P6: quote posts, received and sent (FEP-044f and the older keys)

- Received quotes: read from `quote`, `quoteUrl`, `quoteUri`, `_misskey_quote` or a FEP-e232 Link tag; the quoted post
  is fetched once; a quoteAuthorization stamp is verified field by field on the quoted author's origin; a consent
  quote without a stamp is pending; an older-key quote of a public post is shown; Delete of a stamp revokes. Counts
  and a `quote` notification follow the accepted state. The `quote-inline` fallback survives sanitising and is removed
  from content when the real quote is shown.
- Personas quote through `quoted_status_id`: posts that state a quote policy get a QuoteRequest and stay pending until
  an Accept brings a stamp we can verify, then an Update adds quoteAuthorization; posts that state none are quoted
  the older way, without `quote`; another persona's posts cannot be quoted yet (we issue no stamps). Quoting posts
  are delivered to the quoted author too.
- Mastodon API: Status.quote (with the quoted status one level deep), quotes_count, quote_approval from the remote
  policy, GET /api/v1/statuses/:id/quotes, `quote` notifications, and api_versions.mastodon = 7.

Checked live: GoToSocial's author-only quote policy is respected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

.gitignore

@@ -401,3 +401,4 @@ FodyWeavers.xsd
 
 PrivaPub/media-store/
 PrivaPub/media-store-proxy/
+tools/pasture/.publish/

CLAUDE.md

@@ -1,7 +1,9 @@
 # CLAUDE.md
 
 Guidance for working in this repository. `docs/ROADMAP.md` holds the owner's decisions and the phased plan to full
-ActivityPub interop; read it before changing anything federation-, privacy- or API-shaped.
+ActivityPub interop; read it before changing anything federation-, privacy- or API-shaped. `docs/INTEROP.md` is the
+per-platform evidence behind phases P5 to P8: what each peer sends, what it expects, and what PrivaPub still drops.
+Check the platform's section there before writing a parser or a renderer, and add to it whatever you learn.
 
 ## What this is
 
@@ -69,7 +71,7 @@ PrivaPub/                         ASP.NET Core Web API, net10.0
   Infrastructure/
     Http/                         FederationHttp + SafeHttpHandlerFactory + IpRangeGuard: the only way out
     Jobs/                         JobQueue (leases), JobWorker, Backoff, HostCircuitBreaker
-    Ids/                          PrivacyIds (day-only ids for personas and groups, published-time ids for remote posts)
+    Ids/                          PrivacyIds (day-only ids for personas and groups, arrival-ordered ids for remote posts)
     Data/                         Indexes (created at start), EntityMaps.Warm, Migrations/_NNN_*.cs
     Cli/                          AdminCommands (`PrivaPub admin promote|demote <root>`)
     RateLimiting.cs               accounts (per client address) and inbox (per sending origin) policies
@@ -129,7 +131,8 @@ cd PrivaPub && ASPNETCORE_ENVIRONMENT=Development \
 
 Development config (`appsettings.Development.json`) binds HTTPS 7195 with HTTP/2 only; the overrides above make it
 curl-able. Outbound fetches only go to https DNS names resolving to public addresses; a test network (Pasture) sets
-`Federation__AllowPrivateNetworks=true` and `Federation__AllowPlainHttp=true`, which startup refuses in Production.
+`Federation__AllowPrivateNetworks=true`, `Federation__AllowPlainHttp=true` and `Federation__AcceptAnyCertificate=true`,
+which startup refuses in Production.
 
 Promoting an admin on the box (signing up as "admin" grants nothing):
 
@@ -196,6 +199,10 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
 4. Answer with `Json(...)` (snake_case, explicit nulls) or `Error(status, message)`; page lists with `Page` and `Link`.
 5. Unsupported features answer empty lists or 422 with a message, never 404 or 500, so clients degrade.
 6. Advertise `4.2.0 (compatible; PrivaPub)` until grouped notifications exist.
+7. **What a Mastodon `Status` cannot say goes in `Status.privapub`** (`PrivaPubStatus`): object type, title, excerpt,
+   cover, the author's source, link, video, audio and event details, and up/down votes. Every media URL in it goes
+   through the proxy; only page links (`link.url`, an event's online link) point at the remote site, because following
+   one is the reader's choice.
 
 ## Media invariants
 
@@ -214,8 +221,17 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
   equal to the login.
 - **One username space:** personas, groups and the instance reserve their name in `ReservedName` (unique index) before
   they are saved; `LocalActorService.TryReserveUserName` is the only way to claim one.
+- **Usernames are `Constants.UserNameRegex`** (`^[a-z0-9_]+$`): the intersection of what Mastodon and Misskey accept. A
+  name outside it creates a persona nobody on those servers can reach.
+- **An actor's `published` is `PublishedOn`**, a random whole day up to two weeks before creation, so personas made the
+  same day do not share a date. New persona and group ids carry that same day (`GenerateNewID`), because local clients
+  see ids. Never emit `CreatedAt`.
 - **Per-avatar state stays per avatar:** blocks, mutes, notifications, follows. Nothing may relate sibling avatars.
-- **Blocks never federate,** and reports leave as `Flag` from the instance actor.
+- **Blocks federate** (owner decision, 2026-10-01): a block is sent as `Block` from the blocking avatar, an unblock as
+  `Undo{Block}`. Reports still leave as `Flag` from the instance actor, never from the reporting avatar.
+- **What PrivaPub reveals is the owner's call.** Previews, blocks, website authorship, views, bridging and reactions were
+  decided in `docs/ROADMAP.md` ("Owner decisions on what PrivaPub reveals"). Anything new that tells another server
+  something about an avatar gets the same treatment: ask, then record it there.
 - **Location-ranged posts never federate.**
 
 ## Data
@@ -226,6 +242,44 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
 - **Collection name = class name, so never rename an entity class.**
 - `Entity.ID` is a 24-character lowercase hex string; `GenerateNewID()` returns `object`, so cast it.
 - New fields must be additive: a deploy rollback restores the binary, not the database.
+- **Every stored remote object has an `ObjectRecord`** (raw JSON up to 256 KB plus its hash; delivered or fetched; the
+  activity, inbox, key and signed headers; received time; up to 10 later revisions). Write it right after the post's
+  save: `CreateHandler` (delivered) and `RemotePosts.StoreContext` (fetched) do, and `UpdateHandler` appends a
+  revision. Delivery details reach them through `Arrival.Current`, which `InboxProcessor` sets for the handler's
+  duration. The raw form lives outside `Post` so timelines never load it. Read through
+  `/api/privapub/v1/statuses/:id/provenance` and `/api/privapub/v1/instances/:host`.
+- **Remote objects are parsed for every shape in `ObjectShapes`:** `url`/`icon`/`image` as a value, an object or an
+  array; Markdown `content`; missing `mediaType`s inferred; thumbnails from any of their five places; and the typed
+  `Link`, `Video`, `Audio` and `Event` details. A Mastodon API card is built from those, never by fetching the linked page
+  (that fetch is the owner's decision 1, for P6).
+- **An `Update` is an edit only when its `updated` is newer than ours** (`UpdateHandler.IsEdit`). Otherwise it refreshes
+  the poll, video, audio and event details and nothing else, and leaves no revision: Mastodon and Misskey refresh poll
+  counts with bare Updates.
+- **A poll vote is a `Note` with a `name`, an `inReplyTo` that is a poll we hold, and no content.** `CreateHandler`
+  hands it to `PollService.Receive` before anything else, so it never becomes a reply. Our votes on other servers' polls
+  go only to the poll's author, without `published` (PieFed counts a vote only then).
+- **Link previews follow owner decision 1** (`Domain/Content/LinkPreviews.cs`): only public posts, queued on arrival with
+  0–60 s of jitter, one cached `LinkPreview` per address for the whole server, never fetched when someone reads.
+  `LinkPreviews.Wanted` is called where posts are saved (`CreateHandler`, `StoreContext`, `StatusService.Publish`).
+- **Quote states come from `QuoteService.Resolve`:**
+  - with a stamp: accepted only if `Verified` (fetched, on the quoted author's origin, naming both posts exactly);
+  - a FEP-044f `quote` without a stamp: pending;
+  - older keys only: accepted when the quoted post is public.
+
+  `QuotesCount` moves with the accepted state, never with the raw key. When a persona quotes, `QuotePermission` decides:
+  asking first for posts that state a policy, quoting at once for posts that state none, refusing otherwise. Only `quote`
+  of a post that asks for consent puts `quote` in our JSON; older-key quotes leave it out, as Sharkey learned they must.
+- **A server is described on arrival, never on read.** The first record from a host enqueues `DescribeInstance` (its
+  NodeInfo, at most once a week, into `RemoteInstance`), so opening the details view tells nobody anything.
+- **Post ids are the timeline order, so they follow arrival, not `published`.** `PrivacyIds.Arrived` gives a remote post
+  published within the last hour (or in the future) a fresh `ObjectId`, which sorts after every post already stored,
+  and only backfill keeps a `published`-derived id. With `published` ids a reply arriving in the same second could sort
+  under the post it answers, and a late arrival landed behind a client's `since_id` and was never seen. `created_at`
+  comes from `CreationDate`, never from the id.
+- **The same ordering problem exists on the other side, so `published` carries milliseconds**
+  (`ActivityPubRenderer.Timestamp`). GoToSocial (ULIDs) and Mastodon (Snowflakes) derive a remote status's id from
+  `published` at millisecond resolution. With whole seconds, two of our posts from the same second sorted at random
+  there.
 - **Startup order:** `EntityMaps.Warm()` (every entity's class map, one at a time; two mapped at once throw "An item
   with the same key has already been added" and stay broken), then `MigrateAsync` (`Infrastructure/Data/Migrations`,
   `_NNN_` order, each runs once), then `Indexes.Create()`. A new entity needs nothing; a new unique index needs a
@@ -243,6 +297,9 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
 - Localised strings go through `IStringLocalizer<GenericRes>`.
 - Every `Display`/`ErrorMessage` resource key must exist in `FieldsNameResource`/`ErrorsResource`, including the
   `Designer.cs`, which the CLI build doesn't regenerate. A missing key throws at validation time.
+- **`cond ? value : default` with a value-type branch is the type's default, not null:** `false`, `0`, or year one
+  stored as an edit date on every remote post. Write `(T?)null`. It has shipped four times (`MastodonParams.Bool/Int`,
+  `NoteParser.Int`, `NoteParser.Time`).
 - ActivityPub output is built with `System.Text.Json.Nodes` in `ActivityPubRenderer`, not typed models. Inbound
   documents are read through `InboxService.Id`/`Value`, which handle string, object and array.
 - Libraries chosen for the roadmap: HtmlSanitizer, Markdig (`DisableHtml`), NSign (RFC 9421 inbound), OpenIddict +
@@ -261,8 +318,39 @@ Beyond the tests, verify by building, running locally, and exercising:
 - the client API (sign up, create an avatar, a group, a post);
 - the ActivityPub endpoints with curl and `Accept: application/activity+json`.
 
-Interop is checked against real servers: Fediverse Pasture with podman on the workstation, verify.funfedi.dev, and
+Interop is checked against real servers, starting with the workstation's own pasture:
-the owner's GoToSocial at social.arasaka.software. **Ask before acting from the owner's GoToSocial account.**
+
+```bash
+DOTNET=~/.dotnet/dotnet tools/pasture/run.sh up   # podman: PrivaPub + the latest GoToSocial + Mongo, behind Caddy
+tools/pasture/interop.sh                          # 25 checks, each side driven through its own Mastodon API
+tools/pasture/run.sh down
+```
+
+- **Two sites on one podman network, one Caddy in front.** `privapub.test` and `gts.test` are network aliases of the
+  Caddy container, which serves both with its internal CA (`tls internal`). Both servers are told to accept any
+  certificate: PrivaPub through `appsettings.Pasture.json`, GoToSocial through `GTS_HTTP_CLIENT_TLS_INSECURE_SKIP_VERIFY`.
+  GoToSocial WebFingers and fetches over https only, so plain http between them is not an option.
+- From the workstation, PrivaPub's API is `http://127.0.0.1:6971`. GoToSocial is reached as `https://gts.test:6443`
+  with `curl -k --resolve gts.test:6443:127.0.0.1`, because its sign-in cookie is bound to the host name.
+- **GoToSocial's cached home timeline can stop taking new posts after its first read**, its owner's own included, while
+  a `min_id` query shows them all. So a delivery is checked by looking the object up by URI with `resolve=false`
+  (`on_gts`), which answers from GoToSocial's database and never fetches from us. A home-timeline check there proves
+  nothing, in either direction. A deleted status still turns up in that search as a "deleted status" stub, so a delete
+  is checked as a 404 on `/api/v1/statuses/{id}`.
+- **GoToSocial creates its accounts locked**, so `interop.sh` approves alice's request through
+  `/api/v1/follow_requests`. That also checks our pending (`requested`) state and the manual Accept.
+- The scenario covers:
+  - discovery and follows both ways;
+  - posts and CW;
+  - a reply and its notification;
+  - likes and boosts both ways;
+  - DMs both ways, and the DM staying off public timelines;
+  - edit, delete both ways, and unfollow.
+- `run.sh up` replaces every container, Mongo included, so each run starts clean. To keep the data, republish into
+  `tools/pasture/.publish` and `podman restart pasture-privapub`; that is how a migration is tried on dirty data.
+
+After the pasture, verify.funfedi.dev and the owner's GoToSocial at social.arasaka.software. **Ask before acting from
+the owner's GoToSocial account.**
 
 ## Deploy
 

FEDERATION.md

@@ -10,14 +10,31 @@ PrivaPub is an ActivityPub server written in C#. This document follows
 - [HTTP Signatures](https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures), `rsa-sha256` / `hs2019` with RSA keys
 - [NodeInfo](https://nodeinfo.diaspora.software/) 2.0 and 2.1
 
+## Tested against
+
+- **GoToSocial 0.22.1, end to end.** It runs in a private network on the workstation (`tools/pasture/`) and is driven
+  through its own client API. Checked both ways:
+  - follows, including to a locked account;
+  - public posts with a content warning;
+  - replies with notifications;
+  - likes and boosts;
+  - direct messages;
+  - edits and deletes;
+  - unfollow.
+- **Mastodon, Misskey, Lemmy and PeerTube, by unit tests only.** The tests feed the parser documents written in each
+  server's shape. No live exchange with any of them has run yet.
+
 ## Supported FEPs
 
 - [FEP-67ff: FEDERATION.md](https://codeberg.org/fediverse/fep/src/branch/main/fep/67ff/fep-67ff.md)
 - [FEP-f1d5: NodeInfo in Fediverse Software](https://codeberg.org/fediverse/fep/src/branch/main/fep/f1d5/fep-f1d5.md)
 - [FEP-2c59: Discovery of a WebFinger address from an ActivityPub actor](https://codeberg.org/fediverse/fep/src/branch/main/fep/2c59/fep-2c59.md)
+- [FEP-1b12: Group federation](https://codeberg.org/fediverse/fep/src/branch/main/fep/1b12/fep-1b12.md) (communities; see "Groups")
 
-Planned: FEP-1b12 (communities), FEP-8fcf (followers synchronisation), FEP-5feb (`indexable`), FEP-7628 (Move),
+Planned (see `docs/ROADMAP.md`, phases P5 to P8, and the per-platform notes in `docs/INTEROP.md`): FEP-044f (quotes),
-FEP-044f (quotes).
+FEP-9967 (polls), FEP-c0e0 (emoji reactions), FEP-9098 (custom emoji), FEP-7888 and FEP-f228 (threads), FEP-7628 (Move),
+FEP-8fcf (followers synchronisation), FEP-5feb (`indexable`), FEP-8967 (link attachments), FEP-521a and FEP-8b32 (keys
+and integrity proofs), FEP-ae0c (relays).
 
 ## Actors
 
@@ -39,7 +56,8 @@ actor document, a collection, NodeInfo or a delivery relates two avatars of the
 The names are the project's own and are stable; resolve actors through WebFinger, not by guessing a path.
 
 - The key is `{actor}#main-key`, RSA 2048, served as SPKI PEM with `owner` set to the actor.
-- `published` on an actor is truncated to the day. `indexable` is `false`.
+- `published` on an actor is a whole day, chosen at random up to two weeks before the account was made, so two
+  personas made on the same day do not share a date. `indexable` is `false`.
 - The instance actor is `/peasants/privapub` (type `Application`). It signs every fetch PrivaPub makes, so no avatar's key
   is used to read another server's content.
 
@@ -69,30 +87,74 @@ Received:
 | `Follow` | follows an avatar or community; `Accept` is sent unless the community approves members by hand |
 | `Accept{Follow}`, `Reject{Follow}` | completes or ends a follow an avatar requested |
 | `Undo{Follow, Like, Announce}` | reverses it |
-| `Create{Note, Article, Page, Question, …}` | stored when a local avatar follows the author, is addressed or mentioned, when it replies to a local post, or when it is addressed to a community the author follows; a public parent is fetched to complete the thread |
+| `Create{Note, Article, Page, Question, Video, Audio, Event, ChatMessage, …}` | stored when a local avatar follows the author, is addressed or mentioned, when it replies to a local post, or when it is addressed to a community the author follows; a public parent is fetched to complete the thread |
 | `Update{Note}` | replaces the content; the previous version is kept |
 | `Update{Person}` | refetches the actor |
 | `Like` | counted and notified, on posts the liker could see |
+| `Dislike` | counted as a downvote (Lemmy, PieFed, Mbin, Friendica); `Undo` takes it back |
+| `EmojiReact`, `Like` with an emoji `content` | an emoji reaction (FEP-c0e0; Pleroma, Akkoma, Iceshrimp.NET, Misskey, Sharkey), Unicode or a custom emoji from its `tag`; a `Like` whose content is ❤ stays a favourite; `Undo` takes it back |
+| `Join` | answered with `Ignore`: PrivaPub hosts no events yet (FEP-8a8e) |
 | `Announce` | counted and notified for local posts; shown to followers of the announcer, with the original refetched from its origin |
-| `Delete` | deletes the object, or the actor and its follows |
+| `Delete` | deletes the object, or the actor and its follows; a deleted object id is remembered for 90 days, so a late `Create` cannot bring it back |
 | `Flag` | becomes a report for this server's moderators |
 
-Sent: `Follow`, `Undo{Follow}`, `Create{Note}`, `Update{Note}`, `Update{Person}`, `Delete{Tombstone}`, `Accept{Follow}`,
+Sent: `Follow`, `Undo{Follow}`, `Create{Note}`, `Create{Question}` and poll votes, `EmojiReact` and its `Undo`, `Update{Note}`, `Update{Person}`, `Delete{Tombstone}`, `Accept{Follow}`,
 `Reject{Follow}`, `Like`, `Announce` and their `Undo`, `Flag`. A deleted post answers 410 with a `Tombstone`.
 
 - **Attachments** are `Document`s with `mediaType`, `name` (alt text), `blurhash`, `focalPoint`, `width` and `height`.
   Uploaded files have all metadata removed.
 - **Pinned posts** are the actor's `featured` collection (`/trophies`); `featuredTags` is `/tattoos`.
-- **Blocks are never sent.** A blocked account is sent `Reject{Follow}` if it followed, and is unfollowed.
+- **Blocks are sent.** A blocked remote account receives `Block` from the blocking account (and `Reject{Follow}` if it
+  followed); an unblock sends `Undo{Block}`.
 - **Reports** are sent as `Flag` by the instance actor, never by the reporting account.
 
 A `Create`'s `Note` carries Mastodon's `content`, `contentMap`, `summary` and `sensitive`, plus `Mention` and `Hashtag`
-tags. A post's title becomes `name` and is also the first, bold line of `content`, because Mastodon does not show
+tags.
+
+**Polls** (FEP-9967) go out as a `Question` with `oneOf` or `anyOf`, each option's count in `replies.totalItems`,
+`endTime`, `votersCount`, and `closed` once it has ended. Incoming votes are `Create{Note{name, inReplyTo}}` with no
+content, one per choice, counted once per voter. Counts are refreshed with an `Update{Question}` at most every three
+minutes. Our own votes on other servers' polls are sent the same way to the poll's author only, without `published`.
+An incoming `Update` without a newer `updated` only refreshes counts and details; it is never recorded as an edit.
+
+**Quotes** (FEP-044f, with the older keys):
+- **Received.** A quote is read from `quote`, `quoteUrl`, `quoteUri`, `_misskey_quote` or a FEP-e232 `Link` tag.
+  - With a `quoteAuthorization`, the stamp is fetched and must be a `QuoteAuthorization` on the quoted author's origin,
+    attributed to them, naming exactly the two posts.
+  - A FEP-044f `quote` without a stamp is pending until an `Update` brings one.
+  - A quote made with the older keys only, by software that asks nobody, is shown when the quoted post is public.
+  - A `Delete` of a stamp revokes the quote.
+- **Sent.** Our accounts quote with every key, plus the `RE:` fallback.
+  - When the quoted post states an `interactionPolicy.canQuote` that allows us, `quote` is included and a `QuoteRequest`
+    (with the quoting post as `instrument`) goes to the quoted author. The quote stays pending until their `Accept` brings a
+    stamp we can verify; the post is then updated with `quoteAuthorization`.
+  - Posts that state no policy are quoted the older way, without `quote`.
+  - Quoting posts are also delivered to the quoted author.
+- **Not yet.** Our own posts cannot be quoted by others yet: we do not issue stamps.
+
+**Custom emoji** (`Emoji` tags) are read on posts, display names, bios and profile fields, at most 64 per object.
+**Profiles** keep their header, profile fields, `manuallyApprovesFollowers`, `published`, `movedTo`, `indexable`,
+`memorial` and avatar and header descriptions. A post's title becomes `name` and is also the first, bold line of `content`, because Mastodon does not show
 `name`. A content warning without its own text uses the title, or "Content warning".
 
+Received `summary` is a content warning only on a `Note` or `Question`, or when `sensitive` is `true`. On an `Article`,
+`Page`, `Event`, `Video` or `Audio` it is an excerpt or description, kept as such and never hidden.
+
 Visibility is expressed in `to`/`cc` the way Mastodon does it: public, unlisted, followers-only and direct. Inbound
 followers-only posts are recognised by the author's own `followers` collection.
 
+## Link previews
+
+For a public post that links to a page, PrivaPub builds a preview card. It uses, in order:
+1. a Link attachment's own `preview` (FEP-8967) or the post's own image, title and summary;
+2. otherwise, the linked page, read once by the server between 0 and 60 seconds after the post arrives (never when
+   someone reads it), with an `Accept: text/html` request that reads at most 512 KB, through the same address checks as
+   every other fetch.
+
+The page's OpenGraph and Twitter tags give the title, description and image; the result is cached per address for 7
+days and shared by every account on the server. Images are served to clients only through PrivaPub's media proxy.
+`Federation:FetchLinkPreviews=false` turns page fetching off.
+
 ## Local-only posts
 
 Posts with a location (shown to nearby users of this server) never leave the server, in any form.
@@ -108,12 +170,17 @@ Posts with a location (shown to nearby users of this server) never leave the ser
 - **Fetching.** All fetches are signed by the instance actor. They go only to public addresses, follow at most three
   redirects and read at most 1 MB.
 - **HTML.** Received HTML is sanitised to Mastodon's allowlist.
+- **Keys we cannot fetch for now.** When a sender's key cannot be fetched because its server timed out or answered
+  5xx, the inbox answers 503 with `Retry-After: 300` rather than 401.
+- **Activity ids.** `Create` and `Announce` ids dereference. `Follow`, `Like`, `Block` and the `Accept`, `Reject` and
+  `Undo` that answer them do not, because serving them would reveal who follows, likes and blocks whom; they are always
+  sent with their object embedded.
 - **Delivery.** Failed deliveries are retried with Mastodon's backoff (16 attempts). A host that keeps failing is paused,
   starting at an hour and growing to a week.
 
 ## Known limitations
 
-- Polls and custom emoji are not implemented.
+- Our own posts carry no custom emoji: emoji are received and shown, not offered.
 - Remote media is fetched through this server's proxy when a local client displays it.
 - Collections expose counts, not members.
 - Only `rsa-sha256`-style keys are verified. RFC 9421 signatures are planned.

PrivaPub.ClientModels/Constants.cs

@@ -9,5 +9,6 @@
 		public const int GroupInvitationLength = 64;
 
 		public const string PasswordRegex = @"^(?=.*)(?=.*[a-z])(?=.*[A-Z])(?!.*\s).*$";
+		public const string UserNameRegex = "^[a-z0-9_]+$";
 	}
 }

PrivaPub.ClientModels/Group/InsertGroupForm.cs

@@ -12,7 +12,7 @@ namespace PrivaPub.ClientModels.Group
 
 		[Required(ErrorMessageResourceName = "Required", ErrorMessageResourceType = typeof(ErrorsResource)),
 			StringLength(32, MinimumLength = 3, ErrorMessageResourceName = "StringLengthMinMax", ErrorMessageResourceType = typeof(ErrorsResource)),
-			RegularExpression("^[a-z0-9_]+$", ErrorMessageResourceName = "EmptySpacesNotAllowed", ErrorMessageResourceType = typeof(ErrorsResource)),
+			RegularExpression(Constants.UserNameRegex, ErrorMessageResourceName = "InvalidUserName", ErrorMessageResourceType = typeof(ErrorsResource)),
 			NoWhiteSpaces]
 		public string UserName { get; set; }
 

PrivaPub.ClientModels/InvitationLoginForm.cs

@@ -12,7 +12,7 @@ namespace PrivaPub.ClientModels
 		public string InvitationCode { get; set; }
 
 		[StringLength(32, MinimumLength = 3, ErrorMessageResourceName = "StringLengthMinMax", ErrorMessageResourceType = typeof(ErrorsResource)),
-			RegularExpression("^[a-z0-9_]+$", ErrorMessageResourceName = "EmptySpacesNotAllowed", ErrorMessageResourceType = typeof(ErrorsResource))]
+			RegularExpression(Constants.UserNameRegex, ErrorMessageResourceName = "InvalidUserName", ErrorMessageResourceType = typeof(ErrorsResource))]
 		public string AvatarUserName { get; set; }
 
 		[StringLength(64, ErrorMessageResourceName = "MaxLengthString", ErrorMessageResourceType = typeof(ErrorsResource))]

PrivaPub.ClientModels/Resources/ErrorsResource.Designer.cs

@@ -105,6 +105,15 @@ namespace PrivaPub.ClientModels.Resources {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to Use only lower-case letters, digits and underscores..
+        /// </summary>
+        public static string InvalidUserName {
+            get {
+                return ResourceManager.GetString("InvalidUserName", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to Invalid password, upper-case, lower-case and number characters required..
         /// </summary>

PrivaPub.ClientModels/Resources/ErrorsResource.it.resx

@@ -132,6 +132,9 @@
   <data name="InvalidEmail" xml:space="preserve">
     <value>{0} è invalida.</value>
   </data>
+  <data name="InvalidUserName" xml:space="preserve">
+    <value>Usa solo lettere minuscole, cifre e trattini bassi.</value>
+  </data>
   <data name="InvalidPassword" xml:space="preserve">
     <value>Password non valida, deve avere almeno un carattere grande, un carattere piccolo ed un numero.</value>
   </data>

PrivaPub.ClientModels/Resources/ErrorsResource.resx

@@ -132,6 +132,9 @@
   <data name="InvalidEmail" xml:space="preserve">
     <value>{0} is invalid.</value>
   </data>
+  <data name="InvalidUserName" xml:space="preserve">
+    <value>Use only lower-case letters, digits and underscores.</value>
+  </data>
   <data name="InvalidPassword" xml:space="preserve">
     <value>Invalid password, upper-case, lower-case and number characters required.</value>
   </data>

PrivaPub.ClientModels/User/Avatar/InsertAvatarForm.cs

@@ -20,6 +20,7 @@ namespace PrivaPub.ClientModels.User.Avatar
 
 		[Required(ErrorMessageResourceName = "Required", ErrorMessageResourceType = typeof(ErrorsResource)),
 			StringLength(Constants.MaxAvatarNameLength, ErrorMessageResourceName = "StringLength", ErrorMessageResourceType = typeof(ErrorsResource)),
+			RegularExpression(Constants.UserNameRegex, ErrorMessageResourceName = "InvalidUserName", ErrorMessageResourceType = typeof(ErrorsResource)),
 				Display(Name = nameof(UserName), ResourceType = typeof(FieldsNameResource))]
 		public string UserName { get; set; }//preferredUsername
 

PrivaPub.Tests/Api/StatusContentTests.cs

@@ -0,0 +1,29 @@
+using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Models.Post;
+
+namespace PrivaPub.Tests.Api
+{
+	public class StatusContentTests
+	{
+		[Fact]
+		public void A_remote_article_shows_its_title_above_its_body() =>
+			Assert.Equal("<p><strong>Rain &amp; sun</strong></p><p>body</p>", MastodonMapper.Content(new Post
+			{
+				IsFederatedCopy = true, ObjectType = "Article", Title = "Rain & sun", ContentHtml = "<p>body</p>"
+			}));
+
+		[Fact]
+		public void A_remote_note_keeps_its_content_alone() =>
+			Assert.Equal("<p>body</p>", MastodonMapper.Content(new Post
+			{
+				IsFederatedCopy = true, ObjectType = "Note", Title = "a poll choice", ContentHtml = "<p>body</p>"
+			}));
+
+		[Fact]
+		public void A_remote_event_without_a_body_shows_its_excerpt() =>
+			Assert.Equal("<p><strong>Meetup</strong></p><p>Saturday &lt;10:00&gt;</p>", MastodonMapper.Content(new Post
+			{
+				IsFederatedCopy = true, ObjectType = "Event", Title = "Meetup", Excerpt = "Saturday <10:00>", ContentHtml = string.Empty
+			}));
+	}
+}

PrivaPub.Tests/Domain/LinkPreviewTests.cs

@@ -0,0 +1,43 @@
+using PrivaPub.Domain.Content;
+using PrivaPub.Models.Post;
+
+namespace PrivaPub.Tests.Domain
+{
+	public class LinkPreviewTests
+	{
+		[Fact]
+		public void Reads_open_graph_then_twitter_then_the_page_title()
+		{
+			var preview = LinkPreviews.Read("https://news.example/a?utm_source=x", new Uri("https://news.example/a"), """
+				<html><head><title>Fallback title</title>
+				<meta property="og:title" content="Rain &amp; sun">
+				<meta name="twitter:description" content="A <b>long</b> story">
+				<meta property="og:image" content="/img/cover.jpg">
+				<meta property="og:site_name" content="News">
+				</head><body></body></html>
+				""");
+
+			Assert.Equal("Rain & sun", preview.Title);
+			Assert.Equal("A long story", preview.Description);
+			Assert.Equal("https://news.example/img/cover.jpg", preview.ImageURL);
+			Assert.Equal("News", preview.SiteName);
+			Assert.False(preview.Failed);
+			Assert.True(LinkPreviews.Read("https://x.example", new Uri("https://x.example"), "<html><body>nothing</body></html>").Failed);
+		}
+
+		[Fact]
+		public void Picks_the_first_real_link_and_skips_mentions_tags_quotes_and_ourselves() =>
+			Assert.Equal("https://blog.example/post", LinkPreviews.FirstLink(new Post
+			{
+				Url = "https://m.example/@a/1",
+				ContentHtml = """
+					<p><span class="h-card"><a href="https://m.example/@bob" class="u-url mention">@bob</a></span>
+					<a href="https://m.example/tags/x" class="mention hashtag" rel="tag">#x</a>
+					<span class="quote-inline">RE: <a href="https://k.example/notes/1">link</a></span>
+					<a href="https://privapub.test/@me">me</a>
+					<a href="https://m.example/@a/1">self</a>
+					<a href="https://blog.example/post">read this</a></p>
+					"""
+			}, "https://privapub.test"));
+	}
+}

PrivaPub.Tests/Domain/RelationshipTests.cs

@@ -62,7 +62,31 @@ namespace PrivaPub.Tests.Domain
 			});
 
 			Assert.False(await DB.Default.Find<Follower>().Match(f => f.LocalActorId == alice.Id).ExecuteAnyAsync(token));
-			Assert.Equal("Reject", Assert.Single(await _harness.Outgoing(mallory.Id + "/inbox"))["type"]!.GetValue<string>());
+			var sent = (await _harness.Outgoing(mallory.Id + "/inbox")).Select(a => a["type"]!.GetValue<string>()).ToList();
+			Assert.Equal(new[] { "Block", "Reject" }, sent.Order());
+		}
+
+		[Fact]
+		public async Task A_block_is_told_to_the_blocked_server_and_so_is_the_unblock()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{Origin(mallory)}/follows/{Guid.NewGuid():N}", ["type"] = "Follow", ["actor"] = mallory.Id, ["object"] = alice.Uri
+			});
+
+			await _harness.Relationships.Block(alice, mallory.Id, default, token);
+			await _harness.Relationships.Unblock(alice, mallory.Id, token);
+
+			var sent = await _harness.Outgoing(mallory.Id + "/inbox");
+			var block = Assert.Single(sent, a => a["type"]!.GetValue<string>() == "Block");
+			Assert.Equal(mallory.Id, block["object"]!.GetValue<string>());
+			Assert.Equal(alice.Uri, block["actor"]!.GetValue<string>());
+			var undo = Assert.Single(sent, a => a["type"]!.GetValue<string>() == "Undo");
+			Assert.Equal(block["id"]!.GetValue<string>(), undo["object"]!["id"]!.GetValue<string>());
+			Assert.False(await DB.Default.Find<Block>().Match(b => b.AvatarId == alice.Id).ExecuteAnyAsync(token));
 		}
 
 		[Fact]

PrivaPub.Tests/Federation/ActorProfileTests.cs

@@ -0,0 +1,41 @@
+using PrivaPub.Federation.Actors;
+
+using System.Text.Json;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class ActorProfileTests
+	{
+		[Fact]
+		public void Reads_a_mastodon_profile_with_its_header_fields_emoji_and_lock()
+		{
+			using var json = JsonDocument.Parse("""
+				{
+					"id": "https://m.example/users/ann", "type": "Person", "preferredUsername": "ann", "name": "Ann :sparkle:",
+					"inbox": "https://m.example/users/ann/inbox", "manuallyApprovesFollowers": true, "indexable": true, "memorial": false,
+					"published": "2023-04-01T00:00:00Z", "movedTo": "https://n.example/users/ann",
+					"icon": { "type": "Image", "url": "https://m.example/a.png", "summary": "a cat" },
+					"image": { "type": "Image", "url": "https://m.example/h.png", "name": "mountains" },
+					"tag": [{ "type": "Emoji", "name": ":sparkle:", "icon": { "type": "Image", "url": "https://m.example/emoji/sparkle.png" } }],
+					"attachment": [
+						{ "type": "PropertyValue", "name": "Site", "value": "<a href=\"https://ann.example\" rel=\"me\">ann.example</a><script>x</script>" },
+						{ "type": "PropertyValue", "name": "Pronouns", "value": "she/her" }
+					]
+				}
+				""");
+
+			var actor = ActorDocument.Parse(json.RootElement);
+
+			Assert.True(actor.Locked);
+			Assert.True(actor.Indexable);
+			Assert.Equal("https://m.example/h.png", actor.Header);
+			Assert.Equal("a cat", actor.IconDescription);
+			Assert.Equal("mountains", actor.HeaderDescription);
+			Assert.Equal("https://n.example/users/ann", actor.MovedTo);
+			Assert.Equal(new DateTime(2023, 4, 1, 0, 0, 0, DateTimeKind.Utc), actor.Published);
+			Assert.Equal("sparkle", Assert.Single(actor.Emojis).Shortcode);
+			Assert.Equal(new[] { "Site", "Pronouns" }, actor.Fields.Keys);
+			Assert.DoesNotContain("<script>", actor.Fields["Site"]);
+		}
+	}
+}

PrivaPub.Tests/Federation/InboundRoutingTests.cs

@@ -0,0 +1,139 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Post;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class InboundRoutingTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		static string NewId(RemoteActor actor, string kind) => $"{Origin(actor)}/{kind}/{Guid.NewGuid():N}";
+
+		async Task<Post> LocalPost(string text)
+		{
+			var (root, alice) = await _harness.Persona("alice");
+			await _harness.Posts.InsertPost(root, new InsertPostForm { AvatarId = alice.Id, Text = text }, TestContext.Current.CancellationToken);
+			return await DB.Default.Find<Post>().Match(p => p.GroupUserId == alice.Id).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+		}
+
+		[Fact]
+		public async Task A_downvote_counts_and_its_undo_takes_it_back()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var post = await LocalPost("vote on me");
+			var lemmy = new RemoteActor(_harness.Peer, "voter");
+			var dislike = new JsonObject { ["id"] = NewId(lemmy, "activities/dislike"), ["type"] = "Dislike", ["actor"] = lemmy.Id, ["object"] = post.ObjectURI };
+
+			await _harness.Deliver(lemmy, "/human-centipede", dislike);
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).DownvotesCount);
+
+			await _harness.Deliver(lemmy, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(lemmy, "activities/undo"), ["type"] = "Undo", ["actor"] = lemmy.Id, ["object"] = dislike.DeepClone()
+			});
+			Assert.Equal(0, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).DownvotesCount);
+		}
+
+		[Fact]
+		public async Task A_delete_that_arrives_first_keeps_the_post_from_coming_back()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			var noteId = NewId(mallory, "notes");
+
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(mallory, "activities/delete"), ["type"] = "Delete", ["actor"] = mallory.Id,
+				["object"] = new JsonObject { ["id"] = noteId, ["type"] = "Tombstone" }
+			});
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(mallory, "activities/create"), ["type"] = "Create", ["actor"] = mallory.Id,
+				["object"] = new JsonObject
+				{
+					["id"] = noteId, ["type"] = "Note", ["attributedTo"] = mallory.Id, ["content"] = "<p>late</p>",
+					["to"] = new JsonArray(Addressing.Public), ["cc"] = new JsonArray(alice.Uri),
+					["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = alice.Uri, ["name"] = "@alice" })
+				}
+			});
+
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.ObjectURI == noteId).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task A_lemmy_private_message_arrives_as_a_direct_message()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var lemmy = new RemoteActor(_harness.Peer, "pm");
+			var messageId = NewId(lemmy, "private_message");
+
+			await _harness.Deliver(lemmy, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(lemmy, "activities/create"), ["type"] = "Create", ["actor"] = lemmy.Id, ["to"] = new JsonArray(alice.Uri),
+				["object"] = new JsonObject
+				{
+					["id"] = messageId, ["type"] = "ChatMessage", ["attributedTo"] = lemmy.Id, ["to"] = new JsonArray(alice.Uri),
+					["content"] = "<p>psst</p>", ["mediaType"] = "text/html", ["published"] = DateTime.UtcNow.ToString("O")
+				}
+			});
+
+			var message = await DB.Default.Find<Post>().Match(p => p.ObjectURI == messageId).ExecuteFirstAsync(token);
+			Assert.NotNull(message);
+			Assert.Equal(PostVisibility.Direct, message.Visibility);
+			Assert.NotNull(message.ConversationId);
+		}
+
+		[Fact]
+		public async Task An_unreachable_key_asks_the_sender_to_retry_instead_of_refusing()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+			var offline = new RemoteActor(_harness.Peer, "offline", origin: "http://127.0.0.1:9");
+
+			var result = await _harness.Deliver(offline, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(offline, "follows"), ["type"] = "Follow", ["actor"] = offline.Id, ["object"] = alice.Uri
+			});
+
+			Assert.Equal(503, result.StatusCode);
+			Assert.Equal(300, result.RetryAfterSeconds);
+		}
+
+		[Fact]
+		public async Task A_join_of_a_local_post_is_answered_with_ignore()
+		{
+			var post = await LocalPost("not an event");
+			var mobilizon = new RemoteActor(_harness.Peer, "joiner");
+
+			await _harness.Deliver(mobilizon, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(mobilizon, "join"), ["type"] = "Join", ["actor"] = mobilizon.Id, ["object"] = post.ObjectURI
+			});
+
+			var answer = Assert.Single(await _harness.Outgoing(mobilizon.Id + "/inbox"));
+			Assert.Equal("Ignore", answer["type"]!.GetValue<string>());
+		}
+	}
+}

PrivaPub.Tests/Federation/InboxScenarioTests.cs

@@ -8,6 +8,8 @@ using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Inbox.Handlers;
 using PrivaPub.Federation.Inbox;
 using PrivaPub.Federation.Moderation;
+using PrivaPub.Domain.Social;
+using PrivaPub.Domain.Statuses;
 using PrivaPub.Federation.Objects;
 using PrivaPub.Federation.Outbox;
 using PrivaPub.Infrastructure.Jobs;
@@ -50,13 +52,15 @@ namespace PrivaPub.Tests.Federation
 			var db = new DbEntities();
 			_blocks = new DomainBlocks(NullLogger<DomainBlocks>.Instance);
 			_receiver = new InboxReceiver(_local, remote, queue, _blocks, NullLogger<InboxReceiver>.Instance);
+			var remotePosts = new RemotePosts(db, _local, remote, _blocks, queue, new ObjectRecords(queue), new NoPreviews());
+			var quotes = new QuoteService(db, remote, remotePosts, _local, delivery, new OutboxPublisher(db, _local, delivery));
 			_processor = new InboxProcessor(remote, new IActivityHandler[]
 			{
 				new FollowHandler(db, _local, remote, delivery),
-				new UndoHandler(db, _local),
+				new UndoHandler(db, _local, new Reactions(db, delivery)),
-				new CreateHandler(db, _local, remote, delivery, _blocks, new Fanout(db), new RemotePosts(db, _local, remote, _blocks, queue), new GroupDistributor(delivery)),
+				new CreateHandler(db, _local, remote, delivery, _blocks, new Fanout(db), remotePosts, new GroupDistributor(delivery), new ObjectRecords(queue), new PollService(db, _local, delivery, queue), new NoPreviews(), quotes),
-				new DeleteHandler(db, _local, remote, delivery, new GroupDistributor(delivery)),
+				new DeleteHandler(db, _local, remote, delivery, new GroupDistributor(delivery), quotes),
-				new UpdateHandler(db, _local, remote, new GroupDistributor(delivery))
+				new UpdateHandler(db, _local, remote, new GroupDistributor(delivery), new ObjectRecords(queue), quotes)
 			}, NullLogger<InboxProcessor>.Instance);
 		}
 

PrivaPub.Tests/Federation/NoteParserTests.cs

@@ -54,6 +54,7 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal("a cat", media.Description);
 			Assert.Equal(new[] { 0.5f, -1f }, media.Focus);
 			Assert.Equal(new DateTime(2026, 9, 30, 10, 0, 0, DateTimeKind.Utc), note.Published);
+			Assert.Null(note.Updated);
 		}
 
 		[Fact]
@@ -89,6 +90,28 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal("https://k.example/notes/8", note.QuoteUri);
 		}
 
+		[Theory]
+		[InlineData("Article", false, false)]
+		[InlineData("Event", false, false)]
+		[InlineData("Video", false, false)]
+		[InlineData("Page", false, false)]
+		[InlineData("Note", false, true)]
+		[InlineData("Question", false, true)]
+		[InlineData("Article", true, true)]
+		public void A_summary_warns_only_on_notes_or_when_marked_sensitive(string type, bool sensitive, bool warns)
+		{
+			var note = NoteParser.Parse(JsonNode.Parse($$"""
+				{
+					"id": "https://w.example/?p=12", "type": "{{type}}", "name": "Twelve", "summary": "Saturday, 10:00 at the library",
+					"sensitive": {{(sensitive ? "true" : "false")}}, "attributedTo": "https://w.example/author", "content": "<p>body</p>"
+				}
+				"""));
+
+			Assert.Equal(warns, note.Sensitive);
+			Assert.Equal(warns ? "Saturday, 10:00 at the library" : null, note.SpoilerText);
+			Assert.Equal(warns ? null : "Saturday, 10:00 at the library", note.Excerpt);
+		}
+
 		[Theory]
 		[InlineData("""{ "id": "https://x.example/1", "type": "Person" }""")]
 		[InlineData("""{ "id": "not a uri", "type": "Note" }""")]

