reblogs
  and timeline rows, and lowers the reply count. Any deleted quoting post lowers the
  quoted post's quote count.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

.gitea/workflows/build.yml

@@ -15,5 +15,5 @@ jobs:
       - name: Build
         run: dotnet build PrivaPub.sln -c Release
 
-      - name: Test
-        run: dotnet test PrivaPub.sln -c Release --no-build
+      - name: Test (unit and integration, on a throwaway mongod)
+        run: tools/ci/with-test-mongod.sh dotnet test PrivaPub.sln -c Release --no-build

.gitea/workflows/deploy.yml

@@ -28,8 +28,8 @@ jobs:
           echo "BUILD_REF=${GITHUB_REF_NAME:-master}" >> "$GITHUB_ENV"
           echo "BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"
 
-      - name: Test
-        run: dotnet test PrivaPub.sln -c Release
+      - name: Test (unit and integration, on a throwaway mongod)
+        run: tools/ci/with-test-mongod.sh dotnet test PrivaPub.sln -c Release
 
       - name: Publish
         run: |
@@ -90,6 +90,8 @@ jobs:
           fi
 
       - name: Verify what is being served
+        env:
+          SMOKE_TOKEN: ${{ secrets.PRIVAPUB_SMOKE_TOKEN }}
         run: |
           served=$(curl -fsS "$PUBLIC_URL/build.json" | python3 -c "import json,sys; print(json.load(sys.stdin).get('commit',''))")
           [ "$served" = "$BUILD_COMMIT" ] || { echo "::error::served build is '$served', expected '$BUILD_COMMIT'"; exit 1; }
@@ -104,5 +106,6 @@ jobs:
           code=$(curl -s -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/activity+json' \
             --data '{"type":"Follow","actor":"https://example.org/users/x","object":"'"$PUBLIC_URL"'/peasants/privapub"}' "$PUBLIC_URL/human-centipede")
           [ "$code" = "401" ] || { echo "::error::an unsigned inbox POST answered $code"; exit 1; }
-          tools/smoke/mastodon-api.sh "$PUBLIC_URL"
+          tools/smoke/mastodon-api.sh "$PUBLIC_URL" "$SMOKE_TOKEN"
+          [ -n "$SMOKE_TOKEN" ] || echo "::warning::PRIVAPUB_SMOKE_TOKEN is not set, so the signed-in API was not checked"
           echo "::notice::serving $served"

.gitignore

@@ -401,3 +401,4 @@ FodyWeavers.xsd
 
 PrivaPub/media-store/
 PrivaPub/media-store-proxy/
+tools/pasture/.publish/

CLAUDE.md

@@ -1,7 +1,9 @@
 # CLAUDE.md
 
 Guidance for working in this repository. `docs/ROADMAP.md` holds the owner's decisions and the phased plan to full
-ActivityPub interop; read it before changing anything federation-, privacy- or API-shaped.
+ActivityPub interop; read it before changing anything federation-, privacy- or API-shaped. `docs/INTEROP.md` is the
+per-platform evidence behind phases P5 to P8: what each peer sends, what it expects, and what PrivaPub still drops.
+Check the platform's section there before writing a parser or a renderer, and add to it whatever you learn.
 
 ## What this is
 
@@ -46,6 +48,7 @@ actor-scoped route gets a name in the same spirit, agreed with the owner, and a
 | Notes | `/peasants/{name}/scribbles/{id}` |
 | Activities | `/peasants/{name}/grunts/{id}` (`create-{postId}` resolves) |
 | DM context | `/peasants/{name}/whispers/{id}` |
+| Quote permission (FEP-044f `QuoteAuthorization`) | `/peasants/{name}/parrot-licences/{id}` |
 | Token refresh | `/clientapi/user/sniff/again` |
 
 Agreed for later phases: `/gossip`, `/drool`, `/echoes` (replies, likes, shares), `/trophies` (featured), `/tattoos`
@@ -69,7 +72,7 @@ PrivaPub/                         ASP.NET Core Web API, net10.0
   Infrastructure/
     Http/                         FederationHttp + SafeHttpHandlerFactory + IpRangeGuard: the only way out
     Jobs/                         JobQueue (leases), JobWorker, Backoff, HostCircuitBreaker
-    Ids/                          PrivacyIds (day-only ids for personas and groups, published-time ids for remote posts)
+    Ids/                          PrivacyIds (day-only ids for personas and groups, arrival-ordered ids for remote posts)
     Data/                         Indexes (created at start), EntityMaps.Warm, Migrations/_NNN_*.cs
     Cli/                          AdminCommands (`PrivaPub admin promote|demote <root>`)
     RateLimiting.cs               accounts (per client address) and inbox (per sending origin) policies
@@ -121,6 +124,7 @@ dotnet build PrivaPub.sln -c Release
 dotnet test PrivaPub.sln                                  # unit tests; integration tests skip
 PRIVAPUB_TEST_MONGOD=1 dotnet test PrivaPub.sln           # all of them, against mongod on 127.0.0.1:27017
                                                           # (PRIVAPUB_TEST_MONGO overrides; a fresh database per run, dropped after)
+tools/ci/with-test-mongod.sh dotnet test PrivaPub.sln     # all of them, on a throwaway mongod, as CI runs them
 cd PrivaPub && ASPNETCORE_ENVIRONMENT=Development \
   Kestrel__Endpoints__Http__Url=http://127.0.0.1:6970 Kestrel__Endpoints__Http__Protocols=Http1AndHttp2 \
   AppConfiguration__BackendBaseAddress=http://127.0.0.1:6970 MongoSettings__Database=PrivaPubTest \
@@ -129,7 +133,8 @@ cd PrivaPub && ASPNETCORE_ENVIRONMENT=Development \
 
 Development config (`appsettings.Development.json`) binds HTTPS 7195 with HTTP/2 only; the overrides above make it
 curl-able. Outbound fetches only go to https DNS names resolving to public addresses; a test network (Pasture) sets
-`Federation__AllowPrivateNetworks=true` and `Federation__AllowPlainHttp=true`, which startup refuses in Production.
+`Federation__AllowPrivateNetworks=true`, `Federation__AllowPlainHttp=true` and `Federation__AcceptAnyCertificate=true`,
+which startup refuses in Production.
 
 Promoting an admin on the box (signing up as "admin" grants nothing):
 
@@ -166,8 +171,13 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
    - the shared inbox is advertised in `endpoints.sharedInbox`.
 7. **Remote HTML is sanitized before it is stored** (`ContentSanitizer`); `Post.ContentHtml` is what is shown,
    `ContentFormat` says what `Text` holds. Remote names are plain text.
-8. **Circles never federate.** A circle's actor, collections, WebFinger and inbox answer 404, and its posts are
-   `IsLocalOnly`. Only communities are Group actors.
+8. **Circles federate to members only.** A circle is an undiscoverable Group actor that takes follow requests (the owner
+   approves); its posts are addressed to the circle and its `/flock`, delivered to members' personal inboxes, never
+   announced, and served only to a signed request from a member or a member's instance actor
+   (`SignedFetchAuthorizer`), 404 otherwise. Circles never appear in search, lookups, mentions or profile pages.
+   **Communities** are FEP-1b12 groups: `GroupDistributor` announces the whole activity (plus the object for new posts,
+   for Mastodon), top-level posts are `Page`s with a `name`, posting follows `Group.PostingPolicy`.
+   Located posts (`LocalGeo`) are the only local-only posts.
 9. **A DM joins a conversation only by `DmGroup.ParticipantsKey`**, the exact set of its participants; a remote
    `context` decides nothing. DMs are `Post`s with `Visibility = Direct` and a `ConversationId` (`DmPost` is legacy).
 10. **Nothing slow happens inside a request.** Deliveries and inbox processing are `Job`s (`Infrastructure/Jobs`):
@@ -189,8 +199,15 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
 3. Read parameters through `Params` (query, form and JSON merged Rails-style), never MVC binding. A value type read
    from a conditional must say `(int?)null`, not `default`: that bug once made every list one item long.
 4. Answer with `Json(...)` (snake_case, explicit nulls) or `Error(status, message)`; page lists with `Page` and `Link`.
-5. Unsupported features answer empty lists or 422 with a message, never 404 or 500, so clients degrade.
+5. Unsupported features answer empty lists or 422 with a message, never 404 or 500, so clients degrade. Any `/api`
+   error that leaves without a body (a challenge, a 404 from routing, a 429) gets Mastodon's `{"error": ...}` from
+   `UseMastodonErrorBodies`. `NeverFiveHundredTests` walks every route with junk ids, anonymously, as a persona and
+   with a junk token.
 6. Advertise `4.2.0 (compatible; PrivaPub)` until grouped notifications exist.
+7. **What a Mastodon `Status` cannot say goes in `Status.privapub`** (`PrivaPubStatus`): object type, title, excerpt,
+   cover, the author's source, link, video, audio and event details, and up/down votes. Every media URL in it goes
+   through the proxy; only page links (`link.url`, an event's online link) point at the remote site, because following
+   one is the reader's choice.
 
 ## Media invariants
 
@@ -200,6 +217,16 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
    sibling `media-proxy`, which `/media/files` does not serve.
 3. **A client never contacts a remote server for media:** every remote URL the API returns goes through
    `IMediaProxy.Wrap`, an HMAC-signed `/media/proxy/` URL fetched by `IFederationHttp.GetMedia`.
+4. **The proxy serves three ways:**
+   - **Cached:** a file already cached is served from disk, ranges included.
+   - **Downloaded:** a request without a `Range` is downloaded whole, up to `Media:MaxProxiedBytes`, then cached.
+   - **Streamed:** a ranged request, or anything too big to cache, is streamed from the origin with the range passed on,
+     and never cached. That is how remote video plays.
+
+   nginx has a `/media/proxy/` location with `proxy_buffering off` and a 600 s read timeout for those streams.
+5. **Remote video and audio become one playable attachment** in the Mastodon API (`MastodonMapper.Playable`): the best MP4
+   up to 720p that carries both sound and picture, including PeerTube's fragmented files inside an HLS entry. HLS
+   playlists themselves are not rewritten.
 
 ## Privacy invariants
 
@@ -209,9 +236,29 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
   equal to the login.
 - **One username space:** personas, groups and the instance reserve their name in `ReservedName` (unique index) before
   they are saved; `LocalActorService.TryReserveUserName` is the only way to claim one.
+- **Usernames are `Constants.UserNameRegex`** (`^[a-z0-9_]+$`): the intersection of what Mastodon and Misskey accept. A
+  name outside it creates a persona nobody on those servers can reach.
+- **An actor's `published` is `PublishedOn`**, a random whole day up to two weeks before creation, so personas made the
+  same day do not share a date. New persona and group ids carry that same day (`GenerateNewID`), because local clients
+  see ids. Never emit `CreatedAt`.
 - **Per-avatar state stays per avatar:** blocks, mutes, notifications, follows. Nothing may relate sibling avatars.
-- **Blocks never federate,** and reports leave as `Flag` from the instance actor.
+- **Blocks federate** (owner decision, 2026-10-01): a block is sent as `Block` from the blocking avatar, an unblock as
+  `Undo{Block}`. Reports still leave as `Flag` from the instance actor, never from the reporting avatar.
+- **What PrivaPub reveals is the owner's call.** Previews, blocks, website authorship, views, bridging and reactions were
+  decided in `docs/ROADMAP.md` ("Owner decisions on what PrivaPub reveals"). Anything new that tells another server
+  something about an avatar gets the same treatment: ask, then record it there.
 - **Location-ranged posts never federate.**
+- **Statistics name servers, never people** (owner decisions on statistics, 2026-10-03). Every interaction is recorded
+  through `IInteractionLedger` (`Infrastructure/Statistics`) as an `InteractionEvent` (90 days), but an event never
+  holds a root, persona or group id, an activity id, an inbox URL, a remote actor URI or a sender IP:
+  - Distinct remote accounts are counted with `ActorHash`, an HMAC keyed by that day's `InteractionSalt`, which the
+    day's rollup deletes.
+  - `LocalKind` survives `Interactions.Sanitize` only on public and unlisted traffic, so a circle can show neither by
+    presence nor by absence, and no reason code names one.
+  - Traffic a reader causes (the media proxy, lookups, the client API, fetches of our own documents) is only counted
+    per day (`Count`, `CountServer`), never logged per event.
+  - A host claimed by an unverified sender is kept only if it is already a `RemoteInstance`.
+  - `Record` never blocks and never throws: it writes to a bounded channel, and a full channel drops and counts.
 
 ## Data
 
@@ -221,6 +268,50 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
 - **Collection name = class name, so never rename an entity class.**
 - `Entity.ID` is a 24-character lowercase hex string; `GenerateNewID()` returns `object`, so cast it.
 - New fields must be additive: a deploy rollback restores the binary, not the database.
+- **Every stored remote object has an `ObjectRecord`** (raw JSON up to 256 KB plus its hash; delivered or fetched; the
+  activity, inbox, key and signed headers; received time; up to 10 later revisions). Write it right after the post's
+  save: `CreateHandler` (delivered) and `RemotePosts.StoreContext` (fetched) do, and `UpdateHandler` appends a
+  revision. Delivery details reach them through `Arrival.Current`, which `InboxProcessor` sets for the handler's
+  duration. A fetched record has no signature, key or `@context` of the activity that caused the fetch (its activity
+  fields name that trigger), and every record stores its `Extensions` and `ContextNamespaces` for statistics. The raw form lives outside `Post` so timelines never load it. Read through
+  `/api/privapub/v1/statuses/:id/provenance` and `/api/privapub/v1/instances/:host`.
+- **Remote objects are parsed for every shape in `ObjectShapes`:** `url`/`icon`/`image` as a value, an object or an
+  array; Markdown `content`; missing `mediaType`s inferred; thumbnails from any of their five places; and the typed
+  `Link`, `Video`, `Audio` and `Event` details. A Mastodon API card is built from those, never by fetching the linked page
+  (that fetch is the owner's decision 1, for P6).
+- **An `Update` is an edit only when its `updated` is newer than ours** (`RemoteEdits.IsEdit`; plain and community-wrapped
+  Updates both go through `RemoteEdits.Apply`, and deletes through `RemoteDeletes.Remove`). Otherwise it refreshes
+  the poll, video, audio and event details and nothing else, and leaves no revision: Mastodon and Misskey refresh poll
+  counts with bare Updates.
+- **A poll vote is a `Note` with a `name`, an `inReplyTo` that is a poll we hold, and no content.** `CreateHandler`
+  hands it to `PollService.Receive` before anything else, so it never becomes a reply. Our votes on other servers' polls
+  go only to the poll's author, without `published` (PieFed counts a vote only then).
+- **Link previews follow owner decision 1** (`Domain/Content/LinkPreviews.cs`): only public posts, queued on arrival with
+  0–60 s of jitter, one cached `LinkPreview` per address for the whole server, never fetched when someone reads.
+  `LinkPreviews.Wanted` is called where posts are saved (`CreateHandler`, `StoreContext`, `StatusService.Publish`).
+- **Quote states come from `QuoteService.Resolve`:**
+  - with a stamp: accepted only if `Verified` (fetched, on the quoted author's origin, naming both posts exactly);
+  - a FEP-044f `quote` without a stamp: pending;
+  - older keys only: accepted when the quoted post is public.
+
+  `QuotesCount` moves with the accepted state, never with the raw key. When a persona quotes, `QuotePermission` decides:
+  asking first for posts that state a policy, quoting at once for posts that state none, refusing otherwise. Only `quote`
+  of a post that asks for consent puts `quote` in our JSON; older-key quotes leave it out, as Sharkey learned they must.
+- **Our quote policy is `ActivityPubRenderer.QuotableBy`:** the post's `LocalQuotePolicy`, falling back to the persona's
+  `Settings.QuotePolicy` (default `public`, owner decision), and always `nobody` for anything but public and unlisted. The
+  same rule writes `canQuote`, answers `QuoteRequest`s (`QuoteService.ReceiveRequest`) and fills `quote_approval`, so they
+  cannot disagree. A persona quoting another persona gets a parrot-licence too, so other servers see an approved quote.
+- **A server is described on arrival, never on read.** The first record from a host enqueues `DescribeInstance` (its
+  NodeInfo, at most once a week, into `RemoteInstance`), so opening the details view tells nobody anything.
+- **Post ids are the timeline order, so they follow arrival, not `published`.** `PrivacyIds.Arrived` gives a remote post
+  published within the last hour (or in the future) a fresh `ObjectId`, which sorts after every post already stored,
+  and only backfill keeps a `published`-derived id. With `published` ids a reply arriving in the same second could sort
+  under the post it answers, and a late arrival landed behind a client's `since_id` and was never seen. `created_at`
+  comes from `CreationDate`, never from the id.
+- **The same ordering problem exists on the other side, so `published` carries milliseconds**
+  (`ActivityPubRenderer.Timestamp`). GoToSocial (ULIDs) and Mastodon (Snowflakes) derive a remote status's id from
+  `published` at millisecond resolution. With whole seconds, two of our posts from the same second sorted at random
+  there.
 - **Startup order:** `EntityMaps.Warm()` (every entity's class map, one at a time; two mapped at once throw "An item
   with the same key has already been added" and stay broken), then `MigrateAsync` (`Infrastructure/Data/Migrations`,
   `_NNN_` order, each runs once), then `Indexes.Create()`. A new entity needs nothing; a new unique index needs a
@@ -238,26 +329,79 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
 - Localised strings go through `IStringLocalizer<GenericRes>`.
 - Every `Display`/`ErrorMessage` resource key must exist in `FieldsNameResource`/`ErrorsResource`, including the
   `Designer.cs`, which the CLI build doesn't regenerate. A missing key throws at validation time.
+- **`cond ? value : default` with a value-type branch is the type's default, not null:** `false`, `0`, or year one
+  stored as an edit date on every remote post. Write `(T?)null`. It has shipped four times (`MastodonParams.Bool/Int`,
+  `NoteParser.Int`, `NoteParser.Time`).
 - ActivityPub output is built with `System.Text.Json.Nodes` in `ActivityPubRenderer`, not typed models. Inbound
-  documents are read through `InboxService.Id`/`Value`, which handle string, object and array.
+  documents are read through `ActivityJson.Id`/`Value`, which handle string, object and array.
 - Libraries chosen for the roadmap: HtmlSanitizer, Markdig (`DisableHtml`), NSign (RFC 9421 inbound), OpenIddict +
   OpenIddict.MongoDb, NetVips, Blurhash.Core, FFMpegCore. No ImageSharp (licence key enforced), no MassTransit.
 
 ## Testing
 
 `PrivaPub.Tests` (xUnit v3). Unit tests need nothing; tests marked `Category=Integration` need a mongod and skip
-without `PRIVAPUB_TEST_MONGOD=1`. CI runs the unit tests only (the box's mongods are production).
+without `PRIVAPUB_TEST_MONGOD=1`. CI (`build.yml` and `deploy.yml`) runs all of them through
+`tools/ci/with-test-mongod.sh`, which starts a throwaway mongod on a random localhost port and deletes it afterwards.
+The box's own mongods are production, so `MongoFixture` refuses port 27022, a data directory under `/var/lib/privapub`,
+and in CI anything but the wrapper's mongod. With `PRIVAPUB_TEST_REQUIRE_MONGOD=1`, which the wrapper sets, a missing
+mongod fails the run instead of silently skipping half the tests.
 
 - `Support/Peer` is an in-process HTTP server answering on two origins (`127.0.0.1` and `localhost`), so origin rules
   can be tested; `Support/RemoteActor` signs real deliveries with its own key.
-- Inbox scenarios go through `InboxService.Receive` with a signed request, not through the private handlers.
+- Inbox scenarios go through `InboxReceiver.Receive` with a signed request, not through the private handlers.
+- `Support/Host/PrivaPubHost` is the whole server under test (`WebApplicationFactory<Program>`, environment `Testing`,
+  configured only through `UseSetting`, on the fixture's database). `PrivaPubHost.Shared()` boots it once per run;
+  `SecureModeHost` is the same with `Federation:SecureMode`. Background workers are removed, so a test runs the jobs it
+  queued with `host.Run(j => ...)` or `host.RunInbox(activityId)`. `Accounts` signs a root up, adds personas, and gets a
+  Mastodon token through the real `/oauth` code flow; `RemoteActor.SignedPost`/`SignedGet` sign `HttpRequestMessage`s
+  for the real `/peasants` routes. Each client gets its own `X-Test-Client` address, so rate limits don't collide.
+- All test classes share one database and run in parallel, so a test touches only rows it made:
+  - random names and GUIDs;
+  - `Harness.Outgoing` sees only deliveries queued since that harness started, because Peer ports are reused;
+  - a worker gets a scoped `new JobQueue(j => ...)` so it never leases another test's jobs;
+  - domain blocks are set with `DomainBlocks.Load`, never written to the database.
+
+  A test that must change something database-wide (drop indexes, run a migration over every post, let deliveries to
+  `localhost` fail and trip its breaker) goes in `[Xunit.Collection(nameof(Exclusive))]`, which runs alone, and
+  cleans up after itself. Pure logic belongs in an unconditional unit test, not in a Mongo-gated class.
 
 Beyond the tests, verify by building, running locally, and exercising:
 - the client API (sign up, create an avatar, a group, a post);
 - the ActivityPub endpoints with curl and `Accept: application/activity+json`.
 
-Interop is checked against real servers: Fediverse Pasture with podman on the workstation, verify.funfedi.dev, and
-the owner's GoToSocial at social.arasaka.software. **Ask before acting from the owner's GoToSocial account.**
+Interop is checked against real servers, starting with the workstation's own pasture:
+
+```bash
+DOTNET=~/.dotnet/dotnet tools/pasture/run.sh up   # podman: PrivaPub + the latest GoToSocial + Mongo, behind Caddy
+tools/pasture/interop.sh                          # 33 checks, each side driven through its own Mastodon API
+tools/pasture/run.sh down
+```
+
+- **Two sites on one podman network, one Caddy in front.** `privapub.test` and `gts.test` are network aliases of the
+  Caddy container, which serves both with its internal CA (`tls internal`). Both servers are told to accept any
+  certificate: PrivaPub through `appsettings.Pasture.json`, GoToSocial through `GTS_HTTP_CLIENT_TLS_INSECURE_SKIP_VERIFY`.
+  GoToSocial WebFingers and fetches over https only, so plain http between them is not an option.
+- From the workstation, PrivaPub's API is `http://127.0.0.1:6971`. GoToSocial is reached as `https://gts.test:6443`
+  with `curl -k --resolve gts.test:6443:127.0.0.1`, because its sign-in cookie is bound to the host name.
+- **GoToSocial's cached home timeline can stop taking new posts after its first read**, its owner's own included, while
+  a `min_id` query shows them all. So a delivery is checked by looking the object up by URI with `resolve=false`
+  (`on_gts`), which answers from GoToSocial's database and never fetches from us. A home-timeline check there proves
+  nothing, in either direction. A deleted status still turns up in that search as a "deleted status" stub, so a delete
+  is checked as a 404 on `/api/v1/statuses/{id}`.
+- **GoToSocial creates its accounts locked**, so `interop.sh` approves alice's request through
+  `/api/v1/follow_requests`. That also checks our pending (`requested`) state and the manual Accept.
+- The scenario covers:
+  - discovery and follows both ways;
+  - posts and CW;
+  - a reply and its notification;
+  - likes and boosts both ways;
+  - DMs both ways, and the DM staying off public timelines;
+  - edit, delete both ways, and unfollow.
+- `run.sh up` replaces every container, Mongo included, so each run starts clean. To keep the data, republish into
+  `tools/pasture/.publish` and `podman restart pasture-privapub`; that is how a migration is tried on dirty data.
+
+After the pasture, verify.funfedi.dev and the owner's GoToSocial at social.arasaka.software. **Ask before acting from
+the owner's GoToSocial account.**
 
 ## Deploy
 

FEDERATION.md

@@ -10,14 +10,31 @@ PrivaPub is an ActivityPub server written in C#. This document follows
 - [HTTP Signatures](https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures), `rsa-sha256` / `hs2019` with RSA keys
 - [NodeInfo](https://nodeinfo.diaspora.software/) 2.0 and 2.1
 
+## Tested against
+
+- **GoToSocial 0.22.1, end to end.** It runs in a private network on the workstation (`tools/pasture/`) and is driven
+  through its own client API. Checked both ways:
+  - follows, including to a locked account;
+  - public posts with a content warning;
+  - replies with notifications;
+  - likes and boosts;
+  - direct messages;
+  - edits and deletes;
+  - unfollow.
+- **Mastodon, Misskey, Lemmy and PeerTube, by unit tests only.** The tests feed the parser documents written in each
+  server's shape. No live exchange with any of them has run yet.
+
 ## Supported FEPs
 
 - [FEP-67ff: FEDERATION.md](https://codeberg.org/fediverse/fep/src/branch/main/fep/67ff/fep-67ff.md)
 - [FEP-f1d5: NodeInfo in Fediverse Software](https://codeberg.org/fediverse/fep/src/branch/main/fep/f1d5/fep-f1d5.md)
 - [FEP-2c59: Discovery of a WebFinger address from an ActivityPub actor](https://codeberg.org/fediverse/fep/src/branch/main/fep/2c59/fep-2c59.md)
+- [FEP-1b12: Group federation](https://codeberg.org/fediverse/fep/src/branch/main/fep/1b12/fep-1b12.md) (communities; see "Groups")
 
-Planned: FEP-1b12 (communities), FEP-8fcf (followers synchronisation), FEP-5feb (`indexable`), FEP-7628 (Move),
-FEP-044f (quotes).
+Planned (see `docs/ROADMAP.md`, phases P5 to P8, and the per-platform notes in `docs/INTEROP.md`): FEP-044f (quotes),
+FEP-9967 (polls), FEP-c0e0 (emoji reactions), FEP-9098 (custom emoji), FEP-7888 and FEP-f228 (threads), FEP-7628 (Move),
+FEP-8fcf (followers synchronisation), FEP-5feb (`indexable`), FEP-8967 (link attachments), FEP-521a and FEP-8b32 (keys
+and integrity proofs), FEP-ae0c (relays).
 
 ## Actors
 
@@ -33,13 +50,15 @@ actor document, a collection, NodeInfo or a delivery relates two avatars of the
 | Followers / following | `/peasants/{name}/groupies`, `/peasants/{name}/stalking` |
 | Objects | `/peasants/{name}/scribbles/{id}` |
 | Activities | `/peasants/{name}/grunts/{id}` |
+| Quote permissions (`QuoteAuthorization`) | `/peasants/{name}/parrot-licences/{id}` |
 | Direct-message context | `/peasants/{name}/whispers/{id}` |
 | Profile and post pages | `/@{name}`, `/@{name}/{id}` |
 
 The names are the project's own and are stable; resolve actors through WebFinger, not by guessing a path.
 
 - The key is `{actor}#main-key`, RSA 2048, served as SPKI PEM with `owner` set to the actor.
-- `published` on an actor is truncated to the day. `indexable` is `false`.
+- `published` on an actor is a whole day, chosen at random up to two weeks before the account was made, so two
+  personas made on the same day do not share a date. `indexable` is `false`.
 - The instance actor is `/peasants/privapub` (type `Application`). It signs every fetch PrivaPub makes, so no avatar's key
   is used to read another server's content.
 
@@ -47,10 +66,18 @@ The names are the project's own and are stable; resolve actors through WebFinger
 
 A group is either a **community** or a **circle**.
 
-- A community is a `Group` actor. It accepts `Follow` and re-shares (`Announce`) posts from its followers that address
-  it. Full FEP-1b12 behaviour (announcing activities, `audience`, moderation) is planned.
-- A circle is private and does not federate yet: its actor, collections and WebFinger answer 404, and its posts are never
-  delivered.
+- A **community** follows [FEP-1b12](https://codeberg.org/fediverse/fep/src/branch/main/fep/1b12/fep-1b12.md). Posts
+  addressed to it (in `to`, `cc` or `audience`) are accepted according to its posting policy (followers, anyone, or
+  moderators only) and the group `Announce`s the whole activity, with `audience` set, to its followers. A new post is
+  also announced as an object so Mastodon shows it. Updates and deletes of community content are announced too. A
+  top-level post is a `Page` with a `name`. Members are counted at `/flock`; moderators are listed at `/wardens`, which
+  the actor's `attributedTo` points to, with `postingRestrictedToMods` as Lemmy expects. A mention of a community posts into it.
+- A **circle** is private. Its actor is not discoverable and every follow is a request. Its posts are addressed to the
+  circle and its members collection, delivered to each member's own inbox and never announced. They are served only
+  to a signed request from a member, or from the instance actor of a member's server; anyone else gets 404. A
+  Mastodon member's replies reach only the people they mention.
+- Announces from **remote** groups (Lemmy communities) are followed through to the activity: the object is fetched
+  from its own origin, never taken from the announce.
 
 ## Activities
 
@@ -61,30 +88,84 @@ Received:
 | `Follow` | follows an avatar or community; `Accept` is sent unless the community approves members by hand |
 | `Accept{Follow}`, `Reject{Follow}` | completes or ends a follow an avatar requested |
 | `Undo{Follow, Like, Announce}` | reverses it |
-| `Create{Note, Article, Page, Question, …}` | stored when a local avatar follows the author, is addressed or mentioned, when it replies to a local post, or when it is addressed to a community the author follows; a public parent is fetched to complete the thread |
+| `Create{Note, Article, Page, Question, Video, Audio, Event, ChatMessage, …}` | stored when a local avatar follows the author, is addressed or mentioned, when it replies to a local post, or when it is addressed to a community the author follows; a public parent is fetched to complete the thread |
 | `Update{Note}` | replaces the content; the previous version is kept |
 | `Update{Person}` | refetches the actor |
 | `Like` | counted and notified, on posts the liker could see |
+| `Dislike` | counted as a downvote (Lemmy, PieFed, Mbin, Friendica); `Undo` takes it back |
+| `EmojiReact`, `Like` with an emoji `content` | an emoji reaction (FEP-c0e0; Pleroma, Akkoma, Iceshrimp.NET, Misskey, Sharkey), Unicode or a custom emoji from its `tag`; a `Like` whose content is ❤ stays a favourite; `Undo` takes it back |
+| `Join` | answered with `Ignore`: PrivaPub hosts no events yet (FEP-8a8e) |
 | `Announce` | counted and notified for local posts; shown to followers of the announcer, with the original refetched from its origin |
-| `Delete` | deletes the object, or the actor and its follows |
+| `Delete` | deletes the object, or the actor and its follows; a deleted object id is remembered for 90 days, so a late `Create` cannot bring it back |
 | `Flag` | becomes a report for this server's moderators |
 
-Sent: `Follow`, `Undo{Follow}`, `Create{Note}`, `Update{Note}`, `Update{Person}`, `Delete{Tombstone}`, `Accept{Follow}`,
+Sent: `Follow`, `Undo{Follow}`, `Create{Note}`, `Create{Question}` and poll votes, `EmojiReact` and its `Undo`, `Update{Note}`, `Update{Person}`, `Delete{Tombstone}`, `Accept{Follow}`,
 `Reject{Follow}`, `Like`, `Announce` and their `Undo`, `Flag`. A deleted post answers 410 with a `Tombstone`.
 
 - **Attachments** are `Document`s with `mediaType`, `name` (alt text), `blurhash`, `focalPoint`, `width` and `height`.
   Uploaded files have all metadata removed.
 - **Pinned posts** are the actor's `featured` collection (`/trophies`); `featuredTags` is `/tattoos`.
-- **Blocks are never sent.** A blocked account is sent `Reject{Follow}` if it followed, and is unfollowed.
+- **Blocks are sent.** A blocked remote account receives `Block` from the blocking account (and `Reject{Follow}` if it
+  followed); an unblock sends `Undo{Block}`.
 - **Reports** are sent as `Flag` by the instance actor, never by the reporting account.
 
 A `Create`'s `Note` carries Mastodon's `content`, `contentMap`, `summary` and `sensitive`, plus `Mention` and `Hashtag`
-tags. A post's title becomes `name` and is also the first, bold line of `content`, because Mastodon does not show
+tags.
+
+**Polls** (FEP-9967) go out as a `Question` with `oneOf` or `anyOf`, each option's count in `replies.totalItems`,
+`endTime`, `votersCount`, and `closed` once it has ended. Incoming votes are `Create{Note{name, inReplyTo}}` with no
+content, one per choice, counted once per voter. Counts are refreshed with an `Update{Question}` at most every three
+minutes. Our own votes on other servers' polls are sent the same way to the poll's author only, without `published`.
+An incoming `Update` without a newer `updated` only refreshes counts and details; it is never recorded as an edit.
+
+**Quotes** (FEP-044f, with the older keys):
+- **Received.** A quote is read from `quote`, `quoteUrl`, `quoteUri`, `_misskey_quote` or a FEP-e232 `Link` tag.
+  - With a `quoteAuthorization`, the stamp is fetched and must be a `QuoteAuthorization` on the quoted author's origin,
+    attributed to them, naming exactly the two posts.
+  - A FEP-044f `quote` without a stamp is pending until an `Update` brings one.
+  - A quote made with the older keys only, by software that asks nobody, is shown when the quoted post is public.
+  - A `Delete` of a stamp revokes the quote.
+- **Sent.** Our accounts quote with every key, plus the `RE:` fallback.
+  - When the quoted post states an `interactionPolicy.canQuote` that allows us, `quote` is included and a `QuoteRequest`
+    (with the quoting post as `instrument`) goes to the quoted author. The quote stays pending until their `Accept` brings a
+    stamp we can verify; the post is then updated with `quoteAuthorization`.
+  - Posts that state no policy are quoted the older way, without `quote`.
+  - Quoting posts are also delivered to the quoted author.
+- **Quoting our accounts.** Our public and unlisted posts state `interactionPolicy.canQuote`. By default anyone may quote,
+  automatically (as on Mastodon); an account can choose followers only or nobody, and so can each post.
+  - A `QuoteRequest` is answered with `Accept{result}` naming a stamp at `/peasants/{name}/parrot-licences/{id}`, or
+    with `Reject`.
+  - A stamp is a `QuoteAuthorization` naming both posts. A revoked stamp answers 410 and is announced with
+    `Delete{stamp}`.
+  - Followers-only posts and DMs can never be quoted.
+
+**Custom emoji** (`Emoji` tags) are read on posts, display names, bios and profile fields, at most 64 per object.
+**Profiles** keep their header, profile fields, `manuallyApprovesFollowers`, `published`, `movedTo`, `indexable`,
+`memorial` and avatar and header descriptions. A post's title becomes `name` and is also the first, bold line of `content`, because Mastodon does not show
 `name`. A content warning without its own text uses the title, or "Content warning".
 
+Received `summary` is a content warning only on a `Note` or `Question`, or when `sensitive` is `true`. On an `Article`,
+`Page`, `Event`, `Video` or `Audio` it is an excerpt or description, kept as such and never hidden.
+
 Visibility is expressed in `to`/`cc` the way Mastodon does it: public, unlisted, followers-only and direct. Inbound
 followers-only posts are recognised by the author's own `followers` collection.
 
+## Link previews
+
+For a public post that links to a page, PrivaPub builds a preview card. It uses, in order:
+1. a Link attachment's own `preview` (FEP-8967) or the post's own image, title and summary;
+2. otherwise, the linked page, read once by the server between 0 and 60 seconds after the post arrives (never when
+   someone reads it), with an `Accept: text/html` request that reads at most 512 KB, through the same address checks as
+   every other fetch.
+
+The page's OpenGraph and Twitter tags give the title, description and image; the result is cached per address for 7
+days and shared by every account on the server. Images are served to clients only through PrivaPub's media proxy.
+`Federation:FetchLinkPreviews=false` turns page fetching off.
+
+## Local-only posts
+
+Posts with a location (shown to nearby users of this server) never leave the server, in any form.
+
 ## Security rules a peer will notice
 
 - **Signatures.** Inbox POSTs must be signed over `(request-target)`, `host`, `digest` and `date` (or `(created)`). The
@@ -96,12 +177,18 @@ followers-only posts are recognised by the author's own `followers` collection.
 - **Fetching.** All fetches are signed by the instance actor. They go only to public addresses, follow at most three
   redirects and read at most 1 MB.
 - **HTML.** Received HTML is sanitised to Mastodon's allowlist.
+- **Keys we cannot fetch for now.** When a sender's key cannot be fetched because its server timed out or answered
+  5xx, the inbox answers 503 with `Retry-After: 300` rather than 401.
+- **Activity ids.** `Create` and `Announce` ids dereference. `Follow`, `Like`, `Block` and the `Accept`, `Reject` and
+  `Undo` that answer them do not, because serving them would reveal who follows, likes and blocks whom; they are always
+  sent with their object embedded.
 - **Delivery.** Failed deliveries are retried with Mastodon's backoff (16 attempts). A host that keeps failing is paused,
   starting at an hour and growing to a week.
 
 ## Known limitations
 
-- Polls and custom emoji are not implemented.
-- Remote media is fetched through this server's proxy when a local client displays it.
+- Our own posts carry no custom emoji: emoji are received and shown, not offered.
+- Remote media is fetched through this server's proxy when a local client displays it. Video and audio are streamed
+  through it with byte ranges passed on, so a PeerTube file is never fetched whole for one viewer.
 - Collections expose counts, not members.
 - Only `rsa-sha256`-style keys are verified. RFC 9421 signatures are planned.

PrivaPub.ClientModels/Constants.cs

@@ -9,5 +9,6 @@
 		public const int GroupInvitationLength = 64;
 
 		public const string PasswordRegex = @"^(?=.*)(?=.*[a-z])(?=.*[A-Z])(?!.*\s).*$";
+		public const string UserNameRegex = "^[a-z0-9_]+$";
 	}
 }

PrivaPub.ClientModels/Group/InsertGroupForm.cs

@@ -12,7 +12,7 @@ namespace PrivaPub.ClientModels.Group
 
 		[Required(ErrorMessageResourceName = "Required", ErrorMessageResourceType = typeof(ErrorsResource)),
 			StringLength(32, MinimumLength = 3, ErrorMessageResourceName = "StringLengthMinMax", ErrorMessageResourceType = typeof(ErrorsResource)),
-			RegularExpression("^[a-z0-9_]+$", ErrorMessageResourceName = "EmptySpacesNotAllowed", ErrorMessageResourceType = typeof(ErrorsResource)),
+			RegularExpression(Constants.UserNameRegex, ErrorMessageResourceName = "InvalidUserName", ErrorMessageResourceType = typeof(ErrorsResource)),
 			NoWhiteSpaces]
 		public string UserName { get; set; }
 
@@ -25,6 +25,7 @@ namespace PrivaPub.ClientModels.Group
 
 		public string InvitationPassword { get; set; }
 		public bool IsCommunity { get; set; }
+		public string PostingPolicy { get; set; }//followers (default), anyone, moderators
 		public bool IsDiscoverable { get; set; } = true;
 		public bool ManuallyApprovesMembers { get; set; }
 	}

PrivaPub.ClientModels/Group/UpdateGroupForm.cs

@@ -20,6 +20,7 @@ namespace PrivaPub.ClientModels.Group
 		public bool RemoveInvitationPassword { get; set; }
 		public bool RegenerateInvitationCode { get; set; }
 		public bool? IsDiscoverable { get; set; }
+		public string PostingPolicy { get; set; }
 		public bool? ManuallyApprovesMembers { get; set; }
 	}
 }

PrivaPub.ClientModels/Group/ViewGroup.cs

@@ -9,6 +9,7 @@ namespace PrivaPub.ClientModels.Group
 		public string Url { get; set; }
 		public string Handle { get; set; }
 		public bool IsCommunity { get; set; }
+		public string PostingPolicy { get; set; }
 		public bool IsDiscoverable { get; set; }
 		public bool ManuallyApprovesMembers { get; set; }
 		public bool IsOwner { get; set; }

PrivaPub.ClientModels/InvitationLoginForm.cs

@@ -12,7 +12,7 @@ namespace PrivaPub.ClientModels
 		public string InvitationCode { get; set; }
 
 		[StringLength(32, MinimumLength = 3, ErrorMessageResourceName = "StringLengthMinMax", ErrorMessageResourceType = typeof(ErrorsResource)),
-			RegularExpression("^[a-z0-9_]+$", ErrorMessageResourceName = "EmptySpacesNotAllowed", ErrorMessageResourceType = typeof(ErrorsResource))]
+			RegularExpression(Constants.UserNameRegex, ErrorMessageResourceName = "InvalidUserName", ErrorMessageResourceType = typeof(ErrorsResource))]
 		public string AvatarUserName { get; set; }
 
 		[StringLength(64, ErrorMessageResourceName = "MaxLengthString", ErrorMessageResourceType = typeof(ErrorsResource))]

PrivaPub.ClientModels/Post/InsertPostForm.cs

@@ -24,6 +24,15 @@ namespace PrivaPub.ClientModels.Post
 		public string SpoilerText { get; set; }
 
 		public string Visibility { get; set; }//public (default), unlisted, followersonly
+
+		[Range(-90, 90, ErrorMessageResourceName = "Range", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public double? Latitude { get; set; }
+
+		[Range(-180, 180, ErrorMessageResourceName = "Range", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public double? Longitude { get; set; }
+
+		[Range(1, 50, ErrorMessageResourceName = "Range", ErrorMessageResourceType = typeof(ErrorsResource))]
+		public double? RangeKm { get; set; }
 	}
 
 	public class UpdatePostForm

PrivaPub.ClientModels/Post/ViewPost.cs

@@ -17,6 +17,8 @@ namespace PrivaPub.ClientModels.Post
 		public bool IsFederatedCopy { get; set; }
 		public DateTime CreationDate { get; set; }
 		public ViewPost ReblogOf { get; set; }
+		public double? RangeKm { get; set; }
+		public double? DistanceKm { get; set; }
 	}
 
 	public class ViewDmGroup

PrivaPub.ClientModels/Resources/ErrorsResource.Designer.cs

@@ -105,6 +105,15 @@ namespace PrivaPub.ClientModels.Resources {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to Use only lower-case letters, digits and underscores..
+        /// </summary>
+        public static string InvalidUserName {
+            get {
+                return ResourceManager.GetString("InvalidUserName", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to Invalid password, upper-case, lower-case and number characters required..
         /// </summary>

PrivaPub.ClientModels/Resources/ErrorsResource.it.resx

@@ -132,6 +132,9 @@
   <data name="InvalidEmail" xml:space="preserve">
     <value>{0} è invalida.</value>
   </data>
+  <data name="InvalidUserName" xml:space="preserve">
+    <value>Usa solo lettere minuscole, cifre e trattini bassi.</value>
+  </data>
   <data name="InvalidPassword" xml:space="preserve">
     <value>Password non valida, deve avere almeno un carattere grande, un carattere piccolo ed un numero.</value>
   </data>

PrivaPub.ClientModels/Resources/ErrorsResource.resx

@@ -132,6 +132,9 @@
   <data name="InvalidEmail" xml:space="preserve">
     <value>{0} is invalid.</value>
   </data>
+  <data name="InvalidUserName" xml:space="preserve">
+    <value>Use only lower-case letters, digits and underscores.</value>
+  </data>
   <data name="InvalidPassword" xml:space="preserve">
     <value>Invalid password, upper-case, lower-case and number characters required.</value>
   </data>

PrivaPub.ClientModels/User/Avatar/InsertAvatarForm.cs

@@ -20,6 +20,7 @@ namespace PrivaPub.ClientModels.User.Avatar
 
 		[Required(ErrorMessageResourceName = "Required", ErrorMessageResourceType = typeof(ErrorsResource)),
 			StringLength(Constants.MaxAvatarNameLength, ErrorMessageResourceName = "StringLength", ErrorMessageResourceType = typeof(ErrorsResource)),
+			RegularExpression(Constants.UserNameRegex, ErrorMessageResourceName = "InvalidUserName", ErrorMessageResourceType = typeof(ErrorsResource)),
 				Display(Name = nameof(UserName), ResourceType = typeof(FieldsNameResource))]
 		public string UserName { get; set; }//preferredUsername
 

PrivaPub.Tests/Api/StatusContentTests.cs

@@ -0,0 +1,29 @@
+using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Models.Post;
+
+namespace PrivaPub.Tests.Api
+{
+	public class StatusContentTests
+	{
+		[Fact]
+		public void A_remote_article_shows_its_title_above_its_body() =>
+			Assert.Equal("<p><strong>Rain &amp; sun</strong></p><p>body</p>", MastodonMapper.Content(new Post
+			{
+				IsFederatedCopy = true, ObjectType = "Article", Title = "Rain & sun", ContentHtml = "<p>body</p>"
+			}));
+
+		[Fact]
+		public void A_remote_note_keeps_its_content_alone() =>
+			Assert.Equal("<p>body</p>", MastodonMapper.Content(new Post
+			{
+				IsFederatedCopy = true, ObjectType = "Note", Title = "a poll choice", ContentHtml = "<p>body</p>"
+			}));
+
+		[Fact]
+		public void A_remote_event_without_a_body_shows_its_excerpt() =>
+			Assert.Equal("<p><strong>Meetup</strong></p><p>Saturday &lt;10:00&gt;</p>", MastodonMapper.Content(new Post
+			{
+				IsFederatedCopy = true, ObjectType = "Event", Title = "Meetup", Excerpt = "Saturday <10:00>", ContentHtml = string.Empty
+			}));
+	}
+}

PrivaPub.Tests/Domain/LinkPreviewTests.cs

@@ -0,0 +1,43 @@
+using PrivaPub.Domain.Content;
+using PrivaPub.Models.Post;
+
+namespace PrivaPub.Tests.Domain
+{
+	public class LinkPreviewTests
+	{
+		[Fact]
+		public void Reads_open_graph_then_twitter_then_the_page_title()
+		{
+			var preview = LinkPreviews.Read("https://news.example/a?utm_source=x", new Uri("https://news.example/a"), """
+				<html><head><title>Fallback title</title>
+				<meta property="og:title" content="Rain &amp; sun">
+				<meta name="twitter:description" content="A <b>long</b> story">
+				<meta property="og:image" content="/img/cover.jpg">
+				<meta property="og:site_name" content="News">
+				</head><body></body></html>
+				""");
+
+			Assert.Equal("Rain & sun", preview.Title);
+			Assert.Equal("A long story", preview.Description);
+			Assert.Equal("https://news.example/img/cover.jpg", preview.ImageURL);
+			Assert.Equal("News", preview.SiteName);
+			Assert.False(preview.Failed);
+			Assert.True(LinkPreviews.Read("https://x.example", new Uri("https://x.example"), "<html><body>nothing</body></html>").Failed);
+		}
+
+		[Fact]
+		public void Picks_the_first_real_link_and_skips_mentions_tags_quotes_and_ourselves() =>
+			Assert.Equal("https://blog.example/post", LinkPreviews.FirstLink(new Post
+			{
+				Url = "https://m.example/@a/1",
+				ContentHtml = """
+					<p><span class="h-card"><a href="https://m.example/@bob" class="u-url mention">@bob</a></span>
+					<a href="https://m.example/tags/x" class="mention hashtag" rel="tag">#x</a>
+					<span class="quote-inline">RE: <a href="https://k.example/notes/1">link</a></span>
+					<a href="https://privapub.test/@me">me</a>
+					<a href="https://m.example/@a/1">self</a>
+					<a href="https://blog.example/post">read this</a></p>
+					"""
+			}, "https://privapub.test"));
+	}
+}

PrivaPub.Tests/Domain/NearbyTests.cs

@@ -0,0 +1,77 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Post;
+using PrivaPub.Domain.Privacy;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json;
+
+namespace PrivaPub.Tests.Domain
+{
+	[Trait("Category", "Integration")]
+	public sealed class NearbyTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		[Fact]
+		public async Task A_located_post_reaches_only_those_within_its_radius_and_never_leaves_the_server()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var latitude = 10 + Random.Shared.NextDouble() * 50;
+			var longitude = 10 + Random.Shared.NextDouble() * 50;
+			var (aliceRoot, alice) = await _harness.Persona("alice");
+			var (bobRoot, bob) = await _harness.Persona("bob");
+			var (carolRoot, carol) = await _harness.Persona("carol");
+			var follower = new RemoteActor(_harness.Peer, "follower");
+			await _harness.FollowedBy(alice, follower);
+
+			var created = await _harness.Posts.InsertPost(aliceRoot, new InsertPostForm
+			{
+				AvatarId = alice.Id, Text = "free bread at the bakery", Latitude = latitude, Longitude = longitude, RangeKm = 5
+			}, token);
+			var post = await DB.Default.Find<Post>().OneAsync(((ViewPost)created.Data).Id, token);
+
+			var three = (List<ViewPost>)(await _harness.Posts.Nearby(bobRoot, bob.Id, latitude + 0.027, longitude, token)).Data;
+			var eight = (List<ViewPost>)(await _harness.Posts.Nearby(carolRoot, carol.Id, latitude + 0.072, longitude, token)).Data;
+
+			Assert.Equal(PostVisibility.LocalGeo, post.Visibility);
+			Assert.Equal(Math.Round(latitude, 2), post.Geo.Coordinates[1]);
+			Assert.Contains(three, p => p.Id == post.ID);
+			Assert.InRange(three.First(p => p.Id == post.ID).DistanceKm.Value, 2.0, 4.0);
+			Assert.DoesNotContain(eight, p => p.Id == post.ID);
+			Assert.False(await VisibilityPolicy.CanSee(post, bob.Id, token));
+			var outgoing = (await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.Deliver).ExecuteAsync(token))
+				.Select(j => JsonSerializer.Deserialize<DeliveryPayload>(j.Payload))
+				.Where(p => p.Body.Contains(post.ID));
+			Assert.Empty(outgoing);
+		}
+
+		[Fact]
+		public async Task A_located_post_cannot_be_direct_or_in_a_group()
+		{
+			var (root, alice) = await _harness.Persona("alice");
+
+			var result = await _harness.Statuses.Publish(alice, new PrivaPub.Domain.Statuses.StatusDraft
+			{
+				Text = "x", Latitude = 45, Longitude = 7, Visibility = PostVisibility.Direct
+			}, TestContext.Current.CancellationToken);
+
+			Assert.False(result.Ok);
+		}
+	}
+}

PrivaPub.Tests/Domain/RelationshipTests.cs

@@ -62,7 +62,31 @@ namespace PrivaPub.Tests.Domain
 			});
 
 			Assert.False(await DB.Default.Find<Follower>().Match(f => f.LocalActorId == alice.Id).ExecuteAnyAsync(token));
-			Assert.Equal("Reject", Assert.Single(await _harness.Outgoing(mallory.Id + "/inbox"))["type"]!.GetValue<string>());
+			var sent = (await _harness.Outgoing(mallory.Id + "/inbox")).Select(a => a["type"]!.GetValue<string>()).ToList();
+			Assert.Equal(new[] { "Block", "Reject" }, sent.Order());
+		}
+
+		[Fact]
+		public async Task A_block_is_told_to_the_blocked_server_and_so_is_the_unblock()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(mallory)}/follows/{Guid.NewGuid():N}", ["type"] = "Follow", ["actor"] = mallory.Id, ["object"] = alice.Uri
+			});
+
+			await _harness.Relationships.Block(alice, mallory.Id, default, token);
+			await _harness.Relationships.Unblock(alice, mallory.Id, token);
+
+			var sent = await _harness.Outgoing(mallory.Id + "/inbox");
+			var block = Assert.Single(sent, a => a["type"]!.GetValue<string>() == "Block");
+			Assert.Equal(mallory.Id, block["object"]!.GetValue<string>());
+			Assert.Equal(alice.Uri, block["actor"]!.GetValue<string>());
+			var undo = Assert.Single(sent, a => a["type"]!.GetValue<string>() == "Undo");
+			Assert.Equal(block["id"]!.GetValue<string>(), undo["object"]!["id"]!.GetValue<string>());
+			Assert.False(await DB.Default.Find<Block>().Match(b => b.AvatarId == alice.Id).ExecuteAnyAsync(token));
 		}
 
 		[Fact]

PrivaPub.Tests/Federation/ActorFeaturesTests.cs

@@ -0,0 +1,50 @@
+using PrivaPub.Federation.Actors;
+
+using System.Security.Cryptography;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class ActorFeaturesTests
+	{
+		[Fact]
+		public void A_rich_actor_reports_the_extensions_it_uses()
+		{
+			using var rsa = RSA.Create(4096);
+			var actor = new JsonObject
+			{
+				["id"] = "https://social.example/users/a",
+				["type"] = "Person",
+				["featured"] = "https://social.example/users/a/featured",
+				["alsoKnownAs"] = new JsonArray("https://old.example/users/a"),
+				["endpoints"] = new JsonObject { ["sharedInbox"] = "https://social.example/inbox" },
+				["assertionMethod"] = new JsonArray(),
+				["attachment"] = new JsonArray(new JsonObject { ["type"] = "PropertyValue", ["name"] = "x", ["value"] = "y" }),
+				["manuallyApprovesFollowers"] = true,
+				["discoverable"] = false,
+				["indexable"] = true,
+				["isCat"] = true,
+				["_misskey_summary"] = "hi",
+				["publicKey"] = new JsonObject { ["id"] = "https://social.example/users/a#main-key", ["publicKeyPem"] = rsa.ExportSubjectPublicKeyInfoPem() }
+			};
+
+			var features = ActorFeatures.Detect(JsonDocument.Parse(actor.ToJsonString()).RootElement);
+
+			Assert.Equal(new[]
+			{
+				"featured", "also-known-as", "shared-inbox", "fep-521a-assertion-method", "property-value", "misskey", "is-cat",
+				"indexable", "undiscoverable", "locked", "key:rsa-4096"
+			}, features);
+		}
+
+		[Fact]
+		public void A_bare_actor_reports_nothing_and_junk_is_survived()
+		{
+			Assert.Empty(ActorFeatures.Detect(JsonDocument.Parse("{\"id\":\"https://a.example/u\",\"type\":\"Person\"}").RootElement));
+			Assert.Equal(new[] { "public-key-array" },
+				ActorFeatures.Detect(JsonDocument.Parse("{\"publicKey\":[{\"publicKeyPem\":\"not a key\"}]}").RootElement));
+			Assert.Empty(ActorFeatures.Detect(JsonDocument.Parse("[1,2]").RootElement));
+		}
+	}
+}

PrivaPub.Tests/Federation/ActorProfileTests.cs

@@ -0,0 +1,41 @@
+using PrivaPub.Federation.Actors;
+
+using System.Text.Json;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class ActorProfileTests
+	{
+		[Fact]
+		public void Reads_a_mastodon_profile_with_its_header_fields_emoji_and_lock()
+		{
+			using var json = JsonDocument.Parse("""
+				{
+					"id": "https://m.example/users/ann", "type": "Person", "preferredUsername": "ann", "name": "Ann :sparkle:",
+					"inbox": "https://m.example/users/ann/inbox", "manuallyApprovesFollowers": true, "indexable": true, "memorial": false,
+					"published": "2023-04-01T00:00:00Z", "movedTo": "https://n.example/users/ann",
+					"icon": { "type": "Image", "url": "https://m.example/a.png", "summary": "a cat" },
+					"image": { "type": "Image", "url": "https://m.example/h.png", "name": "mountains" },
+					"tag": [{ "type": "Emoji", "name": ":sparkle:", "icon": { "type": "Image", "url": "https://m.example/emoji/sparkle.png" } }],
+					"attachment": [
+						{ "type": "PropertyValue", "name": "Site", "value": "<a href=\"https://ann.example\" rel=\"me\">ann.example</a><script>x</script>" },
+						{ "type": "PropertyValue", "name": "Pronouns", "value": "she/her" }
+					]
+				}
+				""");
+
+			var actor = ActorDocument.Parse(json.RootElement);
+
+			Assert.True(actor.Locked);
+			Assert.True(actor.Indexable);
+			Assert.Equal("https://m.example/h.png", actor.Header);
+			Assert.Equal("a cat", actor.IconDescription);
+			Assert.Equal("mountains", actor.HeaderDescription);
+			Assert.Equal("https://n.example/users/ann", actor.MovedTo);
+			Assert.Equal(new DateTime(2023, 4, 1, 0, 0, 0, DateTimeKind.Utc), actor.Published);
+			Assert.Equal("sparkle", Assert.Single(actor.Emojis).Shortcode);
+			Assert.Equal(new[] { "Site", "Pronouns" }, actor.Fields.Keys);
+			Assert.DoesNotContain("<script>", actor.Fields["Site"]);
+		}
+	}
+}

PrivaPub.Tests/Federation/CommunityEditsTests.cs

@@ -0,0 +1,131 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Social;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class CommunityEditsTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		async Task<(RemoteActor Community, RemoteActor Poster, JsonObject Note, Post Post)> Announced()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var community = new RemoteActor(_harness.Peer, "cats", type: "Group");
+			var poster = new RemoteActor(_harness.Peer, "poster");
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = community.Id }, token);
+			await DB.Default.Update<Following>().Match(f => f.AvatarId == alice.Id).Modify(f => f.State, FollowState.Accepted).ExecuteAsync(token);
+			var note = new JsonObject
+			{
+				["id"] = $"{Origin(poster)}/notes/{Guid.NewGuid():N}",
+				["type"] = "Page",
+				["name"] = "a title",
+				["attributedTo"] = poster.Id,
+				["content"] = "<p>first</p>",
+				["to"] = new JsonArray(community.Id, Addressing.Public),
+				["audience"] = community.Id,
+				["published"] = DateTime.UtcNow.AddMinutes(-5).ToString("O")
+			};
+			_harness.Peer.Serve(new Uri(note["id"]!.GetValue<string>()).AbsolutePath, note.ToJsonString());
+			await Announce(community, new JsonObject { ["id"] = $"{Origin(poster)}/create/{Guid.NewGuid():N}", ["type"] = "Create", ["actor"] = poster.Id, ["object"] = note.DeepClone() });
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == note["id"]!.GetValue<string>()).ExecuteSingleAsync(token);
+			return (community, poster, note, post);
+		}
+
+		Task Announce(RemoteActor community, JsonObject inner) =>
+			_harness.Deliver(community, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(community)}/announce/{Guid.NewGuid():N}",
+				["type"] = "Announce",
+				["actor"] = community.Id,
+				["to"] = new JsonArray(Addressing.Public),
+				["object"] = inner
+			});
+
+		[Fact]
+		public async Task A_community_edit_is_an_edit_only_when_newer_and_keeps_its_history()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (community, poster, note, post) = await Announced();
+
+			var refresh = (JsonObject)note.DeepClone();
+			_harness.Peer.Serve(new Uri(note["id"]!.GetValue<string>()).AbsolutePath, refresh.ToJsonString());
+			await Announce(community, new JsonObject { ["id"] = $"{Origin(poster)}/update/{Guid.NewGuid():N}", ["type"] = "Update", ["actor"] = poster.Id, ["object"] = note["id"]!.GetValue<string>() });
+			var afterRefresh = await DB.Default.Find<Post>().OneAsync(post.ID, token);
+
+			var edit = (JsonObject)note.DeepClone();
+			edit["content"] = "<p>second</p>";
+			edit["updated"] = DateTime.UtcNow.ToString("O");
+			_harness.Peer.Serve(new Uri(note["id"]!.GetValue<string>()).AbsolutePath, edit.ToJsonString());
+			await Announce(community, new JsonObject { ["id"] = $"{Origin(poster)}/update/{Guid.NewGuid():N}", ["type"] = "Update", ["actor"] = poster.Id, ["object"] = note["id"]!.GetValue<string>() });
+			var afterEdit = await DB.Default.Find<Post>().OneAsync(post.ID, token);
+			var record = await DB.Default.Find<ObjectRecord>().Match(r => r.ObjectURI == post.ObjectURI).ExecuteSingleAsync(token);
+
+			Assert.Empty(afterRefresh.Revisions);
+			Assert.Null(afterRefresh.EditedAt);
+			Assert.Equal("<p>second</p>", afterEdit.ContentHtml);
+			Assert.Equal("a title", afterEdit.Title);
+			Assert.Single(afterEdit.Revisions);
+			Assert.NotNull(afterEdit.EditedAt);
+			Assert.Equal(2, record.Revisions.Count);
+			Assert.Equal(new[] { "refresh", "edit" }, _harness.Ledger.Of("in").Where(e => e.Activity == "Announce" && e.Object == "Update").Select(e => e.Reason));
+		}
+
+		[Fact]
+		public async Task A_community_delete_leaves_a_tombstone_and_no_trace()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (community, poster, note, post) = await Announced();
+			_harness.Peer.Serve(new Uri(note["id"]!.GetValue<string>()).AbsolutePath, new JsonObject { ["id"] = note["id"]!.GetValue<string>(), ["type"] = "Tombstone" }.ToJsonString());
+
+			await Announce(community, new JsonObject { ["id"] = $"{Origin(poster)}/delete/{Guid.NewGuid():N}", ["type"] = "Delete", ["actor"] = poster.Id, ["object"] = note["id"]!.GetValue<string>() });
+
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ID == post.ID).ExecuteAnyAsync(token));
+			Assert.False(await DB.Default.Find<ObjectRecord>().Match(r => r.ObjectURI == post.ObjectURI).ExecuteAnyAsync(token));
+			Assert.False(await DB.Default.Find<TimelineEntry>().Match(e => e.PostId == post.ID).ExecuteAnyAsync(token));
+			Assert.True(await DB.Default.Find<DeletedObject>().Match(d => d.ObjectURI == post.ObjectURI).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task A_fetched_object_does_not_wear_the_signature_of_the_activity_that_caused_the_fetch()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, _, _, post) = await Announced();
+
+			var record = await DB.Default.Find<ObjectRecord>().Match(r => r.ObjectURI == post.ObjectURI).ExecuteSingleAsync(token);
+
+			Assert.Equal(ObjectPath.Fetched, record.Path);
+			Assert.Null(record.KeyId);
+			Assert.Null(record.SignatureScheme);
+			Assert.Empty(record.SignedHeaders);
+			Assert.Null(record.ActivityContext);
+			Assert.Equal("Announce", record.ActivityType);
+			Assert.InRange(record.ReceivedAt, DateTime.UtcNow.AddMinutes(-1), DateTime.UtcNow.AddSeconds(1));
+			Assert.Contains("fep-1b12-audience", record.Extensions);
+			Assert.NotNull(record.ContextNamespaces);
+		}
+	}
+}

PrivaPub.Tests/Federation/DomainBlocksTests.cs

@@ -0,0 +1,37 @@
+using Microsoft.Extensions.Logging.Abstractions;
+
+using PrivaPub.Federation.Moderation;
+using PrivaPub.Models.Federation;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class DomainBlocksTests
+	{
+		[Fact]
+		public void A_block_covers_subdomains_but_not_lookalikes()
+		{
+			var blocks = new DomainBlocks(NullLogger<DomainBlocks>.Instance);
+			blocks.Load(new[] { new DomainBlock { Domain = "evil.example", Severity = DomainBlockSeverity.Silence } });
+
+			Assert.NotNull(blocks.Find("evil.example"));
+			Assert.NotNull(blocks.Find("A.Evil.Example."));
+			Assert.Null(blocks.Find("notevil.example"));
+			Assert.False(blocks.IsSuspended("evil.example"));
+		}
+
+		[Fact]
+		public void A_suspension_is_found_from_any_subdomain()
+		{
+			var blocks = new DomainBlocks(NullLogger<DomainBlocks>.Instance);
+			blocks.Load(new[]
+			{
+				new DomainBlock { Domain = " Spam.Example. ", Severity = DomainBlockSeverity.Suspend },
+				new DomainBlock { Domain = "", Severity = DomainBlockSeverity.Suspend }
+			});
+
+			Assert.True(blocks.IsSuspended("deep.inside.spam.example"));
+			Assert.False(blocks.IsSuspended("example"));
+			Assert.Null(blocks.Find(default));
+		}
+	}
+}

PrivaPub.Tests/Federation/GroupTests.cs

@@ -0,0 +1,198 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Social;
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Federation.Signing;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Group;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class GroupTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		async Task<(GroupEntity Entity, PrivaPub.Federation.Actors.LocalActor Actor)> Group(GroupKind kind, PostingPolicy policy, string ownerId, params string[] remoteMembers)
+		{
+			var (privateKey, publicKey) = PrivaPub.Federation.Actors.Keys.NewKeyPair();
+			var group = new GroupEntity
+			{
+				UserName = $"{kind}{Guid.NewGuid():N}"[..20].ToLowerInvariant(),
+				Kind = kind,
+				PostingPolicy = policy,
+				PrivateKey = privateKey,
+				PublicKey = publicKey,
+				Members = new() { new GroupMember { AvatarId = ownerId, Role = GroupRole.Owner } }
+			};
+			group.Members.AddRange(remoteMembers.Select(m => new GroupMember { AvatarId = m, IsForeign = true }));
+			await DB.Default.SaveAsync(group);
+			return (group, _harness.Local.FromGroup(group));
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		static JsonObject Create(RemoteActor author, IEnumerable<string> to, string audience = default)
+		{
+			var note = new JsonObject
+			{
+				["id"] = $"{Origin(author)}/notes/{Guid.NewGuid():N}",
+				["type"] = "Note",
+				["attributedTo"] = author.Id,
+				["content"] = "<p>to the group</p>",
+				["to"] = new JsonArray(to.Select(t => (JsonNode)t).ToArray())
+			};
+			if (audience != default)
+				note["audience"] = audience;
+			return new JsonObject { ["id"] = $"{Origin(author)}/activities/{Guid.NewGuid():N}", ["type"] = "Create", ["actor"] = author.Id, ["object"] = note };
+		}
+
+		[Fact]
+		public async Task A_follower_posting_to_a_community_is_announced_activity_and_object()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, owner) = await _harness.Persona("owner");
+			var (_, community) = await Group(GroupKind.Community, PostingPolicy.Followers, owner.Id);
+			var lemmy = new RemoteActor(_harness.Peer, "lemmy");
+			var stranger = new RemoteActor(_harness.Peer, "stranger");
+			await _harness.FollowedBy(community, lemmy);
+
+			await _harness.Deliver(lemmy, "/human-centipede", Create(lemmy, new[] { community.Uri, Addressing.Public }, community.Uri));
+			await _harness.Deliver(stranger, "/human-centipede", Create(stranger, new[] { community.Uri, Addressing.Public }, community.Uri));
+
+			Assert.True(await DB.Default.Find<Post>().Match(p => p.GroupId == community.Id && p.ActorURI == lemmy.Id).ExecuteAnyAsync(token));
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.GroupId == community.Id && p.ActorURI == stranger.Id).ExecuteAnyAsync(token));
+			var announces = (await _harness.Outgoing(lemmy.SharedInbox)).Where(a => a["actor"]!.GetValue<string>() == community.Uri).ToList();
+			Assert.Equal(2, announces.Count);
+			Assert.Contains(announces, a => a["object"] is JsonObject inner && inner["type"]!.GetValue<string>() == "Create" && a["audience"]!.GetValue<string>() == community.Uri);
+			Assert.Contains(announces, a => a["object"] is JsonValue);
+		}
+
+		[Fact]
+		public async Task An_open_community_takes_posts_from_anyone()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, owner) = await _harness.Persona("owner");
+			var (_, community) = await Group(GroupKind.Community, PostingPolicy.Anyone, owner.Id);
+			var stranger = new RemoteActor(_harness.Peer, "stranger");
+
+			await _harness.Deliver(stranger, "/human-centipede", Create(stranger, new[] { community.Uri, Addressing.Public }));
+
+			Assert.True(await DB.Default.Find<Post>().Match(p => p.GroupId == community.Id && p.ActorURI == stranger.Id).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task Mentioning_a_community_posts_into_it_as_a_titled_page()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var (_, community) = await Group(GroupKind.Community, PostingPolicy.Anyone, alice.Id);
+			var follower = new RemoteActor(_harness.Peer, "follower");
+			await _harness.FollowedBy(community, follower);
+
+			var outcome = await _harness.Statuses.Publish(alice, new StatusDraft { Text = $"@{community.UserName} a new thread", PlainText = true }, token);
+
+			Assert.Equal(community.Id, outcome.Post.GroupId);
+			var note = ActivityPubRenderer.Note(outcome.Post, alice, community, default);
+			Assert.Equal("Page", note["type"]!.GetValue<string>());
+			Assert.Equal(community.Uri, note["audience"]!.GetValue<string>());
+			Assert.False(string.IsNullOrEmpty(note["name"]!.GetValue<string>()));
+			Assert.Contains(await _harness.Outgoing(follower.SharedInbox), a => a["type"]!.GetValue<string>() == "Announce");
+		}
+
+		[Fact]
+		public async Task A_circle_post_goes_only_to_members_and_only_members_may_read_it()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var member = new RemoteActor(_harness.Peer, "member");
+			var outsider = new RemoteActor(_harness.Peer, "outsider");
+			var (circleEntity, circle) = await Group(GroupKind.Circle, PostingPolicy.Followers, alice.Id, member.Id);
+			await _harness.Remote.GetActor(member.Id, refresh: false, token);
+			var follower = new RemoteActor(_harness.Peer, "follower");
+			await _harness.FollowedBy(alice, follower);
+
+			var outcome = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "just us", GroupId = circle.Id }, token);
+
+			Assert.Equal(PostVisibility.Circle, outcome.Post.Visibility);
+			var create = Assert.Single(await _harness.Outgoing(member.Id + "/inbox"));
+			Assert.Equal(new[] { circle.Uri, circle.Flock }, create["object"]!["to"]!.AsArray().Select(t => t!.GetValue<string>()));
+			Assert.DoesNotContain(Addressing.Public, create.ToJsonString());
+			Assert.Empty(await _harness.Outgoing(follower.SharedInbox));
+			Assert.Empty((await _harness.Outgoing(member.SharedInbox)).Where(a => a["type"]!.GetValue<string>() == "Announce"));
+
+			var authorizer = new SignedFetchAuthorizer(_harness.Remote);
+			var path = new Uri(outcome.Post.ObjectURI).AbsolutePath;
+			var asMember = await authorizer.Requester(member.Get(Harness.Host, path), token);
+			var asOutsider = await authorizer.Requester(outsider.Get(Harness.Host, path), token);
+			Assert.True(SignedFetchAuthorizer.MayReadCircle(circleEntity, asMember));
+			Assert.False(SignedFetchAuthorizer.MayReadCircle(circleEntity, asOutsider));
+			Assert.False(SignedFetchAuthorizer.MayReadCircle(circleEntity, default));
+			Assert.True(circle.IsCircle);
+			Assert.False(circle.Discoverable);
+		}
+
+		[Fact]
+		public async Task Only_circle_members_can_post_into_a_circle()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (aliceRoot, alice) = await _harness.Persona("alice");
+			var member = new RemoteActor(_harness.Peer, "member");
+			var outsider = new RemoteActor(_harness.Peer, "outsider");
+			var (_, circle) = await Group(GroupKind.Circle, PostingPolicy.Followers, alice.Id, member.Id);
+
+			await _harness.Deliver(member, "/human-centipede", Create(member, new[] { circle.Uri, circle.Flock }));
+			await _harness.Deliver(outsider, "/human-centipede", Create(outsider, new[] { circle.Uri, circle.Flock }));
+
+			var stored = await DB.Default.Find<Post>().Match(p => p.GroupId == circle.Id).ExecuteAsync(token);
+			Assert.Equal(member.Id, Assert.Single(stored).ActorURI);
+			Assert.Equal(PostVisibility.Circle, stored[0].Visibility);
+			Assert.True(await DB.Default.Find<TimelineEntry>().Match(e => e.AvatarId == alice.Id && e.PostId == stored[0].ID).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task A_followed_remote_community_announcing_a_post_puts_it_in_home()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (root, alice) = await _harness.Persona("alice");
+			var lemmyCommunity = new RemoteActor(_harness.Peer, "cats", type: "Group");
+			var poster = new RemoteActor(_harness.Peer, "poster");
+			await _harness.Follows.Follow(root, new FollowForm { AvatarId = alice.Id, Target = lemmyCommunity.Id }, token);
+			await DB.Default.Update<Following>().Match(f => f.AvatarId == alice.Id).Modify(f => f.State, FollowState.Accepted).ExecuteAsync(token);
+			var create = Create(poster, new[] { lemmyCommunity.Id, Addressing.Public }, lemmyCommunity.Id);
+			var noteId = create["object"]!["id"]!.GetValue<string>();
+			_harness.Peer.Serve(new Uri(noteId).AbsolutePath, create["object"]!.ToJsonString());
+
+			await _harness.Deliver(lemmyCommunity, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(lemmyCommunity)}/activities/announce/{Guid.NewGuid():N}", ["type"] = "Announce", ["actor"] = lemmyCommunity.Id,
+				["to"] = new JsonArray(Addressing.Public), ["object"] = create
+			});
+
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == noteId).ExecuteSingleAsync(token);
+			Assert.Equal(lemmyCommunity.Id, post.AudienceURI);
+			Assert.True(await DB.Default.Find<TimelineEntry>().Match(e => e.AvatarId == alice.Id && e.PostId == post.ID).ExecuteAnyAsync(token));
+		}
+	}
+}

PrivaPub.Tests/Federation/InboundRoutingTests.cs

@@ -0,0 +1,139 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Post;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class InboundRoutingTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		static string NewId(RemoteActor actor, string kind) => $"{Origin(actor)}/{kind}/{Guid.NewGuid():N}";
+
+		async Task<Post> LocalPost(string text)
+		{
+			var (root, alice) = await _harness.Persona("alice");
+			await _harness.Posts.InsertPost(root, new InsertPostForm { AvatarId = alice.Id, Text = text }, TestContext.Current.CancellationToken);
+			return await DB.Default.Find<Post>().Match(p => p.GroupUserId == alice.Id).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+		}
+
+		[Fact]
+		public async Task A_downvote_counts_and_its_undo_takes_it_back()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var post = await LocalPost("vote on me");
+			var lemmy = new RemoteActor(_harness.Peer, "voter");
+			var dislike = new JsonObject { ["id"] = NewId(lemmy, "activities/dislike"), ["type"] = "Dislike", ["actor"] = lemmy.Id, ["object"] = post.ObjectURI };
+
+			await _harness.Deliver(lemmy, "/human-centipede", dislike);
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).DownvotesCount);
+
+			await _harness.Deliver(lemmy, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(lemmy, "activities/undo"), ["type"] = "Undo", ["actor"] = lemmy.Id, ["object"] = dislike.DeepClone()
+			});
+			Assert.Equal(0, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).DownvotesCount);
+		}
+
+		[Fact]
+		public async Task A_delete_that_arrives_first_keeps_the_post_from_coming_back()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			var noteId = NewId(mallory, "notes");
+
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(mallory, "activities/delete"), ["type"] = "Delete", ["actor"] = mallory.Id,
+				["object"] = new JsonObject { ["id"] = noteId, ["type"] = "Tombstone" }
+			});
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(mallory, "activities/create"), ["type"] = "Create", ["actor"] = mallory.Id,
+				["object"] = new JsonObject
+				{
+					["id"] = noteId, ["type"] = "Note", ["attributedTo"] = mallory.Id, ["content"] = "<p>late</p>",
+					["to"] = new JsonArray(Addressing.Public), ["cc"] = new JsonArray(alice.Uri),
+					["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = alice.Uri, ["name"] = "@alice" })
+				}
+			});
+
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ObjectURI == noteId).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task A_lemmy_private_message_arrives_as_a_direct_message()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var lemmy = new RemoteActor(_harness.Peer, "pm");
+			var messageId = NewId(lemmy, "private_message");
+
+			await _harness.Deliver(lemmy, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(lemmy, "activities/create"), ["type"] = "Create", ["actor"] = lemmy.Id, ["to"] = new JsonArray(alice.Uri),
+				["object"] = new JsonObject
+				{
+					["id"] = messageId, ["type"] = "ChatMessage", ["attributedTo"] = lemmy.Id, ["to"] = new JsonArray(alice.Uri),
+					["content"] = "<p>psst</p>", ["mediaType"] = "text/html", ["published"] = DateTime.UtcNow.ToString("O")
+				}
+			});
+
+			var message = await DB.Default.Find<Post>().Match(p => p.ObjectURI == messageId).ExecuteFirstAsync(token);
+			Assert.NotNull(message);
+			Assert.Equal(PostVisibility.Direct, message.Visibility);
+			Assert.NotNull(message.ConversationId);
+		}
+
+		[Fact]
+		public async Task An_unreachable_key_asks_the_sender_to_retry_instead_of_refusing()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var offline = new RemoteActor(_harness.Peer, "offline", origin: "http://127.0.0.1:9");
+
+			var result = await _harness.Deliver(offline, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(offline, "follows"), ["type"] = "Follow", ["actor"] = offline.Id, ["object"] = alice.Uri
+			});
+
+			Assert.Equal(503, result.StatusCode);
+			Assert.Equal(300, result.RetryAfterSeconds);
+		}
+
+		[Fact]
+		public async Task A_join_of_a_local_post_is_answered_with_ignore()
+		{
+			var post = await LocalPost("not an event");
+			var mobilizon = new RemoteActor(_harness.Peer, "joiner");
+
+			await _harness.Deliver(mobilizon, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(mobilizon, "join"), ["type"] = "Join", ["actor"] = mobilizon.Id, ["object"] = post.ObjectURI
+			});
+
+			var answer = Assert.Single(await _harness.Outgoing(mobilizon.Id + "/inbox"));
+			Assert.Equal("Ignore", answer["type"]!.GetValue<string>());
+		}
+	}
+}

PrivaPub.Tests/Federation/InboxScenarioTests.cs

@@ -8,6 +8,8 @@ using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Inbox.Handlers;
 using PrivaPub.Federation.Inbox;
 using PrivaPub.Federation.Moderation;
+using PrivaPub.Domain.Social;
+using PrivaPub.Domain.Statuses;
 using PrivaPub.Federation.Objects;
 using PrivaPub.Federation.Outbox;
 using PrivaPub.Infrastructure.Jobs;
@@ -50,13 +52,15 @@ namespace PrivaPub.Tests.Federation
 			var db = new DbEntities();
 			_blocks = new DomainBlocks(NullLogger<DomainBlocks>.Instance);
 			_receiver = new InboxReceiver(_local, remote, queue, _blocks, NullLogger<InboxReceiver>.Instance);
+			var remotePosts = new RemotePosts(db, _local, remote, _blocks, queue, new ObjectRecords(queue), new NoPreviews());
+			var quotes = new QuoteService(db, remote, remotePosts, _local, delivery, new OutboxPublisher(db, _local, delivery));
 			_processor = new InboxProcessor(remote, new IActivityHandler[]
 			{
 				new FollowHandler(db, _local, remote, delivery),
-				new UndoHandler(db, _local),
-				new CreateHandler(db, _local, remote, delivery, _blocks, new Fanout(db), new RemotePosts(db, _local, remote, _blocks, queue)),
-				new DeleteHandler(db, _local, remote, delivery),
-				new UpdateHandler(db, _local, remote)
+				new UndoHandler(db, _local, new Reactions(db, delivery)),
+				new CreateHandler(db, _local, remote, delivery, _blocks, new Fanout(db), remotePosts, new GroupDistributor(delivery), new ObjectRecords(queue), new PollService(db, _local, delivery, queue), new NoPreviews(), quotes),
+				new DeleteHandler(db, _local, remote, delivery, new GroupDistributor(delivery), quotes),
+				new UpdateHandler(db, _local, remote, new GroupDistributor(delivery), new ObjectRecords(queue), quotes)
 			}, NullLogger<InboxProcessor>.Instance);
 		}
 
@@ -265,10 +269,7 @@ namespace PrivaPub.Tests.Federation
 			var token = TestContext.Current.CancellationToken;
 			var alice = await LocalAvatar("alice");
 			var bob = new RemoteActor(_peer, "bob", _peer.B);
-			await DB.Default.SaveAsync(new DomainBlock { Domain = "localhost", Severity = DomainBlockSeverity.Suspend }, token);
-			try
-			{
-				await _blocks.Reload(token);
+			_blocks.Load(new[] { new DomainBlock { Domain = "localhost", Severity = DomainBlockSeverity.Suspend } });
 			var before = _peer.Requests.Count;
 
 			var result = await Deliver(bob, $"/peasants/{alice.UserName}/mouth", DirectCreate(bob, alice.Uri));
@@ -277,27 +278,6 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal(before, _peer.Requests.Count);
 			Assert.False(await DB.Default.Find<Post>().Match(p => p.ActorURI == bob.Id).ExecuteAnyAsync(token));
 		}
-			finally
-			{
-				await DB.Default.DeleteAsync<DomainBlock>(b => b.Domain == "localhost");
-				await _blocks.Reload(token);
-			}
-		}
-
-		[Fact]
-		public void A_block_covers_subdomains_but_not_lookalikes()
-		{
-			var blocks = new DomainBlocks(NullLogger<DomainBlocks>.Instance);
-			typeof(DomainBlocks).GetField("_blocks", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
-				.SetValue(blocks, new Dictionary<string, DomainBlock> { ["evil.example"] = new() { Domain = "evil.example", Severity = DomainBlockSeverity.Silence } });
-			typeof(DomainBlocks).GetField("_loadedAt", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
-				.SetValue(blocks, DateTime.UtcNow);
-
-			Assert.NotNull(blocks.Find("evil.example"));
-			Assert.NotNull(blocks.Find("A.Evil.Example."));
-			Assert.Null(blocks.Find("notevil.example"));
-			Assert.False(blocks.IsSuspended("evil.example"));
-		}
 
 		[Fact]
 		public async Task A_bad_signature_is_a_401()
@@ -323,7 +303,7 @@ namespace PrivaPub.Tests.Federation
 		}
 
 		[Fact]
-		public async Task A_circle_is_not_a_federated_actor()
+		public async Task A_circle_only_takes_follow_requests()
 		{
 			var token = TestContext.Current.CancellationToken;
 			var (privateKey, publicKey) = Keys.NewKeyPair();
@@ -339,8 +319,13 @@ namespace PrivaPub.Tests.Federation
 				["object"] = actor.Uri
 			};
 
-			Assert.False(actor.IsFederated);
-			Assert.Equal(404, (await Deliver(bob, "/human-centipede", follow)).StatusCode);
+			Assert.True(actor.IsCircle);
+			Assert.True(actor.ManuallyApprovesFollowers);
+			Assert.False(actor.Discoverable);
+			Assert.Equal(202, (await Deliver(bob, "/human-centipede", follow)).StatusCode);
+			var request = await DB.Default.Find<Follower>().Match(f => f.LocalActorId == circle.ID).ExecuteSingleAsync(token);
+			Assert.False(request.IsAccepted);
+			Assert.DoesNotContain(circle.Members, m => m.AvatarId == bob.Id);
 		}
 	}
 }

PrivaPub.Tests/Federation/NoteParserTests.cs

@@ -54,6 +54,7 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal("a cat", media.Description);
 			Assert.Equal(new[] { 0.5f, -1f }, media.Focus);
 			Assert.Equal(new DateTime(2026, 9, 30, 10, 0, 0, DateTimeKind.Utc), note.Published);
+			Assert.Null(note.Updated);
 		}
 
 		[Fact]
@@ -89,6 +90,28 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal("https://k.example/notes/8", note.QuoteUri);
 		}
 
+		[Theory]
+		[InlineData("Article", false, false)]
+		[InlineData("Event", false, false)]
+		[InlineData("Video", false, false)]
+		[InlineData("Page", false, false)]
+		[InlineData("Note", false, true)]
+		[InlineData("Question", false, true)]
+		[InlineData("Article", true, true)]
+		public void A_summary_warns_only_on_notes_or_when_marked_sensitive(string type, bool sensitive, bool warns)
+		{
+			var note = NoteParser.Parse(JsonNode.Parse($$"""
+				{
+					"id": "https://w.example/?p=12", "type": "{{type}}", "name": "Twelve", "summary": "Saturday, 10:00 at the library",
+					"sensitive": {{(sensitive ? "true" : "false")}}, "attributedTo": "https://w.example/author", "content": "<p>body</p>"
+				}
+				"""));
+
+			Assert.Equal(warns, note.Sensitive);
+			Assert.Equal(warns ? "Saturday, 10:00 at the library" : null, note.SpoilerText);
+			Assert.Equal(warns ? null : "Saturday, 10:00 at the library", note.Excerpt);
+		}
+
 		[Theory]
 		[InlineData("""{ "id": "https://x.example/1", "type": "Person" }""")]
 		[InlineData("""{ "id": "not a uri", "type": "Note" }""")]

PrivaPub.Tests/Federation/ObjectRecordsTests.cs

@@ -0,0 +1,36 @@
+using PrivaPub.Federation.Objects;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class ObjectRecordsTests
+	{
+		[Fact]
+		public void An_object_larger_than_the_cap_keeps_only_its_hash()
+		{
+			var big = new JsonObject { ["content"] = new string('x', ObjectRecords.MaxRawBytes + 1) };
+
+			var (text, hash, bytes, truncated) = ObjectRecords.Capture(big);
+
+			Assert.Null(text);
+			Assert.True(truncated);
+			Assert.True(bytes > ObjectRecords.MaxRawBytes);
+			Assert.Equal(64, hash.Length);
+		}
+
+		[Fact]
+		public void A_small_object_is_kept_whole_with_its_hash()
+		{
+			var small = new JsonObject { ["type"] = "Note", ["content"] = "hi" };
+
+			var (text, hash, bytes, truncated) = ObjectRecords.Capture(small);
+
+			Assert.Equal(small.ToJsonString(), text);
+			Assert.False(truncated);
+			Assert.Equal(text.Length, bytes);
+			Assert.Equal(64, hash.Length);
+			Assert.Equal(default, ObjectRecords.Capture(default));
+		}
+	}
+}

PrivaPub.Tests/Federation/ObjectShapesTests.cs

@@ -0,0 +1,248 @@
+using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class ObjectShapesTests
+	{
+		static NoteDocument Parse(string json) => NoteParser.Parse(JsonNode.Parse(json));
+
+		[Fact]
+		public void Keeps_a_peertube_video_with_its_files_poster_captions_and_markdown_description()
+		{
+			var note = Parse("""
+				{
+					"id": "https://tube.example/videos/watch/1", "type": "Video", "name": "A *talk*", "duration": "PT6299S",
+					"mediaType": "text/markdown", "content": "**Bold** words", "sensitive": false, "views": 14771, "state": 1,
+					"isLiveBroadcast": false, "commentsPolicy": 2, "downloadEnabled": true,
+					"licence": { "identifier": "5", "name": "Attribution - Share Alike" }, "category": { "identifier": "2", "name": "Films" },
+					"attributedTo": [{ "type": "Person", "id": "https://tube.example/accounts/ann" }, { "type": "Group", "id": "https://tube.example/video-channels/films" }],
+					"icon": [
+						{ "type": "Image", "url": "https://tube.example/thumb-280.jpg", "mediaType": "image/jpeg", "width": 280, "height": 157 },
+						{ "type": "Image", "url": "https://tube.example/thumb-1920.jpg", "mediaType": "image/jpeg", "width": 1920, "height": 1080 },
+						{ "type": "Image", "url": "https://tube.example/thumb-850.jpg", "mediaType": "image/jpeg", "width": 850, "height": 480 }
+					],
+					"subtitleLanguage": [{ "identifier": "en", "url": [{ "mediaType": "text/vtt", "href": "https://tube.example/en.vtt" }] }],
+					"url": [
+						{ "type": "Link", "mediaType": "text/html", "href": "https://tube.example/w/abc" },
+						{ "type": "Link", "mediaType": "video/mp4", "href": "https://tube.example/720.mp4", "height": 720, "width": 1280, "fps": 24, "size": 942586378,
+							"attachment": [{ "type": "PropertyValue", "name": "ffprobe_codec_type", "value": "audio" }, { "type": "PropertyValue", "name": "ffprobe_codec_type", "value": "video" }] },
+						{ "type": "Link", "mediaType": "application/x-mpegURL", "href": "https://tube.example/master.m3u8" },
+						{ "type": "Link", "mediaType": "application/x-bittorrent;x-scheme-handler/magnet", "href": "magnet:?xt=urn:btih:abc" }
+					]
+				}
+				""");
+
+			Assert.Equal("https://tube.example/w/abc", note.Url);
+			Assert.Equal("A *talk*", note.Title);
+			Assert.Contains("<strong>Bold</strong>", note.ContentHtml);
+			Assert.Equal("https://tube.example/thumb-850.jpg", note.CoverURL);
+			Assert.Equal(6299, note.Video.DurationSeconds);
+			var file = Assert.Single(note.Video.Variants);
+			Assert.Equal(new[] { "audio", "video" }, file.Streams);
+			Assert.Equal(942586378, file.Size);
+			Assert.Equal("https://tube.example/master.m3u8", note.Video.PlaylistURL);
+			Assert.Equal(2, note.Video.CommentsPolicy);
+			Assert.Equal("Attribution - Share Alike", note.Video.Licence);
+			Assert.Equal("https://tube.example/video-channels/films", note.Video.ChannelURI);
+			Assert.Equal("https://tube.example/en.vtt", Assert.Single(note.Video.Captions).Url);
+			Assert.Equal("https://tube.example/accounts/ann", note.AttributedTo);
+		}
+
+		[Fact]
+		public void Keeps_a_mobilizon_event_with_its_time_place_and_online_link()
+		{
+			var note = Parse("""
+				{
+					"id": "https://events.example/events/9", "type": "Event", "name": "Repair café",
+					"summary": "<p>Saturday at the library</p>", "content": "<p>Bring broken things.</p>",
+					"startTime": "2026-10-03T10:00:00+02:00", "endTime": "2026-10-03T13:00:00+02:00", "timezone": "Europe/Rome",
+					"joinMode": "free", "participantCount": 12, "maximumAttendeeCapacity": 40, "ical:status": "CONFIRMED",
+					"location": { "type": "Place", "name": "Biblioteca", "latitude": 45.07, "longitude": 7.68,
+						"address": { "type": "PostalAddress", "streetAddress": "Via Roma 1", "addressLocality": "Torino", "addressCountry": "IT" } },
+					"attachment": [{ "type": "Link", "name": "Website", "href": "https://meet.example/repair" }],
+					"attributedTo": "https://events.example/@club"
+				}
+				""");
+
+			Assert.Null(note.SpoilerText);
+			Assert.False(note.Sensitive);
+			Assert.Equal("Saturday at the library", note.Excerpt);
+			Assert.Equal(new DateTime(2026, 10, 3, 8, 0, 0, DateTimeKind.Utc), note.Event.Start);
+			Assert.Equal("Via Roma 1, Torino, IT", Assert.Single(note.Event.Places).Address);
+			Assert.Equal("https://meet.example/repair", note.Event.OnlineURL);
+			Assert.Equal(40, note.Event.Capacity);
+			Assert.Equal("CONFIRMED", note.Event.Status);
+			Assert.Equal("2026-10-03 10:00 – 13:00 (Europe/Rome) · Biblioteca", MastodonMapper.EventLine(note.Event));
+		}
+
+		[Fact]
+		public void Keeps_a_lemmy_link_post_as_a_link_with_its_thumbnail()
+		{
+			var note = Parse("""
+				{
+					"id": "https://lemmy.example/post/5", "type": "Page", "name": "A good read", "attributedTo": "https://lemmy.example/u/bo",
+					"attachment": [{ "type": "Link", "href": "https://news.example/story", "mediaType": "text/html" }],
+					"image": { "type": "Image", "url": "https://lemmy.example/pictrs/thumb.jpg" },
+					"language": { "identifier": "en", "name": "English" }
+				}
+				""");
+
+			Assert.Equal("https://news.example/story", note.Link.Href);
+			Assert.Equal("https://lemmy.example/pictrs/thumb.jpg", note.Link.ImageURL);
+			Assert.False(note.Link.FromPublisher);
+			Assert.Empty(note.Attachments);
+		}
+
+		[Fact]
+		public void Takes_a_publisher_supplied_preview_from_a_link_attachment()
+		{
+			var note = Parse("""
+				{
+					"id": "https://m.example/statuses/1", "type": "Note", "attributedTo": "https://m.example/users/a", "content": "<p>look</p>",
+					"attachment": [{ "type": "Link", "href": "https://news.example/a",
+						"preview": { "type": "Article", "name": "Headline &amp; more", "summary": "<p>What happened</p>", "image": { "type": "Image", "url": "https://news.example/a.jpg" } } }]
+				}
+				""");
+
+			Assert.Equal("Headline & more", note.Link.Title);
+			Assert.Equal("What happened", note.Link.Description);
+			Assert.Equal("https://news.example/a.jpg", note.Link.ImageURL);
+			Assert.True(note.Link.FromPublisher);
+		}
+
+		[Fact]
+		public void Reads_media_in_every_shape_and_infers_what_is_missing()
+		{
+			var note = Parse("""
+				{
+					"id": "https://bsky.brid.gy/convert/ap/at://did:plc:x/post/1", "type": "Note", "attributedTo": "https://bsky.brid.gy/ap/did:plc:x",
+					"content": "<p>pics</p>",
+					"@context": ["https://www.w3.org/ns/activitystreams", { "@language": "de" }],
+					"attachment": [
+						{ "type": "Image", "url": "https://cdn.example/a.jpeg", "summary": "alt from summary" },
+						{ "type": "Document", "url": [{ "type": "Link", "href": "https://cdn.example/clip", "mediaType": "video/mp4" }],
+							"icon": { "type": "Image", "url": "https://cdn.example/clip.jpg" }, "duration": "PT12.4S", "sensitive": true },
+						{ "type": "Image", "url": "https://cdn.example/nameless" }
+					]
+				}
+				""");
+
+			Assert.Equal("de", note.Language);
+			Assert.Equal("image/jpeg", note.Attachments[0].ContentType);
+			Assert.Equal("alt from summary", note.Attachments[0].Description);
+			Assert.Equal("https://cdn.example/clip", note.Attachments[1].RemoteURL);
+			Assert.Equal("video/mp4", note.Attachments[1].ContentType);
+			Assert.Equal("https://cdn.example/clip.jpg", note.Attachments[1].RemotePreviewURL);
+			Assert.Equal(12.4, note.Attachments[1].DurationSeconds);
+			Assert.True(note.Attachments[1].Sensitive);
+			Assert.Equal("image/*", note.Attachments[2].ContentType);
+		}
+
+		[Fact]
+		public void Keeps_a_funkwhale_track_and_a_loops_poster()
+		{
+			var track = Parse("""
+				{
+					"id": "https://music.example/federation/music/uploads/1", "type": "Audio", "name": "Song", "attributedTo": "https://music.example/@band",
+					"summary": "#rock #live", "duration": 241, "position": 3, "album": "https://music.example/albums/2", "license": "https://creativecommons.org/licenses/by/4.0/",
+					"url": [{ "type": "Link", "mediaType": "text/html", "href": "https://music.example/library/tracks/1" },
+						{ "type": "Link", "mediaType": "audio/mpeg", "href": "https://music.example/listen/1.mp3", "bitrate": 320000, "size": 9640000 }]
+				}
+				""");
+			var loop = Parse("""
+				{
+					"id": "https://loops.example/v/1", "type": "Note", "attributedTo": "https://loops.example/@dancer", "content": "",
+					"preview": { "type": "Image", "url": { "href": "https://loops.example/poster.jpg", "mediaType": "image/jpeg" } },
+					"attachment": [{ "type": "Document", "mediaType": "video/mp4", "url": "https://loops.example/v/1.mp4", "width": 720, "height": 1280 }]
+				}
+				""");
+
+			Assert.Equal("#rock #live", track.Excerpt);
+			Assert.Null(track.SpoilerText);
+			Assert.Equal(241, track.Audio.DurationSeconds);
+			Assert.Equal(3, track.Audio.Position);
+			Assert.Equal("https://music.example/listen/1.mp3", Assert.Single(track.Audio.Variants).Url);
+			Assert.Equal("https://loops.example/poster.jpg", loop.CoverURL);
+		}
+
+		[Fact]
+		public void Keeps_custom_emoji_and_drops_ones_that_could_not_render()
+		{
+			var note = Parse("""
+				{
+					"id": "https://k.example/notes/1", "type": "Note", "attributedTo": "https://k.example/users/1", "content": ":blobcat: hi :bad:",
+					"tag": [
+						{ "type": "Emoji", "name": ":blobcat:", "updated": "2026-01-01T00:00:00Z", "icon": { "type": "Image", "mediaType": "image/png", "url": "https://k.example/emoji/blobcat.png" } },
+						{ "type": "Emoji", "name": ":blobcat:", "icon": { "type": "Image", "url": "https://k.example/emoji/duplicate.png" } },
+						{ "type": "Emoji", "name": ":bad name:", "icon": { "type": "Image", "url": "https://k.example/emoji/x.png" } },
+						{ "type": "Emoji", "name": ":nourl:", "icon": { "type": "Image", "url": "data:image/png;base64,AAAA" } }
+					]
+				}
+				""");
+
+			var emoji = Assert.Single(note.Emojis);
+			Assert.Equal("blobcat", emoji.Shortcode);
+			Assert.Equal("https://k.example/emoji/blobcat.png", emoji.URL);
+		}
+
+		[Fact]
+		public void Reads_polls_from_mastodon_misskey_and_closed_ones()
+		{
+			var mastodon = Parse("""
+				{ "id": "https://m.example/q/1", "type": "Question", "attributedTo": "https://m.example/u", "content": "?", "endTime": "2026-10-02T00:00:00Z", "votersCount": 7,
+					"oneOf": [{ "type": "Note", "name": "a", "replies": { "type": "Collection", "totalItems": 4 } }, { "type": "Note", "name": "b", "replies": { "type": "Collection", "totalItems": 3 } }] }
+				""");
+			var misskey = Parse("""
+				{ "id": "https://k.example/q/1", "type": "Question", "attributedTo": "https://k.example/u", "_misskey_content": "?",
+					"anyOf": [{ "type": "Note", "name": "x", "_misskey_votes": 2 }, { "type": "Note", "name": "y", "_misskey_votes": 5 }] }
+				""");
+			var closed = Parse("""
+				{ "id": "https://g.example/q/1", "type": "Question", "attributedTo": "https://g.example/u", "content": "?", "closed": "2026-09-30T12:00:00Z",
+					"oneOf": [{ "type": "Note", "name": "p" }, { "type": "Note", "name": "q" }] }
+				""");
+
+			Assert.False(mastodon.Poll.Multiple);
+			Assert.Equal(new[] { 4, 3 }, mastodon.Poll.Options.Select(o => o.Votes));
+			Assert.Equal(7, mastodon.Poll.VotersCount);
+			Assert.True(misskey.Poll.Multiple);
+			Assert.Equal(new[] { 2, 5 }, misskey.Poll.Options.Select(o => o.Votes));
+			Assert.Null(misskey.Poll.VotersCount);
+			Assert.Equal(new DateTime(2026, 9, 30, 12, 0, 0, DateTimeKind.Utc), closed.Poll.ClosedAt);
+		}
+
+		[Fact]
+		public void Finds_playable_files_inside_an_hls_only_peertube_video_and_picks_one_with_sound()
+		{
+			var note = Parse("""
+				{
+					"id": "https://tube.example/videos/watch/2", "type": "Video", "name": "HLS only", "attributedTo": "https://tube.example/accounts/ann",
+					"url": [
+						{ "type": "Link", "mediaType": "text/html", "href": "https://tube.example/w/def" },
+						{ "type": "Link", "mediaType": "application/x-mpegURL", "href": "https://tube.example/master.m3u8", "tag": [
+							{ "type": "Link", "mediaType": "video/mp4", "href": "https://tube.example/1080-fragmented.mp4", "height": 1080,
+								"attachment": [{ "type": "PropertyValue", "name": "ffprobe_codec_type", "value": "video" }, { "type": "PropertyValue", "name": "ffprobe_codec_type", "value": "audio" }] },
+							{ "type": "Link", "mediaType": "video/mp4", "href": "https://tube.example/720-fragmented.mp4", "height": 720,
+								"attachment": [{ "type": "PropertyValue", "name": "ffprobe_codec_type", "value": "video" }] },
+							{ "type": "Link", "mediaType": "video/mp4", "href": "https://tube.example/480-fragmented.mp4", "height": 480,
+								"attachment": [{ "type": "PropertyValue", "name": "ffprobe_codec_type", "value": "video" }, { "type": "PropertyValue", "name": "ffprobe_codec_type", "value": "audio" }] }
+						] }
+					]
+				}
+				""");
+
+			Assert.Equal(3, note.Video.Variants.Count);
+			Assert.Equal("https://tube.example/480-fragmented.mp4", MastodonMapper.BestVideo(note.Video.Variants).Url);
+		}
+
+		[Fact]
+		public void Normalises_hashtags_like_mastodon() =>
+			Assert.Equal("ｆｅｄｉ".Normalize(System.Text.NormalizationForm.FormKC).ToLowerInvariant(), Assert.Single(Parse("""
+				{ "id": "https://x.example/1", "type": "Note", "attributedTo": "https://x.example/u", "content": "",
+					"tag": [{ "type": "Hashtag", "name": "#ＦＥＤＩ" }] }
+				""").Tags));
+	}
+}