PrivaPub.Tests/Federation/ObjectShapesTests.cs

@@ -0,0 +1,224 @@
+using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class ObjectShapesTests
+	{
+		static NoteDocument Parse(string json) => NoteParser.Parse(JsonNode.Parse(json));
+
+		[Fact]
+		public void Keeps_a_peertube_video_with_its_files_poster_captions_and_markdown_description()
+		{
+			var note = Parse("""
+				{
+					"id": "https://tube.example/videos/watch/1", "type": "Video", "name": "A *talk*", "duration": "PT6299S",
+					"mediaType": "text/markdown", "content": "**Bold** words", "sensitive": false, "views": 14771, "state": 1,
+					"isLiveBroadcast": false, "commentsPolicy": 2, "downloadEnabled": true,
+					"licence": { "identifier": "5", "name": "Attribution - Share Alike" }, "category": { "identifier": "2", "name": "Films" },
+					"attributedTo": [{ "type": "Person", "id": "https://tube.example/accounts/ann" }, { "type": "Group", "id": "https://tube.example/video-channels/films" }],
+					"icon": [
+						{ "type": "Image", "url": "https://tube.example/thumb-280.jpg", "mediaType": "image/jpeg", "width": 280, "height": 157 },
+						{ "type": "Image", "url": "https://tube.example/thumb-1920.jpg", "mediaType": "image/jpeg", "width": 1920, "height": 1080 },
+						{ "type": "Image", "url": "https://tube.example/thumb-850.jpg", "mediaType": "image/jpeg", "width": 850, "height": 480 }
+					],
+					"subtitleLanguage": [{ "identifier": "en", "url": [{ "mediaType": "text/vtt", "href": "https://tube.example/en.vtt" }] }],
+					"url": [
+						{ "type": "Link", "mediaType": "text/html", "href": "https://tube.example/w/abc" },
+						{ "type": "Link", "mediaType": "video/mp4", "href": "https://tube.example/720.mp4", "height": 720, "width": 1280, "fps": 24, "size": 942586378,
+							"attachment": [{ "type": "PropertyValue", "name": "ffprobe_codec_type", "value": "audio" }, { "type": "PropertyValue", "name": "ffprobe_codec_type", "value": "video" }] },
+						{ "type": "Link", "mediaType": "application/x-mpegURL", "href": "https://tube.example/master.m3u8" },
+						{ "type": "Link", "mediaType": "application/x-bittorrent;x-scheme-handler/magnet", "href": "magnet:?xt=urn:btih:abc" }
+					]
+				}
+				""");
+
+			Assert.Equal("https://tube.example/w/abc", note.Url);
+			Assert.Equal("A *talk*", note.Title);
+			Assert.Contains("<strong>Bold</strong>", note.ContentHtml);
+			Assert.Equal("https://tube.example/thumb-850.jpg", note.CoverURL);
+			Assert.Equal(6299, note.Video.DurationSeconds);
+			var file = Assert.Single(note.Video.Variants);
+			Assert.Equal(new[] { "audio", "video" }, file.Streams);
+			Assert.Equal(942586378, file.Size);
+			Assert.Equal("https://tube.example/master.m3u8", note.Video.PlaylistURL);
+			Assert.Equal(2, note.Video.CommentsPolicy);
+			Assert.Equal("Attribution - Share Alike", note.Video.Licence);
+			Assert.Equal("https://tube.example/video-channels/films", note.Video.ChannelURI);
+			Assert.Equal("https://tube.example/en.vtt", Assert.Single(note.Video.Captions).Url);
+			Assert.Equal("https://tube.example/accounts/ann", note.AttributedTo);
+		}
+
+		[Fact]
+		public void Keeps_a_mobilizon_event_with_its_time_place_and_online_link()
+		{
+			var note = Parse("""
+				{
+					"id": "https://events.example/events/9", "type": "Event", "name": "Repair café",
+					"summary": "<p>Saturday at the library</p>", "content": "<p>Bring broken things.</p>",
+					"startTime": "2026-10-03T10:00:00+02:00", "endTime": "2026-10-03T13:00:00+02:00", "timezone": "Europe/Rome",
+					"joinMode": "free", "participantCount": 12, "maximumAttendeeCapacity": 40, "ical:status": "CONFIRMED",
+					"location": { "type": "Place", "name": "Biblioteca", "latitude": 45.07, "longitude": 7.68,
+						"address": { "type": "PostalAddress", "streetAddress": "Via Roma 1", "addressLocality": "Torino", "addressCountry": "IT" } },
+					"attachment": [{ "type": "Link", "name": "Website", "href": "https://meet.example/repair" }],
+					"attributedTo": "https://events.example/@club"
+				}
+				""");
+
+			Assert.Null(note.SpoilerText);
+			Assert.False(note.Sensitive);
+			Assert.Equal("Saturday at the library", note.Excerpt);
+			Assert.Equal(new DateTime(2026, 10, 3, 8, 0, 0, DateTimeKind.Utc), note.Event.Start);
+			Assert.Equal("Via Roma 1, Torino, IT", Assert.Single(note.Event.Places).Address);
+			Assert.Equal("https://meet.example/repair", note.Event.OnlineURL);
+			Assert.Equal(40, note.Event.Capacity);
+			Assert.Equal("CONFIRMED", note.Event.Status);
+			Assert.Equal("2026-10-03 10:00 – 13:00 (Europe/Rome) · Biblioteca", MastodonMapper.EventLine(note.Event));
+		}
+
+		[Fact]
+		public void Keeps_a_lemmy_link_post_as_a_link_with_its_thumbnail()
+		{
+			var note = Parse("""
+				{
+					"id": "https://lemmy.example/post/5", "type": "Page", "name": "A good read", "attributedTo": "https://lemmy.example/u/bo",
+					"attachment": [{ "type": "Link", "href": "https://news.example/story", "mediaType": "text/html" }],
+					"image": { "type": "Image", "url": "https://lemmy.example/pictrs/thumb.jpg" },
+					"language": { "identifier": "en", "name": "English" }
+				}
+				""");
+
+			Assert.Equal("https://news.example/story", note.Link.Href);
+			Assert.Equal("https://lemmy.example/pictrs/thumb.jpg", note.Link.ImageURL);
+			Assert.False(note.Link.FromPublisher);
+			Assert.Empty(note.Attachments);
+		}
+
+		[Fact]
+		public void Takes_a_publisher_supplied_preview_from_a_link_attachment()
+		{
+			var note = Parse("""
+				{
+					"id": "https://m.example/statuses/1", "type": "Note", "attributedTo": "https://m.example/users/a", "content": "<p>look</p>",
+					"attachment": [{ "type": "Link", "href": "https://news.example/a",
+						"preview": { "type": "Article", "name": "Headline &amp; more", "summary": "<p>What happened</p>", "image": { "type": "Image", "url": "https://news.example/a.jpg" } } }]
+				}
+				""");
+
+			Assert.Equal("Headline & more", note.Link.Title);
+			Assert.Equal("What happened", note.Link.Description);
+			Assert.Equal("https://news.example/a.jpg", note.Link.ImageURL);
+			Assert.True(note.Link.FromPublisher);
+		}
+
+		[Fact]
+		public void Reads_media_in_every_shape_and_infers_what_is_missing()
+		{
+			var note = Parse("""
+				{
+					"id": "https://bsky.brid.gy/convert/ap/at://did:plc:x/post/1", "type": "Note", "attributedTo": "https://bsky.brid.gy/ap/did:plc:x",
+					"content": "<p>pics</p>",
+					"@context": ["https://www.w3.org/ns/activitystreams", { "@language": "de" }],
+					"attachment": [
+						{ "type": "Image", "url": "https://cdn.example/a.jpeg", "summary": "alt from summary" },
+						{ "type": "Document", "url": [{ "type": "Link", "href": "https://cdn.example/clip", "mediaType": "video/mp4" }],
+							"icon": { "type": "Image", "url": "https://cdn.example/clip.jpg" }, "duration": "PT12.4S", "sensitive": true },
+						{ "type": "Image", "url": "https://cdn.example/nameless" }
+					]
+				}
+				""");
+
+			Assert.Equal("de", note.Language);
+			Assert.Equal("image/jpeg", note.Attachments[0].ContentType);
+			Assert.Equal("alt from summary", note.Attachments[0].Description);
+			Assert.Equal("https://cdn.example/clip", note.Attachments[1].RemoteURL);
+			Assert.Equal("video/mp4", note.Attachments[1].ContentType);
+			Assert.Equal("https://cdn.example/clip.jpg", note.Attachments[1].RemotePreviewURL);
+			Assert.Equal(12.4, note.Attachments[1].DurationSeconds);
+			Assert.True(note.Attachments[1].Sensitive);
+			Assert.Equal("image/*", note.Attachments[2].ContentType);
+		}
+
+		[Fact]
+		public void Keeps_a_funkwhale_track_and_a_loops_poster()
+		{
+			var track = Parse("""
+				{
+					"id": "https://music.example/federation/music/uploads/1", "type": "Audio", "name": "Song", "attributedTo": "https://music.example/@band",
+					"summary": "#rock #live", "duration": 241, "position": 3, "album": "https://music.example/albums/2", "license": "https://creativecommons.org/licenses/by/4.0/",
+					"url": [{ "type": "Link", "mediaType": "text/html", "href": "https://music.example/library/tracks/1" },
+						{ "type": "Link", "mediaType": "audio/mpeg", "href": "https://music.example/listen/1.mp3", "bitrate": 320000, "size": 9640000 }]
+				}
+				""");
+			var loop = Parse("""
+				{
+					"id": "https://loops.example/v/1", "type": "Note", "attributedTo": "https://loops.example/@dancer", "content": "",
+					"preview": { "type": "Image", "url": { "href": "https://loops.example/poster.jpg", "mediaType": "image/jpeg" } },
+					"attachment": [{ "type": "Document", "mediaType": "video/mp4", "url": "https://loops.example/v/1.mp4", "width": 720, "height": 1280 }]
+				}
+				""");
+
+			Assert.Equal("#rock #live", track.Excerpt);
+			Assert.Null(track.SpoilerText);
+			Assert.Equal(241, track.Audio.DurationSeconds);
+			Assert.Equal(3, track.Audio.Position);
+			Assert.Equal("https://music.example/listen/1.mp3", Assert.Single(track.Audio.Variants).Url);
+			Assert.Equal("https://loops.example/poster.jpg", loop.CoverURL);
+		}
+
+		[Fact]
+		public void Keeps_custom_emoji_and_drops_ones_that_could_not_render()
+		{
+			var note = Parse("""
+				{
+					"id": "https://k.example/notes/1", "type": "Note", "attributedTo": "https://k.example/users/1", "content": ":blobcat: hi :bad:",
+					"tag": [
+						{ "type": "Emoji", "name": ":blobcat:", "updated": "2026-01-01T00:00:00Z", "icon": { "type": "Image", "mediaType": "image/png", "url": "https://k.example/emoji/blobcat.png" } },
+						{ "type": "Emoji", "name": ":blobcat:", "icon": { "type": "Image", "url": "https://k.example/emoji/duplicate.png" } },
+						{ "type": "Emoji", "name": ":bad name:", "icon": { "type": "Image", "url": "https://k.example/emoji/x.png" } },
+						{ "type": "Emoji", "name": ":nourl:", "icon": { "type": "Image", "url": "data:image/png;base64,AAAA" } }
+					]
+				}
+				""");
+
+			var emoji = Assert.Single(note.Emojis);
+			Assert.Equal("blobcat", emoji.Shortcode);
+			Assert.Equal("https://k.example/emoji/blobcat.png", emoji.URL);
+		}
+
+		[Fact]
+		public void Reads_polls_from_mastodon_misskey_and_closed_ones()
+		{
+			var mastodon = Parse("""
+				{ "id": "https://m.example/q/1", "type": "Question", "attributedTo": "https://m.example/u", "content": "?", "endTime": "2026-10-02T00:00:00Z", "votersCount": 7,
+					"oneOf": [{ "type": "Note", "name": "a", "replies": { "type": "Collection", "totalItems": 4 } }, { "type": "Note", "name": "b", "replies": { "type": "Collection", "totalItems": 3 } }] }
+				""");
+			var misskey = Parse("""
+				{ "id": "https://k.example/q/1", "type": "Question", "attributedTo": "https://k.example/u", "_misskey_content": "?",
+					"anyOf": [{ "type": "Note", "name": "x", "_misskey_votes": 2 }, { "type": "Note", "name": "y", "_misskey_votes": 5 }] }
+				""");
+			var closed = Parse("""
+				{ "id": "https://g.example/q/1", "type": "Question", "attributedTo": "https://g.example/u", "content": "?", "closed": "2026-09-30T12:00:00Z",
+					"oneOf": [{ "type": "Note", "name": "p" }, { "type": "Note", "name": "q" }] }
+				""");
+
+			Assert.False(mastodon.Poll.Multiple);
+			Assert.Equal(new[] { 4, 3 }, mastodon.Poll.Options.Select(o => o.Votes));
+			Assert.Equal(7, mastodon.Poll.VotersCount);
+			Assert.True(misskey.Poll.Multiple);
+			Assert.Equal(new[] { 2, 5 }, misskey.Poll.Options.Select(o => o.Votes));
+			Assert.Null(misskey.Poll.VotersCount);
+			Assert.Equal(new DateTime(2026, 9, 30, 12, 0, 0, DateTimeKind.Utc), closed.Poll.ClosedAt);
+		}
+
+		[Fact]
+		public void Normalises_hashtags_like_mastodon() =>
+			Assert.Equal("ｆｅｄｉ".Normalize(System.Text.NormalizationForm.FormKC).ToLowerInvariant(), Assert.Single(Parse("""
+				{ "id": "https://x.example/1", "type": "Note", "attributedTo": "https://x.example/u", "content": "",
+					"tag": [{ "type": "Hashtag", "name": "#ＦＥＤＩ" }] }
+				""").Tags));
+	}
+}

PrivaPub.Tests/Federation/PollTests.cs

@@ -0,0 +1,138 @@
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class PollTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		static string NewId(RemoteActor actor, string kind) => $"{Origin(actor)}/{kind}/{Guid.NewGuid():N}";
+
+		async Task Follows(RemoteActor follower, string target) =>
+			await _harness.Deliver(follower, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(follower, "follows"), ["type"] = "Follow", ["actor"] = follower.Id, ["object"] = target
+			});
+
+		JsonObject Vote(RemoteActor voter, string question, string owner, string choice) => new()
+		{
+			["id"] = NewId(voter, "activities"), ["type"] = "Create", ["actor"] = voter.Id, ["to"] = new JsonArray(owner),
+			["object"] = new JsonObject
+			{
+				["id"] = NewId(voter, "votes"), ["type"] = "Note", ["name"] = choice, ["attributedTo"] = voter.Id,
+				["inReplyTo"] = question, ["to"] = new JsonArray(owner)
+			}
+		};
+
+		[Fact]
+		public async Task A_local_poll_goes_out_as_a_question_and_counts_each_remote_voter_once()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			await Follows(mallory, alice.Uri);
+
+			var outcome = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "which?", Poll = new PollDraft(new[] { "tea", "coffee" }, 3600, false, false) }, token);
+			Assert.True(outcome.Ok);
+			var question = (await _harness.Outgoing(mallory.Id + "/inbox")).Single(a => a["type"]!.GetValue<string>() == "Create")["object"]!;
+			Assert.Equal("Question", question["type"]!.GetValue<string>());
+			Assert.Equal(new[] { "tea", "coffee" }, question["oneOf"]!.AsArray().Select(o => o!["name"]!.GetValue<string>()));
+
+			await _harness.Deliver(mallory, "/human-centipede", Vote(mallory, outcome.Post.ObjectURI, alice.Uri, "coffee"));
+			await _harness.Deliver(mallory, "/human-centipede", Vote(mallory, outcome.Post.ObjectURI, alice.Uri, "tea"));
+
+			var poll = (await DB.Default.Find<Post>().OneAsync(outcome.Post.ID, token)).Poll;
+			Assert.Equal(new[] { 0, 1 }, poll.Options.Select(o => o.Votes));
+			Assert.Equal(1, poll.VotersCount);
+			Assert.False(await DB.Default.Find<Post>().Match(p => p.InReplyToURI == outcome.Post.ObjectURI).ExecuteAnyAsync(token));
+			Assert.True(await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.PollRefresh && j.Payload == outcome.Post.ID).ExecuteAnyAsync(token));
+			Assert.True(await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.PollClose && j.Payload == outcome.Post.ID).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public async Task A_persona_votes_on_a_remote_poll_and_a_count_refresh_is_not_an_edit()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			var questionId = NewId(mallory, "questions");
+			JsonObject Question(int first, int second) => new()
+			{
+				["id"] = questionId, ["type"] = "Question", ["attributedTo"] = mallory.Id, ["content"] = "<p>pick</p>",
+				["to"] = new JsonArray(Addressing.Public), ["cc"] = new JsonArray(alice.Uri),
+				["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = alice.Uri, ["name"] = "@alice" }),
+				["endTime"] = DateTime.UtcNow.AddDays(1).ToString("O"),
+				["anyOf"] = new JsonArray(
+					new JsonObject { ["type"] = "Note", ["name"] = "red", ["replies"] = new JsonObject { ["type"] = "Collection", ["totalItems"] = first } },
+					new JsonObject { ["type"] = "Note", ["name"] = "blue", ["replies"] = new JsonObject { ["type"] = "Collection", ["totalItems"] = second } })
+			};
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(mallory, "activities"), ["type"] = "Create", ["actor"] = mallory.Id, ["object"] = Question(3, 1)
+			});
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == questionId).ExecuteFirstAsync(token);
+			Assert.True(post.Poll.Multiple);
+
+			Assert.True((await _harness.Polls.Vote(alice, post, new[] { 0, 1 }, token)).Ok);
+			Assert.False((await _harness.Polls.Vote(alice, post, new[] { 0 }, token)).Ok);
+
+			var votes = (await _harness.Outgoing(mallory.Id + "/inbox")).Where(a => a["type"]!.GetValue<string>() == "Create").Select(a => a["object"]!).ToList();
+			Assert.Equal(new[] { "red", "blue" }, votes.Select(v => v["name"]!.GetValue<string>()).Order().Reverse());
+			Assert.All(votes, v => Assert.Equal(questionId, v["inReplyTo"]!.GetValue<string>()));
+			Assert.All(votes, v => Assert.Null(v["published"]));
+			Assert.Equal(new[] { 0, 1 }, (await _harness.Polls.OwnVotes(post.ID, alice.Id, token)).Order());
+
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(mallory, "activities"), ["type"] = "Update", ["actor"] = mallory.Id, ["object"] = Question(9, 5)
+			});
+			var refreshed = await DB.Default.Find<Post>().OneAsync(post.ID, token);
+			Assert.Equal(new[] { 9, 5 }, refreshed.Poll.Options.Select(o => o.Votes));
+			Assert.Empty(refreshed.Revisions);
+			Assert.Null(refreshed.EditedAt);
+		}
+
+		[Fact]
+		public async Task Closing_a_poll_tells_its_voters_and_its_author()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var (_, bob) = await _harness.Persona("bob");
+			var outcome = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "quick", Poll = new PollDraft(new[] { "yes", "no" }, 300, false, false) }, token);
+			Assert.True((await _harness.Polls.Vote(bob, outcome.Post, new[] { 0 }, token)).Ok);
+			Assert.False((await _harness.Polls.Vote(alice, outcome.Post, new[] { 0 }, token)).Ok);
+
+			var job = await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.PollClose && j.Payload == outcome.Post.ID).ExecuteFirstAsync(token);
+			await new PollCloseJob(_harness.Db, _harness.Local, _harness.Outbox).Handle(job, token);
+
+			Assert.NotNull((await DB.Default.Find<Post>().OneAsync(outcome.Post.ID, token)).Poll.ClosedAt);
+			var told = await DB.Default.Find<Notification>().Match(n => n.Type == NotificationType.Poll && n.PostId == outcome.Post.ID).ExecuteAsync(token);
+			Assert.Equal(new[] { alice.Id, bob.Id }.Order(), told.Select(n => n.AvatarId).Order());
+			Assert.False((await _harness.Polls.Vote(bob, await DB.Default.Find<Post>().OneAsync(outcome.Post.ID, token), new[] { 1 }, token)).Ok);
+		}
+	}
+}

PrivaPub.Tests/Federation/ProvenanceTests.cs

@@ -0,0 +1,85 @@
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class ProvenanceTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		[Fact]
+		public async Task A_delivered_post_keeps_its_raw_object_how_it_came_and_every_edit()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			var origin = new Uri(mallory.Id).GetLeftPart(UriPartial.Authority);
+			var note = new JsonObject
+			{
+				["id"] = $"{origin}/notes/{Guid.NewGuid():N}",
+				["type"] = "Note",
+				["attributedTo"] = mallory.Id,
+				["content"] = "<p>hi</p>",
+				["_misskey_quote"] = $"{origin}/notes/elsewhere",
+				["to"] = new JsonArray(Addressing.Public),
+				["cc"] = new JsonArray(alice.Uri),
+				["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = alice.Uri, ["name"] = "@alice" })
+			};
+			var create = new JsonObject { ["id"] = $"{origin}/activities/{Guid.NewGuid():N}", ["type"] = "Create", ["actor"] = mallory.Id, ["object"] = note.DeepClone() };
+
+			await _harness.Deliver(mallory, "/human-centipede", create);
+			var edited = note.DeepClone().AsObject();
+			edited["content"] = "<p>hi again</p>";
+			edited["updated"] = DateTime.UtcNow.ToString("O");
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = $"{origin}/activities/{Guid.NewGuid():N}", ["type"] = "Update", ["actor"] = mallory.Id, ["object"] = edited
+			});
+
+			var record = await DB.Default.Find<ObjectRecord>().Match(r => r.ObjectURI == note["id"]!.GetValue<string>()).ExecuteFirstAsync(token);
+			Assert.NotNull(record);
+			Assert.Equal(ObjectPath.Delivered, record.Path);
+			Assert.False(record.Refetched);
+			Assert.Equal("shared", record.Inbox);
+			Assert.Equal(mallory.KeyId, record.KeyId);
+			Assert.Equal(create["id"]!.GetValue<string>(), record.ActivityId);
+			Assert.Contains("digest", record.SignedHeaders);
+			Assert.Equal("<p>hi</p>", JsonNode.Parse(record.Raw)!["content"]!.GetValue<string>());
+			Assert.Contains("legacy-quote", ObjectFeatures.Detect(JsonNode.Parse(record.Raw)!.AsObject()));
+			Assert.Equal("<p>hi again</p>", JsonNode.Parse(Assert.Single(record.Revisions).Raw)!["content"]!.GetValue<string>());
+			Assert.True(await DB.Default.Find<Job>().Match(j => j.Kind == JobKind.DescribeInstance && j.Payload == record.Host).ExecuteAnyAsync(token));
+		}
+
+		[Fact]
+		public void An_object_larger_than_the_cap_keeps_only_its_hash()
+		{
+			var big = new JsonObject { ["content"] = new string('x', ObjectRecords.MaxRawBytes + 1) };
+
+			var (text, hash, bytes, truncated) = ObjectRecords.Capture(big);
+
+			Assert.Null(text);
+			Assert.True(truncated);
+			Assert.True(bytes > ObjectRecords.MaxRawBytes);
+			Assert.Equal(64, hash.Length);
+		}
+	}
+}

PrivaPub.Tests/Federation/QuoteTests.cs

@@ -0,0 +1,159 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Post;
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	[Trait("Category", "Integration")]
+	public sealed class QuoteTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		static string NewId(RemoteActor actor, string kind) => $"{Origin(actor)}/{kind}/{Guid.NewGuid():N}";
+
+		async Task<Post> Delivered(RemoteActor author, string mentioned, Action<JsonObject> shape = default)
+		{
+			var note = new JsonObject
+			{
+				["id"] = NewId(author, "notes"), ["type"] = "Note", ["attributedTo"] = author.Id, ["content"] = "<p>hello</p>",
+				["to"] = new JsonArray(Addressing.Public), ["cc"] = new JsonArray(mentioned),
+				["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = mentioned, ["name"] = "@someone" })
+			};
+			shape?.Invoke(note);
+			await _harness.Deliver(author, "/human-centipede", new JsonObject { ["id"] = NewId(author, "activities"), ["type"] = "Create", ["actor"] = author.Id, ["object"] = note });
+			return await DB.Default.Find<Post>().Match(p => p.ObjectURI == note["id"]!.GetValue<string>()).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+		}
+
+		string Stamp(RemoteActor quotedAuthor, string quoting, string quoted)
+		{
+			var path = $"/stamps/{Guid.NewGuid():N}";
+			var id = Origin(quotedAuthor) + path;
+			_harness.Peer.Serve(path, new JsonObject
+			{
+				["@context"] = "https://www.w3.org/ns/activitystreams", ["id"] = id, ["type"] = "QuoteAuthorization",
+				["attributedTo"] = quotedAuthor.Id, ["interactingObject"] = quoting, ["interactionTarget"] = quoted
+			}.ToJsonString());
+			return id;
+		}
+
+		[Fact]
+		public async Task A_misskey_quote_of_a_public_post_is_shown_and_counted()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var ann = new RemoteActor(_harness.Peer, "ann");
+			var kitty = new RemoteActor(_harness.Peer, "kitty");
+			var original = await Delivered(ann, alice.Uri);
+
+			var quoting = await Delivered(kitty, alice.Uri, n =>
+			{
+				n["_misskey_quote"] = original.ObjectURI;
+				n["content"] = $"<p>look<span class=\"quote-inline\"><br>RE: <a href=\"{original.ObjectURI}\">{original.ObjectURI}</a></span></p>";
+			});
+
+			Assert.Equal(QuoteState.Accepted, quoting.QuoteState);
+			Assert.Equal(original.ID, quoting.QuotedPostId);
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(original.ID, token)).QuotesCount);
+			var status = await new PrivaPub.Api.Mastodon.Mappers.MastodonMapper(_harness.Db, _harness.Local).Status(quoting, alice.Id, token);
+			Assert.Equal("accepted", status.Quote.State);
+			Assert.Equal(original.ID, status.Quote.QuotedStatus.Id);
+			Assert.DoesNotContain("RE:", status.Content);
+		}
+
+		[Fact]
+		public async Task A_stamped_quote_is_accepted_a_forged_one_is_not_and_revoking_takes_it_back()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var ann = new RemoteActor(_harness.Peer, "ann");
+			var bob = new RemoteActor(_harness.Peer, "bob");
+			var original = await Delivered(ann, alice.Uri);
+			var quotingId = NewId(bob, "notes");
+			var stamp = Stamp(ann, quotingId, original.ObjectURI);
+			var forged = Stamp(ann, NewId(bob, "notes"), original.ObjectURI);
+
+			var quoting = await Delivered(bob, alice.Uri, n => { n["id"] = quotingId; n["quote"] = original.ObjectURI; n["quoteAuthorization"] = stamp; });
+			var cheat = await Delivered(bob, alice.Uri, n => { n["quote"] = original.ObjectURI; n["quoteAuthorization"] = forged; });
+			var waiting = await Delivered(bob, alice.Uri, n => n["quote"] = original.ObjectURI);
+
+			Assert.Equal(QuoteState.Accepted, quoting.QuoteState);
+			Assert.Equal(QuoteState.Unauthorized, cheat.QuoteState);
+			Assert.Equal(QuoteState.Pending, waiting.QuoteState);
+
+			await _harness.Deliver(ann, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(ann, "activities"), ["type"] = "Delete", ["actor"] = ann.Id, ["object"] = stamp
+			});
+			Assert.Equal(QuoteState.Revoked, (await DB.Default.Find<Post>().OneAsync(quoting.ID, token)).QuoteState);
+			Assert.Equal(0, (await DB.Default.Find<Post>().OneAsync(original.ID, token)).QuotesCount);
+		}
+
+		[Fact]
+		public async Task A_persona_asks_before_quoting_and_is_stamped_when_accepted()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var ann = new RemoteActor(_harness.Peer, "ann");
+			var original = await Delivered(ann, alice.Uri, n => n["interactionPolicy"] = new JsonObject
+			{
+				["canQuote"] = new JsonObject { ["automaticApproval"] = new JsonArray(Addressing.Public) }
+			});
+
+			var outcome = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "this", QuotedStatusId = original.ID }, token);
+			Assert.Equal(QuoteState.Pending, outcome.Post.QuoteState);
+			var request = Assert.Single(await _harness.Outgoing(ann.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "QuoteRequest");
+			Assert.Equal(original.ObjectURI, request["object"]!.GetValue<string>());
+			Assert.Equal(original.ObjectURI, request["instrument"]!["quote"]!.GetValue<string>());
+
+			await _harness.Deliver(ann, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(ann, "activities"), ["type"] = "Accept", ["actor"] = ann.Id,
+				["object"] = request["id"]!.GetValue<string>(), ["result"] = Stamp(ann, outcome.Post.ObjectURI, original.ObjectURI)
+			});
+
+			var quoting = await DB.Default.Find<Post>().OneAsync(outcome.Post.ID, token);
+			Assert.Equal(QuoteState.Accepted, quoting.QuoteState);
+			Assert.NotNull(quoting.QuoteAuthorizationURI);
+			Assert.Contains(await _harness.Outgoing(ann.Id + "/inbox"), a => a["type"]!.GetValue<string>() == "Update"
+				&& a["object"]!["quoteAuthorization"]?.GetValue<string>() == quoting.QuoteAuthorizationURI);
+		}
+
+		[Fact]
+		public async Task A_legacy_post_is_quoted_without_asking_and_another_persona_cannot_be_quoted_yet()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (aliceRoot, alice) = await _harness.Persona("alice");
+			var (bobRoot, bob) = await _harness.Persona("bob");
+			var kitty = new RemoteActor(_harness.Peer, "kitty");
+			var legacy = await Delivered(kitty, alice.Uri);
+			await _harness.Posts.InsertPost(bobRoot, new InsertPostForm { AvatarId = bob.Id, Text = "mine" }, token);
+			var bobs = await DB.Default.Find<Post>().Match(p => p.GroupUserId == bob.Id).ExecuteFirstAsync(token);
+
+			var outcome = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "nice", QuotedStatusId = legacy.ID }, token);
+			Assert.Equal(QuoteState.Accepted, outcome.Post.QuoteState);
+			Assert.False(outcome.Post.QuoteByConsent);
+			Assert.False((await _harness.Statuses.Publish(alice, new StatusDraft { Text = "and this", QuotedStatusId = bobs.ID }, token)).Ok);
+			Assert.True((await _harness.Statuses.Publish(bob, new StatusDraft { Text = "me again", QuotedStatusId = bobs.ID }, token)).Ok);
+		}
+	}
+}

PrivaPub.Tests/Federation/ReactionTests.cs

@@ -0,0 +1,119 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels.Post;
+using PrivaPub.Domain.Social;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Tests.Support;
+
+using System.Text.Json.Nodes;
+
+namespace PrivaPub.Tests.Federation
+{
+	public class ReactionNamesTests
+	{
+		[Theory]
+		[InlineData(":blobcat@k.example:", "blobcat")]
+		[InlineData("👍🏽", "👍🏽")]
+		[InlineData("❤️", "❤️")]
+		[InlineData("nope", null)]
+		[InlineData("👍👍", null)]
+		[InlineData(":unknown:", null)]
+		public void Normalises_what_peers_send(string content, string expected) =>
+			Assert.Equal(expected, Reactions.Normalise(content, new List<CustomEmoji> { new() { Shortcode = "blobcat", URL = "https://k.example/e.png" } })?.Name);
+	}
+
+	[Trait("Category", "Integration")]
+	public sealed class ReactionTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static string Origin(RemoteActor actor) => new Uri(actor.Id).GetLeftPart(UriPartial.Authority);
+
+		static string NewId(RemoteActor actor, string kind) => $"{Origin(actor)}/{kind}/{Guid.NewGuid():N}";
+
+		async Task<Post> LocalPost()
+		{
+			var (root, alice) = await _harness.Persona("alice");
+			await _harness.Posts.InsertPost(root, new InsertPostForm { AvatarId = alice.Id, Text = "react to me" }, TestContext.Current.CancellationToken);
+			return await DB.Default.Find<Post>().Match(p => p.GroupUserId == alice.Id).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+		}
+
+		[Fact]
+		public async Task Misskey_and_pleroma_reactions_are_kept_apart_from_favourites()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var post = await LocalPost();
+			var misskey = new RemoteActor(_harness.Peer, "kitty");
+			var pleroma = new RemoteActor(_harness.Peer, "pleroma");
+
+			await _harness.Deliver(misskey, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(misskey, "likes"), ["type"] = "Like", ["actor"] = misskey.Id, ["object"] = post.ObjectURI, ["content"] = ":blobcat:",
+				["_misskey_reaction"] = ":blobcat:",
+				["tag"] = new JsonArray(new JsonObject { ["type"] = "Emoji", ["name"] = ":blobcat:", ["icon"] = new JsonObject { ["type"] = "Image", ["url"] = $"{Origin(misskey)}/emoji/blobcat.png" } })
+			});
+			await _harness.Deliver(misskey, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(misskey, "likes"), ["type"] = "Like", ["actor"] = misskey.Id, ["object"] = post.ObjectURI, ["content"] = "❤"
+			});
+			var fire = new JsonObject { ["id"] = NewId(pleroma, "activities"), ["type"] = "EmojiReact", ["actor"] = pleroma.Id, ["object"] = post.ObjectURI, ["content"] = "🔥" };
+			await _harness.Deliver(pleroma, "/human-centipede", fire);
+
+			var kept = await DB.Default.Find<Reaction>().Match(r => r.PostId == post.ID).ExecuteAsync(token);
+			Assert.Equal(new HashSet<string> { "blobcat", "🔥" }, kept.Select(r => r.Emoji).ToHashSet());
+			Assert.Equal($"{Origin(misskey)}/emoji/blobcat.png", kept.Single(r => r.Emoji == "blobcat").EmojiURL);
+			Assert.Equal(1, (await DB.Default.Find<Post>().OneAsync(post.ID, token)).FavouritesCount);
+			Assert.True(await DB.Default.Find<Notification>().Match(n => n.Type == NotificationType.Reaction && n.Emoji == "🔥").ExecuteAnyAsync(token));
+
+			await _harness.Deliver(pleroma, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(pleroma, "activities"), ["type"] = "Undo", ["actor"] = pleroma.Id, ["object"] = fire.DeepClone()
+			});
+			Assert.Equal("blobcat", Assert.Single(await DB.Default.Find<Reaction>().Match(r => r.PostId == post.ID).ExecuteAsync(token)).Emoji);
+		}
+
+		[Fact]
+		public async Task A_persona_reacts_to_a_remote_post_and_takes_it_back()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var mallory = new RemoteActor(_harness.Peer, "mallory");
+			var noteId = NewId(mallory, "notes");
+			await _harness.Deliver(mallory, "/human-centipede", new JsonObject
+			{
+				["id"] = NewId(mallory, "activities"), ["type"] = "Create", ["actor"] = mallory.Id,
+				["object"] = new JsonObject
+				{
+					["id"] = noteId, ["type"] = "Note", ["attributedTo"] = mallory.Id, ["content"] = "<p>hi</p>",
+					["to"] = new JsonArray(Addressing.Public), ["cc"] = new JsonArray(alice.Uri),
+					["tag"] = new JsonArray(new JsonObject { ["type"] = "Mention", ["href"] = alice.Uri, ["name"] = "@alice" })
+				}
+			});
+			var post = await DB.Default.Find<Post>().Match(p => p.ObjectURI == noteId).ExecuteFirstAsync(token);
+
+			Assert.True(await _harness.Reactions.React(alice, post, "🎉", token));
+			Assert.False(await _harness.Reactions.React(alice, post, "not an emoji", token));
+			Assert.True(await _harness.Reactions.Unreact(alice, post, "🎉", token));
+
+			var sent = await _harness.Outgoing(mallory.Id + "/inbox");
+			var react = Assert.Single(sent, a => a["type"]!.GetValue<string>() == "EmojiReact");
+			Assert.Equal("🎉", react["content"]!.GetValue<string>());
+			Assert.Equal(noteId, react["object"]!.GetValue<string>());
+			Assert.Equal(react["id"]!.GetValue<string>(), Assert.Single(sent, a => a["type"]!.GetValue<string>() == "Undo")["object"]!["id"]!.GetValue<string>());
+		}
+	}
+}

PrivaPub.Tests/Federation/RendererTests.cs

@@ -57,7 +57,7 @@ namespace PrivaPub.Tests.Federation
 				Language = "en",
 				Mentions = new() { new PostMention { ActorURI = "https://m.example/users/bob", Handle = "@bob@m.example" } },
 				Tags = new() { "cats" },
-				CreationDate = new DateTime(2026, 9, 30, 17, 45, 12, DateTimeKind.Utc)
+				CreationDate = new DateTime(2026, 9, 30, 17, 45, 12, 345, DateTimeKind.Utc)
 			};
 
 			var note = ActivityPubRenderer.Note(post, Alice, default, "https://m.example/users/bob/statuses/1");
@@ -67,7 +67,7 @@ namespace PrivaPub.Tests.Federation
 			Assert.Equal("<p><strong>On &lt;cats&gt;</strong></p><p>body</p>", note["content"]!.GetValue<string>());
 			Assert.Equal("On <cats>", note["summary"]!.GetValue<string>());
 			Assert.True(note["sensitive"]!.GetValue<bool>());
-			Assert.Equal("2026-09-30T17:45:12Z", note["published"]!.GetValue<string>());
+			Assert.Equal("2026-09-30T17:45:12.345Z", note["published"]!.GetValue<string>());
 			Assert.Equal(new[] { ActivityPubRenderer.Public }, note["to"]!.AsArray().Select(n => n!.GetValue<string>()));
 			Assert.Equal(new[] { Alice.Followers, "https://m.example/users/bob" }, note["cc"]!.AsArray().Select(n => n!.GetValue<string>()));
 			var tags = note["tag"]!.AsArray();

PrivaPub.Tests/Infrastructure/PrivacyIdsTests.cs

@@ -12,15 +12,18 @@ namespace PrivaPub.Tests.Infrastructure
 		[Fact]
 		public void Persona_ids_carry_only_the_day_and_share_nothing_else()
 		{
-			var first = (string)new Avatar().GenerateNewID();
+			var avatar = new Avatar();
-			var second = (string)new Avatar().GenerateNewID();
+			var first = (string)avatar.GenerateNewID();
+			var second = (string)new Avatar { PublishedOn = avatar.PublishedOn }.GenerateNewID();
+			var group = new GroupEntity();
 
 			Assert.True(ObjectId.TryParse(first, out var a));
 			Assert.True(ObjectId.TryParse(second, out var b));
-			Assert.Equal(DateTime.UtcNow.Date, a.CreationTime);
+			Assert.Equal(avatar.PublishedOn, a.CreationTime);
+			Assert.InRange(a.CreationTime, DateTime.UtcNow.Date.AddDays(-13), DateTime.UtcNow.Date);
 			Assert.Equal(a.CreationTime, b.CreationTime);
 			Assert.NotEqual(first[8..14], second[8..14]);
-			Assert.Equal(DateTime.UtcNow.Date, ObjectId.Parse((string)new GroupEntity().GenerateNewID()).CreationTime);
+			Assert.Equal(group.PublishedOn, ObjectId.Parse((string)group.GenerateNewID()).CreationTime);
 		}
 
 		[Fact]
@@ -33,6 +36,33 @@ namespace PrivaPub.Tests.Infrastructure
 			Assert.Equal(new DateTime(2025, 1, 1, 0, 0, 0, DateTimeKind.Utc), ObjectId.Parse(older).CreationTime);
 		}
 
+		[Fact]
+		public void A_post_arriving_live_sorts_after_everything_already_stored()
+		{
+			var local = ObjectId.GenerateNewId().ToString();
+			var reply = PrivacyIds.Arrived(DateTime.UtcNow.AddSeconds(-30));
+			var skewed = PrivacyIds.Arrived(DateTime.UtcNow.AddYears(50));
+
+			Assert.True(string.CompareOrdinal(local, reply) < 0);
+			Assert.True(string.CompareOrdinal(reply, skewed) < 0);
+			Assert.True(ObjectId.Parse(skewed).CreationTime < DateTime.UtcNow.AddMinutes(1));
+		}
+
+		[Fact]
+		public void A_backfilled_post_keeps_its_published_time() =>
+			Assert.Equal(new DateTime(2025, 1, 1, 0, 0, 0, DateTimeKind.Utc), ObjectId.Parse(PrivacyIds.Arrived(new DateTime(2025, 1, 1, 0, 0, 0, DateTimeKind.Utc))).CreationTime);
+
+		[Fact]
+		public void A_persona_publishes_a_day_within_two_weeks_before_its_creation()
+		{
+			var created = new DateTime(2026, 10, 1, 15, 30, 0, DateTimeKind.Utc);
+			var days = Enumerable.Range(0, 200).Select(_ => PrivacyIds.PublishedDay(created)).ToList();
+
+			Assert.All(days, d => Assert.Equal(TimeSpan.Zero, d.TimeOfDay));
+			Assert.All(days, d => Assert.InRange(d, created.Date.AddDays(-13), created.Date));
+			Assert.True(days.Distinct().Count() > 1);
+		}
+
 		[Fact]
 		public void A_published_time_in_the_future_is_clamped() =>
 			Assert.True(ObjectId.Parse(PrivacyIds.At(DateTime.UtcNow.AddYears(50))).CreationTime < DateTime.UtcNow.AddDays(2));

PrivaPub.Tests/Support/Harness.cs

@@ -16,6 +16,7 @@ using PrivaPub.Federation.Inbox.Handlers;
 using PrivaPub.Federation.Outbox;
 using PrivaPub.Infrastructure.Jobs;
 using PrivaPub.Models;
+using PrivaPub.Federation.Objects;
 using PrivaPub.Models.Federation;
 using PrivaPub.Models.Jobs;
 using PrivaPub.Models.User;
@@ -42,27 +43,34 @@ namespace PrivaPub.Tests.Support
 			Delivery = new DeliveryService(Db, Queue);
 			Fanout = new Fanout(Db);
 			Groups = new GroupDistributor(Delivery);
-			RemotePosts = new RemotePosts(Db, Local, Remote, new NoBlocks(), Queue);
+			Records = new ObjectRecords(Queue);
+			Polls = new PollService(Db, Local, Delivery, Queue);
+			Reactions = new Reactions(Db, Delivery);
+			RemotePosts = new RemotePosts(Db, Local, Remote, new NoBlocks(), Queue, Records, new NoPreviews());
+			Outbox = new OutboxPublisher(Db, Local, Delivery);
+			Quotes = new QuoteService(Db, Remote, RemotePosts, Local, Delivery, Outbox);
 			Receiver = new InboxReceiver(Local, Remote, Queue, new NoBlocks(), NullLogger<InboxReceiver>.Instance);
 			Processor = new InboxProcessor(Remote, new IActivityHandler[]
 			{
 				new FollowHandler(Db, Local, Remote, Delivery),
-				new AcceptHandler(Db, Local),
+				new AcceptHandler(Db, Local, Quotes),
-				new RejectHandler(Db, Local),
+				new RejectHandler(Db, Local, Quotes),
-				new UndoHandler(Db, Local),
+				new UndoHandler(Db, Local, Reactions),
-				new LikeHandler(Db),
+				new LikeHandler(Db, Reactions),
+				new EmojiReactHandler(Db, Reactions),
+				new DislikeHandler(Db),
+				new JoinHandler(Db, Local, Delivery),
 				new AnnounceHandler(Db, Local, RemotePosts, Fanout, Remote),
-				new CreateHandler(Db, Local, Remote, Delivery, new NoBlocks(), Fanout, RemotePosts, Groups),
+				new CreateHandler(Db, Local, Remote, Delivery, new NoBlocks(), Fanout, RemotePosts, Groups, Records, Polls, new NoPreviews(), Quotes),
-				new DeleteHandler(Db, Local, Remote, Delivery, Groups),
+				new DeleteHandler(Db, Local, Remote, Delivery, Groups, Quotes),
-				new UpdateHandler(Db, Local, Remote, Groups),
+				new UpdateHandler(Db, Local, Remote, Groups, Records, Quotes),
 				new FlagHandler(Db, Local)
 			}, NullLogger<InboxProcessor>.Instance);
 			Follows = new FollowService(Db, Local, Remote, Delivery, new KeyLocalizer<GenericRes>(), NullLogger<FollowService>.Instance);
 			Content = new ContentRenderer(Local, Remote);
-			Outbox = new OutboxPublisher(Db, Local, Delivery);
 			Media = new MediaService(new StaticOptions<MediaOptions>(new MediaOptions { Root = Path.Combine(Path.GetTempPath(), $"privapub-media-{Guid.NewGuid():N}") }),
 				Local, default, NullLogger<MediaService>.Instance);
-			Statuses = new StatusService(Db, Local, Remote, Delivery, Content, Outbox, Fanout, Media, Groups);
+			Statuses = new StatusService(Db, Local, Remote, Delivery, Content, Outbox, Fanout, Media, Groups, Polls, new NoPreviews(), Quotes);
 			Posts = new PostsService(Db, Local, Statuses, new KeyLocalizer<GenericRes>(), NullLogger<PostsService>.Instance);
 			Timelines = new TimelineService(Db, new KeyLocalizer<GenericRes>());
 			Relationships = new RelationshipService(Db, Follows, Delivery);
@@ -86,6 +94,10 @@ namespace PrivaPub.Tests.Support
 		public GroupDistributor Groups { get; }
 		public Fanout Fanout { get; }
 		public RemotePosts RemotePosts { get; }
+		public ObjectRecords Records { get; }
+		public PollService Polls { get; }
+		public Reactions Reactions { get; }
+		public QuoteService Quotes { get; }
 		public TimelineService Timelines { get; }
 		public RelationshipService Relationships { get; }
 		public ReportService Reports { get; }
@@ -138,4 +150,9 @@ namespace PrivaPub.Tests.Support
 		public LocalizedString this[string name, params object[] arguments] => new(name, string.Format(name, arguments));
 		public IEnumerable<LocalizedString> GetAllStrings(bool includeParentCultures) => Enumerable.Empty<LocalizedString>();
 	}
+
+	public sealed class NoPreviews : ILinkPreviews
+	{
+		public Task Wanted(PrivaPub.Models.Post.Post post, CancellationToken token) => Task.CompletedTask;
+	}
 }

PrivaPub/Api/Mastodon/Controllers/InstanceController.cs

@@ -73,6 +73,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			domain = Domain,
 			title = "PrivaPub",
 			version = Version,
+			api_versions = new { mastodon = 7 },
 			source_url = "https://git.thepra.dev/thepra/SocialPub",
 			description = Description,
 			usage = new { users = new { active_month = 0 } },

PrivaPub/Api/Mastodon/Controllers/PollsController.cs

@@ -0,0 +1,54 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+using PrivaPub.Api.Mastodon.Infrastructure;
+using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Domain.Privacy;
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Models.Post;
+using PrivaPub.StaticServices;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Api.Mastodon.Controllers
+{
+	public class PollsController : MastodonController
+	{
+		readonly DbEntities _dbEntities;
+		readonly MastodonMapper _mapper;
+		readonly IPollService _polls;
+
+		public PollsController(DbEntities dbEntities, MastodonMapper mapper, IPollService polls)
+		{
+			_dbEntities = dbEntities;
+			_mapper = mapper;
+			_polls = polls;
+		}
+
+		[HttpGet("/api/v1/polls/{id}"), Scope("read:statuses", requiresUser: false), AllowAnonymous]
+		public async Task<IActionResult> Get(string id, CancellationToken token)
+		{
+			var post = await Visible(id, token);
+			return post?.Poll == default ? NotFoundError() : Json(_mapper.Poll(post, MyId, await _polls.OwnVotes(post.ID, MyId, token)));
+		}
+
+		[HttpPost("/api/v1/polls/{id}/votes"), Scope("write:statuses")]
+		public async Task<IActionResult> Vote(string id, CancellationToken token)
+		{
+			var post = await Visible(id, token);
+			if (post?.Poll == default)
+				return NotFoundError();
+			var choices = Params.List("choices").Select(c => int.TryParse(c, out var index) ? index : -1).ToList();
+			var outcome = await _polls.Vote(Me, post, choices, token);
+			if (!outcome.Ok)
+				return Error(outcome.Status, outcome.Error);
+			return Json(_mapper.Poll(outcome.Post, MyId, await _polls.OwnVotes(post.ID, MyId, token)));
+		}
+
+		async Task<PostEntity> Visible(string id, CancellationToken token)
+		{
+			var post = await _dbEntities.Posts.Match(p => p.ID == id && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			return post != default && post.Visibility != PostVisibility.LocalGeo && await VisibilityPolicy.CanSee(post, MyId, token) ? post : default;
+		}
+	}
+}

PrivaPub/Api/Mastodon/Controllers/ProvenanceController.cs

@@ -0,0 +1,181 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+using MongoDB.Entities;
+
+using PrivaPub.Api.Mastodon.Infrastructure;
+using PrivaPub.Domain.Privacy;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Api.Mastodon.Controllers
+{
+	public class ProvenanceController : MastodonController
+	{
+		readonly DbEntities _dbEntities;
+
+		public ProvenanceController(DbEntities dbEntities) => _dbEntities = dbEntities;
+
+		[HttpGet("/api/privapub/v1/statuses/{id}/provenance"), Scope("read:statuses", requiresUser: false), AllowAnonymous]
+		public async Task<IActionResult> Status(string id, CancellationToken token)
+		{
+			var post = await _dbEntities.Posts.Match(p => p.ID == id && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			if (post?.ReblogOfPostId != default)
+				post = await _dbEntities.Posts.Match(p => p.ID == post.ReblogOfPostId && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			if (post == default || post.Visibility == PostVisibility.LocalGeo || !await VisibilityPolicy.CanSee(post, MyId, token))
+				return NotFoundError();
+			if (!post.IsFederatedCopy)
+				return Json(new Provenance { ObjectUri = post.ObjectURI, Url = post.Url, Path = "local" });
+
+			var record = await DB.Default.Find<ObjectRecord>().Match(r => r.PostId == post.ID).ExecuteFirstAsync(token)
+				?? await DB.Default.Find<ObjectRecord>().Match(r => r.ObjectURI == post.ObjectURI).ExecuteFirstAsync(token);
+			var host = record?.Host ?? (Uri.TryCreate(post.ObjectURI, UriKind.Absolute, out var uri) ? uri.Host.ToLowerInvariant() : default);
+			var instance = host == default ? default : await DB.Default.Find<RemoteInstance>().Match(i => i.Host == host).ExecuteFirstAsync(token);
+			return Json(Describe(post, record, instance));
+		}
+
+		[HttpGet("/api/privapub/v1/instances/{host}"), Scope("read", requiresUser: false), AllowAnonymous]
+		public async Task<IActionResult> Instance(string host, CancellationToken token)
+		{
+			host = host?.Trim().ToLowerInvariant();
+			var instance = await DB.Default.Find<RemoteInstance>().Match(i => i.Host == host).ExecuteFirstAsync(token);
+			return instance == default ? NotFoundError() : Json(Describe(instance));
+		}
+
+		static Provenance Describe(PostEntity post, ObjectRecord record, RemoteInstance instance)
+		{
+			var raw = record?.Raw == default ? default : JsonNode.Parse(record.Raw) as JsonObject;
+			return new Provenance
+			{
+				ObjectUri = post.ObjectURI,
+				ObjectType = record?.ObjectType ?? post.ObjectType,
+				Url = post.Url,
+				Path = record == default ? "unrecorded" : record.Path == ObjectPath.Delivered ? "delivered" : "fetched",
+				Refetched = record?.Refetched == true,
+				Activity = record?.ActivityId == default ? default : new ProvenanceActivity
+				{
+					Id = record.ActivityId, Type = record.ActivityType, Actor = record.ActivityActorURI
+				},
+				Inbox = record?.Inbox,
+				Signature = record?.KeyId == default ? default : new ProvenanceSignature
+				{
+					Scheme = record.SignatureScheme, KeyId = record.KeyId, Algorithm = record.Algorithm, Headers = record.SignedHeaders
+				},
+				ReceivedAt = record == default ? default : MastodonJson.Time(record.ReceivedAt),
+				Published = record?.Published is { } published ? MastodonJson.Time(published) : default,
+				Updated = record?.Updated is { } updated ? MastodonJson.Time(updated) : default,
+				Extensions = ObjectFeatures.Detect(raw),
+				ContextNamespaces = ObjectFeatures.Namespaces(raw, record?.ActivityContext),
+				Raw = raw,
+				RawBytes = record?.RawBytes ?? 0,
+				RawHash = record?.RawHash,
+				RawTruncated = record?.RawTruncated == true,
+				Revisions = record?.Revisions.Select(r => new ProvenanceRevision
+				{
+					ActivityId = r.ActivityId,
+					Updated = r.Updated is { } at ? MastodonJson.Time(at) : default,
+					ReceivedAt = MastodonJson.Time(r.ReceivedAt),
+					RawHash = r.RawHash,
+					Raw = r.Raw == default ? default : JsonNode.Parse(r.Raw)
+				}).ToList() ?? new(),
+				Instance = instance == default ? default : Describe(instance)
+			};
+		}
+
+		static InstanceDescription Describe(RemoteInstance instance) => new()
+		{
+			Host = instance.Host,
+			Software = instance.Software,
+			Version = instance.SoftwareVersion,
+			NodeName = instance.NodeName,
+			Protocols = instance.Protocols ?? new(),
+			OpenRegistrations = instance.OpenRegistrations,
+			DescribedAt = instance.DescribedAt is { } described ? MastodonJson.Time(described) : default,
+			DescriptionError = instance.DescriptionError,
+			NodeInfo = instance.NodeInfo == default ? default : JsonNode.Parse(instance.NodeInfo),
+			Delivery = new InstanceDelivery
+			{
+				ConsecutiveFailures = instance.ConsecutiveFailures,
+				UnavailableUntil = instance.UnavailableUntil is { } until ? MastodonJson.Time(until) : default,
+				LastSuccessAt = instance.LastSuccessAt is { } success ? MastodonJson.Time(success) : default,
+				LastFailureAt = instance.LastFailureAt is { } failure ? MastodonJson.Time(failure) : default
+			}
+		};
+
+		public class Provenance
+		{
+			public string ObjectUri { get; set; }
+			public string ObjectType { get; set; }
+			public string Url { get; set; }
+			public string Path { get; set; }
+			public bool Refetched { get; set; }
+			public ProvenanceActivity Activity { get; set; }
+			public string Inbox { get; set; }
+			public ProvenanceSignature Signature { get; set; }
+			public string ReceivedAt { get; set; }
+			public string Published { get; set; }
+			public string Updated { get; set; }
+			public List<string> Extensions { get; set; } = new();
+			public List<string> ContextNamespaces { get; set; } = new();
+			public JsonNode Raw { get; set; }
+			public int RawBytes { get; set; }
+			public string RawHash { get; set; }
+			public bool RawTruncated { get; set; }
+			public List<ProvenanceRevision> Revisions { get; set; } = new();
+			public InstanceDescription Instance { get; set; }
+		}
+
+		public class ProvenanceActivity
+		{
+			public string Id { get; set; }
+			public string Type { get; set; }
+			public string Actor { get; set; }
+		}
+
+		public class ProvenanceSignature
+		{
+			public string Scheme { get; set; }
+			public string KeyId { get; set; }
+			public string Algorithm { get; set; }
+			public List<string> Headers { get; set; } = new();
+		}
+
+		public class ProvenanceRevision
+		{
+			public string ActivityId { get; set; }
+			public string Updated { get; set; }
+			public string ReceivedAt { get; set; }
+			public string RawHash { get; set; }
+			public JsonNode Raw { get; set; }
+		}
+
+		public class InstanceDescription
+		{
+			public string Host { get; set; }
+			public string Software { get; set; }
+			public string Version { get; set; }
+			public string NodeName { get; set; }
+			public List<string> Protocols { get; set; } = new();
+			public bool? OpenRegistrations { get; set; }
+			public string DescribedAt { get; set; }
+			public string DescriptionError { get; set; }
+			public JsonNode NodeInfo { get; set; }
+			public InstanceDelivery Delivery { get; set; }
+		}
+
+		public class InstanceDelivery
+		{
+			public int ConsecutiveFailures { get; set; }
+			public string UnavailableUntil { get; set; }
+			public string LastSuccessAt { get; set; }
+			public string LastFailureAt { get; set; }
+		}
+	}
+}