PrivaPub.Tests/Federation/PollTests.cs

@@ -0,0 +1,138 @@
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class PollTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		static string NewId(RemoteActor actor, string kind) => $"{Origin(actor)}/{kind}/{Guid.NewGuid():N}";
+
+		async Task Follows(RemoteActor follower, string target) =>
+			await _harness.Deliver(follower, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(follower, "follows"), ["type"] = "Follow", ["actor"] = follower.Id, ["object"] = target
+			});
+
+		JsonObject Vote(RemoteActor voter, string question, string owner, string choice) => new()
+		{
+			["id"] = NewId(voter, "activities"), ["type"] = "Create", ["actor"] = voter.Id, ["to"] = new JsonArray(owner),
+			["object"] = new JsonObject
+			{
+				["id"] = NewId(voter, "votes"), ["type"] = "Note", ["name"] = choice, ["attributedTo"] = voter.Id,
+				["inReplyTo"] = question, ["to"] = new JsonArray(owner)
+			}
+		};
+
+		[Fact]
+		public async Task A_local_poll_goes_out_as_a_question_and_counts_each_remote_voter_once()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			await Follows(mallory, alice.Uri);
+
+			var outcome = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "which?", Poll = new PollDraft(new[] { "tea", "coffee" }, 3600, false, false) }, token);
+			Assert.True(outcome.Ok);
+			var question = (await _harness.Outgoing(mallory.Id + "/inbox")).Single(a => a["type"]!.GetValue<string>() == "Create")["object"]!;
+			Assert.Equal("Question", question["type"]!.GetValue<string>());
+			Assert.Equal(new[] { "tea", "coffee" }, question["oneOf"]!.AsArray().Select(o => o!["name"]!.GetValue<string>()));
+
+			await _harness.Deliver(mallory, "/human-centipede", Vote(mallory, outcome.Post.ObjectURI, alice.Uri, "coffee"));
+			await _harness.Deliver(mallory, "/human-centipede", Vote(mallory, outcome.Post.ObjectURI, alice.Uri, "tea"));
+
+			var poll = (await DB.Default.Find<Post>().OneAsync(outcome.Post.ID, token)).Poll;
+			Assert.Equal(new[] { 0, 1 }, poll.Options.Select(o => o.Votes));
+			Assert.Equal(1, poll.VotersCount);
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.InReplyToURI == outcome.Post.ObjectURI).ExecuteAnyAsync(token));
+			Assert.True(await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.PollRefresh && j.Payload == outcome.Post.ID).ExecuteAnyAsync(token));
+			Assert.True(await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.PollClose && j.Payload == outcome.Post.ID).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task A_persona_votes_on_a_remote_poll_and_a_count_refresh_is_not_an_edit()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			var questionId = NewId(mallory, "questions");
+			JsonObject Question(int first, int second) => new()
+			{
+				["id"] = questionId, ["type"] = "Question", ["attributedTo"] = mallory.Id, ["content"] = "<p>pick</p>",
+				["to"] = new JsonArray(Addressing.Public), ["cc"] = new JsonArray(alice.Uri),
+				["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = alice.Uri, ["name"] = "@alice" }),
+				["endTime"] = DateTime.UtcNow.AddDays(1).ToString("O"),
+				["anyOf"] = new JsonArray(
+					new JsonObject { ["type"] = "Note", ["name"] = "red", ["replies"] = new JsonObject { ["type"] = "Collection", ["totalItems"] = first } },
+					new JsonObject { ["type"] = "Note", ["name"] = "blue", ["replies"] = new JsonObject { ["type"] = "Collection", ["totalItems"] = second } })
+			};
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(mallory, "activities"), ["type"] = "Create", ["actor"] = mallory.Id, ["object"] = Question(3, 1)
+			});
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == questionId).ExecuteFirstAsync(token);
+			Assert.True(post.Poll.Multiple);
+
+			Assert.True((await _harness.Polls.Vote(alice, post, new[] { 0, 1 }, token)).Ok);
+			Assert.False((await _harness.Polls.Vote(alice, post, new[] { 0 }, token)).Ok);
+
+			var votes = (await _harness.Outgoing(mallory.Id + "/inbox")).Where(a => a["type"]!.GetValue<string>() == "Create").Select(a => a["object"]!).ToList();
+			Assert.Equal(new[] { "red", "blue" }, votes.Select(v => v["name"]!.GetValue<string>()).Order().Reverse());
+			Assert.All(votes, v => Assert.Equal(questionId, v["inReplyTo"]!.GetValue<string>()));
+			Assert.All(votes, v => Assert.Null(v["published"]));
+			Assert.Equal(new[] { 0, 1 }, (await _harness.Polls.OwnVotes(post.ID, alice.Id, token)).Order());
+
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(mallory, "activities"), ["type"] = "Update", ["actor"] = mallory.Id, ["object"] = Question(9, 5)
+			});
+			var refreshed = await DB.Default.Find<Post>().OneAsync(post.ID, token);
+			Assert.Equal(new[] { 9, 5 }, refreshed.Poll.Options.Select(o => o.Votes));
+			Assert.Empty(refreshed.Revisions);
+			Assert.Null(refreshed.EditedAt);
+		}
+
+		[Fact]
+		public async Task Closing_a_poll_tells_its_voters_and_its_author()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var (_, bob) = await _harness.Persona("bob");
+			var outcome = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "quick", Poll = new PollDraft(new[] { "yes", "no" }, 300, false, false) }, token);
+			Assert.True((await _harness.Polls.Vote(bob, outcome.Post, new[] { 0 }, token)).Ok);
+			Assert.False((await _harness.Polls.Vote(alice, outcome.Post, new[] { 0 }, token)).Ok);
+
+			var job = await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.PollClose && j.Payload == outcome.Post.ID).ExecuteFirstAsync(token);
+			await new PollCloseJob(_harness.Db, _harness.Local, _harness.Outbox).Handle(job, token);
+
+			Assert.NotNull((await DB.Default.Find<Post>().OneAsync(outcome.Post.ID, token)).Poll.ClosedAt);
+			var told = await DB.Default.Find<Notification>().Match(n => n.Type == NotificationType.Poll && n.PostId == outcome.Post.ID).ExecuteAsync(token);
+			Assert.Equal(new[] { alice.Id, bob.Id }.Order(), told.Select(n => n.AvatarId).Order());
+			Assert.False((await _harness.Polls.Vote(bob, await DB.Default.Find<Post>().OneAsync(outcome.Post.ID, token), new[] { 1 }, token)).Ok);
+		}
+	}
+}

PrivaPub.Tests/Federation/ProvenanceTests.cs

@@ -0,0 +1,72 @@
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class ProvenanceTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		[Fact]
+		public async Task A_delivered_post_keeps_its_raw_object_how_it_came_and_every_edit()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			var origin = new Uri(mallory.Id).GetLeftPart(UriPartial.Authority);
+			var note = new JsonObject
+			{
+				["id"] = $"{origin}/notes/{Guid.NewGuid():N}",
+				["type"] = "Note",
+				["attributedTo"] = mallory.Id,
+				["content"] = "<p>hi</p>",
+				["_misskey_quote"] = $"{origin}/notes/elsewhere",
+				["to"] = new JsonArray(Addressing.Public),
+				["cc"] = new JsonArray(alice.Uri),
+				["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = alice.Uri, ["name"] = "@alice" })
+			};
+			var create = new JsonObject { ["id"] = $"{origin}/activities/{Guid.NewGuid():N}", ["type"] = "Create", ["actor"] = mallory.Id, ["object"] = note.DeepClone() };
+
+			await _harness.Deliver(mallory, "/human-centipede", create);
+			var edited = note.DeepClone().AsObject();
+			edited["content"] = "<p>hi again</p>";
+			edited["updated"] = DateTime.UtcNow.ToString("O");
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{origin}/activities/{Guid.NewGuid():N}", ["type"] = "Update", ["actor"] = mallory.Id, ["object"] = edited
+			});
+
+			var record = await DB.Default.Find<ObjectRecord>().Match(r => r.ObjectURI == note["id"]!.GetValue<string>()).ExecuteFirstAsync(token);
+			Assert.NotNull(record);
+			Assert.Equal(ObjectPath.Delivered, record.Path);
+			Assert.False(record.Refetched);
+			Assert.Equal("shared", record.Inbox);
+			Assert.Equal(mallory.KeyId, record.KeyId);
+			Assert.Equal(create["id"]!.GetValue<string>(), record.ActivityId);
+			Assert.Contains("digest", record.SignedHeaders);
+			Assert.Equal("<p>hi</p>", JsonNode.Parse(record.Raw)!["content"]!.GetValue<string>());
+			Assert.Contains("legacy-quote", ObjectFeatures.Detect(JsonNode.Parse(record.Raw)!.AsObject()));
+			Assert.Equal("<p>hi again</p>", JsonNode.Parse(Assert.Single(record.Revisions).Raw)!["content"]!.GetValue<string>());
+			Assert.True(await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.DescribeInstance && j.Payload == record.Host).ExecuteAnyAsync(token));
+		}
+	}
+}

PrivaPub.Tests/Federation/QuoteTests.cs

@@ -0,0 +1,221 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Post;
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class QuoteTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		static string NewId(RemoteActor actor, string kind) => $"{Origin(actor)}/{kind}/{Guid.NewGuid():N}";
+
+		async Task<Post> Delivered(RemoteActor author, string mentioned, Action<JsonObject> shape = default)
+		{
+			var note = new JsonObject
+			{
+				["id"] = NewId(author, "notes"), ["type"] = "Note", ["attributedTo"] = author.Id, ["content"] = "<p>hello</p>",
+				["to"] = new JsonArray(Addressing.Public), ["cc"] = new JsonArray(mentioned),
+				["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = mentioned, ["name"] = "@someone" })
+			};
+			shape?.Invoke(note);
+			await _harness.Deliver(author, "/human-centipede", new JsonObject { ["id"] = NewId(author, "activities"), ["type"] = "Create", ["actor"] = author.Id, ["object"] = note });
+			return await DB.Default.Find<Post>().Match(p => p.ObjectURI == note["id"]!.GetValue<string>()).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+		}
+
+		string Stamp(RemoteActor quotedAuthor, string quoting, string quoted)
+		{
+			var path = $"/stamps/{Guid.NewGuid():N}";
+			var id = Origin(quotedAuthor) + path;
+			_harness.Peer.Serve(path, new JsonObject
+			{
+				["@context"] = "https://www.w3.org/ns/activitystreams", ["id"] = id, ["type"] = "QuoteAuthorization",
+				["attributedTo"] = quotedAuthor.Id, ["interactingObject"] = quoting, ["interactionTarget"] = quoted
+			}.ToJsonString());
+			return id;
+		}
+
+		[Fact]
+		public async Task A_misskey_quote_of_a_public_post_is_shown_and_counted()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var ann = new RemoteActor(_harness.Peer, "ann");
+			var kitty = new RemoteActor(_harness.Peer, "kitty");
+			var original = await Delivered(ann, alice.Uri);
+
+			var quoting = await Delivered(kitty, alice.Uri, n =>
+			{
+				n["_misskey_quote"] = original.ObjectURI;
+				n["content"] = $"<p>look<span class=\"quote-inline\"><br>RE: <a href=\"{original.ObjectURI}\">{original.ObjectURI}</a></span></p>";
+			});
+
+			Assert.Equal(QuoteState.Accepted, quoting.QuoteState);
+			Assert.Equal(original.ID, quoting.QuotedPostId);
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(original.ID, token)).QuotesCount);
+			var status = await new PrivaPub.Api.Mastodon.Mappers.MastodonMapper(_harness.Db, _harness.Local).Status(quoting, alice.Id, token);
+			Assert.Equal("accepted", status.Quote.State);
+			Assert.Equal(original.ID, status.Quote.QuotedStatus.Id);
+			Assert.DoesNotContain("RE:", status.Content);
+		}
+
+		[Fact]
+		public async Task A_stamped_quote_is_accepted_a_forged_one_is_not_and_revoking_takes_it_back()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var ann = new RemoteActor(_harness.Peer, "ann");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			var original = await Delivered(ann, alice.Uri);
+			var quotingId = NewId(bob, "notes");
+			var stamp = Stamp(ann, quotingId, original.ObjectURI);
+			var forged = Stamp(ann, NewId(bob, "notes"), original.ObjectURI);
+
+			var quoting = await Delivered(bob, alice.Uri, n => { n["id"] = quotingId; n["quote"] = original.ObjectURI; n["quoteAuthorization"] = stamp; });
+			var cheat = await Delivered(bob, alice.Uri, n => { n["quote"] = original.ObjectURI; n["quoteAuthorization"] = forged; });
+			var waiting = await Delivered(bob, alice.Uri, n => n["quote"] = original.ObjectURI);
+
+			Assert.Equal(QuoteState.Accepted, quoting.QuoteState);
+			Assert.Equal(QuoteState.Unauthorized, cheat.QuoteState);
+			Assert.Equal(QuoteState.Pending, waiting.QuoteState);
+
+			await _harness.Deliver(ann, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(ann, "activities"), ["type"] = "Delete", ["actor"] = ann.Id, ["object"] = stamp
+			});
+			Assert.Equal(QuoteState.Revoked, (await DB.Default.Find<Post>().OneAsync(quoting.ID, token)).QuoteState);
+			Assert.Equal(0, (await DB.Default.Find<Post>().OneAsync(original.ID, token)).QuotesCount);
+		}
+
+		[Fact]
+		public async Task A_persona_asks_before_quoting_and_is_stamped_when_accepted()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var ann = new RemoteActor(_harness.Peer, "ann");
+			var original = await Delivered(ann, alice.Uri, n => n["interactionPolicy"] = new JsonObject
+			{
+				["canQuote"] = new JsonObject { ["automaticApproval"] = new JsonArray(Addressing.Public) }
+			});
+
+			var outcome = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "this", QuotedStatusId = original.ID }, token);
+			Assert.Equal(QuoteState.Pending, outcome.Post.QuoteState);
+			var request = Assert.Single(await _harness.Outgoing(ann.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "QuoteRequest");
+			Assert.Equal(original.ObjectURI, request["object"]!.GetValue<string>());
+			Assert.Equal(original.ObjectURI, request["instrument"]!["quote"]!.GetValue<string>());
+
+			await _harness.Deliver(ann, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(ann, "activities"), ["type"] = "Accept", ["actor"] = ann.Id,
+				["object"] = request["id"]!.GetValue<string>(), ["result"] = Stamp(ann, outcome.Post.ObjectURI, original.ObjectURI)
+			});
+
+			var quoting = await DB.Default.Find<Post>().OneAsync(outcome.Post.ID, token);
+			Assert.Equal(QuoteState.Accepted, quoting.QuoteState);
+			Assert.NotNull(quoting.QuoteAuthorizationURI);
+			Assert.Contains(await _harness.Outgoing(ann.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "Update"
+				&& a["object"]!["quoteAuthorization"]?.GetValue<string>() == quoting.QuoteAuthorizationURI);
+		}
+
+		[Fact]
+		public async Task A_legacy_post_is_quoted_without_asking_and_a_persona_that_allows_nobody_cannot_be_quoted()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (aliceRoot, alice) = await _harness.Persona("alice");
+			var (bobRoot, bob) = await _harness.Persona("bob");
+			var kitty = new RemoteActor(_harness.Peer, "kitty");
+			var legacy = await Delivered(kitty, alice.Uri);
+			bob.Settings.QuotePolicy = PrivaPub.Models.User.QuotePolicies.Nobody;
+			var bobs = (await _harness.Statuses.Publish(bob, new StatusDraft { Text = "mine" }, token)).Post;
+
+			var outcome = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "nice", QuotedStatusId = legacy.ID }, token);
+			Assert.Equal(QuoteState.Accepted, outcome.Post.QuoteState);
+			Assert.False(outcome.Post.QuoteByConsent);
+			Assert.False((await _harness.Statuses.Publish(alice, new StatusDraft { Text = "and this", QuotedStatusId = bobs.ID }, token)).Ok);
+			Assert.True((await _harness.Statuses.Publish(bob, new StatusDraft { Text = "me again", QuotedStatusId = bobs.ID }, token)).Ok);
+		}
+
+		JsonObject Request(RemoteActor quoter, string quotedUri, string quotingId) => new()
+		{
+			["id"] = NewId(quoter, "activities"), ["type"] = "QuoteRequest", ["actor"] = quoter.Id, ["object"] = quotedUri,
+			["instrument"] = new JsonObject { ["id"] = quotingId, ["type"] = "Note", ["attributedTo"] = quoter.Id, ["quote"] = quotedUri, ["content"] = "<p>so true</p>" }
+		};
+
+		[Fact]
+		public async Task Anyone_may_quote_a_persona_by_default_and_the_licence_can_be_revoked()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject { ["id"] = NewId(mallory, "follows"), ["type"] = "Follow", ["actor"] = mallory.Id, ["object"] = alice.Uri });
+			var original = (await _harness.Statuses.Publish(alice, new StatusDraft { Text = "quote me" }, token)).Post;
+			var created = (await _harness.Outgoing(mallory.Id + "/inbox")).Single(a => a["type"]!.GetValue<string>() == "Create")["object"]!;
+			Assert.Equal(Addressing.Public, created["interactionPolicy"]!["canQuote"]!["automaticApproval"]![0]!.GetValue<string>());
+
+			var quotingId = NewId(mallory, "notes");
+			await _harness.Deliver(mallory, "/human-centipede", Request(mallory, original.ObjectURI, quotingId));
+			var accept = Assert.Single(await _harness.Outgoing(mallory.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "Accept" && a["result"] != null);
+			var licence = accept["result"]!.GetValue<string>();
+			Assert.StartsWith(alice.Uri + "/parrot-licences/", licence);
+
+			var quoting = await Delivered(mallory, alice.Uri, n => { n["id"] = quotingId; n["quote"] = original.ObjectURI; n["quoteAuthorization"] = licence; });
+			Assert.Equal(QuoteState.Accepted, quoting.QuoteState);
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(original.ID, token)).QuotesCount);
+
+			Assert.True(await _harness.Quotes.RevokeLicence(original, quoting, token));
+			Assert.Equal(QuoteState.Revoked, (await DB.Default.Find<Post>().OneAsync(quoting.ID, token)).QuoteState);
+			Assert.Contains(await _harness.Outgoing(mallory.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "Delete" && a["object"]!.GetValue<string>() == licence);
+		}
+
+		[Fact]
+		public async Task A_followers_only_persona_turns_a_stranger_down()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			alice.Settings.QuotePolicy = PrivaPub.Models.User.QuotePolicies.Followers;
+			var original = (await _harness.Statuses.Publish(alice, new StatusDraft { Text = "friends only quoting" }, token)).Post;
+			var stranger = new RemoteActor(_harness.Peer, "stranger");
+
+			await _harness.Deliver(stranger, "/human-centipede", Request(stranger, original.ObjectURI, NewId(stranger, "notes")));
+
+			Assert.Equal("Reject", Assert.Single(await _harness.Outgoing(stranger.Id + "/inbox"))["type"]!.GetValue<string>());
+		}
+
+		[Fact]
+		public async Task One_persona_quotes_another_with_a_licence()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var (_, bob) = await _harness.Persona("bob");
+			var original = (await _harness.Statuses.Publish(alice, new StatusDraft { Text = "public thought" }, token)).Post;
+
+			var outcome = await _harness.Statuses.Publish(bob, new StatusDraft { Text = "agreed", QuotedStatusId = original.ID }, token);
+
+			Assert.True(outcome.Ok);
+			Assert.Equal(QuoteState.Accepted, outcome.Post.QuoteState);
+			Assert.StartsWith(alice.Uri + "/parrot-licences/", outcome.Post.QuoteAuthorizationURI);
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(original.ID, token)).QuotesCount);
+		}
+	}
+}

PrivaPub.Tests/Federation/ReactionTests.cs

@@ -0,0 +1,119 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Post;
+using PrivaPub.Domain.Social;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class ReactionNamesTests
+	{
+		[Theory]
+		[InlineData(":blobcat@k.example:", "blobcat")]
+		[InlineData("👍🏽", "👍🏽")]
+		[InlineData("❤️", "❤️")]
+		[InlineData("nope", null)]
+		[InlineData("👍👍", null)]
+		[InlineData(":unknown:", null)]
+		public void Normalises_what_peers_send(string content, string expected) =>
+			Assert.Equal(expected, Reactions.Normalise(content, new List<CustomEmoji> { new() { Shortcode = "blobcat", URL = "https://k.example/e.png" } })?.Name);
+	}
+
+	[Trait("Category", "Integration")]
+	public sealed class ReactionTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		static string NewId(RemoteActor actor, string kind) => $"{Origin(actor)}/{kind}/{Guid.NewGuid():N}";
+
+		async Task<Post> LocalPost()
+		{
+			var (root, alice) = await _harness.Persona("alice");
+			await _harness.Posts.InsertPost(root, new InsertPostForm { AvatarId = alice.Id, Text = "react to me" }, TestContext.Current.CancellationToken);
+			return await DB.Default.Find<Post>().Match(p => p.GroupUserId == alice.Id).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+		}
+
+		[Fact]
+		public async Task Misskey_and_pleroma_reactions_are_kept_apart_from_favourites()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var post = await LocalPost();
+			var misskey = new RemoteActor(_harness.Peer, "kitty");
+			var pleroma = new RemoteActor(_harness.Peer, "pleroma");
+
+			await _harness.Deliver(misskey, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(misskey, "likes"), ["type"] = "Like", ["actor"] = misskey.Id, ["object"] = post.ObjectURI, ["content"] = ":blobcat:",
+				["_misskey_reaction"] = ":blobcat:",
+				["tag"] = new JsonArray(new JsonObject { ["type"] = "Emoji", ["name"] = ":blobcat:", ["icon"] = new JsonObject { ["type"] = "Image", ["url"] = $"{Origin(misskey)}/emoji/blobcat.png" } })
+			});
+			await _harness.Deliver(misskey, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(misskey, "likes"), ["type"] = "Like", ["actor"] = misskey.Id, ["object"] = post.ObjectURI, ["content"] = "❤"
+			});
+			var fire = new JsonObject { ["id"] = NewId(pleroma, "activities"), ["type"] = "EmojiReact", ["actor"] = pleroma.Id, ["object"] = post.ObjectURI, ["content"] = "🔥" };
+			await _harness.Deliver(pleroma, "/human-centipede", fire);
+
+			var kept = await DB.Default.Find<Reaction>().Match(r => r.PostId == post.ID).ExecuteAsync(token);
+			Assert.Equal(new HashSet<string> { "blobcat", "🔥" }, kept.Select(r => r.Emoji).ToHashSet());
+			Assert.Equal($"{Origin(misskey)}/emoji/blobcat.png", kept.Single(r => r.Emoji == "blobcat").EmojiURL);
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).FavouritesCount);
+			Assert.True(await DB.Default.Find<Notification>().Match(n => n.Type == NotificationType.Reaction && n.Emoji == "🔥").ExecuteAnyAsync(token));
+
+			await _harness.Deliver(pleroma, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(pleroma, "activities"), ["type"] = "Undo", ["actor"] = pleroma.Id, ["object"] = fire.DeepClone()
+			});
+			Assert.Equal("blobcat", Assert.Single(await DB.Default.Find<Reaction>().Match(r => r.PostId == post.ID).ExecuteAsync(token)).Emoji);
+		}
+
+		[Fact]
+		public async Task A_persona_reacts_to_a_remote_post_and_takes_it_back()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			var noteId = NewId(mallory, "notes");
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(mallory, "activities"), ["type"] = "Create", ["actor"] = mallory.Id,
+				["object"] = new JsonObject
+				{
+					["id"] = noteId, ["type"] = "Note", ["attributedTo"] = mallory.Id, ["content"] = "<p>hi</p>",
+					["to"] = new JsonArray(Addressing.Public), ["cc"] = new JsonArray(alice.Uri),
+					["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = alice.Uri, ["name"] = "@alice" })
+				}
+			});
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == noteId).ExecuteFirstAsync(token);
+
+			Assert.True(await _harness.Reactions.React(alice, post, "🎉", token));
+			Assert.False(await _harness.Reactions.React(alice, post, "not an emoji", token));
+			Assert.True(await _harness.Reactions.Unreact(alice, post, "🎉", token));
+
+			var sent = await _harness.Outgoing(mallory.Id + "/inbox");
+			var react = Assert.Single(sent, a => a["type"]!.GetValue<string>() == "EmojiReact");
+			Assert.Equal("🎉", react["content"]!.GetValue<string>());
+			Assert.Equal(noteId, react["object"]!.GetValue<string>());
+			Assert.Equal(react["id"]!.GetValue<string>(), Assert.Single(sent, a => a["type"]!.GetValue<string>() == "Undo")["object"]!["id"]!.GetValue<string>());
+		}
+	}
+}

PrivaPub.Tests/Federation/RemoteActorServiceTests.cs

@@ -32,6 +32,16 @@ namespace PrivaPub.Tests.Federation
 				await _peer.DisposeAsync();
 		}
 
+		[Fact]
+		public async Task A_stored_actor_remembers_the_extensions_its_document_uses()
+		{
+			var bob = new RemoteActor(_peer, "bob");
+
+			var stored = await _service.GetActor(bob.Id, refresh: true, TestContext.Current.CancellationToken);
+
+			Assert.Contains("key:rsa-2048", stored.Features);
+		}
+
 		static string Actor(string id, string keyId = default, string owner = default, string pem = default, string type = "Person") =>
 			new JsonObject
 			{

PrivaPub.Tests/Federation/RendererTests.cs

@@ -57,7 +57,7 @@ namespace PrivaPub.Tests.Federation
 				Language = "en",
 				Mentions = new() { new PostMention { ActorURI = "https://m.example/users/bob", Handle = "@bob@m.example" } },
 				Tags = new() { "cats" },
-				CreationDate = new DateTime(2026, 9, 30, 17, 45, 12, DateTimeKind.Utc)
+				CreationDate = new DateTime(2026, 9, 30, 17, 45, 12, 345, DateTimeKind.Utc)
 			};
 
 			var note = ActivityPubRenderer.Note(post, Alice, default, "https://m.example/users/bob/statuses/1");
@@ -67,7 +67,7 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal("<p><strong>On &lt;cats&gt;</strong></p><p>body</p>", note["content"]!.GetValue<string>());
 			Assert.Equal("On <cats>", note["summary"]!.GetValue<string>());
 			Assert.True(note["sensitive"]!.GetValue<bool>());
-			Assert.Equal("2026-09-30T17:45:12Z", note["published"]!.GetValue<string>());
+			Assert.Equal("2026-09-30T17:45:12.345Z", note["published"]!.GetValue<string>());
 			Assert.Equal(new[] { ActivityPubRenderer.Public }, note["to"]!.AsArray().Select(n => n!.GetValue<string>()));
 			Assert.Equal(new[] { Alice.Followers, "https://m.example/users/bob" }, note["cc"]!.AsArray().Select(n => n!.GetValue<string>()));
 			var tags = note["tag"]!.AsArray();

PrivaPub.Tests/Http/HostBootTests.cs

@@ -0,0 +1,146 @@
+using Microsoft.AspNetCore.Mvc.Controllers;
+using Microsoft.AspNetCore.Mvc.Infrastructure;
+using Microsoft.AspNetCore.Mvc.RazorPages;
+using Microsoft.Extensions.DependencyInjection;
+
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Inbox;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class HostBootTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		[Fact]
+		public async Task The_host_shares_the_fixture_database()
+		{
+			Assert.True(await DB.Default.Find<AppConfiguration>().ExecuteAnyAsync(TestContext.Current.CancellationToken));
+			using var client = _host.Client();
+			Assert.Equal(HttpStatusCode.OK, (await client.GetAsync("/build.json", TestContext.Current.CancellationToken)).StatusCode);
+		}
+
+		[Fact]
+		public async Task The_harness_handles_the_same_activities_as_the_server()
+		{
+			await using var harness = await Harness.Start();
+			var registered = _host.Services.GetServices<IActivityHandler>().Select(h => h.GetType()).OrderBy(t => t.Name);
+			var harnessed = harness.Handlers.Select(h => h.GetType()).OrderBy(t => t.Name);
+
+			Assert.Equal(registered, harnessed);
+		}
+
+		[Fact]
+		public void Every_job_kind_has_exactly_one_handler()
+		{
+			var handlers = _host.Services.GetServices<IJobHandler>().GroupBy(h => h.Kind).ToDictionary(g => g.Key, g => g.Count());
+
+			foreach (var kind in Enum.GetValues<JobKind>())
+				Assert.True(handlers.GetValueOrDefault(kind) == 1, $"{kind} has {handlers.GetValueOrDefault(kind)} handlers");
+		}
+
+		[Fact]
+		public void Every_controller_and_page_model_can_be_made()
+		{
+			using var scope = _host.Services.CreateScope();
+			var controllers = _host.Get<IActionDescriptorCollectionProvider>().ActionDescriptors.Items
+				.OfType<ControllerActionDescriptor>()
+				.Select(d => d.ControllerTypeInfo.AsType())
+				.Distinct()
+				.ToList();
+			var pages = typeof(Program).Assembly.GetTypes().Where(t => t.IsSubclassOf(typeof(PageModel)) && !t.IsAbstract).ToList();
+
+			Assert.NotEmpty(controllers);
+			Assert.NotEmpty(pages);
+			foreach (var type in controllers.Concat(pages))
+				Assert.NotNull(ActivatorUtilities.CreateInstance(scope.ServiceProvider, type));
+		}
+
+		[Fact]
+		public void The_service_graph_is_valid()
+		{
+			var services = new ServiceCollection();
+			foreach (var descriptor in _host.Registered)
+				((ICollection<ServiceDescriptor>)services).Add(descriptor);
+
+			using var provider = services.BuildServiceProvider(new ServiceProviderOptions { ValidateOnBuild = true, ValidateScopes = true });
+		}
+
+		[Fact]
+		public async Task Swagger_is_not_served_outside_development()
+		{
+			using var client = _host.Client();
+
+			Assert.Equal(HttpStatusCode.NotFound, (await client.GetAsync("/swagger/index.html", TestContext.Current.CancellationToken)).StatusCode);
+		}
+
+		[Fact]
+		public async Task A_persona_gets_a_mastodon_token_through_the_real_code_flow()
+		{
+			var root = await _host.SignUp();
+			var persona = await _host.Persona(root, "boot");
+
+			var token = await _host.MastodonToken(persona);
+
+			using var client = _host.As(token);
+			var account = await client.GetStringAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken);
+			Assert.Contains($"\"id\":\"{persona.Id}\"", account);
+			Assert.DoesNotContain(root.Id, account);
+			Assert.DoesNotContain(root.UserName, account);
+		}
+	
+		[Fact]
+		public async Task A_signed_delivery_through_the_real_route_is_queued_and_stored()
+		{
+			var token = TestContext.Current.CancellationToken;
+			await using var peer = await Peer.Start();
+			var persona = await _host.Persona(await _host.SignUp(), "mouth");
+			var bob = new RemoteActor(peer, "bob");
+			var noteId = $"{peer.A}/notes/{Guid.NewGuid():N}";
+			var activity = new JsonObject
+			{
+				["id"] = noteId + "/activity",
+				["type"] = "Create",
+				["actor"] = bob.Id,
+				["to"] = new JsonArray($"{PrivaPubHost.Base}/peasants/{persona.UserName}"),
+				["object"] = new JsonObject
+				{
+					["id"] = noteId,
+					["type"] = "Note",
+					["attributedTo"] = bob.Id,
+					["to"] = new JsonArray($"{PrivaPubHost.Base}/peasants/{persona.UserName}"),
+					["content"] = "<p>hello through the front door</p>",
+					["published"] = DateTime.UtcNow.ToString("O")
+				}
+			};
+			using var client = _host.Client();
+
+			var response = await client.SendAsync(bob.SignedPost($"/peasants/{persona.UserName}/mouth", activity), token);
+
+			Assert.Equal(HttpStatusCode.Accepted, response.StatusCode);
+			Assert.Equal(1, await _host.RunInbox(noteId + "/activity", token));
+			var stored = await DB.Default.Find<Post>().Match(p => p.ObjectURI == noteId).ExecuteFirstAsync(token);
+			Assert.Equal(PostVisibility.Direct, stored.Visibility);
+			Assert.Contains("front door", stored.ContentHtml);
+		}
+	}
+}

PrivaPub.Tests/Http/NeverFiveHundredTests.cs

@@ -0,0 +1,127 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Routing;
+using Microsoft.AspNetCore.Routing.Patterns;
+using Microsoft.Extensions.DependencyInjection;
+
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Net.Http.Headers;
+using System.Text;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Http
+{
+	[Trait("Category", "Integration")]
+	public sealed class NeverFiveHundredTests : IAsyncLifetime
+	{
+		static readonly string[] Junk = { "x", "000000000000000000000000", "%2e%2e", new string('a', 5000), "5f0c1a2b3c4d5e6f70819203" };
+
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		public static TheoryData<string> Credentials() => new() { "anonymous", "persona", "junk" };
+
+		[Theory]
+		[MemberData(nameof(Credentials))]
+		public async Task No_route_answers_500_to_junk(string credentials)
+		{
+			var token = TestContext.Current.CancellationToken;
+			var bearer = credentials switch
+			{
+				"persona" => await _host.MastodonToken(await _host.Persona(await _host.SignUp(), "junk")),
+				"junk" => "not-a-token",
+				_ => default
+			};
+			var jwt = credentials == "persona" ? (await _host.SignUp()).Jwt : bearer;
+			var failures = new List<string>();
+
+			foreach (var (method, template) in Routes())
+				foreach (var value in Junk)
+				{
+					var path = Fill(template, value);
+					using var request = new HttpRequestMessage(new HttpMethod(method), path);
+					request.Headers.Add(PrivaPubHost.ClientHeader, $"10.9.{Random.Shared.Next(256)}.{Random.Shared.Next(1, 255)}");
+					var auth = path.StartsWith("/api/", StringComparison.Ordinal) || path.StartsWith("/oauth/", StringComparison.Ordinal) ? bearer : jwt;
+					if (auth != default)
+						request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", auth);
+					if (method is "POST" or "PUT" or "PATCH")
+						request.Content = new StringContent("{}", Encoding.UTF8, "application/json");
+					using var client = _host.Client();
+					HttpResponseMessage response;
+					try
+					{
+						response = await client.SendAsync(request, token);
+					}
+					catch (Exception ex)
+					{
+						failures.Add($"{method} {Short(path)} threw {ex.GetType().Name}: {ex.Message}");
+						continue;
+					}
+					using (response)
+					{
+						if ((int)response.StatusCode >= 500)
+							failures.Add($"{method} {Short(path)} answered {(int)response.StatusCode}");
+						else if (path.StartsWith("/api/", StringComparison.Ordinal) && (int)response.StatusCode >= 400 && !await IsMastodonError(response))
+							failures.Add($"{method} {Short(path)} answered {(int)response.StatusCode} without a Mastodon error body");
+					}
+				}
+
+			Assert.True(failures.Count == 0, $"{failures.Count} problems as {credentials}:\n" + string.Join("\n", failures.Distinct().Take(80)));
+		}
+
+		IEnumerable<(string Method, string Template)> Routes()
+		{
+			var endpoints = _host.Services.GetRequiredService<EndpointDataSource>().Endpoints.OfType<RouteEndpoint>();
+			foreach (var endpoint in endpoints)
+			{
+				var methods = endpoint.Metadata.GetMetadata<IHttpMethodMetadata>()?.HttpMethods;
+				var template = "/" + endpoint.RoutePattern.RawText?.TrimStart('/');
+				foreach (var method in methods is { Count: > 0 } ? methods : new[] { "GET", "POST" })
+					yield return (method, template);
+			}
+		}
+
+		static string Fill(string template, string value)
+		{
+			var pattern = RoutePatternFactory.Parse(template);
+			var builder = new StringBuilder();
+			foreach (var segment in pattern.PathSegments)
+			{
+				builder.Append('/');
+				foreach (var part in segment.Parts)
+					builder.Append(part switch
+					{
+						RoutePatternLiteralPart literal => literal.Content,
+						RoutePatternParameterPart => value,
+						RoutePatternSeparatorPart separator => separator.Content,
+						_ => string.Empty
+					});
+			}
+			return builder.Length == 0 ? "/" : builder.ToString();
+		}
+
+		static async Task<bool> IsMastodonError(HttpResponseMessage response)
+		{
+			var body = await response.Content.ReadAsStringAsync();
+			try
+			{
+				return JsonNode.Parse(body) is JsonObject error && error["error"] is JsonValue;
+			}
+			catch (System.Text.Json.JsonException)
+			{
+				return false;
+			}
+		}
+
+		static string Short(string path) => path.Length > 120 ? path[..120] + "…" : path;
+	}
+}

PrivaPub.Tests/Infrastructure/DeliveryWorkerTests.cs

@@ -0,0 +1,95 @@
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Infrastructure
+{
+	[Xunit.Collection(nameof(Exclusive))]
+	[Trait("Category", "Integration")]
+	public sealed class DeliveryWorkerTests : IAsyncLifetime
+	{
+		static readonly string[] PeerHosts = { "localhost", "127.0.0.1" };
+
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_peer = await Peer.Start();
+			await DB.Default.DeleteAsync<RemoteInstance>(i => PeerHosts.Contains(i.Host));
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_peer == default)
+				return;
+			await _peer.DisposeAsync();
+			await DB.Default.DeleteAsync<RemoteInstance>(i => PeerHosts.Contains(i.Host));
+		}
+
+		[Fact]
+		public async Task A_dead_host_does_not_hold_up_deliveries_to_live_ones()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (privateKey, publicKey) = Keys.NewKeyPair();
+			var avatar = new Avatar { UserName = $"sender{Guid.NewGuid():N}"[..20], PrivateKey = privateKey, PublicKey = publicKey };
+			await DB.Default.SaveAsync(avatar, token);
+			var local = new LocalActorService(new DbEntities(), new StaticOptions<AppConfiguration>(new AppConfiguration { BackendBaseAddress = "https://privapub.test" }));
+			var sender = local.FromAvatar(avatar);
+			var run = $"https://privapub.test/a/{Guid.NewGuid():N}/";
+			var queue = new JobQueue(j => j.DedupeKey.StartsWith(run));
+			var delivery = new DeliveryService(new DbEntities(), queue);
+			_peer.Answer("/dead/inbox", 503, TimeSpan.FromMilliseconds(300));
+			_peer.Answer("/live/inbox", 202);
+
+			var deadInboxes = Enumerable.Range(0, 60).Select(i => $"{_peer.B}/dead/inbox?{i}");
+			await delivery.Enqueue(sender, deadInboxes, new JsonObject { ["id"] = run + "dead", ["type"] = "Create" }, token);
+			await delivery.Enqueue(sender, new[] { $"{_peer.A}/live/inbox" }, new JsonObject { ["id"] = run + "live", ["type"] = "Create" }, token);
+
+			var handler = new DeliveryJobHandler(local, Peer.Http(), new HostCircuitBreaker(new MemoryCache(new MemoryCacheOptions())), NullLogger<DeliveryJobHandler>.Instance);
+			using var worker = new JobWorker(queue, new IJobHandler[] { handler }, NullLogger<JobWorker>.Instance);
+			await worker.StartAsync(token);
+			try
+			{
+				await Until(() => Task.FromResult(_peer.Requests.Any(r => r.Path == "/live/inbox")), token);
+				var deadSoFar = _peer.Requests.Count(r => r.Path == "/dead/inbox");
+				var live = Assert.Single(_peer.Requests, r => r.Path == "/live/inbox");
+				Assert.Contains($"keyId=\"{sender.KeyId}\"", live.Signature);
+				Assert.True(deadSoFar < 30, $"{deadSoFar} dead deliveries were tried before the live one");
+
+				await Until(() => DB.Default.Find<Job>().Match(j => j.DedupeKey.StartsWith(run + "dead") && j.State == JobState.Pending && j.Attempts > 0).ExecuteAnyAsync(token), token);
+			}
+			finally
+			{
+				await worker.StopAsync(CancellationToken.None);
+			}
+
+			var retried = await DB.Default.Find<Job>().Match(j => j.DedupeKey.StartsWith(run + "dead") && j.Attempts > 0 && j.State == JobState.Pending).ExecuteFirstAsync(token);
+			Assert.Equal("503", retried.LastError?.Split(' ')[0]);
+			Assert.True(retried.RunAt > DateTime.UtcNow);
+			Assert.True((await DB.Default.Find<RemoteInstance>().Match(i => i.Host == "localhost").ExecuteFirstAsync(token))?.ConsecutiveFailures > 0);
+		}
+
+		static async Task Until(Func<Task<bool>> condition, CancellationToken token)
+		{
+			var deadline = DateTime.UtcNow.AddSeconds(30);
+			while (!await condition())
+			{
+				Assert.True(DateTime.UtcNow < deadline, "timed out");
+				await Task.Delay(50, token);
+			}
+		}
+	}
+}

PrivaPub.Tests/Infrastructure/HostCircuitBreakerTests.cs

@@ -0,0 +1,67 @@
+using Microsoft.Extensions.Caching.Memory;
+
+using MongoDB.Entities;
+
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Tests.Support;
+
+namespace PrivaPub.Tests.Infrastructure
+{
+	[Trait("Category", "Integration")]
+	public sealed class HostCircuitBreakerTests : IAsyncLifetime
+	{
+		readonly string _host = $"breaker{Guid.NewGuid():N}.example";
+
+		public ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			return ValueTask.CompletedTask;
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (MongoFixture.Enabled)
+				await DB.Default.DeleteAsync<RemoteInstance>(i => i.Host == _host);
+		}
+
+		[Fact]
+		public async Task A_host_is_quarantined_only_past_the_threshold_and_freed_by_a_success()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var breaker = new HostCircuitBreaker(new MemoryCache(new MemoryCacheOptions()));
+
+			for (var i = 1; i < HostCircuitBreaker.Threshold; i++)
+				await breaker.Failed(_host, "503", token);
+			Assert.Null(await breaker.UnavailableUntil(_host, token));
+
+			await breaker.Failed(_host, "503", token);
+			var until = await breaker.UnavailableUntil(_host, token);
+			Assert.NotNull(until);
+			Assert.InRange(until.Value, DateTime.UtcNow.AddMinutes(55), DateTime.UtcNow.AddMinutes(65));
+			var instance = await DB.Default.Find<RemoteInstance>().Match(i => i.Host == _host).ExecuteFirstAsync(token);
+			Assert.Equal(HostCircuitBreaker.Threshold, instance.ConsecutiveFailures);
+			Assert.Equal("503", instance.LastError);
+
+			await breaker.Succeeded(_host, token);
+			Assert.Null(await breaker.UnavailableUntil(_host, token));
+			instance = await DB.Default.Find<RemoteInstance>().Match(i => i.Host == _host).ExecuteFirstAsync(token);
+			Assert.Equal(0, instance.ConsecutiveFailures);
+			Assert.NotNull(instance.LastSuccessAt);
+		}
+
+		[Fact]
+		public async Task A_healthy_host_is_written_at_most_once_an_hour()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var breaker = new HostCircuitBreaker(new MemoryCache(new MemoryCacheOptions()));
+
+			await breaker.Succeeded(_host, token);
+			var first = (await DB.Default.Find<RemoteInstance>().Match(i => i.Host == _host).ExecuteFirstAsync(token)).LastSuccessAt;
+			await breaker.Succeeded(_host, token);
+			var second = (await DB.Default.Find<RemoteInstance>().Match(i => i.Host == _host).ExecuteFirstAsync(token)).LastSuccessAt;
+
+			Assert.Equal(first, second);
+		}
+	}
+}

PrivaPub.Tests/Infrastructure/IndexTests.cs

@@ -12,6 +12,7 @@ using PrivaPub.Tests.Support;
 
 namespace PrivaPub.Tests.Infrastructure
 {
+	[Xunit.Collection(nameof(Exclusive))]
 	[Trait("Category", "Integration")]
 	public class IndexTests
 	{

PrivaPub.Tests/Infrastructure/JobQueueTests.cs

@@ -1,19 +1,9 @@
-using Microsoft.Extensions.Caching.Memory;
-using Microsoft.Extensions.Logging.Abstractions;
-
 using MongoDB.Entities;
 
-using PrivaPub.Federation.Actors;
-using PrivaPub.Federation.Outbox;
 using PrivaPub.Infrastructure.Jobs;
-using PrivaPub.Models;
 using PrivaPub.Models.Jobs;
-using PrivaPub.Models.User;
-using PrivaPub.StaticServices;
 using PrivaPub.Tests.Support;
 
-using System.Text.Json.Nodes;
-
 namespace PrivaPub.Tests.Infrastructure
 {
 	public class BackoffTests
@@ -38,19 +28,13 @@ namespace PrivaPub.Tests.Infrastructure
 	[Trait("Category", "Integration")]
 	public sealed class JobQueueTests : IAsyncLifetime
 	{
-		Peer _peer;
-
-		public async ValueTask InitializeAsync()
+		public ValueTask InitializeAsync()
 		{
 			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
-			_peer = await Peer.Start();
+			return ValueTask.CompletedTask;
 		}
 
-		public async ValueTask DisposeAsync()
-		{
-			if (_peer != default)
-				await _peer.DisposeAsync();
-		}
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
 
 		static Job NewJob(string host = default, string dedupe = default) => new()
 		{
@@ -102,44 +86,9 @@ namespace PrivaPub.Tests.Infrastructure
 			var job = new Job { Kind = (JobKind)98, State = JobState.Running, LeasedUntil = DateTime.UtcNow.AddMinutes(-1) };
 			await DB.Default.SaveAsync(job, token);
 
-			await new JobQueue().Reap(token);
+			await new JobQueue(j => j.ID == job.ID).Reap(token);
 
 			Assert.Equal(JobState.Pending, (await DB.Default.Find<Job>().OneAsync(job.ID, token)).State);
 		}
-
-		[Fact]
-		public async Task A_dead_host_does_not_hold_up_deliveries_to_live_ones()
-		{
-			var token = TestContext.Current.CancellationToken;
-			var (privateKey, publicKey) = Keys.NewKeyPair();
-			var avatar = new Avatar { UserName = $"sender{Guid.NewGuid():N}"[..20], PrivateKey = privateKey, PublicKey = publicKey };
-			await DB.Default.SaveAsync(avatar, token);
-			var local = new LocalActorService(new DbEntities(), new StaticOptions<AppConfiguration>(new AppConfiguration { BackendBaseAddress = "https://privapub.test" }));
-			var sender = local.FromAvatar(avatar);
-			var queue = new JobQueue();
-			var delivery = new DeliveryService(new DbEntities(), queue);
-			_peer.Answer("/dead/inbox", 503, TimeSpan.FromMilliseconds(300));
-			_peer.Answer("/live/inbox", 202);
-
-			var deadInboxes = Enumerable.Range(0, 60).Select(i => $"{_peer.B}/dead/inbox?{i}");
-			await delivery.Enqueue(sender, deadInboxes, new JsonObject { ["id"] = $"https://privapub.test/a/{Guid.NewGuid():N}", ["type"] = "Create" }, token);
-			await delivery.Enqueue(sender, new[] { $"{_peer.A}/live/inbox" }, new JsonObject { ["id"] = $"https://privapub.test/a/{Guid.NewGuid():N}", ["type"] = "Create" }, token);
-
-			var handler = new DeliveryJobHandler(local, Peer.Http(), new HostCircuitBreaker(new MemoryCache(new MemoryCacheOptions())), NullLogger<DeliveryJobHandler>.Instance);
-			using var worker = new JobWorker(queue, new IJobHandler[] { handler }, NullLogger<JobWorker>.Instance);
-			await worker.StartAsync(token);
-			var deadline = DateTime.UtcNow.AddSeconds(5);
-			while (DateTime.UtcNow < deadline && !_peer.Requests.Any(r => r.Path == "/live/inbox"))
-				await Task.Delay(50, token);
-			var live = Assert.Single(_peer.Requests, r => r.Path == "/live/inbox");
-			Assert.True(_peer.Requests.Count(r => r.Path == "/dead/inbox") < 30);
-			while (DateTime.UtcNow < deadline && !await DB.Default.Find<RemoteInstance>().Match(i => i.Host == "localhost").ExecuteAnyAsync(token))
-				await Task.Delay(50, token);
-			await worker.StopAsync(token);
-
-			Assert.Contains($"keyId=\"{sender.KeyId}\"", live.Signature);
-			var instance = await DB.Default.Find<RemoteInstance>().Match(i => i.Host == "localhost").ExecuteFirstAsync(token);
-			Assert.True(instance.ConsecutiveFailures > 0);
-		}
 	}
 }

PrivaPub.Tests/Infrastructure/MigrationTests.cs

@@ -1,11 +1,13 @@
 using MongoDB.Entities;
 
 using PrivaPub.Infrastructure.Data.Migrations;
+using PrivaPub.Models.Federation;
 using PrivaPub.Models.Post;
 using PrivaPub.Tests.Support;
 
 namespace PrivaPub.Tests.Infrastructure
 {
+	[Xunit.Collection(nameof(Exclusive))]
 	[Trait("Category", "Integration")]
 	public class MigrationTests
 	{
@@ -45,5 +47,37 @@ namespace PrivaPub.Tests.Infrastructure
 			Assert.Equal("conversation1", post.ConversationId);
 			Assert.Equal("a1", post.AuthorAccountId);
 		}
+	
+		[Fact]
+		public async Task Fetched_records_lose_the_signature_they_never_had_and_every_record_gets_its_extensions()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			var token = TestContext.Current.CancellationToken;
+			var fetched = new ObjectRecord
+			{
+				ObjectURI = $"https://r.example/{Guid.NewGuid():N}", Path = ObjectPath.Fetched, KeyId = "https://x.example/u#k", SignatureScheme = "draft-cavage",
+				Algorithm = "rsa-sha256", SignedHeaders = new() { "host" }, ActivityContext = "\"https://www.w3.org/ns/activitystreams\"",
+				Raw = "{\"type\":\"Note\",\"quoteUrl\":\"https://q.example/1\"}"
+			};
+			var delivered = new ObjectRecord
+			{
+				ObjectURI = $"https://r.example/{Guid.NewGuid():N}", Path = ObjectPath.Delivered, KeyId = "https://x.example/u#k", SignatureScheme = "draft-cavage",
+				Raw = "not json"
+			};
+			await DB.Default.SaveAsync(new[] { fetched, delivered }, token);
+
+			await new _008_fetched_records_lose_the_trigger_signature().UpgradeAsync();
+			await new _009_object_records_keep_their_extensions().UpgradeAsync();
+
+			var afterFetched = await DB.Default.Find<ObjectRecord>().OneAsync(fetched.ID, token);
+			var afterDelivered = await DB.Default.Find<ObjectRecord>().OneAsync(delivered.ID, token);
+			Assert.Null(afterFetched.KeyId);
+			Assert.Null(afterFetched.SignatureScheme);
+			Assert.Empty(afterFetched.SignedHeaders);
+			Assert.Null(afterFetched.ActivityContext);
+			Assert.Equal("https://x.example/u#k", afterDelivered.KeyId);
+			Assert.Contains("legacy-quote", afterFetched.Extensions);
+			Assert.Empty(afterDelivered.Extensions);
+		}
 	}
 }

PrivaPub.Tests/Infrastructure/PrivacyIdsTests.cs

@@ -12,15 +12,18 @@ namespace PrivaPub.Tests.Infrastructure
 		[Fact]
 		public void Persona_ids_carry_only_the_day_and_share_nothing_else()
 		{
-			var first = (string)new Avatar().GenerateNewID();
-			var second = (string)new Avatar().GenerateNewID();
+			var avatar = new Avatar();
+			var first = (string)avatar.GenerateNewID();
+			var second = (string)new Avatar { PublishedOn = avatar.PublishedOn }.GenerateNewID();
+			var group = new GroupEntity();
 
 			Assert.True(ObjectId.TryParse(first, out var a));
 			Assert.True(ObjectId.TryParse(second, out var b));
-			Assert.Equal(DateTime.UtcNow.Date, a.CreationTime);
+			Assert.Equal(avatar.PublishedOn, a.CreationTime);
+			Assert.InRange(a.CreationTime, DateTime.UtcNow.Date.AddDays(-13), DateTime.UtcNow.Date);
 			Assert.Equal(a.CreationTime, b.CreationTime);
 			Assert.NotEqual(first[8..14], second[8..14]);
-			Assert.Equal(DateTime.UtcNow.Date, ObjectId.Parse((string)new GroupEntity().GenerateNewID()).CreationTime);
+			Assert.Equal(group.PublishedOn, ObjectId.Parse((string)group.GenerateNewID()).CreationTime);
 		}
 
 		[Fact]
@@ -33,6 +36,33 @@ namespace PrivaPub.Tests.Infrastructure
 			Assert.Equal(new DateTime(2025, 1, 1, 0, 0, 0, DateTimeKind.Utc), ObjectId.Parse(older).CreationTime);
 		}
 
+		[Fact]
+		public void A_post_arriving_live_sorts_after_everything_already_stored()
+		{
+			var local = ObjectId.GenerateNewId().ToString();
+			var reply = PrivacyIds.Arrived(DateTime.UtcNow.AddSeconds(-30));
+			var skewed = PrivacyIds.Arrived(DateTime.UtcNow.AddYears(50));
+
+			Assert.True(string.CompareOrdinal(local, reply) < 0);
+			Assert.True(string.CompareOrdinal(reply, skewed) < 0);
+			Assert.True(ObjectId.Parse(skewed).CreationTime < DateTime.UtcNow.AddMinutes(1));
+		}
+
+		[Fact]
+		public void A_backfilled_post_keeps_its_published_time() =>
+			Assert.Equal(new DateTime(2025, 1, 1, 0, 0, 0, DateTimeKind.Utc), ObjectId.Parse(PrivacyIds.Arrived(new DateTime(2025, 1, 1, 0, 0, 0, DateTimeKind.Utc))).CreationTime);
+
+		[Fact]
+		public void A_persona_publishes_a_day_within_two_weeks_before_its_creation()
+		{
+			var created = new DateTime(2026, 10, 1, 15, 30, 0, DateTimeKind.Utc);
+			var days = Enumerable.Range(0, 200).Select(_ => PrivacyIds.PublishedDay(created)).ToList();
+
+			Assert.All(days, d => Assert.Equal(TimeSpan.Zero, d.TimeOfDay));
+			Assert.All(days, d => Assert.InRange(d, created.Date.AddDays(-13), created.Date));
+			Assert.True(days.Distinct().Count() > 1);
+		}
+
 		[Fact]
 		public void A_published_time_in_the_future_is_clamped() =>
 			Assert.True(ObjectId.Parse(PrivacyIds.At(DateTime.UtcNow.AddYears(50))).CreationTime < DateTime.UtcNow.AddDays(2));

PrivaPub.Tests/PrivaPub.Tests.csproj

@@ -9,6 +9,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.9" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.10.1" />
     <PackageReference Include="xunit.v3" Version="3.2.2" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />

PrivaPub.Tests/Statistics/DeliveryAttemptTests.cs

@@ -0,0 +1,111 @@
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Statistics;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Statistics
+{
+	[Xunit.Collection(nameof(Exclusive))]
+	[Trait("Category", "Integration")]
+	public sealed class DeliveryAttemptTests : IAsyncLifetime
+	{
+		static readonly string[] PeerHosts = { "localhost", "127.0.0.1" };
+
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+			await DB.Default.DeleteAsync<RemoteInstance>(i => PeerHosts.Contains(i.Host));
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness == default)
+				return;
+			await _harness.DisposeAsync();
+			await DB.Default.DeleteAsync<RemoteInstance>(i => PeerHosts.Contains(i.Host));
+		}
+
+		async Task<(JobOutcome Outcome, InteractionEvent Event)> Attempt(string path, JsonObject activity, LocalActor signer = default)
+		{
+			var ledger = new MemoryLedger();
+			var handler = new DeliveryJobHandler(_harness.Local, Peer.Http(), new HostCircuitBreaker(new MemoryCache(new MemoryCacheOptions())),
+				NullLogger<DeliveryJobHandler>.Instance, ledger);
+			signer ??= (await _harness.Persona("sender")).Avatar;
+			var id = activity["id"]!.GetValue<string>();
+			await _harness.Delivery.Enqueue(signer, new[] { _harness.Peer.A + path }, activity, TestContext.Current.CancellationToken);
+			var job = await DB.Default.Find<Job>().Match(j => j.DedupeKey == $"{id}|{_harness.Peer.A + path}").ExecuteFirstAsync(TestContext.Current.CancellationToken);
+			job.Attempts = 1;
+
+			var outcome = await handler.Handle(job, TestContext.Current.CancellationToken);
+
+			return (outcome, Assert.Single(ledger.Of("out")));
+		}
+
+		static JsonObject Create(string audience) => new()
+		{
+			["id"] = $"https://privapub.test/a/{Guid.NewGuid():N}",
+			["type"] = "Create",
+			["to"] = new JsonArray(audience),
+			["object"] = new JsonObject { ["type"] = "Note", ["content"] = "hi" }
+		};
+
+		[Fact]
+		public async Task A_delivered_public_post_is_ok_with_its_shape_size_and_time()
+		{
+			_harness.Peer.Answer("/ok/inbox", 202);
+
+			var (outcome, e) = await Attempt("/ok/inbox", Create("https://www.w3.org/ns/activitystreams#Public"));
+
+			Assert.Equal(JobResult.Done, outcome.Result);
+			Assert.Equal(("ok", "Create", "Note", "public", "person"), (e.Outcome, e.Activity, e.Object, e.Audience, e.LocalKind));
+			Assert.Equal(202, e.Status);
+			Assert.Equal("127.0.0.1", e.Host);
+			Assert.Null(e.Reason);
+			Assert.True(e.Bytes > 0);
+			Assert.NotNull(e.LatencyMs);
+			Assert.Equal(1, e.Attempt);
+		}
+
+		[Fact]
+		public async Task Refusals_and_failures_carry_their_status_and_private_traffic_has_no_kind()
+		{
+			_harness.Peer.Answer("/gone/inbox", 410);
+			_harness.Peer.Answer("/busy/inbox", 429);
+			_harness.Peer.Answer("/broken/inbox", 500);
+
+			var (_, gone) = await Attempt("/gone/inbox", Create("https://elsewhere.example/users/x"));
+			var (_, busy) = await Attempt("/busy/inbox", Create("https://elsewhere.example/users/x"));
+			var (_, broken) = await Attempt("/broken/inbox", Create("https://elsewhere.example/users/x"));
+
+			Assert.Equal(("dead", "410", 410), (gone.Outcome, gone.Reason, gone.Status!.Value));
+			Assert.Equal(("retry", "429"), (busy.Outcome, busy.Reason));
+			Assert.Equal(("retry", "500"), (broken.Outcome, broken.Reason));
+			Assert.All(new[] { gone, busy, broken }, e => Assert.Equal(("private", (string)null), (e.Audience, e.LocalKind)));
+		}
+
+		[Fact]
+		public async Task A_signer_that_no_longer_exists_is_dead()
+		{
+			var ghost = new LocalActor { Id = "000000000000000000000000", Kind = LocalActorKind.Person, UserName = "ghost", BaseAddress = Harness.Base };
+
+			var (outcome, e) = await Attempt("/never/inbox", Create("https://www.w3.org/ns/activitystreams#Public"), ghost);
+
+			Assert.Equal(JobResult.Dead, outcome.Result);
+			Assert.Equal(("dead", "signer-gone"), (e.Outcome, e.Reason));
+			Assert.Null(e.Status);
+		}
+	}
+}

PrivaPub.Tests/Statistics/HandlerVerdictTests.cs

@@ -0,0 +1,211 @@
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Inbox;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Group;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Statistics;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Tests.Statistics
+{
+	public class ArrivalVerdictTests
+	{
+		[Fact]
+		public void The_first_decision_wins_and_a_circle_has_no_kind()
+		{
+			var verdict = new ArrivalVerdict();
+
+			verdict.Drop("not-addressed");
+			verdict.Accept("stored");
+			verdict.About("Note", PostVisibility.Circle, DateTime.UtcNow.AddMinutes(-2), new LocalActor { Kind = LocalActorKind.Group, IsCircle = true });
+
+			Assert.Equal(("dropped", "not-addressed"), (verdict.Outcome, verdict.Reason));
+			Assert.Equal("private", verdict.Audience);
+			Assert.Null(verdict.LocalKind);
+			Assert.InRange(verdict.AgeSeconds!.Value, 110, 130);
+		}
+
+		[Theory]
+		[InlineData(PostVisibility.Public, "public")]
+		[InlineData(PostVisibility.Unlisted, "unlisted")]
+		[InlineData(PostVisibility.FollowersOnly, "private")]
+		[InlineData(PostVisibility.Direct, "private")]
+		[InlineData(PostVisibility.Circle, "private")]
+		[InlineData(PostVisibility.LocalGeo, "private")]
+		public void Every_visibility_but_public_and_unlisted_is_private(PostVisibility visibility, string audience) =>
+			Assert.Equal(audience, ArrivalVerdict.AudienceOf(visibility));
+
+		[Fact]
+		public void Outside_an_arrival_nothing_happens()
+		{
+			Arrival.Current = default;
+			Arrival.Drop("x");
+			Arrival.About("Note");
+		}
+	}
+
+	[Trait("Category", "Integration")]
+	public sealed class HandlerVerdictTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		InteractionEvent Processed(string activityType) =>
+			_harness.Ledger.Of("in").Last(e => e.Activity == activityType);
+
+		JsonObject Create(RemoteActor author, IEnumerable<string> to, JsonObject extra = default)
+		{
+			var origin = new Uri(author.Id).GetLeftPart(UriPartial.Authority);
+			var note = new JsonObject
+			{
+				["id"] = $"{origin}/notes/{Guid.NewGuid():N}",
+				["type"] = "Note",
+				["attributedTo"] = author.Id,
+				["content"] = "<p>hello</p>",
+				["to"] = new JsonArray(to.Select(t => (JsonNode)t).ToArray())
+			};
+			foreach (var (key, value) in extra ?? new JsonObject())
+				note[key] = value?.DeepClone();
+			return new JsonObject { ["id"] = $"{origin}/activities/{Guid.NewGuid():N}", ["type"] = "Create", ["actor"] = author.Id, ["object"] = note };
+		}
+
+		[Fact]
+		public async Task A_direct_message_is_stored_private_and_without_a_local_kind()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+
+			await _harness.Deliver(bob, "/human-centipede", Create(bob, new[] { alice.Uri }));
+
+			var e = Processed("Create");
+			Assert.Equal(("accepted", "stored", "private"), (e.Outcome, e.Reason, e.Audience));
+			Assert.Equal("Note", e.Object);
+			Assert.Null(e.LocalKind);
+			Assert.Equal("127.0.0.1", e.Host);
+			Assert.NotNull(e.Attempt);
+			Assert.NotNull(e.WaitMs);
+			Assert.Equal(bob.Id, _harness.Ledger.Events.Last(x => x.Event == e).ActorUri);
+		}
+
+		[Fact]
+		public async Task A_public_reply_to_a_persona_names_its_kind_and_its_features()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			var parent = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "first" }, TestContext.Current.CancellationToken);
+
+			await _harness.Deliver(bob, "/human-centipede", Create(bob, new[] { Addressing.Public, alice.Uri },
+				new JsonObject { ["inReplyTo"] = parent.Post.ObjectURI, ["interactionPolicy"] = new JsonObject(), ["quoteUrl"] = "https://elsewhere.example/1" }));
+
+			var e = Processed("Create");
+			Assert.Equal(("accepted", "public", "person"), (e.Outcome, e.Audience, e.LocalKind));
+			Assert.Contains("interaction-policy", e.Features);
+			Assert.Contains("legacy-quote", e.Features);
+		}
+
+		[Fact]
+		public async Task Unwanted_things_are_dropped_with_a_reason()
+		{
+			var stranger = new RemoteActor(_harness.Peer, "stranger");
+
+			await _harness.Deliver(stranger, "/human-centipede", Create(stranger, new[] { Addressing.Public }));
+			var unaddressed = Processed("Create");
+			await _harness.Deliver(stranger, "/human-centipede", new JsonObject
+			{
+				["id"] = new Uri(stranger.Id).GetLeftPart(UriPartial.Authority) + "/likes/" + Guid.NewGuid().ToString("N"),
+				["type"] = "Like",
+				["actor"] = stranger.Id,
+				["object"] = $"{Harness.Base}/peasants/x/scribbles/{Guid.NewGuid():N}"
+			});
+			var like = Processed("Like");
+			await _harness.Deliver(stranger, "/human-centipede", new JsonObject
+			{
+				["id"] = new Uri(stranger.Id).GetLeftPart(UriPartial.Authority) + "/x/" + Guid.NewGuid().ToString("N"),
+				["type"] = "Bite",
+				["actor"] = stranger.Id,
+				["object"] = stranger.Id
+			});
+			var bite = Processed("Bite");
+			await _harness.Deliver(stranger, "/human-centipede", new JsonObject
+			{
+				["id"] = new Uri(stranger.Id).GetLeftPart(UriPartial.Authority) + "/undo/" + Guid.NewGuid().ToString("N"),
+				["type"] = "Undo",
+				["actor"] = stranger.Id,
+				["object"] = new JsonObject { ["id"] = stranger.Id + "/likes/never", ["type"] = "Like", ["actor"] = stranger.Id, ["object"] = "https://nowhere.example/1" }
+			});
+			var undo = Processed("Undo");
+
+			Assert.Equal(("dropped", "not-addressed", "public"), (unaddressed.Outcome, unaddressed.Reason, unaddressed.Audience));
+			Assert.Equal(("dropped", "unknown-object"), (like.Outcome, like.Reason));
+			Assert.Equal(("dropped", "unknown-type"), (bite.Outcome, bite.Reason));
+			Assert.Equal(("dropped", "unknown-object", "Like"), (undo.Outcome, undo.Reason, undo.Object));
+		}
+
+		[Fact]
+		public async Task A_stranger_posting_into_a_circle_never_reveals_the_circle()
+		{
+			var (_, owner) = await _harness.Persona("owner");
+			var (privateKey, publicKey) = Keys.NewKeyPair();
+			var entity = new GroupEntity
+			{
+				UserName = $"circle{Guid.NewGuid():N}"[..20],
+				Kind = GroupKind.Circle,
+				PostingPolicy = PostingPolicy.Followers,
+				PrivateKey = privateKey,
+				PublicKey = publicKey,
+				Members = new() { new GroupMember { AvatarId = owner.Id, Role = GroupRole.Owner } }
+			};
+			await DB.Default.SaveAsync(entity);
+			var circle = _harness.Local.FromGroup(entity);
+			var outsider = new RemoteActor(_harness.Peer, "outsider");
+
+			await _harness.Deliver(outsider, "/human-centipede", Create(outsider, new[] { circle.Uri, circle.Flock }));
+
+			var e = Processed("Create");
+			Assert.Equal(("dropped", "not-addressed", "private"), (e.Outcome, e.Reason, e.Audience));
+			Assert.Null(e.LocalKind);
+			Assert.DoesNotContain(_harness.Ledger.Events, x => System.Text.Json.JsonSerializer.Serialize(x.Event).Contains("circle", StringComparison.OrdinalIgnoreCase));
+		}
+
+		[Fact]
+		public async Task A_follow_is_accepted_and_its_undo_is_recorded()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			var follow = new JsonObject { ["id"] = bob.Id + "/follows/" + Guid.NewGuid().ToString("N"), ["type"] = "Follow", ["actor"] = bob.Id, ["object"] = alice.Uri };
+
+			await _harness.Deliver(bob, "/human-centipede", follow);
+			var followed = Processed("Follow");
+			await _harness.Deliver(bob, "/human-centipede", new JsonObject
+			{
+				["id"] = bob.Id + "/undo/" + Guid.NewGuid().ToString("N"),
+				["type"] = "Undo",
+				["actor"] = bob.Id,
+				["object"] = follow.DeepClone()
+			});
+			var undone = Processed("Undo");
+
+			Assert.Equal(("accepted", "auto-accepted", "none"), (followed.Outcome, followed.Reason, followed.Audience));
+			Assert.Equal(("accepted", "undone", "Follow"), (undone.Outcome, undone.Reason, undone.Object));
+		}
+	}
+}

PrivaPub.Tests/Statistics/InboxAnswerTests.cs

@@ -0,0 +1,169 @@
+using Microsoft.Extensions.Logging.Abstractions;
+
+using PrivaPub.Federation.Inbox;
+using PrivaPub.Federation.Moderation;
+using PrivaPub.Federation.Signing;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Statistics;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Statistics
+{
+	public class SignatureProblemCodeTests
+	{
+		[Theory]
+		[InlineData("unsupported signature algorithm 'ed25519'", "algorithm-unsupported")]
+		[InlineData("(request-target) is not signed", "headers-unsigned")]
+		[InlineData("host is not signed", "headers-unsigned")]
+		[InlineData("the digest is not signed", "headers-unsigned")]
+		[InlineData("neither date nor (created) is signed", "headers-unsigned")]
+		[InlineData("the digest does not match the body", "digest-mismatch")]
+		[InlineData("unreadable Date header", "header-unreadable")]
+		[InlineData("unreadable (created)", "header-unreadable")]
+		[InlineData("unreadable (expires)", "header-unreadable")]
+		[InlineData("the Date header is outside the allowed window", "date-skew")]
+		[InlineData("(created) is outside the allowed window", "date-skew")]
+		[InlineData("the signature has expired", "expired")]
+		[InlineData("something new", "signature-problem")]
+		public void Every_signature_problem_has_a_reason_code(string problem, string code) =>
+			Assert.Equal(code, HttpSignatures.ProblemCode(problem));
+	}
+
+	[Trait("Category", "Integration")]
+	public sealed class InboxAnswerTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		JsonObject Create(RemoteActor sender, string to)
+		{
+			var origin = new Uri(sender.Id).GetLeftPart(UriPartial.Authority);
+			var id = $"{origin}/notes/{Guid.NewGuid():N}";
+			return new JsonObject
+			{
+				["id"] = id + "/activity",
+				["type"] = "Create",
+				["actor"] = sender.Id,
+				["to"] = new JsonArray(to),
+				["object"] = new JsonObject { ["id"] = id, ["type"] = "Note", ["attributedTo"] = sender.Id, ["to"] = new JsonArray(to), ["content"] = "hi" }
+			};
+		}
+
+		(InboxResult Result, InteractionEvent Event, string ActorUri, bool Claimed) Last(InboxResult result)
+		{
+			var recorded = _harness.Ledger.Events.Last(e => e.Event.Channel == "recv");
+			return (result, recorded.Event, recorded.ActorUri, recorded.HostClaimed);
+		}
+
+		[Fact]
+		public async Task A_verified_delivery_is_queued_once_and_then_a_duplicate()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			var activity = Create(bob, alice.Uri);
+
+			var first = Last(await _harness.Receiver.Receive(bob.Post(Harness.Host, "/human-centipede", activity), default, CancellationToken.None));
+			var second = Last(await _harness.Receiver.Receive(bob.Post(Harness.Host, "/human-centipede", activity), default, CancellationToken.None));
+
+			Assert.Equal(202, first.Event.Status);
+			Assert.Equal("queued", first.Event.Reason);
+			Assert.Equal("queued", first.Event.Outcome);
+			Assert.Equal("127.0.0.1", first.Event.Host);
+			Assert.Equal("Create", first.Event.Activity);
+			Assert.Equal("Note", first.Event.Object);
+			Assert.Equal("shared", first.Event.Inbox);
+			Assert.Equal("cavage:rsa-sha256", first.Event.Signature);
+			Assert.True(first.Event.Bytes > 0);
+			Assert.Equal(bob.Id, first.ActorUri);
+			Assert.False(first.Claimed);
+			Assert.Equal("duplicate", second.Event.Reason);
+		}
+
+		[Fact]
+		public async Task Refusals_carry_their_reason_and_an_unverified_host_is_only_claimed()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+
+			var unsigned = mallory.Post(Harness.Host, "/human-centipede", Create(mallory, alice.Uri));
+			unsigned.Headers.Remove("Signature");
+			var noSignature = Last(await _harness.Receiver.Receive(unsigned, default, CancellationToken.None));
+
+			var tampered = mallory.Post(Harness.Host, "/human-centipede", Create(mallory, alice.Uri));
+			tampered.Headers["Digest"] = "SHA-256=AAAA";
+			var badDigest = Last(await _harness.Receiver.Receive(tampered, default, CancellationToken.None));
+
+			var forged = mallory.Post(Harness.Host, "/human-centipede", Create(mallory, alice.Uri));
+			forged.Headers["Signature"] = forged.Headers["Signature"].ToString().Replace("signature=\"", "signature=\"AAAA");
+			var badSignature = Last(await _harness.Receiver.Receive(forged, default, CancellationToken.None));
+
+			var junk = Last(await _harness.Deliver(mallory, "/human-centipede", new JsonArray(1, 2)));
+
+			Assert.Equal((401, "no-signature", "none"), (noSignature.Event.Status!.Value, noSignature.Event.Reason, noSignature.Event.Signature));
+			Assert.Equal((401, "digest-mismatch"), (badDigest.Event.Status!.Value, badDigest.Event.Reason));
+			Assert.Equal((401, "signature-invalid"), (badSignature.Event.Status!.Value, badSignature.Event.Reason));
+			Assert.Equal((400, "not-activity"), (junk.Event.Status!.Value, junk.Event.Reason));
+			foreach (var refused in new[] { noSignature, badDigest, badSignature })
+			{
+				Assert.Equal("refused", refused.Event.Outcome);
+				Assert.True(refused.Claimed);
+				Assert.Null(refused.ActorUri);
+			}
+		}
+
+		[Fact]
+		public async Task A_follow_of_nobody_is_a_404_and_a_self_delete_with_an_unknown_key_is_a_silent_202()
+		{
+			var stranger = new RemoteActor(_harness.Peer, "stranger");
+			var follow = new JsonObject
+			{
+				["id"] = stranger.Id + "/follows/" + Guid.NewGuid().ToString("N"),
+				["type"] = "Follow",
+				["actor"] = stranger.Id,
+				["object"] = $"{Harness.Base}/peasants/nobody{Guid.NewGuid():N}"
+			};
+			var notFound = Last(await _harness.Receiver.Receive(stranger.Post(Harness.Host, "/human-centipede", follow), default, CancellationToken.None));
+
+			var gone = new RemoteActor(_harness.Peer, "gone");
+			_harness.Peer.Answer(new Uri(gone.Id).AbsolutePath, 410);
+			var delete = new JsonObject { ["id"] = gone.Id + "#delete", ["type"] = "Delete", ["actor"] = gone.Id, ["object"] = gone.Id };
+			var deleted = Last(await _harness.Receiver.Receive(gone.Post(Harness.Host, "/human-centipede", delete), default, CancellationToken.None));
+
+			Assert.Equal((404, "unknown-recipient"), (notFound.Event.Status!.Value, notFound.Event.Reason));
+			Assert.Equal((202, "self-delete-unknown-key"), (deleted.Event.Status!.Value, deleted.Event.Reason));
+			Assert.True(deleted.Claimed);
+		}
+
+		[Fact]
+		public async Task A_suspended_server_is_recorded_under_its_own_name()
+		{
+			var blocks = new DomainBlocks(NullLogger<DomainBlocks>.Instance);
+			blocks.Load(new[] { new DomainBlock { Domain = "localhost", Severity = DomainBlockSeverity.Suspend } });
+			var ledger = new MemoryLedger();
+			var receiver = new InboxReceiver(_harness.Local, _harness.Remote, _harness.Queue, blocks, NullLogger<InboxReceiver>.Instance, ledger);
+			var (_, alice) = await _harness.Persona("alice");
+			var spammer = new RemoteActor(_harness.Peer, "spammer", _harness.Peer.B);
+
+			var result = await receiver.Receive(spammer.Post(Harness.Host, "/human-centipede", Create(spammer, alice.Uri)), default, CancellationToken.None);
+
+			Assert.Equal(202, result.StatusCode);
+			var (recorded, actorUri, claimed) = Assert.Single(ledger.Events);
+			Assert.Equal(("localhost", "suspended", "queued"), (recorded.Host, recorded.Reason, recorded.Outcome));
+			Assert.False(claimed);
+			Assert.Null(actorUri);
+		}
+	}
+}

PrivaPub.Tests/Statistics/InteractionsTests.cs

@@ -0,0 +1,105 @@
+using Microsoft.Extensions.Logging.Abstractions;
+
+using PrivaPub.Infrastructure.Statistics;
+using PrivaPub.Models.Statistics;
+using PrivaPub.Tests.Support;
+
+namespace PrivaPub.Tests.Statistics
+{
+	public class InteractionsTests
+	{
+		[Fact]
+		public void The_local_kind_is_kept_only_on_public_and_unlisted_traffic()
+		{
+			Assert.Equal("person", Interactions.Sanitize(new InteractionEvent { Audience = "public", LocalKind = "person" }).LocalKind);
+			Assert.Equal("group", Interactions.Sanitize(new InteractionEvent { Audience = "unlisted", LocalKind = "group" }).LocalKind);
+			Assert.Null(Interactions.Sanitize(new InteractionEvent { Audience = "private", LocalKind = "group" }).LocalKind);
+			Assert.Null(Interactions.Sanitize(new InteractionEvent { Audience = "none", LocalKind = "person" }).LocalKind);
+			Assert.Null(Interactions.Sanitize(new InteractionEvent { LocalKind = "person" }).LocalKind);
+			Assert.Null(Interactions.Sanitize(new InteractionEvent { Audience = "public", LocalKind = "circle" }).LocalKind);
+		}
+
+		[Fact]
+		public void Junk_becomes_other_and_hosts_are_normalised()
+		{
+			var e = Interactions.Sanitize(new InteractionEvent
+			{
+				Host = "Mastodon.Social.",
+				Channel = "sideways",
+				Activity = "https://www.w3.org/ns/activitystreams#Create",
+				Object = "Note",
+				Outcome = "Dropped!",
+				Reason = "not-addressed",
+				Audience = "everyone",
+				Inbox = "front-door",
+				Signature = "cavage:rsa-sha256",
+				Features = new() { "fep-044f", "Bad Feature", "fep-044f", "source:text/markdown" }
+			});
+
+			Assert.Equal("mastodon.social", e.Host);
+			Assert.Equal("other", e.Channel);
+			Assert.Equal("other", e.Activity);
+			Assert.Equal("Note", e.Object);
+			Assert.Equal("other", e.Outcome);
+			Assert.Equal("not-addressed", e.Reason);
+			Assert.Null(e.Audience);
+			Assert.Null(e.Inbox);
+			Assert.Equal("cavage:rsa-sha256", e.Signature);
+			Assert.Equal(new[] { "fep-044f", "other", "source:text/markdown" }, e.Features);
+			Assert.Equal("-", Interactions.Host("evil host/with path"));
+			Assert.Equal("-", Interactions.Host(default));
+			Assert.Equal("social.example", Interactions.HostOf("https://Social.Example:8443/users/x"));
+		}
+
+		[Fact]
+		public void Latencies_and_waits_fall_into_buckets()
+		{
+			Assert.Equal("le50ms", Interactions.Latency(0));
+			Assert.Equal("le250ms", Interactions.Latency(101));
+			Assert.Equal("inf", Interactions.Latency(31_000));
+			Assert.Equal("le1s", Interactions.Wait(900));
+			Assert.Equal("le60s", Interactions.Wait(59_000));
+			Assert.Equal("inf", Interactions.Wait(100_000_000));
+		}
+
+		[Fact]
+		public void An_actor_hash_is_stable_for_a_salt_and_unlinkable_across_salts()
+		{
+			var monday = new byte[32];
+			var tuesday = Enumerable.Repeat((byte)1, 32).ToArray();
+			const string actor = "https://social.example/users/alice";
+
+			var first = InteractionSalts.Hash(monday, actor);
+
+			Assert.Equal(first, InteractionSalts.Hash(monday, actor));
+			Assert.NotEqual(first, InteractionSalts.Hash(tuesday, actor));
+			Assert.NotEqual(first, InteractionSalts.Hash(monday, actor + "2"));
+			Assert.Equal(16, first.Length);
+			Assert.DoesNotContain("alice", first);
+			Assert.Null(InteractionSalts.Hash(default, actor));
+		}
+
+		[Fact]
+		public void A_full_ledger_drops_and_counts_but_never_blocks_or_throws()
+		{
+			var ledger = new InteractionLedger(new InteractionSalts(), new StaticOptions<StatisticsOptions>(new StatisticsOptions()), NullLogger<InteractionLedger>.Instance);
+
+			for (var i = 0; i < 10_005; i++)
+				ledger.Record(new InteractionEvent { Channel = Interactions.In });
+			ledger.Record(default);
+
+			Assert.Equal(5, ledger.Dropped);
+		}
+
+		[Fact]
+		public void A_disabled_ledger_records_nothing()
+		{
+			var ledger = new InteractionLedger(new InteractionSalts(), new StaticOptions<StatisticsOptions>(new StatisticsOptions { Enabled = false }), NullLogger<InteractionLedger>.Instance);
+
+			for (var i = 0; i < 10_005; i++)
+				ledger.Record(new InteractionEvent { Channel = Interactions.In });
+
+			Assert.Equal(0, ledger.Dropped);
+		}
+	}
+}

PrivaPub.Tests/Statistics/LedgerOverHttpTests.cs

@@ -0,0 +1,113 @@
+using MongoDB.Bson;
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Infrastructure.Statistics;
+using PrivaPub.Models.Statistics;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Statistics
+{
+	[Trait("Category", "Integration")]
+	public sealed class LedgerOverHttpTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+		Peer _peer;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+			_peer = await Peer.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_peer != default)
+				await _peer.DisposeAsync();
+		}
+
+		JsonObject DirectNote(RemoteActor sender, Persona persona, string text)
+		{
+			var noteId = $"{_peer.A}/notes/{Guid.NewGuid():N}";
+			var to = new JsonArray($"{PrivaPubHost.Base}/peasants/{persona.UserName}");
+			return new JsonObject
+			{
+				["id"] = noteId + "/activity",
+				["type"] = "Create",
+				["actor"] = sender.Id,
+				["to"] = to.DeepClone(),
+				["object"] = new JsonObject { ["id"] = noteId, ["type"] = "Note", ["attributedTo"] = sender.Id, ["to"] = to.DeepClone(), ["content"] = text }
+			};
+		}
+
+		async Task<List<BsonDocument>> StoredSince(DateTime since, CancellationToken token)
+		{
+			await _host.Get<InteractionLedger>().Flush(token);
+			return await DB.Default.Database().GetCollection<BsonDocument>(nameof(InteractionEvent))
+				.Find(Builders<BsonDocument>.Filter.Gte(nameof(InteractionEvent.At), since) & Builders<BsonDocument>.Filter.In(nameof(InteractionEvent.Host), new[] { "127.0.0.1", Interactions.Unknown }))
+				.ToListAsync(token);
+		}
+
+		[Fact]
+		public async Task A_delivery_and_its_refusals_are_recorded_naming_only_the_server()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var since = DateTime.UtcNow.AddSeconds(-1);
+			var persona = await _host.Persona(await _host.SignUp(), "ledger");
+			var bob = new RemoteActor(_peer, "bob");
+			using var client = _host.Client();
+
+			Assert.Equal(HttpStatusCode.Accepted, (await client.SendAsync(bob.SignedPost($"/peasants/{persona.UserName}/mouth", DirectNote(bob, persona, "psst")), token)).StatusCode);
+			var forged = bob.SignedPost("/human-centipede", DirectNote(bob, persona, "forged"));
+			forged.Headers.Remove("Signature");
+			forged.Headers.TryAddWithoutValidation("Signature", bob.SignedPost("/elsewhere", new JsonObject()).Headers.GetValues("Signature").Single());
+			Assert.Equal(HttpStatusCode.Unauthorized, (await client.SendAsync(forged, token)).StatusCode);
+			Assert.Equal(HttpStatusCode.NotFound, (await client.SendAsync(bob.SignedPost($"/peasants/nobody{Guid.NewGuid():N}"[..20] + "/mouth", DirectNote(bob, persona, "lost")), token)).StatusCode);
+
+			var stored = await StoredSince(since, token);
+			var reasons = stored.Select(e => e.GetValue(nameof(InteractionEvent.Reason), BsonNull.Value).ToString()).ToList();
+			Assert.Contains("queued", reasons);
+			Assert.Contains("signature-invalid", reasons);
+			Assert.Contains("unknown-recipient", reasons);
+			var everything = string.Join("\n", stored.Select(e => e.ToJson()));
+			Assert.DoesNotContain(persona.UserName, everything);
+			Assert.DoesNotContain(persona.Id, everything);
+			Assert.DoesNotContain(persona.Root.Id, everything);
+			Assert.DoesNotContain(bob.Name, everything);
+			Assert.DoesNotContain("/notes/", everything);
+		}
+	
+		[Fact]
+		public async Task Client_and_served_traffic_is_counted_per_day_never_per_server()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var persona = await _host.Persona(await _host.SignUp(), "served");
+			var reader = new RemoteActor(_peer, "reader");
+			var day = DateTime.UtcNow.Date;
+			await _host.Get<InteractionLedger>().Flush(token);
+			var before = await DB.Default.Find<ServerDay>().Match(d => d.Day == day).ExecuteFirstAsync(token) ?? new ServerDay();
+			using var client = _host.Client();
+
+			Assert.Equal(HttpStatusCode.OK, (await client.GetAsync("/api/v1/instance", token)).StatusCode);
+			using (var actorRequest = new HttpRequestMessage(HttpMethod.Get, $"/peasants/{persona.UserName}"))
+			{
+				actorRequest.Headers.Accept.ParseAdd("application/activity+json");
+				Assert.Equal(HttpStatusCode.OK, (await client.SendAsync(actorRequest, token)).StatusCode);
+			}
+			Assert.Equal(HttpStatusCode.OK, (await client.SendAsync(reader.SignedGet($"/peasants/{persona.UserName}/anus"), token)).StatusCode);
+			await _host.Get<InteractionLedger>().Flush(token);
+
+			var after = await DB.Default.Find<ServerDay>().Match(d => d.Day == day).ExecuteFirstAsync(token);
+			long Grew(Dictionary<string, long> now, Dictionary<string, long> then, string key) => now.GetValueOrDefault(key) - then.GetValueOrDefault(key);
+			Assert.True(Grew(after.Client, before.Client, "api/v1/instance:GET:2xx") >= 1);
+			Assert.True(Grew(after.Served, before.Served, "actor:200:unsigned") >= 1);
+			Assert.True(Grew(after.Served, before.Served, "outbox:200:signed") >= 1);
+			Assert.DoesNotContain(after.Served.Keys, k => k.Contains(persona.UserName));
+		}
+	}
+}

PrivaPub.Tests/Statistics/LedgerStoreTests.cs

@@ -0,0 +1,89 @@
+using Microsoft.Extensions.Logging.Abstractions;
+
+using MongoDB.Bson;
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Infrastructure.Statistics;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Statistics;
+using PrivaPub.Tests.Support;
+
+namespace PrivaPub.Tests.Statistics
+{
+	[Trait("Category", "Integration")]
+	public sealed class LedgerStoreTests : IAsyncLifetime
+	{
+		readonly string _known = $"known{Guid.NewGuid():N}.example";
+		readonly string _stranger = $"stranger{Guid.NewGuid():N}.example";
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			await DB.Default.SaveAsync(new RemoteInstance { Host = _known });
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		static InteractionLedger Ledger() =>
+			new(new InteractionSalts(), new StaticOptions<StatisticsOptions>(new StatisticsOptions()), NullLogger<InteractionLedger>.Instance);
+
+		[Fact]
+		public async Task Events_are_stored_with_a_hash_and_never_the_actor()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var ledger = Ledger();
+			var actor = $"https://{_known}/users/someone{Guid.NewGuid():N}";
+
+			ledger.Record(new InteractionEvent { Host = _known, Channel = Interactions.In, Activity = "Create", Object = "Note", Outcome = Interactions.Accepted }, actor);
+			ledger.Record(new InteractionEvent { Host = _stranger, Channel = Interactions.Receive, Status = 401, Outcome = Interactions.Refused, Reason = "no-signature" }, hostClaimed: true);
+			ledger.Record(new InteractionEvent { Host = _known, Channel = Interactions.Receive, Status = 401, Outcome = Interactions.Refused, Reason = "signature-invalid" }, hostClaimed: true);
+			await ledger.Flush(token);
+
+			var stored = await DB.Default.Find<InteractionEvent>().Match(e => e.Host == _known).ExecuteAsync(token);
+			Assert.Equal(2, stored.Count);
+			var accepted = Assert.Single(stored, e => e.Channel == Interactions.In);
+			Assert.NotNull(accepted.ActorHash);
+			Assert.Equal("signature-invalid", Assert.Single(stored, e => e.Channel == Interactions.Receive).Reason);
+			Assert.False(await DB.Default.Find<InteractionEvent>().Match(e => e.Host == _stranger).ExecuteAnyAsync(token));
+			var raw = await DB.Default.Database().GetCollection<BsonDocument>(nameof(InteractionEvent)).Find(new BsonDocument("_id", ObjectId.Parse(accepted.ID))).FirstAsync(token);
+			Assert.DoesNotContain("someone", raw.ToJson());
+			Assert.DoesNotContain("/users/", raw.ToJson());
+		}
+
+		[Fact]
+		public async Task Two_processes_agree_on_a_days_salt_and_no_salt_is_made_for_the_past()
+		{
+			var token = TestContext.Current.CancellationToken;
+
+			var one = await new InteractionSalts().For(DateTime.UtcNow, token);
+			var two = await new InteractionSalts().For(DateTime.UtcNow, token);
+
+			Assert.Equal(Convert.ToBase64String(one), Convert.ToBase64String(two));
+			Assert.Null(await new InteractionSalts().For(new DateTime(2001, 1, 1, 0, 0, 0, DateTimeKind.Utc), token));
+		}
+
+		[Fact]
+		public async Task Counters_add_up_per_day()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var ledger = Ledger();
+
+			ledger.Count(_known, "media:hit", 1000);
+			ledger.Count(_known, "media:hit", 500);
+			ledger.Count(_known, "media.miss");
+			ledger.CountServer(ServerSections.Client, $"test{_known}:GET:2xx", 120);
+			ledger.CountServer(ServerSections.Served, $"test{_known}:200:signed");
+			await ledger.Flush(token);
+
+			var day = await DB.Default.Find<InstanceDay>().Match(d => d.Host == _known && d.Day == DateTime.UtcNow.Date).ExecuteFirstAsync(token);
+			Assert.Equal(2, day.Reads["media:hit"]);
+			Assert.Equal(1500, day.Reads["media:hit:bytes"]);
+			Assert.Equal(1, day.Reads["media_miss"]);
+			var server = await DB.Default.Find<ServerDay>().Match(d => d.Day == DateTime.UtcNow.Date).ExecuteFirstAsync(token);
+			Assert.Equal(1, server.Client[$"test{_known.Replace('.', '_')}:GET:2xx"]);
+			Assert.Equal(1, server.Served[$"test{_known.Replace('.', '_')}:200:signed"]);
+			Assert.True(server.ClientLatency["le250ms"] >= 1);
+		}
+	}
+}

PrivaPub.Tests/Statistics/OutboundRequestTests.cs

@@ -0,0 +1,130 @@
+using Microsoft.AspNetCore.Http;
+
+using PrivaPub.Infrastructure.Http;
+using PrivaPub.Infrastructure.Statistics;
+using PrivaPub.Tests.Support;
+
+namespace PrivaPub.Tests.Statistics
+{
+	public class HttpScopeTests
+	{
+		[Fact]
+		public async Task Scopes_nest_and_restore_across_awaits()
+		{
+			Assert.Null(HttpScope.Purpose);
+			Assert.Equal("request", HttpScope.Trigger);
+
+			using (HttpScope.Triggered("deliver"))
+			{
+				using (HttpScope.Default("object"))
+				{
+					Assert.Equal("object", HttpScope.Purpose);
+					using (HttpScope.For("actor"))
+					{
+						await Task.Yield();
+						Assert.Equal("actor", HttpScope.Purpose);
+						using (HttpScope.Default("object"))
+							Assert.Equal("actor", HttpScope.Purpose);
+					}
+					Assert.Equal("object", HttpScope.Purpose);
+				}
+				Assert.Null(HttpScope.Purpose);
+				Assert.Equal("deliver", HttpScope.Trigger);
+				Assert.False(HttpScope.Crawling);
+				using (HttpScope.Crawl())
+					Assert.True(HttpScope.Crawling);
+			}
+			Assert.Equal("request", HttpScope.Trigger);
+		}
+	}
+
+	public class TrafficMeterTests
+	{
+		[Theory]
+		[InlineData("api/v1/accounts/{id}/follow", "api/v1/accounts")]
+		[InlineData("/api/v1/statuses", "api/v1/statuses")]
+		[InlineData("/oauth/token", "oauth/token")]
+		[InlineData("/clientapi/avatar/private/insert", "clientapi/avatar/private")]
+		[InlineData("api/{x}", "api")]
+		[InlineData(null, "unmatched")]
+		public void Client_routes_group_by_their_first_literal_segments(string template, string group) =>
+			Assert.Equal(group, TrafficMeter.Group(template));
+
+		[Theory]
+		[InlineData("peasants/{actor}", "/peasants/alice", "actor")]
+		[InlineData("peasants/{actor}/anus", "/peasants/alice/anus", "outbox")]
+		[InlineData("peasants/{actor}/flock", "/peasants/c/flock", "collection")]
+		[InlineData("peasants/{actor}/groupies", "/peasants/alice/groupies", "collection")]
+		[InlineData("peasants/{actor}/scribbles/{postId}", "/peasants/alice/scribbles/1", "object")]
+		[InlineData("peasants/{actor}/grunts/{activityId}", "/peasants/alice/grunts/1", "activity")]
+		[InlineData("peasants/{actor}/parrot-licences/{licenceId}", "/peasants/alice/parrot-licences/1", "licence")]
+		[InlineData("users/{actor}", "/users/alice", "actor")]
+		[InlineData(".well-known/webfinger", "/.well-known/webfinger", "webfinger")]
+		[InlineData("nodeinfo/2.1", "/nodeinfo/2.1", "nodeinfo")]
+		[InlineData("@{user}", "/@alice", null)]
+		public void Served_documents_are_counted_by_kind_never_by_name(string template, string path, string kind) =>
+			Assert.Equal(kind, TrafficMeter.Served(template, new PathString(path)));
+	}
+
+	public sealed class OutboundRequestTests : IAsyncLifetime
+	{
+		Peer _peer;
+
+		public async ValueTask InitializeAsync() => _peer = await Peer.Start();
+
+		public async ValueTask DisposeAsync() => await _peer.DisposeAsync();
+
+		[Fact]
+		public async Task A_federation_fetch_is_recorded_with_its_purpose_trigger_and_size()
+		{
+			var ledger = new MemoryLedger();
+			var http = Peer.Http(ledger: ledger);
+			_peer.Serve("/users/a", "{\"id\":\"{A}/users/a\",\"type\":\"Person\"}");
+
+			using (HttpScope.Triggered("processinbox"))
+			using (HttpScope.For("actor"))
+				Assert.NotNull(await http.GetJson($"{_peer.A}/users/a", "application/activity+json", default, TestContext.Current.CancellationToken));
+
+			var e = Assert.Single(ledger.Of("http"));
+			Assert.Equal(("127.0.0.1", "actor", "processinbox", "ok", 200), (e.Host, e.Purpose, e.Trigger, e.Outcome, e.Status!.Value));
+			Assert.True(e.Bytes > 10);
+			Assert.Equal(0, e.Redirects);
+		}
+
+		[Fact]
+		public async Task Refusals_are_recorded_and_a_second_try_is_remembered()
+		{
+			var ledger = new MemoryLedger();
+			var http = Peer.Http(ledger: ledger);
+			_peer.Answer("/gone", 410);
+			_peer.ServeText("/page", "<html></html>", "text/html");
+
+			using (HttpScope.Triggered("fetchancestors"))
+			{
+				await http.GetJson($"{_peer.A}/gone", "application/activity+json", default, TestContext.Current.CancellationToken);
+				await http.GetJson($"{_peer.A}/gone", "application/activity+json", default, TestContext.Current.CancellationToken);
+				await http.GetJson($"{_peer.A}/page", "application/activity+json", default, TestContext.Current.CancellationToken);
+				await http.GetJson("ftp://example.org/x", "application/activity+json", default, TestContext.Current.CancellationToken);
+			}
+
+			var events = ledger.Of("http");
+			Assert.Equal(new[] { ("refused", "410"), ("refused", "remembered"), ("refused", "content-type"), ("refused", "disallowed") },
+				events.Select(e => (e.Outcome, e.Reason)));
+			Assert.Equal("object", events[0].Purpose);
+		}
+
+		[Fact]
+		public async Task A_fetch_a_reader_caused_is_only_counted()
+		{
+			var ledger = new MemoryLedger();
+			var http = Peer.Http(ledger: ledger);
+			_peer.Serve("/users/b", "{\"id\":\"{A}/users/b\",\"type\":\"Person\"}");
+
+			using (HttpScope.For("webfinger"))
+				await http.GetJson($"{_peer.A}/users/b", "application/activity+json", default, TestContext.Current.CancellationToken);
+
+			Assert.Empty(ledger.Events);
+			Assert.Equal(1, ledger.Counts[("127.0.0.1", "http:webfinger:ok")]);
+		}
+	}
+}

PrivaPub.Tests/Support/Exclusive.cs

@@ -0,0 +1,7 @@
+namespace PrivaPub.Tests.Support
+{
+	[CollectionDefinition(nameof(Exclusive), DisableParallelization = true)]
+	public sealed class Exclusive
+	{
+	}
+}

PrivaPub.Tests/Support/Harness.cs

@@ -16,6 +16,7 @@ using PrivaPub.Federation.Inbox.Handlers;
 using PrivaPub.Federation.Outbox;
 using PrivaPub.Infrastructure.Jobs;
 using PrivaPub.Models;
+using PrivaPub.Federation.Objects;
 using PrivaPub.Models.Federation;
 using PrivaPub.Models.Jobs;
 using PrivaPub.Models.User;
@@ -33,6 +34,8 @@ namespace PrivaPub.Tests.Support
 		public const string Host = "privapub.test";
 		public const string Base = "https://" + Host;
 
+		readonly DateTime _started = Millisecond(DateTime.UtcNow);
+
 		Harness(Peer peer)
 		{
 			Peer = peer;
@@ -41,27 +44,37 @@ namespace PrivaPub.Tests.Support
 			Remote = new RemoteActorService(Peer.Http(cache), Local, cache, Db);
 			Delivery = new DeliveryService(Db, Queue);
 			Fanout = new Fanout(Db);
-			RemotePosts = new RemotePosts(Db, Local, Remote, new NoBlocks(), Queue);
-			Receiver = new InboxReceiver(Local, Remote, Queue, new NoBlocks(), NullLogger<InboxReceiver>.Instance);
-			Processor = new InboxProcessor(Remote, new IActivityHandler[]
+			Groups = new GroupDistributor(Delivery);
+			Records = new ObjectRecords(Queue);
+			Polls = new PollService(Db, Local, Delivery, Queue);
+			Reactions = new Reactions(Db, Delivery);
+			RemotePosts = new RemotePosts(Db, Local, Remote, new NoBlocks(), Queue, Records, new NoPreviews());
+			Outbox = new OutboxPublisher(Db, Local, Delivery);
+			Quotes = new QuoteService(Db, Remote, RemotePosts, Local, Delivery, Outbox);
+			Receiver = new InboxReceiver(Local, Remote, Queue, new NoBlocks(), NullLogger<InboxReceiver>.Instance, Ledger);
+			Handlers = new IActivityHandler[]
 			{
 				new FollowHandler(Db, Local, Remote, Delivery),
-				new AcceptHandler(Db, Local),
-				new RejectHandler(Db, Local),
-				new UndoHandler(Db, Local),
-				new LikeHandler(Db),
-				new AnnounceHandler(Db, Local, RemotePosts, Fanout),
-				new CreateHandler(Db, Local, Remote, Delivery, new NoBlocks(), Fanout, RemotePosts),
-				new DeleteHandler(Db, Local, Remote, Delivery),
-				new UpdateHandler(Db, Local, Remote),
+				new AcceptHandler(Db, Local, Quotes),
+				new RejectHandler(Db, Local, Quotes),
+				new UndoHandler(Db, Local, Reactions),
+				new LikeHandler(Db, Reactions),
+				new EmojiReactHandler(Db, Reactions),
+				new QuoteRequestHandler(Quotes),
+				new DislikeHandler(Db),
+				new JoinHandler(Db, Local, Delivery),
+				new AnnounceHandler(Db, Local, RemotePosts, Fanout, Remote, Records, Quotes),
+				new CreateHandler(Db, Local, Remote, Delivery, new NoBlocks(), Fanout, RemotePosts, Groups, Records, Polls, new NoPreviews(), Quotes),
+				new DeleteHandler(Db, Local, Remote, Delivery, Groups, Quotes),
+				new UpdateHandler(Db, Local, Remote, Groups, Records, Quotes),
 				new FlagHandler(Db, Local)
-			}, NullLogger<InboxProcessor>.Instance);
+			};
+			Processor = new InboxProcessor(Remote, Handlers, NullLogger<InboxProcessor>.Instance, Ledger);
 			Follows = new FollowService(Db, Local, Remote, Delivery, new KeyLocalizer<GenericRes>(), NullLogger<FollowService>.Instance);
 			Content = new ContentRenderer(Local, Remote);
-			Outbox = new OutboxPublisher(Db, Local, Delivery);
 			Media = new MediaService(new StaticOptions<MediaOptions>(new MediaOptions { Root = Path.Combine(Path.GetTempPath(), $"privapub-media-{Guid.NewGuid():N}") }),
 				Local, default, NullLogger<MediaService>.Instance);
-			Statuses = new StatusService(Db, Local, Remote, Delivery, Content, Outbox, Fanout, Media);
+			Statuses = new StatusService(Db, Local, Remote, Delivery, Content, Outbox, Fanout, Media, Groups, Polls, new NoPreviews(), Quotes);
 			Posts = new PostsService(Db, Local, Statuses, new KeyLocalizer<GenericRes>(), NullLogger<PostsService>.Instance);
 			Timelines = new TimelineService(Db, new KeyLocalizer<GenericRes>());
 			Relationships = new RelationshipService(Db, Follows, Delivery);
@@ -70,20 +83,27 @@ namespace PrivaPub.Tests.Support
 
 		public Peer Peer { get; }
 		public DbEntities Db { get; } = new();
+		public MemoryLedger Ledger { get; } = new();
 		public JobQueue Queue { get; } = new();
 		public LocalActorService Local { get; }
 		public RemoteActorService Remote { get; }
 		public DeliveryService Delivery { get; }
 		public InboxReceiver Receiver { get; }
 		public InboxProcessor Processor { get; }
+		public IReadOnlyList<IActivityHandler> Handlers { get; }
 		public FollowService Follows { get; }
 		public ContentRenderer Content { get; }
 		public OutboxPublisher Outbox { get; }
 		public PostsService Posts { get; }
 		public StatusService Statuses { get; }
 		public MediaService Media { get; }
+		public GroupDistributor Groups { get; }
 		public Fanout Fanout { get; }
 		public RemotePosts RemotePosts { get; }
+		public ObjectRecords Records { get; }
+		public PollService Polls { get; }
+		public Reactions Reactions { get; }
+		public QuoteService Quotes { get; }
 		public TimelineService Timelines { get; }
 		public RelationshipService Relationships { get; }
 		public ReportService Reports { get; }
@@ -121,13 +141,15 @@ namespace PrivaPub.Tests.Support
 		}
 
 		public async Task<List<JsonObject>> Outgoing(string inbox) =>
-			(await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.Deliver).ExecuteAsync())
+			(await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.Deliver && j.CreatedAt >= _started).ExecuteAsync())
 				.Select(j => JsonSerializer.Deserialize<DeliveryPayload>(j.Payload))
 				.Where(p => p.Inbox == inbox)
 				.Select(p => JsonNode.Parse(p.Body)!.AsObject())
 				.ToList();
 
 		public async ValueTask DisposeAsync() => await Peer.DisposeAsync();
+
+		static DateTime Millisecond(DateTime time) => new(time.Ticks - time.Ticks % TimeSpan.TicksPerMillisecond, DateTimeKind.Utc);
 	}
 
 	public sealed class KeyLocalizer<T> : IStringLocalizer<T>
@@ -136,4 +158,9 @@ namespace PrivaPub.Tests.Support
 		public LocalizedString this[string name, params object[] arguments] => new(name, string.Format(name, arguments));
 		public IEnumerable<LocalizedString> GetAllStrings(bool includeParentCultures) => Enumerable.Empty<LocalizedString>();
 	}
+
+	public sealed class NoPreviews : ILinkPreviews
+	{
+		public Task Wanted(PrivaPub.Models.Post.Post post, CancellationToken token) => Task.CompletedTask;
+	}
 }

PrivaPub.Tests/Support/Host/Accounts.cs

@@ -0,0 +1,117 @@
+using PrivaPub.Infrastructure.Cli;
+
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Text.Json.Nodes;
+using System.Text.RegularExpressions;
+
+namespace PrivaPub.Tests.Support.Host
+{
+	public sealed record Root(string Id, string UserName, string Password, string Jwt);
+
+	public sealed record Persona(string Id, string UserName, Root Root);
+
+	public static partial class Accounts
+	{
+		public const string Password = "Test-Pass-1!";
+		const string OutOfBand = "urn:ietf:wg:oauth:2.0:oob";
+
+		public static async Task<Root> SignUp(this PrivaPubHost host, string name = "root")
+		{
+			var userName = $"{name}{Guid.NewGuid():N}"[..24];
+			using var client = host.Client();
+			var response = await client.PostAsJsonAsync("/clientapi/user/signup", new { userName, password = Password });
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			var jwt = (await response.Content.ReadFromJsonAsync<JsonObject>())!;
+			return new Root(jwt["userId"]!.GetValue<string>(), userName, Password, jwt["token"]!.GetValue<string>());
+		}
+
+		public static async Task<Root> LogIn(this PrivaPubHost host, Root root)
+		{
+			using var client = host.Client();
+			var response = await client.PostAsJsonAsync("/clientapi/user/login", new { userName = root.UserName, password = root.Password });
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			var jwt = (await response.Content.ReadFromJsonAsync<JsonObject>())!;
+			return root with { Jwt = jwt["token"]!.GetValue<string>() };
+		}
+
+		public static async Task<Root> Admin(this PrivaPubHost host)
+		{
+			var root = await host.SignUp("admin");
+			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }));
+			return await host.LogIn(root);
+		}
+
+		public static async Task<Persona> Persona(this PrivaPubHost host, Root root, string name = "persona")
+		{
+			var userName = $"{name}{Guid.NewGuid():N}"[..20];
+			using var client = host.As(root.Jwt);
+			var response = await client.PostAsJsonAsync("/clientapi/avatar/private/insert", new { userName, name, biography = "testing" });
+			Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+			var avatar = (await response.Content.ReadFromJsonAsync<JsonObject>())!;
+			return new Persona(avatar["id"]!.GetValue<string>(), userName, root);
+		}
+
+		public static async Task<string> MastodonToken(this PrivaPubHost host, Persona persona, string scopes = "read write follow")
+		{
+			using var client = host.Client(cookies: true);
+			var app = await Form(client, "/api/v1/apps", ("client_name", "privapub-tests"), ("redirect_uris", OutOfBand), ("scopes", scopes));
+			var clientId = app["client_id"]!.GetValue<string>();
+			var clientSecret = app["client_secret"]!.GetValue<string>();
+			var query = $"client_id={Uri.EscapeDataString(clientId)}&redirect_uri={Uri.EscapeDataString(OutOfBand)}&response_type=code&scope={Uri.EscapeDataString(scopes)}";
+
+			var code = await Authorize(client, persona, query);
+			var token = await Form(client, "/oauth/token", ("grant_type", "authorization_code"), ("code", code), ("client_id", clientId),
+				("client_secret", clientSecret), ("redirect_uri", OutOfBand));
+			return token["access_token"]!.GetValue<string>();
+		}
+
+		public static async Task<string> Authorize(HttpClient client, Persona persona, string query, string decision = "allow")
+		{
+			var returnUrl = "/oauth/authorize?" + query;
+			var login = await client.GetStringAsync("/oauth/login?returnUrl=" + Uri.EscapeDataString(returnUrl));
+			var antiforgery = AntiforgeryToken().Match(login).Groups[1].Value;
+			var signedIn = await client.PostAsync("/oauth/login", new FormUrlEncodedContent(new Dictionary<string, string>
+			{
+				["returnUrl"] = returnUrl,
+				["__RequestVerificationToken"] = antiforgery,
+				["userName"] = persona.Root.UserName,
+				["password"] = persona.Root.Password
+			}));
+			Assert.Equal(HttpStatusCode.Redirect, signedIn.StatusCode);
+
+			var choose = await client.GetStringAsync(returnUrl + "&signed_in=1");
+			var fields = HiddenInput().Matches(choose).Select(m => new KeyValuePair<string, string>(m.Groups[1].Value, WebUtility.HtmlDecode(m.Groups[2].Value))).ToList();
+			fields.Add(new("avatarId", persona.Id));
+			fields.Add(new("decision", decision));
+			var answer = await client.PostAsync("/oauth/authorize", new FormUrlEncodedContent(fields));
+			var page = await answer.Content.ReadAsStringAsync();
+			return Code().Match(page) is { Success: true } match ? match.Groups[1].Value : default;
+		}
+
+		public static HttpClient As(this PrivaPubHost host, string bearer)
+		{
+			var client = host.Client();
+			client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
+			return client;
+		}
+
+		static async Task<JsonObject> Form(HttpClient client, string path, params (string Key, string Value)[] fields)
+		{
+			var response = await client.PostAsync(path, new FormUrlEncodedContent(fields.Select(f => new KeyValuePair<string, string>(f.Key, f.Value))));
+			var body = await response.Content.ReadAsStringAsync();
+			Assert.True(response.IsSuccessStatusCode, $"{path} answered {(int)response.StatusCode}: {body}");
+			return JsonNode.Parse(body)!.AsObject();
+		}
+
+		[GeneratedRegex("name=\"__RequestVerificationToken\" type=\"hidden\" value=\"([^\"]*)\"")]
+		private static partial Regex AntiforgeryToken();
+
+		[GeneratedRegex("<input type=\"hidden\" name=\"([^\"]*)\" value=\"([^\"]*)\"")]
+		private static partial Regex HiddenInput();
+
+		[GeneratedRegex("<code>([^<]*)</code>")]
+		private static partial Regex Code();
+	}
+}

PrivaPub.Tests/Support/Host/Jobs.cs

@@ -0,0 +1,64 @@
+using Microsoft.Extensions.DependencyInjection;
+
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Jobs;
+
+using System.Linq.Expressions;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Support.Host
+{
+	public static class Jobs
+	{
+		public static async Task<int> Run(this PrivaPubHost host, Expression<Func<Job, bool>> which, CancellationToken token = default)
+		{
+			var handlers = host.Services.GetServices<IJobHandler>().ToDictionary(h => h.Kind);
+			var queue = host.Get<IJobQueue>();
+			var ran = 0;
+			for (var round = 0; round < 50; round++)
+			{
+				var pending = await DB.Default.Find<Job>().Match(which).Match(j => j.State == JobState.Pending).ExecuteAsync(token);
+				if (pending.Count == 0)
+					return ran;
+				foreach (var candidate in pending)
+				{
+					var job = await DB.Default.UpdateAndGet<Job>()
+						.Match(j => j.ID == candidate.ID && j.State == JobState.Pending)
+						.Modify(j => j.State, JobState.Running)
+						.Modify(j => j.LeasedUntil, DateTime.UtcNow + JobQueue.LeaseTime)
+						.Modify(b => b.Inc(j => j.Attempts, 1))
+						.ExecuteAsync(token);
+					if (job == default)
+						continue;
+					var handler = handlers[job.Kind];
+					JobOutcome outcome;
+					try
+					{
+						outcome = await handler.Handle(job, token);
+					}
+					catch (Exception ex)
+					{
+						outcome = JobOutcome.Dead(ex.GetType().Name + ": " + ex.Message);
+					}
+					await queue.Finish(job, outcome, handler.MaxAttempts, token);
+					ran++;
+				}
+			}
+			return ran;
+		}
+
+		public static Task<int> RunInbox(this PrivaPubHost host, string activityId, CancellationToken token = default) =>
+			host.Run(j => j.Kind == JobKind.ProcessInbox && j.DedupeKey == "inbox|" + activityId, token);
+
+		public static async Task<List<JsonObject>> Deliveries(string inbox, DateTime since, CancellationToken token = default) =>
+			(await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.Deliver && j.CreatedAt >= since).ExecuteAsync(token))
+				.Select(j => JsonSerializer.Deserialize<DeliveryPayload>(j.Payload))
+				.Where(p => p.Inbox == inbox)
+				.Select(p => JsonNode.Parse(p.Body)!.AsObject())
+				.ToList();
+	}
+}

PrivaPub.Tests/Support/Host/PrivaPubHost.cs

@@ -0,0 +1,160 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.DataProtection;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+
+using PrivaPub.Api.Mastodon.Auth;
+using PrivaPub.Domain.Media;
+using PrivaPub.Infrastructure.Jobs;
+
+using System.Net;
+
+namespace PrivaPub.Tests.Support.Host
+{
+	public class PrivaPubHost : WebApplicationFactory<Program>
+	{
+		public const string Host = "privapub.test";
+		public const string Base = "https://" + Host;
+		public const string ClientHeader = "X-Test-Client";
+
+		static readonly SemaphoreSlim Boot = new(1, 1);
+		static readonly Type[] Unwanted = { typeof(JobWorker), typeof(MediaJanitor), typeof(OAuthPruner) };
+		static PrivaPubHost _shared;
+
+		readonly string _mediaRoot = Path.Combine(Path.GetTempPath(), $"privapub-tests-{Guid.NewGuid():N}");
+
+		public IReadOnlyList<ServiceDescriptor> Registered { get; private set; }
+
+		public static async Task<PrivaPubHost> Shared()
+		{
+			await Boot.WaitAsync();
+			try
+			{
+				if (_shared == default)
+				{
+					var host = new PrivaPubHost();
+					_ = host.Services;
+					_shared = host;
+				}
+				return _shared;
+			}
+			finally
+			{
+				Boot.Release();
+			}
+		}
+
+		protected virtual IEnumerable<KeyValuePair<string, string>> Settings() => new Dictionary<string, string>
+		{
+			["MongoSettings:ConnectionString"] = MongoFixture.Connection,
+			["MongoSettings:Database"] = MongoFixture.Database,
+			["MongoSettings:LogsDatabase"] = "logs",
+			["AppConfiguration:Version"] = "0.0.0-test",
+			["AppConfiguration:BackendBaseAddress"] = Base,
+			["AppConfiguration:MaxAllowedUploadFiles"] = "3",
+			["AppConfiguration:MaxAllowedFileSize"] = "2097152",
+			["AppConfiguration:SupportedLanguages:0"] = "en",
+			["AppConfiguration:SupportedLanguages:1"] = "it",
+			["AppConfiguration:HashingOptions:Iterations"] = "1000",
+			["AppConfiguration:Jwt:Key"] = "privapub-tests-only-signing-key-0123456789abcdef0123456789abcdef",
+			["AppConfiguration:Jwt:Issuer"] = Base,
+			["AppConfiguration:Jwt:Audience"] = Base,
+			["AppConfiguration:Jwt:HoursTimeout"] = "1",
+			["AppConfiguration:EmailConfiguration:SmtpServer"] = "127.0.0.1",
+			["AppConfiguration:EmailConfiguration:SmtpPort"] = "9",
+			["AppConfiguration:EmailConfiguration:UseSSL"] = "false",
+			["AppConfiguration:EmailConfiguration:SmtpUsername"] = "nobody@privapub.test",
+			["AppConfiguration:EmailConfiguration:SmtpPassword"] = "none",
+			["Federation:AllowPrivateNetworks"] = "true",
+			["Federation:AllowPlainHttp"] = "true",
+			["Federation:FetchLinkPreviews"] = "false",
+			["Media:Root"] = _mediaRoot,
+			["Logging:LogLevel:Default"] = "Warning",
+			["Serilog:MinimumLevel:Default"] = Environment.GetEnvironmentVariable("PRIVAPUB_TEST_LOGS") == "1" ? "Information" : "Fatal"
+		};
+
+		protected override void ConfigureWebHost(IWebHostBuilder builder)
+		{
+			builder.UseEnvironment("Testing");
+			foreach (var (key, value) in Settings())
+				builder.UseSetting(key, value);
+			builder.ConfigureTestServices(services =>
+			{
+				foreach (var hosted in services.Where(s => s.ServiceType == typeof(IHostedService) && Unwanted.Contains(s.ImplementationType)).ToList())
+					services.Remove(hosted);
+				services.AddDataProtection().UseEphemeralDataProtectionProvider();
+				services.AddSingleton<IStartupFilter, ClientAddressFilter>();
+				Registered = services.ToList();
+			});
+		}
+
+		protected override void ConfigureClient(HttpClient client)
+		{
+			client.BaseAddress = new Uri(Base + "/");
+			client.DefaultRequestHeaders.Add(ClientHeader, $"10.{Random.Shared.Next(256)}.{Random.Shared.Next(256)}.{Random.Shared.Next(1, 255)}");
+		}
+
+		public HttpClient Client(bool cookies = false) => CreateClient(new WebApplicationFactoryClientOptions
+		{
+			BaseAddress = new Uri(Base + "/"),
+			AllowAutoRedirect = false,
+			HandleCookies = cookies
+		});
+
+		public T Get<T>() where T : notnull => Services.GetRequiredService<T>();
+
+		protected override void Dispose(bool disposing)
+		{
+			base.Dispose(disposing);
+			if (disposing && Directory.Exists(_mediaRoot))
+				Directory.Delete(_mediaRoot, recursive: true);
+		}
+
+		sealed class ClientAddressFilter : IStartupFilter
+		{
+			public Action<IApplicationBuilder> Configure(Action<IApplicationBuilder> next) => app =>
+			{
+				app.Use(async (context, call) =>
+				{
+					if (IPAddress.TryParse(context.Request.Headers[ClientHeader].ToString(), out var address))
+						context.Connection.RemoteIpAddress = address;
+					await call(context);
+				});
+				next(app);
+			};
+		}
+	}
+
+	public sealed class SecureModeHost : PrivaPubHost
+	{
+		static readonly SemaphoreSlim Boot = new(1, 1);
+		static SecureModeHost _shared;
+
+		public static new async Task<SecureModeHost> Shared()
+		{
+			await PrivaPubHost.Shared();
+			await Boot.WaitAsync();
+			try
+			{
+				if (_shared == default)
+				{
+					var host = new SecureModeHost();
+					_ = host.Services;
+					_shared = host;
+				}
+				return _shared;
+			}
+			finally
+			{
+				Boot.Release();
+			}
+		}
+
+		protected override IEnumerable<KeyValuePair<string, string>> Settings() =>
+			base.Settings().Append(new KeyValuePair<string, string>("Federation:SecureMode", "true"));
+	}
+}

PrivaPub.Tests/Support/MemoryLedger.cs

@@ -0,0 +1,27 @@
+using PrivaPub.Infrastructure.Statistics;
+using PrivaPub.Models.Statistics;
+
+using System.Collections.Concurrent;
+
+namespace PrivaPub.Tests.Support
+{
+	public sealed class MemoryLedger : IInteractionLedger
+	{
+		public ConcurrentQueue<(InteractionEvent Event, string ActorUri, bool HostClaimed)> Events { get; } = new();
+		public ConcurrentDictionary<(string Host, string Key), long> Counts { get; } = new();
+		public ConcurrentDictionary<(string Section, string Key), long> ServerCounts { get; } = new();
+
+		public long Dropped => 0;
+
+		public void Record(InteractionEvent interaction, string actorUri = default, bool hostClaimed = false) =>
+			Events.Enqueue((Interactions.Sanitize(interaction), actorUri, hostClaimed));
+
+		public void Count(string host, string key, long bytes = 0) =>
+			Counts.AddOrUpdate((Interactions.Host(host), key), 1, (_, count) => count + 1);
+
+		public void CountServer(string section, string key, int? latencyMs = default) =>
+			ServerCounts.AddOrUpdate((section, key), 1, (_, count) => count + 1);
+
+		public IReadOnlyList<InteractionEvent> Of(string channel) => Events.Select(e => e.Event).Where(e => e.Channel == channel).ToList();
+	}
+}

PrivaPub.Tests/Support/MongoFixture.cs

@@ -13,15 +13,24 @@ namespace PrivaPub.Tests.Support
 	public sealed class MongoFixture : IAsyncLifetime
 	{
 		public const string Skip = "set PRIVAPUB_TEST_MONGOD=1 (and optionally PRIVAPUB_TEST_MONGO) to run the tests that need a mongod";
+		const int ProductionPort = 27022;
+		const int DefaultPort = 27017;
 
 		public static bool Enabled => Environment.GetEnvironmentVariable("PRIVAPUB_TEST_MONGOD") == "1";
+		static bool Required => Environment.GetEnvironmentVariable("PRIVAPUB_TEST_REQUIRE_MONGOD") == "1";
+		static bool InCi => !string.IsNullOrEmpty(Environment.GetEnvironmentVariable("CI")) || !string.IsNullOrEmpty(Environment.GetEnvironmentVariable("GITEA_ACTIONS"));
 
-		public string Database { get; } = $"PrivaPubTests_{Guid.NewGuid():N}";
+		public static string Connection { get; } = Environment.GetEnvironmentVariable("PRIVAPUB_TEST_MONGO") ?? $"mongodb://127.0.0.1:{DefaultPort}";
+		public static string Database { get; } = $"PrivaPubTests_{Guid.NewGuid():N}";
 
 		public async ValueTask InitializeAsync()
 		{
+			if (Required && !Enabled)
+				throw new InvalidOperationException("PRIVAPUB_TEST_REQUIRE_MONGOD=1 but PRIVAPUB_TEST_MONGOD is not 1: the integration tests would be skipped");
 			if (!Enabled)
 				return;
+			var settings = MongoClientSettings.FromConnectionString(Connection);
+			Refuse(settings);
 			try
 			{
 				BsonSerializer.RegisterSerializer(new GuidSerializer(GuidRepresentation.Standard));
@@ -29,9 +38,10 @@ namespace PrivaPub.Tests.Support
 			catch (BsonSerializationException)
 			{
 			}
-			var connection = Environment.GetEnvironmentVariable("PRIVAPUB_TEST_MONGO") ?? "mongodb://127.0.0.1:27017";
-			await DB.InitAsync(Database, MongoClientSettings.FromConnectionString(connection));
+			await DB.InitAsync(Database, settings);
+			await RefuseProductionData();
 			EntityMaps.Warm();
+			await DB.Default.MigrateAsync<Program>();
 			await Indexes.Create();
 		}
 
@@ -40,5 +50,32 @@ namespace PrivaPub.Tests.Support
 			if (Enabled)
 				await DB.Default.Database().Client.DropDatabaseAsync(Database);
 		}
+
+		static void Refuse(MongoClientSettings settings)
+		{
+			var ports = settings.Servers.Select(s => s.Port).ToList();
+			if (ports.Contains(ProductionPort))
+				throw new InvalidOperationException($"the tests never run against port {ProductionPort}: that is production's mongod");
+			if (InCi && (Environment.GetEnvironmentVariable("PRIVAPUB_TEST_MONGO") == default || ports.Contains(DefaultPort)))
+				throw new InvalidOperationException("in CI the tests run only against a throwaway mongod: use tools/ci/with-test-mongod.sh");
+		}
+
+		static async Task RefuseProductionData()
+		{
+			BsonDocument options;
+			try
+			{
+				options = await DB.Default.Database().Client.GetDatabase("admin").RunCommandAsync<BsonDocument>(new BsonDocument("getCmdLineOpts", 1));
+			}
+			catch (MongoCommandException)
+			{
+				return;
+			}
+			var dbPath = options.GetValue("parsed", new BsonDocument()).AsBsonDocument
+				.GetValue("storage", new BsonDocument()).AsBsonDocument
+				.GetValue("dbPath", BsonNull.Value);
+			if (dbPath.IsString && dbPath.AsString.StartsWith("/var/lib/privapub", StringComparison.Ordinal))
+				throw new InvalidOperationException($"the mongod at {Connection} keeps its data in {dbPath.AsString}: that is production's");
+		}
 	}
 }

PrivaPub.Tests/Support/Peer.cs

@@ -8,6 +8,7 @@ using Microsoft.Extensions.Options;
 
 using PrivaPub.Federation.Moderation;
 using PrivaPub.Infrastructure.Http;
+using PrivaPub.Infrastructure.Statistics;
 using PrivaPub.Models.Federation;
 
 using System.Collections.Concurrent;
@@ -17,7 +18,7 @@ namespace PrivaPub.Tests.Support
 	public sealed class Peer : IAsyncDisposable
 	{
 		readonly WebApplication _app;
-		readonly ConcurrentDictionary<string, string> _documents = new();
+		readonly ConcurrentDictionary<string, (string Text, string ContentType)> _documents = new();
 		readonly ConcurrentDictionary<string, (int Status, TimeSpan Delay)> _answers = new();
 		readonly ConcurrentDictionary<string, (byte[] Bytes, string ContentType)> _files = new();
 
@@ -40,12 +41,15 @@ namespace PrivaPub.Tests.Support
 			Peer peer = default;
 			app.Run(async context =>
 			{
-				peer.Requests.Enqueue(new(context.Request.Method, context.Request.Path, context.Request.Headers["Signature"].ToString()));
+				var body = context.Request.ContentLength > 0 || context.Request.Headers.TransferEncoding.Count > 0
+					? await new StreamReader(context.Request.Body).ReadToEndAsync()
+					: default;
+				peer.Requests.Enqueue(new(context.Request.Method, context.Request.Path, context.Request.Headers["Signature"].ToString(), body,
+					context.Request.Headers.ToDictionary(h => h.Key, h => h.Value.ToString(), StringComparer.OrdinalIgnoreCase)));
 				var key = context.Request.Path.Value;
 				if (peer._files.TryGetValue(key, out var file))
 				{
-					context.Response.ContentType = file.ContentType;
-					await context.Response.Body.WriteAsync(file.Bytes);
+					await Results.Bytes(file.Bytes, file.ContentType, enableRangeProcessing: true).ExecuteAsync(context);
 					return;
 				}
 				if (peer._answers.TryGetValue(key, out var answer))
@@ -60,21 +64,23 @@ namespace PrivaPub.Tests.Support
 					context.Response.StatusCode = StatusCodes.Status404NotFound;
 					return;
 				}
-				context.Response.ContentType = "application/activity+json";
-				await context.Response.WriteAsync(document.Replace("{A}", peer.A).Replace("{B}", peer.B));
+				context.Response.ContentType = document.ContentType;
+				await context.Response.WriteAsync(document.Text.Replace("{A}", peer.A).Replace("{B}", peer.B));
 			});
 			await app.StartAsync();
 			peer = new Peer(app, new Uri(app.Urls.First()).Port);
 			return peer;
 		}
 
-		public void Serve(string path, string json) => _documents[path] = json;
+		public void Serve(string path, string json) => _documents[path] = (json, "application/activity+json");
+
+		public void ServeText(string path, string text, string contentType) => _documents[path] = (text, contentType);
 
 		public void ServeFile(string path, byte[] bytes, string contentType) => _files[path] = (bytes, contentType);
 
 		public void Answer(string path, int status, TimeSpan delay = default) => _answers[path] = (status, delay);
 
-		public static FederationHttp Http(IMemoryCache cache = default, IDomainBlocks blocks = default)
+		public static FederationHttp Http(IMemoryCache cache = default, IDomainBlocks blocks = default, IInteractionLedger ledger = default)
 		{
 			var options = new FederationOptions { AllowPrivateNetworks = true, AllowPlainHttp = true };
 			var services = new ServiceCollection();
@@ -82,7 +88,7 @@ namespace PrivaPub.Tests.Support
 				.ConfigurePrimaryHttpMessageHandler(() => SafeHttpHandlerFactory.Create(options));
 			return new FederationHttp(services.BuildServiceProvider().GetRequiredService<IHttpClientFactory>(),
 				cache ?? new MemoryCache(new MemoryCacheOptions()), new StaticOptions<FederationOptions>(options),
-				blocks ?? new NoBlocks(), NullLogger<FederationHttp>.Instance);
+				blocks ?? new NoBlocks(), NullLogger<FederationHttp>.Instance, ledger);
 		}
 
 		public async ValueTask DisposeAsync() => await _app.DisposeAsync();
@@ -95,7 +101,8 @@ namespace PrivaPub.Tests.Support
 		public Task Reload(CancellationToken token) => Task.CompletedTask;
 	}
 
-	public sealed record HttpRequestRecord(string Method, string Path, string Signature);
+	public sealed record HttpRequestRecord(string Method, string Path, string Signature, string Body = default,
+		IReadOnlyDictionary<string, string> Headers = default);
 
 	public sealed class StaticOptions<T> : IOptionsMonitor<T>
 	{

PrivaPub.Tests/Support/RemoteActor.cs

@@ -14,13 +14,16 @@ namespace PrivaPub.Tests.Support
 	{
 		readonly RSA _key = RSA.Create(2048);
 
-		public RemoteActor(Peer peer, string name, string origin = default)
+		public RemoteActor(Peer peer, string name, string origin = default, string type = "Person")
 		{
 			Name = $"{name}{Guid.NewGuid():N}"[..20];
 			Id = $"{origin ?? peer.A}/users/{Name}";
+			Type = type;
 			peer.Serve($"/users/{Name}", Document().ToJsonString());
 		}
 
+		public string Type { get; }
+
 		public string Name { get; }
 		public string Id { get; }
 		public string KeyId => Id + "#main-key";
@@ -29,7 +32,7 @@ namespace PrivaPub.Tests.Support
 		public JsonObject Document() => new()
 		{
 			["id"] = Id,
-			["type"] = "Person",
+			["type"] = Type,
 			["preferredUsername"] = Name,
 			["inbox"] = Id + "/inbox",
 			["followers"] = Id + "/followers",
@@ -41,14 +44,54 @@ namespace PrivaPub.Tests.Support
 			}
 		};
 
+		public HttpRequestMessage SignedGet(string path, string host = "privapub.test")
+		{
+			var date = DateTimeOffset.UtcNow.ToString("r", CultureInfo.InvariantCulture);
+			var request = new HttpRequestMessage(HttpMethod.Get, path);
+			request.Headers.TryAddWithoutValidation("Date", date);
+			request.Headers.TryAddWithoutValidation("Accept", "application/activity+json");
+			request.Headers.TryAddWithoutValidation("Signature", Signature($"(request-target): get {path}\nhost: {host}\ndate: {date}", "(request-target) host date"));
+			return request;
+		}
+
+		public HttpRequestMessage SignedPost(string path, JsonNode activity, string host = "privapub.test", string date = default)
+		{
+			var body = Encoding.UTF8.GetBytes(activity.ToJsonString());
+			date ??= DateTimeOffset.UtcNow.ToString("r", CultureInfo.InvariantCulture);
+			var digest = HttpSignatures.Digest(body);
+			var request = new HttpRequestMessage(HttpMethod.Post, path) { Content = new ByteArrayContent(body) };
+			request.Content.Headers.TryAddWithoutValidation("Content-Type", "application/activity+json");
+			request.Headers.TryAddWithoutValidation("Date", date);
+			request.Headers.TryAddWithoutValidation("Digest", digest);
+			request.Headers.TryAddWithoutValidation("Signature",
+				Signature($"(request-target): post {path}\nhost: {host}\ndate: {date}\ndigest: {digest}", "(request-target) host date digest"));
+			return request;
+		}
+
+		string Signature(string signingString, string headers)
+		{
+			var signature = Convert.ToBase64String(_key.SignData(Encoding.UTF8.GetBytes(signingString), HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1));
+			return $"keyId=\"{KeyId}\",algorithm=\"rsa-sha256\",headers=\"{headers}\",signature=\"{signature}\"";
+		}
+
+		public HttpRequest Get(string host, string path)
+		{
+			var date = DateTimeOffset.UtcNow.ToString("r", CultureInfo.InvariantCulture);
+			var context = new DefaultHttpContext();
+			context.Request.Method = "GET";
+			context.Request.Host = new HostString(host);
+			context.Request.Path = path;
+			context.Features.Get<IHttpRequestFeature>().RawTarget = path;
+			context.Request.Headers["Date"] = date;
+			context.Request.Headers["Signature"] = Signature($"(request-target): get {path}\nhost: {host}\ndate: {date}", "(request-target) host date");
+			return context.Request;
+		}
+
 		public HttpRequest Post(string host, string path, JsonNode activity)
 		{
 			var body = Encoding.UTF8.GetBytes(activity.ToJsonString());
 			var date = DateTimeOffset.UtcNow.ToString("r", CultureInfo.InvariantCulture);
 			var digest = HttpSignatures.Digest(body);
-			var signingString = $"(request-target): post {path}\nhost: {host}\ndate: {date}\ndigest: {digest}";
-			var signature = Convert.ToBase64String(_key.SignData(Encoding.UTF8.GetBytes(signingString), HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1));
-
 			var context = new DefaultHttpContext();
 			context.Request.Method = "POST";
 			context.Request.Host = new HostString(host);
@@ -57,7 +100,7 @@ namespace PrivaPub.Tests.Support
 			context.Request.Headers["Date"] = date;
 			context.Request.Headers["Digest"] = digest;
 			context.Request.Headers["Content-Type"] = "application/activity+json";
-			context.Request.Headers["Signature"] = $"keyId=\"{KeyId}\",algorithm=\"rsa-sha256\",headers=\"(request-target) host date digest\",signature=\"{signature}\"";
+			context.Request.Headers["Signature"] = Signature($"(request-target): post {path}\nhost: {host}\ndate: {date}\ndigest: {digest}", "(request-target) host date digest");
 			context.Request.Body = new MemoryStream(body);
 			context.Request.ContentLength = body.Length;
 			return context.Request;

PrivaPub/Api/Mastodon/Controllers/AccountsController.cs

@@ -79,6 +79,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				avatar.Settings.DefaultSensitive = sensitive;
 			if (Params.Has("source[language]"))
 				avatar.Settings.DefaultLanguage = Params.Get("source[language]");
+			if (Params.Get("source[quote_policy]") is { } quotePolicy && QuotePolicies.IsKnown(quotePolicy))
+				avatar.Settings.QuotePolicy = quotePolicy;
 			var fields = new Dictionary<string, string>();
 			for (var i = 0; i < 4; i++)
 			{
@@ -114,7 +116,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			if (parts.Length == 1 || parts[1].Equals(localDomain, StringComparison.OrdinalIgnoreCase))
 			{
 				var local = await _localActors.FindByUserName(parts[0], token);
-				return local is { IsFederated: true, Kind: not LocalActorKind.Application } ? Json(await _mapper.Local(local, false, token)) : NotFoundError();
+				return local is { IsFederated: true, IsCircle: false, Kind: not LocalActorKind.Application } ? Json(await _mapper.Local(local, false, token)) : NotFoundError();
 			}
 			var userName = parts[0];
 			var domain = parts[1].ToLowerInvariant();
@@ -365,7 +367,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			if (avatar is { DeletionAt: null })
 				return (_localActors.FromAvatar(avatar), default);
 			var group = await _dbEntities.Groups.MatchID(id).ExecuteFirstAsync(token);
-			if (group is { DeletionAt: null } && _localActors.FromGroup(group) is { IsFederated: true } community)
+			if (group is { DeletionAt: null } && _localActors.FromGroup(group) is { IsFederated: true, IsCircle: false } community)
 				return (community, default);
 			return (default, await _dbEntities.ForeignAvatars.MatchID(id).ExecuteFirstAsync(token));
 		}

PrivaPub/Api/Mastodon/Controllers/InstanceController.cs

@@ -73,6 +73,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			domain = Domain,
 			title = "PrivaPub",
 			version = Version,
+			api_versions = new { mastodon = 7 },
 			source_url = "https://git.thepra.dev/thepra/SocialPub",
 			description = Description,
 			usage = new { users = new { active_month = 0 } },

PrivaPub/Api/Mastodon/Controllers/MediaController.cs

@@ -1,3 +1,4 @@
+using PrivaPub.Infrastructure.Statistics;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
@@ -18,10 +19,13 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		readonly IMediaService _media;
 		readonly IMediaProxy _proxy;
 
-		public MediaController(IMediaService media, IMediaProxy proxy)
+		readonly IInteractionLedger _ledger;
+
+		public MediaController(IMediaService media, IMediaProxy proxy, IInteractionLedger ledger = default)
 		{
 			_media = media;
 			_proxy = proxy;
+			_ledger = ledger;
 		}
 
 		[HttpPost("/api/v1/media"), HttpPost("/api/v2/media"), Scope("write:media"), RequestSizeLimit(UploadLimit),
@@ -60,13 +64,41 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		[HttpGet("/media/proxy/{signature}/{encoded}"), AllowAnonymous, ApiExplorerSettings(IgnoreApi = true)]
 		public async Task<IActionResult> Proxy(string signature, string encoded, CancellationToken token)
 		{
-			var (path, contentType) = await _proxy.Fetch(signature, encoded, token);
-			if (path == default)
+			var url = _proxy.Verified(signature, encoded);
+			if (url == default)
 				return NotFound();
 			Response.Headers["X-Content-Type-Options"] = "nosniff";
 			Response.Headers["Content-Security-Policy"] = "default-src 'none'; sandbox";
 			Response.Headers["Cache-Control"] = "public, max-age=604800";
-			return PhysicalFile(path, contentType);
+			if (_proxy.Cached(url) is { Path: not null } cached)
+			{
+				_ledger?.Count(Interactions.HostOf(url), "media:hit");
+				return PhysicalFile(cached.Path, cached.ContentType, enableRangeProcessing: true);
+			}
+			if (Request.Headers.Range.Count == 0)
+			{
+				var (path, contentType) = await _proxy.Fetch(signature, encoded, token);
+				if (path != default)
+					return PhysicalFile(path, contentType, enableRangeProcessing: true);
+			}
+			return await Stream(url, token);
+		}
+
+		async Task<IActionResult> Stream(string url, CancellationToken token)
+		{
+			var range = System.Net.Http.Headers.RangeHeaderValue.TryParse(Request.Headers.Range.ToString(), out var asked) ? asked : default;
+			using var upstream = await _proxy.Open(url, range, token);
+			if (upstream == default)
+				return NotFound();
+			Response.StatusCode = (int)upstream.StatusCode;
+			Response.ContentType = upstream.Content.Headers.ContentType?.ToString() ?? "application/octet-stream";
+			if (upstream.Content.Headers.ContentLength is { } length)
+				Response.ContentLength = length;
+			if (upstream.Content.Headers.ContentRange is { } contentRange)
+				Response.Headers.ContentRange = contentRange.ToString();
+			Response.Headers.AcceptRanges = "bytes";
+			await upstream.Content.CopyToAsync(Response.Body, token);
+			return new EmptyResult();
 		}
 
 		object View(MediaAttachment attachment) => new

PrivaPub/Api/Mastodon/Controllers/PollsController.cs

@@ -0,0 +1,54 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+using PrivaPub.Api.Mastodon.Infrastructure;
+using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Domain.Privacy;
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Models.Post;
+using PrivaPub.StaticServices;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Api.Mastodon.Controllers
+{
+	public class PollsController : MastodonController
+	{
+		readonly DbEntities _dbEntities;
+		readonly MastodonMapper _mapper;
+		readonly IPollService _polls;
+
+		public PollsController(DbEntities dbEntities, MastodonMapper mapper, IPollService polls)
+		{
+			_dbEntities = dbEntities;
+			_mapper = mapper;
+			_polls = polls;
+		}
+
+		[HttpGet("/api/v1/polls/{id}"), Scope("read:statuses", requiresUser: false), AllowAnonymous]
+		public async Task<IActionResult> Get(string id, CancellationToken token)
+		{
+			var post = await Visible(id, token);
+			return post?.Poll == default ? NotFoundError() : Json(_mapper.Poll(post, MyId, await _polls.OwnVotes(post.ID, MyId, token)));
+		}
+
+		[HttpPost("/api/v1/polls/{id}/votes"), Scope("write:statuses")]
+		public async Task<IActionResult> Vote(string id, CancellationToken token)
+		{
+			var post = await Visible(id, token);
+			if (post?.Poll == default)
+				return NotFoundError();
+			var choices = Params.List("choices").Select(c => int.TryParse(c, out var index) ? index : -1).ToList();
+			var outcome = await _polls.Vote(Me, post, choices, token);
+			if (!outcome.Ok)
+				return Error(outcome.Status, outcome.Error);
+			return Json(_mapper.Poll(outcome.Post, MyId, await _polls.OwnVotes(post.ID, MyId, token)));
+		}
+
+		async Task<PostEntity> Visible(string id, CancellationToken token)
+		{
+			var post = await _dbEntities.Posts.Match(p => p.ID == id && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			return post != default && post.Visibility != PostVisibility.LocalGeo && await VisibilityPolicy.CanSee(post, MyId, token) ? post : default;
+		}
+	}
+}

PrivaPub/Api/Mastodon/Controllers/ProvenanceController.cs

@@ -0,0 +1,183 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+using MongoDB.Entities;
+
+using PrivaPub.Api.Mastodon.Infrastructure;
+using PrivaPub.Domain.Privacy;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Api.Mastodon.Controllers
+{
+	public class ProvenanceController : MastodonController
+	{
+		readonly DbEntities _dbEntities;
+
+		public ProvenanceController(DbEntities dbEntities) => _dbEntities = dbEntities;
+
+		[HttpGet("/api/privapub/v1/statuses/{id}/provenance"), Scope("read:statuses", requiresUser: false), AllowAnonymous]
+		public async Task<IActionResult> Status(string id, CancellationToken token)
+		{
+			var post = await _dbEntities.Posts.Match(p => p.ID == id && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			if (post?.ReblogOfPostId != default)
+				post = await _dbEntities.Posts.Match(p => p.ID == post.ReblogOfPostId && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			if (post == default || post.Visibility == PostVisibility.LocalGeo || !await VisibilityPolicy.CanSee(post, MyId, token))
+				return NotFoundError();
+			if (!post.IsFederatedCopy)
+				return Json(new Provenance { ObjectUri = post.ObjectURI, Url = post.Url, Path = "local" });
+
+			var record = await DB.Default.Find<ObjectRecord>().Match(r => r.PostId == post.ID).ExecuteFirstAsync(token)
+				?? await DB.Default.Find<ObjectRecord>().Match(r => r.ObjectURI == post.ObjectURI).ExecuteFirstAsync(token);
+			var host = record?.Host ?? (Uri.TryCreate(post.ObjectURI, UriKind.Absolute, out var uri) ? uri.Host.ToLowerInvariant() : default);
+			var instance = host == default ? default : await DB.Default.Find<RemoteInstance>().Match(i => i.Host == host).ExecuteFirstAsync(token);
+			return Json(Describe(post, record, instance));
+		}
+
+		[HttpGet("/api/privapub/v1/instances/{host}"), Scope("read", requiresUser: false), AllowAnonymous]
+		public async Task<IActionResult> Instance(string host, CancellationToken token)
+		{
+			host = host?.Trim().ToLowerInvariant();
+			var instance = await DB.Default.Find<RemoteInstance>().Match(i => i.Host == host).ExecuteFirstAsync(token);
+			return instance == default ? NotFoundError() : Json(Describe(instance));
+		}
+
+		static Provenance Describe(PostEntity post, ObjectRecord record, RemoteInstance instance)
+		{
+			var raw = record?.Raw == default ? default : JsonNode.Parse(record.Raw) as JsonObject;
+			return new Provenance
+			{
+				ObjectUri = post.ObjectURI,
+				ObjectType = record?.ObjectType ?? post.ObjectType,
+				Url = post.Url,
+				Path = record == default ? "unrecorded" : record.Path == ObjectPath.Delivered ? "delivered" : "fetched",
+				Refetched = record?.Refetched == true,
+				Activity = record?.ActivityId == default ? default : new ProvenanceActivity
+				{
+					Id = record.ActivityId, Type = record.ActivityType, Actor = record.ActivityActorURI
+				},
+				Inbox = record?.Inbox,
+				FetchedBy = record?.Path == ObjectPath.Fetched ? "instance-actor" : default,
+				Signature = record?.KeyId == default || record.Path == ObjectPath.Fetched ? default : new ProvenanceSignature
+				{
+					Scheme = record.SignatureScheme, KeyId = record.KeyId, Algorithm = record.Algorithm, Headers = record.SignedHeaders
+				},
+				ReceivedAt = record == default ? default : MastodonJson.Time(record.ReceivedAt),
+				Published = record?.Published is { } published ? MastodonJson.Time(published) : default,
+				Updated = record?.Updated is { } updated ? MastodonJson.Time(updated) : default,
+				Extensions = record?.Extensions ?? ObjectFeatures.Detect(raw),
+				ContextNamespaces = record?.ContextNamespaces ?? ObjectFeatures.Namespaces(raw, record?.ActivityContext),
+				Raw = raw,
+				RawBytes = record?.RawBytes ?? 0,
+				RawHash = record?.RawHash,
+				RawTruncated = record?.RawTruncated == true,
+				Revisions = record?.Revisions.Select(r => new ProvenanceRevision
+				{
+					ActivityId = r.ActivityId,
+					Updated = r.Updated is { } at ? MastodonJson.Time(at) : default,
+					ReceivedAt = MastodonJson.Time(r.ReceivedAt),
+					RawHash = r.RawHash,
+					Raw = r.Raw == default ? default : JsonNode.Parse(r.Raw)
+				}).ToList() ?? new(),
+				Instance = instance == default ? default : Describe(instance)
+			};
+		}
+
+		static InstanceDescription Describe(RemoteInstance instance) => new()
+		{
+			Host = instance.Host,
+			Software = instance.Software,
+			Version = instance.SoftwareVersion,
+			NodeName = instance.NodeName,
+			Protocols = instance.Protocols ?? new(),
+			OpenRegistrations = instance.OpenRegistrations,
+			DescribedAt = instance.DescribedAt is { } described ? MastodonJson.Time(described) : default,
+			DescriptionError = instance.DescriptionError,
+			NodeInfo = instance.NodeInfo == default ? default : JsonNode.Parse(instance.NodeInfo),
+			Delivery = new InstanceDelivery
+			{
+				ConsecutiveFailures = instance.ConsecutiveFailures,
+				UnavailableUntil = instance.UnavailableUntil is { } until ? MastodonJson.Time(until) : default,
+				LastSuccessAt = instance.LastSuccessAt is { } success ? MastodonJson.Time(success) : default,
+				LastFailureAt = instance.LastFailureAt is { } failure ? MastodonJson.Time(failure) : default
+			}
+		};
+
+		public class Provenance
+		{
+			public string ObjectUri { get; set; }
+			public string ObjectType { get; set; }
+			public string Url { get; set; }
+			public string Path { get; set; }
+			public bool Refetched { get; set; }
+			public ProvenanceActivity Activity { get; set; }
+			public string Inbox { get; set; }
+			public string FetchedBy { get; set; }
+			public ProvenanceSignature Signature { get; set; }
+			public string ReceivedAt { get; set; }
+			public string Published { get; set; }
+			public string Updated { get; set; }
+			public List<string> Extensions { get; set; } = new();
+			public List<string> ContextNamespaces { get; set; } = new();
+			public JsonNode Raw { get; set; }
+			public int RawBytes { get; set; }
+			public string RawHash { get; set; }
+			public bool RawTruncated { get; set; }
+			public List<ProvenanceRevision> Revisions { get; set; } = new();
+			public InstanceDescription Instance { get; set; }
+		}
+
+		public class ProvenanceActivity
+		{
+			public string Id { get; set; }
+			public string Type { get; set; }
+			public string Actor { get; set; }
+		}
+
+		public class ProvenanceSignature
+		{
+			public string Scheme { get; set; }
+			public string KeyId { get; set; }
+			public string Algorithm { get; set; }
+			public List<string> Headers { get; set; } = new();
+		}
+
+		public class ProvenanceRevision
+		{
+			public string ActivityId { get; set; }
+			public string Updated { get; set; }
+			public string ReceivedAt { get; set; }
+			public string RawHash { get; set; }
+			public JsonNode Raw { get; set; }
+		}
+
+		public class InstanceDescription
+		{
+			public string Host { get; set; }
+			public string Software { get; set; }
+			public string Version { get; set; }
+			public string NodeName { get; set; }
+			public List<string> Protocols { get; set; } = new();
+			public bool? OpenRegistrations { get; set; }
+			public string DescribedAt { get; set; }
+			public string DescriptionError { get; set; }
+			public JsonNode NodeInfo { get; set; }
+			public InstanceDelivery Delivery { get; set; }
+		}
+
+		public class InstanceDelivery
+		{
+			public int ConsecutiveFailures { get; set; }
+			public string UnavailableUntil { get; set; }
+			public string LastSuccessAt { get; set; }
+			public string LastFailureAt { get; set; }
+		}
+	}
+}

PrivaPub/Api/Mastodon/Controllers/ReactionsController.cs

@@ -0,0 +1,76 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+using MongoDB.Entities;
+
+using PrivaPub.Api.Mastodon.Infrastructure;
+using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Domain.Privacy;
+using PrivaPub.Domain.Social;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.StaticServices;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Api.Mastodon.Controllers
+{
+	public class ReactionsController : MastodonController
+	{
+		readonly DbEntities _dbEntities;
+		readonly MastodonMapper _mapper;
+		readonly IReactions _reactions;
+
+		public ReactionsController(DbEntities dbEntities, MastodonMapper mapper, IReactions reactions)
+		{
+			_dbEntities = dbEntities;
+			_mapper = mapper;
+			_reactions = reactions;
+		}
+
+		[HttpGet("/api/v1/pleroma/statuses/{id}/reactions"), Scope("read:statuses", requiresUser: false), AllowAnonymous]
+		public async Task<IActionResult> List(string id, CancellationToken token)
+		{
+			var post = await Visible(id, token);
+			if (post == default)
+				return NotFoundError();
+			var reactions = await DB.Default.Find<Reaction>().Match(r => r.PostId == post.ID).ExecuteAsync(token);
+			var accounts = await _mapper.Accounts(reactions.Select(r => r.AccountId), token);
+			return Json(reactions.GroupBy(r => r.Emoji).Select(group => new
+			{
+				name = group.Key,
+				count = group.Count(),
+				me = MyId != default && group.Any(r => r.AccountId == MyId),
+				url = _mapper.ProxiedUrl(group.First().EmojiURL),
+				accounts = group.Select(r => accounts.GetValueOrDefault(r.AccountId)).Where(a => a != default).ToList()
+			}).OrderByDescending(r => r.count).ToList());
+		}
+
+		[HttpPut("/api/v1/pleroma/statuses/{id}/reactions/{emoji}"), Scope("write:favourites")]
+		public async Task<IActionResult> React(string id, string emoji, CancellationToken token)
+		{
+			var post = await Visible(id, token);
+			if (post == default)
+				return NotFoundError();
+			if (!await _reactions.React(Me, post, Uri.UnescapeDataString(emoji), token))
+				return Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: That emoji cannot be used here");
+			return Json(await _mapper.Status(post, MyId, token));
+		}
+
+		[HttpDelete("/api/v1/pleroma/statuses/{id}/reactions/{emoji}"), Scope("write:favourites")]
+		public async Task<IActionResult> Unreact(string id, string emoji, CancellationToken token)
+		{
+			var post = await Visible(id, token);
+			if (post == default)
+				return NotFoundError();
+			await _reactions.Unreact(Me, post, Uri.UnescapeDataString(emoji), token);
+			return Json(await _mapper.Status(post, MyId, token));
+		}
+
+		async Task<PostEntity> Visible(string id, CancellationToken token)
+		{
+			var post = await _dbEntities.Posts.Match(p => p.ID == id && !p.DeletedAt.HasValue && p.ReblogOfPostId == null).ExecuteFirstAsync(token);
+			return post != default && post.Visibility != PostVisibility.LocalGeo && await VisibilityPolicy.CanSee(post, MyId, token) ? post : default;
+		}
+	}
+}

PrivaPub/Api/Mastodon/Controllers/SearchController.cs

@@ -56,7 +56,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				{
 					var local = await _localActors.FindByUri(q, token);
 					var foreign = local == default ? (resolve ? await _remoteActors.GetActor(q, refresh: false, token) : default) : default;
-					if (local is { IsFederated: true })
+					if (local is { IsFederated: true, IsCircle: false })
 						results.Accounts.Add(await _mapper.Local(local, false, token));
 					else if (foreign != default)
 						results.Accounts.Add(_mapper.Foreign(foreign));

PrivaPub/Api/Mastodon/Controllers/StatusesController.cs

@@ -9,6 +9,9 @@ using PrivaPub.Api.Mastodon.Mappers;
 using PrivaPub.Domain.Privacy;
 using PrivaPub.Domain.Statuses;
 using PrivaPub.Models.Post;
+using PrivaPub.Models.User;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Federation.Outbox;
 using PrivaPub.StaticServices;
 
 using PostEntity = PrivaPub.Models.Post.Post;
@@ -24,9 +27,14 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		readonly MastodonMapper _mapper;
 		readonly DbEntities _dbEntities;
 		readonly IMemoryCache _cache;
+		readonly IQuoteService _quotes;
+		readonly IOutboxPublisher _outbox;
 
-		public StatusesController(IStatusService statuses, MastodonMapper mapper, DbEntities dbEntities, IMemoryCache cache)
+		public StatusesController(IStatusService statuses, MastodonMapper mapper, DbEntities dbEntities, IMemoryCache cache, IQuoteService quotes,
+			IOutboxPublisher outbox)
 		{
+			_quotes = quotes;
+			_outbox = outbox;
 			_statuses = statuses;
 			_mapper = mapper;
 			_dbEntities = dbEntities;
@@ -44,9 +52,6 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				if (existing != default)
 					return Json(await _mapper.Status(existing, MyId, token));
 			}
-			if (Params.Has("poll[options]"))
-				return Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: Polls are not supported yet");
-
 			var outcome = await _statuses.Publish(Me, new StatusDraft
 			{
 				Text = Params.Get("status"),
@@ -56,7 +61,13 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				Visibility = Visibility(Params.Get("visibility") ?? Me.Settings.DefaultVisibility),
 				InReplyTo = Params.Get("in_reply_to_id"),
 				Language = Params.Get("language") ?? Me.Settings.DefaultLanguage,
-				MediaIds = Params.List("media_ids")
+				MediaIds = Params.List("media_ids"),
+				QuotedStatusId = Params.Get("quoted_status_id"),
+				QuotePolicy = Params.Get("quote_approval_policy"),
+				Poll = Params.Has("poll[options]")
+					? new PollDraft(Params.List("poll[options]"), Params.Int("poll[expires_in]") ?? 0, Params.Bool("poll[multiple]") == true,
+						Params.Bool("poll[hide_totals]") == true)
+					: default
 			}, token);
 			if (!outcome.Ok)
 				return Error(outcome.Status, outcome.Error);
@@ -225,6 +236,47 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			return Json(reblogs.Select(r => accounts.GetValueOrDefault(MastodonMapper.AuthorOf(r))).Where(a => a != default).ToList());
 		}
 
+		[HttpGet("/api/v1/statuses/{id}/quotes"), Scope("read:statuses", requiresUser: false), Microsoft.AspNetCore.Authorization.AllowAnonymous]
+		public async Task<IActionResult> Quotes(string id, CancellationToken token)
+		{
+			if (await Visible(id, token) == default)
+				return NotFoundError();
+			var query = _dbEntities.Posts.Match(p => p.QuotedPostId == id && p.QuoteState == QuoteState.Accepted && !p.DeletedAt.HasValue);
+			var quotes = await Page.From(Params, Limit()).Fetch(query, p => p.ID, token);
+			var visible = new List<PostEntity>();
+			foreach (var quote in quotes)
+				if (quote.Visibility != PostVisibility.LocalGeo && await VisibilityPolicy.CanSee(quote, MyId, token))
+					visible.Add(quote);
+			Link($"/api/v1/statuses/{id}/quotes", quotes.LastOrDefault()?.ID, quotes.FirstOrDefault()?.ID);
+			return Json(await _mapper.Statuses(visible, MyId, token));
+		}
+
+		[HttpPost("/api/v1/statuses/{id}/quotes/{quotingId}/revoke"), Scope("write:statuses")]
+		public async Task<IActionResult> RevokeQuote(string id, string quotingId, CancellationToken token)
+		{
+			var quoted = await _dbEntities.Posts.Match(p => p.ID == id && p.GroupUserId == MyId && !p.IsFederatedCopy && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			var quoting = quoted == default ? default : await _dbEntities.Posts.Match(p => p.ID == quotingId && p.QuotedPostId == quoted.ID).ExecuteFirstAsync(token);
+			if (quoting == default || !await _quotes.RevokeLicence(quoted, quoting, token))
+				return NotFoundError();
+			return Json(await _mapper.Status(await _dbEntities.Posts.MatchID(quoting.ID).ExecuteFirstAsync(token), MyId, token));
+		}
+
+		[HttpPut("/api/v1/statuses/{id}/interaction_policy"), Scope("write:statuses")]
+		public async Task<IActionResult> InteractionPolicy(string id, CancellationToken token)
+		{
+			var post = await _dbEntities.Posts.Match(p => p.ID == id && p.GroupUserId == MyId && !p.IsFederatedCopy && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			if (post == default)
+				return NotFoundError();
+			var policy = Params.Get("quote_approval_policy");
+			if (!QuotePolicies.IsKnown(policy))
+				return Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: Unknown quote approval policy");
+			await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(p => p.LocalQuotePolicy, policy).ExecuteAsync(token);
+			post.LocalQuotePolicy = policy;
+			if (!post.IsLocalOnly)
+				await _outbox.Publish(Me, post, ActivityPubRenderer.UpdateOf(post, Me, $"policy-{DateTime.UtcNow.Ticks}"), token);
+			return Json(await _mapper.Status(post, MyId, token));
+		}
+
 		[HttpPost("/api/v1/statuses/{id}/bookmark"), Scope("write:bookmarks")]
 		public async Task<IActionResult> Bookmark(string id, CancellationToken token)
 		{