PrivaPub/Api/Mastodon/Controllers/ReactionsController.cs

@@ -0,0 +1,76 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+using MongoDB.Entities;
+
+using PrivaPub.Api.Mastodon.Infrastructure;
+using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Domain.Privacy;
+using PrivaPub.Domain.Social;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.StaticServices;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Api.Mastodon.Controllers
+{
+	public class ReactionsController : MastodonController
+	{
+		readonly DbEntities _dbEntities;
+		readonly MastodonMapper _mapper;
+		readonly IReactions _reactions;
+
+		public ReactionsController(DbEntities dbEntities, MastodonMapper mapper, IReactions reactions)
+		{
+			_dbEntities = dbEntities;
+			_mapper = mapper;
+			_reactions = reactions;
+		}
+
+		[HttpGet("/api/v1/pleroma/statuses/{id}/reactions"), Scope("read:statuses", requiresUser: false), AllowAnonymous]
+		public async Task<IActionResult> List(string id, CancellationToken token)
+		{
+			var post = await Visible(id, token);
+			if (post == default)
+				return NotFoundError();
+			var reactions = await DB.Default.Find<Reaction>().Match(r => r.PostId == post.ID).ExecuteAsync(token);
+			var accounts = await _mapper.Accounts(reactions.Select(r => r.AccountId), token);
+			return Json(reactions.GroupBy(r => r.Emoji).Select(group => new
+			{
+				name = group.Key,
+				count = group.Count(),
+				me = MyId != default && group.Any(r => r.AccountId == MyId),
+				url = _mapper.ProxiedUrl(group.First().EmojiURL),
+				accounts = group.Select(r => accounts.GetValueOrDefault(r.AccountId)).Where(a => a != default).ToList()
+			}).OrderByDescending(r => r.count).ToList());
+		}
+
+		[HttpPut("/api/v1/pleroma/statuses/{id}/reactions/{emoji}"), Scope("write:favourites")]
+		public async Task<IActionResult> React(string id, string emoji, CancellationToken token)
+		{
+			var post = await Visible(id, token);
+			if (post == default)
+				return NotFoundError();
+			if (!await _reactions.React(Me, post, Uri.UnescapeDataString(emoji), token))
+				return Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: That emoji cannot be used here");
+			return Json(await _mapper.Status(post, MyId, token));
+		}
+
+		[HttpDelete("/api/v1/pleroma/statuses/{id}/reactions/{emoji}"), Scope("write:favourites")]
+		public async Task<IActionResult> Unreact(string id, string emoji, CancellationToken token)
+		{
+			var post = await Visible(id, token);
+			if (post == default)
+				return NotFoundError();
+			await _reactions.Unreact(Me, post, Uri.UnescapeDataString(emoji), token);
+			return Json(await _mapper.Status(post, MyId, token));
+		}
+
+		async Task<PostEntity> Visible(string id, CancellationToken token)
+		{
+			var post = await _dbEntities.Posts.Match(p => p.ID == id && !p.DeletedAt.HasValue && p.ReblogOfPostId == null).ExecuteFirstAsync(token);
+			return post != default && post.Visibility != PostVisibility.LocalGeo && await VisibilityPolicy.CanSee(post, MyId, token) ? post : default;
+		}
+	}
+}

PrivaPub/Api/Mastodon/Controllers/StatusesController.cs

@@ -44,9 +44,6 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				if (existing != default)
 					return Json(await _mapper.Status(existing, MyId, token));
 			}
-			if (Params.Has("poll[options]"))
-				return Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: Polls are not supported yet");
-
 			var outcome = await _statuses.Publish(Me, new StatusDraft
 			{
 				Text = Params.Get("status"),
@@ -56,7 +53,12 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				Visibility = Visibility(Params.Get("visibility") ?? Me.Settings.DefaultVisibility),
 				InReplyTo = Params.Get("in_reply_to_id"),
 				Language = Params.Get("language") ?? Me.Settings.DefaultLanguage,
-				MediaIds = Params.List("media_ids")
+				MediaIds = Params.List("media_ids"),
+				QuotedStatusId = Params.Get("quoted_status_id"),
+				Poll = Params.Has("poll[options]")
+					? new PollDraft(Params.List("poll[options]"), Params.Int("poll[expires_in]") ?? 0, Params.Bool("poll[multiple]") == true,
+						Params.Bool("poll[hide_totals]") == true)
+					: default
 			}, token);
 			if (!outcome.Ok)
 				return Error(outcome.Status, outcome.Error);
@@ -225,6 +227,21 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			return Json(reblogs.Select(r => accounts.GetValueOrDefault(MastodonMapper.AuthorOf(r))).Where(a => a != default).ToList());
 		}
 
+		[HttpGet("/api/v1/statuses/{id}/quotes"), Scope("read:statuses", requiresUser: false), Microsoft.AspNetCore.Authorization.AllowAnonymous]
+		public async Task<IActionResult> Quotes(string id, CancellationToken token)
+		{
+			if (await Visible(id, token) == default)
+				return NotFoundError();
+			var query = _dbEntities.Posts.Match(p => p.QuotedPostId == id && p.QuoteState == QuoteState.Accepted && !p.DeletedAt.HasValue);
+			var quotes = await Page.From(Params, Limit()).Fetch(query, p => p.ID, token);
+			var visible = new List<PostEntity>();
+			foreach (var quote in quotes)
+				if (quote.Visibility != PostVisibility.LocalGeo && await VisibilityPolicy.CanSee(quote, MyId, token))
+					visible.Add(quote);
+			Link($"/api/v1/statuses/{id}/quotes", quotes.LastOrDefault()?.ID, quotes.FirstOrDefault()?.ID);
+			return Json(await _mapper.Statuses(visible, MyId, token));
+		}
+
 		[HttpPost("/api/v1/statuses/{id}/bookmark"), Scope("write:bookmarks")]
 		public async Task<IActionResult> Bookmark(string id, CancellationToken token)
 		{

PrivaPub/Api/Mastodon/Controllers/TimelinesController.cs

@@ -162,7 +162,10 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			[NotificationType.FollowRequest] = "follow_request",
 			[NotificationType.Favourite] = "favourite",
 			[NotificationType.Reblog] = "reblog",
-			[NotificationType.Update] = "update"
+			[NotificationType.Update] = "update",
+			[NotificationType.Poll] = "poll",
+			[NotificationType.Reaction] = "pleroma:emoji_reaction",
+			[NotificationType.Quote] = "quote"
 		};
 
 		readonly MastodonMapper _mapper;
@@ -233,7 +236,9 @@ namespace PrivaPub.Api.Mastodon.Controllers
 					CreatedAt = MastodonJson.Time(n.CreatedAt),
 					GroupKey = $"ungrouped-{n.ID}",
 					Account = accounts[n.FromAccountId],
-					Status = n.PostId == default ? default : statuses[n.PostId]
+					Status = n.PostId == default ? default : statuses[n.PostId],
+					Emoji = n.Emoji == default ? default : n.EmojiURL == default ? n.Emoji : $":{n.Emoji}:",
+					EmojiUrl = _mapper.ProxiedUrl(n.EmojiURL)
 				})
 				.ToList();
 		}

PrivaPub/Api/Mastodon/Entities/Entities.cs

@@ -25,12 +25,24 @@ namespace PrivaPub.Api.Mastodon.Entities
 		public string LastStatusAt { get; set; }
 		public bool? HideCollections { get; set; }
 		public bool Noindex { get; set; } = true;
-		public List<object> Emojis { get; set; } = new();
+		public List<CustomEmojiEntity> Emojis { get; set; } = new();
 		public List<object> Roles { get; set; } = new();
+		public bool? Memorial { get; set; }
+		public string AvatarDescription { get; set; } = string.Empty;
+		public string HeaderDescription { get; set; } = string.Empty;
 		public List<Field> Fields { get; set; } = new();
 		public Source Source { get; set; }
 	}
 
+	public class CustomEmojiEntity
+	{
+		public string Shortcode { get; set; }
+		public string Url { get; set; }
+		public string StaticUrl { get; set; }
+		public bool VisibleInPicker { get; set; }
+		public string Category { get; set; }
+	}
+
 	public class Field
 	{
 		public string Name { get; set; }
@@ -49,6 +61,176 @@ namespace PrivaPub.Api.Mastodon.Entities
 		public string AttributionDomains { get; set; }
 	}
 
+	public class PrivaPubStatus
+	{
+		public string ObjectType { get; set; }
+		public string Title { get; set; }
+		public string Excerpt { get; set; }
+		public string Cover { get; set; }
+		public PrivaPubSource Source { get; set; }
+		public PrivaPubLink Link { get; set; }
+		public PrivaPubVideo Video { get; set; }
+		public PrivaPubAudio Audio { get; set; }
+		public PrivaPubEvent Event { get; set; }
+		public PrivaPubVotes Votes { get; set; } = new();
+	}
+
+	public class PrivaPubSource
+	{
+		public string Content { get; set; }
+		public string MediaType { get; set; }
+	}
+
+	public class PrivaPubLink
+	{
+		public string Url { get; set; }
+		public string Title { get; set; }
+		public string Description { get; set; }
+		public string Image { get; set; }
+		public bool FromPublisher { get; set; }
+	}
+
+	public class PrivaPubVariant
+	{
+		public string Url { get; set; }
+		public string MediaType { get; set; }
+		public int? Width { get; set; }
+		public int? Height { get; set; }
+		public double? Fps { get; set; }
+		public long? Size { get; set; }
+		public List<string> Streams { get; set; } = new();
+	}
+
+	public class PrivaPubVideo
+	{
+		public double? Duration { get; set; }
+		public List<PrivaPubVariant> Variants { get; set; } = new();
+		public bool IsLive { get; set; }
+		public int? State { get; set; }
+		public long? Views { get; set; }
+		public int? CommentsPolicy { get; set; }
+		public bool? DownloadEnabled { get; set; }
+		public string Licence { get; set; }
+		public string Category { get; set; }
+		public string Channel { get; set; }
+		public List<PrivaPubCaption> Captions { get; set; } = new();
+	}
+
+	public class PrivaPubCaption
+	{
+		public string Language { get; set; }
+		public string Url { get; set; }
+	}
+
+	public class PrivaPubAudio
+	{
+		public double? Duration { get; set; }
+		public List<PrivaPubVariant> Variants { get; set; } = new();
+		public string Album { get; set; }
+		public int? Position { get; set; }
+		public string Licence { get; set; }
+	}
+
+	public class PrivaPubEvent
+	{
+		public string Start { get; set; }
+		public string End { get; set; }
+		public string TimeZone { get; set; }
+		public bool Floating { get; set; }
+		public List<PrivaPubPlace> Places { get; set; } = new();
+		public string OnlineUrl { get; set; }
+		public string JoinMode { get; set; }
+		public int? Participants { get; set; }
+		public int? Capacity { get; set; }
+		public string Status { get; set; }
+		public string Category { get; set; }
+	}
+
+	public class PrivaPubPlace
+	{
+		public string Name { get; set; }
+		public string Address { get; set; }
+		public double? Latitude { get; set; }
+		public double? Longitude { get; set; }
+		public string Url { get; set; }
+	}
+
+	public class PrivaPubVotes
+	{
+		public int Up { get; set; }
+		public int Down { get; set; }
+	}
+
+	public class QuoteEntity
+	{
+		public string State { get; set; }
+		public Status QuotedStatus { get; set; }
+		public string QuotedStatusId { get; set; }
+	}
+
+	public class QuoteApprovalEntity
+	{
+		public List<string> Automatic { get; set; } = new();
+		public List<string> Manual { get; set; } = new();
+		public string CurrentUser { get; set; } = "denied";
+	}
+
+	public class EmojiReactionEntity
+	{
+		public string Name { get; set; }
+		public int Count { get; set; }
+		public bool Me { get; set; }
+		public string Url { get; set; }
+		public string StaticUrl { get; set; }
+	}
+
+	public class PleromaStatus
+	{
+		public List<EmojiReactionEntity> EmojiReactions { get; set; } = new();
+	}
+
+	public class PollEntity
+	{
+		public string Id { get; set; }
+		public string ExpiresAt { get; set; }
+		public bool Expired { get; set; }
+		public bool Multiple { get; set; }
+		public int VotesCount { get; set; }
+		public int? VotersCount { get; set; }
+		public bool? Voted { get; set; }
+		public List<int> OwnVotes { get; set; }
+		public List<PollOptionEntity> Options { get; set; } = new();
+		public List<CustomEmojiEntity> Emojis { get; set; } = new();
+	}
+
+	public class PollOptionEntity
+	{
+		public string Title { get; set; }
+		public int? VotesCount { get; set; }
+	}
+
+	public class PreviewCard
+	{
+		public string Url { get; set; }
+		public string Title { get; set; } = string.Empty;
+		public string Description { get; set; } = string.Empty;
+		public string Type { get; set; } = "link";
+		public string AuthorName { get; set; } = string.Empty;
+		public string AuthorUrl { get; set; } = string.Empty;
+		public string ProviderName { get; set; } = string.Empty;
+		public string ProviderUrl { get; set; } = string.Empty;
+		public string Html { get; set; } = string.Empty;
+		public int Width { get; set; }
+		public int Height { get; set; }
+		public string Image { get; set; }
+		public string ImageDescription { get; set; } = string.Empty;
+		public string EmbedUrl { get; set; } = string.Empty;
+		public string Blurhash { get; set; }
+		public string Language { get; set; }
+		public string PublishedAt { get; set; }
+		public List<object> Authors { get; set; } = new();
+	}
+
 	public class Status
 	{
 		public string Id { get; set; }
@@ -61,7 +243,7 @@ namespace PrivaPub.Api.Mastodon.Entities
 		public string Content { get; set; } = string.Empty;
 		public string CreatedAt { get; set; }
 		public string EditedAt { get; set; }
-		public List<object> Emojis { get; set; } = new();
+		public List<CustomEmojiEntity> Emojis { get; set; } = new();
 		public int RepliesCount { get; set; }
 		public int ReblogsCount { get; set; }
 		public int FavouritesCount { get; set; }
@@ -76,12 +258,18 @@ namespace PrivaPub.Api.Mastodon.Entities
 		public List<MediaAttachment> MediaAttachments { get; set; } = new();
 		public List<StatusMention> Mentions { get; set; } = new();
 		public List<StatusTag> Tags { get; set; } = new();
-		public object Card { get; set; }
+		public PreviewCard Card { get; set; }
-		public object Poll { get; set; }
+		public PollEntity Poll { get; set; }
 		public Application Application { get; set; }
 		public string Language { get; set; }
 		public string Text { get; set; }
 		public List<object> Filtered { get; set; } = new();
+		public PrivaPubStatus Privapub { get; set; }
+		public List<EmojiReactionEntity> EmojiReactions { get; set; } = new();
+		public PleromaStatus Pleroma { get; set; }
+		public QuoteEntity Quote { get; set; }
+		public int QuotesCount { get; set; }
+		public QuoteApprovalEntity QuoteApproval { get; set; }
 	}
 
 	public class MediaAttachment
@@ -150,6 +338,8 @@ namespace PrivaPub.Api.Mastodon.Entities
 		public string GroupKey { get; set; }
 		public Account Account { get; set; }
 		public Status Status { get; set; }
+		public string Emoji { get; set; }
+		public string EmojiUrl { get; set; }
 	}
 
 	public class Context
@@ -166,7 +356,7 @@ namespace PrivaPub.Api.Mastodon.Entities
 		public string CreatedAt { get; set; }
 		public Account Account { get; set; }
 		public List<MediaAttachment> MediaAttachments { get; set; } = new();
-		public List<object> Emojis { get; set; } = new();
+		public List<CustomEmojiEntity> Emojis { get; set; } = new();
 	}
 
 	public class StatusSource

PrivaPub/Api/Mastodon/Mappers/MastodonMapper.cs

@@ -7,11 +7,15 @@ using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Rendering;
 using PrivaPub.Models.Federation;
 using PrivaPub.Models.Group;
+using PrivaPub.Domain.Privacy;
+using PrivaPub.Federation.Objects;
 using PrivaPub.Models.Post;
+using PrivaPub.Domain.Statuses;
 using PrivaPub.Models.Social;
 using PrivaPub.Models.User;
 using PrivaPub.StaticServices;
 
+using System.Globalization;
 using System.Net;
 
 using GroupEntity = PrivaPub.Models.Group.Group;
@@ -34,6 +38,8 @@ namespace PrivaPub.Api.Mastodon.Mappers
 
 		string Proxied(string url) => _proxy == default ? url : _proxy.Wrap(url);
 
+		public string ProxiedUrl(string url) => Proxied(url);
+
 		string MissingAvatar => $"{_localActors.BaseAddress}/media/missing-avatar.png";
 		string MissingHeader => $"{_localActors.BaseAddress}/media/missing-header.png";
 
@@ -102,8 +108,15 @@ namespace PrivaPub.Api.Mastodon.Mappers
 			DisplayName = foreign.Name ?? foreign.UserName ?? string.Empty,
 			Bot = foreign.AvatarType is AvatarType.Service or AvatarType.Application,
 			Group = foreign.AvatarType == AvatarType.Group,
+			Locked = foreign.IsLocked,
 			Discoverable = foreign.IsDiscoverable,
-			CreatedAt = MastodonJson.Day(foreign.CreatedAt),
+			Indexable = foreign.IsIndexable,
+			Memorial = foreign.IsMemorial ? true : default(bool?),
+			CreatedAt = MastodonJson.Day(foreign.Published ?? foreign.CreatedAt),
+			Emojis = Emojis(foreign.Emojis),
+			Fields = foreign.Fields.Select(f => new Field { Name = f.Key, Value = f.Value }).ToList(),
+			AvatarDescription = foreign.PictureDescription ?? string.Empty,
+			HeaderDescription = foreign.HeaderDescription ?? string.Empty,
 			Note = foreign.Biography ?? string.Empty,
 			Url = foreign.Url ?? foreign.ActorURI,
 			Uri = foreign.ActorURI,
@@ -135,7 +148,10 @@ namespace PrivaPub.Api.Mastodon.Mappers
 		public async Task<Status> Status(PostEntity post, string viewerId, CancellationToken token) =>
 			(await Statuses(new[] { post }, viewerId, token)).FirstOrDefault();
 
-		public async Task<List<Status>> Statuses(IReadOnlyCollection<PostEntity> posts, string viewerId, CancellationToken token)
+		public Task<List<Status>> Statuses(IReadOnlyCollection<PostEntity> posts, string viewerId, CancellationToken token) =>
+			Statuses(posts, viewerId, nested: false, token);
+
+		async Task<List<Status>> Statuses(IReadOnlyCollection<PostEntity> posts, string viewerId, bool nested, CancellationToken token)
 		{
 			var originalIds = posts.Where(p => p.ReblogOfPostId != default).Select(p => p.ReblogOfPostId).Distinct().ToList();
 			var originals = originalIds.Count == 0
@@ -157,6 +173,24 @@ namespace PrivaPub.Api.Mastodon.Mappers
 				? new HashSet<string>()
 				: (await DB.Default.Find<Bookmark>().Match(b => b.AvatarId == viewerId && ids.Contains(b.PostId)).ExecuteAsync(token)).Select(b => b.PostId).ToHashSet();
 			var pinned = (await DB.Default.Find<Pin>().Match(p => ids.Contains(p.PostId)).ExecuteAsync(token)).Select(p => p.PostId).ToHashSet();
+			var reactions = (await DB.Default.Find<Reaction>().Match(r => ids.Contains(r.PostId)).ExecuteAsync(token))
+				.GroupBy(r => r.PostId)
+				.ToDictionary(g => g.Key, g => g.GroupBy(r => r.Emoji)
+					.Select(e => new EmojiReactionEntity
+					{
+						Name = e.Key,
+						Count = e.Count(),
+						Me = viewerId != default && e.Any(r => r.AccountId == viewerId),
+						Url = Proxied(e.First().EmojiURL),
+						StaticUrl = Proxied(e.First().EmojiURL)
+					})
+					.OrderByDescending(e => e.Count)
+					.ToList());
+			var pollIds = all.Where(p => p.Poll != default).Select(p => p.ID).ToList();
+			var ownVotes = viewerId == default || pollIds.Count == 0
+				? new Dictionary<string, List<int>>()
+				: (await DB.Default.Find<PollVote>().Match(v => pollIds.Contains(v.PostId) && v.VoterAccountId == viewerId && v.IsLocalVoter).ExecuteAsync(token))
+					.GroupBy(v => v.PostId).ToDictionary(g => g.Key, g => g.Select(v => v.Choice).ToList());
 			var hidden = viewerId == default
 				? new HashSet<string>()
 				: await Domain.Relationships.Hidden.AuthorsHiddenFrom(viewerId, all.Select(p => p.ActorURI), forNotifications: false, token);
@@ -192,12 +226,42 @@ namespace PrivaPub.Api.Mastodon.Mappers
 					Visibility = Visibility(post.Visibility),
 					Language = post.Language,
 					MediaAttachments = post.Media.Select(Media).ToList(),
+					Card = Card(post),
+					Poll = Poll(post, viewerId, ownVotes.GetValueOrDefault(post.ID)),
+					Emojis = Emojis(post.Emojis),
+					Privapub = Extension(post),
+					EmojiReactions = reactions.GetValueOrDefault(post.ID) ?? new(),
+					Pleroma = new PleromaStatus { EmojiReactions = reactions.GetValueOrDefault(post.ID) ?? new() },
 					Mentions = post.Mentions.Select(m => Mention(m, mentionAccounts)).Where(m => m != default).ToList(),
 					Tags = post.Tags.Select(t => new StatusTag { Name = t, Url = ActivityPubRenderer.TagUrl(_localActors.BaseAddress, t) }).ToList()
 				};
 				return status;
 			}
 
+			var quotedIds = nested ? new List<string>() : all.Where(p => p.QuoteState == QuoteState.Accepted && p.QuotedPostId != default).Select(p => p.QuotedPostId).Distinct().ToList();
+			var quotedPosts = new List<PostEntity>();
+			foreach (var quotedPost in quotedIds.Count == 0 ? new List<PostEntity>() : await _dbEntities.Posts.Match(p => quotedIds.Contains(p.ID) && !p.DeletedAt.HasValue).ExecuteAsync(token))
+				if (quotedPost.Visibility != PostVisibility.LocalGeo && await VisibilityPolicy.CanSee(quotedPost, viewerId, token))
+					quotedPosts.Add(quotedPost);
+			var quotedStatuses = quotedPosts.Count == 0
+				? new Dictionary<string, Status>()
+				: (await Statuses(quotedPosts, viewerId, nested: true, token)).ToDictionary(q => q.Id);
+
+			void Quote(Status status, PostEntity post)
+			{
+				status.QuotesCount = post.QuotesCount;
+				status.QuoteApproval = Approval(post, viewerId);
+				if (post.QuoteState == QuoteState.None)
+					return;
+				var state = post.QuoteState.ToString().ToLowerInvariant();
+				var quoted = post.QuotedPostId != default && quotedStatuses.TryGetValue(post.QuotedPostId, out var shown) ? shown : default;
+				status.Quote = nested
+					? new QuoteEntity { State = state, QuotedStatusId = post.QuotedPostId }
+					: new QuoteEntity { State = state, QuotedStatus = post.QuoteState == QuoteState.Accepted ? quoted : default, QuotedStatusId = post.QuotedPostId };
+				if (!nested && post.QuoteState == QuoteState.Accepted && quoted != default)
+					status.Content = WithoutQuoteFallback(status.Content);
+			}
+
 			var mapped = new List<Status>();
 			foreach (var post in posts)
 			{
@@ -207,10 +271,12 @@ namespace PrivaPub.Api.Mastodon.Mappers
 				var status = Map(post);
 				if (status == default)
 					continue;
+				Quote(status, post);
 				if (post.ReblogOfPostId != default)
 				{
 					if (!originals.TryGetValue(post.ReblogOfPostId, out var original) || Map(original) is not { } inner)
 						continue;
+					Quote(inner, original);
 					status.Reblog = inner;
 					status.Content = string.Empty;
 					status.Reblogged = reblogged.Contains(original.ID);
@@ -222,12 +288,185 @@ namespace PrivaPub.Api.Mastodon.Mappers
 
 		public static string AuthorOf(PostEntity post) => post.AuthorAccountId ?? post.GroupUserId;
 
+		static readonly AngleSharp.Html.Parser.HtmlParser Fragments = new();
+
+		public static string WithoutQuoteFallback(string html)
+		{
+			if (string.IsNullOrEmpty(html) || !html.Contains("quote-inline", StringComparison.Ordinal))
+				return html;
+			var document = Fragments.ParseDocument($"<body>{html}</body>");
+			foreach (var fallback in document.QuerySelectorAll(".quote-inline").ToList())
+				fallback.Remove();
+			return document.Body!.InnerHtml;
+		}
+
+		static QuoteApprovalEntity Approval(PostEntity post, string viewerId)
+		{
+			if (!post.IsFederatedCopy || post.Visibility is not (PostVisibility.Public or PostVisibility.Unlisted))
+				return new QuoteApprovalEntity();
+			if (post.QuotePolicy is not { } policy)
+				return new QuoteApprovalEntity { Automatic = new List<string> { "public" }, CurrentUser = viewerId == default ? "unknown" : "automatic" };
+			static List<string> Named(IEnumerable<string> who) => who.Select(w => Addressing.IsPublic(w) ? "public" : w.EndsWith("/followers") ? "followers" : "unsupported_policy").Distinct().ToList();
+			return new QuoteApprovalEntity
+			{
+				Automatic = Named(policy.Automatic),
+				Manual = Named(policy.Manual),
+				CurrentUser = viewerId == default ? "unknown" : policy.Automatic.Any(Addressing.IsPublic) ? "automatic" : policy.Manual.Any(Addressing.IsPublic) ? "manual" : "denied"
+			};
+		}
+
 		public static string Content(PostEntity post)
 		{
 			var content = post.ContentHtml ?? ActivityPubRenderer.Html(post.Text);
-			return string.IsNullOrEmpty(post.Title) || post.IsFederatedCopy
+			if (post.IsFederatedCopy && string.IsNullOrWhiteSpace(content) && !string.IsNullOrEmpty(post.Excerpt))
-				? content ?? string.Empty
+				content = $"<p>{WebUtility.HtmlEncode(post.Excerpt)}</p>";
-				: $"<p><strong>{WebUtility.HtmlEncode(post.Title)}</strong></p>{content}";
+			if (post.Event is { } happening && EventLine(happening) is { } line)
+				content = $"<p>{WebUtility.HtmlEncode(line)}</p>{content}";
+			var titled = !string.IsNullOrEmpty(post.Title) && (!post.IsFederatedCopy || post.ObjectType is not (null or "Note" or "Question"));
+			return titled
+				? $"<p><strong>{WebUtility.HtmlEncode(post.Title)}</strong></p>{content}"
+				: content ?? string.Empty;
+		}
+
+		public static string EventLine(EventDetails happening)
+		{
+			if (happening.Start is not { } start)
+				return default;
+			var zone = Zone(happening.FloatingTime ? default : happening.TimeZone);
+			var local = zone == default ? start : TimeZoneInfo.ConvertTimeFromUtc(start, zone);
+			var when = local.ToString("yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture);
+			if (happening.End is { } end && end > start)
+			{
+				var localEnd = zone == default ? end : TimeZoneInfo.ConvertTimeFromUtc(end, zone);
+				when += " – " + localEnd.ToString(localEnd.Date == local.Date ? "HH:mm" : "yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture);
+			}
+			when += happening.FloatingTime ? " (local time)" : zone == default ? " UTC" : $" ({happening.TimeZone})";
+			var where = happening.Places.Select(p => p.Name ?? p.Address).FirstOrDefault(p => p != default)
+				?? (happening.OnlineURL != default ? "online" : default);
+			return where == default ? when : $"{when} · {where}";
+		}
+
+		static TimeZoneInfo Zone(string id)
+		{
+			if (string.IsNullOrWhiteSpace(id))
+				return default;
+			try
+			{
+				return TimeZoneInfo.FindSystemTimeZoneById(id);
+			}
+			catch (Exception ex) when (ex is TimeZoneNotFoundException or InvalidTimeZoneException)
+			{
+				return default;
+			}
+		}
+
+		public PollEntity Poll(PostEntity post, string viewerId, IReadOnlyCollection<int> ownVotes)
+		{
+			if (post.Poll is not { } poll)
+				return default;
+			var expired = PollService.Ended(poll);
+			var hidden = poll.HideTotals && !expired && post.GroupUserId != viewerId;
+			return new PollEntity
+			{
+				Id = post.ID,
+				ExpiresAt = poll.ExpiresAt is { } ends ? MastodonJson.Time(ends) : default,
+				Expired = expired,
+				Multiple = poll.Multiple,
+				VotesCount = poll.Options.Sum(o => o.Votes),
+				VotersCount = poll.Multiple ? poll.VotersCount : poll.VotersCount ?? poll.Options.Sum(o => o.Votes),
+				Voted = viewerId == default ? default(bool?) : ownVotes?.Count > 0 || post.GroupUserId == viewerId,
+				OwnVotes = viewerId == default ? default : ownVotes?.ToList() ?? new List<int>(),
+				Options = poll.Options.Select(o => new PollOptionEntity { Title = o.Title, VotesCount = hidden ? default(int?) : o.Votes }).ToList(),
+				Emojis = Emojis(post.Emojis.Where(e => poll.Options.Any(o => o.Title.Contains($":{e.Shortcode}:"))))
+			};
+		}
+
+		List<CustomEmojiEntity> Emojis(IEnumerable<CustomEmoji> emojis) =>
+			emojis?.Select(e => new CustomEmojiEntity { Shortcode = e.Shortcode, Url = Proxied(e.URL), StaticUrl = Proxied(e.URL) }).ToList() ?? new();
+
+		PrivaPubStatus Extension(PostEntity post) => new()
+		{
+			ObjectType = post.ObjectType,
+			Title = post.IsFederatedCopy ? post.Title : default,
+			Excerpt = post.Excerpt,
+			Cover = Proxied(post.CoverURL),
+			Source = post.Source == default ? default : new PrivaPubSource { Content = post.Source.Content, MediaType = post.Source.MediaType },
+			Link = post.Link == default ? default : new PrivaPubLink
+			{
+				Url = post.Link.Href, Title = post.Link.Title, Description = post.Link.Description, Image = Proxied(post.Link.ImageURL), FromPublisher = post.Link.FromPublisher
+			},
+			Video = post.Video == default ? default : new PrivaPubVideo
+			{
+				Duration = post.Video.DurationSeconds,
+				Variants = post.Video.Variants.Select(Variant).ToList(),
+				IsLive = post.Video.IsLive,
+				State = post.Video.State,
+				Views = post.Video.Views,
+				CommentsPolicy = post.Video.CommentsPolicy,
+				DownloadEnabled = post.Video.DownloadEnabled,
+				Licence = post.Video.Licence,
+				Category = post.Video.Category,
+				Channel = post.Video.ChannelURI,
+				Captions = post.Video.Captions.Select(c => new PrivaPubCaption { Language = c.Language, Url = Proxied(c.Url) }).ToList()
+			},
+			Audio = post.Audio == default ? default : new PrivaPubAudio
+			{
+				Duration = post.Audio.DurationSeconds,
+				Variants = post.Audio.Variants.Select(Variant).ToList(),
+				Album = post.Audio.Album,
+				Position = post.Audio.Position,
+				Licence = post.Audio.Licence
+			},
+			Event = post.Event == default ? default : new PrivaPubEvent
+			{
+				Start = post.Event.Start is { } start ? MastodonJson.Time(start) : default,
+				End = post.Event.End is { } end ? MastodonJson.Time(end) : default,
+				TimeZone = post.Event.TimeZone,
+				Floating = post.Event.FloatingTime,
+				Places = post.Event.Places.Select(p => new PrivaPubPlace { Name = p.Name, Address = p.Address, Latitude = p.Latitude, Longitude = p.Longitude, Url = p.Url }).ToList(),
+				OnlineUrl = post.Event.OnlineURL,
+				JoinMode = post.Event.JoinMode,
+				Participants = post.Event.ParticipantCount,
+				Capacity = post.Event.Capacity,
+				Status = post.Event.Status,
+				Category = post.Event.Category
+			},
+			Votes = new PrivaPubVotes { Up = post.FavouritesCount, Down = post.DownvotesCount }
+		};
+
+		PrivaPubVariant Variant(MediaVariant variant) => new()
+		{
+			Url = Proxied(variant.Url),
+			MediaType = variant.MediaType,
+			Width = variant.Width,
+			Height = variant.Height,
+			Fps = variant.Fps,
+			Size = variant.Size,
+			Streams = variant.Streams
+		};
+
+		PreviewCard Card(PostEntity post)
+		{
+			if (post.Link is { } link)
+				return Card(link.Href, link.Title ?? post.Title, link.Description ?? (post.Media.Count == 0 ? post.Excerpt : default), link.ImageURL);
+			if (post.IsFederatedCopy && post.ObjectType is "Article" or "Event" or "Video" or "Audio" && post.Url != default && post.Media.Count == 0)
+				return Card(post.Url, post.Title, post.Excerpt, post.CoverURL);
+			return default;
+		}
+
+		PreviewCard Card(string url, string title, string description, string image)
+		{
+			if (!Uri.TryCreate(url, UriKind.Absolute, out var uri))
+				return default;
+			return new PreviewCard
+			{
+				Url = url,
+				Title = title ?? uri.Host,
+				Description = description ?? string.Empty,
+				ProviderName = uri.Host,
+				ProviderUrl = uri.GetLeftPart(UriPartial.Authority),
+				Image = Proxied(image)
+			};
 		}
 
 		public static string Visibility(PostVisibility visibility) => visibility switch
@@ -250,6 +489,28 @@ namespace PrivaPub.Api.Mastodon.Mappers
 			return new StatusMention { Id = account.ID, Username = account.UserName, Acct = $"{account.UserName}@{account.Domain}", Url = account.Url ?? account.ActorURI };
 		}
 
+		static Dictionary<string, object> Meta(PostMedia media)
+		{
+			var original = new Dictionary<string, object>();
+			if (media.Width > 0 && media.Height > 0)
+			{
+				original["width"] = media.Width;
+				original["height"] = media.Height;
+				original["size"] = $"{media.Width}x{media.Height}";
+				original["aspect"] = (double)media.Width.Value / media.Height.Value;
+			}
+			if (media.DurationSeconds is { } seconds)
+				original["duration"] = seconds;
+			var meta = new Dictionary<string, object>();
+			if (original.Count > 0)
+				meta["original"] = original;
+			if (media.DurationSeconds is { } length)
+				meta["length"] = TimeSpan.FromSeconds(length).ToString(@"h\:mm\:ss\.ff", CultureInfo.InvariantCulture);
+			if (media.Focus is { Length: 2 })
+				meta["focus"] = new { x = media.Focus[0], y = media.Focus[1] };
+			return meta;
+		}
+
 		MediaAttachment Media(PostMedia media) => new()
 		{
 			Id = media.AttachmentId ?? media.Id.ToString("N"),
@@ -262,17 +523,12 @@ namespace PrivaPub.Api.Mastodon.Mappers
 				_ => "unknown"
 			},
 			Url = media.URL ?? Proxied(media.RemoteURL),
-			PreviewUrl = media.PreviewURL ?? media.URL ?? Proxied(media.RemoteURL),
+			PreviewUrl = media.PreviewURL ?? Proxied(media.RemotePreviewURL)
+				?? (media.ContentType?.StartsWith("image/") == true || media.ContentType == default ? media.URL ?? Proxied(media.RemoteURL) : default),
 			RemoteUrl = media.RemoteURL,
 			Description = media.Description,
 			Blurhash = media.Blurhash,
-			Meta = new
+			Meta = Meta(media)
-			{
-				original = media.Width.HasValue && media.Height > 0
-					? new { width = media.Width, height = media.Height, size = $"{media.Width}x{media.Height}", aspect = (double)media.Width / media.Height.Value }
-					: default,
-				focus = media.Focus is { Length: 2 } ? new { x = media.Focus[0], y = media.Focus[1] } : default
-			}
 		};
 	}
 }

PrivaPub/Domain/Content/LinkPreviews.cs

@@ -0,0 +1,155 @@
+using AngleSharp.Html.Parser;
+
+using Microsoft.Extensions.Options;
+
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Infrastructure.Http;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.StaticServices;
+
+using System.Security.Cryptography;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Domain.Content
+{
+	public class LinkPreview : Entity
+	{
+		public string Url { get; set; }
+		public string Title { get; set; }
+		public string Description { get; set; }
+		public string ImageURL { get; set; }
+		public string SiteName { get; set; }
+		public bool Failed { get; set; }
+		public DateTime FetchedAt { get; set; } = DateTime.UtcNow;
+	}
+
+	public interface ILinkPreviews
+	{
+		Task Wanted(PostEntity post, CancellationToken token);
+	}
+
+	public class LinkPreviews : ILinkPreviews, IJobHandler
+	{
+		const int MaxJitterSeconds = 60;
+		static readonly TimeSpan Freshness = TimeSpan.FromDays(7);
+		static readonly HtmlParser Parser = new();
+
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IFederationHttp _http;
+		readonly IJobQueue _queue;
+		readonly IOptionsMonitor<FederationOptions> _options;
+
+		public LinkPreviews(DbEntities dbEntities, ILocalActorService localActors, IFederationHttp http, IJobQueue queue,
+			IOptionsMonitor<FederationOptions> options)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_http = http;
+			_queue = queue;
+			_options = options;
+		}
+
+		public JobKind Kind => JobKind.FetchPreview;
+		public int Concurrency => 2;
+		public int MaxAttempts => 1;
+		public int PerHostLimit => 1;
+
+		public async Task Wanted(PostEntity post, CancellationToken token)
+		{
+			if (!_options.CurrentValue.FetchLinkPreviews || post.Visibility is not (PostVisibility.Public or PostVisibility.Unlisted) || post.IsLocalOnly
+				|| post.ReblogOfPostId != default || post.Link?.Title != default || post.Link == default && post.Media.Count > 0)
+				return;
+			var url = post.Link?.Href ?? FirstLink(post, _localActors.BaseAddress);
+			if (url == default)
+				return;
+			await _queue.EnqueueMany(new[]
+			{
+				new Job
+				{
+					Kind = JobKind.FetchPreview, Payload = post.ID, Host = new Uri(url).Host.ToLowerInvariant(), DedupeKey = $"preview|{post.ID}",
+					RunAt = DateTime.UtcNow.AddSeconds(RandomNumberGenerator.GetInt32(0, MaxJitterSeconds + 1))
+				}
+			}, token);
+		}
+
+		public async Task<JobOutcome> Handle(Job job, CancellationToken token)
+		{
+			var post = await _dbEntities.Posts.MatchID(job.Payload).ExecuteFirstAsync(token);
+			if (post == default || post.DeletedAt.HasValue || post.Link?.Title != default)
+				return JobOutcome.Done;
+			var url = post.Link?.Href ?? FirstLink(post, _localActors.BaseAddress);
+			if (url == default)
+				return JobOutcome.Done;
+
+			var preview = await DB.Default.Find<LinkPreview>().Match(p => p.Url == url).ExecuteFirstAsync(token);
+			if (preview == default || preview.FetchedAt < DateTime.UtcNow - Freshness)
+				preview = await Fetch(url, token);
+			if (preview == default || preview.Failed)
+				return JobOutcome.Done;
+
+			var link = post.Link ?? new PostLink { Href = url };
+			link.Title ??= preview.Title;
+			link.Description ??= preview.Description;
+			link.ImageURL ??= preview.ImageURL;
+			await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(p => p.Link, link).ExecuteAsync(token);
+			return JobOutcome.Done;
+		}
+
+		async Task<LinkPreview> Fetch(string url, CancellationToken token)
+		{
+			var (finalUri, html) = await _http.GetPage(url, token);
+			var preview = html == default ? new LinkPreview { Url = url, Failed = true } : Read(url, finalUri, html);
+			await DB.Default.Update<LinkPreview>()
+				.Match(p => p.Url == url)
+				.Modify(p => p.Title, preview.Title)
+				.Modify(p => p.Description, preview.Description)
+				.Modify(p => p.ImageURL, preview.ImageURL)
+				.Modify(p => p.SiteName, preview.SiteName)
+				.Modify(p => p.Failed, preview.Failed)
+				.Modify(p => p.FetchedAt, DateTime.UtcNow)
+				.Option(o => o.IsUpsert = true)
+				.ExecuteAsync(token);
+			return preview;
+		}
+
+		public static LinkPreview Read(string url, Uri finalUri, string html)
+		{
+			var document = Parser.ParseDocument(html);
+			string Meta(params string[] names) => names
+				.Select(name => document.QuerySelector($"meta[property='{name}'], meta[name='{name}']")?.GetAttribute("content"))
+				.FirstOrDefault(value => !string.IsNullOrWhiteSpace(value));
+			var image = Meta("og:image:secure_url", "og:image", "og:image:url", "twitter:image", "twitter:image:src");
+			var imageUri = image != default && Uri.TryCreate(finalUri, image, out var resolved) && resolved.Scheme is "https" or "http" ? resolved.AbsoluteUri : default;
+			var preview = new LinkPreview
+			{
+				Url = url,
+				Title = ObjectShapes.Text(Meta("og:title", "twitter:title") ?? document.Title, 300),
+				Description = ObjectShapes.Text(Meta("og:description", "twitter:description", "description"), 1000),
+				SiteName = ObjectShapes.Text(Meta("og:site_name"), 200),
+				ImageURL = imageUri
+			};
+			preview.Failed = preview.Title == default && preview.Description == default && preview.ImageURL == default;
+			return preview;
+		}
+
+		public static string FirstLink(PostEntity post, string ownBase)
+		{
+			if (string.IsNullOrEmpty(post.ContentHtml))
+				return default;
+			var document = Parser.ParseDocument(post.ContentHtml);
+			return document.QuerySelectorAll("a[href]")
+				.Where(a => !(a.ClassList.Contains("mention") || a.ClassList.Contains("hashtag") || a.GetAttribute("rel")?.Contains("tag") == true
+					|| a.Closest(".quote-inline") != default))
+				.Select(a => a.GetAttribute("href"))
+				.FirstOrDefault(href => Uri.TryCreate(href, UriKind.Absolute, out var uri) && uri.Scheme is "https" or "http"
+					&& href != post.Url && href != post.ObjectURI && !href.StartsWith(ownBase + "/", StringComparison.OrdinalIgnoreCase));
+		}
+	}
+}

PrivaPub/Domain/Relationships/RelationshipService.cs

@@ -38,12 +38,14 @@ namespace PrivaPub.Domain.Relationships
 
 		public async Task Block(LocalActor me, string targetActorUri, string targetAccountId, CancellationToken token)
 		{
+			var block = new Block { AvatarId = me.Id, TargetAccountId = targetAccountId, TargetActorURI = targetActorUri };
 			try
 			{
-				await DB.Default.SaveAsync(new Block { AvatarId = me.Id, TargetAccountId = targetAccountId, TargetActorURI = targetActorUri }, token);
+				await DB.Default.SaveAsync(block, token);
 			}
 			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
 			{
+				block = await DB.Default.Find<Block>().Match(b => b.AvatarId == me.Id && b.TargetActorURI == targetActorUri).ExecuteFirstAsync(token);
 			}
 
 			await _follows.UnfollowAs(me, targetActorUri, token);
@@ -67,10 +69,44 @@ namespace PrivaPub.Domain.Relationships
 					await DB.Default.DeleteAsync<Following>(f => f.TargetActorURI == me.Uri && f.AvatarId == targetAccountId);
 			}
 			await Forget(me, targetAccountId, token);
+			if (block != default)
+				await Tell(me, targetActorUri, BlockActivity(me, block), token);
 		}
 
-		public async Task Unblock(LocalActor me, string targetActorUri, CancellationToken token) =>
+		public async Task Unblock(LocalActor me, string targetActorUri, CancellationToken token)
-			await DB.Default.DeleteAsync<Block>(b => b.AvatarId == me.Id && b.TargetActorURI == targetActorUri);
+		{
+			var block = await DB.Default.Find<Block>().Match(b => b.AvatarId == me.Id && b.TargetActorURI == targetActorUri).ExecuteFirstAsync(token);
+			if (block == default)
+				return;
+			await DB.Default.DeleteAsync<Block>(block.ID);
+			await Tell(me, targetActorUri, new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.ActivityStreams,
+				["id"] = me.ActivityUri($"undo-block-{block.ID}"),
+				["type"] = "Undo",
+				["actor"] = me.Uri,
+				["object"] = BlockActivity(me, block)
+			}, token);
+		}
+
+		static JsonObject BlockActivity(LocalActor me, Block block) => new()
+		{
+			["@context"] = ActivityPubRenderer.ActivityStreams,
+			["id"] = me.ActivityUri($"block-{block.ID}"),
+			["type"] = "Block",
+			["actor"] = me.Uri,
+			["object"] = block.TargetActorURI,
+			["to"] = new JsonArray(block.TargetActorURI)
+		};
+
+		async Task Tell(LocalActor me, string targetActorUri, JsonObject activity, CancellationToken token)
+		{
+			if (targetActorUri.StartsWith(me.BaseAddress + "/", StringComparison.OrdinalIgnoreCase))
+				return;
+			var target = await _dbEntities.ForeignAvatars.Match(f => f.ActorURI == targetActorUri).ExecuteFirstAsync(token);
+			if (!string.IsNullOrEmpty(target?.InboxURL))
+				await _delivery.Enqueue(me, new[] { target.InboxURL }, activity, token);
+		}
 
 		public async Task Mute(LocalActor me, string targetActorUri, string targetAccountId, bool hideNotifications, TimeSpan? duration, CancellationToken token)
 		{

PrivaPub/Domain/Social/Notifications.cs

@@ -8,9 +8,9 @@ namespace PrivaPub.Domain.Social
 	public static class Notifications
 	{
 		public static async Task Add(string avatarId, NotificationType type, string fromAccountId, string fromActorUri, string postId,
-			CancellationToken token)
+			CancellationToken token, string emoji = default, string emojiUrl = default)
 		{
-			if (string.IsNullOrEmpty(avatarId) || avatarId == fromAccountId)
+			if (string.IsNullOrEmpty(avatarId) || avatarId == fromAccountId && type != NotificationType.Poll)
 				return;
 			if ((await Relationships.Hidden.AuthorsHiddenFrom(avatarId, new[] { fromActorUri }, forNotifications: true, token)).Count > 0)
 				return;
@@ -23,7 +23,9 @@ namespace PrivaPub.Domain.Social
 					FromAccountId = fromAccountId,
 					FromActorURI = fromActorUri,
 					PostId = postId,
-					DedupeKey = $"{type}|{avatarId}|{fromActorUri}|{postId}"
+					Emoji = emoji,
+					EmojiURL = emojiUrl,
+					DedupeKey = emoji == default ? $"{type}|{avatarId}|{fromActorUri}|{postId}" : $"{type}|{avatarId}|{fromActorUri}|{postId}|{emoji}"
 				}, token);
 			}
 			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)