PrivaPub/Api/Mastodon/Controllers/TimelinesController.cs

@@ -162,7 +162,10 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			[NotificationType.FollowRequest] = "follow_request",
 			[NotificationType.Favourite] = "favourite",
 			[NotificationType.Reblog] = "reblog",
-			[NotificationType.Update] = "update"
+			[NotificationType.Update] = "update",
+			[NotificationType.Poll] = "poll",
+			[NotificationType.Reaction] = "pleroma:emoji_reaction",
+			[NotificationType.Quote] = "quote"
 		};
 
 		readonly MastodonMapper _mapper;
@@ -233,7 +236,9 @@ namespace PrivaPub.Api.Mastodon.Controllers
 					CreatedAt = MastodonJson.Time(n.CreatedAt),
 					GroupKey = $"ungrouped-{n.ID}",
 					Account = accounts[n.FromAccountId],
-					Status = n.PostId == default ? default : statuses[n.PostId]
+					Status = n.PostId == default ? default : statuses[n.PostId],
+					Emoji = n.Emoji == default ? default : n.EmojiURL == default ? n.Emoji : $":{n.Emoji}:",
+					EmojiUrl = _mapper.ProxiedUrl(n.EmojiURL)
 				})
 				.ToList();
 		}

PrivaPub/Api/Mastodon/Entities/Entities.cs

@@ -25,12 +25,24 @@ namespace PrivaPub.Api.Mastodon.Entities
 		public string LastStatusAt { get; set; }
 		public bool? HideCollections { get; set; }
 		public bool Noindex { get; set; } = true;
-		public List<object> Emojis { get; set; } = new();
+		public List<CustomEmojiEntity> Emojis { get; set; } = new();
 		public List<object> Roles { get; set; } = new();
+		public bool? Memorial { get; set; }
+		public string AvatarDescription { get; set; } = string.Empty;
+		public string HeaderDescription { get; set; } = string.Empty;
 		public List<Field> Fields { get; set; } = new();
 		public Source Source { get; set; }
 	}
 
+	public class CustomEmojiEntity
+	{
+		public string Shortcode { get; set; }
+		public string Url { get; set; }
+		public string StaticUrl { get; set; }
+		public bool VisibleInPicker { get; set; }
+		public string Category { get; set; }
+	}
+
 	public class Field
 	{
 		public string Name { get; set; }
@@ -47,6 +59,177 @@ namespace PrivaPub.Api.Mastodon.Entities
 		public List<Field> Fields { get; set; } = new();
 		public int FollowRequestsCount { get; set; }
 		public string AttributionDomains { get; set; }
+		public string QuotePolicy { get; set; } = "public";
+	}
+
+	public class PrivaPubStatus
+	{
+		public string ObjectType { get; set; }
+		public string Title { get; set; }
+		public string Excerpt { get; set; }
+		public string Cover { get; set; }
+		public PrivaPubSource Source { get; set; }
+		public PrivaPubLink Link { get; set; }
+		public PrivaPubVideo Video { get; set; }
+		public PrivaPubAudio Audio { get; set; }
+		public PrivaPubEvent Event { get; set; }
+		public PrivaPubVotes Votes { get; set; } = new();
+	}
+
+	public class PrivaPubSource
+	{
+		public string Content { get; set; }
+		public string MediaType { get; set; }
+	}
+
+	public class PrivaPubLink
+	{
+		public string Url { get; set; }
+		public string Title { get; set; }
+		public string Description { get; set; }
+		public string Image { get; set; }
+		public bool FromPublisher { get; set; }
+	}
+
+	public class PrivaPubVariant
+	{
+		public string Url { get; set; }
+		public string MediaType { get; set; }
+		public int? Width { get; set; }
+		public int? Height { get; set; }
+		public double? Fps { get; set; }
+		public long? Size { get; set; }
+		public List<string> Streams { get; set; } = new();
+	}
+
+	public class PrivaPubVideo
+	{
+		public double? Duration { get; set; }
+		public List<PrivaPubVariant> Variants { get; set; } = new();
+		public bool IsLive { get; set; }
+		public int? State { get; set; }
+		public long? Views { get; set; }
+		public int? CommentsPolicy { get; set; }
+		public bool? DownloadEnabled { get; set; }
+		public string Licence { get; set; }
+		public string Category { get; set; }
+		public string Channel { get; set; }
+		public List<PrivaPubCaption> Captions { get; set; } = new();
+	}
+
+	public class PrivaPubCaption
+	{
+		public string Language { get; set; }
+		public string Url { get; set; }
+	}
+
+	public class PrivaPubAudio
+	{
+		public double? Duration { get; set; }
+		public List<PrivaPubVariant> Variants { get; set; } = new();
+		public string Album { get; set; }
+		public int? Position { get; set; }
+		public string Licence { get; set; }
+	}
+
+	public class PrivaPubEvent
+	{
+		public string Start { get; set; }
+		public string End { get; set; }
+		public string TimeZone { get; set; }
+		public bool Floating { get; set; }
+		public List<PrivaPubPlace> Places { get; set; } = new();
+		public string OnlineUrl { get; set; }
+		public string JoinMode { get; set; }
+		public int? Participants { get; set; }
+		public int? Capacity { get; set; }
+		public string Status { get; set; }
+		public string Category { get; set; }
+	}
+
+	public class PrivaPubPlace
+	{
+		public string Name { get; set; }
+		public string Address { get; set; }
+		public double? Latitude { get; set; }
+		public double? Longitude { get; set; }
+		public string Url { get; set; }
+	}
+
+	public class PrivaPubVotes
+	{
+		public int Up { get; set; }
+		public int Down { get; set; }
+	}
+
+	public class QuoteEntity
+	{
+		public string State { get; set; }
+		public Status QuotedStatus { get; set; }
+		public string QuotedStatusId { get; set; }
+	}
+
+	public class QuoteApprovalEntity
+	{
+		public List<string> Automatic { get; set; } = new();
+		public List<string> Manual { get; set; } = new();
+		public string CurrentUser { get; set; } = "denied";
+	}
+
+	public class EmojiReactionEntity
+	{
+		public string Name { get; set; }
+		public int Count { get; set; }
+		public bool Me { get; set; }
+		public string Url { get; set; }
+		public string StaticUrl { get; set; }
+	}
+
+	public class PleromaStatus
+	{
+		public List<EmojiReactionEntity> EmojiReactions { get; set; } = new();
+	}
+
+	public class PollEntity
+	{
+		public string Id { get; set; }
+		public string ExpiresAt { get; set; }
+		public bool Expired { get; set; }
+		public bool Multiple { get; set; }
+		public int VotesCount { get; set; }
+		public int? VotersCount { get; set; }
+		public bool? Voted { get; set; }
+		public List<int> OwnVotes { get; set; }
+		public List<PollOptionEntity> Options { get; set; } = new();
+		public List<CustomEmojiEntity> Emojis { get; set; } = new();
+	}
+
+	public class PollOptionEntity
+	{
+		public string Title { get; set; }
+		public int? VotesCount { get; set; }
+	}
+
+	public class PreviewCard
+	{
+		public string Url { get; set; }
+		public string Title { get; set; } = string.Empty;
+		public string Description { get; set; } = string.Empty;
+		public string Type { get; set; } = "link";
+		public string AuthorName { get; set; } = string.Empty;
+		public string AuthorUrl { get; set; } = string.Empty;
+		public string ProviderName { get; set; } = string.Empty;
+		public string ProviderUrl { get; set; } = string.Empty;
+		public string Html { get; set; } = string.Empty;
+		public int Width { get; set; }
+		public int Height { get; set; }
+		public string Image { get; set; }
+		public string ImageDescription { get; set; } = string.Empty;
+		public string EmbedUrl { get; set; } = string.Empty;
+		public string Blurhash { get; set; }
+		public string Language { get; set; }
+		public string PublishedAt { get; set; }
+		public List<object> Authors { get; set; } = new();
 	}
 
 	public class Status
@@ -61,7 +244,7 @@ namespace PrivaPub.Api.Mastodon.Entities
 		public string Content { get; set; } = string.Empty;
 		public string CreatedAt { get; set; }
 		public string EditedAt { get; set; }
-		public List<object> Emojis { get; set; } = new();
+		public List<CustomEmojiEntity> Emojis { get; set; } = new();
 		public int RepliesCount { get; set; }
 		public int ReblogsCount { get; set; }
 		public int FavouritesCount { get; set; }
@@ -76,12 +259,18 @@ namespace PrivaPub.Api.Mastodon.Entities
 		public List<MediaAttachment> MediaAttachments { get; set; } = new();
 		public List<StatusMention> Mentions { get; set; } = new();
 		public List<StatusTag> Tags { get; set; } = new();
-		public object Card { get; set; }
-		public object Poll { get; set; }
+		public PreviewCard Card { get; set; }
+		public PollEntity Poll { get; set; }
 		public Application Application { get; set; }
 		public string Language { get; set; }
 		public string Text { get; set; }
 		public List<object> Filtered { get; set; } = new();
+		public PrivaPubStatus Privapub { get; set; }
+		public List<EmojiReactionEntity> EmojiReactions { get; set; } = new();
+		public PleromaStatus Pleroma { get; set; }
+		public QuoteEntity Quote { get; set; }
+		public int QuotesCount { get; set; }
+		public QuoteApprovalEntity QuoteApproval { get; set; }
 	}
 
 	public class MediaAttachment
@@ -150,6 +339,8 @@ namespace PrivaPub.Api.Mastodon.Entities
 		public string GroupKey { get; set; }
 		public Account Account { get; set; }
 		public Status Status { get; set; }
+		public string Emoji { get; set; }
+		public string EmojiUrl { get; set; }
 	}
 
 	public class Context
@@ -166,7 +357,7 @@ namespace PrivaPub.Api.Mastodon.Entities
 		public string CreatedAt { get; set; }
 		public Account Account { get; set; }
 		public List<MediaAttachment> MediaAttachments { get; set; } = new();
-		public List<object> Emojis { get; set; } = new();
+		public List<CustomEmojiEntity> Emojis { get; set; } = new();
 	}
 
 	public class StatusSource

PrivaPub/Api/Mastodon/Infrastructure/MastodonErrors.cs

@@ -0,0 +1,29 @@
+using System.Text.Json;
+
+namespace PrivaPub.Api.Mastodon.Infrastructure
+{
+	public static class MastodonErrors
+	{
+		public static IApplicationBuilder UseMastodonErrorBodies(this IApplicationBuilder app) =>
+			app.UseWhen(context => context.Request.Path.StartsWithSegments("/api"), api => api.UseStatusCodePages(async pages =>
+			{
+				var response = pages.HttpContext.Response;
+				response.ContentType = "application/json; charset=utf-8";
+				await response.WriteAsync(JsonSerializer.Serialize(new { error = Message(response.StatusCode) }, MastodonJson.Options));
+			}));
+
+		public static string Message(int status) => status switch
+		{
+			StatusCodes.Status401Unauthorized => "The access token is invalid",
+			StatusCodes.Status403Forbidden => "This action is outside the authorized scopes",
+			StatusCodes.Status404NotFound => "Record not found",
+			StatusCodes.Status405MethodNotAllowed => "Method not allowed",
+			StatusCodes.Status413PayloadTooLarge => "Payload too large",
+			StatusCodes.Status415UnsupportedMediaType => "Unsupported media type",
+			StatusCodes.Status422UnprocessableEntity => "Validation failed",
+			StatusCodes.Status429TooManyRequests => "Too many requests",
+			>= 500 => "Something went wrong.",
+			_ => "Bad request"
+		};
+	}
+}

PrivaPub/Api/Mastodon/Mappers/MastodonMapper.cs

@@ -6,11 +6,16 @@ using PrivaPub.Domain.Media;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Rendering;
 using PrivaPub.Models.Federation;
+using PrivaPub.Models.Group;
+using PrivaPub.Domain.Privacy;
+using PrivaPub.Federation.Objects;
 using PrivaPub.Models.Post;
+using PrivaPub.Domain.Statuses;
 using PrivaPub.Models.Social;
 using PrivaPub.Models.User;
 using PrivaPub.StaticServices;
 
+using System.Globalization;
 using System.Net;
 
 using GroupEntity = PrivaPub.Models.Group.Group;
@@ -33,6 +38,8 @@ namespace PrivaPub.Api.Mastodon.Mappers
 
 		string Proxied(string url) => _proxy == default ? url : _proxy.Wrap(url);
 
+		public string ProxiedUrl(string url) => Proxied(url);
+
 		string MissingAvatar => $"{_localActors.BaseAddress}/media/missing-avatar.png";
 		string MissingHeader => $"{_localActors.BaseAddress}/media/missing-header.png";
 
@@ -86,6 +93,7 @@ namespace PrivaPub.Api.Mastodon.Mappers
 					Privacy = actor.Settings.DefaultVisibility ?? "public",
 					Sensitive = actor.Settings.DefaultSensitive,
 					Language = actor.Settings.DefaultLanguage,
+					QuotePolicy = actor.Settings.QuotePolicy ?? QuotePolicies.Public,
 					Note = actor.Summary ?? string.Empty,
 					Fields = actor.Fields.Select(f => new Field { Name = f.Key, Value = f.Value }).ToList(),
 					FollowRequestsCount = (int)await DB.Default.CountAsync<Follower>(f => f.LocalActorId == actor.Id && !f.IsAccepted, token)
@@ -101,8 +109,15 @@ namespace PrivaPub.Api.Mastodon.Mappers
 			DisplayName = foreign.Name ?? foreign.UserName ?? string.Empty,
 			Bot = foreign.AvatarType is AvatarType.Service or AvatarType.Application,
 			Group = foreign.AvatarType == AvatarType.Group,
+			Locked = foreign.IsLocked,
 			Discoverable = foreign.IsDiscoverable,
-			CreatedAt = MastodonJson.Day(foreign.CreatedAt),
+			Indexable = foreign.IsIndexable,
+			Memorial = foreign.IsMemorial ? true : default(bool?),
+			CreatedAt = MastodonJson.Day(foreign.Published ?? foreign.CreatedAt),
+			Emojis = Emojis(foreign.Emojis),
+			Fields = foreign.Fields.Select(f => new Field { Name = f.Key, Value = f.Value }).ToList(),
+			AvatarDescription = foreign.PictureDescription ?? string.Empty,
+			HeaderDescription = foreign.HeaderDescription ?? string.Empty,
 			Note = foreign.Biography ?? string.Empty,
 			Url = foreign.Url ?? foreign.ActorURI,
 			Uri = foreign.ActorURI,
@@ -124,7 +139,7 @@ namespace PrivaPub.Api.Mastodon.Mappers
 
 			foreach (var avatar in await _dbEntities.Avatars.Match(a => wanted.Contains(a.ID) && !a.DeletionAt.HasValue).ExecuteAsync(token))
 				accounts[avatar.ID] = await Local(_localActors.FromAvatar(avatar), false, token);
-			foreach (var group in await _dbEntities.Groups.Match(g => wanted.Contains(g.ID) && !g.DeletionAt.HasValue).ExecuteAsync(token))
+			foreach (var group in await _dbEntities.Groups.Match(g => wanted.Contains(g.ID) && !g.DeletionAt.HasValue && g.Kind == GroupKind.Community).ExecuteAsync(token))
 				accounts[group.ID] = await Local(_localActors.FromGroup(group), false, token);
 			foreach (var foreign in await _dbEntities.ForeignAvatars.Match(f => wanted.Contains(f.ID)).ExecuteAsync(token))
 				accounts[foreign.ID] = Foreign(foreign);
@@ -134,7 +149,10 @@ namespace PrivaPub.Api.Mastodon.Mappers
 		public async Task<Status> Status(PostEntity post, string viewerId, CancellationToken token) =>
 			(await Statuses(new[] { post }, viewerId, token)).FirstOrDefault();
 
-		public async Task<List<Status>> Statuses(IReadOnlyCollection<PostEntity> posts, string viewerId, CancellationToken token)
+		public Task<List<Status>> Statuses(IReadOnlyCollection<PostEntity> posts, string viewerId, CancellationToken token) =>
+			Statuses(posts, viewerId, nested: false, token);
+
+		async Task<List<Status>> Statuses(IReadOnlyCollection<PostEntity> posts, string viewerId, bool nested, CancellationToken token)
 		{
 			var originalIds = posts.Where(p => p.ReblogOfPostId != default).Select(p => p.ReblogOfPostId).Distinct().ToList();
 			var originals = originalIds.Count == 0
@@ -156,6 +174,24 @@ namespace PrivaPub.Api.Mastodon.Mappers
 				? new HashSet<string>()
 				: (await DB.Default.Find<Bookmark>().Match(b => b.AvatarId == viewerId && ids.Contains(b.PostId)).ExecuteAsync(token)).Select(b => b.PostId).ToHashSet();
 			var pinned = (await DB.Default.Find<Pin>().Match(p => ids.Contains(p.PostId)).ExecuteAsync(token)).Select(p => p.PostId).ToHashSet();
+			var reactions = (await DB.Default.Find<Reaction>().Match(r => ids.Contains(r.PostId)).ExecuteAsync(token))
+				.GroupBy(r => r.PostId)
+				.ToDictionary(g => g.Key, g => g.GroupBy(r => r.Emoji)
+					.Select(e => new EmojiReactionEntity
+					{
+						Name = e.Key,
+						Count = e.Count(),
+						Me = viewerId != default && e.Any(r => r.AccountId == viewerId),
+						Url = Proxied(e.First().EmojiURL),
+						StaticUrl = Proxied(e.First().EmojiURL)
+					})
+					.OrderByDescending(e => e.Count)
+					.ToList());
+			var pollIds = all.Where(p => p.Poll != default).Select(p => p.ID).ToList();
+			var ownVotes = viewerId == default || pollIds.Count == 0
+				? new Dictionary<string, List<int>>()
+				: (await DB.Default.Find<PollVote>().Match(v => pollIds.Contains(v.PostId) && v.VoterAccountId == viewerId && v.IsLocalVoter).ExecuteAsync(token))
+					.GroupBy(v => v.PostId).ToDictionary(g => g.Key, g => g.Select(v => v.Choice).ToList());
 			var hidden = viewerId == default
 				? new HashSet<string>()
 				: await Domain.Relationships.Hidden.AuthorsHiddenFrom(viewerId, all.Select(p => p.ActorURI), forNotifications: false, token);
@@ -190,13 +226,47 @@ namespace PrivaPub.Api.Mastodon.Mappers
 					SpoilerText = post.SpoilerText ?? (post.HasContentWarning ? post.Title ?? ActivityPubRenderer.ContentWarning : string.Empty),
 					Visibility = Visibility(post.Visibility),
 					Language = post.Language,
-					MediaAttachments = post.Media.Select(Media).ToList(),
+					MediaAttachments = post.Media.Count > 0 ? post.Media.Select(Media).ToList() : Playable(post),
+					Card = Card(post),
+					Poll = Poll(post, viewerId, ownVotes.GetValueOrDefault(post.ID)),
+					Emojis = Emojis(post.Emojis),
+					Privapub = Extension(post),
+					EmojiReactions = reactions.GetValueOrDefault(post.ID) ?? new(),
+					Pleroma = new PleromaStatus { EmojiReactions = reactions.GetValueOrDefault(post.ID) ?? new() },
 					Mentions = post.Mentions.Select(m => Mention(m, mentionAccounts)).Where(m => m != default).ToList(),
 					Tags = post.Tags.Select(t => new StatusTag { Name = t, Url = ActivityPubRenderer.TagUrl(_localActors.BaseAddress, t) }).ToList()
 				};
 				return status;
 			}
 
+			var localAuthors = all.Where(p => !p.IsFederatedCopy && p.GroupUserId != default).Select(p => p.GroupUserId).Distinct().ToList();
+			var followsAuthor = viewerId == default || localAuthors.Count == 0
+				? new HashSet<string>()
+				: await FollowedLocalAuthors(viewerId, localAuthors, token);
+			var quotedIds = nested ? new List<string>() : all.Where(p => p.QuoteState == QuoteState.Accepted && p.QuotedPostId != default).Select(p => p.QuotedPostId).Distinct().ToList();
+			var quotedPosts = new List<PostEntity>();
+			foreach (var quotedPost in quotedIds.Count == 0 ? new List<PostEntity>() : await _dbEntities.Posts.Match(p => quotedIds.Contains(p.ID) && !p.DeletedAt.HasValue).ExecuteAsync(token))
+				if (quotedPost.Visibility != PostVisibility.LocalGeo && await VisibilityPolicy.CanSee(quotedPost, viewerId, token))
+					quotedPosts.Add(quotedPost);
+			var quotedStatuses = quotedPosts.Count == 0
+				? new Dictionary<string, Status>()
+				: (await Statuses(quotedPosts, viewerId, nested: true, token)).ToDictionary(q => q.Id);
+
+			void Quote(Status status, PostEntity post)
+			{
+				status.QuotesCount = post.QuotesCount;
+				status.QuoteApproval = post.IsFederatedCopy ? Approval(post, viewerId) : LocalApproval(post, viewerId, followsAuthor.Contains(post.GroupUserId));
+				if (post.QuoteState == QuoteState.None)
+					return;
+				var state = post.QuoteState.ToString().ToLowerInvariant();
+				var quoted = post.QuotedPostId != default && quotedStatuses.TryGetValue(post.QuotedPostId, out var shown) ? shown : default;
+				status.Quote = nested
+					? new QuoteEntity { State = state, QuotedStatusId = post.QuotedPostId }
+					: new QuoteEntity { State = state, QuotedStatus = post.QuoteState == QuoteState.Accepted ? quoted : default, QuotedStatusId = post.QuotedPostId };
+				if (!nested && post.QuoteState == QuoteState.Accepted && quoted != default)
+					status.Content = WithoutQuoteFallback(status.Content);
+			}
+
 			var mapped = new List<Status>();
 			foreach (var post in posts)
 			{
@@ -206,10 +276,12 @@ namespace PrivaPub.Api.Mastodon.Mappers
 				var status = Map(post);
 				if (status == default)
 					continue;
+				Quote(status, post);
 				if (post.ReblogOfPostId != default)
 				{
 					if (!originals.TryGetValue(post.ReblogOfPostId, out var original) || Map(original) is not { } inner)
 						continue;
+					Quote(inner, original);
 					status.Reblog = inner;
 					status.Content = string.Empty;
 					status.Reblogged = reblogged.Contains(original.ID);
@@ -221,12 +293,237 @@ namespace PrivaPub.Api.Mastodon.Mappers
 
 		public static string AuthorOf(PostEntity post) => post.AuthorAccountId ?? post.GroupUserId;
 
+		static readonly AngleSharp.Html.Parser.HtmlParser Fragments = new();
+
+		public static string WithoutQuoteFallback(string html)
+		{
+			if (string.IsNullOrEmpty(html) || !html.Contains("quote-inline", StringComparison.Ordinal))
+				return html;
+			var document = Fragments.ParseDocument($"<body>{html}</body>");
+			foreach (var fallback in document.QuerySelectorAll(".quote-inline").ToList())
+				fallback.Remove();
+			return document.Body!.InnerHtml;
+		}
+
+		async Task<HashSet<string>> FollowedLocalAuthors(string viewerId, List<string> authorIds, CancellationToken token)
+		{
+			var uris = new Dictionary<string, string>();
+			foreach (var avatar in await _dbEntities.Avatars.Match(a => authorIds.Contains(a.ID)).ExecuteAsync(token))
+				uris[_localActors.FromAvatar(avatar).Uri] = avatar.ID;
+			var targets = uris.Keys.ToList();
+			return (await _dbEntities.Followings.Match(f => f.AvatarId == viewerId && targets.Contains(f.TargetActorURI) && f.State == FollowState.Accepted).ExecuteAsync(token))
+				.Select(f => uris[f.TargetActorURI]).ToHashSet();
+		}
+
+		static QuoteApprovalEntity LocalApproval(PostEntity post, string viewerId, bool viewerFollows)
+		{
+			var policy = ActivityPubRenderer.QuotableBy(post);
+			var everyone = policy switch { QuotePolicies.Public => new List<string> { "public" }, QuotePolicies.Followers => new List<string> { "followers" }, _ => new List<string>() };
+			var current = viewerId == default ? "unknown"
+				: viewerId == post.GroupUserId && post.Visibility is PostVisibility.Public or PostVisibility.Unlisted ? "automatic"
+				: policy == QuotePolicies.Public || policy == QuotePolicies.Followers && viewerFollows ? "automatic"
+				: "denied";
+			return new QuoteApprovalEntity { Automatic = everyone, CurrentUser = current };
+		}
+
+		static QuoteApprovalEntity Approval(PostEntity post, string viewerId)
+		{
+			if (!post.IsFederatedCopy || post.Visibility is not (PostVisibility.Public or PostVisibility.Unlisted))
+				return new QuoteApprovalEntity();
+			if (post.QuotePolicy is not { } policy)
+				return new QuoteApprovalEntity { Automatic = new List<string> { "public" }, CurrentUser = viewerId == default ? "unknown" : "automatic" };
+			static List<string> Named(IEnumerable<string> who) => who.Select(w => Addressing.IsPublic(w) ? "public" : w.EndsWith("/followers") ? "followers" : "unsupported_policy").Distinct().ToList();
+			return new QuoteApprovalEntity
+			{
+				Automatic = Named(policy.Automatic),
+				Manual = Named(policy.Manual),
+				CurrentUser = viewerId == default ? "unknown" : policy.Automatic.Any(Addressing.IsPublic) ? "automatic" : policy.Manual.Any(Addressing.IsPublic) ? "manual" : "denied"
+			};
+		}
+
 		public static string Content(PostEntity post)
 		{
 			var content = post.ContentHtml ?? ActivityPubRenderer.Html(post.Text);
-			return string.IsNullOrEmpty(post.Title) || post.IsFederatedCopy
-				? content ?? string.Empty
-				: $"<p><strong>{WebUtility.HtmlEncode(post.Title)}</strong></p>{content}";
+			if (post.IsFederatedCopy && string.IsNullOrWhiteSpace(content) && !string.IsNullOrEmpty(post.Excerpt))
+				content = $"<p>{WebUtility.HtmlEncode(post.Excerpt)}</p>";
+			if (post.Event is { } happening && EventLine(happening) is { } line)
+				content = $"<p>{WebUtility.HtmlEncode(line)}</p>{content}";
+			var titled = !string.IsNullOrEmpty(post.Title) && (!post.IsFederatedCopy || post.ObjectType is not (null or "Note" or "Question"));
+			return titled
+				? $"<p><strong>{WebUtility.HtmlEncode(post.Title)}</strong></p>{content}"
+				: content ?? string.Empty;
+		}
+
+		public static string EventLine(EventDetails happening)
+		{
+			if (happening.Start is not { } start)
+				return default;
+			var zone = Zone(happening.FloatingTime ? default : happening.TimeZone);
+			var local = zone == default ? start : TimeZoneInfo.ConvertTimeFromUtc(start, zone);
+			var when = local.ToString("yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture);
+			if (happening.End is { } end && end > start)
+			{
+				var localEnd = zone == default ? end : TimeZoneInfo.ConvertTimeFromUtc(end, zone);
+				when += " – " + localEnd.ToString(localEnd.Date == local.Date ? "HH:mm" : "yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture);
+			}
+			when += happening.FloatingTime ? " (local time)" : zone == default ? " UTC" : $" ({happening.TimeZone})";
+			var where = happening.Places.Select(p => p.Name ?? p.Address).FirstOrDefault(p => p != default)
+				?? (happening.OnlineURL != default ? "online" : default);
+			return where == default ? when : $"{when} · {where}";
+		}
+
+		static TimeZoneInfo Zone(string id)
+		{
+			if (string.IsNullOrWhiteSpace(id))
+				return default;
+			try
+			{
+				return TimeZoneInfo.FindSystemTimeZoneById(id);
+			}
+			catch (Exception ex) when (ex is TimeZoneNotFoundException or InvalidTimeZoneException)
+			{
+				return default;
+			}
+		}
+
+		public PollEntity Poll(PostEntity post, string viewerId, IReadOnlyCollection<int> ownVotes)
+		{
+			if (post.Poll is not { } poll)
+				return default;
+			var expired = PollService.Ended(poll);
+			var hidden = poll.HideTotals && !expired && post.GroupUserId != viewerId;
+			return new PollEntity
+			{
+				Id = post.ID,
+				ExpiresAt = poll.ExpiresAt is { } ends ? MastodonJson.Time(ends) : default,
+				Expired = expired,
+				Multiple = poll.Multiple,
+				VotesCount = poll.Options.Sum(o => o.Votes),
+				VotersCount = poll.Multiple ? poll.VotersCount : poll.VotersCount ?? poll.Options.Sum(o => o.Votes),
+				Voted = viewerId == default ? default(bool?) : ownVotes?.Count > 0 || post.GroupUserId == viewerId,
+				OwnVotes = viewerId == default ? default : ownVotes?.ToList() ?? new List<int>(),
+				Options = poll.Options.Select(o => new PollOptionEntity { Title = o.Title, VotesCount = hidden ? default(int?) : o.Votes }).ToList(),
+				Emojis = Emojis(post.Emojis.Where(e => poll.Options.Any(o => o.Title.Contains($":{e.Shortcode}:"))))
+			};
+		}
+
+		List<CustomEmojiEntity> Emojis(IEnumerable<CustomEmoji> emojis) =>
+			emojis?.Select(e => new CustomEmojiEntity { Shortcode = e.Shortcode, Url = Proxied(e.URL), StaticUrl = Proxied(e.URL) }).ToList() ?? new();
+
+		PrivaPubStatus Extension(PostEntity post) => new()
+		{
+			ObjectType = post.ObjectType,
+			Title = post.IsFederatedCopy ? post.Title : default,
+			Excerpt = post.Excerpt,
+			Cover = Proxied(post.CoverURL),
+			Source = post.Source == default ? default : new PrivaPubSource { Content = post.Source.Content, MediaType = post.Source.MediaType },
+			Link = post.Link == default ? default : new PrivaPubLink
+			{
+				Url = post.Link.Href, Title = post.Link.Title, Description = post.Link.Description, Image = Proxied(post.Link.ImageURL), FromPublisher = post.Link.FromPublisher
+			},
+			Video = post.Video == default ? default : new PrivaPubVideo
+			{
+				Duration = post.Video.DurationSeconds,
+				Variants = post.Video.Variants.Select(Variant).ToList(),
+				IsLive = post.Video.IsLive,
+				State = post.Video.State,
+				Views = post.Video.Views,
+				CommentsPolicy = post.Video.CommentsPolicy,
+				DownloadEnabled = post.Video.DownloadEnabled,
+				Licence = post.Video.Licence,
+				Category = post.Video.Category,
+				Channel = post.Video.ChannelURI,
+				Captions = post.Video.Captions.Select(c => new PrivaPubCaption { Language = c.Language, Url = Proxied(c.Url) }).ToList()
+			},
+			Audio = post.Audio == default ? default : new PrivaPubAudio
+			{
+				Duration = post.Audio.DurationSeconds,
+				Variants = post.Audio.Variants.Select(Variant).ToList(),
+				Album = post.Audio.Album,
+				Position = post.Audio.Position,
+				Licence = post.Audio.Licence
+			},
+			Event = post.Event == default ? default : new PrivaPubEvent
+			{
+				Start = post.Event.Start is { } start ? MastodonJson.Time(start) : default,
+				End = post.Event.End is { } end ? MastodonJson.Time(end) : default,
+				TimeZone = post.Event.TimeZone,
+				Floating = post.Event.FloatingTime,
+				Places = post.Event.Places.Select(p => new PrivaPubPlace { Name = p.Name, Address = p.Address, Latitude = p.Latitude, Longitude = p.Longitude, Url = p.Url }).ToList(),
+				OnlineUrl = post.Event.OnlineURL,
+				JoinMode = post.Event.JoinMode,
+				Participants = post.Event.ParticipantCount,
+				Capacity = post.Event.Capacity,
+				Status = post.Event.Status,
+				Category = post.Event.Category
+			},
+			Votes = new PrivaPubVotes { Up = post.FavouritesCount, Down = post.DownvotesCount }
+		};
+
+		PrivaPubVariant Variant(MediaVariant variant) => new()
+		{
+			Url = Proxied(variant.Url),
+			MediaType = variant.MediaType,
+			Width = variant.Width,
+			Height = variant.Height,
+			Fps = variant.Fps,
+			Size = variant.Size,
+			Streams = variant.Streams
+		};
+
+		List<MediaAttachment> Playable(PostEntity post)
+		{
+			var (variant, kind, duration) = post.Video is { } video ? (BestVideo(video.Variants), "video", video.DurationSeconds)
+				: post.Audio is { } audio ? (audio.Variants.FirstOrDefault(), "audio", audio.DurationSeconds)
+				: default;
+			if (variant == default)
+				return new List<MediaAttachment>();
+			return new List<MediaAttachment>
+			{
+				Media(new PostMedia
+				{
+					Id = new Guid(System.Security.Cryptography.MD5.HashData(System.Text.Encoding.UTF8.GetBytes(variant.Url))),
+					RemoteURL = variant.Url,
+					ContentType = variant.MediaType ?? kind + "/*",
+					RemotePreviewURL = post.CoverURL,
+					Width = variant.Width,
+					Height = variant.Height,
+					DurationSeconds = duration,
+					Description = post.Title
+				})
+			};
+		}
+
+		public static MediaVariant BestVideo(IReadOnlyCollection<MediaVariant> variants)
+		{
+			var playable = variants.Where(v => v.MediaType?.StartsWith("video/") == true && (v.Streams.Count == 0 || v.Streams.Contains("audio") && v.Streams.Contains("video"))).ToList();
+			return playable.Where(v => v.Height <= 720).OrderByDescending(v => v.Height).FirstOrDefault()
+				?? playable.OrderBy(v => v.Height ?? int.MaxValue).FirstOrDefault();
+		}
+
+		PreviewCard Card(PostEntity post)
+		{
+			if (post.Link is { } link)
+				return Card(link.Href, link.Title ?? post.Title, link.Description ?? (post.Media.Count == 0 ? post.Excerpt : default), link.ImageURL);
+			if (post.IsFederatedCopy && post.ObjectType is "Article" or "Event" && post.Url != default && post.Media.Count == 0
+				|| post.IsFederatedCopy && post.ObjectType is "Video" or "Audio" && post.Url != default && post.Media.Count == 0 && Playable(post).Count == 0)
+				return Card(post.Url, post.Title, post.Excerpt, post.CoverURL);
+			return default;
+		}
+
+		PreviewCard Card(string url, string title, string description, string image)
+		{
+			if (!Uri.TryCreate(url, UriKind.Absolute, out var uri))
+				return default;
+			return new PreviewCard
+			{
+				Url = url,
+				Title = title ?? uri.Host,
+				Description = description ?? string.Empty,
+				ProviderName = uri.Host,
+				ProviderUrl = uri.GetLeftPart(UriPartial.Authority),
+				Image = Proxied(image)
+			};
 		}
 
 		public static string Visibility(PostVisibility visibility) => visibility switch
@@ -249,6 +546,28 @@ namespace PrivaPub.Api.Mastodon.Mappers
 			return new StatusMention { Id = account.ID, Username = account.UserName, Acct = $"{account.UserName}@{account.Domain}", Url = account.Url ?? account.ActorURI };
 		}
 
+		static Dictionary<string, object> Meta(PostMedia media)
+		{
+			var original = new Dictionary<string, object>();
+			if (media.Width > 0 && media.Height > 0)
+			{
+				original["width"] = media.Width;
+				original["height"] = media.Height;
+				original["size"] = $"{media.Width}x{media.Height}";
+				original["aspect"] = (double)media.Width.Value / media.Height.Value;
+			}
+			if (media.DurationSeconds is { } seconds)
+				original["duration"] = seconds;
+			var meta = new Dictionary<string, object>();
+			if (original.Count > 0)
+				meta["original"] = original;
+			if (media.DurationSeconds is { } length)
+				meta["length"] = TimeSpan.FromSeconds(length).ToString(@"h\:mm\:ss\.ff", CultureInfo.InvariantCulture);
+			if (media.Focus is { Length: 2 })
+				meta["focus"] = new { x = media.Focus[0], y = media.Focus[1] };
+			return meta;
+		}
+
 		MediaAttachment Media(PostMedia media) => new()
 		{
 			Id = media.AttachmentId ?? media.Id.ToString("N"),
@@ -261,17 +580,12 @@ namespace PrivaPub.Api.Mastodon.Mappers
 				_ => "unknown"
 			},
 			Url = media.URL ?? Proxied(media.RemoteURL),
-			PreviewUrl = media.PreviewURL ?? media.URL ?? Proxied(media.RemoteURL),
+			PreviewUrl = media.PreviewURL ?? Proxied(media.RemotePreviewURL)
+				?? (media.ContentType?.StartsWith("image/") == true || media.ContentType == default ? media.URL ?? Proxied(media.RemoteURL) : default),
 			RemoteUrl = media.RemoteURL,
 			Description = media.Description,
 			Blurhash = media.Blurhash,
-			Meta = new
-			{
-				original = media.Width.HasValue && media.Height > 0
-					? new { width = media.Width, height = media.Height, size = $"{media.Width}x{media.Height}", aspect = (double)media.Width / media.Height.Value }
-					: default,
-				focus = media.Focus is { Length: 2 } ? new { x = media.Focus[0], y = media.Focus[1] } : default
-			}
+			Meta = Meta(media)
 		};
 	}
 }

PrivaPub/Controllers/ClientToServer/PostController.cs

@@ -32,6 +32,10 @@ namespace PrivaPub.Controllers.ClientToServer
 		public async Task<IActionResult> Insert(InsertPostForm form, CancellationToken token) =>
 			!ModelState.IsValid ? Invalid() : Answer(await _postsService.InsertPost(User.GetUserId(), form, token));
 
+		[HttpGet, Route("/clientapi/post/nearby")]
+		public async Task<IActionResult> Nearby([FromQuery] string avatarId, [FromQuery] double latitude, [FromQuery] double longitude, CancellationToken token) =>
+			Answer(await _postsService.Nearby(User.GetUserId(), avatarId, latitude, longitude, token));
+
 		[HttpPost, Route("/clientapi/post/update")]
 		public async Task<IActionResult> Update(UpdatePostForm form, CancellationToken token) =>
 			!ModelState.IsValid ? Invalid() : Answer(await _postsService.UpdatePost(User.GetUserId(), form, token));

PrivaPub/Domain/Content/ContentRenderer.cs

@@ -122,7 +122,7 @@ namespace PrivaPub.Domain.Content
 			if (parts.Length == 1 || parts[1].Equals(localDomain, StringComparison.OrdinalIgnoreCase))
 			{
 				var local = await _localActors.FindByUserName(parts[0], token);
-				return local is { IsFederated: true, Kind: not LocalActorKind.Application }
+				return local is { IsFederated: true, IsCircle: false, Kind: not LocalActorKind.Application }
 					? new ResolvedMention(local.Uri, local.UserName, local.Domain, local.Uri, true, local.Id, local.Inbox)
 					: default;
 			}

PrivaPub/Domain/Content/LinkPreviews.cs

@@ -0,0 +1,171 @@
+using AngleSharp.Html.Parser;
+
+using Microsoft.Extensions.Options;
+
+using MongoDB.Entities;
+
+using PrivaPub.Infrastructure.Statistics;
+using PrivaPub.Models.Statistics;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Infrastructure.Http;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.StaticServices;
+
+using System.Security.Cryptography;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Domain.Content
+{
+	public class LinkPreview : Entity
+	{
+		public string Url { get; set; }
+		public string Title { get; set; }
+		public string Description { get; set; }
+		public string ImageURL { get; set; }
+		public string SiteName { get; set; }
+		public bool Failed { get; set; }
+		public DateTime FetchedAt { get; set; } = DateTime.UtcNow;
+	}
+
+	public interface ILinkPreviews
+	{
+		Task Wanted(PostEntity post, CancellationToken token);
+	}
+
+	public class LinkPreviews : ILinkPreviews, IJobHandler
+	{
+		const int MaxJitterSeconds = 60;
+		static readonly TimeSpan Freshness = TimeSpan.FromDays(7);
+		static readonly HtmlParser Parser = new();
+
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IFederationHttp _http;
+		readonly IJobQueue _queue;
+		readonly IOptionsMonitor<FederationOptions> _options;
+
+		readonly IInteractionLedger _ledger;
+
+		public LinkPreviews(DbEntities dbEntities, ILocalActorService localActors, IFederationHttp http, IJobQueue queue,
+			IOptionsMonitor<FederationOptions> options, IInteractionLedger ledger = default)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_http = http;
+			_queue = queue;
+			_options = options;
+			_ledger = ledger;
+		}
+
+		public JobKind Kind => JobKind.FetchPreview;
+		public int Concurrency => 2;
+		public int MaxAttempts => 1;
+		public int PerHostLimit => 1;
+
+		public async Task Wanted(PostEntity post, CancellationToken token)
+		{
+			if (!_options.CurrentValue.FetchLinkPreviews || post.Visibility is not (PostVisibility.Public or PostVisibility.Unlisted) || post.IsLocalOnly
+				|| post.ReblogOfPostId != default || post.Link?.Title != default || post.Link == default && post.Media.Count > 0)
+				return;
+			var url = post.Link?.Href ?? FirstLink(post, _localActors.BaseAddress);
+			if (url == default)
+				return;
+			await _queue.EnqueueMany(new[]
+			{
+				new Job
+				{
+					Kind = JobKind.FetchPreview, Payload = post.ID, Host = new Uri(url).Host.ToLowerInvariant(), DedupeKey = $"preview|{post.ID}",
+					RunAt = DateTime.UtcNow.AddSeconds(RandomNumberGenerator.GetInt32(0, MaxJitterSeconds + 1))
+				}
+			}, token);
+		}
+
+		public async Task<JobOutcome> Handle(Job job, CancellationToken token)
+		{
+			var post = await _dbEntities.Posts.MatchID(job.Payload).ExecuteFirstAsync(token);
+			if (post == default || post.DeletedAt.HasValue || post.Link?.Title != default)
+				return JobOutcome.Done;
+			var url = post.Link?.Href ?? FirstLink(post, _localActors.BaseAddress);
+			if (url == default)
+				return JobOutcome.Done;
+
+			var preview = await DB.Default.Find<LinkPreview>().Match(p => p.Url == url).ExecuteFirstAsync(token);
+			if (preview == default || preview.FetchedAt < DateTime.UtcNow - Freshness)
+				preview = await Fetch(url, token);
+			if (preview == default || preview.Failed)
+				return JobOutcome.Done;
+
+			var link = post.Link ?? new PostLink { Href = url };
+			link.Title ??= preview.Title;
+			link.Description ??= preview.Description;
+			link.ImageURL ??= preview.ImageURL;
+			await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(p => p.Link, link).ExecuteAsync(token);
+			return JobOutcome.Done;
+		}
+
+		async Task<LinkPreview> Fetch(string url, CancellationToken token)
+		{
+			var started = System.Diagnostics.Stopwatch.GetTimestamp();
+			var (finalUri, html) = await _http.GetPage(url, token);
+			var preview = html == default ? new LinkPreview { Url = url, Failed = true } : Read(url, finalUri, html);
+			_ledger?.Record(new InteractionEvent
+			{
+				Channel = Interactions.Preview,
+				Host = Interactions.HostOf(url),
+				Outcome = html == default ? Interactions.Failed : Interactions.Ok,
+				Reason = html == default ? default : preview.Title == default && preview.ImageURL == default ? "no-card" : "card",
+				LatencyMs = (int)System.Diagnostics.Stopwatch.GetElapsedTime(started).TotalMilliseconds,
+				Bytes = html == default ? default : System.Text.Encoding.UTF8.GetByteCount(html),
+				Redirects = finalUri == default || finalUri.AbsoluteUri == url ? 0 : 1
+			});
+			await DB.Default.Update<LinkPreview>()
+				.Match(p => p.Url == url)
+				.Modify(p => p.Title, preview.Title)
+				.Modify(p => p.Description, preview.Description)
+				.Modify(p => p.ImageURL, preview.ImageURL)
+				.Modify(p => p.SiteName, preview.SiteName)
+				.Modify(p => p.Failed, preview.Failed)
+				.Modify(p => p.FetchedAt, DateTime.UtcNow)
+				.Option(o => o.IsUpsert = true)
+				.ExecuteAsync(token);
+			return preview;
+		}
+
+		public static LinkPreview Read(string url, Uri finalUri, string html)
+		{
+			var document = Parser.ParseDocument(html);
+			string Meta(params string[] names) => names
+				.Select(name => document.QuerySelector($"meta[property='{name}'], meta[name='{name}']")?.GetAttribute("content"))
+				.FirstOrDefault(value => !string.IsNullOrWhiteSpace(value));
+			var image = Meta("og:image:secure_url", "og:image", "og:image:url", "twitter:image", "twitter:image:src");
+			var imageUri = image != default && Uri.TryCreate(finalUri, image, out var resolved) && resolved.Scheme is "https" or "http" ? resolved.AbsoluteUri : default;
+			var preview = new LinkPreview
+			{
+				Url = url,
+				Title = ObjectShapes.Text(Meta("og:title", "twitter:title") ?? document.Title, 300),
+				Description = ObjectShapes.Text(Meta("og:description", "twitter:description", "description"), 1000),
+				SiteName = ObjectShapes.Text(Meta("og:site_name"), 200),
+				ImageURL = imageUri
+			};
+			preview.Failed = preview.Title == default && preview.Description == default && preview.ImageURL == default;
+			return preview;
+		}
+
+		public static string FirstLink(PostEntity post, string ownBase)
+		{
+			if (string.IsNullOrEmpty(post.ContentHtml))
+				return default;
+			var document = Parser.ParseDocument(post.ContentHtml);
+			return document.QuerySelectorAll("a[href]")
+				.Where(a => !(a.ClassList.Contains("mention") || a.ClassList.Contains("hashtag") || a.GetAttribute("rel")?.Contains("tag") == true
+					|| a.Closest(".quote-inline") != default))
+				.Select(a => a.GetAttribute("href"))
+				.FirstOrDefault(href => Uri.TryCreate(href, UriKind.Absolute, out var uri) && uri.Scheme is "https" or "http"
+					&& href != post.Url && href != post.ObjectURI && !href.StartsWith(ownBase + "/", StringComparison.OrdinalIgnoreCase));
+		}
+	}
+}

PrivaPub/Domain/Media/MediaProxy.cs

@@ -15,6 +15,9 @@ namespace PrivaPub.Domain.Media
 	{
 		string Wrap(string remoteUrl);
 		Task<(string Path, string ContentType)> Fetch(string signature, string encodedUrl, CancellationToken token);
+		string Verified(string signature, string encodedUrl);
+		(string Path, string ContentType) Cached(string url);
+		Task<HttpResponseMessage> Open(string url, System.Net.Http.Headers.RangeHeaderValue range, CancellationToken token);
 	}
 
 	public class MediaProxy : IMediaProxy
@@ -43,7 +46,7 @@ namespace PrivaPub.Domain.Media
 			return $"{_localActors.BaseAddress}/media/proxy/{Sign(remoteUrl)}/{encoded}";
 		}
 
-		public async Task<(string Path, string ContentType)> Fetch(string signature, string encodedUrl, CancellationToken token)
+		public string Verified(string signature, string encodedUrl)
 		{
 			string url;
 			try
@@ -54,19 +57,38 @@ namespace PrivaPub.Domain.Media
 			{
 				return default;
 			}
-			if (!CryptographicOperations.FixedTimeEquals(Encoding.ASCII.GetBytes(signature ?? string.Empty), Encoding.ASCII.GetBytes(Sign(url))))
-				return default;
-
-			var name = Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(url)));
-			var directory = System.IO.Path.Combine(_media.ProxyRoot, name[..2]);
-			var path = System.IO.Path.Combine(directory, name);
-			var typePath = path + ".type";
-			if (File.Exists(path) && File.Exists(typePath))
-			{
-				File.SetLastWriteTimeUtc(path, DateTime.UtcNow);
-				return (path, await File.ReadAllTextAsync(typePath, token));
+			return CryptographicOperations.FixedTimeEquals(Encoding.ASCII.GetBytes(signature ?? string.Empty), Encoding.ASCII.GetBytes(Sign(url))) ? url : default;
 		}
 
+		public (string Path, string ContentType) Cached(string url)
+		{
+			var (path, typePath) = CachePaths(url);
+			if (!File.Exists(path) || !File.Exists(typePath))
+				return default;
+			File.SetLastWriteTimeUtc(path, DateTime.UtcNow);
+			return (path, File.ReadAllText(typePath));
+		}
+
+		public Task<HttpResponseMessage> Open(string url, System.Net.Http.Headers.RangeHeaderValue range, CancellationToken token) =>
+			_http.OpenMedia(url, range, token);
+
+		(string Path, string TypePath) CachePaths(string url)
+		{
+			var name = Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(url)));
+			var path = System.IO.Path.Combine(_media.ProxyRoot, name[..2], name);
+			return (path, path + ".type");
+		}
+
+		public async Task<(string Path, string ContentType)> Fetch(string signature, string encodedUrl, CancellationToken token)
+		{
+			var url = Verified(signature, encodedUrl);
+			if (url == default)
+				return default;
+			if (Cached(url) is { Path: not null } cached)
+				return cached;
+			var (path, typePath) = CachePaths(url);
+			var directory = System.IO.Path.GetDirectoryName(path);
+
 			var (bytes, contentType) = await _http.GetMedia(url, _options.CurrentValue.MaxProxiedBytes, token);
 			if (bytes == default)
 				return default;

PrivaPub/Domain/Relationships/RelationshipService.cs

@@ -38,12 +38,14 @@ namespace PrivaPub.Domain.Relationships
 
 		public async Task Block(LocalActor me, string targetActorUri, string targetAccountId, CancellationToken token)
 		{
+			var block = new Block { AvatarId = me.Id, TargetAccountId = targetAccountId, TargetActorURI = targetActorUri };
 			try
 			{
-				await DB.Default.SaveAsync(new Block { AvatarId = me.Id, TargetAccountId = targetAccountId, TargetActorURI = targetActorUri }, token);
+				await DB.Default.SaveAsync(block, token);
 			}
 			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
 			{
+				block = await DB.Default.Find<Block>().Match(b => b.AvatarId == me.Id && b.TargetActorURI == targetActorUri).ExecuteFirstAsync(token);
 			}
 
 			await _follows.UnfollowAs(me, targetActorUri, token);
@@ -67,10 +69,44 @@ namespace PrivaPub.Domain.Relationships
 					await DB.Default.DeleteAsync<Following>(f => f.TargetActorURI == me.Uri && f.AvatarId == targetAccountId);
 			}
 			await Forget(me, targetAccountId, token);
+			if (block != default)
+				await Tell(me, targetActorUri, BlockActivity(me, block), token);
 		}
 
-		public async Task Unblock(LocalActor me, string targetActorUri, CancellationToken token) =>
-			await DB.Default.DeleteAsync<Block>(b => b.AvatarId == me.Id && b.TargetActorURI == targetActorUri);
+		public async Task Unblock(LocalActor me, string targetActorUri, CancellationToken token)
+		{
+			var block = await DB.Default.Find<Block>().Match(b => b.AvatarId == me.Id && b.TargetActorURI == targetActorUri).ExecuteFirstAsync(token);
+			if (block == default)
+				return;
+			await DB.Default.DeleteAsync<Block>(block.ID);
+			await Tell(me, targetActorUri, new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.ActivityStreams,
+				["id"] = me.ActivityUri($"undo-block-{block.ID}"),
+				["type"] = "Undo",
+				["actor"] = me.Uri,
+				["object"] = BlockActivity(me, block)
+			}, token);
+		}
+
+		static JsonObject BlockActivity(LocalActor me, Block block) => new()
+		{
+			["@context"] = ActivityPubRenderer.ActivityStreams,
+			["id"] = me.ActivityUri($"block-{block.ID}"),
+			["type"] = "Block",
+			["actor"] = me.Uri,
+			["object"] = block.TargetActorURI,
+			["to"] = new JsonArray(block.TargetActorURI)
+		};
+
+		async Task Tell(LocalActor me, string targetActorUri, JsonObject activity, CancellationToken token)
+		{
+			if (targetActorUri.StartsWith(me.BaseAddress + "/", StringComparison.OrdinalIgnoreCase))
+				return;
+			var target = await _dbEntities.ForeignAvatars.Match(f => f.ActorURI == targetActorUri).ExecuteFirstAsync(token);
+			if (!string.IsNullOrEmpty(target?.InboxURL))
+				await _delivery.Enqueue(me, new[] { target.InboxURL }, activity, token);
+		}
 
 		public async Task Mute(LocalActor me, string targetActorUri, string targetAccountId, bool hideNotifications, TimeSpan? duration, CancellationToken token)
 		{