PrivaPub/Domain/Social/Reactions.cs

@@ -0,0 +1,179 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Inbox.Handlers;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Globalization;
+using System.Text.Json.Nodes;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Domain.Social
+{
+	public interface IReactions
+	{
+		Task Receive(PostEntity post, ForeignAvatar actor, string content, JsonNode tags, string activityId, CancellationToken token);
+		Task<bool> Withdraw(ForeignAvatar actor, string activityId, string objectUri, string content, CancellationToken token);
+		Task<bool> React(LocalActor me, PostEntity post, string emoji, CancellationToken token);
+		Task<bool> Unreact(LocalActor me, PostEntity post, string emoji, CancellationToken token);
+	}
+
+	public class Reactions : IReactions
+	{
+		static readonly string[] Hearts = { "❤", "❤️", "♥", "♥️" };
+
+		readonly DbEntities _dbEntities;
+		readonly IDeliveryService _delivery;
+
+		public Reactions(DbEntities dbEntities, IDeliveryService delivery)
+		{
+			_dbEntities = dbEntities;
+			_delivery = delivery;
+		}
+
+		public static bool IsHeart(string content) => content == default || Hearts.Contains(content.Trim());
+
+		public async Task Receive(PostEntity post, ForeignAvatar actor, string content, JsonNode tags, string activityId, CancellationToken token)
+		{
+			if (!LikeHandler.MaySee(post, actor) || Normalise(content, ObjectShapes.Emojis(tags)) is not { } emoji)
+				return;
+			try
+			{
+				await DB.Default.SaveAsync(new Reaction
+				{
+					PostId = post.ID, AccountId = actor.ID, ActorURI = actor.ActorURI, Emoji = emoji.Name, EmojiURL = emoji.Url, ActivityURI = activityId
+				}, token);
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+				return;
+			}
+			if (!post.IsFederatedCopy)
+				await Notifications.Add(post.GroupUserId, NotificationType.Reaction, actor.ID, actor.ActorURI, post.ID, token, emoji.Name, emoji.Url);
+		}
+
+		public async Task<bool> Withdraw(ForeignAvatar actor, string activityId, string objectUri, string content, CancellationToken token)
+		{
+			var reaction = activityId == default
+				? default
+				: await DB.Default.Find<Reaction>().Match(r => r.ActivityURI == activityId && r.ActorURI == actor.ActorURI).ExecuteFirstAsync(token);
+			if (reaction == default && objectUri != default && Normalise(content, new()) is { } emoji)
+			{
+				var post = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri).ExecuteFirstAsync(token);
+				reaction = post == default
+					? default
+					: await DB.Default.Find<Reaction>().Match(r => r.PostId == post.ID && r.ActorURI == actor.ActorURI && r.Emoji == emoji.Name).ExecuteFirstAsync(token);
+			}
+			if (reaction == default)
+				return false;
+			await DB.Default.DeleteAsync<Reaction>(reaction.ID);
+			return true;
+		}
+
+		public async Task<bool> React(LocalActor me, PostEntity post, string emoji, CancellationToken token)
+		{
+			var known = post.Emojis.Select(e => (e.Shortcode, e.URL))
+				.Concat((await DB.Default.Find<Reaction>().Match(r => r.PostId == post.ID && r.EmojiURL != null).ExecuteAsync(token)).Select(r => (r.Emoji, r.EmojiURL)))
+				.Select(e => new Models.Post.CustomEmoji { Shortcode = e.Item1, URL = e.Item2 })
+				.ToList();
+			if (Normalise(emoji, known) is not { } picked)
+				return false;
+			var reaction = new Reaction
+			{
+				PostId = post.ID, AccountId = me.Id, ActorURI = me.Uri, IsLocal = true, Emoji = picked.Name, EmojiURL = picked.Url,
+				ActivityURI = me.ActivityUri($"react-{post.ID}-{Guid.NewGuid():N}")
+			};
+			try
+			{
+				await DB.Default.SaveAsync(reaction, token);
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+				return true;
+			}
+			if (!post.IsFederatedCopy)
+				await Notifications.Add(post.GroupUserId, NotificationType.Reaction, me.Id, me.Uri, post.ID, token, picked.Name, picked.Url);
+			else
+				await Tell(me, post, Activity(me, post, reaction), token);
+			return true;
+		}
+
+		public async Task<bool> Unreact(LocalActor me, PostEntity post, string emoji, CancellationToken token)
+		{
+			var name = Normalise(emoji, post.Emojis.ToList(), requireKnownCustom: false)?.Name;
+			var reaction = name == default
+				? default
+				: await DB.Default.Find<Reaction>().Match(r => r.PostId == post.ID && r.ActorURI == me.Uri && r.Emoji == name).ExecuteFirstAsync(token);
+			if (reaction == default)
+				return false;
+			await DB.Default.DeleteAsync<Reaction>(reaction.ID);
+			if (post.IsFederatedCopy)
+				await Tell(me, post, new JsonObject
+				{
+					["@context"] = ActivityPubRenderer.Context(),
+					["id"] = me.ActivityUri($"undo-{reaction.ID}"),
+					["type"] = "Undo",
+					["actor"] = me.Uri,
+					["object"] = Activity(me, post, reaction)
+				}, token);
+			return true;
+		}
+
+		static JsonObject Activity(LocalActor me, PostEntity post, Reaction reaction)
+		{
+			var react = new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.Context(),
+				["id"] = reaction.ActivityURI,
+				["type"] = "EmojiReact",
+				["actor"] = me.Uri,
+				["object"] = post.ObjectURI,
+				["to"] = new JsonArray(post.ActorURI),
+				["content"] = reaction.EmojiURL == default ? reaction.Emoji : $":{reaction.Emoji}:"
+			};
+			if (reaction.EmojiURL != default)
+				react["tag"] = new JsonArray(new JsonObject
+				{
+					["type"] = "Emoji",
+					["name"] = $":{reaction.Emoji}:",
+					["icon"] = new JsonObject { ["type"] = "Image", ["url"] = reaction.EmojiURL }
+				});
+			return react;
+		}
+
+		async Task Tell(LocalActor me, PostEntity post, JsonObject activity, CancellationToken token)
+		{
+			var author = await _dbEntities.ForeignAvatars.Match(f => f.ActorURI == post.ActorURI).ExecuteFirstAsync(token);
+			if (!string.IsNullOrEmpty(author?.InboxURL))
+				await _delivery.Enqueue(me, new[] { author.InboxURL }, activity, token);
+		}
+
+		public sealed record Picked(string Name, string Url);
+
+		public static Picked Normalise(string content, List<Models.Post.CustomEmoji> emojis, bool requireKnownCustom = true)
+		{
+			var text = content?.Trim();
+			if (string.IsNullOrEmpty(text) || text.Length > 100)
+				return default;
+			if (text.StartsWith(':') && text.EndsWith(':') && text.Length > 2)
+			{
+				var shortcode = text.Trim(':');
+				var bare = shortcode.Split('@')[0];
+				var emoji = emojis.FirstOrDefault(e => e.Shortcode == shortcode) ?? emojis.FirstOrDefault(e => e.Shortcode.Split('@')[0] == bare);
+				if (emoji == default)
+					return requireKnownCustom ? default : new Picked(bare, default);
+				return new Picked(bare, emoji.URL);
+			}
+			if (text.Any(c => c < 128 || char.IsWhiteSpace(c)) || new StringInfo(text).LengthInTextElements != 1)
+				return default;
+			return new Picked(text, default);
+		}
+	}
+}

PrivaPub/Domain/Statuses/PollService.cs

@@ -0,0 +1,281 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Social;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Inbox.Handlers;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Domain.Statuses
+{
+	public sealed record PollDraft(IReadOnlyList<string> Options, int ExpiresIn, bool Multiple, bool HideTotals);
+
+	public interface IPollService
+	{
+		string Invalid(PollDraft draft);
+		PostPoll Create(PollDraft draft);
+		Task Scheduled(PostEntity post, CancellationToken token);
+		Task<StatusOutcome> Vote(LocalActor me, PostEntity post, IReadOnlyList<int> choices, CancellationToken token);
+		Task Receive(PostEntity post, ForeignAvatar voter, string choice, string activityId, CancellationToken token);
+		Task<HashSet<int>> OwnVotes(string postId, string avatarId, CancellationToken token);
+	}
+
+	public class PollService : IPollService
+	{
+		public const int MaxOptions = 4;
+		public const int MaxOptionLength = 50;
+		public const int MinExpiration = 300;
+		public const int MaxExpiration = 2_629_746;
+		static readonly TimeSpan RefreshEvery = TimeSpan.FromMinutes(3);
+
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IDeliveryService _delivery;
+		readonly IJobQueue _queue;
+
+		public PollService(DbEntities dbEntities, ILocalActorService localActors, IDeliveryService delivery, IJobQueue queue)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_delivery = delivery;
+			_queue = queue;
+		}
+
+		public string Invalid(PollDraft draft)
+		{
+			var options = draft.Options.Select(o => o?.Trim()).ToList();
+			if (options.Count is < 2 or > MaxOptions)
+				return $"Validation failed: A poll needs between 2 and {MaxOptions} options";
+			if (options.Any(o => string.IsNullOrEmpty(o) || o.Length > MaxOptionLength))
+				return $"Validation failed: Poll options must be between 1 and {MaxOptionLength} characters";
+			if (options.Distinct(StringComparer.Ordinal).Count() != options.Count)
+				return "Validation failed: Poll options must be unique";
+			if (draft.ExpiresIn is < MinExpiration or > MaxExpiration)
+				return "Validation failed: The poll's duration is out of range";
+			return default;
+		}
+
+		public PostPoll Create(PollDraft draft) => new()
+		{
+			Options = draft.Options.Select(o => new PollOption { Title = o.Trim() }).ToList(),
+			Multiple = draft.Multiple,
+			HideTotals = draft.HideTotals,
+			ExpiresAt = DateTime.UtcNow.AddSeconds(draft.ExpiresIn),
+			VotersCount = 0
+		};
+
+		public async Task Scheduled(PostEntity post, CancellationToken token)
+		{
+			if (post.Poll?.ExpiresAt is not { } ends)
+				return;
+			await _queue.EnqueueMany(new[]
+			{
+				new Job { Kind = JobKind.PollClose, Payload = post.ID, Host = LocalHost, DedupeKey = $"poll-close|{post.ID}", RunAt = ends }
+			}, token);
+		}
+
+		public async Task<StatusOutcome> Vote(LocalActor me, PostEntity post, IReadOnlyList<int> choices, CancellationToken token)
+		{
+			var poll = post.Poll;
+			if (poll == default)
+				return StatusOutcome.Fail(StatusCodes.Status404NotFound, "Record not found");
+			if (Ended(poll))
+				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: The poll has already ended");
+			if (!post.IsFederatedCopy && post.GroupUserId == me.Id)
+				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: You cannot vote in your own poll");
+			var picked = choices.Distinct().ToList();
+			if (picked.Count == 0 || picked.Any(c => c < 0 || c >= poll.Options.Count) || !poll.Multiple && picked.Count > 1)
+				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: The choices are invalid");
+			if (await DB.Default.Find<PollVote>().Match(v => v.PostId == post.ID && v.ActorURI == me.Uri).ExecuteAnyAsync(token))
+				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: You have already voted on this poll");
+
+			foreach (var choice in picked)
+				await DB.Default.SaveAsync(new PollVote
+				{
+					PostId = post.ID, VoterAccountId = me.Id, ActorURI = me.Uri, IsLocalVoter = true, Choice = choice,
+					ActivityURI = me.Uri + $"#votes/{post.ID}/{choice}"
+				}, token);
+			await Count(post, picked, newVoter: true, token);
+
+			if (post.IsFederatedCopy)
+				await SendVotes(me, post, picked, token);
+			else
+				await Refreshed(post, token);
+			await Scheduled(post, token);
+			return new StatusOutcome(await _dbEntities.Posts.MatchID(post.ID).ExecuteFirstAsync(token));
+		}
+
+		public async Task Receive(PostEntity post, ForeignAvatar voter, string choice, string activityId, CancellationToken token)
+		{
+			var poll = post.Poll;
+			if (poll == default || post.IsFederatedCopy || Ended(poll) || !LikeHandler.MaySee(post, voter))
+				return;
+			var index = poll.Options.FindIndex(o => o.Title == choice);
+			if (index < 0)
+				return;
+			var earlier = await DB.Default.Find<PollVote>().Match(v => v.PostId == post.ID && v.ActorURI == voter.ActorURI).ExecuteAsync(token);
+			if (earlier.Count > 0 && (!poll.Multiple || earlier.Any(v => v.Choice == index)))
+				return;
+			try
+			{
+				await DB.Default.SaveAsync(new PollVote
+				{
+					PostId = post.ID, VoterAccountId = voter.ID, ActorURI = voter.ActorURI, Choice = index, ActivityURI = activityId
+				}, token);
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+				return;
+			}
+			await Count(post, new[] { index }, newVoter: earlier.Count == 0, token);
+			await Refreshed(post, token);
+		}
+
+		public async Task<HashSet<int>> OwnVotes(string postId, string avatarId, CancellationToken token) =>
+			avatarId == default
+				? new HashSet<int>()
+				: (await DB.Default.Find<PollVote>().Match(v => v.PostId == postId && v.VoterAccountId == avatarId && v.IsLocalVoter).ExecuteAsync(token))
+					.Select(v => v.Choice).ToHashSet();
+
+		public static bool Ended(PostPoll poll) => poll.ClosedAt.HasValue || poll.ExpiresAt <= DateTime.UtcNow;
+
+		async Task Count(PostEntity post, IReadOnlyList<int> choices, bool newVoter, CancellationToken token)
+		{
+			var update = DB.Default.Update<PostEntity>().MatchID(post.ID);
+			foreach (var choice in choices)
+				update = update.Modify(b => b.Inc($"{nameof(PostEntity.Poll)}.{nameof(PostPoll.Options)}.{choice}.{nameof(PollOption.Votes)}", 1));
+			if (newVoter && post.Poll.VotersCount.HasValue)
+				update = update.Modify(b => b.Inc($"{nameof(PostEntity.Poll)}.{nameof(PostPoll.VotersCount)}", 1));
+			await update.ExecuteAsync(token);
+		}
+
+		async Task SendVotes(LocalActor me, PostEntity post, IReadOnlyList<int> choices, CancellationToken token)
+		{
+			var owner = await _dbEntities.ForeignAvatars.Match(f => f.ActorURI == post.ActorURI).ExecuteFirstAsync(token);
+			if (string.IsNullOrEmpty(owner?.InboxURL))
+				return;
+			foreach (var choice in choices)
+			{
+				var voteId = me.Uri + $"#votes/{post.ID}/{choice}";
+				await _delivery.Enqueue(me, new[] { owner.InboxURL }, new JsonObject
+				{
+					["@context"] = ActivityPubRenderer.ActivityStreams,
+					["id"] = voteId + "/activity",
+					["type"] = "Create",
+					["actor"] = me.Uri,
+					["to"] = new JsonArray(owner.ActorURI),
+					["object"] = new JsonObject
+					{
+						["id"] = voteId,
+						["type"] = "Note",
+						["name"] = post.Poll.Options[choice].Title,
+						["attributedTo"] = me.Uri,
+						["to"] = new JsonArray(owner.ActorURI),
+						["inReplyTo"] = post.ObjectURI
+					}
+				}, token);
+			}
+		}
+
+		async Task Refreshed(PostEntity post, CancellationToken token)
+		{
+			var bucket = DateTime.UtcNow.Ticks / RefreshEvery.Ticks;
+			await _queue.EnqueueMany(new[]
+			{
+				new Job
+				{
+					Kind = JobKind.PollRefresh, Payload = post.ID, Host = LocalHost, DedupeKey = $"poll-refresh|{post.ID}|{bucket}",
+					RunAt = new DateTime((bucket + 1) * RefreshEvery.Ticks, DateTimeKind.Utc)
+				}
+			}, token);
+		}
+
+		string LocalHost => new Uri(_localActors.BaseAddress).Host;
+	}
+
+	public class PollRefreshJob : IJobHandler
+	{
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IOutboxPublisher _outbox;
+
+		public PollRefreshJob(DbEntities dbEntities, ILocalActorService localActors, IOutboxPublisher outbox)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_outbox = outbox;
+		}
+
+		public virtual JobKind Kind => JobKind.PollRefresh;
+		public int Concurrency => 1;
+		public int MaxAttempts => 3;
+		public int PerHostLimit => 1;
+
+		public virtual async Task<JobOutcome> Handle(Job job, CancellationToken token)
+		{
+			var post = await _dbEntities.Posts.MatchID(job.Payload).ExecuteFirstAsync(token);
+			if (post?.Poll == default || post.IsFederatedCopy || post.DeletedAt.HasValue)
+				return JobOutcome.Done;
+			var author = await _localActors.FindById(LocalActorKind.Person, post.GroupUserId, token);
+			if (author == default)
+				return JobOutcome.Done;
+			await Closing(post, author, token);
+			if (!post.IsLocalOnly)
+				await _outbox.Publish(author, post, ActivityPubRenderer.UpdateOf(post, author, $"poll-{DateTime.UtcNow.Ticks}"), token);
+			return JobOutcome.Done;
+		}
+
+		protected virtual Task Closing(PostEntity post, LocalActor author, CancellationToken token) => Task.CompletedTask;
+	}
+
+	public class PollCloseJob : PollRefreshJob
+	{
+		readonly DbEntities _posts;
+
+		public PollCloseJob(DbEntities dbEntities, ILocalActorService localActors, IOutboxPublisher outbox) : base(dbEntities, localActors, outbox)
+		{
+			_posts = dbEntities;
+		}
+
+		public override JobKind Kind => JobKind.PollClose;
+
+		public override async Task<JobOutcome> Handle(Job job, CancellationToken token)
+		{
+			var post = await _posts.Posts.MatchID(job.Payload).ExecuteFirstAsync(token);
+			if (post?.Poll == default || post.DeletedAt.HasValue)
+				return JobOutcome.Done;
+			if (!post.IsFederatedCopy)
+				return await base.Handle(job, token);
+			await Notify(post, post.AuthorAccountId, post.ActorURI, token);
+			return JobOutcome.Done;
+		}
+
+		protected override async Task Closing(PostEntity post, LocalActor author, CancellationToken token)
+		{
+			post.Poll.ClosedAt ??= DateTime.UtcNow;
+			await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(p => p.Poll.ClosedAt, post.Poll.ClosedAt).ExecuteAsync(token);
+			await Notify(post, author.Id, author.Uri, token);
+		}
+
+		public static async Task Notify(PostEntity post, string authorAccountId, string authorUri, CancellationToken token)
+		{
+			var voters = await DB.Default.Find<PollVote>().Match(v => v.PostId == post.ID && v.IsLocalVoter).ExecuteAsync(token);
+			foreach (var voter in voters.Select(v => v.VoterAccountId).Distinct())
+				await Notifications.Add(voter, NotificationType.Poll, authorAccountId, authorUri, post.ID, token);
+			if (!post.IsFederatedCopy)
+				await Notifications.Add(post.GroupUserId, NotificationType.Poll, post.GroupUserId, authorUri, post.ID, token);
+		}
+	}
+}

PrivaPub/Domain/Statuses/QuoteService.cs

@@ -0,0 +1,196 @@
+using MongoDB.Entities;
+
+using PrivaPub.Domain.Social;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Inbox;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.User;
+using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Domain.Statuses
+{
+	public interface IQuoteService
+	{
+		Task Resolve(PostEntity post, NoteDocument note, CancellationToken token);
+		Task Revoke(string stampUri, CancellationToken token);
+		Task<bool> Verified(string stampUri, string quotingUri, PostEntity quoted, CancellationToken token);
+		QuotePermission Permission(PostEntity quoted, LocalActor author);
+		Task Request(LocalActor author, PostEntity post, PostEntity quoted, JsonObject note, CancellationToken token);
+		Task<bool> Answered(JsonNode answer, ForeignAvatar actor, bool accepted, CancellationToken token);
+	}
+
+	public enum QuotePermission
+	{
+		Denied,
+		Granted,
+		AskFirst
+	}
+
+	public class QuoteService : IQuoteService
+	{
+		readonly DbEntities _dbEntities;
+		readonly IRemoteActorService _remoteActors;
+		readonly IRemotePosts _remotePosts;
+		readonly ILocalActorService _localActors;
+		readonly IDeliveryService _delivery;
+		readonly IOutboxPublisher _outbox;
+
+		public QuoteService(DbEntities dbEntities, IRemoteActorService remoteActors, IRemotePosts remotePosts, ILocalActorService localActors,
+			IDeliveryService delivery, IOutboxPublisher outbox)
+		{
+			_dbEntities = dbEntities;
+			_remoteActors = remoteActors;
+			_remotePosts = remotePosts;
+			_localActors = localActors;
+			_delivery = delivery;
+			_outbox = outbox;
+		}
+
+		const string RequestPrefix = "quote-request-";
+
+		public QuotePermission Permission(PostEntity quoted, LocalActor author)
+		{
+			if (!quoted.IsFederatedCopy)
+				return quoted.GroupUserId == author.Id && quoted.Visibility is PostVisibility.Public or PostVisibility.Unlisted
+					? QuotePermission.Granted
+					: QuotePermission.Denied;
+			if (quoted.Visibility is not (PostVisibility.Public or PostVisibility.Unlisted))
+				return QuotePermission.Denied;
+			if (quoted.QuotePolicy is not { } policy)
+				return QuotePermission.Granted;
+			return policy.Automatic.Concat(policy.Manual).Any(Addressing.IsPublic) || policy.Automatic.Concat(policy.Manual).Contains(author.Uri)
+				? QuotePermission.AskFirst
+				: QuotePermission.Denied;
+		}
+
+		public async Task Request(LocalActor author, PostEntity post, PostEntity quoted, JsonObject note, CancellationToken token)
+		{
+			var owner = await _dbEntities.ForeignAvatars.Match(f => f.ActorURI == quoted.ActorURI).ExecuteFirstAsync(token);
+			if (string.IsNullOrEmpty(owner?.InboxURL))
+				return;
+			await _delivery.Enqueue(author, new[] { owner.InboxURL }, new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.Context(),
+				["id"] = author.ActivityUri(RequestPrefix + post.ID),
+				["type"] = "QuoteRequest",
+				["actor"] = author.Uri,
+				["object"] = quoted.ObjectURI,
+				["instrument"] = note.DeepClone(),
+				["to"] = new JsonArray(quoted.ActorURI)
+			}, token);
+		}
+
+		public async Task<bool> Answered(JsonNode answer, ForeignAvatar actor, bool accepted, CancellationToken token)
+		{
+			var request = answer["object"];
+			var requestId = Id(request);
+			var marker = requestId?.LastIndexOf("/grunts/" + RequestPrefix, StringComparison.Ordinal) ?? -1;
+			if (marker < 0 && !(request is JsonObject && Value(request, "type") == "QuoteRequest"))
+				return false;
+			if (marker < 0)
+				return true;
+			var postId = requestId[(marker + "/grunts/".Length + RequestPrefix.Length)..];
+			var post = await _dbEntities.Posts.Match(p => p.ID == postId && !p.IsFederatedCopy && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			var author = post == default ? default : await _localActors.FindById(LocalActorKind.Person, post.GroupUserId, token);
+			if (author == default || author.ActivityUri(RequestPrefix + post.ID) != requestId || post.QuoteState != QuoteState.Pending)
+				return true;
+			var quoted = await _dbEntities.Posts.MatchID(post.QuotedPostId).ExecuteFirstAsync(token);
+			if (quoted?.ActorURI != actor.ActorURI)
+				return true;
+			if (!accepted)
+			{
+				await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(p => p.QuoteState, QuoteState.Rejected).ExecuteAsync(token);
+				return true;
+			}
+			var stamp = Id(answer["result"]);
+			if (stamp == default || !await Verified(stamp, post.ObjectURI, quoted, token))
+				return true;
+			post.QuoteAuthorizationURI = stamp;
+			post.QuoteState = QuoteState.Accepted;
+			await DB.Default.Update<PostEntity>().MatchID(post.ID)
+				.Modify(p => p.QuoteAuthorizationURI, stamp)
+				.Modify(p => p.QuoteState, QuoteState.Accepted)
+				.ExecuteAsync(token);
+			await DB.Default.Update<PostEntity>().MatchID(quoted.ID).Modify(b => b.Inc(p => p.QuotesCount, 1)).ExecuteAsync(token);
+			if (!post.IsLocalOnly)
+				await _outbox.Publish(author, post, ActivityPubRenderer.UpdateOf(post, author, "quote-approved"), token);
+			return true;
+		}
+
+		public async Task Resolve(PostEntity post, NoteDocument note, CancellationToken token)
+		{
+			if (note.QuoteUri == default && !note.QuoteDeleted)
+				return;
+			var quoted = note.QuoteUri == default
+				? default
+				: await _dbEntities.Posts.Match(p => p.ObjectURI == note.QuoteUri && !p.DeletedAt.HasValue).ExecuteFirstAsync(token)
+					?? await _remotePosts.StoreContext(note.QuoteUri, RemotePosts.MaxDepth, token);
+
+			var state = note.QuoteDeleted ? QuoteState.Deleted
+				: quoted == default ? QuoteState.Pending
+				: note.QuoteAuthorization != default
+					? !quoted.IsFederatedCopy || !await Verified(note.QuoteAuthorization, post.ObjectURI, quoted, token) ? QuoteState.Unauthorized : QuoteState.Accepted
+				: note.QuotesByConsent ? QuoteState.Pending
+				: quoted.Visibility is PostVisibility.Public or PostVisibility.Unlisted ? QuoteState.Accepted
+				: QuoteState.Unauthorized;
+
+			var wasCounted = post.QuoteState == QuoteState.Accepted ? post.QuotedPostId : default;
+			await DB.Default.Update<PostEntity>().MatchID(post.ID)
+				.Modify(p => p.QuoteURI, note.QuoteUri)
+				.Modify(p => p.QuotedPostId, quoted?.ID)
+				.Modify(p => p.QuoteState, state)
+				.Modify(p => p.QuoteAuthorizationURI, state == QuoteState.Accepted ? note.QuoteAuthorization : default)
+				.ExecuteAsync(token);
+			post.QuotedPostId = quoted?.ID;
+			post.QuoteState = state;
+
+			var nowCounted = state == QuoteState.Accepted ? quoted?.ID : default;
+			if (wasCounted == nowCounted)
+				return;
+			if (wasCounted != default)
+				await DB.Default.Update<PostEntity>().MatchID(wasCounted).Modify(b => b.Inc(p => p.QuotesCount, -1)).ExecuteAsync(token);
+			if (nowCounted != default)
+			{
+				await DB.Default.Update<PostEntity>().MatchID(nowCounted).Modify(b => b.Inc(p => p.QuotesCount, 1)).ExecuteAsync(token);
+				if (!quoted.IsFederatedCopy)
+					await Notifications.Add(quoted.GroupUserId, NotificationType.Quote, post.AuthorAccountId, post.ActorURI, post.ID, token);
+			}
+		}
+
+		public async Task Revoke(string stampUri, CancellationToken token)
+		{
+			var revoked = await _dbEntities.Posts.Match(p => p.QuoteAuthorizationURI == stampUri && p.QuoteState == QuoteState.Accepted).ExecuteAsync(token);
+			foreach (var post in revoked)
+			{
+				await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(p => p.QuoteState, QuoteState.Revoked).ExecuteAsync(token);
+				if (post.QuotedPostId != default)
+					await DB.Default.Update<PostEntity>().MatchID(post.QuotedPostId).Modify(b => b.Inc(p => p.QuotesCount, -1)).ExecuteAsync(token);
+			}
+		}
+
+		public async Task<bool> Verified(string stampUri, string quotingUri, PostEntity quoted, CancellationToken token)
+		{
+			if (!Origin.Same(stampUri, quoted.ActorURI))
+				return false;
+			using var fetched = await _remoteActors.FetchObject(stampUri, token);
+			if (fetched == default)
+				return false;
+			var stamp = JsonNode.Parse(fetched.Root.GetRawText());
+			return Value(stamp, "type") == "QuoteAuthorization"
+				&& Id(stamp["attributedTo"]) == quoted.ActorURI
+				&& Id(stamp["interactingObject"]) == quotingUri
+				&& Id(stamp["interactionTarget"]) == quoted.ObjectURI;
+		}
+	}
+}

PrivaPub/Domain/Statuses/StatusService.cs

@@ -39,6 +39,8 @@ namespace PrivaPub.Domain.Statuses
 		public double? Latitude { get; init; }
 		public double? Longitude { get; init; }
 		public double? RangeKm { get; init; }
+		public PollDraft Poll { get; init; }
+		public string QuotedStatusId { get; init; }
 	}
 
 	public sealed record StatusOutcome(PostEntity Post, int Status = StatusCodes.Status200OK, string Error = default)
@@ -69,10 +71,17 @@ namespace PrivaPub.Domain.Statuses
 		readonly IFanout _fanout;
 		readonly IMediaService _media;
 		readonly IGroupDistributor _groups;
+		readonly IPollService _polls;
+		readonly ILinkPreviews _previews;
+		readonly IQuoteService _quotes;
 
 		public StatusService(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDeliveryService delivery,
-			IContentRenderer content, IOutboxPublisher outbox, IFanout fanout, IMediaService media, IGroupDistributor groups)
+			IContentRenderer content, IOutboxPublisher outbox, IFanout fanout, IMediaService media, IGroupDistributor groups, IPollService polls,
+			ILinkPreviews previews, IQuoteService quotes)
 		{
+			_previews = previews;
+			_quotes = quotes;
+			_polls = polls;
 			_media = media;
 			_groups = groups;
 			_dbEntities = dbEntities;
@@ -89,8 +98,10 @@ namespace PrivaPub.Domain.Statuses
 			var media = await Media(author, draft.MediaIds, default, token);
 			if (media == default)
 				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: Media attachments are invalid");
-			if (string.IsNullOrWhiteSpace(draft.Text) && media.Count == 0)
+			if (string.IsNullOrWhiteSpace(draft.Text) && media.Count == 0 && draft.Poll == default)
 				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: Text can't be blank");
+			if (draft.Poll != default && _polls.Invalid(draft.Poll) is { } invalidPoll)
+				return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, invalidPoll);
 
 			LocalActor group = default;
 			if (!string.IsNullOrEmpty(draft.GroupId))
@@ -107,6 +118,18 @@ namespace PrivaPub.Domain.Statuses
 			if (parent != default && !await VisibilityPolicy.CanSee(parent, author.Id, token))
 				return StatusOutcome.Fail(StatusCodes.Status404NotFound, "Record not found");
 
+			PostEntity quoted = default;
+			var quotePermission = QuotePermission.Denied;
+			if (!string.IsNullOrEmpty(draft.QuotedStatusId))
+			{
+				quoted = await _dbEntities.Posts.Match(p => p.ID == draft.QuotedStatusId && !p.DeletedAt.HasValue && p.ReblogOfPostId == null).ExecuteFirstAsync(token);
+				if (quoted == default || !await VisibilityPolicy.CanSee(quoted, author.Id, token))
+					return StatusOutcome.Fail(StatusCodes.Status404NotFound, "Record not found");
+				quotePermission = _quotes.Permission(quoted, author);
+				if (quotePermission == QuotePermission.Denied)
+					return StatusOutcome.Fail(StatusCodes.Status422UnprocessableEntity, "Validation failed: This post cannot be quoted");
+			}
+
 			var located = draft.Latitude.HasValue || draft.Longitude.HasValue;
 			if (located && (draft.Latitude is not (>= -90 and <= 90) || draft.Longitude is not (>= -180 and <= 180) || group != default
 				|| draft.Visibility == PostVisibility.Direct))
@@ -157,7 +180,12 @@ namespace PrivaPub.Domain.Statuses
 				InReplyToURI = parent?.ObjectURI ?? (IsRemoteUri(draft.InReplyTo) ? draft.InReplyTo : default),
 				InReplyToAccountId = parent?.AuthorAccountId ?? parent?.GroupUserId,
 				IsLocalOnly = isLocalOnly,
-				ActorURI = author.Uri
+				ActorURI = author.Uri,
+				Poll = draft.Poll == default ? default : _polls.Create(draft.Poll),
+				QuoteURI = quoted?.ObjectURI,
+				QuotedPostId = quoted?.ID,
+				QuoteByConsent = quoted != default && (quoted.QuotePolicy != default || !quoted.IsFederatedCopy),
+				QuoteState = quoted == default ? QuoteState.None : quotePermission == QuotePermission.Granted ? QuoteState.Accepted : QuoteState.Pending
 			};
 			post.ID = (string)post.GenerateNewID();
 			post.ObjectURI = author.PostUri(post.ID);
@@ -200,6 +228,12 @@ namespace PrivaPub.Domain.Statuses
 			if (parent != default)
 				await DB.Default.Update<PostEntity>().MatchID(parent.ID).Modify(b => b.Inc(p => p.RepliesCount, 1)).ExecuteAsync(token);
 			await _fanout.Distribute(post, token);
+			await _polls.Scheduled(post, token);
+			if (post.QuoteState == QuoteState.Accepted)
+				await DB.Default.Update<PostEntity>().MatchID(quoted.ID).Modify(b => b.Inc(p => p.QuotesCount, 1)).ExecuteAsync(token);
+			if (post.QuoteState == QuoteState.Pending && create?["object"] is JsonObject quotingNote)
+				await _quotes.Request(author, post, quoted, quotingNote, token);
+			await _previews.Wanted(post, token);
 			if (create != default)
 				await _outbox.Publish(author, post, create, token);
 			if (create != default && group is { IsCircle: false } && visibility is PostVisibility.Public or PostVisibility.Unlisted)

PrivaPub/Federation/Actors/ActorDocument.cs

@@ -1,6 +1,9 @@
+using System.Globalization;
 using System.Text.Json;
+using System.Text.Json.Nodes;
 
 using PrivaPub.Federation.Objects;
+using PrivaPub.Models.Post;
 
 namespace PrivaPub.Federation.Actors
 {
@@ -23,6 +26,16 @@ namespace PrivaPub.Federation.Actors
 		public string SharedInbox { get; init; }
 		public string Icon { get; init; }
 		public bool Discoverable { get; init; } = true;
+		public bool Indexable { get; init; }
+		public bool Locked { get; init; }
+		public bool Memorial { get; init; }
+		public string Header { get; init; }
+		public string IconDescription { get; init; }
+		public string HeaderDescription { get; init; }
+		public string MovedTo { get; init; }
+		public DateTime? Published { get; init; }
+		public List<CustomEmoji> Emojis { get; init; } = new();
+		public Dictionary<string, string> Fields { get; init; } = new();
 		public IReadOnlyList<ActorKey> Keys { get; init; } = Array.Empty<ActorKey>();
 
 		public ActorKey Key(string keyId) => Keys.FirstOrDefault(k => k.Id == keyId);
@@ -52,10 +65,46 @@ namespace PrivaPub.Federation.Actors
 				SharedInbox = root.TryGetProperty("endpoints", out var endpoints) ? RemoteActorService.Text(endpoints, "sharedInbox") : default,
 				Icon = root.TryGetProperty("icon", out var icon) ? RemoteActorService.Text(icon, "url") : default,
 				Discoverable = !root.TryGetProperty("discoverable", out var discoverable) || discoverable.ValueKind != JsonValueKind.False,
-				Keys = ParseKeys(root, id)
+				Keys = ParseKeys(root, id),
+				Indexable = Flag(root, "indexable"),
+				Locked = Flag(root, "manuallyApprovesFollowers"),
+				Memorial = Flag(root, "memorial"),
+				Header = root.TryGetProperty("image", out var image) ? ObjectShapes.Image(JsonNode.Parse(image.GetRawText())) : default,
+				IconDescription = root.TryGetProperty("icon", out var described) ? Alt(described) : default,
+				HeaderDescription = root.TryGetProperty("image", out var headerImage) ? Alt(headerImage) : default,
+				MovedTo = RemoteActorService.Text(root, "movedTo"),
+				Published = DateTimeOffset.TryParse(RemoteActorService.Text(root, "published"), CultureInfo.InvariantCulture, DateTimeStyles.AssumeUniversal, out var published)
+					? published.UtcDateTime
+					: default(DateTime?),
+				Emojis = root.TryGetProperty("tag", out var tags) ? ObjectShapes.Emojis(JsonNode.Parse(tags.GetRawText())) : new(),
+				Fields = root.TryGetProperty("attachment", out var attachment) ? ParseFields(JsonNode.Parse(attachment.GetRawText())) : new()
 			};
 		}
 
+		const int MaxFields = 16;
+
+		static bool Flag(JsonElement root, string property) =>
+			root.TryGetProperty(property, out var value) && value.ValueKind == JsonValueKind.True;
+
+		static string Alt(JsonElement image) =>
+			image.ValueKind == JsonValueKind.Object ? ObjectShapes.Text(RemoteActorService.Text(image, "name") ?? RemoteActorService.Text(image, "summary"), 1500) : default;
+
+		static Dictionary<string, string> ParseFields(JsonNode attachment)
+		{
+			var fields = new Dictionary<string, string>();
+			foreach (var field in ObjectShapes.Objects(attachment).Where(a => ActivityJson.Value(a, "type") is "PropertyValue" or "Note"))
+			{
+				var name = ObjectShapes.Text(ActivityJson.Value(field, "name"), 255);
+				var value = ActivityJson.Value(field, "value") ?? ActivityJson.Value(field, "content");
+				if (name == default || value == default || fields.ContainsKey(name))
+					continue;
+				fields[name] = ContentSanitizer.Html(value.Length <= 2048 ? value : value[..2048]);
+				if (fields.Count == MaxFields)
+					break;
+			}
+			return fields;
+		}
+
 		static List<ActorKey> ParseKeys(JsonElement root, string actorId)
 		{
 			var keys = new List<ActorKey>();

PrivaPub/Federation/Actors/LocalActorService.cs

@@ -202,7 +202,7 @@ namespace PrivaPub.Federation.Actors
 			ThumbnailURL = avatar.ThumbnailURL,
 			PrivateKeyPem = avatar.PrivateKey,
 			PublicKeyPem = avatar.PublicKey,
-			Published = avatar.CreatedAt,
+			Published = avatar.PublishedOn,
 			Fields = avatar.Fields ?? new Dictionary<string, string>(),
 			ManuallyApprovesFollowers = avatar.Settings?.IsLocked == true,
 			Discoverable = avatar.Settings?.IsDiscoverable != false,
@@ -227,7 +227,7 @@ namespace PrivaPub.Federation.Actors
 			ManuallyApprovesFollowers = group.Kind == GroupKind.Circle || group.ManuallyApprovesMembers,
 			IsCircle = group.Kind == GroupKind.Circle,
 			PostingRestrictedToModerators = group.PostingPolicy == PostingPolicy.Moderators,
-			Published = group.CreationDate,
+			Published = group.PublishedOn,
 			BaseAddress = BaseAddress
 		};
 	}

PrivaPub/Federation/Actors/RemoteActorService.cs

@@ -6,6 +6,7 @@ using PrivaPub.StaticServices;
 using System.Text.Json;
 
 using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Options;
 
 using PrivaPub.Federation.Objects;
 using PrivaPub.Federation.Signing;
@@ -18,6 +19,7 @@ namespace PrivaPub.Federation.Actors
 		Task<FetchedJson> FetchObject(string uri, CancellationToken token);
 		Task<ForeignAvatar> GetActor(string actorUri, bool refresh, CancellationToken token);
 		Task<ForeignAvatar> GetActorByKeyId(string keyId, bool refresh, CancellationToken token);
+		bool KeyTemporarilyUnavailable(string keyId) => false;
 		Task<string> ResolveHandle(string handle, CancellationToken token);
 	}
 
@@ -32,13 +34,16 @@ namespace PrivaPub.Federation.Actors
 		readonly ILocalActorService _localActors;
 		readonly IMemoryCache _cache;
 		readonly DbEntities _dbEntities;
+		readonly IOptionsMonitor<FederationOptions> _options;
 
-		public RemoteActorService(IFederationHttp http, ILocalActorService localActors, IMemoryCache cache, DbEntities dbEntities)
+		public RemoteActorService(IFederationHttp http, ILocalActorService localActors, IMemoryCache cache, DbEntities dbEntities,
+			IOptionsMonitor<FederationOptions> options = default)
 		{
 			_http = http;
 			_localActors = localActors;
 			_cache = cache;
 			_dbEntities = dbEntities;
+			_options = options;
 		}
 
 		public async Task<FetchedJson> FetchObject(string uri, CancellationToken token)
@@ -116,14 +121,19 @@ namespace PrivaPub.Federation.Actors
 			return await Upsert(actor, key, token);
 		}
 
+		public bool KeyTemporarilyUnavailable(string keyId) => Origin.Of(keyId) != default && _http.FailedTemporarily(StripFragment(keyId));
+
 		public async Task<string> ResolveHandle(string handle, CancellationToken token)
 		{
 			var parts = handle?.TrimStart('@').Split('@');
 			if (parts is not { Length: 2 } || string.IsNullOrEmpty(parts[0]) || string.IsNullOrEmpty(parts[1]))
 				return default;
 
-			var url = $"https://{parts[1]}/.well-known/webfinger?resource={Uri.EscapeDataString($"acct:{parts[0]}@{parts[1]}")}";
+			var query = $"/.well-known/webfinger?resource={Uri.EscapeDataString($"acct:{parts[0]}@{parts[1]}")}";
-			using var fetched = await _http.GetJson(url, "application/jrd+json, application/json", sign: default, token);
+			using var fetched = await _http.GetJson($"https://{parts[1]}{query}", "application/jrd+json, application/json", sign: default, token)
+				?? (_options?.CurrentValue.AllowPlainHttp == true
+					? await _http.GetJson($"http://{parts[1]}{query}", "application/jrd+json, application/json", sign: default, token)
+					: default);
 			if (fetched == default)
 				return default;
 			var document = fetched.Document;
@@ -167,7 +177,17 @@ namespace PrivaPub.Federation.Actors
 				.Modify(a => a.FollowingURL, actor.Following)
 				.Modify(a => a.SharedInboxURL, actor.SharedInbox)
 				.Modify(a => a.PictureURL, actor.Icon)
+				.Modify(a => a.ThumbnailURL, actor.Header)
+				.Modify(a => a.PictureDescription, actor.IconDescription)
+				.Modify(a => a.HeaderDescription, actor.HeaderDescription)
 				.Modify(a => a.IsDiscoverable, actor.Discoverable)
+				.Modify(a => a.IsIndexable, actor.Indexable)
+				.Modify(a => a.IsLocked, actor.Locked)
+				.Modify(a => a.IsMemorial, actor.Memorial)
+				.Modify(a => a.MovedToURL, Origin.Of(actor.MovedTo) == default ? default : actor.MovedTo)
+				.Modify(a => a.Published, actor.Published)
+				.Modify(a => a.Emojis, actor.Emojis)
+				.Modify(a => a.Fields, actor.Fields)
 				.Modify(a => a.AvatarType, Enum.TryParse<AvatarType>(actor.Type, out var type) ? type : AvatarType.Person)
 				.Modify(a => a.PublicKeyId, key?.Id)
 				.Modify(a => a.PublicKey, key?.Pem)

PrivaPub/Federation/Controllers/PeasantsController.cs

@@ -317,6 +317,8 @@ namespace PrivaPub.Federation.Controllers
 		[NonAction]
 		public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
 		{
+			if (HttpMethods.IsGet(Request.Method))
+				Response.Headers.Vary = "Accept";
 			if (_federation.CurrentValue.SecureMode && HttpMethods.IsGet(Request.Method)
 				&& !string.Equals(context.RouteData.Values["actor"] as string, LocalActorService.InstanceUserName, StringComparison.OrdinalIgnoreCase)
 				&& await _fetches.Requester(Request, HttpContext.RequestAborted) == default)
@@ -331,6 +333,8 @@ namespace PrivaPub.Federation.Controllers
 		{
 			if (result.Error != default)
 				_logger.LogInformation("Inbox refused with {Status}: {Error}", result.StatusCode, result.Error);
+			if (result.RetryAfterSeconds is { } seconds)
+				Response.Headers.RetryAfter = seconds.ToString(System.Globalization.CultureInfo.InvariantCulture);
 			return result.Error == default ? StatusCode(result.StatusCode) : StatusCode(result.StatusCode, result.Error);
 		}
 

PrivaPub/Federation/Inbox/Arrival.cs

@@ -0,0 +1,14 @@
+namespace PrivaPub.Federation.Inbox
+{
+	public sealed record Arrival(string ActivityId, string ActivityType, string ActorURI, string Inbox, string KeyId, string Algorithm,
+		IReadOnlyList<string> SignedHeaders, DateTime ReceivedAt, string Context = default)
+	{
+		static readonly AsyncLocal<Arrival> current = new();
+
+		public static Arrival Current
+		{
+			get => current.Value;
+			set => current.Value = value;
+		}
+	}
+}

PrivaPub/Federation/Inbox/Handlers/AcceptHandler.cs

@@ -1,5 +1,6 @@
 using MongoDB.Entities;
 
+using PrivaPub.Domain.Statuses;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Models.Social;
 using PrivaPub.Models.User;
@@ -15,17 +16,21 @@ namespace PrivaPub.Federation.Inbox.Handlers
 	{
 		readonly DbEntities _dbEntities;
 		readonly ILocalActorService _localActors;
+		readonly IQuoteService _quotes;
 
-		public AcceptHandler(DbEntities dbEntities, ILocalActorService localActors)
+		public AcceptHandler(DbEntities dbEntities, ILocalActorService localActors, IQuoteService quotes)
 		{
 			_dbEntities = dbEntities;
 			_localActors = localActors;
+			_quotes = quotes;
 		}
 
 		public virtual string Type => "Accept";
 
 		public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
 		{
+			if (await _quotes.Answered(activity, actor, accepted: Type == "Accept", token))
+				return;
 			var following = await FindFollowing(activity["object"], actor, _dbEntities, _localActors, token);
 			if (following == default)
 				return;
@@ -56,7 +61,7 @@ namespace PrivaPub.Federation.Inbox.Handlers
 
 	public class RejectHandler : AcceptHandler
 	{
-		public RejectHandler(DbEntities dbEntities, ILocalActorService localActors) : base(dbEntities, localActors)
+		public RejectHandler(DbEntities dbEntities, ILocalActorService localActors, IQuoteService quotes) : base(dbEntities, localActors, quotes)
 		{
 		}
 

PrivaPub/Federation/Inbox/Handlers/AnnounceHandler.cs

@@ -71,7 +71,7 @@ namespace PrivaPub.Federation.Inbox.Handlers
 				: DateTime.UtcNow;
 			var reblog = new PostEntity
 			{
-				ID = PrivacyIds.At(published),
+				ID = PrivacyIds.Arrived(published),
 				ObjectURI = announceId,
 				ActivityURI = announceId,
 				ActorURI = actor.ActorURI,

PrivaPub/Federation/Inbox/Handlers/CreateHandler.cs

@@ -4,6 +4,8 @@ using MongoDB.Entities;
 using PrivaPub.Domain.Timelines;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Moderation;
+using PrivaPub.Domain.Content;
+using PrivaPub.Domain.Statuses;
 using PrivaPub.Federation.Objects;
 using PrivaPub.Federation.Outbox;
 using PrivaPub.Infrastructure.Ids;
@@ -34,10 +36,18 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		readonly IFanout _fanout;
 		readonly IRemotePosts _remotePosts;
 		readonly IGroupDistributor _groups;
+		readonly IObjectRecords _records;
+		readonly IPollService _polls;
+		readonly ILinkPreviews _previews;
+		readonly IQuoteService _quotes;
 
 		public CreateHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDeliveryService delivery,
-			IDomainBlocks domainBlocks, IFanout fanout, IRemotePosts remotePosts, IGroupDistributor groups)
+			IDomainBlocks domainBlocks, IFanout fanout, IRemotePosts remotePosts, IGroupDistributor groups, IObjectRecords records, IPollService polls, ILinkPreviews previews, IQuoteService quotes)
 		{
+			_quotes = quotes;
+			_previews = previews;
+			_records = records;
+			_polls = polls;
 			_groups = groups;
 			_fanout = fanout;
 			_remotePosts = remotePosts;
@@ -53,7 +63,8 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		public async Task Handle(JsonNode activity, ForeignAvatar author, CancellationToken token)
 		{
 			var node = activity["object"];
-			if (node is not JsonObject || !Origin.Same(Id(node), author.ActorURI))
+			var refetched = node is not JsonObject || !Origin.Same(Id(node), author.ActorURI);
+			if (refetched)
 			{
 				using var fetched = await _remoteActors.FetchObject(Id(node), token);
 				node = fetched == default ? default : JsonNode.Parse(fetched.Root.GetRawText());
@@ -61,7 +72,17 @@ namespace PrivaPub.Federation.Inbox.Handlers
 			var note = NoteParser.Parse(node);
 			if (note == default || note.AttributedTo != author.ActorURI)
 				return;
-			if (await _dbEntities.Posts.Match(p => p.ObjectURI == note.Id).ExecuteAnyAsync(token))
+			if (note.Title != default && note.InReplyTo != default && ObjectShapes.Text(note.ContentHtml, 1) == default)
+			{
+				var question = await _dbEntities.Posts.Match(p => p.ObjectURI == note.InReplyTo && p.Poll != null).ExecuteFirstAsync(token);
+				if (question != default)
+				{
+					await _polls.Receive(question, author, note.Title, Id(activity), token);
+					return;
+				}
+			}
+			if (await _dbEntities.Posts.Match(p => p.ObjectURI == note.Id).ExecuteAnyAsync(token)
+				|| await DB.Default.Find<DeletedObject>().Match(d => d.ObjectURI == note.Id).ExecuteAnyAsync(token))
 				return;
 
 			var to = note.To.Concat(Strings(activity["to"])).Distinct(StringComparer.Ordinal).ToList();
@@ -131,6 +152,9 @@ namespace PrivaPub.Federation.Inbox.Handlers
 			{
 				return;
 			}
+			await _records.Record(note, post, ObjectPath.Delivered, refetched, token);
+			await _previews.Wanted(post, token);
+			await _quotes.Resolve(post, note, token);
 
 			if (parent != default)
 				await DB.Default.Update<PostEntity>().MatchID(parent.ID).Modify(b => b.Inc(p => p.RepliesCount, 1)).ExecuteAsync(token);

PrivaPub/Federation/Inbox/Handlers/DeleteHandler.cs

@@ -1,5 +1,6 @@
 using MongoDB.Entities;
 
+using PrivaPub.Domain.Statuses;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Objects;
 using PrivaPub.Federation.Outbox;
@@ -27,10 +28,12 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		readonly IRemoteActorService _remoteActors;
 		readonly IDeliveryService _delivery;
 		readonly IGroupDistributor _groups;
+		readonly IQuoteService _quotes;
 
 		public DeleteHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDeliveryService delivery,
-			IGroupDistributor groups)
+			IGroupDistributor groups, IQuoteService quotes)
 		{
+			_quotes = quotes;
 			_groups = groups;
 			_dbEntities = dbEntities;
 			_localActors = localActors;
@@ -65,10 +68,19 @@ namespace PrivaPub.Federation.Inbox.Handlers
 				return;
 			}
 