PrivaPub/Domain/Social/FollowService.cs

@@ -95,7 +95,7 @@ namespace PrivaPub.Domain.Social
 			var (local, remote) = await ResolveTarget(target, token);
 			if (local == default && remote == default)
 				return default;
-			if (local != default && (local.Id == follower.Id || !local.IsFederated || local.Kind == LocalActorKind.Application))
+			if (local != default && (local.Id == follower.Id || !local.IsFederated || local.IsCircle || local.Kind == LocalActorKind.Application))
 				return default;
 
 			var targetUri = local?.Uri ?? remote.ActorURI;

PrivaPub/Domain/Social/Notifications.cs

@@ -8,9 +8,9 @@ namespace PrivaPub.Domain.Social
 	public static class Notifications
 	{
 		public static async Task Add(string avatarId, NotificationType type, string fromAccountId, string fromActorUri, string postId,
-			CancellationToken token)
+			CancellationToken token, string emoji = default, string emojiUrl = default)
 		{
-			if (string.IsNullOrEmpty(avatarId) || avatarId == fromAccountId)
+			if (string.IsNullOrEmpty(avatarId) || avatarId == fromAccountId && type != NotificationType.Poll)
 				return;
 			if ((await Relationships.Hidden.AuthorsHiddenFrom(avatarId, new[] { fromActorUri }, forNotifications: true, token)).Count > 0)
 				return;
@@ -23,7 +23,9 @@ namespace PrivaPub.Domain.Social
 					FromAccountId = fromAccountId,
 					FromActorURI = fromActorUri,
 					PostId = postId,
-					DedupeKey = $"{type}|{avatarId}|{fromActorUri}|{postId}"
+					Emoji = emoji,
+					EmojiURL = emojiUrl,
+					DedupeKey = emoji == default ? $"{type}|{avatarId}|{fromActorUri}|{postId}" : $"{type}|{avatarId}|{fromActorUri}|{postId}|{emoji}"
 				}, token);
 			}
 			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)

PrivaPub/Domain/Social/Reactions.cs

@@ -0,0 +1,185 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Inbox;
+using PrivaPub.Federation.Inbox.Handlers;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Globalization;
+using System.Text.Json.Nodes;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Domain.Social
+{
+	public interface IReactions
+	{
+		Task Receive(PostEntity post, ForeignAvatar actor, string content, JsonNode tags, string activityId, CancellationToken token);
+		Task<bool> Withdraw(ForeignAvatar actor, string activityId, string objectUri, string content, CancellationToken token);
+		Task<bool> React(LocalActor me, PostEntity post, string emoji, CancellationToken token);
+		Task<bool> Unreact(LocalActor me, PostEntity post, string emoji, CancellationToken token);
+	}
+
+	public class Reactions : IReactions
+	{
+		static readonly string[] Hearts = { "❤", "❤️", "♥", "♥️" };
+
+		readonly DbEntities _dbEntities;
+		readonly IDeliveryService _delivery;
+
+		public Reactions(DbEntities dbEntities, IDeliveryService delivery)
+		{
+			_dbEntities = dbEntities;
+			_delivery = delivery;
+		}
+
+		public static bool IsHeart(string content) => content == default || Hearts.Contains(content.Trim());
+
+		public async Task Receive(PostEntity post, ForeignAvatar actor, string content, JsonNode tags, string activityId, CancellationToken token)
+		{
+			if (!LikeHandler.MaySee(post, actor) || Normalise(content, ObjectShapes.Emojis(tags)) is not { } emoji)
+			{
+				Arrival.Drop(LikeHandler.MaySee(post, actor) ? "unparseable" : "not-visible");
+				return;
+			}
+			try
+			{
+				await DB.Default.SaveAsync(new Reaction
+				{
+					PostId = post.ID, AccountId = actor.ID, ActorURI = actor.ActorURI, Emoji = emoji.Name, EmojiURL = emoji.Url, ActivityURI = activityId
+				}, token);
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+				Arrival.Drop("duplicate");
+				return;
+			}
+			Arrival.Accept("reaction");
+			if (!post.IsFederatedCopy)
+				await Notifications.Add(post.GroupUserId, NotificationType.Reaction, actor.ID, actor.ActorURI, post.ID, token, emoji.Name, emoji.Url);
+		}
+
+		public async Task<bool> Withdraw(ForeignAvatar actor, string activityId, string objectUri, string content, CancellationToken token)
+		{
+			var reaction = activityId == default
+				? default
+				: await DB.Default.Find<Reaction>().Match(r => r.ActivityURI == activityId && r.ActorURI == actor.ActorURI).ExecuteFirstAsync(token);
+			if (reaction == default && objectUri != default && Normalise(content, new()) is { } emoji)
+			{
+				var post = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri).ExecuteFirstAsync(token);
+				reaction = post == default
+					? default
+					: await DB.Default.Find<Reaction>().Match(r => r.PostId == post.ID && r.ActorURI == actor.ActorURI && r.Emoji == emoji.Name).ExecuteFirstAsync(token);
+			}
+			if (reaction == default)
+				return false;
+			await DB.Default.DeleteAsync<Reaction>(reaction.ID);
+			return true;
+		}
+
+		public async Task<bool> React(LocalActor me, PostEntity post, string emoji, CancellationToken token)
+		{
+			var known = post.Emojis.Select(e => (e.Shortcode, e.URL))
+				.Concat((await DB.Default.Find<Reaction>().Match(r => r.PostId == post.ID && r.EmojiURL != null).ExecuteAsync(token)).Select(r => (r.Emoji, r.EmojiURL)))
+				.Select(e => new Models.Post.CustomEmoji { Shortcode = e.Item1, URL = e.Item2 })
+				.ToList();
+			if (Normalise(emoji, known) is not { } picked)
+				return false;
+			var reaction = new Reaction
+			{
+				PostId = post.ID, AccountId = me.Id, ActorURI = me.Uri, IsLocal = true, Emoji = picked.Name, EmojiURL = picked.Url,
+				ActivityURI = me.ActivityUri($"react-{post.ID}-{Guid.NewGuid():N}")
+			};
+			try
+			{
+				await DB.Default.SaveAsync(reaction, token);
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+				return true;
+			}
+			if (!post.IsFederatedCopy)
+				await Notifications.Add(post.GroupUserId, NotificationType.Reaction, me.Id, me.Uri, post.ID, token, picked.Name, picked.Url);
+			else
+				await Tell(me, post, Activity(me, post, reaction), token);
+			return true;
+		}
+
+		public async Task<bool> Unreact(LocalActor me, PostEntity post, string emoji, CancellationToken token)
+		{
+			var name = Normalise(emoji, post.Emojis.ToList(), requireKnownCustom: false)?.Name;
+			var reaction = name == default
+				? default
+				: await DB.Default.Find<Reaction>().Match(r => r.PostId == post.ID && r.ActorURI == me.Uri && r.Emoji == name).ExecuteFirstAsync(token);
+			if (reaction == default)
+				return false;
+			await DB.Default.DeleteAsync<Reaction>(reaction.ID);
+			if (post.IsFederatedCopy)
+				await Tell(me, post, new JsonObject
+				{
+					["@context"] = ActivityPubRenderer.Context(),
+					["id"] = me.ActivityUri($"undo-{reaction.ID}"),
+					["type"] = "Undo",
+					["actor"] = me.Uri,
+					["object"] = Activity(me, post, reaction)
+				}, token);
+			return true;
+		}
+
+		static JsonObject Activity(LocalActor me, PostEntity post, Reaction reaction)
+		{
+			var react = new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.Context(),
+				["id"] = reaction.ActivityURI,
+				["type"] = "EmojiReact",
+				["actor"] = me.Uri,
+				["object"] = post.ObjectURI,
+				["to"] = new JsonArray(post.ActorURI),
+				["content"] = reaction.EmojiURL == default ? reaction.Emoji : $":{reaction.Emoji}:"
+			};
+			if (reaction.EmojiURL != default)
+				react["tag"] = new JsonArray(new JsonObject
+				{
+					["type"] = "Emoji",
+					["name"] = $":{reaction.Emoji}:",
+					["icon"] = new JsonObject { ["type"] = "Image", ["url"] = reaction.EmojiURL }
+				});
+			return react;
+		}
+
+		async Task Tell(LocalActor me, PostEntity post, JsonObject activity, CancellationToken token)
+		{
+			var author = await _dbEntities.ForeignAvatars.Match(f => f.ActorURI == post.ActorURI).ExecuteFirstAsync(token);
+			if (!string.IsNullOrEmpty(author?.InboxURL))
+				await _delivery.Enqueue(me, new[] { author.InboxURL }, activity, token);
+		}
+
+		public sealed record Picked(string Name, string Url);
+
+		public static Picked Normalise(string content, List<Models.Post.CustomEmoji> emojis, bool requireKnownCustom = true)
+		{
+			var text = content?.Trim();
+			if (string.IsNullOrEmpty(text) || text.Length > 100)
+				return default;
+			if (text.StartsWith(':') && text.EndsWith(':') && text.Length > 2)
+			{
+				var shortcode = text.Trim(':');
+				var bare = shortcode.Split('@')[0];
+				var emoji = emojis.FirstOrDefault(e => e.Shortcode == shortcode) ?? emojis.FirstOrDefault(e => e.Shortcode.Split('@')[0] == bare);
+				if (emoji == default)
+					return requireKnownCustom ? default : new Picked(bare, default);
+				return new Picked(bare, emoji.URL);
+			}
+			if (text.Any(c => c < 128 || char.IsWhiteSpace(c)) || new StringInfo(text).LengthInTextElements != 1)
+				return default;
+			return new Picked(text, default);
+		}
+	}
+}

PrivaPub/Domain/Statuses/PollService.cs

@@ -0,0 +1,281 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Social;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Inbox.Handlers;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Domain.Statuses
+{
+	public sealed record PollDraft(IReadOnlyList<string> Options, int ExpiresIn, bool Multiple, bool HideTotals);
+
+	public interface IPollService
+	{
+		string Invalid(PollDraft draft);
+		PostPoll Create(PollDraft draft);
+		Task Scheduled(PostEntity post, CancellationToken token);
+		Task<StatusOutcome> Vote(LocalActor me, PostEntity post, IReadOnlyList<int> choices, CancellationToken token);
+		Task Receive(PostEntity post, ForeignAvatar voter, string choice, string activityId, CancellationToken token);
+		Task<HashSet<int>> OwnVotes(string postId, string avatarId, CancellationToken token);
+	}
+
+	public class PollService : IPollService
+	{
+		public const int MaxOptions = 4;
+		public const int MaxOptionLength = 50;
+		public const int MinExpiration = 300;
+		public const int MaxExpiration = 2_629_746;
+		static readonly TimeSpan RefreshEvery = TimeSpan.FromMinutes(3);
+
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IDeliveryService _delivery;
+		readonly IJobQueue _queue;
+
+		public PollService(DbEntities dbEntities, ILocalActorService localActors, IDeliveryService delivery, IJobQueue queue)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_delivery = delivery;
+			_queue = queue;
+		}
+
+		public string Invalid(PollDraft draft)
+		{
+			var options = draft.Options.Select(o => o?.Trim()).ToList();
+			if (options.Count is < 2 or > MaxOptions)
+				return $"Validation failed: A poll needs between 2 and {MaxOptions} options";
+			if (options.Any(o => string.IsNullOrEmpty(o) || o.Length > MaxOptionLength))
+				return $"Validation failed: Poll options must be between 1 and {MaxOptionLength} characters";
+			if (options.Distinct(StringComparer.Ordinal).Count() != options.Count)
+				return "Validation failed: Poll options must be unique";
+			if (draft.ExpiresIn is < MinExpiration or > MaxExpiration)
+				return "Validation failed: The poll's duration is out of range";
+			return default;
+		}
+
+		public PostPoll Create(PollDraft draft) => new()
+		{
+			Options = draft.Options.Select(o => new PollOption { Title = o.Trim() }).ToList(),
+			Multiple = draft.Multiple,
+			HideTotals = draft.HideTotals,
+			ExpiresAt = DateTime.UtcNow.AddSeconds(draft.ExpiresIn),
+			VotersCount = 0
+		};
+
+		public async Task Scheduled(PostEntity post, CancellationToken token)
+		{
+			if (post.Poll?.ExpiresAt is not { } ends)
+				return;
+			await _queue.EnqueueMany(new[]
+			{
+				new Job { Kind = JobKind.PollClose, Payload = post.ID, Host = LocalHost, DedupeKey = $"poll-close|{post.ID}", RunAt = ends }
+			}, token);
+		}
+
+		public async Task<StatusOutcome> Vote(LocalActor me, PostEntity post, IReadOnlyList<int> choices, CancellationToken token)
+		{
+			var poll = post.Poll;
+			if (poll == default)
+				return StatusOutcome.Fail(StatusCodes.Status404NotFound, "Record not found");
+			if (Ended(poll))
+				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: The poll has already ended");
+			if (!post.IsFederatedCopy && post.GroupUserId == me.Id)
+				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: You cannot vote in your own poll");
+			var picked = choices.Distinct().ToList();
+			if (picked.Count == 0 || picked.Any(c => c < 0 || c >= poll.Options.Count) || !poll.Multiple && picked.Count > 1)
+				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: The choices are invalid");
+			if (await DB.Default.Find<PollVote>().Match(v => v.PostId == post.ID && v.ActorURI == me.Uri).ExecuteAnyAsync(token))
+				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: You have already voted on this poll");
+
+			foreach (var choice in picked)
+				await DB.Default.SaveAsync(new PollVote
+				{
+					PostId = post.ID, VoterAccountId = me.Id, ActorURI = me.Uri, IsLocalVoter = true, Choice = choice,
+					ActivityURI = me.Uri + $"#votes/{post.ID}/{choice}"
+				}, token);
+			await Count(post, picked, newVoter: true, token);
+
+			if (post.IsFederatedCopy)
+				await SendVotes(me, post, picked, token);
+			else
+				await Refreshed(post, token);
+			await Scheduled(post, token);
+			return new StatusOutcome(await _dbEntities.Posts.MatchID(post.ID).ExecuteFirstAsync(token));
+		}
+
+		public async Task Receive(PostEntity post, ForeignAvatar voter, string choice, string activityId, CancellationToken token)
+		{
+			var poll = post.Poll;
+			if (poll == default || post.IsFederatedCopy || Ended(poll) || !LikeHandler.MaySee(post, voter))
+				return;
+			var index = poll.Options.FindIndex(o => o.Title == choice);
+			if (index < 0)
+				return;
+			var earlier = await DB.Default.Find<PollVote>().Match(v => v.PostId == post.ID && v.ActorURI == voter.ActorURI).ExecuteAsync(token);
+			if (earlier.Count > 0 && (!poll.Multiple || earlier.Any(v => v.Choice == index)))
+				return;
+			try
+			{
+				await DB.Default.SaveAsync(new PollVote
+				{
+					PostId = post.ID, VoterAccountId = voter.ID, ActorURI = voter.ActorURI, Choice = index, ActivityURI = activityId
+				}, token);
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+				return;
+			}
+			await Count(post, new[] { index }, newVoter: earlier.Count == 0, token);
+			await Refreshed(post, token);
+		}
+
+		public async Task<HashSet<int>> OwnVotes(string postId, string avatarId, CancellationToken token) =>
+			avatarId == default
+				? new HashSet<int>()
+				: (await DB.Default.Find<PollVote>().Match(v => v.PostId == postId && v.VoterAccountId == avatarId && v.IsLocalVoter).ExecuteAsync(token))
+					.Select(v => v.Choice).ToHashSet();
+
+		public static bool Ended(PostPoll poll) => poll.ClosedAt.HasValue || poll.ExpiresAt <= DateTime.UtcNow;
+
+		async Task Count(PostEntity post, IReadOnlyList<int> choices, bool newVoter, CancellationToken token)
+		{
+			var update = DB.Default.Update<PostEntity>().MatchID(post.ID);
+			foreach (var choice in choices)
+				update = update.Modify(b => b.Inc($"{nameof(PostEntity.Poll)}.{nameof(PostPoll.Options)}.{choice}.{nameof(PollOption.Votes)}", 1));
+			if (newVoter && post.Poll.VotersCount.HasValue)
+				update = update.Modify(b => b.Inc($"{nameof(PostEntity.Poll)}.{nameof(PostPoll.VotersCount)}", 1));
+			await update.ExecuteAsync(token);
+		}
+
+		async Task SendVotes(LocalActor me, PostEntity post, IReadOnlyList<int> choices, CancellationToken token)
+		{
+			var owner = await _dbEntities.ForeignAvatars.Match(f => f.ActorURI == post.ActorURI).ExecuteFirstAsync(token);
+			if (string.IsNullOrEmpty(owner?.InboxURL))
+				return;
+			foreach (var choice in choices)
+			{
+				var voteId = me.Uri + $"#votes/{post.ID}/{choice}";
+				await _delivery.Enqueue(me, new[] { owner.InboxURL }, new JsonObject
+				{
+					["@context"] = ActivityPubRenderer.ActivityStreams,
+					["id"] = voteId + "/activity",
+					["type"] = "Create",
+					["actor"] = me.Uri,
+					["to"] = new JsonArray(owner.ActorURI),
+					["object"] = new JsonObject
+					{
+						["id"] = voteId,
+						["type"] = "Note",
+						["name"] = post.Poll.Options[choice].Title,
+						["attributedTo"] = me.Uri,
+						["to"] = new JsonArray(owner.ActorURI),
+						["inReplyTo"] = post.ObjectURI
+					}
+				}, token);
+			}
+		}
+
+		async Task Refreshed(PostEntity post, CancellationToken token)
+		{
+			var bucket = DateTime.UtcNow.Ticks / RefreshEvery.Ticks;
+			await _queue.EnqueueMany(new[]
+			{
+				new Job
+				{
+					Kind = JobKind.PollRefresh, Payload = post.ID, Host = LocalHost, DedupeKey = $"poll-refresh|{post.ID}|{bucket}",
+					RunAt = new DateTime((bucket + 1) * RefreshEvery.Ticks, DateTimeKind.Utc)
+				}
+			}, token);
+		}
+
+		string LocalHost => new Uri(_localActors.BaseAddress).Host;
+	}
+
+	public class PollRefreshJob : IJobHandler
+	{
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IOutboxPublisher _outbox;
+
+		public PollRefreshJob(DbEntities dbEntities, ILocalActorService localActors, IOutboxPublisher outbox)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_outbox = outbox;
+		}
+
+		public virtual JobKind Kind => JobKind.PollRefresh;
+		public int Concurrency => 1;
+		public int MaxAttempts => 3;
+		public int PerHostLimit => 1;
+
+		public virtual async Task<JobOutcome> Handle(Job job, CancellationToken token)
+		{
+			var post = await _dbEntities.Posts.MatchID(job.Payload).ExecuteFirstAsync(token);
+			if (post?.Poll == default || post.IsFederatedCopy || post.DeletedAt.HasValue)
+				return JobOutcome.Done;
+			var author = await _localActors.FindById(LocalActorKind.Person, post.GroupUserId, token);
+			if (author == default)
+				return JobOutcome.Done;
+			await Closing(post, author, token);
+			if (!post.IsLocalOnly)
+				await _outbox.Publish(author, post, ActivityPubRenderer.UpdateOf(post, author, $"poll-{DateTime.UtcNow.Ticks}"), token);
+			return JobOutcome.Done;
+		}
+
+		protected virtual Task Closing(PostEntity post, LocalActor author, CancellationToken token) => Task.CompletedTask;
+	}
+
+	public class PollCloseJob : PollRefreshJob
+	{
+		readonly DbEntities _posts;
+
+		public PollCloseJob(DbEntities dbEntities, ILocalActorService localActors, IOutboxPublisher outbox) : base(dbEntities, localActors, outbox)
+		{
+			_posts = dbEntities;
+		}
+
+		public override JobKind Kind => JobKind.PollClose;
+
+		public override async Task<JobOutcome> Handle(Job job, CancellationToken token)
+		{
+			var post = await _posts.Posts.MatchID(job.Payload).ExecuteFirstAsync(token);
+			if (post?.Poll == default || post.DeletedAt.HasValue)
+				return JobOutcome.Done;
+			if (!post.IsFederatedCopy)
+				return await base.Handle(job, token);
+			await Notify(post, post.AuthorAccountId, post.ActorURI, token);
+			return JobOutcome.Done;
+		}
+
+		protected override async Task Closing(PostEntity post, LocalActor author, CancellationToken token)
+		{
+			post.Poll.ClosedAt ??= DateTime.UtcNow;
+			await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(p => p.Poll.ClosedAt, post.Poll.ClosedAt).ExecuteAsync(token);
+			await Notify(post, author.Id, author.Uri, token);
+		}
+
+		public static async Task Notify(PostEntity post, string authorAccountId, string authorUri, CancellationToken token)
+		{
+			var voters = await DB.Default.Find<PollVote>().Match(v => v.PostId == post.ID && v.IsLocalVoter).ExecuteAsync(token);
+			foreach (var voter in voters.Select(v => v.VoterAccountId).Distinct())
+				await Notifications.Add(voter, NotificationType.Poll, authorAccountId, authorUri, post.ID, token);
+			if (!post.IsFederatedCopy)
+				await Notifications.Add(post.GroupUserId, NotificationType.Poll, post.GroupUserId, authorUri, post.ID, token);
+		}
+	}
+}

PrivaPub/Domain/Statuses/QuoteService.cs

@@ -0,0 +1,313 @@
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Social;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Inbox;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.User;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Domain.Statuses
+{
+	public interface IQuoteService
+	{
+		Task Resolve(PostEntity post, NoteDocument note, CancellationToken token);
+		Task Revoke(string stampUri, CancellationToken token);
+		Task<bool> Verified(string stampUri, string quotingUri, PostEntity quoted, CancellationToken token);
+		Task<QuotePermission> Permission(PostEntity quoted, LocalActor author, CancellationToken token);
+		Task<string> Grant(LocalActor author, PostEntity quoted, string quotingUri, string quoterUri, CancellationToken token);
+		Task ReceiveRequest(JsonNode request, ForeignAvatar actor, CancellationToken token);
+		Task<bool> RevokeLicence(PostEntity quoted, PostEntity quoting, CancellationToken token);
+		Task Request(LocalActor author, PostEntity post, PostEntity quoted, JsonObject note, CancellationToken token);
+		Task<bool> Answered(JsonNode answer, ForeignAvatar actor, bool accepted, CancellationToken token);
+	}
+
+	public enum QuotePermission
+	{
+		Denied,
+		Granted,
+		AskFirst
+	}
+
+	public class QuoteService : IQuoteService
+	{
+		readonly DbEntities _dbEntities;
+		readonly IRemoteActorService _remoteActors;
+		readonly IRemotePosts _remotePosts;
+		readonly ILocalActorService _localActors;
+		readonly IDeliveryService _delivery;
+		readonly IOutboxPublisher _outbox;
+
+		public QuoteService(DbEntities dbEntities, IRemoteActorService remoteActors, IRemotePosts remotePosts, ILocalActorService localActors,
+			IDeliveryService delivery, IOutboxPublisher outbox)
+		{
+			_dbEntities = dbEntities;
+			_remoteActors = remoteActors;
+			_remotePosts = remotePosts;
+			_localActors = localActors;
+			_delivery = delivery;
+			_outbox = outbox;
+		}
+
+		const string RequestPrefix = "quote-request-";
+
+		const string LicencePath = "/parrot-licences/";
+
+		public static string LicenceUri(LocalActor author, string licenceId) => author.Uri + LicencePath + licenceId;
+
+		async Task<bool> MayQuote(PostEntity quoted, string quoterUri, CancellationToken token)
+		{
+			var author = await _localActors.FindById(LocalActorKind.Person, quoted.GroupUserId, token);
+			if (author == default)
+				return false;
+			if (quoterUri == author.Uri)
+				return quoted.Visibility is PostVisibility.Public or PostVisibility.Unlisted;
+			return ActivityPubRenderer.QuotableBy(quoted) switch
+			{
+				QuotePolicies.Public => true,
+				QuotePolicies.Followers => await Follows(quoterUri, author, token),
+				_ => false
+			};
+		}
+
+		async Task<bool> Follows(string followerUri, LocalActor author, CancellationToken token)
+		{
+			if (await _dbEntities.Followers.Match(f => f.LocalActorId == author.Id && f.ActorURI == followerUri && f.IsAccepted).ExecuteAnyAsync(token))
+				return true;
+			var local = await _localActors.FindByUri(followerUri, token);
+			return local != default
+				&& await _dbEntities.Followings.Match(f => f.AvatarId == local.Id && f.TargetActorURI == author.Uri && f.State == FollowState.Accepted).ExecuteAnyAsync(token);
+		}
+
+		public async Task<string> Grant(LocalActor author, PostEntity quoted, string quotingUri, string quoterUri, CancellationToken token)
+		{
+			var existing = await DB.Default.Find<QuoteLicence>().Match(l => l.PostId == quoted.ID && l.QuotingObjectURI == quotingUri && l.RevokedAt == null).ExecuteFirstAsync(token);
+			if (existing != default)
+				return LicenceUri(author, existing.ID);
+			var licence = new QuoteLicence { PostId = quoted.ID, AuthorAvatarId = author.Id, QuotingObjectURI = quotingUri, QuoterActorURI = quoterUri };
+			await DB.Default.SaveAsync(licence, token);
+			return LicenceUri(author, licence.ID);
+		}
+
+		public async Task ReceiveRequest(JsonNode request, ForeignAvatar actor, CancellationToken token)
+		{
+			var objectUri = Id(request["object"]);
+			var instrument = request["instrument"];
+			var quotingUri = Id(instrument);
+			if (objectUri == default || quotingUri == default || !Origin.Same(quotingUri, actor.ActorURI)
+				|| instrument is JsonObject embedded && Id(embedded["attributedTo"]) is { } by && by != actor.ActorURI)
+			{
+				Arrival.Drop("misattributed");
+				return;
+			}
+			var quoted = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && !p.IsFederatedCopy && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			var author = quoted == default ? default : await _localActors.FindById(LocalActorKind.Person, quoted.GroupUserId, token);
+			if (author == default || string.IsNullOrEmpty(actor.InboxURL))
+			{
+				Arrival.Drop("unknown-object");
+				return;
+			}
+			Arrival.About("Note", quoted.Visibility, quoted.CreationDate);
+			var answer = new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.Context(),
+				["actor"] = author.Uri,
+				["object"] = Id(request),
+				["to"] = new JsonArray(actor.ActorURI)
+			};
+			if (await MayQuote(quoted, actor.ActorURI, token))
+			{
+				Arrival.Accept("quote-granted");
+				answer["type"] = "Accept";
+				answer["result"] = await Grant(author, quoted, quotingUri, actor.ActorURI, token);
+				answer["id"] = author.ActivityUri($"accept-quote-{Guid.NewGuid():N}");
+			}
+			else
+			{
+				Arrival.Reject("quote-refused");
+				answer["type"] = "Reject";
+				answer["id"] = author.ActivityUri($"reject-quote-{Guid.NewGuid():N}");
+			}
+			await _delivery.Enqueue(author, new[] { actor.InboxURL }, answer, token);
+		}
+
+		public async Task<bool> RevokeLicence(PostEntity quoted, PostEntity quoting, CancellationToken token)
+		{
+			var licence = await DB.Default.Find<QuoteLicence>().Match(l => l.PostId == quoted.ID && l.QuotingObjectURI == quoting.ObjectURI && l.RevokedAt == null).ExecuteFirstAsync(token);
+			var author = licence == default ? default : await _localActors.FindById(LocalActorKind.Person, quoted.GroupUserId, token);
+			if (author == default)
+				return false;
+			await DB.Default.Update<QuoteLicence>().MatchID(licence.ID).Modify(l => l.RevokedAt, DateTime.UtcNow).ExecuteAsync(token);
+			var uri = LicenceUri(author, licence.ID);
+			await Revoke(uri, token);
+			var quoter = quoting.IsFederatedCopy ? await _dbEntities.ForeignAvatars.Match(f => f.ActorURI == quoting.ActorURI).ExecuteFirstAsync(token) : default;
+			var inboxes = (await _delivery.FollowerInboxes(author, token)).Append(quoter?.InboxURL).Where(i => !string.IsNullOrEmpty(i)).Distinct().ToList();
+			if (inboxes.Count > 0)
+				await _delivery.Enqueue(author, inboxes, new JsonObject
+				{
+					["@context"] = ActivityPubRenderer.Context(),
+					["id"] = author.ActivityUri($"revoke-quote-{licence.ID}"),
+					["type"] = "Delete",
+					["actor"] = author.Uri,
+					["object"] = uri,
+					["to"] = new JsonArray(Addressing.Public)
+				}, token);
+			return true;
+		}
+
+		async Task<bool> OurLicence(string stampUri, PostEntity quoting, PostEntity quoted, CancellationToken token)
+		{
+			var marker = stampUri?.LastIndexOf(LicencePath, StringComparison.Ordinal) ?? -1;
+			if (marker < 0 || !stampUri.StartsWith(_localActors.BaseAddress + "/", StringComparison.OrdinalIgnoreCase))
+				return false;
+			var id = stampUri[(marker + LicencePath.Length)..];
+			return await DB.Default.Find<QuoteLicence>().Match(l => l.ID == id && l.PostId == quoted.ID && l.QuotingObjectURI == quoting.ObjectURI && l.RevokedAt == null)
+				.ExecuteAnyAsync(token);
+		}
+
+		public async Task<QuotePermission> Permission(PostEntity quoted, LocalActor author, CancellationToken token)
+		{
+			if (!quoted.IsFederatedCopy)
+				return await MayQuote(quoted, author.Uri, token) ? QuotePermission.Granted : QuotePermission.Denied;
+			if (quoted.Visibility is not (PostVisibility.Public or PostVisibility.Unlisted))
+				return QuotePermission.Denied;
+			if (quoted.QuotePolicy is not { } policy)
+				return QuotePermission.Granted;
+			return policy.Automatic.Concat(policy.Manual).Any(Addressing.IsPublic) || policy.Automatic.Concat(policy.Manual).Contains(author.Uri)
+				? QuotePermission.AskFirst
+				: QuotePermission.Denied;
+		}
+
+		public async Task Request(LocalActor author, PostEntity post, PostEntity quoted, JsonObject note, CancellationToken token)
+		{
+			var owner = await _dbEntities.ForeignAvatars.Match(f => f.ActorURI == quoted.ActorURI).ExecuteFirstAsync(token);
+			if (string.IsNullOrEmpty(owner?.InboxURL))
+				return;
+			await _delivery.Enqueue(author, new[] { owner.InboxURL }, new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.Context(),
+				["id"] = author.ActivityUri(RequestPrefix + post.ID),
+				["type"] = "QuoteRequest",
+				["actor"] = author.Uri,
+				["object"] = quoted.ObjectURI,
+				["instrument"] = note.DeepClone(),
+				["to"] = new JsonArray(quoted.ActorURI)
+			}, token);
+		}
+
+		public async Task<bool> Answered(JsonNode answer, ForeignAvatar actor, bool accepted, CancellationToken token)
+		{
+			var request = answer["object"];
+			var requestId = Id(request);
+			var marker = requestId?.LastIndexOf("/grunts/" + RequestPrefix, StringComparison.Ordinal) ?? -1;
+			if (marker < 0 && !(request is JsonObject && Value(request, "type") == "QuoteRequest"))
+				return false;
+			if (marker < 0)
+				return true;
+			var postId = requestId[(marker + "/grunts/".Length + RequestPrefix.Length)..];
+			var post = await _dbEntities.Posts.Match(p => p.ID == postId && !p.IsFederatedCopy && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			var author = post == default ? default : await _localActors.FindById(LocalActorKind.Person, post.GroupUserId, token);
+			if (author == default || author.ActivityUri(RequestPrefix + post.ID) != requestId || post.QuoteState != QuoteState.Pending)
+				return true;
+			var quoted = await _dbEntities.Posts.MatchID(post.QuotedPostId).ExecuteFirstAsync(token);
+			if (quoted?.ActorURI != actor.ActorURI)
+				return true;
+			if (!accepted)
+			{
+				await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(p => p.QuoteState, QuoteState.Rejected).ExecuteAsync(token);
+				return true;
+			}
+			var stamp = Id(answer["result"]);
+			if (stamp == default || !await Verified(stamp, post.ObjectURI, quoted, token))
+				return true;
+			post.QuoteAuthorizationURI = stamp;
+			post.QuoteState = QuoteState.Accepted;
+			await DB.Default.Update<PostEntity>().MatchID(post.ID)
+				.Modify(p => p.QuoteAuthorizationURI, stamp)
+				.Modify(p => p.QuoteState, QuoteState.Accepted)
+				.ExecuteAsync(token);
+			await DB.Default.Update<PostEntity>().MatchID(quoted.ID).Modify(b => b.Inc(p => p.QuotesCount, 1)).ExecuteAsync(token);
+			if (!post.IsLocalOnly)
+				await _outbox.Publish(author, post, ActivityPubRenderer.UpdateOf(post, author, "quote-approved"), token);
+			return true;
+		}
+
+		public async Task Resolve(PostEntity post, NoteDocument note, CancellationToken token)
+		{
+			if (note.QuoteUri == default && !note.QuoteDeleted)
+				return;
+			var quoted = note.QuoteUri == default
+				? default
+				: await _dbEntities.Posts.Match(p => p.ObjectURI == note.QuoteUri && !p.DeletedAt.HasValue).ExecuteFirstAsync(token)
+					?? await _remotePosts.StoreContext(note.QuoteUri, RemotePosts.MaxDepth, token);
+
+			var state = note.QuoteDeleted ? QuoteState.Deleted
+				: quoted == default ? QuoteState.Pending
+				: note.QuoteAuthorization != default
+					? (quoted.IsFederatedCopy ? await Verified(note.QuoteAuthorization, post.ObjectURI, quoted, token) : await OurLicence(note.QuoteAuthorization, post, quoted, token))
+						? QuoteState.Accepted
+						: QuoteState.Unauthorized
+				: note.QuotesByConsent ? QuoteState.Pending
+				: quoted.Visibility is PostVisibility.Public or PostVisibility.Unlisted ? QuoteState.Accepted
+				: QuoteState.Unauthorized;
+
+			var wasCounted = post.QuoteState == QuoteState.Accepted ? post.QuotedPostId : default;
+			await DB.Default.Update<PostEntity>().MatchID(post.ID)
+				.Modify(p => p.QuoteURI, note.QuoteUri)
+				.Modify(p => p.QuotedPostId, quoted?.ID)
+				.Modify(p => p.QuoteState, state)
+				.Modify(p => p.QuoteAuthorizationURI, state == QuoteState.Accepted ? note.QuoteAuthorization : default)
+				.ExecuteAsync(token);
+			post.QuotedPostId = quoted?.ID;
+			post.QuoteState = state;
+
+			var nowCounted = state == QuoteState.Accepted ? quoted?.ID : default;
+			if (wasCounted == nowCounted)
+				return;
+			if (wasCounted != default)
+				await DB.Default.Update<PostEntity>().MatchID(wasCounted).Modify(b => b.Inc(p => p.QuotesCount, -1)).ExecuteAsync(token);
+			if (nowCounted != default)
+			{
+				await DB.Default.Update<PostEntity>().MatchID(nowCounted).Modify(b => b.Inc(p => p.QuotesCount, 1)).ExecuteAsync(token);
+				if (!quoted.IsFederatedCopy)
+					await Notifications.Add(quoted.GroupUserId, NotificationType.Quote, post.AuthorAccountId, post.ActorURI, post.ID, token);
+			}
+		}
+
+		public async Task Revoke(string stampUri, CancellationToken token)
+		{
+			var revoked = await _dbEntities.Posts.Match(p => p.QuoteAuthorizationURI == stampUri && p.QuoteState == QuoteState.Accepted).ExecuteAsync(token);
+			foreach (var post in revoked)
+			{
+				await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(p => p.QuoteState, QuoteState.Revoked).ExecuteAsync(token);
+				if (post.QuotedPostId != default)
+					await DB.Default.Update<PostEntity>().MatchID(post.QuotedPostId).Modify(b => b.Inc(p => p.QuotesCount, -1)).ExecuteAsync(token);
+			}
+		}
+
+		public async Task<bool> Verified(string stampUri, string quotingUri, PostEntity quoted, CancellationToken token)
+		{
+			if (!Origin.Same(stampUri, quoted.ActorURI))
+				return false;
+			using var fetched = await _remoteActors.FetchObject(stampUri, token);
+			if (fetched == default)
+				return false;
+			var stamp = JsonNode.Parse(fetched.Root.GetRawText());
+			return Value(stamp, "type") == "QuoteAuthorization"
+				&& Id(stamp["attributedTo"]) == quoted.ActorURI
+				&& Id(stamp["interactingObject"]) == quotingUri
+				&& Id(stamp["interactionTarget"]) == quoted.ObjectURI;
+		}
+	}
+}

PrivaPub/Domain/Statuses/StatusService.cs

@@ -13,6 +13,7 @@ using PrivaPub.Models.Federation;
 using PrivaPub.Models.Group;
 using PrivaPub.Models.Media;
 using PrivaPub.Models.Post;
+using PrivaPub.Models.User;
 using PrivaPub.Models.Social;
 using PrivaPub.StaticServices;
 
@@ -36,6 +37,12 @@ namespace PrivaPub.Domain.Statuses
 		public string ConversationId { get; init; }
 		public IReadOnlyList<string> Recipients { get; init; } = Array.Empty<string>();
 		public IReadOnlyList<string> MediaIds { get; init; }
+		public double? Latitude { get; init; }
+		public double? Longitude { get; init; }
+		public double? RangeKm { get; init; }
+		public PollDraft Poll { get; init; }
+		public string QuotedStatusId { get; init; }
+		public string QuotePolicy { get; init; }
 	}
 
 	public sealed record StatusOutcome(PostEntity Post, int Status = StatusCodes.Status200OK, string Error = default)
@@ -65,11 +72,20 @@ namespace PrivaPub.Domain.Statuses
 		readonly IOutboxPublisher _outbox;
 		readonly IFanout _fanout;
 		readonly IMediaService _media;
+		readonly IGroupDistributor _groups;
+		readonly IPollService _polls;
+		readonly ILinkPreviews _previews;
+		readonly IQuoteService _quotes;
 
 		public StatusService(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDeliveryService delivery,
-			IContentRenderer content, IOutboxPublisher outbox, IFanout fanout, IMediaService media)
+			IContentRenderer content, IOutboxPublisher outbox, IFanout fanout, IMediaService media, IGroupDistributor groups, IPollService polls,
+			ILinkPreviews previews, IQuoteService quotes)
 		{
+			_previews = previews;
+			_quotes = quotes;
+			_polls = polls;
 			_media = media;
+			_groups = groups;
 			_dbEntities = dbEntities;
 			_localActors = localActors;
 			_remoteActors = remoteActors;
@@ -84,14 +100,16 @@ namespace PrivaPub.Domain.Statuses
 			var media = await Media(author, draft.MediaIds, default, token);
 			if (media == default)
 				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: Media attachments are invalid");
-			if (string.IsNullOrWhiteSpace(draft.Text) && media.Count == 0)
+			if (string.IsNullOrWhiteSpace(draft.Text) && media.Count == 0 && draft.Poll == default)
 				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: Text can't be blank");
+			if (draft.Poll != default && _polls.Invalid(draft.Poll) is { } invalidPoll)
+				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, invalidPoll);
 
 			LocalActor group = default;
 			if (!string.IsNullOrEmpty(draft.GroupId))
 			{
 				var groupEntity = await _dbEntities.Groups.MatchID(draft.GroupId).ExecuteFirstAsync(token);
-				if (groupEntity == default || groupEntity.DeletionAt.HasValue || !groupEntity.Members.Any(m => !m.IsForeign && m.AvatarId == author.Id))
+				if (groupEntity == default || groupEntity.DeletionAt.HasValue || !await MayPost(groupEntity, author, token))
 					return StatusOutcome.Fail(StatusCodes.Status404NotFound, "Group not found");
 				group = _localActors.FromGroup(groupEntity);
 			}
@@ -102,9 +120,47 @@ namespace PrivaPub.Domain.Statuses
 			if (parent != default && !await VisibilityPolicy.CanSee(parent, author.Id, token))
 				return StatusOutcome.Fail(StatusCodes.Status404NotFound, "Record not found");
 
+			PostEntity quoted = default;
+			var quotePermission = QuotePermission.Denied;
+			if (!string.IsNullOrEmpty(draft.QuotedStatusId))
+			{
+				quoted = await _dbEntities.Posts.Match(p => p.ID == draft.QuotedStatusId && !p.DeletedAt.HasValue && p.ReblogOfPostId == null).ExecuteFirstAsync(token);
+				if (quoted == default || !await VisibilityPolicy.CanSee(quoted, author.Id, token))
+					return StatusOutcome.Fail(StatusCodes.Status404NotFound, "Record not found");
+				quotePermission = await _quotes.Permission(quoted, author, token);
+				if (quotePermission == QuotePermission.Denied)
+					return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: This post cannot be quoted");
+			}
+
+			var located = draft.Latitude.HasValue || draft.Longitude.HasValue;
+			if (located && (draft.Latitude is not (>= -90 and <= 90) || draft.Longitude is not (>= -180 and <= 180) || group != default
+				|| draft.Visibility == PostVisibility.Direct))
+				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: A located post needs a valid position and no group or recipients");
+
 			var rendered = draft.PlainText ? await _content.PlainText(draft.Text ?? string.Empty, token) : await _content.Markdown(draft.Text ?? string.Empty, token);
-			var isLocalOnly = group is { IsFederated: false };
-			var visibility = isLocalOnly ? PostVisibility.Circle : draft.Visibility is PostVisibility.Circle or PostVisibility.LocalGeo ? PostVisibility.Public : draft.Visibility;
+			string audienceUri = default;
+			if (group == default && !located && draft.Visibility is PostVisibility.Public or PostVisibility.Unlisted)
+				foreach (var mention in rendered.Mentions)
+				{
+					if (mention.IsLocal)
+					{
+						var mentioned = await _dbEntities.Groups.MatchID(mention.AccountId).ExecuteFirstAsync(token);
+						if (mentioned is { DeletionAt: null, Kind: GroupKind.Community } && await MayPost(mentioned, author, token))
+						{
+							group = _localActors.FromGroup(mentioned);
+							break;
+						}
+					}
+					else if (await _dbEntities.ForeignAvatars.MatchID(mention.AccountId).ExecuteFirstAsync(token) is { AvatarType: Models.User.AvatarType.Group } remoteGroup)
+					{
+						audienceUri = remoteGroup.ActorURI;
+						break;
+					}
+				}
+			var isLocalOnly = located;
+			var visibility = located ? PostVisibility.LocalGeo
+				: group is { IsCircle: true } ? PostVisibility.Circle
+				: draft.Visibility is PostVisibility.Circle or PostVisibility.LocalGeo ? PostVisibility.Public : draft.Visibility;
 			var post = new PostEntity
 			{
 				GroupUserId = author.Id,
@@ -121,15 +177,30 @@ namespace PrivaPub.Domain.Statuses
 				Mentions = rendered.Mentions.Select(ToMention).ToList(),
 				Tags = rendered.Tags.ToList(),
 				Media = media.Select(ToPostMedia).ToList(),
+				AudienceURI = audienceUri,
 				AnsweringToPostId = parent?.ID,
 				InReplyToURI = parent?.ObjectURI ?? (IsRemoteUri(draft.InReplyTo) ? draft.InReplyTo : default),
 				InReplyToAccountId = parent?.AuthorAccountId ?? parent?.GroupUserId,
 				IsLocalOnly = isLocalOnly,
-				ActorURI = author.Uri
+				ActorURI = author.Uri,
+				Poll = draft.Poll == default ? default : _polls.Create(draft.Poll),
+				QuoteURI = quoted?.ObjectURI,
+				QuotedPostId = quoted?.ID,
+				QuoteByConsent = quoted != default && (quoted.QuotePolicy != default || !quoted.IsFederatedCopy),
+				QuoteState = quoted == default ? QuoteState.None : quotePermission == QuotePermission.Granted ? QuoteState.Accepted : QuoteState.Pending
 			};
 			post.ID = (string)post.GenerateNewID();
 			post.ObjectURI = author.PostUri(post.ID);
 			post.Url = author.PostHtmlUrl(post.ID);
+			post.LocalQuotePolicy = QuotePolicies.IsKnown(draft.QuotePolicy) ? draft.QuotePolicy : author.Settings.QuotePolicy ?? QuotePolicies.Public;
+			if (quoted is { IsFederatedCopy: false } && post.QuoteState == QuoteState.Accepted
+				&& await _localActors.FindById(LocalActorKind.Person, quoted.GroupUserId, token) is { } quotedAuthor)
+				post.QuoteAuthorizationURI = await _quotes.Grant(quotedAuthor, quoted, post.ObjectURI, author.Uri, token);
+			if (located)
+			{
+				post.Geo = new Coordinates2D(Math.Round(draft.Longitude.Value, 2), Math.Round(draft.Latitude.Value, 2));
+				post.RangeKm = (float)Math.Clamp(draft.RangeKm ?? 5, 1, 50);
+			}
 
 			JsonObject create = default;
 			if (visibility == PostVisibility.Direct)
@@ -163,10 +234,16 @@ namespace PrivaPub.Domain.Statuses
 			if (parent != default)
 				await DB.Default.Update<PostEntity>().MatchID(parent.ID).Modify(b => b.Inc(p => p.RepliesCount, 1)).ExecuteAsync(token);
 			await _fanout.Distribute(post, token);
+			await _polls.Scheduled(post, token);
+			if (post.QuoteState == QuoteState.Accepted)
+				await DB.Default.Update<PostEntity>().MatchID(quoted.ID).Modify(b => b.Inc(p => p.QuotesCount, 1)).ExecuteAsync(token);
+			if (post.QuoteState == QuoteState.Pending && create?["object"] is JsonObject quotingNote)
+				await _quotes.Request(author, post, quoted, quotingNote, token);
+			await _previews.Wanted(post, token);
 			if (create != default)
 				await _outbox.Publish(author, post, create, token);
-			if (group is { IsFederated: true } && visibility is PostVisibility.Public or PostVisibility.Unlisted)
-				await _delivery.EnqueueToFollowers(group, ActivityPubRenderer.Announce(group, post.ObjectURI, $"announce-{post.ID}"), token);
+			if (create != default && group is { IsCircle: false } && visibility is PostVisibility.Public or PostVisibility.Unlisted)
+				await _groups.Announce(group, create, post.ObjectURI, isNewPost: string.IsNullOrEmpty(post.InReplyToURI), token);
 			return new StatusOutcome(post);
 		}
 
@@ -232,6 +309,8 @@ namespace PrivaPub.Domain.Statuses
 					["object"] = note
 				};
 				await _outbox.Publish(author, post, update, token);
+				if (group is { IsCircle: false })
+					await _groups.Announce(group, update, post.ObjectURI, isNewPost: false, token);
 			}
 			return new StatusOutcome(post);
 		}
@@ -262,6 +341,9 @@ namespace PrivaPub.Domain.Statuses
 				var delete = ActivityPubRenderer.Delete(author, post.ObjectURI, $"delete-{post.ID}",
 					new JsonArray(post.To.Select(t => (JsonNode)t).ToArray()), new JsonArray(post.Cc.Select(c => (JsonNode)c).ToArray()));
 				await _delivery.Enqueue(author, audience, delete, token);
+				var group = string.IsNullOrEmpty(post.GroupId) ? default : await _localActors.FindById(LocalActorKind.Group, post.GroupId, token);
+				if (group is { IsCircle: false })
+					await _groups.Announce(group, delete, post.ObjectURI, isNewPost: false, token);
 			}
 			return new StatusOutcome(post);
 		}
@@ -479,6 +561,20 @@ namespace PrivaPub.Domain.Statuses
 			return (await _dbEntities.ForeignAvatars.MatchID(post.AuthorAccountId).ExecuteFirstAsync(token))?.InboxURL;
 		}
 
+		async Task<bool> MayPost(Models.Group.Group group, LocalActor author, CancellationToken token)
+		{
+			var member = group.Members.FirstOrDefault(m => !m.IsForeign && m.AvatarId == author.Id);
+			if (group.Kind == GroupKind.Circle)
+				return member != default;
+			return group.PostingPolicy switch
+			{
+				PostingPolicy.Anyone => true,
+				PostingPolicy.Moderators => member?.Role is GroupRole.Owner or GroupRole.Moderator,
+				_ => member != default || await _dbEntities.Followings
+					.Match(f => f.AvatarId == author.Id && f.TargetAccountId == group.ID && f.State == FollowState.Accepted).ExecuteAnyAsync(token)
+			};
+		}
+
 		async Task<List<MediaAttachment>> Media(LocalActor author, IReadOnlyList<string> ids, string postId, CancellationToken token)
 		{
 			if (ids == default || ids.Count == 0)

PrivaPub/Domain/Timelines/Fanout.cs

@@ -40,6 +40,9 @@ namespace PrivaPub.Domain.Timelines
 					foreach (var following in followers)
 						if (await Shows(following, post, token))
 							recipients.Add(following.AvatarId);
+					if (!string.IsNullOrEmpty(post.AudienceURI))
+						foreach (var member in await _dbEntities.Followings.Match(f => f.TargetActorURI == post.AudienceURI && f.State == FollowState.Accepted).ExecuteAsync(token))
+							recipients.Add(member.AvatarId);
 					break;
 				case PostVisibility.Direct when !string.IsNullOrEmpty(post.ConversationId):
 					var conversation = await _dbEntities.DmGroups.MatchID(post.ConversationId).ExecuteFirstAsync(token);

PrivaPub/Federation/Actors/ActorDocument.cs

@@ -1,6 +1,9 @@
+using System.Globalization;
 using System.Text.Json;
+using System.Text.Json.Nodes;
 
 using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
 
 namespace PrivaPub.Federation.Actors
 {
@@ -23,7 +26,18 @@ namespace PrivaPub.Federation.Actors
 		public string SharedInbox { get; init; }
 		public string Icon { get; init; }
 		public bool Discoverable { get; init; } = true;
+		public bool Indexable { get; init; }
+		public bool Locked { get; init; }
+		public bool Memorial { get; init; }
+		public string Header { get; init; }
+		public string IconDescription { get; init; }
+		public string HeaderDescription { get; init; }
+		public string MovedTo { get; init; }
+		public DateTime? Published { get; init; }
+		public List<CustomEmoji> Emojis { get; init; } = new();
+		public Dictionary<string, string> Fields { get; init; } = new();
 		public IReadOnlyList<ActorKey> Keys { get; init; } = Array.Empty<ActorKey>();
+		public List<string> Features { get; init; } = new();
 
 		public ActorKey Key(string keyId) => Keys.FirstOrDefault(k => k.Id == keyId);
 