+			await DB.Default.Update<DeletedObject>()
+				.Match(d => d.ObjectURI == objectUri)
+				.Modify(d => d.DeletedAt, DateTime.UtcNow)
+				.Option(o => o.IsUpsert = true)
+				.ExecuteAsync(token);
 			var post = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && p.ActorURI == actor.ActorURI).ExecuteFirstAsync(token);
 			if (post == default)
+			{
+				await _quotes.Revoke(objectUri, token);
 				return;
+			}
 			await DB.Default.DeleteAsync<PostEntity>(post.ID);
+			await DB.Default.DeleteAsync<ObjectRecord>(r => r.PostId == post.ID || r.ObjectURI == objectUri);
 			await DB.Default.DeleteAsync<TimelineEntry>(e => e.PostId == post.ID || e.ReblogOfPostId == post.ID);
 			if (!string.IsNullOrEmpty(post.GroupId) && await _localActors.FindById(LocalActorKind.Group, post.GroupId, token) is { IsCircle: false } community)
 				await _groups.Announce(community, activity.AsObject(), post.ObjectURI, isNewPost: false, token);

PrivaPub/Federation/Inbox/Handlers/DislikeHandler.cs

@@ -0,0 +1,47 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Federation.Inbox.Handlers
+{
+	public class DislikeHandler : IActivityHandler
+	{
+		readonly DbEntities _dbEntities;
+
+		public DislikeHandler(DbEntities dbEntities)
+		{
+			_dbEntities = dbEntities;
+		}
+
+		public string Type => "Dislike";
+
+		public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
+		{
+			var objectUri = Id(activity["object"]);
+			var post = objectUri == default
+				? default
+				: await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && !p.DeletedAt.HasValue && p.ReblogOfPostId == null).ExecuteFirstAsync(token);
+			if (post == default || !LikeHandler.MaySee(post, actor))
+				return;
+
+			try
+			{
+				await DB.Default.SaveAsync(new Downvote { AccountId = actor.ID, ActorURI = actor.ActorURI, PostId = post.ID, ActivityURI = Id(activity) }, token);
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+				return;
+			}
+			await DB.Default.Update<PostEntity>().MatchID(post.ID).Modify(b => b.Inc(p => p.DownvotesCount, 1)).ExecuteAsync(token);
+		}
+	}
+}

PrivaPub/Federation/Inbox/Handlers/EmojiReactHandler.cs

@@ -0,0 +1,34 @@
+using PrivaPub.Domain.Social;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+namespace PrivaPub.Federation.Inbox.Handlers
+{
+	public class EmojiReactHandler : IActivityHandler
+	{
+		readonly DbEntities _dbEntities;
+		readonly IReactions _reactions;
+
+		public EmojiReactHandler(DbEntities dbEntities, IReactions reactions)
+		{
+			_dbEntities = dbEntities;
+			_reactions = reactions;
+		}
+
+		public string Type => "EmojiReact";
+
+		public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
+		{
+			var objectUri = Id(activity["object"]);
+			var post = objectUri == default
+				? default
+				: await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && !p.DeletedAt.HasValue && p.ReblogOfPostId == null).ExecuteFirstAsync(token);
+			if (post != default)
+				await _reactions.Receive(post, actor, Value(activity, "content"), activity["tag"], Id(activity), token);
+		}
+	}
+}

PrivaPub/Federation/Inbox/Handlers/JoinHandler.cs

@@ -0,0 +1,48 @@
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Outbox;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.User;
+using PrivaPub.StaticServices;
+
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+namespace PrivaPub.Federation.Inbox.Handlers
+{
+	public class JoinHandler : IActivityHandler
+	{
+		readonly DbEntities _dbEntities;
+		readonly ILocalActorService _localActors;
+		readonly IDeliveryService _delivery;
+
+		public JoinHandler(DbEntities dbEntities, ILocalActorService localActors, IDeliveryService delivery)
+		{
+			_dbEntities = dbEntities;
+			_localActors = localActors;
+			_delivery = delivery;
+		}
+
+		public string Type => "Join";
+
+		public async Task Handle(JsonNode activity, ForeignAvatar actor, CancellationToken token)
+		{
+			var objectUri = Id(activity["object"]);
+			if (objectUri == default || !objectUri.StartsWith(_localActors.BaseAddress + "/", StringComparison.OrdinalIgnoreCase))
+				return;
+			var post = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && !p.IsFederatedCopy && !p.DeletedAt.HasValue).ExecuteFirstAsync(token);
+			var owner = post == default ? default : await _localActors.FindById(LocalActorKind.Person, post.GroupUserId, token);
+			if (owner == default || string.IsNullOrEmpty(actor.InboxURL))
+				return;
+			await _delivery.Enqueue(owner, new[] { actor.InboxURL }, new JsonObject
+			{
+				["@context"] = ActivityPubRenderer.ActivityStreams,
+				["id"] = owner.ActivityUri($"ignore-{Guid.NewGuid():N}"),
+				["type"] = "Ignore",
+				["actor"] = owner.Uri,
+				["object"] = activity.DeepClone()
+			}, token);
+		}
+	}
+}

PrivaPub/Federation/Inbox/Handlers/LikeHandler.cs

@@ -18,10 +18,12 @@ namespace PrivaPub.Federation.Inbox.Handlers
 	public class LikeHandler : IActivityHandler
 	{
 		readonly DbEntities _dbEntities;
+		readonly IReactions _reactions;
 
-		public LikeHandler(DbEntities dbEntities)
+		public LikeHandler(DbEntities dbEntities, IReactions reactions)
 		{
 			_dbEntities = dbEntities;
+			_reactions = reactions;
 		}
 
 		public string Type => "Like";
@@ -34,6 +36,12 @@ namespace PrivaPub.Federation.Inbox.Handlers
 				: await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri && !p.DeletedAt.HasValue && p.ReblogOfPostId == null).ExecuteFirstAsync(token);
 			if (post == default || !MaySee(post, actor))
 				return;
+			var content = Value(activity, "_misskey_reaction") ?? Value(activity, "content");
+			if (!Reactions.IsHeart(content))
+			{
+				await _reactions.Receive(post, actor, content, activity["tag"], Id(activity), token);
+				return;
+			}
 
 			try
 			{

PrivaPub/Federation/Inbox/Handlers/UndoHandler.cs

@@ -1,5 +1,6 @@
 using MongoDB.Entities;
 
+using PrivaPub.Domain.Social;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Models.Federation;
 using PrivaPub.Models.Social;
@@ -17,11 +18,13 @@ namespace PrivaPub.Federation.Inbox.Handlers
 {
 	public class UndoHandler : IActivityHandler
 	{
+		readonly IReactions _reactions;
 		readonly DbEntities _dbEntities;
 		readonly ILocalActorService _localActors;
 
-		public UndoHandler(DbEntities dbEntities, ILocalActorService localActors)
+		public UndoHandler(DbEntities dbEntities, ILocalActorService localActors, IReactions reactions)
 		{
+			_reactions = reactions;
 			_dbEntities = dbEntities;
 			_localActors = localActors;
 		}
@@ -40,6 +43,29 @@ namespace PrivaPub.Federation.Inbox.Handlers
 				await UndoLike(inner, innerId, actor, token);
 			if (innerType is null or "Announce")
 				await UndoAnnounce(innerId, actor, token);
+			if (innerType is null or "Dislike")
+				await UndoDislike(inner, innerId, actor, token);
+			if (innerType is null or "Like" or "EmojiReact")
+				await _reactions.Withdraw(actor, innerId, inner is JsonObject ? Id(inner["object"]) : default,
+					inner is JsonObject ? Value(inner, "_misskey_reaction") ?? Value(inner, "content") : default, token);
+		}
+
+		async Task UndoDislike(JsonNode inner, string innerId, ForeignAvatar actor, CancellationToken token)
+		{
+			var downvote = innerId == default
+				? default
+				: await DB.Default.Find<Downvote>().Match(d => d.ActivityURI == innerId && d.ActorURI == actor.ActorURI).ExecuteFirstAsync(token);
+			if (downvote == default && inner is JsonObject && Id(inner["object"]) is { } objectUri)
+			{
+				var post = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri).ExecuteFirstAsync(token);
+				downvote = post == default
+					? default
+					: await DB.Default.Find<Downvote>().Match(d => d.PostId == post.ID && d.ActorURI == actor.ActorURI).ExecuteFirstAsync(token);
+			}
+			if (downvote == default)
+				return;
+			await DB.Default.DeleteAsync<Downvote>(downvote.ID);
+			await DB.Default.Update<PostEntity>().MatchID(downvote.PostId).Modify(b => b.Inc(p => p.DownvotesCount, -1)).ExecuteAsync(token);
 		}
 
 		async Task UndoFollow(JsonNode inner, string innerId, ForeignAvatar actor, CancellationToken token)

PrivaPub/Federation/Inbox/Handlers/UpdateHandler.cs

@@ -1,6 +1,7 @@
 using MongoDB.Entities;
 
 using PrivaPub.Federation.Actors;
+using PrivaPub.Domain.Statuses;
 using PrivaPub.Federation.Objects;
 using PrivaPub.Federation.Outbox;
 using PrivaPub.Models.Post;
@@ -23,9 +24,14 @@ namespace PrivaPub.Federation.Inbox.Handlers
 		readonly ILocalActorService _localActors;
 		readonly IRemoteActorService _remoteActors;
 		readonly IGroupDistributor _groups;
+		readonly IObjectRecords _records;
+		readonly IQuoteService _quotes;
 
-		public UpdateHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IGroupDistributor groups)
+		public UpdateHandler(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IGroupDistributor groups,
+			IObjectRecords records, IQuoteService quotes)
 		{
+			_quotes = quotes;
+			_records = records;
 			_groups = groups;
 			_dbEntities = dbEntities;
 			_localActors = localActors;
@@ -52,6 +58,19 @@ namespace PrivaPub.Federation.Inbox.Handlers
 			if (post == default || post.DeletedAt.HasValue)
 				return;
 
+			post.Poll = note.Poll ?? post.Poll;
+			post.QuotePolicy = note.QuotePolicy;
+			post.Video = note.Video ?? post.Video;
+			post.Audio = note.Audio ?? post.Audio;
+			post.Event = note.Event ?? post.Event;
+			if (!IsEdit(note, post))
+			{
+				await DB.Default.SaveAsync(post, token);
+				await _records.Revise(note, Id(activity), token);
+				await Requote(post, note, token);
+				return;
+			}
+
 			post.Revisions.Add(new PostRevision
 			{
 				Title = post.Title,
@@ -72,6 +91,11 @@ namespace PrivaPub.Federation.Inbox.Handlers
 
 			post.Title = note.Title;
 			post.SpoilerText = note.SpoilerText;
+			post.Excerpt = note.Excerpt;
+			post.Source = note.Source;
+			post.Emojis = note.Emojis.ToList();
+			post.CoverURL = note.CoverURL;
+			post.Link = note.Link;
 			post.HasContentWarning = note.Sensitive;
 			post.Text = note.ContentHtml;
 			post.ContentHtml = note.ContentHtml;
@@ -82,8 +106,19 @@ namespace PrivaPub.Federation.Inbox.Handlers
 			post.EditedAt = note.Updated ?? DateTime.UtcNow;
 			post.UpdateDate = DateTime.UtcNow;
 			await DB.Default.SaveAsync(post, token);
+			await _records.Revise(note, Id(activity), token);
+			await Requote(post, note, token);
 			if (!string.IsNullOrEmpty(post.GroupId) && await _localActors.FindById(Models.Federation.LocalActorKind.Group, post.GroupId, token) is { IsCircle: false } community)
 				await _groups.Announce(community, activity.AsObject(), post.ObjectURI, isNewPost: false, token);
 		}
+
+		static bool IsEdit(NoteDocument note, PostEntity post) =>
+			note.Updated is { } updated && updated > (post.EditedAt ?? post.CreationDate);
+
+		async Task Requote(PostEntity post, NoteDocument note, CancellationToken token)
+		{
+			if (note.QuoteUri != post.QuoteURI || note.QuoteAuthorization != post.QuoteAuthorizationURI || post.QuoteState != QuoteState.Accepted)
+				await _quotes.Resolve(post, note, token);
+		}
 	}
 }

PrivaPub/Federation/Inbox/InboxProcessor.cs

@@ -46,7 +46,16 @@ namespace PrivaPub.Federation.Inbox
 			if (actor == default)
 				return JobOutcome.Retry("the actor could not be loaded");
 
+			Arrival.Current = new Arrival(Id(activity), type, actor.ActorURI, payload.Inbox, payload.KeyId, payload.Algorithm,
+				payload.SignedHeaders ?? Array.Empty<string>(), payload.ReceivedAt ?? job.CreatedAt, activity["@context"]?.ToJsonString());
+			try
+			{
 				await handler.Handle(activity, actor, token);
+			}
+			finally
+			{
+				Arrival.Current = default;
+			}
 			_logger.LogInformation("Processed {Type} {Id} from {Actor}", type, Id(activity), actor.ActorURI);
 			return JobOutcome.Done;
 		}

PrivaPub/Federation/Inbox/InboxReceiver.cs

@@ -13,9 +13,10 @@ using static PrivaPub.Federation.Objects.ActivityJson;
 
 namespace PrivaPub.Federation.Inbox
 {
-	public sealed record InboxResult(int StatusCode, string Error = default);
+	public sealed record InboxResult(int StatusCode, string Error = default, int? RetryAfterSeconds = default);
 
-	public sealed record InboxPayload(string ActorURI, string Activity);
+	public sealed record InboxPayload(string ActorURI, string Activity, string Inbox = default, string KeyId = default, string Algorithm = default,
+		string[] SignedHeaders = default, DateTime? ReceivedAt = default);
 
 	public interface IInboxReceiver
 	{
@@ -24,6 +25,8 @@ namespace PrivaPub.Federation.Inbox
 
 	public class InboxReceiver : IInboxReceiver
 	{
+		const int KeyRetrySeconds = 300;
+
 		const int MaxBodyBytes = 1024 * 1024;
 
 		readonly ILocalActorService _localActors;
@@ -87,6 +90,8 @@ namespace PrivaPub.Federation.Inbox
 			if (keyOwner == default || !HttpSignatures.Verify(keyOwner.PublicKey, signingString, parameters.Signature))
 			{
 				keyOwner = await _remoteActors.GetActorByKeyId(parameters.KeyId, refresh: true, token);
+				if (keyOwner == default && _remoteActors.KeyTemporarilyUnavailable(parameters.KeyId))
+					return new(StatusCodes.Status503ServiceUnavailable, "the signing key could not be fetched; try again later", KeyRetrySeconds);
 				if (keyOwner == default || !HttpSignatures.Verify(keyOwner.PublicKey, signingString, parameters.Signature))
 					return new(StatusCodes.Status401Unauthorized, "the signature does not verify");
 			}
@@ -99,7 +104,9 @@ namespace PrivaPub.Federation.Inbox
 				return shapeProblem;
 
 			var activityId = Id(activity);
-			await _queue.Enqueue(JobKind.ProcessInbox, JsonSerializer.Serialize(new InboxPayload(actorUri, activity.ToJsonString())),
+			var payload = new InboxPayload(actorUri, activity.ToJsonString(), recipient == default ? "shared" : "personal", parameters.KeyId,
+				parameters.Algorithm, parameters.Headers, DateTime.UtcNow);
+			await _queue.Enqueue(JobKind.ProcessInbox, JsonSerializer.Serialize(payload),
 				new Uri(actorUri).Host.ToLowerInvariant(), activityId == default ? default : "inbox|" + activityId, token);
 			_logger.LogInformation("Inbox {Recipient}: {Type} from {Actor} queued", recipient?.Handle ?? "shared", type, actorUri);
 			return new(StatusCodes.Status202Accepted);

PrivaPub/Federation/Inbox/RemotePosts.cs

@@ -1,11 +1,13 @@
 using MongoDB.Driver;
 using MongoDB.Entities;
 
+using PrivaPub.Domain.Content;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Moderation;
 using PrivaPub.Federation.Objects;
 using PrivaPub.Infrastructure.Ids;
 using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Federation;
 using PrivaPub.Models.Jobs;
 using PrivaPub.Models.Post;
 using PrivaPub.Models.User;
@@ -37,10 +39,14 @@ namespace PrivaPub.Federation.Inbox
 		readonly IRemoteActorService _remoteActors;
 		readonly IDomainBlocks _domainBlocks;
 		readonly IJobQueue _queue;
+		readonly IObjectRecords _records;
+		readonly ILinkPreviews _previews;
 
 		public RemotePosts(DbEntities dbEntities, ILocalActorService localActors, IRemoteActorService remoteActors, IDomainBlocks domainBlocks,
-			IJobQueue queue)
+			IJobQueue queue, IObjectRecords records, ILinkPreviews previews)
 		{
+			_previews = previews;
+			_records = records;
 			_dbEntities = dbEntities;
 			_localActors = localActors;
 			_remoteActors = remoteActors;
@@ -60,7 +66,7 @@ namespace PrivaPub.Federation.Inbox
 
 			return new PostEntity
 			{
-				ID = PrivacyIds.At(note.Published),
+				ID = PrivacyIds.Arrived(note.Published),
 				ObjectURI = note.Id,
 				ActorURI = author.ActorURI,
 				AuthorAccountId = author.ID,
@@ -70,8 +76,19 @@ namespace PrivaPub.Federation.Inbox
 				Url = note.Url,
 				ContextURI = note.Context,
 				QuoteURI = note.QuoteUri,
+				ObjectType = note.Type,
 				Title = note.Title,
 				SpoilerText = note.SpoilerText,
+				Excerpt = note.Excerpt,
+				Source = note.Source,
+				Poll = note.Poll,
+				QuotePolicy = note.QuotePolicy,
+				Emojis = note.Emojis.ToList(),
+				CoverURL = note.CoverURL,
+				Link = note.Link,
+				Video = note.Video,
+				Audio = note.Audio,
+				Event = note.Event,
 				HasContentWarning = note.Sensitive,
 				Text = note.ContentHtml,
 				ContentHtml = note.ContentHtml,
@@ -103,7 +120,7 @@ namespace PrivaPub.Federation.Inbox
 		public async Task<PostEntity> StoreContext(string objectUri, int depth, CancellationToken token)
 		{
 			var existing = await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri).ExecuteFirstAsync(token);
-			if (existing != default || depth > MaxDepth)
+			if (existing != default || depth > MaxDepth || await DB.Default.Find<DeletedObject>().Match(d => d.ObjectURI == objectUri).ExecuteAnyAsync(token))
 				return existing;
 
 			using var fetched = await _remoteActors.FetchObject(objectUri, token);
@@ -129,6 +146,8 @@ namespace PrivaPub.Federation.Inbox
 			{
 				return await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri).ExecuteFirstAsync(token);
 			}
+			await _records.Record(note, post, ObjectPath.Fetched, refetched: false, token);
+			await _previews.Wanted(post, token);
 
 			if (grandparent == default && !string.IsNullOrEmpty(note.InReplyTo) && depth < MaxDepth)
 				await _queue.Enqueue(JobKind.FetchAncestors, JsonSerializer.Serialize(new AncestorsPayload(post.ID, depth + 1)), new Uri(note.InReplyTo).Host,

PrivaPub/Federation/Objects/ContentSanitizer.cs

@@ -38,7 +38,7 @@ namespace PrivaPub.Federation.Objects
 			{
 				KeepChildNodes = true
 			};
-			foreach (var allowed in new[] { "mention", "hashtag", "ellipsis", "invisible" })
+			foreach (var allowed in new[] { "mention", "hashtag", "ellipsis", "invisible", "quote-inline" })
 				sanitizer.AllowedClasses.Add(allowed);
 			sanitizer.RemovingCssClass += (_, e) => e.Cancel = MicroformatClass().IsMatch(e.CssClass);
 			sanitizer.RemovingTag += (_, e) =>

PrivaPub/Federation/Objects/InstanceDescriber.cs

@@ -0,0 +1,84 @@
+using MongoDB.Entities;
+
+using PrivaPub.Infrastructure.Http;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Jobs;
+
+using System.Text.Json;
+
+namespace PrivaPub.Federation.Objects
+{
+	public class InstanceDescriber : IJobHandler
+	{
+		const int MaxNodeInfoChars = 64 * 1024;
+		static readonly string[] Schemas =
+		{
+			"http://nodeinfo.diaspora.software/ns/schema/2.1",
+			"http://nodeinfo.diaspora.software/ns/schema/2.0"
+		};
+
+		readonly IFederationHttp _http;
+
+		public InstanceDescriber(IFederationHttp http) => _http = http;
+
+		public JobKind Kind => JobKind.DescribeInstance;
+		public int Concurrency => 1;
+		public int MaxAttempts => 2;
+		public int PerHostLimit => 1;
+
+		public async Task<JobOutcome> Handle(Job job, CancellationToken token)
+		{
+			var host = job.Payload;
+			using var links = await _http.GetJson($"https://{host}/.well-known/nodeinfo", "application/json", sign: default, token);
+			var href = links == default ? default : Schemas.Select(schema => LinkFor(links.Root, schema)).FirstOrDefault(link => link != default);
+			if (href == default)
+				return await Described(host, default, "no NodeInfo", token);
+
+			using var nodeInfo = await _http.GetJson(href, "application/json", sign: default, token);
+			return nodeInfo == default ? await Described(host, default, "NodeInfo unreadable", token) : await Described(host, nodeInfo.Root, default, token);
+		}
+
+		static async Task<JobOutcome> Described(string host, JsonElement? nodeInfo, string error, CancellationToken token)
+		{
+			var update = DB.Default.Update<RemoteInstance>()
+				.Match(i => i.Host == host)
+				.Modify(i => i.DescribedAt, DateTime.UtcNow)
+				.Modify(i => i.DescriptionError, error)
+				.Option(o => o.IsUpsert = true);
+			if (nodeInfo is { } root)
+			{
+				var raw = root.GetRawText();
+				update = update
+					.Modify(i => i.Software, Text(root, "software", "name"))
+					.Modify(i => i.SoftwareVersion, Text(root, "software", "version"))
+					.Modify(i => i.NodeName, Text(root, "metadata", "nodeName"))
+					.Modify(i => i.Protocols, root.TryGetProperty("protocols", out var protocols) && protocols.ValueKind == JsonValueKind.Array
+						? protocols.EnumerateArray().Where(p => p.ValueKind == JsonValueKind.String).Select(p => p.GetString()).Take(16).ToList()
+						: new List<string>())
+					.Modify(i => i.OpenRegistrations, root.TryGetProperty("openRegistrations", out var open) && open.ValueKind is JsonValueKind.True or JsonValueKind.False
+						? open.GetBoolean()
+						: default(bool?))
+					.Modify(i => i.NodeInfo, raw.Length <= MaxNodeInfoChars ? raw : default);
+			}
+			await update.ExecuteAsync(token);
+			return JobOutcome.Done;
+		}
+
+		static string LinkFor(JsonElement root, string schema) =>
+			root.TryGetProperty("links", out var links) && links.ValueKind == JsonValueKind.Array
+				? links.EnumerateArray()
+					.Where(l => l.ValueKind == JsonValueKind.Object && l.TryGetProperty("rel", out var rel) && rel.ValueKind == JsonValueKind.String && rel.GetString() == schema)
+					.Select(l => l.TryGetProperty("href", out var href) && href.ValueKind == JsonValueKind.String ? href.GetString() : default)
+					.FirstOrDefault(h => h != default && h.StartsWith("https://", StringComparison.OrdinalIgnoreCase))
+				: default;
+
+		static string Text(JsonElement root, string parent, string name)
+		{
+			if (!root.TryGetProperty(parent, out var section) || section.ValueKind != JsonValueKind.Object
+				|| !section.TryGetProperty(name, out var value) || value.ValueKind != JsonValueKind.String)
+				return default;
+			var text = value.GetString();
+			return text.Length <= 200 ? text : text[..200];
+		}
+	}
+}

PrivaPub/Federation/Objects/NoteParser.cs

@@ -1,6 +1,7 @@
 using PrivaPub.Models.Post;
 
 using System.Globalization;
+using System.Text;
 using System.Text.Json.Nodes;
 
 using static PrivaPub.Federation.Objects.ActivityJson;
@@ -11,10 +12,12 @@ namespace PrivaPub.Federation.Objects
 	{
 		public string Id { get; init; }
 		public string Type { get; init; }
+		public JsonObject Raw { get; init; }
 		public string AttributedTo { get; init; }
 		public string ContentHtml { get; init; }
 		public string Title { get; init; }
 		public string SpoilerText { get; init; }
+		public string Excerpt { get; init; }
 		public bool Sensitive { get; init; }
 		public string Language { get; init; }
 		public string Url { get; init; }
@@ -22,6 +25,9 @@ namespace PrivaPub.Federation.Objects
 		public string Context { get; init; }
 		public string Audience { get; init; }
 		public string QuoteUri { get; init; }
+		public string QuoteAuthorization { get; init; }
+		public bool QuotesByConsent { get; init; }//FEP-044f `quote`, as opposed to the legacy keys that ask nobody
+		public bool QuoteDeleted { get; init; }
 		public DateTime Published { get; init; }
 		public DateTime? Updated { get; init; }
 		public IReadOnlyList<string> To { get; init; } = Array.Empty<string>();
@@ -29,11 +35,20 @@ namespace PrivaPub.Federation.Objects
 		public IReadOnlyList<PostMention> Mentions { get; init; } = Array.Empty<PostMention>();
 		public IReadOnlyList<string> Tags { get; init; } = Array.Empty<string>();
 		public IReadOnlyList<PostMedia> Attachments { get; init; } = Array.Empty<PostMedia>();
+		public PostSource Source { get; init; }
+		public PostPoll Poll { get; init; }
+		public InteractionRule QuotePolicy { get; init; }
+		public IReadOnlyList<CustomEmoji> Emojis { get; init; } = Array.Empty<CustomEmoji>();
+		public string CoverURL { get; init; }
+		public PostLink Link { get; init; }
+		public VideoDetails Video { get; init; }
+		public AudioDetails Audio { get; init; }
+		public EventDetails Event { get; init; }
 	}
 
 	public static class NoteParser
 	{
-		static readonly string[] NoteTypes = { "Note", "Article", "Page", "Question", "Event", "Video", "Audio", "Image" };
+		static readonly string[] NoteTypes = { "Note", "Article", "Page", "Question", "Event", "Video", "Audio", "Image", "ChatMessage" };
 		const int MaxAttachments = 16;
 		const int MaxTags = 64;
 
@@ -48,22 +63,30 @@ namespace PrivaPub.Federation.Objects
 
 			var (contentHtml, language) = Content(note);
 			var summary = Value(note, "summary");
+			var excerpt = ObjectShapes.Text(summary, 1000)
+				?? (note["preview"] is JsonObject preview && Value(preview, "type") == "Note" ? ObjectShapes.Text(Value(preview, "content"), 1000) : default);
+			var sensitive = note["sensitive"] is JsonValue flag && flag.TryGetValue<bool>(out var marked) && marked;
+			var summaryWarns = type is "Note" or "Question" || sensitive;
 			return new NoteDocument
 			{
 				Id = id,
 				Type = type,
+				Raw = note,
 				AttributedTo = Attribution(note["attributedTo"]),
 				ContentHtml = ContentSanitizer.Html(contentHtml),
-				Title = Plain(Value(note, "name"), 500),
+				Title = ObjectShapes.Text(Value(note, "name"), 500),
-				SpoilerText = Plain(summary, 500),
+				SpoilerText = summaryWarns ? Plain(summary, 500) : default,
-				Sensitive = note["sensitive"] is JsonValue sensitive && sensitive.TryGetValue<bool>(out var s) && s
+				Excerpt = summaryWarns ? default : excerpt,
-					|| !string.IsNullOrWhiteSpace(summary),
+				Sensitive = sensitive || summaryWarns && !string.IsNullOrWhiteSpace(summary),
 				Language = language,
 				Url = UrlOf(note["url"]) ?? id,
 				InReplyTo = Id(note["inReplyTo"]),
 				Context = Id(note["context"]) ?? Value(note, "conversation"),
 				Audience = Id(note["audience"]),
-				QuoteUri = Value(note, "quote") ?? Value(note, "quoteUrl") ?? Value(note, "quoteUri") ?? Value(note, "_misskey_quote"),
+				QuoteUri = Id(note["quote"]) ?? Value(note, "quoteUrl") ?? Value(note, "quoteUri") ?? Value(note, "_misskey_quote") ?? QuoteLink(note),
+				QuoteAuthorization = Id(note["quoteAuthorization"]),
+				QuotesByConsent = note.ContainsKey("quote"),
+				QuoteDeleted = note["quote"] is JsonObject quoted && Value(quoted, "type") == "Tombstone",
 				Published = Time(Value(note, "published")) ?? DateTime.UtcNow,
 				Updated = Time(Value(note, "updated")),
 				To = List(note["to"]),
@@ -73,12 +96,21 @@ namespace PrivaPub.Federation.Objects
 					.DistinctBy(m => m.ActorURI)
 					.Take(MaxTags)
 					.ToList(),
-				Tags = Tags(note, "Hashtag").Select(t => Value(t, "name")?.TrimStart('#').ToLowerInvariant())
+				Tags = Tags(note, "Hashtag").Select(t => Value(t, "name")?.TrimStart('#').Normalize(NormalizationForm.FormKC).ToLowerInvariant())
 					.Where(t => !string.IsNullOrEmpty(t))
 					.Distinct()
 					.Take(MaxTags)
 					.ToList(),
-				Attachments = Attachments(note)
+				Attachments = Attachments(note),
+				Source = ObjectShapes.Source(note),
+				Poll = ObjectShapes.Poll(note),
+				QuotePolicy = ObjectShapes.QuotePolicy(note),
+				Emojis = ObjectShapes.Emojis(note["tag"]),
+				CoverURL = ObjectShapes.Cover(note),
+				Link = ObjectShapes.Link(note),
+				Video = ObjectShapes.Video(note),
+				Audio = ObjectShapes.Audio(note),
+				Event = ObjectShapes.Event(note)
 			};
 		}
 
@@ -95,7 +127,9 @@ namespace PrivaPub.Federation.Objects
 			}
 			if (string.IsNullOrEmpty(content) && Value(note, "_misskey_content") is { } misskey)
 				content = System.Net.WebUtility.HtmlEncode(misskey).Replace("\n", "<br>");
-			return (content, language);
+			if (!string.IsNullOrEmpty(content) && Value(note, "mediaType")?.StartsWith("text/markdown", StringComparison.OrdinalIgnoreCase) == true)
+				content = Rendering.ActivityPubRenderer.Html(content);
+			return (content, language ?? ObjectShapes.Language(note));
 		}
 
 		static string Attribution(JsonNode node) => node switch
@@ -115,33 +149,43 @@ namespace PrivaPub.Federation.Objects
 				_ => Enumerable.Empty<JsonObject>()
 			}).Where(t => Value(t, "type") == type);
 
-		static List<PostMedia> Attachments(JsonObject note)
+		static List<PostMedia> Attachments(JsonObject note) =>
-		{
+			ObjectShapes.Objects(note["attachment"])
-			var items = note["attachment"] switch
-			{
-				JsonArray array => array.OfType<JsonObject>(),
-				JsonObject single => new[] { single },
-				_ => Enumerable.Empty<JsonObject>()
-			};
-			return items
 				.Where(a => Value(a, "type") is "Document" or "Image" or "Video" or "Audio")
-				.Select(a => new PostMedia
+				.Select(Attachment)
-				{
-					RemoteURL = UrlOf(a["url"]),
-					ContentType = Value(a, "mediaType"),
-					Description = Plain(Value(a, "name") ?? Value(a, "summary"), 1500),
-					Blurhash = Value(a, "blurhash"),
-					Width = Int(a["width"]),
-					Height = Int(a["height"]),
-					Focus = a["focalPoint"] is JsonArray focus && focus.Count == 2
-						? focus.Select(f => f is JsonValue v && v.TryGetValue<double>(out var d) ? (float)Math.Clamp(d, -1, 1) : 0f).ToArray()
-						: default
-				})
 				.Where(m => Origin.Of(m.RemoteURL) != default)
 				.Take(MaxAttachments)
 				.ToList();
+
+		static PostMedia Attachment(JsonObject attachment)
+		{
+			var (url, linkMediaType) = ObjectShapes.MediaLink(attachment["url"] ?? attachment["href"]);
+			return new PostMedia
+			{
+				RemoteURL = url,
+				ContentType = ObjectShapes.InferMediaType(Value(attachment, "mediaType") ?? linkMediaType, url, Value(attachment, "type")),
+				RemotePreviewURL = ObjectShapes.Image(attachment["icon"]),
+				DurationSeconds = ObjectShapes.Seconds(attachment["duration"]),
+				Sensitive = attachment["sensitive"] is JsonValue flag && flag.TryGetValue<bool>(out var marked) ? marked : default(bool?),
+				Description = Plain(Value(attachment, "name") ?? Value(attachment, "summary") ?? FirstOf(attachment["nameMap"]) ?? FirstOf(attachment["summaryMap"]), 1500),
+				Blurhash = Value(attachment, "blurhash"),
+				Width = Int(attachment["width"]),
+				Height = Int(attachment["height"]),
+				Focus = attachment["focalPoint"] is JsonArray focus && focus.Count == 2
+					? focus.Select(f => f is JsonValue v && v.TryGetValue<double>(out var d) ? (float)Math.Clamp(d, -1, 1) : 0f).ToArray()
+					: default
+			};
 		}
 
+		static string QuoteLink(JsonObject note) =>
+			Tags(note, "Link")
+				.Where(t => Value(t, "mediaType") is { } type && (type.StartsWith("application/activity+json") || type.StartsWith("application/ld+json")))
+				.Select(t => Value(t, "href"))
+				.FirstOrDefault(href => Origin.Of(href) != default);
+
+		static string FirstOf(JsonNode map) =>
+			map is JsonObject languages ? languages.Select(l => l.Value is JsonValue v && v.TryGetValue<string>(out var text) ? text : default).FirstOrDefault(t => t != default) : default;
+
 		static string UrlOf(JsonNode node) => node switch
 		{
 			JsonValue value when value.TryGetValue<string>(out var text) => text,
@@ -163,7 +207,7 @@ namespace PrivaPub.Federation.Objects
 		static DateTime? Time(string value) =>
 			DateTimeOffset.TryParse(value, CultureInfo.InvariantCulture, DateTimeStyles.AssumeUniversal, out var parsed)
 				? parsed.UtcDateTime
-				: default;
+				: (DateTime?)null;
 
 		static int? Int(JsonNode node) =>
 			node is JsonValue value && value.TryGetValue<int>(out var number) && number is > 0 and < 100_000 ? number : (int?)null;

PrivaPub/Federation/Objects/ObjectFeatures.cs

@@ -0,0 +1,68 @@
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+namespace PrivaPub.Federation.Objects
+{
+	public static class ObjectFeatures
+	{
+		public static List<string> Detect(JsonObject raw)
+		{
+			var found = new List<string>();
+			if (raw == default)
+				return found;
+			void When(bool condition, string feature)
+			{
+				if (condition)
+					found.Add(feature);
+			}
+
+			When(raw.ContainsKey("quote"), "fep-044f-quote");
+			When(raw.ContainsKey("quoteAuthorization"), "fep-044f-authorization");
+			When(raw.ContainsKey("_misskey_quote") || raw.ContainsKey("quoteUrl") || raw.ContainsKey("quoteUri"), "legacy-quote");
+			When(raw.ContainsKey("interactionPolicy"), "interaction-policy");
+			When(raw.ContainsKey("context"), "context");
+			When(raw.ContainsKey("proof"), "fep-8b32-proof");
+			When(raw.Any(p => p.Key.StartsWith("_misskey_", StringComparison.Ordinal)), "misskey");
+			When(raw["source"] is JsonObject, "source:" + (Value(raw["source"], "mediaType") ?? "unknown"));
+			When(raw["source"] is JsonValue, "source:url");
+			When(raw.ContainsKey("htmlMfm"), "fep-c16b-mfm");
+			When(raw.ContainsKey("formerRepresentations"), "former-representations");
+			When(raw.ContainsKey("searchableBy"), "fep-268d-searchable-by");
+			When(raw.ContainsKey("audience"), "fep-1b12-audience");
+			When(Items(raw["attachment"]).Any(a => Value(a, "type") == "Link"), "fep-8967-link");
+			When(Items(raw["tag"]).Any(t => Value(t, "type") == "Emoji"), "custom-emoji");
+			When(Value(raw, "type") == "Question", "poll");
+			When(raw["contentMap"] is JsonObject, "content-map");
+			When(raw["url"] is JsonArray, "url-variants");
+			var contentType = Value(raw, "mediaType");
+			When(contentType is not (null or "text/html"), "content:" + contentType);
+			return found;
+		}
+
+		public static List<string> Namespaces(JsonObject raw, string activityContext = default) =>
+			Namespaces(raw?["@context"] ?? (activityContext == default ? default : JsonNode.Parse(activityContext)));
+
+		static List<string> Namespaces(JsonNode context) => context switch
+		{
+			JsonValue single when single.TryGetValue<string>(out var url) => new List<string> { url },
+			JsonArray array => array.SelectMany(entry => entry switch
+				{
+					JsonValue value when value.TryGetValue<string>(out var url) => new[] { url },
+					JsonObject terms => terms.Where(t => t.Value is JsonValue v && v.TryGetValue<string>(out var target) && target.EndsWith('#'))
+						.Select(t => t.Key + "=" + t.Value!.GetValue<string>()),
+					_ => Enumerable.Empty<string>()
+				})
+				.Take(32)
+				.ToList(),
+			_ => new List<string>()
+		};
+
+		static IEnumerable<JsonObject> Items(JsonNode node) => node switch
+		{
+			JsonArray array => array.OfType<JsonObject>(),
+			JsonObject single => new[] { single },
+			_ => Enumerable.Empty<JsonObject>()
+		};
+	}
+}

PrivaPub/Federation/Objects/ObjectRecords.cs

@@ -0,0 +1,112 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Federation.Inbox;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+
+using System.Globalization;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json.Nodes;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Federation.Objects
+{
+	public interface IObjectRecords
+	{
+		Task Record(NoteDocument note, PostEntity post, ObjectPath path, bool refetched, CancellationToken token);
+		Task Revise(NoteDocument note, string activityId, CancellationToken token);
+	}
+
+	public class ObjectRecords : IObjectRecords
+	{
+		public const int MaxRawBytes = 256 * 1024;
+		const int MaxRevisions = 10;
+		static readonly TimeSpan DescriptionAge = TimeSpan.FromDays(7);
+
+		readonly IJobQueue _queue;
+
+		public ObjectRecords(IJobQueue queue) => _queue = queue;
+
+		public async Task Record(NoteDocument note, PostEntity post, ObjectPath path, bool refetched, CancellationToken token)
+		{
+			var arrival = Arrival.Current;
+			var raw = Capture(note.Raw);
+			var host = new Uri(note.Id).Host.ToLowerInvariant();
+			var record = new ObjectRecord
+			{
+				ObjectURI = note.Id,
+				PostId = post.ID,
+				ObjectType = note.Type,
+				Host = host,
+				Raw = raw.Text,
+				RawHash = raw.Hash,
+				RawBytes = raw.Bytes,
+				RawTruncated = raw.Truncated,
+				ActivityContext = note.Raw?.ContainsKey("@context") == true || arrival?.Context?.Length > 16 * 1024 ? default : arrival?.Context,
+				Path = path,
+				Refetched = refetched,
+				ActivityId = arrival?.ActivityId,
+				ActivityType = arrival?.ActivityType,
+				ActivityActorURI = arrival?.ActorURI,
+				Inbox = path == ObjectPath.Delivered ? arrival?.Inbox : default,
+				SignatureScheme = arrival?.KeyId == default ? default : "draft-cavage",
+				KeyId = arrival?.KeyId,
+				Algorithm = arrival?.Algorithm,
+				SignedHeaders = arrival?.SignedHeaders?.ToList() ?? new(),
+				ReceivedAt = arrival?.ReceivedAt ?? DateTime.UtcNow,
+				Published = note.Published,
+				Updated = note.Updated
+			};
+			try
+			{
+				await DB.Default.SaveAsync(record, token);
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+				return;
+			}
+			await Describe(host, token);
+		}
+
+		public async Task Revise(NoteDocument note, string activityId, CancellationToken token)
+		{
+			var raw = Capture(note.Raw);
+			var revision = new ObjectRevision
+			{
+				Raw = raw.Text,
+				RawHash = raw.Hash,
+				RawTruncated = raw.Truncated,
+				ActivityId = activityId,
+				Updated = note.Updated
+			};
+			await DB.Default.Update<ObjectRecord>()
+				.Match(r => r.ObjectURI == note.Id)
+				.Modify(b => b.PushEach(r => r.Revisions, new[] { revision }, -MaxRevisions))
+				.Modify(r => r.Updated, note.Updated)
+				.ExecuteAsync(token);
+		}
+
+		async Task Describe(string host, CancellationToken token)
+		{
+			var known = await DB.Default.Find<RemoteInstance>().Match(i => i.Host == host).ExecuteFirstAsync(token);
+			if (known?.DescribedAt > DateTime.UtcNow - DescriptionAge)
+				return;
+			var week = ISOWeek.GetYear(DateTime.UtcNow) + "-" + ISOWeek.GetWeekOfYear(DateTime.UtcNow);
+			await _queue.Enqueue(JobKind.DescribeInstance, host, host, $"describe|{host}|{week}", token);
+		}
+
+		public static (string Text, string Hash, int Bytes, bool Truncated) Capture(JsonNode raw)
+		{
+			if (raw == default)
+				return default;
+			var text = raw.ToJsonString();
+			var bytes = Encoding.UTF8.GetBytes(text);
+			var hash = Convert.ToHexStringLower(SHA256.HashData(bytes));
+			return bytes.Length > MaxRawBytes ? (default, hash, bytes.Length, true) : (text, hash, bytes.Length, false);
+		}
+	}
+}