@@ -41,6 +55,7 @@ namespace PrivaPub.Federation.Actors
 			{
 				Id = id,
 				Type = type,
+				Features = ActorFeatures.Detect(root),
 				PreferredUsername = RemoteActorService.Text(root, "preferredUsername"),
 				Name = RemoteActorService.Text(root, "name"),
 				Summary = RemoteActorService.Text(root, "summary"),
@@ -52,10 +67,46 @@ namespace PrivaPub.Federation.Actors
 				SharedInbox = root.TryGetProperty("endpoints", out var endpoints) ? RemoteActorService.Text(endpoints, "sharedInbox") : default,
 				Icon = root.TryGetProperty("icon", out var icon) ? RemoteActorService.Text(icon, "url") : default,
 				Discoverable = !root.TryGetProperty("discoverable", out var discoverable) || discoverable.ValueKind != JsonValueKind.False,
-				Keys = ParseKeys(root, id)
+				Keys = ParseKeys(root, id),
+				Indexable = Flag(root, "indexable"),
+				Locked = Flag(root, "manuallyApprovesFollowers"),
+				Memorial = Flag(root, "memorial"),
+				Header = root.TryGetProperty("image", out var image) ? ObjectShapes.Image(JsonNode.Parse(image.GetRawText())) : default,
+				IconDescription = root.TryGetProperty("icon", out var described) ? Alt(described) : default,
+				HeaderDescription = root.TryGetProperty("image", out var headerImage) ? Alt(headerImage) : default,
+				MovedTo = RemoteActorService.Text(root, "movedTo"),
+				Published = DateTimeOffset.TryParse(RemoteActorService.Text(root, "published"), CultureInfo.InvariantCulture, DateTimeStyles.AssumeUniversal, out var published)
+					? published.UtcDateTime
+					: default(DateTime?),
+				Emojis = root.TryGetProperty("tag", out var tags) ? ObjectShapes.Emojis(JsonNode.Parse(tags.GetRawText())) : new(),
+				Fields = root.TryGetProperty("attachment", out var attachment) ? ParseFields(JsonNode.Parse(attachment.GetRawText())) : new()
 			};
 		}
 
+		const int MaxFields = 16;
+
+		static bool Flag(JsonElement root, string property) =>
+			root.TryGetProperty(property, out var value) && value.ValueKind == JsonValueKind.True;
+
+		static string Alt(JsonElement image) =>
+			image.ValueKind == JsonValueKind.Object ? ObjectShapes.Text(RemoteActorService.Text(image, "name") ?? RemoteActorService.Text(image, "summary"), 1500) : default;
+
+		static Dictionary<string, string> ParseFields(JsonNode attachment)
+		{
+			var fields = new Dictionary<string, string>();
+			foreach (var field in ObjectShapes.Objects(attachment).Where(a => ActivityJson.Value(a, "type") is "PropertyValue" or "Note"))
+			{
+				var name = ObjectShapes.Text(ActivityJson.Value(field, "name"), 255);
+				var value = ActivityJson.Value(field, "value") ?? ActivityJson.Value(field, "content");
+				if (name == default || value == default || fields.ContainsKey(name))
+					continue;
+				fields[name] = ContentSanitizer.Html(value.Length <= 2048 ? value : value[..2048]);
+				if (fields.Count == MaxFields)
+					break;
+			}
+			return fields;
+		}
+
 		static List<ActorKey> ParseKeys(JsonElement root, string actorId)
 		{
 			var keys = new List<ActorKey>();

PrivaPub/Federation/Actors/ActorFeatures.cs

@@ -0,0 +1,72 @@
+using System.Security.Cryptography;
+using System.Text.Json;
+
+namespace PrivaPub.Federation.Actors
+{
+	public static class ActorFeatures
+	{
+		public static List<string> Detect(JsonElement root)
+		{
+			var found = new List<string>();
+			if (root.ValueKind != JsonValueKind.Object)
+				return found;
+			void When(bool condition, string feature)
+			{
+				if (condition)
+					found.Add(feature);
+			}
+			bool Has(string name) => root.TryGetProperty(name, out var value) && value.ValueKind is not (JsonValueKind.Null or JsonValueKind.Undefined);
+			bool True(string name) => root.TryGetProperty(name, out var value) && value.ValueKind == JsonValueKind.True;
+			IEnumerable<JsonElement> Items(string name) => !root.TryGetProperty(name, out var value)
+				? Enumerable.Empty<JsonElement>()
+				: value.ValueKind == JsonValueKind.Array ? value.EnumerateArray() : new[] { value };
+			bool Typed(JsonElement item, string type) =>
+				item.ValueKind == JsonValueKind.Object && item.TryGetProperty("type", out var t) && t.ValueKind == JsonValueKind.String && t.GetString() == type;
+
+			When(Has("featured"), "featured");
+			When(Has("featuredTags"), "featured-tags");
+			When(Items("alsoKnownAs").Any(), "also-known-as");
+			When(Has("movedTo"), "moved-to");
+			When(root.TryGetProperty("endpoints", out var endpoints) && endpoints.ValueKind == JsonValueKind.Object && endpoints.TryGetProperty("sharedInbox", out _), "shared-inbox");
+			When(Has("assertionMethod"), "fep-521a-assertion-method");
+			When(Has("proof"), "fep-8b32-proof");
+			When(Items("attachment").Any(a => Typed(a, "PropertyValue")), "property-value");
+			When(Items("attachment").Any(a => Typed(a, "VerifiableIdentityStatement") || Typed(a, "IdentityProof")), "fep-c390-identity-proof");
+			When(Items("tag").Any(t => Typed(t, "Emoji")), "custom-emoji");
+			When(root.EnumerateObject().Any(p => p.Name.StartsWith("_misskey", StringComparison.Ordinal)), "misskey");
+			When(True("isCat"), "is-cat");
+			When(Has("webfinger"), "fep-2c59-webfinger");
+			When(Has("attributionDomains"), "attribution-domains");
+			When(Has("searchableBy"), "fep-268d-searchable-by");
+			When(True("indexable"), "indexable");
+			When(root.TryGetProperty("discoverable", out var discoverable) && discoverable.ValueKind == JsonValueKind.False, "undiscoverable");
+			When(True("manuallyApprovesFollowers"), "locked");
+			When(True("memorial"), "memorial");
+			When(Has("generator"), "generator");
+			When(root.TryGetProperty("publicKey", out var keys) && keys.ValueKind == JsonValueKind.Array, "public-key-array");
+			if (KeyBits(root) is { } bits)
+				found.Add($"key:rsa-{bits}");
+			return found;
+		}
+
+		static int? KeyBits(JsonElement root)
+		{
+			if (!root.TryGetProperty("publicKey", out var key))
+				return default;
+			if (key.ValueKind == JsonValueKind.Array)
+				key = key.EnumerateArray().FirstOrDefault(k => k.ValueKind == JsonValueKind.Object);
+			if (key.ValueKind != JsonValueKind.Object || !key.TryGetProperty("publicKeyPem", out var pem) || pem.ValueKind != JsonValueKind.String)
+				return default;
+			try
+			{
+				using var rsa = RSA.Create();
+				rsa.ImportFromPem(pem.GetString());
+				return rsa.KeySize;
+			}
+			catch (Exception ex) when (ex is ArgumentException or CryptographicException)
+			{
+				return default;
+			}
+		}
+	}
+}

PrivaPub/Federation/Actors/LocalActorService.cs

@@ -29,6 +29,8 @@ namespace PrivaPub.Federation.Actors
 		public bool Discoverable { get; init; } = true;
 		public bool ManuallyApprovesFollowers { get; init; }
 		public bool IsFederated { get; init; } = true;
+		public bool IsCircle { get; init; }
+		public bool PostingRestrictedToModerators { get; init; }
 		public bool IsBot { get; init; }
 		public bool Indexable { get; init; }
 		public AvatarSettings Settings { get; init; } = new();
@@ -44,6 +46,8 @@ namespace PrivaPub.Federation.Actors
 		public string Following => $"{Uri}/stalking";
 		public string Featured => $"{Uri}/trophies";
 		public string FeaturedTags => $"{Uri}/tattoos";
+		public string Flock => $"{Uri}/flock";
+		public string Wardens => $"{Uri}/wardens";
 		public string SharedInbox => $"{BaseAddress}/human-centipede";
 		public string Domain => new Uri(BaseAddress).Authority;
 		public string Handle => $"{UserName}@{Domain}";
@@ -198,7 +202,7 @@ namespace PrivaPub.Federation.Actors
 			ThumbnailURL = avatar.ThumbnailURL,
 			PrivateKeyPem = avatar.PrivateKey,
 			PublicKeyPem = avatar.PublicKey,
-			Published = avatar.CreatedAt,
+			Published = avatar.PublishedOn,
 			Fields = avatar.Fields ?? new Dictionary<string, string>(),
 			ManuallyApprovesFollowers = avatar.Settings?.IsLocked == true,
 			Discoverable = avatar.Settings?.IsDiscoverable != false,
@@ -219,10 +223,11 @@ namespace PrivaPub.Federation.Actors
 			ThumbnailURL = group.ThumbnailURL,
 			PrivateKeyPem = group.PrivateKey,
 			PublicKeyPem = group.PublicKey,
-			Discoverable = group.IsDiscoverable,
-			ManuallyApprovesFollowers = group.ManuallyApprovesMembers,
-			IsFederated = group.Kind == GroupKind.Community,
-			Published = group.CreationDate,
+			Discoverable = group.Kind == GroupKind.Community && group.IsDiscoverable,
+			ManuallyApprovesFollowers = group.Kind == GroupKind.Circle || group.ManuallyApprovesMembers,
+			IsCircle = group.Kind == GroupKind.Circle,
+			PostingRestrictedToModerators = group.PostingPolicy == PostingPolicy.Moderators,
+			Published = group.PublishedOn,
 			BaseAddress = BaseAddress
 		};
 	}

PrivaPub/Federation/Actors/RemoteActorService.cs

@@ -6,6 +6,7 @@ using PrivaPub.StaticServices;
 using System.Text.Json;
 
 using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Options;
 
 using PrivaPub.Federation.Objects;
 using PrivaPub.Federation.Signing;
@@ -18,6 +19,7 @@ namespace PrivaPub.Federation.Actors
 		Task<FetchedJson> FetchObject(string uri, CancellationToken token);
 		Task<ForeignAvatar> GetActor(string actorUri, bool refresh, CancellationToken token);
 		Task<ForeignAvatar> GetActorByKeyId(string keyId, bool refresh, CancellationToken token);
+		bool KeyTemporarilyUnavailable(string keyId) => false;
 		Task<string> ResolveHandle(string handle, CancellationToken token);
 	}
 
@@ -32,17 +34,21 @@ namespace PrivaPub.Federation.Actors
 		readonly ILocalActorService _localActors;
 		readonly IMemoryCache _cache;
 		readonly DbEntities _dbEntities;
+		readonly IOptionsMonitor<FederationOptions> _options;
 
-		public RemoteActorService(IFederationHttp http, ILocalActorService localActors, IMemoryCache cache, DbEntities dbEntities)
+		public RemoteActorService(IFederationHttp http, ILocalActorService localActors, IMemoryCache cache, DbEntities dbEntities,
+			IOptionsMonitor<FederationOptions> options = default)
 		{
 			_http = http;
 			_localActors = localActors;
 			_cache = cache;
 			_dbEntities = dbEntities;
+			_options = options;
 		}
 
 		public async Task<FetchedJson> FetchObject(string uri, CancellationToken token)
 		{
+			using var scope = HttpScope.Default("object");
 			var signer = await _localActors.GetInstanceActor(token);
 			var fetched = await Get(uri, signer, token);
 			if (fetched == default)
@@ -76,6 +82,7 @@ namespace PrivaPub.Federation.Actors
 			if (!MayFetch(actorUri))
 				return cached;
 
+			using var scope = HttpScope.For("actor");
 			using var fetched = await FetchObject(actorUri, token);
 			var actor = fetched == default ? default : ActorDocument.Parse(fetched.Root);
 			if (actor == default)
@@ -96,6 +103,7 @@ namespace PrivaPub.Federation.Actors
 			if (!MayFetch(keyId))
 				return cached;
 
+			using var scope = HttpScope.For("key");
 			using var fetched = await FetchObject(StripFragment(keyId), token);
 			if (fetched == default)
 				return cached;
@@ -116,14 +124,20 @@ namespace PrivaPub.Federation.Actors
 			return await Upsert(actor, key, token);
 		}
 
+		public bool KeyTemporarilyUnavailable(string keyId) => Origin.Of(keyId) != default && _http.FailedTemporarily(StripFragment(keyId));
+
 		public async Task<string> ResolveHandle(string handle, CancellationToken token)
 		{
 			var parts = handle?.TrimStart('@').Split('@');
 			if (parts is not { Length: 2 } || string.IsNullOrEmpty(parts[0]) || string.IsNullOrEmpty(parts[1]))
 				return default;
 
-			var url = $"https://{parts[1]}/.well-known/webfinger?resource={Uri.EscapeDataString($"acct:{parts[0]}@{parts[1]}")}";
-			using var fetched = await _http.GetJson(url, "application/jrd+json, application/json", sign: default, token);
+			using var scope = HttpScope.For("webfinger");
+			var query = $"/.well-known/webfinger?resource={Uri.EscapeDataString($"acct:{parts[0]}@{parts[1]}")}";
+			using var fetched = await _http.GetJson($"https://{parts[1]}{query}", "application/jrd+json, application/json", sign: default, token)
+				?? (_options?.CurrentValue.AllowPlainHttp == true
+					? await _http.GetJson($"http://{parts[1]}{query}", "application/jrd+json, application/json", sign: default, token)
+					: default);
 			if (fetched == default)
 				return default;
 			var document = fetched.Document;
@@ -167,7 +181,18 @@ namespace PrivaPub.Federation.Actors
 				.Modify(a => a.FollowingURL, actor.Following)
 				.Modify(a => a.SharedInboxURL, actor.SharedInbox)
 				.Modify(a => a.PictureURL, actor.Icon)
+				.Modify(a => a.ThumbnailURL, actor.Header)
+				.Modify(a => a.PictureDescription, actor.IconDescription)
+				.Modify(a => a.HeaderDescription, actor.HeaderDescription)
 				.Modify(a => a.IsDiscoverable, actor.Discoverable)
+				.Modify(a => a.IsIndexable, actor.Indexable)
+				.Modify(a => a.IsLocked, actor.Locked)
+				.Modify(a => a.IsMemorial, actor.Memorial)
+				.Modify(a => a.MovedToURL, Origin.Of(actor.MovedTo) == default ? default : actor.MovedTo)
+				.Modify(a => a.Published, actor.Published)
+				.Modify(a => a.Emojis, actor.Emojis)
+				.Modify(a => a.Fields, actor.Fields)
+				.Modify(a => a.Features, actor.Features)
 				.Modify(a => a.AvatarType, Enum.TryParse<AvatarType>(actor.Type, out var type) ? type : AvatarType.Person)
 				.Modify(a => a.PublicKeyId, key?.Id)
 				.Modify(a => a.PublicKey, key?.Pem)

PrivaPub/Federation/Controllers/PeasantsController.cs

@@ -1,4 +1,6 @@
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.Extensions.Options;
 using Microsoft.AspNetCore.RateLimiting;
 
 using MongoDB.Entities;
@@ -15,12 +17,15 @@ using PrivaPub.Domain.Privacy;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Rendering;
 using PrivaPub.Federation.Inbox;
+using PrivaPub.Federation.Signing;
+using PrivaPub.Infrastructure.Http;
+using PrivaPub.Models.Group;
 using PrivaPub.Infrastructure;
 
 namespace PrivaPub.Federation.Controllers
 {
 	[ApiController, Route("peasants")]
-	public class PeasantsController : ControllerBase
+	public class PeasantsController : ControllerBase, IAsyncActionFilter
 	{
 		const string ActivityContentType = "application/activity+json; charset=utf-8";
 		const int OutboxSize = 20;
@@ -29,10 +34,14 @@ namespace PrivaPub.Federation.Controllers
 		readonly IInboxReceiver _inbox;
 		readonly DbEntities _dbEntities;
 		readonly ILogger<PeasantsController> _logger;
+		readonly ISignedFetchAuthorizer _fetches;
+		readonly IOptionsMonitor<FederationOptions> _federation;
 
 		public PeasantsController(ILocalActorService localActors, IInboxReceiver inbox, DbEntities dbEntities,
-			ILogger<PeasantsController> logger)
+			ILogger<PeasantsController> logger, ISignedFetchAuthorizer fetches, IOptionsMonitor<FederationOptions> federation)
 		{
+			_fetches = fetches;
+			_federation = federation;
 			_localActors = localActors;
 			_inbox = inbox;
 			_dbEntities = dbEntities;
@@ -113,6 +122,34 @@ namespace PrivaPub.Federation.Controllers
 			return local is not { IsFederated: true } ? NotFound() : Activity(ActivityPubRenderer.OrderedCollection(local.Following, 0, default));
 		}
 
+		[HttpGet, Route("{actor}/flock")]
+		public async Task<IActionResult> Members(string actor, CancellationToken token)
+		{
+			var local = await _localActors.FindByUserName(actor, token);
+			if (local is not { IsFederated: true, Kind: LocalActorKind.Group })
+				return NotFound();
+			var group = await _dbEntities.Groups.MatchID(local.Id).ExecuteFirstAsync(token);
+			if (local.IsCircle && !SignedFetchAuthorizer.MayReadCircle(group, await _fetches.Requester(Request, token)))
+				return NotFound();
+			return Activity(ActivityPubRenderer.OrderedCollection(local.Flock, group.Members.Count, default));
+		}
+
+		[HttpGet, Route("{actor}/wardens")]
+		public async Task<IActionResult> Moderators(string actor, CancellationToken token)
+		{
+			var local = await _localActors.FindByUserName(actor, token);
+			if (local is not { IsFederated: true, Kind: LocalActorKind.Group })
+				return NotFound();
+			var group = await _dbEntities.Groups.MatchID(local.Id).ExecuteFirstAsync(token);
+			if (local.IsCircle && !SignedFetchAuthorizer.MayReadCircle(group, await _fetches.Requester(Request, token)))
+				return NotFound();
+			var moderators = new List<JsonNode>();
+			foreach (var member in group.Members.Where(m => !m.IsForeign && m.Role is GroupRole.Owner or GroupRole.Moderator))
+				if (await _localActors.FindById(LocalActorKind.Person, member.AvatarId, token) is { } moderator)
+					moderators.Add(moderator.Uri);
+			return Activity(ActivityPubRenderer.OrderedCollection(local.Wardens, moderators.Count, moderators));
+		}
+
 		[HttpGet, Route("{actor}/trophies")]
 		public async Task<IActionResult> Featured(string actor, CancellationToken token)
 		{
@@ -145,6 +182,12 @@ namespace PrivaPub.Federation.Controllers
 		public async Task<IActionResult> Post(string actor, string postId, CancellationToken token)
 		{
 			var (local, post) = await PublicPost(actor, postId, token);
+			if (post == default && await CirclePost(actor, postId, token) is { } circlePost)
+			{
+				var circleNote = ActivityPubRenderer.Note(circlePost.Post, circlePost.Author, circlePost.Circle, circlePost.Post.InReplyToURI);
+				circleNote["@context"] = ActivityPubRenderer.Context();
+				return Activity(circleNote);
+			}
 			if (post == default)
 				return await Tombstone(actor, postId, token) ?? NotFound();
 			if (WantsHtml())
@@ -156,6 +199,33 @@ namespace PrivaPub.Federation.Controllers
 			return Activity(note);
 		}
 
+		[HttpGet, Route("{actor}/parrot-licences/{licenceId}")]
+		public async Task<IActionResult> ParrotLicence(string actor, string licenceId, CancellationToken token)
+		{
+			var author = await _localActors.FindByUserName(actor, token);
+			var licence = author == default ? default : await DB.Default.Find<QuoteLicence>().Match(l => l.ID == licenceId && l.AuthorAvatarId == author.Id).ExecuteFirstAsync(token);
+			var quoted = licence == default ? default : await _dbEntities.Posts.MatchID(licence.PostId).ExecuteFirstAsync(token);
+			if (quoted == default)
+				return NotFound();
+			var uri = Domain.Statuses.QuoteService.LicenceUri(author, licence.ID);
+			if (licence.RevokedAt.HasValue || quoted.DeletedAt.HasValue)
+				return new ContentResult
+				{
+					Content = new JsonObject { ["@context"] = ActivityPubRenderer.ActivityStreams, ["id"] = uri, ["type"] = "Tombstone", ["formerType"] = "QuoteAuthorization" }.ToJsonString(),
+					ContentType = ActivityContentType,
+					StatusCode = StatusCodes.Status410Gone
+				};
+			return Activity(new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.Context(),
+				["id"] = uri,
+				["type"] = "QuoteAuthorization",
+				["attributedTo"] = author.Uri,
+				["interactingObject"] = licence.QuotingObjectURI,
+				["interactionTarget"] = quoted.ObjectURI
+			});
+		}
+
 		[HttpGet, Route("{actor}/grunts/{activityId}")]
 		public async Task<IActionResult> Grunt(string actor, string activityId, CancellationToken token)
 		{
@@ -178,7 +248,7 @@ namespace PrivaPub.Federation.Controllers
 		{
 			var local = await _localActors.FindByUserName(actor, token);
 			if (local is not { IsFederated: true })
-				return NotFound();
+				return Answer(_inbox.NoSuchRecipient(Request));
 			return Answer(await _inbox.Receive(Request, local, token));
 		}
 
@@ -202,6 +272,20 @@ namespace PrivaPub.Federation.Controllers
 			return (local, post);
 		}
 
+		async Task<(LocalActor Author, LocalActor Circle, PostEntity Post)?> CirclePost(string actor, string postId, CancellationToken token)
+		{
+			var local = await _localActors.FindByUserName(actor, token);
+			if (local is not { Kind: LocalActorKind.Person })
+				return default;
+			var post = await _dbEntities.Posts
+				.Match(p => p.ID == postId && p.GroupUserId == local.Id && !p.IsFederatedCopy && !p.DeletedAt.HasValue && p.Visibility == PostVisibility.Circle)
+				.ExecuteFirstAsync(token);
+			var circle = post == default ? default : await _dbEntities.Groups.MatchID(post.GroupId).ExecuteFirstAsync(token);
+			if (circle == default || !SignedFetchAuthorizer.MayReadCircle(circle, await _fetches.Requester(Request, token)))
+				return default;
+			return (local, _localActors.FromGroup(circle), post);
+		}
+
 		async Task<IActionResult> Tombstone(string actor, string postId, CancellationToken token)
 		{
 			var local = await _localActors.FindByUserName(actor, token);
@@ -257,10 +341,27 @@ namespace PrivaPub.Federation.Controllers
 				&& !accept.Contains("ld+json", StringComparison.OrdinalIgnoreCase);
 		}
 
+		[NonAction]
+		public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
+		{
+			if (HttpMethods.IsGet(Request.Method))
+				Response.Headers.Vary = "Accept";
+			if (_federation.CurrentValue.SecureMode && HttpMethods.IsGet(Request.Method)
+				&& !string.Equals(context.RouteData.Values["actor"] as string, LocalActorService.InstanceUserName, StringComparison.OrdinalIgnoreCase)
+				&& await _fetches.Requester(Request, HttpContext.RequestAborted) == default)
+			{
+				context.Result = StatusCode(StatusCodes.Status401Unauthorized);
+				return;
+			}
+			await next();
+		}
+
 		IActionResult Answer(InboxResult result)
 		{
 			if (result.Error != default)
-				_logger.LogInformation("Inbox refused with {Status}: {Error}", result.StatusCode, result.Error);
+				_logger.LogInformation("Inbox refused with {Status} ({Reason}): {Error}", result.StatusCode, result.Reason, result.Error);
+			if (result.RetryAfterSeconds is { } seconds)
+				Response.Headers.RetryAfter = seconds.ToString(System.Globalization.CultureInfo.InvariantCulture);
 			return result.Error == default ? StatusCode(result.StatusCode) : StatusCode(result.StatusCode, result.Error);
 		}
 

PrivaPub/Federation/Inbox/Arrival.cs

@@ -0,0 +1,78 @@
+using PrivaPub.Federation.Actors;
+using PrivaPub.Infrastructure.Statistics;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Post;
+
+namespace PrivaPub.Federation.Inbox
+{
+	public sealed record Arrival(string ActivityId, string ActivityType, string ActorURI, string Inbox, string KeyId, string Algorithm,
+		IReadOnlyList<string> SignedHeaders, DateTime ReceivedAt, string Context = default)
+	{
+		static readonly AsyncLocal<Arrival> current = new();
+
+		public static Arrival Current
+		{
+			get => current.Value;
+			set => current.Value = value;
+		}
+
+		public ArrivalVerdict Verdict { get; } = new();
+
+		public static void Drop(string reason) => Current?.Verdict.Drop(reason);
+
+		public static void Reject(string reason) => Current?.Verdict.Reject(reason);
+
+		public static void Accept(string reason) => Current?.Verdict.Accept(reason);
+
+		public static void About(string objectType = default, PostVisibility? visibility = default, DateTime? created = default, LocalActor local = default) =>
+			Current?.Verdict.About(objectType, visibility, created, local);
+	}
+
+	public sealed class ArrivalVerdict
+	{
+		public string Outcome { get; private set; }
+		public string Reason { get; private set; }
+		public string ObjectType { get; private set; }
+		public string Audience { get; private set; }
+		public string LocalKind { get; private set; }
+		public long? AgeSeconds { get; private set; }
+
+		public void Drop(string reason) => Decide(Interactions.Dropped, reason);
+
+		public void Reject(string reason) => Decide(Interactions.Rejected, reason);
+
+		public void Accept(string reason) => Decide(Interactions.Accepted, reason);
+
+		void Decide(string outcome, string reason)
+		{
+			if (Outcome != default)
+				return;
+			Outcome = outcome;
+			Reason = reason;
+		}
+
+		public void About(string objectType, PostVisibility? visibility, DateTime? created, LocalActor local)
+		{
+			ObjectType = objectType ?? ObjectType;
+			if (visibility is { } known)
+				Audience = AudienceOf(known);
+			if (created is { } at)
+				AgeSeconds = Math.Max(0, (long)(DateTime.UtcNow - at).TotalSeconds);
+			if (local != default)
+				LocalKind = local.Kind switch
+				{
+					LocalActorKind.Person => "person",
+					LocalActorKind.Group when !local.IsCircle => "group",
+					LocalActorKind.Application => "application",
+					_ => default
+				};
+		}
+
+		public static string AudienceOf(PostVisibility visibility) => visibility switch
+		{
+			PostVisibility.Public => Interactions.Public,
+			PostVisibility.Unlisted => Interactions.Unlisted,
+			_ => Interactions.Private
+		};
+	}
+}

PrivaPub/Federation/Inbox/Handlers/AcceptHandler.cs

@@ -1,5 +1,6 @@
 using MongoDB.Entities;
 
+using PrivaPub.Domain.Statuses;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Models.Social;
 using PrivaPub.Models.User;
@@ -15,20 +16,32 @@ namespace PrivaPub.Federation.Inbox.Handlers
 	{
 		readonly DbEntities _dbEntities;
 		readonly ILocalActorService _localActors;
+		readonly IQuoteService _quotes;
 
-		public AcceptHandler(DbEntities dbEntities, ILocalActorService localActors)
+		public AcceptHandler(DbEntities dbEntities, ILocalActorService localActors, IQuoteService quotes)
 		{
 			_dbEntities = dbEntities;
 			_localActors = localActors;
+			_quotes = quotes;
 		}
 
 		public virtual string Type => "Accept";
 
 		public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
 		{
+			if (await _quotes.Answered(activity, actor, accepted: Type == "Accept", token))
+			{
+				Arrival.Accept("quote-answer");
+				return;
+			}
 			var following = await FindFollowing(activity["object"], actor, _dbEntities, _localActors, token);
 			if (following == default)
+			{
+				Arrival.Drop("unknown-object");
 				return;
+			}
+			Arrival.About("Follow");
+			Arrival.Accept("follow-answer");
 			await Apply(following, token);
 		}
 
@@ -56,7 +69,7 @@ namespace PrivaPub.Federation.Inbox.Handlers
 
 	public class RejectHandler : AcceptHandler
 	{
-		public RejectHandler(DbEntities dbEntities, ILocalActorService localActors) : base(dbEntities, localActors)
+		public RejectHandler(DbEntities dbEntities, ILocalActorService localActors, IQuoteService quotes) : base(dbEntities, localActors, quotes)
 		{
 		}
 

PrivaPub/Federation/Inbox/Handlers/AnnounceHandler.cs

@@ -1,6 +1,7 @@
 using MongoDB.Driver;
 using MongoDB.Entities;
 
+using PrivaPub.Domain.Statuses;
 using PrivaPub.Domain.Social;
 using PrivaPub.Domain.Timelines;
 using PrivaPub.Federation.Actors;
@@ -26,9 +27,17 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		readonly ILocalActorService _localActors;
 		readonly IRemotePosts _remotePosts;
 		readonly IFanout _fanout;
+		readonly IRemoteActorService _remoteActors;
 
-		public AnnounceHandler(DbEntities dbEntities, ILocalActorService localActors, IRemotePosts remotePosts, IFanout fanout)
+		readonly IObjectRecords _records;
+		readonly IQuoteService _quotes;
+
+		public AnnounceHandler(DbEntities dbEntities, ILocalActorService localActors, IRemotePosts remotePosts, IFanout fanout, IRemoteActorService remoteActors,
+			IObjectRecords records, IQuoteService quotes)
 		{
+			_records = records;
+			_quotes = quotes;
+			_remoteActors = remoteActors;
 			_dbEntities = dbEntities;
 			_localActors = localActors;
 			_remotePosts = remotePosts;
@@ -41,23 +50,44 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		{
 			var inner = activity["object"];
 			if (inner is JsonObject && Value(inner, "type") is "Create" or "Update" or "Delete" or "Like" or "Dislike" or "Undo" or "Add" or "Remove" or "Block")
+			{
+				await GroupActivity(inner, actor, token);
 				return;
+			}
 			var objectUri = Id(inner);
 			var announceId = Id(activity);
 			if (objectUri == default || announceId == default)
+			{
+				Arrival.Drop("unparseable");
 				return;
+			}
 			if (await _dbEntities.Posts.Match(p => p.ObjectURI == announceId).ExecuteAnyAsync(token))
+			{
+				Arrival.Drop("duplicate");
 				return;
+			}
 
 			var isLocal = objectUri.StartsWith(_localActors.BaseAddress + "/", StringComparison.OrdinalIgnoreCase);
 			var original = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && !p.DeletedAt.HasValue && p.ReblogOfPostId == null).ExecuteFirstAsync(token);
 			var followed = await _dbEntities.Followings.Match(f => f.TargetActorURI == actor.ActorURI && f.State == FollowState.Accepted).ExecuteAnyAsync(token);
 			if (original is not { IsFederatedCopy: false } && !followed)
+			{
+				Arrival.Drop("not-followed");
 				return;
+			}
 			if (original == default && !isLocal)
 				original = await _remotePosts.StoreContext(objectUri, 0, token);
-			if (original == default || original.Visibility is not (PostVisibility.Public or PostVisibility.Unlisted))
+			if (original == default)
+			{
+				Arrival.Drop("fetch-failed");
 				return;
+			}
+			Arrival.About(original.ObjectType ?? "Note", original.Visibility, original.CreationDate);
+			if (original.Visibility is not (PostVisibility.Public or PostVisibility.Unlisted))
+			{
+				Arrival.Drop("not-public");
+				return;
+			}
 
 			var to = Strings(activity["to"]);
 			var cc = Strings(activity["cc"]);
@@ -66,7 +96,7 @@ namespace PrivaPub.Federation.Inbox.Handlers
 				: DateTime.UtcNow;
 			var reblog = new PostEntity
 			{
-				ID = PrivacyIds.At(published),
+				ID = PrivacyIds.Arrived(published),
 				ObjectURI = announceId,
 				ActivityURI = announceId,
 				ActorURI = actor.ActorURI,
@@ -80,15 +110,21 @@ namespace PrivaPub.Federation.Inbox.Handlers
 				UpdateDate = published
 			};
 			if (reblog.Visibility == PostVisibility.Direct)
+			{
+				Arrival.Drop("not-public");
 				return;
+			}
 			try
 			{
 				await DB.Default.SaveAsync(reblog, token);
 			}
 			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
 			{
+				Arrival.Drop("duplicate");
 				return;
 			}
+			Arrival.Accept("stored");
+			Arrival.About(local: original.IsFederatedCopy ? default : await _localActors.FindById(Models.Federation.LocalActorKind.Person, original.GroupUserId, token));
 
 			await DB.Default.Update<PostEntity>().MatchID(original.ID).Modify(b => b.Inc(p => p.ReblogsCount, 1)).ExecuteAsync(token);
 			if (!original.IsFederatedCopy)
@@ -96,6 +132,79 @@ namespace PrivaPub.Federation.Inbox.Handlers
 			await _fanout.Distribute(reblog, token);
 		}
 
+		async Task GroupActivity(JsonNode inner, ForeignAvatar group, CancellationToken token)
+		{
+			Arrival.About(Value(inner, "type"));
+			if (group.AvatarType != AvatarType.Group
+				|| !await _dbEntities.Followings.Match(f => f.TargetActorURI == group.ActorURI && f.State == FollowState.Accepted).ExecuteAnyAsync(token))
+			{
+				Arrival.Drop("not-followed");
+				return;
+			}
+			var objectUri = Id(inner["object"]);
+			switch (Value(inner, "type"))
+			{
+				case "Create" when objectUri != default:
+					if (await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri).ExecuteAnyAsync(token))
+					{
+						Arrival.Drop("duplicate");
+						return;
+					}
+					var post = await _remotePosts.StoreContext(objectUri, 0, token);
+					if (post == default)
+					{
+						Arrival.Drop("fetch-failed");
+						return;
+					}
+					Arrival.Accept("stored");
+					Arrival.About(visibility: post.Visibility);
+					await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(p => p.AudienceURI, group.ActorURI).ExecuteAsync(token);
+					post.AudienceURI = group.ActorURI;
+					await _fanout.Distribute(post, token);
+					break;
+				case "Update" when objectUri != default:
+					var stored = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && p.AudienceURI == group.ActorURI && !p.DeletedAt.HasValue)
+						.ExecuteFirstAsync(token);
+					if (stored == default)
+					{
+						Arrival.Drop("unknown-object");
+						return;
+					}
+					Arrival.About(visibility: stored.Visibility, created: stored.CreationDate);
+					using (var fetched = await _remoteActors.FetchObject(objectUri, token))
+					{
+						var note = fetched == default ? default : NoteParser.Parse(System.Text.Json.Nodes.JsonNode.Parse(fetched.Root.GetRawText()));
+						if (note == default || note.AttributedTo != stored.ActorURI)
+						{
+							Arrival.Drop(note == default ? "fetch-failed" : "misattributed");
+							return;
+						}
+						Arrival.Accept(await RemoteEdits.Apply(stored, note, Id(inner), _localActors, _records, _quotes, token) ? "edit" : "refresh");
+					}
+					break;
+				case "Delete" when objectUri != default:
+					var deleted = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && p.AudienceURI == group.ActorURI).ExecuteFirstAsync(token);
+					if (deleted == default)
+					{
+						Arrival.Drop("unknown-object");
+						return;
+					}
+					Arrival.About(visibility: deleted.Visibility, created: deleted.CreationDate);
+					using (var check = await _remoteActors.FetchObject(objectUri, token))
+						if (check != default && Value(System.Text.Json.Nodes.JsonNode.Parse(check.Root.GetRawText()), "type") != "Tombstone")
+						{
+							Arrival.Drop("not-deleted");
+							return;
+						}
+					Arrival.Accept("removed");
+					await RemoteDeletes.Remove(deleted, objectUri, token);
+					break;
+				default:
+					Arrival.Drop("unsupported");
+					break;
+			}
+		}
+
 		static List<string> Strings(JsonNode node) => node switch
 		{
 			JsonArray array => array.Select(Id).Where(id => id != default).ToList(),

PrivaPub/Federation/Inbox/Handlers/CreateHandler.cs

@@ -4,6 +4,8 @@ using MongoDB.Entities;
 using PrivaPub.Domain.Timelines;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Moderation;
+using PrivaPub.Domain.Content;
+using PrivaPub.Domain.Statuses;
 using PrivaPub.Federation.Objects;
 using PrivaPub.Federation.Outbox;
 using PrivaPub.Infrastructure.Ids;
@@ -33,10 +35,20 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		readonly IDomainBlocks _domainBlocks;
 		readonly IFanout _fanout;
 		readonly IRemotePosts _remotePosts;
+		readonly IGroupDistributor _groups;
+		readonly IObjectRecords _records;
+		readonly IPollService _polls;
+		readonly ILinkPreviews _previews;
+		readonly IQuoteService _quotes;
 
 		public CreateHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDeliveryService delivery,
-			IDomainBlocks domainBlocks, IFanout fanout, IRemotePosts remotePosts)
+			IDomainBlocks domainBlocks, IFanout fanout, IRemotePosts remotePosts, IGroupDistributor groups, IObjectRecords records, IPollService polls, ILinkPreviews previews, IQuoteService quotes)
 		{
+			_quotes = quotes;
+			_previews = previews;
+			_records = records;
+			_polls = polls;
+			_groups = groups;
 			_fanout = fanout;
 			_remotePosts = remotePosts;
 			_dbEntities = dbEntities;
@@ -51,20 +63,47 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		public async Task Handle(JsonNode activity, ForeignAvatar author, CancellationToken token)
 		{
 			var node = activity["object"];
-			if (node is not JsonObject || !Origin.Same(Id(node), author.ActorURI))
+			var refetched = node is not JsonObject || !Origin.Same(Id(node), author.ActorURI);
+			if (refetched)
 			{
 				using var fetched = await _remoteActors.FetchObject(Id(node), token);
 				node = fetched == default ? default : JsonNode.Parse(fetched.Root.GetRawText());
+				if (node == default)
+					Arrival.Drop("fetch-failed");
 			}
 			var note = NoteParser.Parse(node);
 			if (note == default || note.AttributedTo != author.ActorURI)
+			{
+				Arrival.Drop(note == default ? "unparseable" : "misattributed");
 				return;
+			}
+			Arrival.About(note.Type);
+			if (note.Title != default && note.InReplyTo != default && ObjectShapes.Text(note.ContentHtml, 1) == default)
+			{
+				var question = await _dbEntities.Posts.Match(p => p.ObjectURI == note.InReplyTo && p.Poll != null).ExecuteFirstAsync(token);
+				if (question != default)
+				{
+					await _polls.Receive(question, author, note.Title, Id(activity), token);
+					Arrival.Accept("poll-vote");
+					Arrival.About(visibility: question.Visibility);
+					return;
+				}
+			}
 			if (await _dbEntities.Posts.Match(p => p.ObjectURI == note.Id).ExecuteAnyAsync(token))
+			{
+				Arrival.Drop("duplicate");
 				return;
+			}
+			if (await DB.Default.Find<DeletedObject>().Match(d => d.ObjectURI == note.Id).ExecuteAnyAsync(token))
+			{
+				Arrival.Drop("deleted");
+				return;
+			}
 
 			var to = note.To.Concat(Strings(activity["to"])).Distinct(StringComparer.Ordinal).ToList();
 			var cc = note.Cc.Concat(Strings(activity["cc"])).Distinct(StringComparer.Ordinal).ToList();
 			var visibility = Addressing.Classify(to, cc, author.FollowersURL);
+			Arrival.About(visibility: visibility);
 
 			var addressed = to.Concat(cc)
 				.Concat(Addresses(activity))
@@ -85,10 +124,21 @@ namespace PrivaPub.Federation.Inbox.Handlers
 			var parent = string.IsNullOrEmpty(note.InReplyTo)
 				? default
 				: await _dbEntities.Posts.Match(p => p.ObjectURI == note.InReplyTo && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
-			var group = visibility is PostVisibility.Public or PostVisibility.Unlisted
-				? localTargets.FirstOrDefault(t => t.Kind == LocalActorKind.Group)
-				: default;
-			if (group != default && !await IsAcceptedFollower(group, author.ActorURI, token))
+			var circle = localTargets.FirstOrDefault(t => t is { Kind: LocalActorKind.Group, IsCircle: true });
+			if (circle != default)
+			{
+				visibility = PostVisibility.Circle;
+				Arrival.About(visibility: visibility);
+				if (!await IsCircleMember(circle, author.ActorURI, token))
+				{
+					Arrival.Drop("not-addressed");
+					return;
+				}
+			}
+			var group = circle ?? (visibility is PostVisibility.Public or PostVisibility.Unlisted
+				? localTargets.FirstOrDefault(t => t is { Kind: LocalActorKind.Group, IsCircle: false })
+				: default);
+			if (group is { IsCircle: false } && !await MayPost(group, author.ActorURI, token))
 				group = default;
 
 			var repliesToLocal = parent is { IsFederatedCopy: false } && visibility != PostVisibility.Direct;
@@ -96,7 +146,10 @@ namespace PrivaPub.Federation.Inbox.Handlers
 				.Match(f => f.TargetActorURI == author.ActorURI && f.State == FollowState.Accepted)
 				.ExecuteAnyAsync(token);
 			if (visibility == PostVisibility.Direct ? persons.Count == 0 : group == default && persons.Count == 0 && !repliesToLocal && !followed)
+			{
+				Arrival.Drop("not-addressed");
 				return;
+			}
 			if (parent == default && visibility != PostVisibility.Direct)
 				parent = await _remotePosts.Parent(note.InReplyTo, 1, token);
 
@@ -120,19 +173,36 @@ namespace PrivaPub.Federation.Inbox.Handlers
 			}
 			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
 			{
+				Arrival.Drop("duplicate");
 				return;
 			}
+			Arrival.Accept("stored");
+			Arrival.About(local: group ?? persons.FirstOrDefault());
+			await _records.Record(note, post, ObjectPath.Delivered, refetched, token);
+			await _previews.Wanted(post, token);
+			await _quotes.Resolve(post, note, token);
 
 			if (parent != default)
 				await DB.Default.Update<PostEntity>().MatchID(parent.ID).Modify(b => b.Inc(p => p.RepliesCount, 1)).ExecuteAsync(token);
 			await _fanout.Distribute(post, token);
 			if (conversation != default)
 				await DB.Default.Update<DmGroup>().MatchID(conversation.ID).Modify(g => g.UpdatedAt, DateTime.UtcNow).ExecuteAsync(token);
-			if (group != default)
-			{
-				var announce = ActivityPubRenderer.Announce(group, note.Id, $"announce-{post.ID}");
-				await _delivery.EnqueueToFollowers(group, announce, token);
+			if (group is { IsCircle: false })
+				await _groups.Announce(group, activity.AsObject(), note.Id, isNewPost: string.IsNullOrEmpty(note.InReplyTo), token);
 		}
+
+		async Task<bool> IsCircleMember(LocalActor circle, string actorUri, CancellationToken token) =>
+			await _dbEntities.Groups.Match(g => g.ID == circle.Id && g.Members.Any(m => m.IsForeign && m.AvatarId == actorUri)).ExecuteAnyAsync(token);
+
+		async Task<bool> MayPost(LocalActor community, string actorUri, CancellationToken token)
+		{
+			var entity = await _dbEntities.Groups.MatchID(community.Id).ExecuteFirstAsync(token);
+			return entity?.PostingPolicy switch
+			{
+				PostingPolicy.Anyone => true,
+				PostingPolicy.Followers => await IsAcceptedFollower(community, actorUri, token),
+				_ => false
+			};
 		}
 
 		async Task<DmGroup> FindOrCreateConversation(List<string> participantUris, string context, CancellationToken token)

PrivaPub/Federation/Inbox/Handlers/DeleteHandler.cs

@@ -1,5 +1,6 @@
 using MongoDB.Entities;
 
+using PrivaPub.Domain.Statuses;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Objects;
 using PrivaPub.Federation.Outbox;
@@ -26,9 +27,14 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		readonly ILocalActorService _localActors;
 		readonly IRemoteActorService _remoteActors;
 		readonly IDeliveryService _delivery;
+		readonly IGroupDistributor _groups;
+		readonly IQuoteService _quotes;
 
-		public DeleteHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDeliveryService delivery)
+		public DeleteHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDeliveryService delivery,
+			IGroupDistributor groups, IQuoteService quotes)
 		{
+			_quotes = quotes;
+			_groups = groups;
 			_dbEntities = dbEntities;
 			_localActors = localActors;
 			_remoteActors = remoteActors;
@@ -43,10 +49,15 @@ namespace PrivaPub.Federation.Inbox.Handlers
 
 			var objectUri = Id(delete["object"]);
 			if (!Origin.Same(objectUri, actor.ActorURI))
+			{
+				Arrival.Drop("cross-origin");
 				return;
+			}
 
 			if (objectUri == actor.ActorURI)
 			{
+				Arrival.Accept("actor-delete");
+				Arrival.About(actor.AvatarType.ToString(), created: actor.Published);
 				actor.DeletionAt = DateTime.UtcNow;
 				actor.AccountState = AvatarAccountState.Deleted;
 				await DB.Default.SaveAsync(actor, token);
@@ -62,14 +73,19 @@ namespace PrivaPub.Federation.Inbox.Handlers
 				return;
 			}
 
+			await RemoteDeletes.Tombstone(objectUri, token);
 			var post = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && p.ActorURI == actor.ActorURI).ExecuteFirstAsync(token);
 			if (post == default)
+			{
+				Arrival.Accept("tombstone-only");
+				await _quotes.Revoke(objectUri, token);
 				return;
-			await DB.Default.DeleteAsync<PostEntity>(post.ID);
-			await DB.Default.DeleteAsync<TimelineEntry>(e => e.PostId == post.ID || e.ReblogOfPostId == post.ID);
-			await DB.Default.DeleteAsync<PostEntity>(p => p.ReblogOfPostId == post.ID);
-			if (!string.IsNullOrEmpty(post.AnsweringToPostId))
-				await DB.Default.Update<PostEntity>().MatchID(post.AnsweringToPostId).Modify(b => b.Inc(p => p.RepliesCount, -1)).ExecuteAsync(token);
+			}
+			Arrival.Accept("removed");
+			Arrival.About(post.ObjectType, post.Visibility, post.CreationDate);
+			await RemoteDeletes.Remove(post, objectUri, token);
+			if (!string.IsNullOrEmpty(post.GroupId) && await _localActors.FindById(LocalActorKind.Group, post.GroupId, token) is { IsCircle: false } community)
+				await _groups.Announce(community, activity.AsObject(), post.ObjectURI, isNewPost: false, token);
 		}
 	}
 }

PrivaPub/Federation/Inbox/Handlers/DislikeHandler.cs

@@ -0,0 +1,53 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Federation.Inbox.Handlers
+{
+	public class DislikeHandler : IActivityHandler
+	{
+		readonly DbEntities _dbEntities;
+
+		public DislikeHandler(DbEntities dbEntities)
+		{
+			_dbEntities = dbEntities;
+		}
+
+		public string Type => "Dislike";
+
+		public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
+		{
+			var objectUri = Id(activity["object"]);
+			var post = objectUri == default
+				? default
+				: await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && !p.DeletedAt.HasValue && p.ReblogOfPostId == null).ExecuteFirstAsync(token);
+			if (post == default || !LikeHandler.MaySee(post, actor))
+			{
+				Arrival.Drop(post == default ? "unknown-object" : "not-visible");
+				return;
+			}
+			Arrival.About(post.ObjectType ?? "Note", post.Visibility, post.CreationDate);
+
+			try
+			{
+				await DB.Default.SaveAsync(new Downvote { AccountId = actor.ID, ActorURI = actor.ActorURI, PostId = post.ID, ActivityURI = Id(activity) }, token);
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+				Arrival.Drop("duplicate");
+				return;
+			}
+			Arrival.Accept("stored");
+			await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(b => b.Inc(p => p.DownvotesCount, 1)).ExecuteAsync(token);
+		}
+	}
+}

PrivaPub/Federation/Inbox/Handlers/EmojiReactHandler.cs

@@ -0,0 +1,39 @@
+using PrivaPub.Domain.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+namespace PrivaPub.Federation.Inbox.Handlers
+{
+	public class EmojiReactHandler : IActivityHandler
+	{
+		readonly DbEntities _dbEntities;
+		readonly IReactions _reactions;
+
+		public EmojiReactHandler(DbEntities dbEntities, IReactions reactions)
+		{
+			_dbEntities = dbEntities;
+			_reactions = reactions;
+		}
+
+		public string Type => "EmojiReact";
+
+		public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
+		{
+			var objectUri = Id(activity["object"]);
+			var post = objectUri == default
+				? default
+				: await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && !p.DeletedAt.HasValue && p.ReblogOfPostId == null).ExecuteFirstAsync(token);
+			if (post == default)
+			{
+				Arrival.Drop("unknown-object");
+				return;
+			}
+			Arrival.About(post.ObjectType ?? "Note", post.Visibility, post.CreationDate);
+			await _reactions.Receive(post, actor, Value(activity, "content"), activity["tag"], Id(activity), token);
+		}
+	}
+}

PrivaPub/Federation/Inbox/Handlers/FlagHandler.cs

@@ -50,7 +50,11 @@ namespace PrivaPub.Federation.Inbox.Handlers
 			if (target == default && posts.Count > 0)
 				target = await _localActors.FindById(LocalActorKind.Person, posts[0].GroupUserId, token);
 			if (target == default)
+			{
+				Arrival.Drop("unknown-object");
 				return;
+			}
+			Arrival.Accept("reported");
 
 			await DB.Default.SaveAsync(new Report
 			{

PrivaPub/Federation/Inbox/Handlers/FollowHandler.cs

@@ -45,7 +45,10 @@ namespace PrivaPub.Federation.Inbox.Handlers
 
 			var target = await _localActors.FindByUri(Id(follow["object"]), token);
 			if (target is not { IsFederated: true } || target.Kind == LocalActorKind.Application)
+			{
+				Arrival.Drop("unknown-recipient");
 				return;
+			}
 			if (target.Kind == LocalActorKind.Person
 				&& await DB.Default.Find<Models.Social.Block>().Match(b => b.AvatarId == target.Id && b.TargetActorURI == follower.ActorURI).ExecuteAnyAsync(token))
 			{
@@ -58,6 +61,7 @@ namespace PrivaPub.Federation.Inbox.Handlers
 					["object"] = follow.DeepClone()
 				};
 				await _delivery.Enqueue(target, new[] { follower.InboxURL }, reject, token);
+				Arrival.Reject("blocked");
 				return;
 			}
 
@@ -75,6 +79,7 @@ namespace PrivaPub.Federation.Inbox.Handlers
 			record.FollowActivityURI = Id(follow);
 			record.IsAccepted = existing?.IsAccepted == true || !target.ManuallyApprovesFollowers;
 			await DB.Default.SaveAsync(record, token);
+			Arrival.Accept(record.IsAccepted ? "auto-accepted" : "pending");
 
 			if (target.Kind == LocalActorKind.Person)
 				await Notifications.Add(target.Id, record.IsAccepted ? NotificationType.Follow : NotificationType.FollowRequest,

PrivaPub/Federation/Inbox/Handlers/JoinHandler.cs

@@ -0,0 +1,56 @@
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+namespace PrivaPub.Federation.Inbox.Handlers
+{
+	public class JoinHandler : IActivityHandler
+	{
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IDeliveryService _delivery;
+
+		public JoinHandler(DbEntities dbEntities, ILocalActorService localActors, IDeliveryService delivery)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_delivery = delivery;
+		}
+
+		public string Type => "Join";
+
+		public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
+		{
+			var objectUri = Id(activity["object"]);
+			if (objectUri == default || !objectUri.StartsWith(_localActors.BaseAddress + "/", StringComparison.OrdinalIgnoreCase))
+			{
+				Arrival.Drop("unknown-object");
+				return;
+			}
+			var post = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && !p.IsFederatedCopy && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			var owner = post == default ? default : await _localActors.FindById(LocalActorKind.Person, post.GroupUserId, token);
+			if (owner == default || string.IsNullOrEmpty(actor.InboxURL))
+			{
+				Arrival.Drop("unknown-object");
+				return;
+			}
+			Arrival.About(post.ObjectType ?? "Note", post.Visibility, post.CreationDate);
+			Arrival.Reject("ignored");
+			await _delivery.Enqueue(owner, new[] { actor.InboxURL }, new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.ActivityStreams,
+				["id"] = owner.ActivityUri($"ignore-{Guid.NewGuid():N}"),
+				["type"] = "Ignore",
+				["actor"] = owner.Uri,
+				["object"] = activity.DeepClone()
+			}, token);
+		}
+	}
+}