PrivaPub/Federation/Objects/ObjectShapes.cs

@@ -0,0 +1,362 @@
+using PrivaPub.Models.Post;
+
+using System.Globalization;
+using System.Net;
+using System.Text.Json.Nodes;
+using System.Text.RegularExpressions;
+using System.Xml;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
+namespace PrivaPub.Federation.Objects
+{
+	public static partial class ObjectShapes
+	{
+		const int MaxVariants = 20;
+		const int MaxCaptions = 20;
+		const int MaxPlaces = 4;
+		const int CoverMaxWidth = 1280;
+		const int MaxEmojis = 64;
+		const int MaxPollOptions = 20;
+		const int MaxAudience = 32;
+
+		static readonly Dictionary<string, string> MediaTypesByExtension = new(StringComparer.OrdinalIgnoreCase)
+		{
+			[".jpg"] = "image/jpeg", [".jpeg"] = "image/jpeg", [".png"] = "image/png", [".gif"] = "image/gif", [".webp"] = "image/webp",
+			[".avif"] = "image/avif", [".heic"] = "image/heic", [".svg"] = "image/svg+xml",
+			[".mp4"] = "video/mp4", [".m4v"] = "video/mp4", [".webm"] = "video/webm", [".mov"] = "video/quicktime", [".mkv"] = "video/x-matroska",
+			[".mp3"] = "audio/mpeg", [".ogg"] = "audio/ogg", [".oga"] = "audio/ogg", [".opus"] = "audio/opus", [".m4a"] = "audio/mp4",
+			[".flac"] = "audio/flac", [".wav"] = "audio/wav", [".m3u8"] = "application/x-mpegURL"
+		};
+
+		public static IEnumerable<JsonObject> Objects(JsonNode node) => node switch
+		{
+			JsonArray array => array.OfType<JsonObject>(),
+			JsonObject single => new[] { single },
+			_ => Enumerable.Empty<JsonObject>()
+		};
+
+		public static (string Url, string MediaType) MediaLink(JsonNode node)
+		{
+			switch (node)
+			{
+				case JsonValue value when value.TryGetValue<string>(out var text):
+					return (text, default);
+				case JsonObject link when Value(link, "href") is { } href:
+					return (href, Value(link, "mediaType"));
+				case JsonObject wrapper when wrapper["url"] is { } inner:
+					var (url, mediaType) = MediaLink(inner);
+					return (url, mediaType ?? Value(wrapper, "mediaType"));
+				case JsonArray array:
+					var links = array.Select(MediaLink).Where(l => l.Url != default).ToList();
+					return links.FirstOrDefault(l => l.MediaType?.StartsWith("text/html", StringComparison.OrdinalIgnoreCase) != true);
+				default:
+					return default;
+			}
+		}
+
+		public static string InferMediaType(string declared, string url, string objectType)
+		{
+			if (!string.IsNullOrWhiteSpace(declared) && declared.Contains('/'))
+				return declared.Trim();
+			if (Uri.TryCreate(url, UriKind.Absolute, out var uri) && MediaTypesByExtension.TryGetValue(Path.GetExtension(uri.AbsolutePath), out var byExtension))
+				return byExtension;
+			return objectType switch
+			{
+				"Image" => "image/*",
+				"Video" => "video/*",
+				"Audio" => "audio/*",
+				_ => default
+			};
+		}
+
+		public static string Image(JsonNode node)
+		{
+			var candidates = node switch
+			{
+				JsonValue value when value.TryGetValue<string>(out var text) => new[] { (Url: text, Width: (int?)default) },
+				JsonArray array => array.Select(item => (Url: MediaLink(item).Url, Width: Int(item as JsonObject, "width"))).ToArray(),
+				JsonObject single => new[] { (Url: MediaLink(single).Url, Width: Int(single, "width")) },
+				_ => Array.Empty<(string Url, int? Width)>()
+			};
+			var usable = candidates.Where(c => Origin.Of(c.Url) != default).ToList();
+			return usable.Where(c => c.Width <= CoverMaxWidth).OrderByDescending(c => c.Width).Select(c => c.Url).FirstOrDefault()
+				?? usable.Select(c => c.Url).FirstOrDefault();
+		}
+
+		public static List<CustomEmoji> Emojis(JsonNode tags) =>
+			Objects(tags)
+				.Where(t => Value(t, "type") == "Emoji")
+				.Select(t => new CustomEmoji
+				{
+					Shortcode = Value(t, "name")?.Trim(':'),
+					URL = MediaLink(t["icon"]).Url,
+					Updated = Moment(Value(t, "updated"))
+				})
+				.Where(e => !string.IsNullOrEmpty(e.Shortcode) && e.Shortcode.Length <= 100 && Shortcode().IsMatch(e.Shortcode) && Origin.Of(e.URL) != default)
+				.DistinctBy(e => e.Shortcode)
+				.Take(MaxEmojis)
+				.ToList();
+
+		public static InteractionRule QuotePolicy(JsonObject note)
+		{
+			if (note["interactionPolicy"] is not JsonObject policy || policy["canQuote"] is not JsonObject canQuote)
+				return default;
+			static List<string> Who(JsonNode node) => node switch
+			{
+				JsonArray array => array.Select(Id).Where(id => id != default).Take(MaxAudience).ToList(),
+				JsonNode single when Id(single) is { } id => new List<string> { id },
+				_ => new List<string>()
+			};
+			return new InteractionRule
+			{
+				Automatic = Who(canQuote["automaticApproval"] ?? canQuote["always"]),
+				Manual = Who(canQuote["manualApproval"] ?? canQuote["approvalRequired"])
+			};
+		}
+
+		public static PostPoll Poll(JsonObject note)
+		{
+			if (Value(note, "type") != "Question")
+				return default;
+			var multiple = note["anyOf"] is JsonArray;
+			var options = Objects(note[multiple ? "anyOf" : "oneOf"])
+				.Select(o => new PollOption
+				{
+					Title = Text(Value(o, "name"), 200),
+					Votes = o["replies"] is JsonObject replies && Int(replies, "totalItems") is { } total ? total : Int(o, "_misskey_votes") ?? 0
+				})
+				.Where(o => o.Title != default)
+				.Take(MaxPollOptions)
+				.ToList();
+			if (options.Count < 2)
+				return default;
+			var closedAt = note["closed"] switch
+			{
+				JsonValue value when value.TryGetValue<bool>(out var closed) => closed ? Moment(Value(note, "endTime")) ?? DateTime.UtcNow : default(DateTime?),
+				JsonValue value when value.TryGetValue<string>(out var at) => Moment(at),
+				_ => default
+			};
+			return new PostPoll
+			{
+				Options = options,
+				Multiple = multiple,
+				ExpiresAt = Moment(Value(note, "endTime")),
+				ClosedAt = closedAt,
+				VotersCount = Int(note, "votersCount")
+			};
+		}
+
+		public static string Cover(JsonObject note) =>
+			Image(note["image"]) ?? Image(note["icon"]) ?? (note["preview"] is JsonObject preview && Value(preview, "type") == "Image" ? Image(preview) : default);
+
+		public static double? Seconds(JsonNode node)
+		{
+			switch (node)
+			{
+				case JsonValue value when value.TryGetValue<double>(out var number):
+					return number >= 0 && number < 1e7 ? number : default;
+				case JsonValue value when value.TryGetValue<string>(out var text) && !string.IsNullOrWhiteSpace(text):
+					try
+					{
+						var span = XmlConvert.ToTimeSpan(text.Trim());
+						return span >= TimeSpan.Zero ? span.TotalSeconds : default;
+					}
+					catch (FormatException)
+					{
+						return double.TryParse(text, NumberStyles.Float, CultureInfo.InvariantCulture, out var seconds) && seconds >= 0 ? seconds : default;
+					}
+				default:
+					return default;
+			}
+		}
+
+		public static string Text(string html, int max)
+		{
+			if (string.IsNullOrWhiteSpace(html))
+				return default;
+			var text = WebUtility.HtmlDecode(Tags().Replace(html, " "));
+			text = Spaces().Replace(text, " ").Trim();
+			if (text.Length == 0)
+				return default;
+			return text.Length <= max ? text : text[..max];
+		}
+
+		public static string Language(JsonObject note) =>
+			note["@context"] is JsonArray context
+				? context.OfType<JsonObject>().Select(entry => Value(entry, "@language")).FirstOrDefault(language => !string.IsNullOrWhiteSpace(language))
+				: default;
+
+		public static PostSource Source(JsonObject note) => note["source"] is JsonObject source && Value(source, "content") is { } content
+			? new PostSource { Content = content.Length <= 64 * 1024 ? content : content[..(64 * 1024)], MediaType = Value(source, "mediaType") }
+			: default;
+
+		public static PostLink Link(JsonObject note)
+		{
+			var attached = Objects(note["attachment"]).FirstOrDefault(a => Value(a, "type") == "Link" && IsWeb(Value(a, "href")));
+			if (attached != default)
+			{
+				var preview = attached["preview"] as JsonObject;
+				return new PostLink
+				{
+					Href = Value(attached, "href"),
+					MediaType = Value(attached, "mediaType"),
+					Title = Text(Value(preview, "name") ?? Value(attached, "name"), 300),
+					Description = Text(Value(preview, "summary") ?? Value(preview, "content"), 1000),
+					ImageURL = preview == default ? Image(note["image"]) : Image(preview["image"]) ?? Image(preview["icon"]),
+					FromPublisher = preview != default
+				};
+			}
+			if (note["source"] is JsonValue source && source.TryGetValue<string>(out var sourceUrl) && IsWeb(sourceUrl))
+				return new PostLink { Href = sourceUrl, ImageURL = Image(note["image"]) };
+			return default;
+		}
+
+		public static VideoDetails Video(JsonObject note)
+		{
+			if (Value(note, "type") != "Video")
+				return default;
+			var links = Objects(note["url"]).ToList();
+			return new VideoDetails
+			{
+				DurationSeconds = Seconds(note["duration"]),
+				Variants = Variants(links, "video/", "audio/"),
+				PlaylistURL = links.Where(l => Value(l, "mediaType")?.Equals("application/x-mpegURL", StringComparison.OrdinalIgnoreCase) == true)
+					.Select(l => Value(l, "href")).FirstOrDefault(IsWeb),
+				IsLive = Bool(note, "isLiveBroadcast") == true,
+				State = Int(note, "state"),
+				Views = Long(note, "views"),
+				CommentsPolicy = Int(note, "commentsPolicy"),
+				DownloadEnabled = Bool(note, "downloadEnabled"),
+				Licence = Named(note["licence"] ?? note["license"]),
+				Category = Named(note["category"]),
+				ChannelURI = Objects(note["attributedTo"]).Where(a => Value(a, "type") == "Group").Select(a => Id(a)).FirstOrDefault(),
+				EmbedURL = Value(note, "embedUrl") is { } embed && IsWeb(embed) ? embed : default,
+				ChaptersURL = Value(note, "hasParts") is { } chapters && IsWeb(chapters) ? chapters : default,
+				Captions = Objects(note["subtitleLanguage"])
+					.Select(c => new Caption
+					{
+						Language = Value(c, "identifier"),
+						Url = Objects(c["url"]).Where(u => Value(u, "mediaType") == "text/vtt").Select(u => Value(u, "href")).FirstOrDefault(IsWeb)
+							?? (Value(c, "url") is { } plain && IsWeb(plain) ? plain : default)
+					})
+					.Where(c => c.Url != default)
+					.Take(MaxCaptions)
+					.ToList()
+			};
+		}
+
+		public static AudioDetails Audio(JsonObject note)
+		{
+			if (Value(note, "type") != "Audio")
+				return default;
+			return new AudioDetails
+			{
+				DurationSeconds = Seconds(note["duration"]),
+				Variants = Variants(Objects(note["url"]).ToList(), "audio/"),
+				Album = Named(note["album"]),
+				Position = Int(note, "position"),
+				Licence = Named(note["license"] ?? note["licence"])
+			};
+		}
+
+		public static EventDetails Event(JsonObject note)
+		{
+			if (Value(note, "type") != "Event")
+				return default;
+			var start = Value(note, "startTime");
+			var places = Objects(note["location"]).Select(Place).Where(p => p != default).Take(MaxPlaces).ToList();
+			return new EventDetails
+			{
+				Start = Moment(start),
+				End = Moment(Value(note, "endTime")),
+				TimeZone = Value(note, "timezone"),
+				FloatingTime = start?.EndsWith("-00:00", StringComparison.Ordinal) == true,
+				Places = places,
+				OnlineURL = places.Select(p => p.Url).FirstOrDefault(u => u != default)
+					?? Objects(note["attachment"]).Where(a => Value(a, "type") == "Link" && Value(a, "name") == "Website").Select(a => Value(a, "href")).FirstOrDefault(IsWeb),
+				JoinMode = Value(note, "joinMode"),
+				ParticipantCount = Int(note, "participantCount"),
+				Capacity = Int(note, "maximumAttendeeCapacity"),
+				Status = Value(note, "ical:status") ?? Value(note, "eventStatus") ?? Value(note, "status"),
+				Category = Named(note["category"])
+			};
+		}
+
+		static EventPlace Place(JsonObject location)
+		{
+			var type = Value(location, "type");
+			if (type == "VirtualLocation")
+				return Value(location, "url") is { } url && IsWeb(url) ? new EventPlace { Name = Text(Value(location, "name"), 200), Url = url } : default;
+			var address = location["address"] switch
+			{
+				JsonValue value when value.TryGetValue<string>(out var text) => text,
+				JsonObject postal => string.Join(", ", new[] { "streetAddress", "postalCode", "addressLocality", "addressRegion", "addressCountry" }
+					.Select(field => Value(postal, field)).Where(part => !string.IsNullOrWhiteSpace(part))),
+				_ => default
+			};
+			var place = new EventPlace
+			{
+				Name = Text(Value(location, "name") ?? Value(location, "content"), 200),
+				Address = Text(address, 300),
+				Latitude = Double(location, "latitude"),
+				Longitude = Double(location, "longitude")
+			};
+			return place.Name == default && place.Address == default && place.Latitude == default ? default : place;
+		}
+
+		static List<MediaVariant> Variants(List<JsonObject> links, params string[] prefixes) =>
+			links.Where(l => Value(l, "mediaType") is { } type && prefixes.Any(p => type.StartsWith(p, StringComparison.OrdinalIgnoreCase)) && IsWeb(Value(l, "href")))
+				.Select(l => new MediaVariant
+				{
+					Url = Value(l, "href"),
+					MediaType = Value(l, "mediaType"),
+					Width = Int(l, "width"),
+					Height = Int(l, "height"),
+					Fps = Double(l, "fps"),
+					Size = Long(l, "size"),
+					Streams = Objects(l["attachment"])
+						.Where(p => Value(p, "name") == "ffprobe_codec_type")
+						.Select(p => Value(p, "value"))
+						.Where(v => v is "audio" or "video")
+						.Distinct()
+						.ToList()
+				})
+				.Take(MaxVariants)
+				.ToList();
+
+		static string Named(JsonNode node) => node switch
+		{
+			JsonValue value when value.TryGetValue<string>(out var text) => Text(text, 200),
+			JsonObject named => Text(Value(named, "name") ?? Value(named, "identifier"), 200),
+			_ => default
+		};
+
+		static DateTime? Moment(string value) =>
+			DateTimeOffset.TryParse(value, CultureInfo.InvariantCulture, DateTimeStyles.AssumeUniversal, out var parsed) ? parsed.UtcDateTime : (DateTime?)null;
+
+		static bool IsWeb(string url) =>
+			Uri.TryCreate(url, UriKind.Absolute, out var uri) && (uri.Scheme == Uri.UriSchemeHttps || uri.Scheme == Uri.UriSchemeHttp);
+
+		static int? Int(JsonObject node, string property) =>
+			node?[property] is JsonValue value && value.TryGetValue<double>(out var number) && number is >= 0 and < int.MaxValue ? (int)number : (int?)null;
+
+		static long? Long(JsonObject node, string property) =>
+			node?[property] is JsonValue value && value.TryGetValue<double>(out var number) && number is >= 0 and < long.MaxValue ? (long)number : (long?)null;
+
+		static double? Double(JsonObject node, string property) =>
+			node?[property] is JsonValue value && value.TryGetValue<double>(out var number) && double.IsFinite(number) ? number : (double?)null;
+
+		static bool? Bool(JsonObject node, string property) =>
+			node?[property] is JsonValue value && value.TryGetValue<bool>(out var flag) ? flag : (bool?)null;
+
+		[GeneratedRegex(@"^[\w+\-.@]+$")]
+		private static partial Regex Shortcode();
+
+		[GeneratedRegex("<[^>]*>")]
+		private static partial Regex Tags();
+
+		[GeneratedRegex(@"\s+")]
+		private static partial Regex Spaces();
+	}
+}

PrivaPub/Federation/Outbox/DeliveryService.cs

@@ -123,12 +123,13 @@ namespace PrivaPub.Federation.Outbox
 					await _breaker.Succeeded(job.Host, token);
 					return JobOutcome.Done;
 				}
-				if (response.StatusCode == HttpStatusCode.TooManyRequests)
+				if (response.StatusCode == HttpStatusCode.TooManyRequests
+					|| response.StatusCode == HttpStatusCode.ServiceUnavailable && response.Headers.RetryAfter != default)
 				{
 					var retryAfter = response.Headers.RetryAfter?.Delta ?? (response.Headers.RetryAfter?.Date - DateTimeOffset.UtcNow);
 					return retryAfter > TimeSpan.Zero
-						? JobOutcome.Defer(DateTime.UtcNow + Min(retryAfter.Value, TimeSpan.FromHours(6)), "429")
+						? JobOutcome.Defer(DateTime.UtcNow + Min(retryAfter.Value, TimeSpan.FromHours(6)), $"{status}")
-						: JobOutcome.Retry("429");
+						: JobOutcome.Retry($"{status}");
 				}
 				if (status is >= 400 and < 500 && status != 408)
 				{

PrivaPub/Federation/Outbox/OutboxPublisher.cs

@@ -60,6 +60,16 @@ namespace PrivaPub.Federation.Outbox
 					inboxes.Add(parentAuthor.InboxURL);
 			}
 
+			if (post.Visibility is PostVisibility.Public or PostVisibility.Unlisted && !string.IsNullOrEmpty(post.QuotedPostId))
+			{
+				var quoted = await _dbEntities.Posts.MatchID(post.QuotedPostId).ExecuteFirstAsync(token);
+				var quotedAuthor = quoted is { IsFederatedCopy: true }
+					? await _dbEntities.ForeignAvatars.Match(a => a.ActorURI == quoted.ActorURI).ExecuteFirstAsync(token)
+					: default;
+				if (!string.IsNullOrEmpty(quotedAuthor?.InboxURL))
+					inboxes.Add(quotedAuthor.InboxURL);
+			}
+
 			return inboxes.Where(i => !string.IsNullOrEmpty(i)).Distinct(StringComparer.Ordinal).ToList();
 		}
 

PrivaPub/Federation/Rendering/ActivityPubRenderer.cs

@@ -37,18 +37,33 @@ namespace PrivaPub.Federation.Rendering
 				["discoverable"] = "toot:discoverable",
 				["indexable"] = "toot:indexable",
 				["blurhash"] = "toot:blurhash",
+				["votersCount"] = "toot:votersCount",
+				["Emoji"] = "toot:Emoji",
+				["quote"] = new JsonObject { ["@id"] = "https://w3id.org/fep/044f#quote", ["@type"] = "@id" },
+				["quoteAuthorization"] = new JsonObject { ["@id"] = "https://w3id.org/fep/044f#quoteAuthorization", ["@type"] = "@id" },
+				["QuoteRequest"] = "https://w3id.org/fep/044f#QuoteRequest",
+				["QuoteAuthorization"] = "https://w3id.org/fep/044f#QuoteAuthorization",
+				["misskey"] = "https://misskey-hub.net/ns#",
+				["_misskey_quote"] = "misskey:_misskey_quote",
+				["fedibird"] = "http://fedibird.com/ns#",
+				["quoteUri"] = "fedibird:quoteUri",
+				["quoteUrl"] = "as:quoteUrl",
+				["litepub"] = "http://litepub.social/ns#",
+				["EmojiReact"] = "litepub:EmojiReact",
 				["focalPoint"] = new JsonObject { ["@container"] = "@list", ["@id"] = "toot:focalPoint" },
 				["schema"] = "http://schema.org#",
 				["PropertyValue"] = "schema:PropertyValue",
 				["value"] = "schema:value",
-				["webfinger"] = "https://purl.archive.org/socialweb/webfinger#webfinger"
+				["webfinger"] = "https://purl.archive.org/socialweb/webfinger#webfinger",
+				["lemmy"] = "https://join-lemmy.org/ns#",
+				["postingRestrictedToMods"] = "lemmy:postingRestrictedToMods"
 			});
 
 		public static string Html(string markdown) =>
 			string.IsNullOrEmpty(markdown) ? string.Empty : Markdown.ToHtml(markdown, Pipeline).Trim();
 
 		public static string Timestamp(DateTime value) =>
-			DateTime.SpecifyKind(value, DateTimeKind.Utc).ToString("yyyy-MM-ddTHH:mm:ssZ", CultureInfo.InvariantCulture);
+			DateTime.SpecifyKind(value, DateTimeKind.Utc).ToString("yyyy-MM-ddTHH:mm:ss.fffZ", CultureInfo.InvariantCulture);
 
 		public static string Day(DateTime value) =>
 			DateTime.SpecifyKind(value, DateTimeKind.Utc).Date.ToString("yyyy-MM-ddT00:00:00Z", CultureInfo.InvariantCulture);
@@ -154,6 +169,64 @@ namespace PrivaPub.Federation.Rendering
 			return note;
 		}
 
+		public static JsonObject UpdateOf(PostEntity post, LocalActor author, string reason)
+		{
+			var note = post.Visibility == PostVisibility.Direct
+				? DirectNote(post, author, Array.Empty<(string, string)>(), post.ContextURI)
+				: Note(post, author, default, post.InReplyToURI);
+			note["to"] = new JsonArray(post.To.Select(t => (JsonNode)t).ToArray());
+			note["cc"] = new JsonArray(post.Cc.Select(c => (JsonNode)c).ToArray());
+			return new JsonObject
+			{
+				["@context"] = Context(),
+				["id"] = author.ActivityUri($"update-{post.ID}-{reason}"),
+				["type"] = "Update",
+				["actor"] = author.Uri,
+				["to"] = note["to"]!.DeepClone(),
+				["cc"] = note["cc"]!.DeepClone(),
+				["object"] = note
+			};
+		}
+
+		static void AddQuote(JsonObject note, PostEntity post, ref string content)
+		{
+			if (string.IsNullOrEmpty(post.QuoteURI))
+				return;
+			var link = WebUtility.HtmlEncode(post.QuoteURI);
+			content += $"<p class=\"quote-inline\">RE: <a href=\"{link}\">{link}</a></p>";
+			if (post.QuoteByConsent)
+				note["quote"] = post.QuoteURI;
+			if (!string.IsNullOrEmpty(post.QuoteAuthorizationURI))
+				note["quoteAuthorization"] = post.QuoteAuthorizationURI;
+			note["_misskey_quote"] = post.QuoteURI;
+			note["quoteUri"] = post.QuoteURI;
+			note["quoteUrl"] = post.QuoteURI;
+			(note["tag"] as JsonArray)?.Add(new JsonObject
+			{
+				["type"] = "Link",
+				["mediaType"] = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"",
+				["href"] = post.QuoteURI,
+				["name"] = $"RE: {post.QuoteURI}"
+			});
+		}
+
+		static void AddPoll(JsonObject note, PostPoll poll)
+		{
+			note["type"] = "Question";
+			note[poll.Multiple ? "anyOf" : "oneOf"] = new JsonArray(poll.Options.Select(option => (JsonNode)new JsonObject
+			{
+				["type"] = "Note",
+				["name"] = option.Title,
+				["replies"] = new JsonObject { ["type"] = "Collection", ["totalItems"] = option.Votes }
+			}).ToArray());
+			if (poll.ExpiresAt is { } ends)
+				note["endTime"] = Timestamp(ends);
+			if (poll.ClosedAt is { } closed)
+				note["closed"] = Timestamp(closed);
+			if (poll.VotersCount is { } voters)
+				note["votersCount"] = voters;
+		}
+
 		static string Headline(PostEntity post)
 		{
 			var text = System.Text.RegularExpressions.Regex.Replace(post.ContentHtml ?? post.Text ?? string.Empty, "<[^>]+>", " ");
@@ -188,8 +261,12 @@ namespace PrivaPub.Federation.Rendering
 					}))
 					.ToArray())
 			};
+			AddQuote(note, post, ref content);
+			note["content"] = content;
 			if (!string.IsNullOrEmpty(post.Language))
 				note["contentMap"] = new JsonObject { [post.Language] = content };
+			if (post.Poll is { } poll)
+				AddPoll(note, poll);
 			var attachments = post.Media.Where(m => !string.IsNullOrEmpty(m.URL)).Select(m =>
 			{
 				var attachment = new JsonObject

PrivaPub/Infrastructure/Data/Indexes.cs

@@ -13,6 +13,8 @@ namespace PrivaPub.Infrastructure.Data
 {
 	public static class Indexes
 	{
+		public static readonly TimeSpan TombstoneLifetime = TimeSpan.FromDays(90);
+
 		public static async Task Create(CancellationToken token = default)
 		{
 			await Unique<Post>(p => p.ObjectURI, Builders<Post>.Filter.Type(p => p.ObjectURI, BsonType.String), token);
@@ -102,6 +104,19 @@ namespace PrivaPub.Infrastructure.Data
 			await Plain<Report>(token, r => r.IsResolved, r => r.ID);
 			await Unique<DomainBlock>(b => b.Domain, Builders<DomainBlock>.Filter.Type(b => b.Domain, BsonType.String), token);
 			await Unique<RemoteInstance>(i => i.Host, Builders<RemoteInstance>.Filter.Type(i => i.Host, BsonType.String), token);
+			await Unique<ObjectRecord>(r => r.ObjectURI, Builders<ObjectRecord>.Filter.Type(r => r.ObjectURI, BsonType.String), token);
+			await Plain<ObjectRecord>(token, r => r.PostId);
+			await Unique<DeletedObject>(d => d.ObjectURI, Builders<DeletedObject>.Filter.Type(d => d.ObjectURI, BsonType.String), token);
+			await DB.Default.Index<DeletedObject>().Key(d => d.DeletedAt, KeyType.Ascending).Option(o => o.ExpireAfter = TombstoneLifetime).CreateAsync(token);
+			await DB.Default.Index<Downvote>().Key(d => d.PostId, KeyType.Ascending).Key(d => d.ActorURI, KeyType.Ascending).Option(o => o.Unique = true).CreateAsync(token);
+			await Plain<Downvote>(token, d => d.ActivityURI);
+			await DB.Default.Index<PollVote>().Key(v => v.PostId, KeyType.Ascending).Key(v => v.ActorURI, KeyType.Ascending).Key(v => v.Choice, KeyType.Ascending)
+				.Option(o => o.Unique = true).CreateAsync(token);
+			await DB.Default.Index<PollVote>().Key(v => v.PostId, KeyType.Ascending).Key(v => v.VoterAccountId, KeyType.Ascending).CreateAsync(token);
+			await DB.Default.Index<Reaction>().Key(r => r.PostId, KeyType.Ascending).Key(r => r.ActorURI, KeyType.Ascending).Key(r => r.Emoji, KeyType.Ascending)
+				.Option(o => o.Unique = true).CreateAsync(token);
+			await Plain<Reaction>(token, r => r.ActivityURI);
+			await Unique<Domain.Content.LinkPreview>(p => p.Url, Builders<Domain.Content.LinkPreview>.Filter.Type(p => p.Url, BsonType.String), token);
 		}
 
 		static async Task Unique<T>(System.Linq.Expressions.Expression<Func<T, object>> key, FilterDefinition<T> partial,

PrivaPub/Infrastructure/Data/Migrations/_006_unedited_remote_posts_lose_year_one.cs

@@ -0,0 +1,26 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Post;
+
+namespace PrivaPub.Infrastructure.Data.Migrations
+{
+	public class _006_unedited_remote_posts_lose_year_one : IMigration
+	{
+		public async Task UpgradeAsync()
+		{
+			var posts = await DB.Default.Find<Post>()
+				.Match(p => p.EditedAt == DateTime.MinValue || p.UpdateDate == DateTime.MinValue || p.Revisions.Any(r => r.EditedAt == DateTime.MinValue))
+				.ExecuteAsync();
+			foreach (var post in posts)
+			{
+				foreach (var revision in post.Revisions.Where(r => r.EditedAt == DateTime.MinValue))
+					revision.EditedAt = post.CreationDate;
+				await DB.Default.Update<Post>().MatchID(post.ID)
+					.Modify(p => p.EditedAt, post.EditedAt == DateTime.MinValue ? null : post.EditedAt)
+					.Modify(p => p.UpdateDate, post.UpdateDate == DateTime.MinValue ? post.CreationDate : post.UpdateDate)
+					.Modify(p => p.Revisions, post.Revisions)
+					.ExecuteAsync();
+			}
+		}
+	}
+}

PrivaPub/Infrastructure/Data/Migrations/_007_personas_publish_a_spread_day.cs

@@ -0,0 +1,23 @@
+using MongoDB.Bson;
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Infrastructure.Ids;
+using PrivaPub.Models.User;
+
+using GroupEntity = PrivaPub.Models.Group.Group;
+
+namespace PrivaPub.Infrastructure.Data.Migrations
+{
+	public class _007_personas_publish_a_spread_day : IMigration
+	{
+		public async Task UpgradeAsync()
+		{
+			var missing = new BsonDocument(nameof(Avatar.PublishedOn), new BsonDocument("$exists", false));
+			foreach (var avatar in await DB.Default.Collection<Avatar>().Find(missing).ToListAsync())
+				await DB.Default.Update<Avatar>().MatchID(avatar.ID).Modify(a => a.PublishedOn, PrivacyIds.PublishedDay(avatar.CreatedAt)).ExecuteAsync();
+			foreach (var group in await DB.Default.Collection<GroupEntity>().Find(missing).ToListAsync())
+				await DB.Default.Update<GroupEntity>().MatchID(group.ID).Modify(g => g.PublishedOn, PrivacyIds.PublishedDay(group.CreationDate)).ExecuteAsync();
+		}
+	}
+}

PrivaPub/Infrastructure/Http/FederationHttp.cs

@@ -21,6 +21,8 @@ namespace PrivaPub.Infrastructure.Http
 	{
 		bool IsAllowed(Uri target);
 		Task<FetchedJson> GetJson(string url, string accept, Action<HttpRequestMessage> sign, CancellationToken token);
+		bool FailedTemporarily(string url);
+		Task<(Uri FinalUri, string Html)> GetPage(string url, CancellationToken token);
 		Task<HttpResponseMessage> Send(HttpRequestMessage request, CancellationToken token);
 		Task<(byte[] Bytes, string ContentType)> GetMedia(string url, long maxBytes, CancellationToken token);
 	}
@@ -107,7 +109,8 @@ namespace PrivaPub.Infrastructure.Http
 					}
 
 					if (!response.IsSuccessStatusCode)
-						return Refuse(negativeKey, url, $"status {(int)response.StatusCode}");
+						return Refuse(negativeKey, url, $"status {(int)response.StatusCode}",
+							transient: (int)response.StatusCode is >= 500 or 429 or 408);
 
 					var mediaType = response.Content.Headers.ContentType?.MediaType;
 					if (mediaType == default || !JsonMediaTypes.Contains(mediaType, StringComparer.OrdinalIgnoreCase))
@@ -125,14 +128,21 @@ namespace PrivaPub.Infrastructure.Http
 			}
 			catch (OperationCanceledException) when (!token.IsCancellationRequested)
 			{
-				return Refuse(negativeKey, url, "a timeout");
+				return Refuse(negativeKey, url, "a timeout", transient: true);
 			}
-			catch (Exception ex) when (ex is HttpRequestException or JsonException or BlockedDestinationException)
+			catch (HttpRequestException ex)
+			{
+				return Refuse(negativeKey, url, ex.Message, transient: true);
+			}
+			catch (Exception ex) when (ex is JsonException or BlockedDestinationException)
 			{
 				return Refuse(negativeKey, url, ex.Message);
 			}
 		}
 
+		public bool FailedTemporarily(string url) =>
+			Uri.TryCreate(url, UriKind.Absolute, out var target) && _cache.TryGetValue(NegativeKey(target), out bool transient) && transient;
+
 		public async Task<(byte[] Bytes, string ContentType)> GetMedia(string url, long maxBytes, CancellationToken token)
 		{
 			if (!Uri.TryCreate(url, UriKind.Absolute, out var target) || !IsAllowed(target))
@@ -172,6 +182,66 @@ namespace PrivaPub.Infrastructure.Http
 			}
 		}
 
+		public async Task<(Uri FinalUri, string Html)> GetPage(string url, CancellationToken token)
+		{
+			if (!Uri.TryCreate(url, UriKind.Absolute, out var target) || !IsAllowed(target))
+				return default;
+			using var timeout = CancellationTokenSource.CreateLinkedTokenSource(token);
+			timeout.CancelAfter(RequestTimeout);
+			try
+			{
+				for (var hop = 0; hop <= MaxRedirects; hop++)
+				{
+					using var request = new HttpRequestMessage(HttpMethod.Get, target);
+					request.Headers.Accept.ParseAdd("text/html, application/xhtml+xml");
+					using var response = await _httpClientFactory.CreateClient(ClientName).SendAsync(request, HttpCompletionOption.ResponseHeadersRead, timeout.Token);
+					if (IsRedirect(response.StatusCode))
+					{
+						var location = response.Headers.Location;
+						var next = location == default ? default : location.IsAbsoluteUri ? location : new Uri(target, location);
+						if (!IsAllowed(next))
+							return default;
+						target = next;
+						continue;
+					}
+					var mediaType = response.Content.Headers.ContentType?.MediaType?.ToLowerInvariant();
+					if (!response.IsSuccessStatusCode || mediaType is not ("text/html" or "application/xhtml+xml"))
+						return default;
+					var bytes = await ReadPrefix(response.Content, MaxPageBytes, timeout.Token);
+					var charset = response.Content.Headers.ContentType?.CharSet?.Trim('"');
+					var encoding = System.Text.Encoding.UTF8;
+					try
+					{
+						if (!string.IsNullOrEmpty(charset))
+							encoding = System.Text.Encoding.GetEncoding(charset);
+					}
+					catch (ArgumentException)
+					{
+					}
+					return (target, encoding.GetString(bytes));
+				}
+				return default;
+			}
+			catch (Exception ex) when (ex is HttpRequestException or BlockedDestinationException or OperationCanceledException && !token.IsCancellationRequested)
+			{
+				_logger.LogInformation("Page {Url} refused: {Reason}", url, ex.Message);
+				return default;
+			}
+		}
+
+		const int MaxPageBytes = 512 * 1024;
+
+		static async Task<byte[]> ReadPrefix(HttpContent content, int limit, CancellationToken token)
+		{
+			await using var stream = await content.ReadAsStreamAsync(token);
+			var buffer = new byte[limit];
+			var total = 0;
+			int read;
+			while (total < limit && (read = await stream.ReadAsync(buffer.AsMemory(total, limit - total), token)) > 0)
+				total += read;
+			return buffer[..total];
+		}
+
 		public async Task<HttpResponseMessage> Send(HttpRequestMessage request, CancellationToken token)
 		{
 			if (!IsAllowed(request.RequestUri))
@@ -200,9 +270,9 @@ namespace PrivaPub.Infrastructure.Http
 
 		static string NegativeKey(Uri target) => "federation-http:refused:" + target.AbsoluteUri;
 
-		FetchedJson Refuse(string negativeKey, string url, string reason)
+		FetchedJson Refuse(string negativeKey, string url, string reason, bool transient = false)
 		{
-			_cache.Set(negativeKey, true, NegativeCacheLifetime);
+			_cache.Set(negativeKey, transient, NegativeCacheLifetime);
 			_logger.LogInformation("GET {Url} refused: {Reason}", url, reason);
 			return default;
 		}

PrivaPub/Infrastructure/Http/FederationOptions.cs

@@ -5,5 +5,7 @@ namespace PrivaPub.Infrastructure.Http
 		public bool AllowPrivateNetworks { get; set; }
 		public bool AllowPlainHttp { get; set; }
 		public bool SecureMode { get; set; }
+		public bool AcceptAnyCertificate { get; set; }
+		public bool FetchLinkPreviews { get; set; } = true;//owner decision 1: the server reads linked pages of public posts
 	}
 }

PrivaPub/Infrastructure/Http/SafeHttpHandlerFactory.cs

@@ -1,4 +1,5 @@
 using System.Net;
+using System.Net.Security;
 using System.Net.Sockets;
 
 namespace PrivaPub.Infrastructure.Http
@@ -12,6 +13,9 @@ namespace PrivaPub.Infrastructure.Http
 	{
 		public static SocketsHttpHandler Create(FederationOptions options) => new()
 		{
+			SslOptions = options.AcceptAnyCertificate
+				? new SslClientAuthenticationOptions { RemoteCertificateValidationCallback = (_, _, _, _) => true }
+				: new SslClientAuthenticationOptions(),
 			AllowAutoRedirect = false,
 			UseProxy = false,
 			UseCookies = false,

PrivaPub/Infrastructure/Ids/PrivacyIds.cs

@@ -1,12 +1,24 @@
 using System.Buffers.Binary;
 using System.Security.Cryptography;
 
+using MongoDB.Bson;
+
 namespace PrivaPub.Infrastructure.Ids
 {
 	public static class PrivacyIds
 	{
 		public static string ForDay(DateTime when) => At(DateTime.SpecifyKind(when, DateTimeKind.Utc).Date);
 
+		public static DateTime PublishedDay(DateTime created) =>
+			DateTime.SpecifyKind(created, DateTimeKind.Utc).Date.AddDays(-RandomNumberGenerator.GetInt32(0, PublishedSpreadDays));
+
+		const int PublishedSpreadDays = 14;
+
+		public static string Arrived(DateTime published) =>
+			DateTime.SpecifyKind(published, DateTimeKind.Utc) > DateTime.UtcNow - LiveWindow ? ObjectId.GenerateNewId().ToString() : At(published);
+
+		static readonly TimeSpan LiveWindow = TimeSpan.FromHours(1);
+
 		public static string At(DateTime when)
 		{
 			var seconds = Math.Clamp(new DateTimeOffset(DateTime.SpecifyKind(when, DateTimeKind.Utc)).ToUnixTimeSeconds(), 0,

PrivaPub/Middleware/SocialPubConfigurations.cs

@@ -17,6 +17,7 @@ using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Outbox;
 using PrivaPub.Federation.Signing;
 using PrivaPub.Federation.Inbox;
+using PrivaPub.Federation.Objects;
 using PrivaPub.Federation.Moderation;
 using PrivaPub.Federation.Inbox.Handlers;
 using PrivaPub.Domain.Content;
@@ -75,6 +76,13 @@ namespace PrivaPub.Middleware
 				.AddSingleton<IActivityHandler, RejectHandler>()
 				.AddSingleton<IActivityHandler, UndoHandler>()
 				.AddSingleton<IActivityHandler, LikeHandler>()
+				.AddSingleton<IActivityHandler, DislikeHandler>()
+				.AddSingleton<IActivityHandler, EmojiReactHandler>()
+				.AddSingleton<IReactions, Reactions>()
+				.AddSingleton<LinkPreviews>()
+				.AddSingleton<ILinkPreviews>(services => services.GetRequiredService<LinkPreviews>())
+				.AddSingleton<IJobHandler>(services => services.GetRequiredService<LinkPreviews>())
+				.AddSingleton<IActivityHandler, JoinHandler>()
 				.AddSingleton<IActivityHandler, AnnounceHandler>()
 				.AddSingleton<IActivityHandler, FlagHandler>()
 				.AddSingleton<IActivityHandler, CreateHandler>()
@@ -82,6 +90,12 @@ namespace PrivaPub.Middleware
 				.AddSingleton<IActivityHandler, UpdateHandler>()
 				.AddSingleton<IJobHandler, InboxProcessor>()
 				.AddSingleton<IRemotePosts, RemotePosts>()
+				.AddSingleton<IObjectRecords, ObjectRecords>()
+				.AddSingleton<IPollService, PollService>()
+				.AddSingleton<IQuoteService, QuoteService>()
+				.AddSingleton<IJobHandler, PollRefreshJob>()
+				.AddSingleton<IJobHandler, PollCloseJob>()
+				.AddSingleton<IJobHandler, InstanceDescriber>()
 				.AddSingleton<IJobHandler, AncestorsJobHandler>()
 				.AddSingleton<IJobQueue, JobQueue>()
 				.AddSingleton<IHostCircuitBreaker, HostCircuitBreaker>()

PrivaPub/Models/Federation/DeletedObject.cs

@@ -0,0 +1,10 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Models.Federation
+{
+	public class DeletedObject : Entity
+	{
+		public string ObjectURI { get; set; }
+		public DateTime DeletedAt { get; set; } = DateTime.UtcNow;//expires after Indexes.TombstoneLifetime
+	}
+}

PrivaPub/Models/Federation/ObjectRecord.cs

@@ -0,0 +1,50 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Models.Federation
+{
+	public class ObjectRecord : Entity
+	{
+		public string ObjectURI { get; set; }
+		public string PostId { get; set; }
+		public string ObjectType { get; set; }
+		public string Host { get; set; }
+
+		public string Raw { get; set; }//the object exactly as it reached us, unless it was larger than MaxRawBytes
+		public string RawHash { get; set; }//sha-256 of the raw bytes, hex
+		public int RawBytes { get; set; }
+		public bool RawTruncated { get; set; }
+		public string ActivityContext { get; set; }//the delivering activity's @context, which an embedded object does not repeat
+
+		public ObjectPath Path { get; set; }
+		public bool Refetched { get; set; }//delivered, but read again from its origin because it came embedded from another one
+		public string ActivityId { get; set; }//the activity that brought it, or that caused the fetch
+		public string ActivityType { get; set; }
+		public string ActivityActorURI { get; set; }
+		public string Inbox { get; set; }//"shared" or "personal" when delivered
+		public string SignatureScheme { get; set; }
+		public string KeyId { get; set; }
+		public string Algorithm { get; set; }
+		public List<string> SignedHeaders { get; set; } = new();
+
+		public DateTime ReceivedAt { get; set; } = DateTime.UtcNow;
+		public DateTime? Published { get; set; }
+		public DateTime? Updated { get; set; }
+		public List<ObjectRevision> Revisions { get; set; } = new();
+	}
+
+	public class ObjectRevision
+	{
+		public string Raw { get; set; }
+		public string RawHash { get; set; }
+		public bool RawTruncated { get; set; }
+		public string ActivityId { get; set; }
+		public DateTime? Updated { get; set; }
+		public DateTime ReceivedAt { get; set; } = DateTime.UtcNow;
+	}
+
+	public enum ObjectPath
+	{
+		Delivered,
+		Fetched
+	}
+}

PrivaPub/Models/Group/Group.cs

@@ -31,10 +31,11 @@ namespace PrivaPub.Models.Group
 		public string HashedInvitationPassword { get; set; }
 
 		public DateTime CreationDate { get; set; } = DateTime.UtcNow;
+		public DateTime PublishedOn { get; set; } = PrivacyIds.PublishedDay(DateTime.UtcNow);
 		public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
 		public DateTime? DeletionAt { get; set; }
 
-		public override object GenerateNewID() => PrivacyIds.ForDay(DateTime.UtcNow);
+		public override object GenerateNewID() => PrivacyIds.ForDay(PublishedOn);
 	}
 
 	public class GroupMember

PrivaPub/Models/Jobs/Job.cs

@@ -22,7 +22,11 @@ namespace PrivaPub.Models.Jobs
 	{
 		Deliver,
 		ProcessInbox,
-		FetchAncestors
+		FetchAncestors,
+		DescribeInstance,
+		PollRefresh,
+		PollClose,
+		FetchPreview
 	}
 
 	public enum JobState

PrivaPub/Models/Jobs/RemoteInstance.cs

@@ -10,5 +10,14 @@ namespace PrivaPub.Models.Jobs
 		public DateTime? LastSuccessAt { get; set; }
 		public DateTime? LastFailureAt { get; set; }
 		public string LastError { get; set; }
+
+		public string Software { get; set; }//NodeInfo software.name: for display, never for deciding behaviour
+		public string SoftwareVersion { get; set; }
+		public string NodeName { get; set; }
+		public List<string> Protocols { get; set; } = new();
+		public bool? OpenRegistrations { get; set; }
+		public string NodeInfo { get; set; }//the raw document, when small enough
+		public DateTime? DescribedAt { get; set; }
+		public string DescriptionError { get; set; }
 	}
 }

PrivaPub/Models/Post/Post.cs

@@ -17,6 +17,7 @@ namespace PrivaPub.Models.Post
 		public PostVisibility Visibility { get; set; }
 		public string Title { get; set; }
 		public string SpoilerText { get; set; }
+		public string Excerpt { get; set; }//a non-Note's summary: a teaser, a description, an event's date and place
 		public string Text { get; set; }
 		public string ContentHtml { get; set; }
 		public ContentFormat ContentFormat { get; set; }
@@ -24,6 +25,21 @@ namespace PrivaPub.Models.Post
 		public List<PostMention> Mentions { get; set; } = new();
 		public List<string> Tags { get; set; } = new();
 		public List<PostMedia> Media { get; set; } = new();
+		public List<CustomEmoji> Emojis { get; set; } = new();
+		[BsonIgnoreIfNull]
+		public PostSource Source { get; set; }//the remote author's own text (Markdown, MFM, BBCode)
+		[BsonIgnoreIfNull]
+		public string CoverURL { get; set; }//a remote object's own image: article cover, video poster, event banner
+		[BsonIgnoreIfNull]
+		public PostLink Link { get; set; }
+		[BsonIgnoreIfNull]
+		public VideoDetails Video { get; set; }
+		[BsonIgnoreIfNull]
+		public AudioDetails Audio { get; set; }
+		[BsonIgnoreIfNull]
+		public EventDetails Event { get; set; }
+		[BsonIgnoreIfNull]
+		public PostPoll Poll { get; set; }
 		public List<float> Location { get; set; } = new();
 		public float RangeKm { get; set; } = 5.0f;
 		[BsonIgnoreIfNull]
@@ -35,16 +51,25 @@ namespace PrivaPub.Models.Post
 
 		public bool IsFederatedCopy { get; set; }
 		public string ObjectURI { get; set; }//the Note's id
+		public string ObjectType { get; set; }//the remote object's type: Note, Article, Page, Video, Event…; null for local posts
 		public string ActivityURI { get; set; }//the Create's id
 		public string ActorURI { get; set; }//attributedTo
 		public string Url { get; set; }
 		public string ContextURI { get; set; }
 		public string QuoteURI { get; set; }
+		public string QuotedPostId { get; set; }//our copy of the quoted post, once fetched
+		public QuoteState QuoteState { get; set; }
+		public string QuoteAuthorizationURI { get; set; }//FEP-044f: the quoted author's stamp
+		public bool QuoteByConsent { get; set; }//our quote of a post whose server asks for consent (FEP-044f), so `quote` is sent
+		public int QuotesCount { get; set; }
+		[BsonIgnoreIfNull]
+		public InteractionRule QuotePolicy { get; set; }//a remote post's interactionPolicy.canQuote; null when it states none
 		public List<string> To { get; set; } = new();
 		public List<string> Cc { get; set; } = new();
 
 		public int RepliesCount { get; set; }
 		public int FavouritesCount { get; set; }
+		public int DownvotesCount { get; set; }//Lemmy, PieFed, Mbin and Friendica Dislikes
 		public int ReblogsCount { get; set; }
 		public List<PostRevision> Revisions { get; set; } = new();
 
@@ -55,6 +80,17 @@ namespace PrivaPub.Models.Post
 		public string UpdateReason { get; set; }
 	}
 
+	public enum QuoteState
+	{
+		None,
+		Pending,
+		Accepted,
+		Rejected,
+		Revoked,
+		Deleted,
+		Unauthorized
+	}
+
 	public enum PostVisibility
 	{
 		Public,

PrivaPub/Models/Post/PostDetails.cs

@@ -0,0 +1,115 @@
+namespace PrivaPub.Models.Post
+{
+	public class CustomEmoji
+	{
+		public string Shortcode { get; set; }//without the colons
+		public string URL { get; set; }
+		public DateTime? Updated { get; set; }
+	}
+
+	public class PostPoll
+	{
+		public List<PollOption> Options { get; set; } = new();
+		public bool Multiple { get; set; }
+		public DateTime? ExpiresAt { get; set; }
+		public DateTime? ClosedAt { get; set; }
+		public int? VotersCount { get; set; }//null when the origin does not say (Misskey)
+		public bool HideTotals { get; set; }
+	}
+
+	public class PollOption
+	{
+		public string Title { get; set; }
+		public int Votes { get; set; }
+	}
+
+	public class InteractionRule
+	{
+		public List<string> Automatic { get; set; } = new();//actor or collection URIs; Public for anyone
+		public List<string> Manual { get; set; } = new();
+	}
+
+	public class PostSource
+	{
+		public string Content { get; set; }
+		public string MediaType { get; set; }//text/markdown, text/x.misskeymarkdown (MFM), text/bbcode…
+	}
+
+	public class PostLink
+	{
+		public string Href { get; set; }
+		public string MediaType { get; set; }
+		public string Title { get; set; }
+		public string Description { get; set; }
+		public string ImageURL { get; set; }
+		public bool FromPublisher { get; set; }//title, description and image came with the post (FEP-8967 preview), nothing was fetched
+	}
+
+	public class MediaVariant
+	{
+		public string Url { get; set; }
+		public string MediaType { get; set; }
+		public int? Width { get; set; }
+		public int? Height { get; set; }
+		public double? Fps { get; set; }
+		public long? Size { get; set; }
+		public List<string> Streams { get; set; } = new();//"audio", "video", from PeerTube's ffprobe_codec_type
+	}
+
+	public class VideoDetails
+	{
+		public double? DurationSeconds { get; set; }
+		public List<MediaVariant> Variants { get; set; } = new();
+		public string PlaylistURL { get; set; }//HLS
+		public bool IsLive { get; set; }
+		public int? State { get; set; }//PeerTube: 1 published, 4 waiting for live, 5 live ended
+		public long? Views { get; set; }
+		public int? CommentsPolicy { get; set; }//PeerTube: 1 open, 2 closed, 3 needs approval
+		public bool? DownloadEnabled { get; set; }
+		public string Licence { get; set; }
+		public string Category { get; set; }
+		public string ChannelURI { get; set; }
+		public string EmbedURL { get; set; }
+		public string ChaptersURL { get; set; }
+		public List<Caption> Captions { get; set; } = new();
+	}
+
+	public class Caption
+	{
+		public string Language { get; set; }
+		public string Url { get; set; }
+	}
+
+	public class AudioDetails
+	{
+		public double? DurationSeconds { get; set; }
+		public List<MediaVariant> Variants { get; set; } = new();
+		public string Album { get; set; }
+		public int? Position { get; set; }
+		public string Licence { get; set; }
+	}
+
+	public class EventDetails
+	{
+		public DateTime? Start { get; set; }
+		public DateTime? End { get; set; }
+		public string TimeZone { get; set; }
+		public bool FloatingTime { get; set; }//"-00:00": a local time with no zone (Hubzilla)
+		public List<EventPlace> Places { get; set; } = new();
+		public string OnlineURL { get; set; }
+		public string JoinMode { get; set; }
+		public int? ParticipantCount { get; set; }
+		public int? Capacity { get; set; }
+		public string Status { get; set; }
+		public string Category { get; set; }
+	}
+
+	public class EventPlace
+	{
+		public string Name { get; set; }
+		public string Address { get; set; }
+		public double? Latitude { get; set; }
+		public double? Longitude { get; set; }
+		public string Url { get; set; }//a VirtualLocation
+	}
+}

PrivaPub/Models/Post/PostMedia.cs

@@ -16,5 +16,8 @@ namespace PrivaPub.Models.Post
 		public int? Width { get; set; }
 		public int? Height { get; set; }
 		public float[] Focus { get; set; }
+		public string RemotePreviewURL { get; set; }//the remote thumbnail (attachment icon), served through the proxy
+		public double? DurationSeconds { get; set; }
+		public bool? Sensitive { get; set; }//Misskey marks each attachment
 	}
 }

PrivaPub/Models/Social/Downvote.cs

@@ -0,0 +1,13 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Models.Social
+{
+	public class Downvote : Entity
+	{
+		public string AccountId { get; set; }//ForeignAvatar.ID
+		public string ActorURI { get; set; }
+		public string PostId { get; set; }
+		public string ActivityURI { get; set; }
+		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+	}
+}

PrivaPub/Models/Social/Notification.cs

@@ -10,6 +10,8 @@ namespace PrivaPub.Models.Social
 		public string FromActorURI { get; set; }
 		public string PostId { get; set; }
 		public string DedupeKey { get; set; }
+		public string Emoji { get; set; }//a reaction's emoji
+		public string EmojiURL { get; set; }
 		public bool IsRead { get; set; }
 		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
 	}
@@ -21,6 +23,9 @@ namespace PrivaPub.Models.Social
 		FollowRequest,
 		Favourite,
 		Reblog,
-		Update
+		Update,
+		Poll,
+		Reaction,
+		Quote
 	}
 }

PrivaPub/Models/Social/PollVote.cs

@@ -0,0 +1,15 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Models.Social
+{
+	public class PollVote : Entity
+	{
+		public string PostId { get; set; }
+		public string VoterAccountId { get; set; }//Avatar.ID for a local voter, ForeignAvatar.ID for a remote one
+		public string ActorURI { get; set; }
+		public bool IsLocalVoter { get; set; }
+		public int Choice { get; set; }
+		public string ActivityURI { get; set; }
+		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+	}
+}

PrivaPub/Models/Social/Reaction.cs

@@ -0,0 +1,16 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Models.Social
+{
+	public class Reaction : Entity
+	{
+		public string PostId { get; set; }
+		public string AccountId { get; set; }//Avatar.ID for a local persona, ForeignAvatar.ID for a remote account
+		public string ActorURI { get; set; }
+		public bool IsLocal { get; set; }
+		public string Emoji { get; set; }//a single Unicode emoji, or a custom emoji's shortcode without colons or host
+		public string EmojiURL { get; set; }//set for a custom emoji
+		public string ActivityURI { get; set; }
+		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+	}
+}

PrivaPub/Models/User/Avatar.cs

@@ -32,12 +32,13 @@ namespace PrivaPub.Models.User
 
 		public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
 		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+		public DateTime PublishedOn { get; set; } = PrivacyIds.PublishedDay(DateTime.UtcNow);//the actor's published: a few days before CreatedAt, so same-day personas differ
 		public DateTime? SilencedAt { get; set; }
 		public DateTime? SuspendedAt { get; set; }
 		public DateTime? BannedAt { get; set; }
 		public DateTime? DeletionAt { get; set; }
 
-		public override object GenerateNewID() => PrivacyIds.ForDay(DateTime.UtcNow);
+		public override object GenerateNewID() => PrivacyIds.ForDay(PublishedOn);
 	}
 
 	public class ForeignAvatar : Entity
@@ -58,6 +59,13 @@ namespace PrivaPub.Models.User
 		public string PersonalNote { get; set; }
 		public string ModerationNote { get; set; }
 		public bool IsDiscoverable { get; set; } = true;
+		public bool IsIndexable { get; set; }
+		public bool IsLocked { get; set; }//manuallyApprovesFollowers
+		public bool IsMemorial { get; set; }
+		public List<PrivaPub.Models.Post.CustomEmoji> Emojis { get; set; } = new();
+		public string PictureDescription { get; set; }
+		public string HeaderDescription { get; set; }
+		public DateTime? Published { get; set; }//the actor's own published
 
 		public string ActorURI { get; set; }//id
 		public string PublicKeyId { get; set; }

PrivaPub/Program.cs

@@ -21,6 +21,8 @@ using PrivaPub.Models;
 using PrivaPub.Services;
 using PrivaPub.StaticServices;
 
+Log.Logger = new LoggerConfiguration().WriteTo.Console().CreateBootstrapLogger();
+
 try
 {
 	var builder = WebApplication.CreateBuilder(args);
@@ -71,8 +73,8 @@ try
 	}
 
 	var federationOptions = builder.Configuration.GetSection("Federation").Get<FederationOptions>() ?? new();
-	if (builder.Environment.IsProduction() && (federationOptions.AllowPrivateNetworks || federationOptions.AllowPlainHttp))
+	if (builder.Environment.IsProduction() && (federationOptions.AllowPrivateNetworks || federationOptions.AllowPlainHttp || federationOptions.AcceptAnyCertificate))
-		throw new InvalidOperationException("Federation:AllowPrivateNetworks and Federation:AllowPlainHttp are for test networks and must stay off in Production.");
+		throw new InvalidOperationException("Federation:AllowPrivateNetworks, AllowPlainHttp and AcceptAnyCertificate are for test networks and must stay off in Production.");
 
 	try
 	{
@@ -189,4 +191,8 @@ catch (Exception ex)
 	Log.ForContext<Program>().Fatal(ex, $"{nameof(Program)}.{nameof(Program)}()");
 	Environment.ExitCode = 1;
 }
+finally
+{
+	await Log.CloseAndFlushAsync();
+}
 

docs/INTEROP.md

@@ -0,0 +1,771 @@
+# Interop: what every peer sends, what it expects, and what PrivaPub still drops
+
+Research as of **2026-10-01**: the platforms' source on their default branches, live ActivityPub fetches from large
+instances, release notes and the FEP repository. Version numbers are what was current that day. Claims the
+research could not confirm from a primary source are marked *(unconfirmed)*. The sources are at the end.
+
+This file is for two readers:
+- **Whoever changes federation code.** Every gotcha below has broken somebody.
+- **Whoever builds the rich client.** That client shows every kind of fediverse content in one place, with a secondary
+  "details" view of the raw object and how it reached us. Section 4 says what the server must keep for it.
+
+Priorities, used throughout:
+
+| Priority | Meaning |
+|---|---|
+| **P1** | Breaks interop, or loses content the user would see. |
+| **P2** | Degrades the experience. |
+| **P3** | Nice to have. |
+
+## 1. Where PrivaPub stands (checked in the code, 2026-10-01)
+
+**Already right**
+- **Public addressing:** all three spellings are recognised (`…#Public`, `as:Public`, `Public`).
+- **Undo:** embeds its whole object, which Misskey needs; it fetches the object only when it isn't embedded.
+- **Content types:**
+  - Served documents are `application/activity+json; charset=utf-8`, which is on Lemmy's exact allowlist and is
+    accepted by GoToSocial and Misskey.
+  - WebFinger answers `application/jrd+json`, and answers for the actor URL as well as `acct:`. Akkoma and
+    Iceshrimp.NET require both.
+- **SSRF guard:**
+  - Its IPv6 rule is an allowlist (`2000::/3` only), so IPv4-compatible `::a.b.c.d`, NAT64 and the other tricks behind
+    Mastodon's GHSA-vwhj (Jul 2026) are already refused.
+  - It caps fetches at 1 MB. Misskey caps at 256 KiB, so keep our own documents well under that.
+- **Attachments:**
+  - Up to 16 are kept. Mastodon drops anything past 4; Pixelfed albums and Threads carousels go beyond it.
+  - `{type: Link}` attachments are not mistaken for media.
+- **Deleted posts** answer 410 with a `Tombstone`. Actor `published` is truncated to the day. The `webfinger` property
+  (FEP-2c59) is on every actor.
+- **Live check:** the whole follow, post, reply, like, boost, DM, edit and delete set round-trips with GoToSocial
+  0.22.1 (`tools/pasture/`).
+
+**Wrong at the time of the research (P1, cheap; all three fixed in v1.7.0)**
+- **`summary` is read as a content warning on every object type.** It is one only on a `Note`, or when
+  `sensitive: true` is set. Elsewhere it is something else:
+
+  | Sender | What `summary` holds |
+  |---|---|
+  | WordPress, WriteFreely, Ghost, NodeBB (`Article`) | a teaser or excerpt |
+  | Mobilizon, Gancio (`Event`) | the date and address, or the whole description |
+  | Funkwhale (`Audio`) | a line of hashtags |
+  | Mbin (`Page`) | a short title plus tags |
+
+  Today all of these arrive hidden behind a warning, and marked sensitive.
+- **Persona and group usernames are only lowercased.** Mastodon accepts `[a-z0-9_]` with `.` and `-` only inside the
+  name; Misskey `^\w([\w-.]*\w)?$`, 128 characters at most. A persona named outside that is unreachable from either.
+- **Our JSON-LD context does not define `postingRestrictedToMods`.** Iceshrimp.NET runs full JSON-LD expansion and
+  silently drops every undefined term. Any term we add later (`quote`, `Emoji`, `EmojiReact`, `interactionPolicy`,
+  `votersCount`) must be defined in `ActivityPubRenderer.Context()` in the same commit.
+
+**Smaller**
+- No `Vary: Accept` on actor and object URLs, although they answer HTML or JSON depending on `Accept`.
+- Only `create-…` and `announce-…` activity ids dereference. `follow-`, `like-`, `accept-` and `undo-…` answer 404.
+  That is harmless while objects are embedded, but every id should resolve.
+
+## 2. Rules that hold across platforms
+
+| # | Rule | What PrivaPub must do | P |
+|---|---|---|---|
+| W1 | `url`, `icon`, `image`, `attributedTo`, `actor`, `tag`, `attachment` and `alsoKnownAs` can each be a single value, an object or an array. The `url` array matters most: PeerTube video files, Funkwhale streams, and Bridgy posts, whose `rel: canonical` link is `at://…`. | Parse every shape. For "open original", use the `text/html` Link. Keep every other Link as a media variant. | P1 |
+| W2 | `summary` is a content warning only on a `Note`, or when `sensitive: true`. | See §1. On other types store it as an excerpt or description. NodeBB 4.16 honours a CW only on a sensitive Note. | P1 |
+| W3 | `content` can be Markdown. PeerTube descriptions and comments carry `mediaType: text/markdown`. | Render it, then sanitise. Keep `source{content, mediaType}`: Markdown, BBCode, `text/x.misskeymarkdown` (MFM). | P1 |
+| W4 | `mediaType` is missing or wrong: Bridgy media has none, Funkwhale hard-codes `audio/mpeg`, Gancio `image/jpeg`. Mastodon types every attachment `Document`. | Infer it from the object or attachment type, then sniff it in the media proxy. | P1 |
+| W5 | Thumbnails live in five places: attachment `icon` (Mastodon), object `icon[]` (PeerTube), object `preview` (Loops), `image` (Bridgy video; Ghost as a bare string; WordPress), and `icon` (Plume). | Keep them all; choose one per kind. | P1 |
+| W6 | `Accept`, `Reject` and `TentativeAccept` are not always follow answers. Friendica and Hubzilla use them as event RSVPs; Mobilizon answers a `Join`; GoToSocial answers interaction requests with `result`; Mastodon answers a `QuoteRequest`. | Route on what the object *is*. | P1 |
+| W7 | `id` is not the page a person opens. WordPress uses `?p=123`, Ghost `/.ghost/…`, Bridgy `/convert/ap/at://…`. | Link to `url`, never to `id`. | P1 |
+| W8 | Rich types are updated in place: PeerTube live state, WordPress (on every save), Mobilizon. A poll's counts are refreshed with an `Update{Question}` that changes nothing else. | Apply Updates to every kind. An Update with no newer `updated` is a refresh, never an edit revision. Mastodon applies the same rule. | P1 |
+| W9 | A `Delete` can arrive before its `Create`, and relays and forwarders re-send old Creates. | Keep tombstones so deleted posts stay deleted. When the deleter is not the author, confirm with the origin: 404 or 410 means deleted. | P1 |
+| W10 | Time comes in seconds (Mastodon), milliseconds (Misskey, us), or with offsets. `-00:00` means floating local time (Hubzilla events). `duration` is ISO 8601 (`PT6299S`). GoToSocial rejects a status whose `updated` is earlier than `published`. | Parse all of these, and clamp future times. Order by arrival (PrivacyIds.Arrived). Never emit `updated` < `published`. | P1 |
+| W11 | Language may be in `contentMap`, in `@context[].@language` (Pleroma 2.9+), or a `language{identifier,name}` object (Lemmy, PeerTube). Akkoma replaces `content` with the *first* `contentMap` entry. | Read all three. When sending, put `content` and the primary `contentMap` entry first and keep them equal. | P2 |
+| W12 | Alt text: `name` (Mastodon), `summary` (GoToSocial 0.20.0, Akkoma reads it first), or their `*Map` forms. Avatar and header alt is in `icon.name`/`image.name`, or `summary` on Mastodon. | Read both; send `name`. | P2 |
+| W13 | `"id": null` objects (Akkoma); a `Tombstone` served with **200** as a soft delete (FEP-4f05: NodeBB, Discourse); 410 for deleted GoToSocial 0.22 statuses. | Accept a null id inside an activity; never emit one. Any `Tombstone`, whatever the status code, means deleted. | P2 |
+| W14 | Size limits on the receiving side: Misskey reads at most 256 KiB, truncates text at 8192 characters, CW 512, poll choice 256, alt 512. GoToSocial takes emoji up to 100 KB. Peers cap fetches at about 1 MB. | Accept long posts from others. Keep our own documents small. | P2 |
+| W15 | Hashtag `name` comes with or without `#`. Mastodon normalises with NFKC + lowercase (watch Turkish `İ`). Lemmy adds an automatic `#<community>` tag to every post. | Normalise the same way; ignore Lemmy's automatic tag. | P3 |
+
+## 3. Per platform
+
+### Mastodon: 4.7.2 (2026-09-15); mastodon.social runs 4.8 alpha; client `api_versions.mastodon` = 11
+
+**Emits**
+- **Objects and activities:**
+  - Objects: `Note` and `Question` only.
+  - Federated `Block`.
+  - `Add`/`Remove` for pins, featured hashtags and featured collections (4.6, FEP-7aa9).
+  - `Move`.
+  - `QuoteRequest`, its `Accept`/`Reject` (with `result`), and `Delete{QuoteAuthorization}`.
+  - `FeatureRequest`/`FeatureAuthorization` (4.6).
+- **Threads:** `context` is a dereferenceable collection of the thread (FEP-7888, threads started on 4.5+).
+- **Interaction counts:** `likes` and `shares` carry `totalItems`.
+- **Quotes:** `quote`, plus `quoteUri` and `_misskey_quote`, `quoteAuthorization`, and `interactionPolicy.canQuote`.
+- **Link previews:** from 4.7, a `{type: Link, href}` **attachment** names the link a card is made from (FEP-8967).
+- **Attachments:** `duration`, and `icon` thumbnails.
+- **Actors:**
+  - `webfinger`, `featuredCollections`, `interactionPolicy.canFeature`, `attributionDomains`;
+  - `memorial`, `suspended`, `indexable`, `discoverable`;
+  - avatar and header alt text in `summary`;
+  - several keys allowed (4.6).
+- **Ids:** new accounts get numeric actor ids (4.5). Remote renames are accepted, keyed on the actor `id` (4.7).
+
+**Expects**
+- **Fetched documents:**
+  - `id` equals the URL requested, exactly.
+  - The type is `activity+json`, or `ld+json` with the profile.
+  - `@context` includes the ActivityStreams URL.
+- **WebFinger:** it loops back to the same `id`.
+- **draft-cavage signatures:**
+  - `(request-target)` includes the query string (4.3).
+  - `digest` is signed on POST and `host` on GET.
+  - The window is 12 h, with 1 h of skew.
+  - Mastodon no longer signs `Accept` (4.6). Never require it.
+- **RFC 9421:** verified by default since 4.5.0.
+  - A request carries one signature only.
+  - It must cover `@method`, `@target-uri` and `content-digest`, and include `created` and `keyid`.
+  - **4.7 double-knocks:** it signs draft-cavage first, and if we answer 400 or 401 it retries with RFC 9421. A 400 for
+    any other reason therefore triggers a retry we would fail.
+  - Mastodon answers **503** when it temporarily cannot fetch a key; that is a retry, not a failure.
+- **Edits:** an Update counts as an edit only with a newer `updated`.
+- **Quotes:** a post with no `canQuote` **cannot be quoted** by Mastodon users at all. A quote without a valid stamp
+  stays "pending", and only its fallback link shows.
+- **Fetch all replies** is always on (4.5). Mastodon crawls `replies` as its instance actor, up to 500 per post, and
+  **deletes its copy** when a refetch answers 404.
+- **Converted types:** `Article`, `Page`, `Event`, `Video`, `Audio` and `Image` become `<h2>name</h2>` + summary +
+  link. **The body is dropped.** Only `Mention` tags notify. Previews come from fetching the page; FEP-8967's
+  `preview` is ignored.
+
+**Gaps**
+
+| Gap | P | Client surface |
+|---|---|---|
+| Quotes: read all keys; verify the `QuoteAuthorization` (type, host, `attributedTo`, `interactingObject`, `interactionTarget`; GHSA-vg36 compared domains only); revocation; strip the `.quote-inline` fallback | P1 | `Status.quote{state, quoted_status}`, `quotes_count`, `/statuses/:id/quotes`, `quote`/`quoted_update` notifications, `api_versions.mastodon ≥ 7` |
+| Being quotable: emit `canQuote`; answer `QuoteRequest` with `Accept{object: request id, result: stamp}`; serve and revoke stamps | P2 | `Status.quote_approval`, `PUT /statuses/:id/interaction_policy` |
+| Polls (see §3 Misskey for vote shapes) | P1 | `Status.poll`, `/polls/:id`, `/polls/:id/votes`, `poll` notification |
+| Custom emoji on posts, names, fields and poll options, proxied, refreshed by `updated` | P1 | `Status.emojis`, `Account.emojis` |
+| Link attachments as the card source | P1 | `Status.card` |
+| Inbound `Move` with Mastodon's checks (`target` re-fetched, its `alsoKnownAs` lists the old account, 7-day lock); move each persona's follow | P1 | `Account.moved` |
+| Re-run WebFinger when `preferredUsername` changes; key accounts on the actor id | P2 | `Account.acct` |
+| Inbound `Block`: stop delivering, hide | P2 | `relationship.blocked_by` |
+| `Add`/`Remove` featured (pins, tags) | P2 | `GET /accounts/:id/statuses?pinned=true` |
+| Remote like and boost totals | P2 | counts |
+| Publish `context` and a paged `replies` | P2 | — |
+| `FeatureRequest`: send `Reject` (or implement FEP-7aa9) | P3 | — |
+
+### GoToSocial: 0.22.1 (2026-07-20)
+
+**Emits**
+- **Objects:** `Note` and `Question` only.
+- **Interaction policies** on every status: `canLike`, `canReply`, `canAnnounce` and `canQuote`, each split into
+  `automaticApproval` and `manualApproval`.
+  - Defaults: open on public and unlisted posts.
+  - On followers-only posts, liking and replying are limited to the author, followers and mentioned accounts, and
+    boosting to the author.
+  - `canQuote` is author-only on every post (0.21).
+- **Since 0.21 it asks politely:** `LikeRequest`, `ReplyRequest` and `AnnounceRequest`, with the interaction in
+  `instrument`. The answer is `Accept`/`Reject` whose `result` is a `*Authorization`. The interaction then carries
+  `replyAuthorization` (with `approvedBy` as the legacy fallback).
+- **Keys and actors:**
+  - The key id is `…/main-key` (no `#`), and its document is a stub actor.
+  - There is **no `sharedInbox`**.
+  - `hidesToPublicFromUnauthedWeb` / `hidesCcPublicFromUnauthedWeb`, `indexable`.
+  - `featured` holds URIs only, and changes to it are never announced, so read it instead.
+- **What it leaves out:**
+  - `context`;
+  - `likes`/`shares`;
+  - attachment `width`/`height`.
+- **Deleted statuses:** 0.22 keeps a stub and answers 410.
+
+**Expects**
+- **Signed requests:** every GET and POST is signed, draft-cavage only, with RSA keys. **No RFC 9421 in either
+  direction.**
+- **Key handshake:** the instance actor and key documents must be served **unsigned**, or both sides deadlock fetching
+  each other's keys. Ours are: SecureMode exempts the instance actor.
+- **Content-Type:** an inbox POST must be `activity+json`, or `ld+json` with the profile. Anything else gets 406.
+- **Activities:** one without an `id` is dropped. A 400 is never retried.
+- **Keys:** a changed public key on refresh is refused. **Never rotate keys silently.**
+- **Interaction policies:**
+  - Third-party GoToSocial servers drop replies that have no valid `replyAuthorization`.
+  - On followers-only GoToSocial posts, send `ReplyRequest` / `LikeRequest` instead of a bare Create or Like.
+- **Rate limit:** 300 requests per 5 minutes per IP, answered with 503 and `Retry-After`.
+- **Not accepted:** top-level `Audio`.
+- **Timelines:** its cached home timeline can miss new posts. Check a delivery by URI, not through its timelines; see
+  CLAUDE.md, "Testing".
+
+**Gaps**
+
+| Gap | P | Client surface |
+|---|---|---|
+| Store remote `interactionPolicy` (with GoToSocial's defaults); disable or mark actions | P1 | GoToSocial-style `Status.interaction_policy` |
+| Send `ReplyRequest`/`LikeRequest` where approval is needed; handle `Accept{result}`/`Reject`; attach the authorization | P1 | own: pending/approved/rejected on our own reply |
+| Honour 503 with `Retry-After` in delivery and in the proxy | P1 | — |
+| Respect `hides*FromUnauthedWeb` on our public pages; emit it for personas (it suits the privacy design) | P2 | — |
+| Measure media size when proxying | P2 | `MediaAttachment.meta` |
+| Only advertise the policies we enforce | P2 | — |
+
+### Misskey family: Misskey 2026.10.0, Sharkey 2025.4.7, Iceshrimp.NET 2026.1.2-beta, CherryPick 4.17
+
+Firefish is dead (its site has answered 410 since February 2025).
+
+**Emits**
+- **Text and quotes:**
+  - `_misskey_content` plus `source{content, mediaType: text/x.misskeymarkdown}` (MFM).
+  - The quote is `_misskey_quote`/`quoteUrl`, plus a `RE:` fallback inside the content.
+  - An empty CW is a zero-width space.
+- **Attachments:** each carries its own `sensitive`.
+- **Emoji tags** carry `_misskey_license`.
+- **Polls:** `Question` with `oneOf`/`anyOf`. Counts are in `replies.totalItems` per option. `endTime` and `closed` are
+  set; there is **no `votersCount`**.
+  - A vote is `Create{Note{name, inReplyTo, to:[owner]}}`, one per choice.
+  - Every vote triggers an `Update{Question}`.
+- **Reactions** are `Like{content: "👍"|":name:", _misskey_reaction, tag:[Emoji]}`.
+  - One reaction per user per note; a plain like is `❤`.
+  - They are sent to the author **and to the reactor's followers**.
+- **Actors:**
+  - `isCat`, `_misskey_summary`, `_misskey_followedMessage`;
+  - `_misskey_requireSigninToViewContents`;
+  - `_misskey_makeNotesFollowersOnlyBefore`/`HiddenBefore` (seconds; a negative value is relative to now);
+  - `vcard:bday`, `vcard:Address`, `backgroundUrl`.
+- **Vanilla Misskey has no edits.**
+- **Sharkey adds:**
+  - edits;
+  - a FEP-e232 quote `Link` tag (it deliberately leaves out `quote`);
+  - a `replies` collection;
+  - `hideOnlineStatus`, `noindex`, `enableRss`, `speakAsCat`.
+  - It sends contentless Likes only to Mastodon-like peers, so **we always receive Like+content**.
+- **Iceshrimp.NET adds:**
+  - `EmojiReact`, several per user, and `:name@host:` for remote emoji;
+  - a FEP-7888 `context`;
+  - `htmlMfm: true` (FEP-c16b);
+  - every `QuoteRequest` is auto-accepted;
+  - `Bite`, `pronouns`.
+- **CherryPick adds:** events on a plain Note (`startTime`/`endTime`), `deleteAt`, and federated chat
+  (`_misskey_talk: true`).
+
+**Expects**
+- **Inbound signatures:**
+  - draft-cavage over `(request-target) host date digest`;
+  - at most 300 s of skew;
+  - since 2026.10.0, the query string is included in `(request-target)`.
+  - **No RFC 9421 anywhere in the family.**
+- **Activities:**
+  - An activity's `id` must be on the signer's host.
+  - Activities forwarded on behalf of someone else are refused. A group must `Announce`.
+  - Misskey answers 202 even when it drops something, so errors stay invisible.
+- **Fetched documents:** request URL = final URL = `id`; ≤256 KiB; `activity+json` or `ld+json`.
+- **Actor collections** must be on the actor's host.
+- **Visibility:** Misskey recognises followers-only by the author's own `followers` URL, matched exactly. Otherwise:
+  - **A "specified" (direct) note with no resolvable recipients that Misskey fetches by URL is stored as public.**
+    Circle objects must therefore never be served to an unauthorised fetcher. They aren't: 404.
+- **Groups:** vanilla Misskey drops `Announce{Create}`, so groups should `Announce` the Note itself. We send both.
+- **Reactions:** must be `:name:` with no host, plus an Emoji tag, or they fall back to ❤.
+- **Article/Page titles** are never shown in Misskey's web UI.
+- **Iceshrimp.NET:**
+  - full JSON-LD expansion (see §1);
+  - `@graph`, `@reverse` and `@included` are refused;
+  - every actor must resolve through WebFinger;
+  - `preferredUsername` must be unique per domain. PrivaPub shares one name space across personas and groups, so this
+    holds.
+
+**Gaps**
+
+| Gap | P | Client surface |
+|---|---|---|
+| Emoji reactions in all three inbound forms: Like with `content`/`_misskey_reaction`, `EmojiReact`, and `Dislike`-as-un-like (Sharkey). Normalise `:n:`, `:n@host:` and `n@host`. Store per actor, emoji and activity, including reactions to remote posts. Undo by id. | P1 | `emoji_reactions` and `pleroma.emoji_reactions` `[{name,count,me,url,static_url}]` (Phanpy reads the first); `PUT/DELETE /api/v1/pleroma/statuses/:id/reactions/:emoji` |
+| Outbound reaction as `EmojiReact{content: ":name:", tag:[Emoji]}`. A plain Like stays a favourite. | P2 | same |
+| Polls: per-option counts (fall back to `_misskey_votes`); `votersCount` null when absent; `Update{Question}` is a refresh; an inbound `Note{name, inReplyTo: question}` with no content is a vote, never a reply | P1 | `Status.poll` |
+| Keep MFM source; let the sanitiser keep `<span class="mfm-*" data-mfm-*>` and `<ruby>` (FEP-c16b) | P2 | `text`, `content_type`; the rich client renders MFM from the source |
+| Per-attachment `sensitive`; `isCat` and other actor extras; enforce `requireSignin…` and `makeNotes…Before` on our public pages | P2 | own `privapub.*` |
+| Quotes: when we send one, send every key (`quote`, `_misskey_quote`, `quoteUrl`, `quoteUri`, a FEP-e232 tag, the `RE:` fallback) | P2 | — |
+
+### Pleroma 2.10.2 and Akkoma 3.20.1
+
+**Emits**
+- **Notes:**
+  - `@context` with the instance's own `litepub-0.1.jsonld` URL (never fetch it) and `@language`;
+  - `source{content, mediaType: text/markdown}`;
+  - `context` and `conversation` holding the same value;
+  - `quoteUrl`/`quoteUri`.
+- **Edit history:** `formerRepresentations`, an OrderedCollection of earlier versions.
+- **Reactions:** `EmojiReact{content: ":name:", tag:[Emoji]}`, several per user; separate from Like.
+- **Polls:** `votersCount` (Pleroma 2.10.1, Akkoma 3.20). A vote is a `Note{name, inReplyTo, to:[], cc:[owner]}`.
+- **Pleroma only:**
+  - `ChatMessage`, sent only to actors with `capabilities.acceptsChatMessages`;
+  - `Listen{Audio}`;
+  - outgoing `Block` is on by default.
+- **Akkoma only:**
+  - local-only posts are addressed to `<base>/#Public`, which is **not** public;
+  - FEP-2c59.
+
+**Expects**
+- **Pleroma's inbox guard answers 400 for unknown activity types:** `Move`, `QuoteRequest` and `Bite` are not on its
+  list (develop, 2026-09-30). Treat that 4xx as final.
+- **Signatures (Akkoma):** `host` must be signed and match; signatures up to 2 h old and up to 40 min in the future.
+- **Activity ids** must be at least 8 bytes.
+- **ObjectAgePolicy** (default in both) delists anything older than 7 days, so `published` must be accurate.
+- **Quotes:** Pleroma's InlineQuotePolicy rewrites incoming quotes into "RT: url" text. **Neither reads FEP-044f
+  `quote`**, so send `quoteUri` and `_misskey_quote` as well.
+- **Edits:** a changed `name` is ignored on update.
+
+**Gaps**
+
+| Gap | P | Client surface |
+|---|---|---|
+| Language from `@context[].@language` | P1 | `Status.language` |
+| `formerRepresentations` → our revisions | P2 | `/statuses/:id/history` |
+| `context`/`conversation` threading; parents and quotes we could not fetch, kept as URIs | P2 | `pleroma.context`; `akkoma.in_reply_to_apid`, `akkoma.quote_apid` precedent |
+| `ChatMessage` in as a direct message (also needed for Lemmy, Mbin and PieFed); advertise `acceptsChatMessages` only once it is answered | P1 (in), P3 (out) | `visibility: direct`, Conversations |
+| `Listen`, `vcard:bday`, `backgroundUrl` | P3 | own |
+
+### Lemmy: 0.19.20 live (lemmy.ml); 1.0.0-beta.2 (2026-09-25) in beta since May
+
+join-lemmy.org's federation page is out of date. Current Lemmy neither sends nor reads `stickied` or `commentsEnabled`
+on a Page: pins live in `featured`, locks in `Lock`.
+
+**Emits**
+- **Group:**
+  - `summary` (sidebar HTML) and `source` (sidebar Markdown); a plain `description` in 1.0;
+  - `sensitive`; `attributedTo` → the moderators collection; `featured`; `postingRestrictedToMods`; `language[]`;
+  - 1.0 adds: `manuallyApprovesFollowers` for private communities, `discoverable: false` for unlisted ones, and the
+    community's post tags in `tag[]` as `CommunityPostTag` with colour slots `color01`–`color10`.
+- **Page (post):**
+  - `name`, `content` and `source`;
+  - a link post is `attachment[0] = Link{href, mediaType}`, with `image` as the thumbnail;
+  - 1.0 image posts are `Image{url, name}`, where `name` is the alt text;
+  - `language{identifier, name}`, `audience`, `to: [community, Public]`;
+  - an automatic `#<community>` hashtag;
+  - 1.0 adds a Mention of the community and `context`.
+- **Note (comment):** `distinguished`.
+- **Votes:** `Like`/`Dislike` as `{actor, object, audience}` with no `to`/`cc`, and their `Undo`.
+- **Moderation:**
+  - a `Delete` with a `summary` is a mod removal (1.0 adds `withReplies`); its `Undo` restores;
+  - `Lock`/`Undo{Lock}` (1.0 also on comments);
+  - a ban is `Block{target, removeData, summary, endTime}` (0.19 also sends `expires`);
+  - `Add`/`Remove` of featured posts and moderators;
+  - `Update{Group}` **by the moderator Person**;
+  - 1.0 adds `Warn` and `Resolve{Flag}`.
+- **Delivery:** everything travels inside the community's `Announce`. For a new post Lemmy also sends a compatibility
+  `Announce(Page)` with a synthetic id; deduplicate it.
+- **Private messages:** `ChatMessage` on 0.19; a single-recipient `Note` on 1.0.
+- **Context:** 1.0's `context` collection is unpaged and **every comment's own context URL returns the whole post
+  thread**. Group threads by the root post, never by comparing `context` strings.
+- **Feeds:** multi-communities are 1.0's `type: Feed` actors.
+
+**Expects**
+- **Fetched documents:** Content-Type exactly one of `activity+json`, `activity+json; charset=utf-8`, or `ld+json` with
+  the profile; and `id` equals the URL fetched.
+- **Addressing:**
+  - Create, Update, Lock, Delete and Block **must carry both `to` and `cc` arrays**.
+  - A post's community is the first Group found in `to` ∪ `cc`.
+  - In a public community, the object, the activity **and the Announce** all include Public.
+- **Accepted types:** Page, Article, Note, Video and Event become posts. **`Question` is dropped.**
+- **Anti-spam:** activities for a community are accepted only if a local user follows it.
+- **Actors:** a Create, vote, moderation action or Flag must come from a Person, Service or Organization. **A Group or
+  Application actor fails to parse**, so moderation comes from the moderator Person. Our Flags, sent by an
+  Application instance actor, probably fail *(unconfirmed)*.
+- **Flags:** exactly one `to` (community or site); `object` a URL or an array; the reason in `summary` or `content`.
+- **Moderation trust:** an action is trusted when it is on the community's or the object's host (FEP-fe34), or when its
+  actor is in the moderators list Lemmy fetched.
+- **1.0 hides a local user's post or comment in a remote community until that community Announces it back.** A
+  community we host must therefore announce to the author's own instance too.
+- **Refused:** Lemmy does not accept an incoming `Announce(Page)`.
+
+**Gaps**
+
+| Gap | P | Client surface |
+|---|---|---|
+| `Dislike` and its `Undo`: a vote ledger per object (actor, ±1, activity, relaying group, time) | P1 | `favourites_count` = upvotes; own `privapub.vote{score, up, down, mine}`, `POST …/vote` |
+| Announces of activities other than Create (votes, moderation): trust the inner activity when the object's own group signed the Announce; refetching every vote does not scale. Keep the origin refetch for Create and Update. | P1 | — |
+| Moderation state: removals (reason, by, at, cascade), locks, bans with `endTime`/`removeData`, featured, moderators, `Update{Group}` by a moderator | P1 | removed posts hidden plus `privapub.removed`; `privapub.locked` (replying answers 422); pins as `pinned=true` |
+| Link posts: keep `Link.href`, the thumbnail `image` and alt text; build the card (Lemmy sends no title or description for the link) | P1 | `Status.card` |
+| `ChatMessage` in and out (out only to Lemmy < 1.0 and Mbin; `Note` to everyone else) | P1 | `visibility: direct` |
+| Outbound shape for Lemmy: both `to` and `cc`; the community in `to`; Public in the object, Create and Announce; votes and comments sent to the community inbox | P1 | — |
+| Communities we host: announce to every follower instance including the author's; pick `Announce(object)` per peer by NodeInfo (as PieFed does) | P1 | — |
+| Flags from a `Service`-typed reporter actor with `to: [community]`; the reporter stays anonymous | P2 | — |
+| `Warn` → `moderation_warning` notification; `Resolve{Flag}` | P2 | AccountWarning |
+| Remote communities: `description`, `language[]`, private (`locked`), `discoverable`; post tags | P2 | `Account.locked`, own `privapub.flairs[]` |
+| Serve our communities' collections the way Lemmy reads them: inline outbox of `Announce{Create{Page}}`, inline featured Pages, inline moderators. Lemmy does not page. | P2 | — |
+| `Feed` actors | P2 | group-like account |
+| Read 1.0 `context`, grouped by root post; cross-post detection by URL | P3 | — |
+
+### PieFed 1.7.17 and Mbin 1.10.1
+
+- **PieFed sends Lemmy's set plus:**
+  - posts: `commentsEnabled`, `stickied`, `nsfl`, `genAI`, `searchableBy`, `canQuote`;
+  - galleries of several Documents;
+  - **polls in communities** (`Question` with `votersCount`), and Mobilizon-style `Event`s;
+  - flairs in two dialects;
+  - comments: `repliesEnabled` (comment lock), `answer`, plus custom `ChooseAnswer` and `PollVote` activities;
+  - `Move{object: post}` between communities;
+  - `Feed` actors;
+  - emoji Likes and `EmojiReact` count as upvotes.
+- **How PieFed formats what it sends us:**
+  - It **chooses the format by our NodeInfo software name**, so keep that accurate.
+  - Software it lists as microblogs gets a bare `Announce(URL)`.
+  - A poll vote is recognised only when it is a `Note{name, inReplyTo}` **without `published`**.
+  - Batched Announces (FEP-1a11) go only to PieFed and Pylova.
+- **Mbin:**
+  - Thread `summary` is "short title + tags", so it is **not a CW**.
+  - On link threads `source` is a **plain URL string**.
+  - `commentsEnabled` and `stickied` are sent.
+  - A Person's `Announce` counts as an upvote; Mbin reads the `likes`/`dislikes`/`shares` counts we publish.
+  - Private messages are `ChatMessage`.
+  - The magazine outbox is empty.
+  - Mbin also auto-ingests Mastodon posts by hashtag and Announces them.
+- **Gaps:**
+  - **P1:** Lemmy's P1 set, W2, and tolerating `source` as a string.
+  - **P2:** galleries; community polls (vote without `published`); post `Move`; `repliesEnabled`; `nsfl`; flairs;
+    publish `likes`/`shares` totals.
+  - **P3:** `genAI`; accepted answers; batched Announces.
+
+### NodeBB 4.16, Discourse, Friendica
+
+- **NodeBB:**
+  - A topic's first post is an `Article` with `name`, **`summary` = an excerpt** and `preview`; replies are Notes.
+  - Categories are `Group`s **without `followers`**.
+  - `context` is a paged collection with an **ETag digest**; NodeBB refetches with `If-None-Match`.
+  - Since 4.15, an Announce of anything but a Create or a plain object is accepted only from Group actors.
+  - It sends `Move`/`Remove` of a whole context (FEP-f15d) and `Add{post → context}` (FEP-11dd).
+- **Discourse** (plugin, semi-dormant): categories and tags are Groups. "Full Topic" mode makes the topic an
+  OrderedCollection used as `context`.
+- **Friendica** (2026.05-1):
+  - Group accounts relay with `Announce(object)`.
+  - Titled posts are `Page`/`Article`; it sends `Dislike`.
+  - `instrument{Service}` names the software.
+  - It sends **`Follow` with a post as the object**, meaning "include me in this thread". Answer that with `Reject` or
+    ignore it, without an error.
+- **Gaps:**
+  - **P1:** W2 for NodeBB Articles (`privapub.excerpt`).
+  - **P2:** Groups without `followers`; Announces from an Application; context Move/Remove; paged `context` with ETag;
+    Friendica's thread-Follow.
+
+### PeerTube 8.3.1 (2026-09-28)
+
+**Emits**
+
+The account sends `Create{Video}`; the channel (a Group) sends `Announce{Video}`, so deduplicate.
+
+| Part of the Video | What it holds |
+|---|---|
+| Attribution | `attributedTo: [Person, Group]` (both, possibly bare URLs); `audience` = the channel |
+| Description | Markdown in `content` with `mediaType: text/markdown`; `summary` is the CW (since 7.2) |
+| `url[]` | A `text/html` watch page; per-resolution mp4 Links (`height`, `width`, `fps`, `size`, ffprobe codec types); HLS `application/x-mpegURL` (since 6.3 audio and video can be separate, with "0" as the audio-only resolution); torrent and magnet; a metadata JSON |
+| Images | `icon[]`: thumbnails up to 1920 px; `preview`: storyboards |
+| Captions | `subtitleLanguage[]` with VTT and HLS URLs |
+| Chapters | `hasParts` |
+| Playback and metadata | `duration` (ISO 8601), `views`, `state`, `isLiveBroadcast`, `permanentLive`, `latencyMode`, `commentsPolicy`, `downloadEnabled`, `category`, `licence`, `language`, `support`, `uuid`, `embedUrl`, `originallyPublishedAt`, `schedules`, `aspectRatio` |
+| Sensitivity | `SensitiveTag` |
+
+- **Value meanings:**
+  - **Live now** means `isLiveBroadcast && state == 1`.
+  - `commentsPolicy`: 1 open, 2 closed, 3 needs approval.
+- **Other activities:**
+  - Comments are Markdown Notes.
+  - `View` comes from the server's Application actor.
+  - `Dislike`; `ApproveReply` (FEP-5624, since 6.2); `CacheFile` (mirrors); playlists.
+
+**Expects**
+- **Replies** must:
+  - be Public;
+  - have non-empty `content`, a valid `url` and `published`;
+  - have an `id` on the actor's host;
+  - have an `inReplyTo` that resolves to the video or one of its comments.
+- `commentsPolicy` 2 rejects replies; 3 holds them until approved.
+- PeerTube signs its fetches.
+- It drops followers that have been unreachable for about 7 days (8.2).
+
+**What Mastodon does with it:** `<h2>name</h2>` + summary + link. The description is dropped and there is no
+attachment. The player is a card whose iframe loads from the remote host, which our proxy rule forbids.
+
+**Gaps**
+
+| Gap | P | Client surface |
+|---|---|---|
+| Store the whole Video: variants, thumbnails, storyboards, captions, chapters, duration, live state, views, `commentsPolicy`, licence, category, language, support, channel | P1 | own `privapub.video` |
+| Play through the proxy: a `MediaAttachment{type: video}` pointing at a proxied muxed mp4 (a `web-video` file, or a fragmented file whose codec types include both audio and video); `preview_url` = a ~560 px `icon`; `meta.original` with width, height, `frame_rate`, `duration` | P1 | `media_attachments` |
+| The proxy answers **Range** requests and rewrites HLS playlists and caption URLs to proxied ones. A 720p file is about 0.9 GB, so stream it; never buffer. | P1 | — |
+| A video card made from the object, **without** a remote iframe | P1 | `Status.card{type: video}` |
+| Reply rules: closed when `commentsPolicy` is 2; replies sent Public with a `url`; `ApproveReply` shows our reply as pending | P1 / P2 | own |
+| Dislike counts; live state through `Update`; chapters and captions | P2 | own |
+| Optionally, `View` sent from the instance actor (so it never names a persona) | P3 | — |
+
+### Loops (1.0.0-beta.14) and Pixelfed (0.14.4)
+
+- **Loops:**
+  - A video is a Note with one mp4 `Document` whose `url` is a string. **The poster is in the object's `preview`.**
+    Videos are vertical.
+  - Its interactionPolicy follows GoToSocial's model.
+  - It sends `QuoteRequest` and `FeatureRequest`.
+  - A top-level post it accepts must be a Note with an mp4 attachment, from an instance its admin allowlisted, **≤ 100 MB,
+    checked with a HEAD request**. Our media must answer HEAD.
+- **Pixelfed:**
+  - Posts are a Note with attachments.
+  - It also sends `location: Place{name, latitude, longitude, country}`, `commentsEnabled`, `capabilities`, and
+    `canQuote` (0.14).
+  - Stories are `Add{Story}` with a bearcap only Pixelfed understands.
+  - Pixelfed 0.14 does FEP-044f and FEP-8fcf.
+- **What Pixelfed accepts:**
+  - Only `Note`s, and **a top-level post must have media**.
+  - **Every** attachment must be a Document or Image with a string `url` and a `mediaType` in the instance's list. The
+    default list is **jpeg, png and gif only**, and a single webp or avif attachment rejects the whole post.
+- **Gaps:**
+  - **P1 outbound:** keep JPEG/PNG renditions with an explicit `mediaType`.
+  - **P1 inbound:** Loops' `preview` poster.
+  - **P2:** Pixelfed `location` → own `privapub.place`, display only and never re-federated; `commentsEnabled: false`
+    disables replies.
+  - **P3:** ignore `Add{Story}` without an error; answer `FeatureRequest` with `Reject`.
+
+### Long-form: WordPress plugin 9.3.1, Ghost 6, WriteFreely 0.17.2
+
+FEP-b2b8 (draft) describes the shape: plain-text `name`, a `summary` teaser (≤500), full HTML `content`, `image`, and
+a `preview` Note fallback.
+
+- **WordPress:**
+  - Object type: an Article for a titled post, a Page for a page, otherwise a Note.
+  - Fields: `image` (the featured image), `preview`, `interactionPolicy.canQuote`.
+  - A CW is `sensitive` + `summary` + `dcterms:subject`.
+  - `id` is `?p=123`, different from `url`.
+  - The blog actor is a Group with `attributionDomains`.
+  - It sends an `Update` on every save, and **signs with RFC 9421 first** (9.3.0), falling back to draft-cavage after
+    any 4xx.
+  - It drops followers-only replies.
+- **Ghost 6** (its ActivityPub service is separate, built on Fedify):
+  - Article with `image` as a bare string and `preview`; members-only parts removed.
+  - It refetches every object signed, **never applies remote Updates**, and accepts only Note and Article.
+  - Public is addressed as `as:Public`.
+- **WriteFreely:** Article when the body has a paragraph break. **`preview` reuses the Article's id**, so never store
+  it as its own post. It has no comments.
+- **Gaps:**
+
+| Gap | P | Client surface |
+|---|---|---|
+| An Article shown in the Mastodon API: `content` = name + teaser (`summary`, else `preview.content`) + a link to `url`; a card made from the object (title, description, `image` then `icon`, author, provider, date) | P1 | `Status.content`, `Status.card` |
+| The full sanitised HTML kept for a reader view | P1 | own `privapub.article{title, html, cover, excerpt}` |
+| Body images duplicated in `attachment` removed; `attributedTo` arrays resolved to the Person | P2 | — |
+
+### Events: Mobilizon 5.2.4, Gancio 1.28, Friendica/Hubzilla/Forte
+
+FEP-8a8e (draft) is the common reference.
+
+- **Mobilizon:**
+  - Times and status: `startTime`, `endTime`, `timezone`, `status`/`ical:status`, `isOnline`, `draft`.
+  - Place: `location: Place{address: PostalAddress, latitude, longitude}`.
+  - Participation: `joinMode`, `participantCount`, `maximumAttendeeCapacity`, `remainingAttendeeCapacity`,
+    `anonymousParticipationEnabled`.
+  - Comments: `repliesModerationOption`, `commentsEnabled`.
+  - Other: `category`, `contacts`.
+  - Attachments: the online link `Link{name: Website}`; `PropertyValue`s under `mz:` keys; a banner `Document`.
+  - The event is attributed to the Group.
+  - **RSVP:** `Join{object: event}` with a stable id that can be fetched; Mobilizon answers `Accept` or `Reject`;
+    `Leave`.
+- **Gancio:** a single Application actor; `location` is an **array** of `VirtualLocation` and `Place`; no RSVP.
+- **Friendica, Hubzilla:** RSVP with `Accept`/`Reject`/`TentativeAccept`. Hubzilla creates events as `Invite{Event}`,
+  with HTML in `location.content`, and `-00:00` for floating times.
+- **FEP-8a8e:** a server that does not handle joins answers `Join` with `Ignore`.
+- **Gaps:**
+
+| Gap | P | Client surface |
+|---|---|---|
+| Store times, time zone and place in every one of those shapes; RSVP routing (W6); `Invite{Event}`; answer `Join` with `Ignore` until RSVP exists | P1 | `content` = title + "date (zone) · place" + link; card with the banner |
+| Capacity, join mode, online link, status, category | P2 | own `privapub.event` |
+| RSVP out (`Join`/`Leave`, stable ids), from the persona the user chose | P2 | own `…/rsvp` |
+
+### Audio: Funkwhale 2.0.11, Castopod 1.15.5, Owncast 0.3.0
+
+- **Funkwhale:**
+  - `Create{Audio}` whose `url` is an array: a page link plus the stream, with `bitrate` and `size`.
+  - Also `duration`, `position`, `disc`, `album`, `license` and `image`; `summary` is a hashtag line (W2).
+  - `Listen{Track}`.
+- **Castopod:** an episode arrives as a link-only Note; the player comes from OpenGraph/oEmbed. Fetching the episode
+  with the podcast type gives a `PodcastEpisode` with transcript and chapters.
+- **Owncast:** a `Service` actor; "go live" is a Note with a thumbnail.
+- **Gaps:**
+  - **P1:** pick the audio Link out of `url`, sniff its type, apply W2. Surfaces as `MediaAttachment{type: audio}`
+    with `meta.original.duration` and the cover as `preview_url`.
+  - **P2:** duration, cover, album, position and licence (own `privapub.audio`); the Castopod transcript and chapters.
+  - **P3:** `Listen` history; Owncast live state.
+
+### Books: BookWyrm 0.9.3, NeoDB 0.19.4
+
+- **BookWyrm:**
+  - **To non-BookWyrm servers** it sends a review as an `Article` named `Review of "Title" (★★★★): …`, a comment or
+    quotation as a Note with the citation appended, and the cover as a `Document`.
+  - The fields `inReplyToBook`, `rating` and `quote` go only to BookWyrm servers.
+- **NeoDB:** `relatedWith[]` carries the item, the rating (out of 10), the review and the shelf; `tag[]` holds catalogue
+  items (`{type: "Movie", href, name, image}`).
+- **Gaps:**
+  - **P1:** keep the Article `name`, `tag` entries that are not Mention or Hashtag, and covers that have no blurhash.
+  - **P2:** keep `relatedWith`, `rating` and `inReplyToBook` raw; a card for the item; own
+    `privapub.review{item, rating, scale}`.
+
+### Threads, Flipboard, Bluesky via Bridgy Fed
+
+- **Threads:**
+  - **Unsigned GETs answer 404**, so fetch it signed, as our instance actor.
+  - Quotes arrive as `_misskey_quote` + a FEP-e232 tag + an `RE:` fallback.
+  - Polls are not federated.
+  - Threads users must be 18 or over, opt in, and live outside the EU.
+  - Threads blocks servers that ignore deletes or have no privacy policy.
+  - **P1:** process `Delete` promptly; publish a privacy policy and a minimum age.
+- **Flipboard:**
+  - Each flip is a link-only Note: headline, a link with `utm_*` parameters, and a Mention of the magazine.
+  - Magazines are Groups that `Announce` bare URIs.
+  - **P1:** fetch objects that arrive as bare-URI Announces (we do).
+  - **P2:** a card, or the post reads as a bare headline; deduplicate by canonical URL with `utm_*` stripped.
+- **Bridgy Fed:**
+  - Actors are `https://bsky.brid.gy/ap/did:plc:…`, with handles like `@x.bsky.social@bsky.brid.gy` (**dots in the
+    user part**). `alsoKnownAs` holds `did:` values; there is no `published` and the outbox is empty.
+  - Posts: a `url` array with an `at://` canonical link (W1); **media without `mediaType`** (W4); link embeds flattened
+    into `content`; video thumbnails in `image`; long-form as Article.
+  - **Bridging a persona:**
+    - opt-in, by following the bot;
+    - the persona needs an `icon` and must be at least 7 days old;
+    - only public posts are bridged;
+    - **opting out takes a `Block` sent to the bot**, which we never send today.
+  - **Privacy note:** two personas created on the same day share the same day-truncated `published`. That is weak,
+    but a link.
+- **P2:** `Account.created_at` fallback; the Bridgy opt-out Block (see §6).
+
+## 4. What the rich client needs from the server
+
+The rule: **never drop what arrived; keep it typed where we understand it and raw where we don't.** The Mastodon API
+keeps working for existing apps. Everything it cannot express goes under a `privapub` object on the same entities,
+following the precedent of `pleroma.*` and `akkoma.*`, plus a few endpoints of our own.
+
+### 4.1 One post, many kinds
+
+`Post` gains a `Kind` and one typed payload per kind.
+
+| Kind | From | Typed payload | Mastodon API view | `privapub.*` |
+|---|---|---|---|---|
+| note | everyone | — | as today | `source` (Markdown/MFM/BBCode), per-attachment `sensitive` |
+| article | WordPress, Ghost, WriteFreely, NodeBB, BookWyrm, Bridgy | title, excerpt, cover, full HTML, `preview` | content = title + excerpt + link; card from the object | `article` (reader view) |
+| video | PeerTube, Loops, Bridgy, Owncast | variants, HLS, poster, storyboards, captions, chapters, duration, live state, licence, channel | proxied `video` attachment + card | `video` |
+| audio | Funkwhale, Castopod | stream variants, cover, duration, album, position, licence, transcript, chapters | `audio` attachment | `audio` |
+| event | Mobilizon, Gancio, PieFed, Friendica, Hubzilla, CherryPick | start, end, zone, place, online link, join mode, capacity, status | text + card | `event` (+ RSVP) |
+| poll | Mastodon, Misskey, Pleroma, GoToSocial, PieFed | options, counts, multiple, end, closed, voters | `poll` | — |
+| link | Lemmy, PieFed, Mbin, Flipboard, Mastodon 4.7 | href, thumbnail, alt, author | `card` | `link` |
+| review | BookWyrm, NeoDB | item, rating, scale, shelf | text + card | `review` |
+| page / thread | Lemmy, PieFed, Mbin, NodeBB | title, community, flair, lock, removal, score | content + `card` for links | `thread{community, flairs, locked, removed, score, distinguished}` |
+
+These cut across every kind:
+
+| Feature | Mastodon API | `privapub.*` |
+|---|---|---|
+| Quote | `quote{state, quoted_status}` | the URI when it could not be fetched |
+| Emoji | `emojis` | — |
+| Reactions | `emoji_reactions` (and `pleroma.emoji_reactions`) | — |
+| Votes | — | `vote{score, up, down, mine}` |
+| Interaction policy | GoToSocial-style `interaction_policy` | — |
+| Edit history | `edited_at`, `/history` | — |
+
+### 4.2 Linking things together
+
+Every reference is kept as a URI even when the target could not be fetched: the parent, the quoted post, the
+community, the channel, the book, the original `url`. The client can then link out where it cannot embed. This
+follows the `akkoma.in_reply_to_apid` / `akkoma.quote_apid` precedent.
+
+A link opens `url` (W7), never `id`. Media and thumbnails only ever go through the proxy, so the client never contacts
+a remote host.
+
+### 4.3 Details view ("nerd stats")
+
+`GET /api/privapub/v1/statuses/:id/provenance` (and the same for accounts):
+
+| Group | Fields |
+|---|---|
+| Raw | The object exactly as received, with its hash. Every later refetch and `Update`, with timestamps. The `@context` as sent (the namespaces show `toot`, `misskey`, `litepub`, `lemmy`, `pt`, `mz`, `gts`, `fedibird`, …). |
+| Path in | How it arrived: direct Create, inbox forward, Announce (and by whom: community, channel, magazine, relay), backfill, or fetch on demand. Delivered to the personal or the shared inbox. |
+| Trust | Signature scheme: draft-cavage (algorithm string, signed headers, query signed or not), RFC 9421, FEP-8b32 proof, or verified by refetch from origin. Key id and key type. LD signature present but ignored. |
+| Time | `published`, `updated`, received, and their gaps (backdated posts, clock skew). |
+| Extensions | Detected from properties: 044f `quote`, `interactionPolicy`, 7888 `context`, 8b32 `proof`, 521a `assertionMethod`, 8967 Link attachment, c16b `htmlMfm`, `_misskey_*`, `searchableBy`, `formerRepresentations`, FEP-1b12 `audience`. |
+| Origin | Software and version from NodeInfo, with a family. This is for display only: FEP-0151 says the names are opaque, so never branch on them except where a peer does the same to us (PieFed). |
+| Media | Variants with codec, fps, size and bitrate; infohashes, magnets and mirrors; licence. |
+| Counts | Remote likes, boosts, views, downloads and dislikes as last seen, with the time. |
+| Interactions | Policy as received, defaults applied, approval state, authorization URIs. |
+| Moderation | Removals, locks and bans as received from a community, with reasons. |
+
+`GET /api/privapub/v1/instances/:host` returns cached NodeInfo (`metadata` extras: Misskey `themeColor`/`maxNoteTextLength`,
+Pleroma `features[]`/`federation.mrf_policies`), the instance API's icon and description, the delivery health our
+circuit breaker sees, and which signature scheme worked.
+
+`software.name` → family, for display:
+
+| Family | `software.name` values |
+|---|---|
+| Mastodon | mastodon (glitch-soc shows `+glitch` in the version), hometown, fedibird, kmyblue |
+| Misskey | misskey, sharkey, cherrypick, iceshrimp, firefish, foundkey, catodon |
+| Pleroma | pleroma, akkoma |
+| Microblog | gotosocial, takahe, hollo, mitra, snac, smithereen, ktistec, wafrn, bonfire, friendica, hubzilla, streams/forte |
+| Threadiverse | lemmy, piefed, mbin, kbin, lotide, nodebb, discourse |
+| Media | peertube, pixelfed, loops, funkwhale, owncast, vernissage, castopod |
+| Publishing | wordpress, ghost, writefreely, plume |
+| Events | mobilizon, gancio |
+| Other | bookwyrm, neodb, forgejo |
+| Bridges and relays | bridgy-fed, activityrelay |
+
+## 5. Signatures, identity and transport
+
+| Topic | State on 2026-10-01 | PrivaPub | P |
+|---|---|---|---|
+| RFC 9421 inbound | Mastodon accepts since 4.5. WordPress and Fedify sign with it first. GoToSocial, the Misskey family, Akkoma, Pleroma and Bridgy do not. | Verify RSA and Ed25519; `content-digest` (RFC 9530); one signature; `created` and `keyid` | P2 |
+| RFC 9421 outbound | Mastodon 4.7 double-knocks | draft-cavage first; RFC 9421 after a 401; remember per host | P2 |
+| 400 vs 401 | A 400 or 401 makes Mastodon 4.7 and WordPress retry with the other scheme | 401 only for signature failures (we do this); 400 only for bodies that are really malformed | P1 (keep) |
+| Temporary key failure | Mastodon answers 503 | We should answer 503 too, and treat a 503 as a retry in delivery | P2 |
+| Keys | `publicKey` can be an array (Mastodon 4.6). FEP-521a `assertionMethod` Multikey is FINAL (Ed25519 `z6Mk…`). GoToSocial key ids have no `#` and point at a stub. | Read all of these | P2 |
+| Integrity proofs | FEP-8b32 `eddsa-jcs-2022`: JCS, no JSON-LD. Sent by Mitra, Streams, Hubzilla, Fedify and others; Mastodon verifies them from 4.7 | Verify, so relayed or forwarded objects need no refetch | P2 |
+| LD signatures | Mastodon still sends `RsaSignature2017` | Ignore, and refetch from origin (we do) | — |
+| Query string | GoToSocial, Akkoma 3.20 and Misskey 2026.10 sign it; GoToSocial retries without it | Verify both ways | P1 |
+| `hs2019` | The algorithm comes from the key; some senders hash with SHA-512 | Try rsa-sha256, then sha512 | P2 |
+| Move (FEP-7628, FINAL 2026-08-26) | See Mastodon | Inbound P1; outbound per persona P3 (never link personas) | P1 / P3 |
+| Followers sync (FEP-8fcf) | Mastodon, Pixelfed, Fedify and WordPress | Send and honour `Collection-Synchronization`. It protects followers-only posts. | P2 |
+| Instance actor discovery | FEP-d556 (FINAL), FEP-2677 | Publish both | P3 |
+| Relays (FEP-ae0c, FINAL) | Mastodon-style relays forward LD-signed Creates; LitePub-style relays Announce. GoToSocial 0.22 subscribes to relays. | Client for both styles; refetch or check an integrity proof. This is how a small server sees beyond its follows. | P2 |
+| FASP | Mastodon 4.4+, behind a flag. Its data sharing pushes content to a third party. | Do not join the data sharing; maybe consume search and trends | P3 |
+| Search consent | `indexable` (missing = false), `discoverable`, `searchableBy` (FEP-268d, which takes precedence) | Honour all three; emit explicit `false` per persona | P2 |
+
+## 6. Choices the privacy design has to make
+
+These change what PrivaPub reveals, so they are the owner's calls, not implementation details. **All six were decided on
+2026-10-01; the decisions are in `docs/ROADMAP.md`, "Owner decisions on what PrivaPub reveals".** In short:
+1. pages are fetched by the server for public posts;
+2. blocks federate;
+3. website authorship stays off;
+4. PeerTube views are never sent;
+5. Bluesky bridging is per persona, with persona dates randomised;
+6. a one-time notice before the first reaction or vote.
+
+The options as they were laid out:
+
+1. **Link previews.**
+   - Building a card from the object, or from FEP-8967 `preview` data, fetches nothing; we do that.
+   - Fetching the linked page tells that site our server read the link. Cache per URL across personas, so no fetch
+     ties a page to one persona; add jitter.
+   - Proposed admin switch: *off / from the object only / fetch*.
+2. **Outbound Block.**
+   - Blocks are never sent today.
+   - Bridgy Fed's opt-out *requires* one, and Mastodon, GoToSocial and Misskey federate blocks as a matter of course.
+   - Proposal: never by default; an explicit per-persona "tell their server" option.
+3. **`attributionDomains` / `fediverse:creator`.** It ties a persona to a website. Opt-in per persona only.
+4. **PeerTube `View`.** Counting a view tells the origin a video was watched. If ever, send it from the instance actor.
+5. **Bridging to Bluesky.** It is per persona; each persona needs its own avatar and 7 days of age. Same-day personas
+   share a `published` day.
+6. **Emoji reactions and votes** are public by nature on every platform that has them. The client should say so
+   before the first one.
+
+## Sources
+
+The full source lists, with versions and dates, were gathered by five research passes on 2026-10-01. The primary
+ones:
+
+| Area | Sources |
+|---|---|
+| Mastodon | `CHANGELOG.md` (4.3.0–4.7.2); docs.joinmastodon.org (`spec/activitypub`, `spec/security`, `spec/webfinger`, `client/quotes`, `client/collections`, entities); the `main` source (`note_serializer.rb`, `activity/{create,update,accept,delete,quote_request,move,like,flag}.rb`, `status_parser.rb`, `media_attachment_parser.rb`, `fetch_link_card_service.rb`, `verify_quote_service.rb`, `fetch_all_replies_service.rb`, `signed_request.rb`); developer posts for 4.5, 4.6 and 4.7; GHSA-vwhj, GHSA-rwcw, GHSA-vg36; issue #39997 (spam, July 2026) |
+| GoToSocial | Codeberg releases 0.18.0–0.22.1; `docs/federation/*` (`interaction_controls`, `posts`, `actors`, `http_signatures`, `access_control`); `internal/typeutils`, `internal/ap`, `internal/federation`, `internal/transport`; issues #4939, #1894, #4994, #4849, #4677 |
+| Misskey family | misskey-dev/misskey develop `ed9654b` (`ApRendererService`, `ApInboxService`, `ApNoteService`, `ApAudienceService`, `ReactionService`, `check-against-url`); PR #16250; Sharkey develop `effcecb`; Iceshrimp.NET dev `926fcde` (`FEDERATION.md`, `LdHelpers.cs`, `HttpSignature.cs`, `NoteRenderer.cs`); CherryPick develop |
+| Pleroma, Akkoma | Pleroma develop `cfeca7f` (`transmogrifier.ex`, `inbox_guard_plug.ex`, `ap_extensions.md`); Akkoma develop (`FEDERATION.md`, `CHANGELOG.md`, `nodeinfo_extensions.md`) |
+| Lemmy | LemmyNet/lemmy `main` `f1476db` and tag 0.19.20 (`crates/apub/apub/assets/*` fixtures, `objects/src/protocol/*`, `activities/src/protocol/*`, the pending-post migration); PRs #5856, #6152, #6401, #6409, #6466; issues #6281, #6343, #6346; activitypub-federation-rust `fetch/mod.rs` |
+| Other threadiverse | PieFed `41cccb7` (`FEDERATION.md`, `docs/activitypub_examples`, `docs/fep-1a11.md`); Mbin `cf95b04` (`docs/05-fediverse_developers`); NodeBB `260a0cc` (`src/activitypub/*`); discourse-activity-pub; friendica `FEDERATION.md` |
+| PeerTube | docs.joinpeertube.org/api/activitypub; Chocobozzz/PeerTube develop (`object-to-model-attributes.ts`, `custom-validators/activitypub/*`, `process-*.ts`); live fetches from peertube2.cpy.re, garr.tv (8.2.4), tube.tchncs.de |
+| Pixelfed, Loops | pixelfed dev (`Transformer/ActivityPub/Verb/*`, `Inbox/HandlesCreates.php`, `Helpers::verifyAttachments`); loops-server main (`FEDERATION.md`, `NoteWithVideoAttachmentValidator.php`) |
+| Long-form, events, audio, books | wordpress-activitypub trunk (`class-post.php`, `class-signature.php`); TryGhost/ActivityPub v1.2.13; writefreely `posts.go`; Mobilizon 5.2.4 converters; Gancio 1.28.2/2.0-beta; Funkwhale 2.0.x; Castopod 1.15.5; Owncast 0.3.0; BookWyrm 0.9.3; NeoDB `docs/internals/activitypub.md` |
+| New entrants | fed.brid.gy/docs and bridgy-fed `activitypub.py`; live probes of threads.net, flipboard.com and bsky.brid.gy; engineering.fb.com (2024-03-21) |
+| FEPs | codeberg.org/fediverse/fep at 2026-09-30: 044f, 1311, 1a11, 1b12, 2345, 268d, 2c59, 4f05, 521a, 5624, 5feb, 7458, 7628, 7888, 7aa9, 844e, 8967, 8a8e, 8b32, 8fcf, 9098, 9967, ae0c, b2b8, c0e0, c16b, d556, e232, ef61, f15d, f228, fb2a, fe34 |
+| Signatures | SWICG "ActivityPub and HTTP Signatures" report and its RFC 9421 adoption tracker; SocialHub "RFC 9421 HTTP signatures in 2026" (Jan 2026) |

docs/ROADMAP.md

@@ -9,8 +9,11 @@ Written 2026-10-01 from the original 2023 code, the decePubClient UI, a federati
 - [x] P1.2 Social graph and timelines: v1.3.0, deployed and verified 2026-10-01
 - [x] P2 Mastodon client API: v1.4.0, deployed 2026-10-01; OAuth and the anonymous API verified on production, the signed-in API verified locally (no real-client login on production yet)
 - [x] P3 Social features: v1.5.0, deployed 2026-10-01; media, proxy, blocks, mutes, bookmarks, pins and reports verified by tests and locally (no upload on production yet)
-- [ ] P4 Groups and privacy features
+- [x] P4 Groups and privacy features: v1.6.0, deployed 2026-10-01; communities, circles and local-only located posts verified by tests. v1.6.1 adds the pasture (`tools/pasture/`): live interop with GoToSocial 0.22.1 passes all 25 checks, three runs in a row. Lemmy and a live Mastodon circle member are not run yet; the pasture has GoToSocial only
-- [ ] P5 FEPs and polish
+- [x] P5 Lose nothing: v1.7.0 to v1.9.1, deployed 2026-10-01; parsing, typed details, provenance, downvotes, tombstones, federated blocks, all checked live against GoToSocial. Book reviews and forum threads keep their raw form only (typed in P7 and P8)
+- [ ] P6 Emoji, polls, quotes, reactions, cards, players
+- [ ] P7 Threads, communities, moderation, the social graph
+- [ ] P8 Signatures, discovery, the long tail
 
 ## Intent
 
@@ -115,6 +118,17 @@ and circles (see Owner decisions).
 | Location-ranged posts | **Local only, never federated.** Shown to local users within the radius, with coordinates rounded on storage. |
 | Groups | **Per group, two kinds.** A *community* federates per FEP-1b12, Lemmy-compatible: it Announces the activity, uses `audience`, and accepts posts from non-followers. A *circle* is invitation-only: posts are addressed to the members collection, and objects are served only to signed requests from members. |
 
+### Owner decisions on what PrivaPub reveals (2026-10-01, from `docs/INTEROP.md` §6)
+
+| Question | Decision |
+|---|---|
+| Link previews | **The server fetches the linked page itself.** It does this only for public posts, after a short random delay, once per link for the whole server (a shared cache, so a fetch never points at one persona), and when the post arrives, never when someone reads it. Cards built from the post's own data are used first. The client never contacts the site. |
+| Blocks | **Federated.** A persona's block is sent to the blocked account's server as `Block`, and an unblock as `Undo{Block}`. Their server enforces it too, and they can learn they were blocked. This replaces the earlier "blocks never federate" rule. |
+| Website authorship (`attributionDomains`, `fediverse:creator`) | **Off.** It is never emitted, not even as a per-persona option, because it would publicly tie a persona to a website. |
+| PeerTube views | **Never sent.** The remote video file is still downloaded through our proxy when it is played; that cannot be avoided without pre-downloading video. |
+| Bluesky bridging (Bridgy Fed) | **Allowed per persona**, with a clear warning that the posts become far more widely copied. Leaving the bridge must work, through a federated `Block` sent to the bridge. Persona creation dates are moved back by a random number of days, so personas created the same day no longer share a date. |
+| Reactions and votes | **Public, with a one-time notice.** The client tells each persona once, before its first reaction or vote, that these are public and visible as that persona. |
+
 ## Libraries (researched; no maintained .NET ActivityPub library exists, so Letterbook and Iceshrimp.NET both wrote their own)
 
 | Area | Choice |
@@ -386,28 +400,132 @@ The first refactor commit is a pure move with namespaces only. Logic changes fol
 - **Persona hardening:** optionally re-key existing avatar ids; an optional `SecureMode` (signed GETs required); no
   suggestions or directories that could relate sibling avatars.
 
-### P5 FEPs and polish (ongoing)
+### P5 and beyond: rich content and the rest of the fediverse
-- **FEP-8fcf:** followers synchronisation.
+
-- **FEP-5feb:** honour remote `indexable` in search.
+Rewritten on 2026-10-01 from the research in `docs/INTEROP.md`, which holds the per-platform evidence and the
-- **FEP-7628:** Move in both directions, plus editing `alsoKnownAs`.
+priorities. The goal is a future client that shows and links every kind of fediverse content in one place, with a
-- **FEP-044f:** quotes and `interactionPolicy`.
+details view of where each object came from. So the server keeps everything it receives: typed where it understands
-- **RFC 9421:** inbound verification with NSign, plus Content-Digest.
+it, raw where it doesn't.
-- **Mastodon API extras:** polls, the streaming WebSocket (nginx Upgrade headers), Web Push (VAPID), and grouped
+
-  notifications v2, after which the advertised version moves to 4.3.
+#### P5 Lose nothing (wire tolerance and full objects)
+- **Cheap fixes that were wrong** (done in v1.7.0):
+  - `summary` is a content warning only on a `Note`/`Question`, or when `sensitive` is set; elsewhere it is an excerpt
+    (INTEROP W2). Remote titles now show in the Mastodon API for non-Note objects.
+  - Persona usernames match Mastodon's and Misskey's pattern (groups already did).
+  - Every term we emit is defined in our JSON-LD context.
+  - `Vary: Accept`.
+  - Not done on purpose: see "Deliberately not done" below.
+- **Owner decisions that were small** (done in v1.7.0): blocks federate (`Block`, `Undo{Block}`); a persona's and a
+  group's `published` is a random day up to two weeks before its creation (migration `_007`).
+- **Parsing every shape** (done in v1.8.0, `Federation/Objects/ObjectShapes.cs`):
+  - `url`, `icon`, `image`, `attachment` and `attributedTo` as a value, an object or an array (W1).
+  - A Markdown `content` and `source` (W3).
+  - Inferring a missing `mediaType` (W4).
+  - Every thumbnail location (W5).
+  - Language from `@context` (W11); alt text from `summary` (W12).
+  - A null `id`, a 200 `Tombstone`, a `Delete` before its `Create` (W9, W13).
+- **Typed payloads** (done in v1.8.0 for link, video, audio, event and the cover image; review and thread are still
+  open): `Post.ObjectType` plus `Link`, `Video`, `Audio`, `Event`, `CoverURL` and `Source` (INTEROP §4.1). The Mastodon
+  API view: the title above the body, an event's "when · where" line, a card made from the object without fetching,
+  attachments with their thumbnail and duration. Video and audio playback through the proxy is P6.
+- **Raw capture for the details view** (done in v1.8.0): the object as received, how it arrived, the signature scheme and
+  key, received versus `published`, the extensions detected, and the origin's software (§4.3). Exposed at
+  `/api/privapub/v1/statuses/:id/provenance` and `/api/privapub/v1/instances/:host`. Checked live against GoToSocial.
+- **Routing by object type** (done in v1.9.0):
+  - `Accept`/`Reject` act only on a Follow we sent and ignore any other object (W6); routing to RSVPs and interaction
+    approvals comes with those features.
+  - `ChatMessage` in as a direct message.
+  - `Dislike` and its `Undo` in a downvote ledger, shown with favourites as `privapub.votes`.
+  - A `Join` answered with `Ignore` until RSVP exists.
+  - Friendica's thread-`Follow` is ignored without an error.
+  - A deleted object's id is kept for 90 days (W9), and its `ObjectRecord` is removed with the post.
+- **Typed details reach clients** (done in v1.9.0) as `Status.privapub`.
+- **Delivery:** a 503 with `Retry-After` is waited out like a 429 and no longer counts against the host (done in v1.9.0).
+  We answer 503 with `Retry-After` ourselves when a sender's key cannot be fetched for a temporary reason (v1.9.1),
+  so Mastodon 4.7 retries instead of switching to RFC 9421.
+- **Deliberately not done: dereferenceable `Follow`, `Like`, `Block`, `Accept`, `Reject` and `Undo` ids.** Serving them
+  would publish who follows, likes and blocks whom, which our collections deliberately hide. Every one of them is sent
+  with its object embedded, which is all Misskey needs. `Create` and `Announce` ids do dereference.
+
+#### P6 What people see: emoji, polls, quotes, reactions, cards, players
+- **Custom emoji** on posts, names, fields and poll options, proxied (done in v1.10.0), together with fuller remote
+  profiles: header, fields, locked, published, moved-to, indexable, memorial, image descriptions.
+- **Polls** in and out, with the Misskey, Pleroma and PieFed vote shapes. A count refresh is never an edit (done in
+  v1.10.0; checked live both ways against GoToSocial).
+- **Quotes (FEP-044f):**
+  - read every key; verify `QuoteAuthorization` on all of its fields; handle revocation (done in v1.13.0);
+  - personas quote others: `quoted_status_id`, `QuoteRequest`, `Accept{result}` verified, `Update` with
+    `quoteAuthorization`; legacy quotes for posts that state no policy (done in v1.13.0); `api_versions.mastodon = 7`;
+  - still open: be quotable (`canQuote` on our posts, answer `QuoteRequest`, serve and revoke stamps). It needs a themed
+    route name for stamps, agreed with the owner, and a default quote policy.
+- **Emoji reactions** in all three inbound forms, plus outbound `EmojiReact`, exposed as `emoji_reactions` (done in
+  v1.11.0; Pleroma's `/api/v1/pleroma/statuses/:id/reactions` endpoints and `pleroma:emoji_reaction` notifications).
+- **Link cards** (done in v1.12.0):
+  - from the object, or from FEP-8967 `preview`, without fetching;
+  - otherwise the server reads the page (owner decision 1): public posts only, 0–60 s after arrival, cached per address
+    for 7 days across the whole server, `Federation:FetchLinkPreviews` to switch it off. Checked live against a
+    GoToSocial profile page.
+- **Media:**
+  - video playback through the proxy (Range requests, HLS playlist rewriting, the poster), with a `video` card;
+  - audio attachments;
+  - an article reader view;
+  - JPEG/PNG renditions kept for Pixelfed.
+
+#### P7 Threads, communities and the social graph
+- **Thread backfill:**
+  - read in order: `contextHistory`, then `context` (paged, with ETag), then `replies`;
+  - group by the root post;
+  - publish our own `context` and a paged `replies`.
+- **Lemmy, PieFed and Mbin:**
+  - the moderation set: removals, locks, bans, featured, moderators, `Warn`, `Resolve`;
+  - votes in and out; link posts; flairs; `Feed` actors; community polls; post `Move`;
+  - the outbound shape Lemmy requires;
+  - communities we host announce to the author's own instance too;
+  - Flags from a `Service`-typed reporter actor.
+- **GoToSocial interaction policies:** stored and shown; send `ReplyRequest`/`LikeRequest` where approval is
+  needed; handle `Accept{result}`.
+- **Accounts and follows:**
+  - inbound `Move` with Mastodon's checks;
+  - re-run WebFinger on a rename;
+  - inbound `Block`, plus `Add`/`Remove` of pins;
+  - FEP-8fcf followers sync;
+  - `indexable`/`discoverable`/`searchableBy`;
+  - edit history from `formerRepresentations`;
+  - PeerTube reply rules and `ApproveReply`.
+- **Events:** structured RSVP (`Join`/`Leave` with stable ids).
+
+#### P8 Signatures, discovery and the long tail
+- **Signatures:**
+  - RFC 9421 inbound (RSA and Ed25519, Content-Digest);
+  - outbound double-knock, remembered per host;
+  - `publicKey` arrays and FEP-521a Multikey;
+  - FEP-8b32 proof verification;
+  - `hs2019` with SHA-512.
+- **Discovery:**
+  - a relay client for both relay styles;
+  - instance actor discovery (FEP-d556, FEP-2677);
+  - `implements` (FEP-844e).
+- **Mastodon API:** streaming WebSocket, Web Push, grouped notifications. Then advertise an honest version.
 - **Backfill:** an author's outbox after following them.
-- **Later:** FEP-521a, FEP-8b32, FEP-e232, relays.
+- **Long tail:**
+  - MFM rendering data;
+  - Misskey actor extras;
+  - book reviews (`relatedWith`, `rating`);
+  - Funkwhale and Castopod metadata;
+  - Pixelfed `place` (display only, never re-federated);
+  - Bluesky bridging per persona.
 
 ### Cut or deferred (deliberately)
 - **Cut:**
-  - Link-preview cards: an SSRF and privacy risk.
+  - Link-preview cards *fetched from the linked page* by default. Cards built from the object, or from FEP-8967
+    `preview` data, are in P6; fetching the page is an owner decision (INTEROP §6.1).
   - Translation, trends, directory and lists (filters stay as stubs).
   - Scheduled posts.
   - The Mastodon admin API: moderation stays on `/clientapi`.
   - `POST /api/v1/accounts` registration: avatars are created through `/clientapi`.
   - Local custom emoji.
   - S3 storage.
-  - JSON-LD and LD-signature processing.
+  - JSON-LD and LD-signature processing. FEP-8b32 proofs need neither (JCS), so they are in P8.
-  - Outbound RFC 9421.
 - **Deferred:** video transcoding (remux only for now).
 - **Out of scope:** moving decePubClient onto the Mastodon API.
 
@@ -417,8 +535,10 @@ The first refactor commit is a pure move with namespaces only. Logic changes fol
   `Fixtures/{mastodon,gotosocial,misskey,akkoma,lemmy}/`. Renderers are checked against golden JSON. Inbound
   scenarios run as integration tests on a throwaway mongod.
 - **Interop:** **Fediverse Pasture** runs on the workstation with podman: Mastodon, GoToSocial, Misskey/Sharkey,
-  Akkoma, plus Lemmy for P4. `tools/pasture/docker-compose.privapub.yml` runs PrivaPub with `AllowPrivateNetworks`;
+  Akkoma, plus Lemmy for P4. As built, `tools/pasture/run.sh` runs PrivaPub and GoToSocial behind one Caddy on a
-  startup asserts that flag is false in Production. The matrix, per peer:
+  podman network, with `AllowPrivateNetworks`, `AllowPlainHttp` and `AcceptAnyCertificate`; startup refuses all three in
+  Production. `tools/pasture/interop.sh` drives the matrix for GoToSocial; the other peers are still to be added. The
+  matrix, per peer:
   - follow both ways;
   - public, unlisted, followers-only and direct posts both ways;
   - a reply landing in the remote thread;

tools/pasture/Caddyfile

@@ -0,0 +1,14 @@
+{
+	local_certs
+	skip_install_trust
+}
+
+privapub.test {
+	tls internal
+	reverse_proxy pasture-privapub:80
+}
+
+gts.test {
+	tls internal
+	reverse_proxy pasture-gts:80
+}

tools/pasture/appsettings.Pasture.json

@@ -0,0 +1,33 @@
+{
+	"MongoSettings": {
+		"Database": "PrivaPub",
+		"LogsDatabase": "logs",
+		"ConnectionString": "mongodb://mongo:27017"
+	},
+	"AppConfiguration": {
+		"Version": "0.0.0",
+		"MaxAllowedUploadFiles": 3,
+		"MaxAllowedFileSize": 2097152,
+		"SupportedLanguages": [ "en" ],
+		"BackendBaseAddress": "https://privapub.test",
+		"FrontendBaseAddress": "https://privapub.test",
+		"HashingOptions": { "Iterations": 10101 },
+		"Jwt": {
+			"Key": "pasture-only-key-not-a-secret-pasture-only-key-not-a-secret-0123456789",
+			"Issuer": "http://privapub.test",
+			"Audience": "http://privapub.test",
+			"HoursTimeout": 24
+		}
+	},
+	"Federation": {
+		"AllowPrivateNetworks": true,
+		"AllowPlainHttp": true,
+		"AcceptAnyCertificate": true
+	},
+	"Media": { "Root": "/tmp/privapub-media" },
+	"Kestrel": { "Endpoints": { "Http": { "Url": "http://0.0.0.0:80", "Protocols": "Http1AndHttp2" } } },
+	"Serilog": {
+		"MinimumLevel": { "Default": "Information", "Override": { "Microsoft": "Warning", "System": "Warning" } },
+		"WriteTo": [ { "Name": "Console" } ]
+	}
+}

tools/pasture/interop.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# Drives PrivaPub and GoToSocial (started by run.sh) through each other's federation, as their users would.
+set -uo pipefail
+P=http://127.0.0.1:6971; G=https://gts.test:6443
+gcurl() { curl -k --resolve gts.test:6443:127.0.0.1 "$@"; }
+work=$(mktemp -d); trap 'rm -rf "$work"' EXIT
+pass=0; fail=0
+ok() { echo "  ok   $*"; pass=$((pass+1)); }
+ko() { echo "  FAIL $*"; fail=$((fail+1)); }
+j() { python3 -c "import sys,json
+try: d=json.load(sys.stdin)
+except Exception: d=None
+$1" 2>/dev/null; }
+until_true() { local tries=$1; shift; for i in $(seq 1 "$tries"); do if eval "$@"; then return 0; fi; sleep 2; done; return 1; }
+# GoToSocial's cached home timeline can stop taking new posts after its first read, so a delivery is checked by looking
+# the object up by URI with resolve=false: that answers from GoToSocial's database and never fetches from us.
+on_gts() { gcurl -s -G -H "$GH" "$G/api/v2/search" --data-urlencode "q=$1" -d resolve=false -d type=statuses; }
+
+# --- PrivaPub persona and token
+root=$(curl -s -X POST $P/clientapi/user/signup -H 'Content-Type: application/json' -d '{"userName":"pastureroot","password":"Pasture-Pass-1!"}')
+jwt=$(echo "$root" | j "print(d['token'])"); rootid=$(echo "$root" | j "print(d['userId'])")
+if [ -z "$jwt" ]; then jwt=$(curl -s -X POST $P/clientapi/user/login -H 'Content-Type: application/json' -d '{"userName":"pastureroot","password":"Pasture-Pass-1!"}' | j "print(d['token'])"); rootid=$(curl -s -X POST $P/clientapi/user/login -H 'Content-Type: application/json' -d '{"userName":"pastureroot","password":"Pasture-Pass-1!"}' | j "print(d['userId'])"); fi
+curl -s -o /dev/null -X POST $P/clientapi/avatar/private/insert -H 'Content-Type: application/json' -H "Authorization: Bearer $jwt" \
+	-d "{\"rootId\":\"$rootid\",\"userName\":\"alice\",\"name\":\"Alice of PrivaPub\",\"biography\":\"testing federation\"}"
+app=$(curl -s -X POST $P/api/v1/apps -d 'client_name=pasture&redirect_uris=urn:ietf:wg:oauth:2.0:oob&scopes=read+write+follow')
+cid=$(echo "$app" | j "print(d['client_id'])"); cs=$(echo "$app" | j "print(d['client_secret'])")
+q="client_id=$cid&redirect_uri=urn:ietf:wg:oauth:2.0:oob&response_type=code&scope=read+write+follow"
+xt=$(curl -s -c $work/pj -b $work/pj "$P/oauth/login?returnUrl=/oauth/authorize?$q" | grep -o 'name="__RequestVerificationToken" type="hidden" value="[^"]*"' | sed 's/.*value="//;s/"//')
+curl -s -o /dev/null -c $work/pj -b $work/pj -X POST $P/oauth/login --data-urlencode "returnUrl=/oauth/authorize?$q" --data-urlencode "__RequestVerificationToken=$xt" -d 'userName=pastureroot&password=Pasture-Pass-1!'
+curl -s -c $work/pj -b $work/pj "$P/oauth/authorize?$q&signed_in=1" > $work/choose.html
+form=$(python3 - "$work/choose.html" <<'PY'
+import re,sys,urllib.parse,html
+s=open(sys.argv[1]).read()
+pairs=[(k,html.unescape(v)) for k,v in re.findall(r'<input type="hidden" name="([^"]*)" value="([^"]*)"',s)]
+print(urllib.parse.urlencode(pairs+[("avatarId",re.findall(r'name="avatarId" value="([^"]*)"',s)[0]),("decision","allow")]))
+PY
+)
+code=$(curl -s -c $work/pj -b $work/pj -X POST $P/oauth/authorize --data "$form" | grep -o '<code>[^<]*</code>' | sed 's/<[^>]*>//g')
+PT=$(curl -s -X POST $P/oauth/token -d "grant_type=authorization_code&code=$code&client_id=$cid&client_secret=$cs&redirect_uri=urn:ietf:wg:oauth:2.0:oob" | j "print(d['access_token'])")
+PH="Authorization: Bearer $PT"
+[ -n "$PT" ] && ok "PrivaPub token for alice" || { ko "PrivaPub token"; exit 1; }
+
+# --- GoToSocial token
+gapp=$(gcurl -s -X POST $G/api/v1/apps -d 'client_name=pasture&redirect_uris=urn:ietf:wg:oauth:2.0:oob&scopes=read+write+follow')
+gid=$(echo "$gapp" | j "print(d['client_id'])"); gs=$(echo "$gapp" | j "print(d['client_secret'])")
+gcurl -s -o /dev/null -c $work/gj -b $work/gj "$G/oauth/authorize?client_id=$gid&redirect_uri=urn:ietf:wg:oauth:2.0:oob&response_type=code&scope=read+write+follow"
+gcurl -s -o /dev/null -c $work/gj -b $work/gj -X POST $G/auth/sign_in --data-urlencode 'username=gtsuser@gts.test' --data-urlencode 'password=Gts-Pasture-Pass-1!'
+gcode=$(gcurl -s -o /dev/null -w '%{redirect_url}' -c $work/gj -b $work/gj -X POST "$G/oauth/authorize" | sed -n 's/.*[?&]code=\([^&]*\).*/\1/p')
+GT=$(gcurl -s -X POST $G/oauth/token -d "grant_type=authorization_code&code=$gcode&client_id=$gid&client_secret=$gs&redirect_uri=urn:ietf:wg:oauth:2.0:oob&scope=read+write+follow" | j "print(d['access_token'])")
+GH="Authorization: Bearer $GT"
+[ -n "$GT" ] && ok "GoToSocial token for gtsuser" || { ko "GoToSocial token (code '$gcode')"; exit 1; }
+
+echo "discovery"
+alice_on_gts=$(gcurl -s -H "$GH" "$G/api/v2/search?q=@alice@privapub.test&resolve=true&type=accounts" | j "print(d['accounts'][0]['id'])")
+[ -n "$alice_on_gts" ] && ok "GoToSocial resolves @alice@privapub.test" || ko "GoToSocial cannot resolve alice"
+gts_on_pp=$(curl -s -H "$PH" "$P/api/v2/search?q=gtsuser@gts.test&resolve=true&type=accounts" | j "print(d['accounts'][0]['id'])")
+[ -n "$gts_on_pp" ] && ok "PrivaPub resolves @gtsuser@gts.test" || ko "PrivaPub cannot resolve gtsuser"
+
+echo "follows"
+gcurl -s -o /dev/null -X POST -H "$GH" $G/api/v1/accounts/$alice_on_gts/follow
+until_true 20 '[ "$(gcurl -s -H "$GH" "$G/api/v1/accounts/relationships?id[]=$alice_on_gts" | j "print(d[0][\"following\"])")" = "True" ]' && ok "gtsuser follows alice (Accept arrived)" || ko "gtsuser's follow of alice not accepted"
+curl -s -o /dev/null -X POST -H "$PH" $P/api/v1/accounts/$gts_on_pp/follow
+until_true 10 '[ "$(curl -s -H "$PH" "$P/api/v1/accounts/relationships?id[]=$gts_on_pp" | j "print(d[0][\"requested\"])")" = "True" ]' && ok "alice's follow of locked gtsuser waits as a request" || ko "alice's follow is not shown as requested"
+until_true 20 'gcurl -s -H "$GH" "$G/api/v1/follow_requests" | j "print(any(a[\"id\"]==\"$alice_on_gts\" for a in d))" | grep -q True' && ok "the request reaches gtsuser's follow requests" || ko "follow request missing on GoToSocial"
+gcurl -s -o /dev/null -X POST -H "$GH" $G/api/v1/follow_requests/$alice_on_gts/authorize
+until_true 20 '[ "$(curl -s -H "$PH" "$P/api/v1/accounts/relationships?id[]=$gts_on_pp" | j "print(d[0][\"following\"])")" = "True" ]' && ok "alice follows gtsuser (Accept arrived)" || ko "alice's follow of gtsuser not accepted"
+
+echo "posts"
+pp_status=$(curl -s -X POST -H "$PH" $P/api/v1/statuses -d 'status=Hello from PrivaPub #pasture&visibility=public')
+pp_post=$(echo "$pp_status" | j "print(d['id'])"); pp_uri=$(echo "$pp_status" | j "print(d['uri'])")
+until_true 20 'on_gts "$pp_uri" | j "print(len(d[\"statuses\"]))" | grep -q 1' && ok "alice's post reaches GoToSocial" || ko "alice's post missing on GoToSocial"
+gts_post=$(gcurl -s -X POST -H "$GH" $G/api/v1/statuses -d 'status=Hello from GoToSocial&visibility=public' | j "print(d['id'])")
+until_true 20 'curl -s -H "$PH" "$P/api/v1/timelines/home" | grep -q "Hello from GoToSocial"' && ok "gtsuser's post reaches alice's home" || ko "gtsuser's post missing on PrivaPub"
+[ "$(curl -s -H "$PH" "$P/api/v1/timelines/home" | j "print(next(s['edited_at'] for s in d if 'Hello from GoToSocial' in s['content']))")" = "None" ] && ok "an unedited remote post carries no edited_at" || ko "unedited remote post reports an edit"
+cw_status=$(curl -s -X POST -H "$PH" $P/api/v1/statuses -d 'status=behind a warning&spoiler_text=spoilers&visibility=public')
+cw=$(echo "$cw_status" | j "print(d['id'])"); cw_uri=$(echo "$cw_status" | j "print(d['uri'])")
+until_true 20 'on_gts "$cw_uri" | j "print(any(s[\"spoiler_text\"]==\"spoilers\" and s[\"sensitive\"] for s in d[\"statuses\"]))" | grep -q True' && ok "content warning survives to GoToSocial" || ko "content warning lost"
+cw_on_gts=$(on_gts "$cw_uri" | j "print(d['statuses'][0]['id'])")
+
+echo "replies and mentions"
+pp_on_gts=$(on_gts "$pp_uri" | j "print(d['statuses'][0]['id'])")
+gcurl -s -o /dev/null -X POST -H "$GH" $G/api/v1/statuses -d "status=@alice@privapub.test nice to meet you&in_reply_to_id=$pp_on_gts&visibility=public"
+until_true 20 'curl -s -H "$PH" "$P/api/v1/notifications" | j "print(any(n[\"type\"]==\"mention\" for n in d))" | grep -q True' && ok "gtsuser's reply notifies alice" || ko "reply did not notify alice"
+until_true 10 '[ "$(curl -s -H "$PH" "$P/api/v1/statuses/$pp_post/context" | j "print(len(d[\"descendants\"]))")" -ge 1 ]' && ok "the reply threads under alice's post" || ko "reply not threaded"
+
+echo "likes and boosts"
+gts_on_pp_post=$(curl -s -H "$PH" "$P/api/v1/timelines/home" | j "print(next(s['id'] for s in d if 'Hello from GoToSocial' in s['content']))")
+curl -s -o /dev/null -X POST -H "$PH" $P/api/v1/statuses/$gts_on_pp_post/favourite
+curl -s -o /dev/null -X POST -H "$PH" $P/api/v1/statuses/$gts_on_pp_post/reblog
+until_true 20 'gcurl -s -H "$GH" "$G/api/v1/notifications" | j "print(any(n[\"type\"]==\"favourite\" for n in d))" | grep -q True' && ok "alice's like reaches GoToSocial" || ko "like not received"
+until_true 20 'gcurl -s -H "$GH" "$G/api/v1/notifications" | j "print(any(n[\"type\"]==\"reblog\" for n in d))" | grep -q True' && ok "alice's boost reaches GoToSocial" || ko "boost not received"
+gcurl -s -o /dev/null -X POST -H "$GH" $G/api/v1/statuses/$pp_on_gts/favourite
+gcurl -s -o /dev/null -X POST -H "$GH" $G/api/v1/statuses/$pp_on_gts/reblog
+until_true 20 '[ "$(curl -s -H "$PH" "$P/api/v1/statuses/$pp_post" | j "print(d[\"favourites_count\"])")" = "1" ]' && ok "gtsuser's like counts on PrivaPub" || ko "like not counted"
+until_true 20 'curl -s -H "$PH" "$P/api/v1/notifications" | j "print(any(n[\"type\"]==\"reblog\" for n in d))" | grep -q True' && ok "gtsuser's boost notifies alice" || ko "boost not notified"
+
+echo "direct messages"
+curl -s -o /dev/null -X POST -H "$PH" $P/api/v1/statuses -d 'status=@gtsuser@gts.test a secret&visibility=direct'
+until_true 20 'gcurl -s -H "$GH" "$G/api/v1/conversations" | grep -q "a secret"' && ok "alice's DM reaches gtsuser" || ko "DM missing on GoToSocial"
+gcurl -s -o /dev/null -X POST -H "$GH" $G/api/v1/statuses -d 'status=@alice@privapub.test a secret back&visibility=direct'
+until_true 20 'curl -s -H "$PH" "$P/api/v1/conversations" | grep -q "a secret back"' && ok "gtsuser's DM reaches alice" || ko "DM missing on PrivaPub"
+until_true 5 '! gcurl -s -H "$GH" "$G/api/v1/timelines/public?local=false" | grep -q "a secret"' && ok "the DM is not public on GoToSocial" || ko "DM leaked to a public timeline"
+
+echo "polls"
+pp_poll=$(curl -s -X POST -H "$PH" $P/api/v1/statuses -d 'status=tea or coffee&visibility=public&poll[options][]=tea&poll[options][]=coffee&poll[expires_in]=3600' | j "print(d['uri'])")
+until_true 20 'on_gts "$pp_poll" | j "print(len(d[\"statuses\"][0][\"poll\"][\"options\"]))" | grep -q 2' && ok "alice's poll reaches GoToSocial as a poll" || ko "poll missing on GoToSocial"
+pp_poll_on_gts=$(on_gts "$pp_poll" | j "print(d['statuses'][0]['poll']['id'])")
+gcurl -s -o /dev/null -X POST -H "$GH" "$G/api/v1/polls/$pp_poll_on_gts/votes" -d 'choices[]=1'
+pp_poll_id=$(curl -s -H "$PH" "$P/api/v1/timelines/home" | j "print(next(s['id'] for s in d if s['poll'] and s['uri']=='$pp_poll'))")
+until_true 20 '[ "$(curl -s -H "$PH" "$P/api/v1/polls/$pp_poll_id" | j "print(d[\"options\"][1][\"votes_count\"])")" = "1" ]' && ok "gtsuser's vote counts on PrivaPub" || ko "vote not counted on PrivaPub"
+gts_poll=$(gcurl -s -X POST -H "$GH" $G/api/v1/statuses -d 'status=red or blue&visibility=public&poll[options][]=red&poll[options][]=blue&poll[expires_in]=3600' | j "print(d['id'])")
+until_true 20 'curl -s -H "$PH" "$P/api/v1/timelines/home" | j "print(any(s[\"poll\"] and s[\"content\"].find(\"red or blue\")>=0 for s in d))" | grep -q True' && ok "gtsuser's poll reaches alice as a poll" || ko "poll missing on PrivaPub"
+gts_poll_on_pp=$(curl -s -H "$PH" "$P/api/v1/timelines/home" | j "print(next(s['poll']['id'] for s in d if s['poll'] and 'red or blue' in s['content']))")
+curl -s -o /dev/null -X POST -H "$PH" "$P/api/v1/polls/$gts_poll_on_pp/votes" -d 'choices[]=0'
+until_true 20 '[ "$(gcurl -s -H "$GH" "$G/api/v1/statuses/$gts_poll" | j "print(d[\"poll\"][\"options\"][0][\"votes_count\"])")" = "1" ]' && ok "alice's vote counts on GoToSocial" || ko "vote not counted on GoToSocial"
+
+echo "quotes"
+quote_target=$(curl -s -H "$PH" "$P/api/v1/timelines/home" | j "print(next(s['id'] for s in d if 'red or blue' in s['content']))")
+[ "$(curl -s -o /dev/null -w '%{http_code}' -X POST -H "$PH" $P/api/v1/statuses -d "status=quoting&quoted_status_id=$quote_target")" = "422" ] \
+	&& ok "GoToSocial's author-only quote policy is respected" || ko "quoted a post whose author forbids it"
+
+echo "link previews"
+linked=$(curl -s -X POST -H "$PH" $P/api/v1/statuses --data-urlencode 'status=have a look https://gts.test/@gtsuser' -d 'visibility=public' | j "print(d['id'])")
+until_true 45 '[ -n "$(curl -s -H "$PH" "$P/api/v1/statuses/$linked" | j "print((d[\"card\"] or {}).get(\"title\") or \"\")")" ]' && ok "the server builds a card for a linked page" || ko "no card for the linked page"
+
+echo "edits and deletes"
+curl -s -o /dev/null -X PUT -H "$PH" $P/api/v1/statuses/$pp_post -d 'status=Hello from PrivaPub, edited'
+until_true 20 'gcurl -s -H "$GH" "$G/api/v1/statuses/$pp_on_gts" | grep -q "edited"' && ok "alice's edit reaches GoToSocial" || ko "edit not applied"
+curl -s -o /dev/null -X DELETE -H "$PH" $P/api/v1/statuses/$cw
+[ -n "$cw_on_gts" ] && until_true 20 '[ "$(gcurl -s -o /dev/null -w "%{http_code}" -H "$GH" "$G/api/v1/statuses/$cw_on_gts")" = "404" ]' && ok "alice's delete reaches GoToSocial" || ko "delete not applied"
+gcurl -s -o /dev/null -X DELETE -H "$GH" $G/api/v1/statuses/$gts_post
+until_true 20 '! curl -s -H "$PH" "$P/api/v1/timelines/home" | grep -q "Hello from GoToSocial"' && ok "gtsuser's delete reaches PrivaPub" || ko "remote delete not applied"
+
+echo "unfollow"
+curl -s -o /dev/null -X POST -H "$PH" $P/api/v1/accounts/$gts_on_pp/unfollow
+until_true 20 '[ "$(gcurl -s -H "$GH" "$G/api/v1/accounts/relationships?id[]=$alice_on_gts" | j "print(d[0][\"followed_by\"])")" = "False" ]' && ok "alice's unfollow reaches GoToSocial" || ko "unfollow not applied"
+
+echo "blocks"
+curl -s -o /dev/null -X POST -H "$PH" $P/api/v1/accounts/$gts_on_pp/block
+until_true 20 '[ "$(gcurl -s -H "$GH" "$G/api/v1/accounts/relationships?id[]=$alice_on_gts" | j "print(d[0][\"blocked_by\"])")" = "True" ]' && ok "alice's block reaches GoToSocial" || ko "block not applied"
+curl -s -o /dev/null -X POST -H "$PH" $P/api/v1/accounts/$gts_on_pp/unblock
+until_true 20 '[ "$(gcurl -s -H "$GH" "$G/api/v1/accounts/relationships?id[]=$alice_on_gts" | j "print(d[0][\"blocked_by\"])")" = "False" ]' && ok "alice's unblock reaches GoToSocial" || ko "unblock not applied"
+
+echo; echo "$pass passed, $fail failed"
+[ "$fail" = 0 ]

tools/pasture/run.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# A private test fediverse on one podman network: PrivaPub (privapub.test) and GoToSocial (gts.test) behind Caddy,
+# whose internal CA both sides are told to accept. From the workstation: PrivaPub's API at http://127.0.0.1:6971,
+# both sites at https://{privapub,gts}.test:6443 (curl --resolve ...:6443:127.0.0.1 -k).
+# usage: tools/pasture/run.sh up | down | logs <name>
+set -euo pipefail
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; repo="$(cd "$here/../.." && pwd)"
+net=privapub-pasture; publish="$here/.publish"
+
+case "${1:-up}" in
+up)
+	dotnet=${DOTNET:-$(command -v dotnet || echo ~/.dotnet/dotnet)}
+	"$dotnet" publish "$repo/PrivaPub/PrivaPub.csproj" -c Release -r linux-x64 --self-contained true -o "$publish" -v quiet
+	cp "$here/appsettings.Pasture.json" "$publish/"
+	podman network exists $net || podman network create $net >/dev/null
+	podman run -d --replace --name pasture-mongo --network $net --network-alias mongo docker.io/library/mongo:8 --quiet >/dev/null
+	podman run -d --replace --name pasture-caddy --network $net --network-alias privapub.test --network-alias gts.test \
+		-p 127.0.0.1:6443:443 --sysctl net.ipv4.ip_unprivileged_port_start=0 -v "$here/Caddyfile:/etc/caddy/Caddyfile:Z,ro" \
+		docker.io/library/caddy:2 >/dev/null
+	podman run -d --replace --name pasture-privapub --network $net -p 127.0.0.1:6971:80 \
+		--sysctl net.ipv4.ip_unprivileged_port_start=0 -e ASPNETCORE_ENVIRONMENT=Pasture -w /app -v "$publish:/app:Z,ro" \
+		mcr.microsoft.com/dotnet/runtime-deps:10.0 /app/PrivaPub >/dev/null
+	podman run -d --replace --name pasture-gts --network $net -p 127.0.0.1:6972:80 \
+		--sysctl net.ipv4.ip_unprivileged_port_start=0 \
+		-e GTS_HOST=gts.test -e GTS_PROTOCOL=https -e GTS_PORT=80 -e GTS_BIND_ADDRESS=0.0.0.0 -e GTS_HTTP_CLIENT_TLS_INSECURE_SKIP_VERIFY=true \
+		-e GTS_DB_TYPE=sqlite -e GTS_DB_ADDRESS=/gotosocial/storage/sqlite.db -e GTS_STORAGE_LOCAL_BASE_PATH=/gotosocial/storage \
+		-e GTS_LETSENCRYPT_ENABLED=false -e GTS_HTTP_CLIENT_ALLOW_IPS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 \
+		-e GTS_TRUSTED_PROXIES=0.0.0.0/0 -e GTS_LOG_LEVEL=info -e GTS_INSTANCE_EXPOSE_PUBLIC_TIMELINE=true \
+		docker.io/superseriousbusiness/gotosocial:latest >/dev/null
+	for i in $(seq 1 60); do curl -fs -o /dev/null http://127.0.0.1:6971/build.json && curl -fs -o /dev/null http://127.0.0.1:6972/api/v1/instance && break; sleep 2; done
+	podman exec pasture-gts /gotosocial/gotosocial admin account create --username gtsuser --email gtsuser@gts.test --password 'Gts-Pasture-Pass-1!' >/dev/null 2>&1 || true
+	podman exec pasture-gts /gotosocial/gotosocial admin account confirm --username gtsuser >/dev/null 2>&1 || true
+	podman restart pasture-gts >/dev/null
+	for i in $(seq 1 60); do curl -fs -o /dev/null http://127.0.0.1:6972/api/v1/instance && break; sleep 2; done
+	echo "privapub: http://127.0.0.1:6971, https://privapub.test:6443   gotosocial: https://gts.test:6443"
+	;;
+down)
+	podman rm -f pasture-caddy pasture-privapub pasture-gts pasture-mongo >/dev/null 2>&1 || true
+	podman network rm $net >/dev/null 2>&1 || true
+	;;
+logs)
+	podman logs --tail 200 "pasture-${2:-privapub}"
+	;;
+esac