@@ -66,3 +66,4 @@
   .await?;
   if !is_mod_or_admin {
+    // TODO: more accurately, not_a_mod_or_admin?
     return Err(APIError::err("not_an_admin").into());

@@ -168,0 +174,4 @@
+      .as_single_xsd_string()
+      .unwrap()
+      .to_string();
+    check_slurs(&content)?;

@@ -182,3 +187,3 @@
       updated: note.updated().map(|u| u.to_owned().naive_local()),
       deleted: None,
-      ap_id: note.id_unchecked().unwrap().to_string(),
+      ap_id: check_actor_domain(note, expected_domain)?,

@@ -337,0 +351,4 @@
+      .unwrap()
+      .to_string();
+    let title = group.inner.preferred_username().unwrap().to_string();
+    // TODO: should be parsed as html and tags like <script> removed (or use markdown source)

@@ -465,2 +477,4 @@
+  // because that would result in a database error (same data inserted twice)
   // this seems to be the "easiest" stable alternative for remove_item()
   to.retain(|x| *x != sender.get_shared_inbox_url());
+  to.retain(|x| *x != community.get_shared_inbox_url());

@@ -57,2 +64,3 @@
 
-  let post = PostForm::from_apub(&page, client, pool).await?;
+  let post = PostForm::from_apub(&page, client, pool, Some(user.actor_id()?)).await?;
+  // TODO: not sure if it makes sense to check for the exact user, seeing as we already check the domain

@@ -42,1 +49,4 @@
   let remove = Remove::from_any_base(activity)?.unwrap();
+  let actor = get_user_from_activity(&remove, client, pool).await?;
+  let community = get_community_from_activity(&remove, client, pool).await?;
+  // TODO: we dont federate remote admins at all, and remote mods arent federated properly

@@ -55,0 +72,4 @@
+  } else {
+    Ok(())
+  }
+}

@@ -110,1 +135,4 @@
   let dislike = Dislike::from_any_base(undo.object().to_owned().one().unwrap())?.unwrap();
+  check_is_undo_valid(&undo, &dislike)?;
+
+  // TODO: need to implement Undo<Dislike>

@@ -43,0 +45,4 @@
+
+  // ensure that update and actor come from the same instance
+  let user = get_user_from_activity(&update, client, pool).await?;
+  update.id(user.actor_id()?.domain().unwrap())?;

@@ -73,2 +73,3 @@
 
-  let community = get_community_id_from_activity(&activity).await;
+  // TODO: i dont think this works for Announce/Undo activities
+  //let community = get_community_id_from_activity(&activity).await;

@@ -77,3 +78,3 @@
-  check_is_apub_id_valid(&community)?;
   verify(&request, actor.as_ref())?;
 
+  // TODO: probably better to do this after, so we dont store activities that fail a check somewhere

@@ -161,3 +162,3 @@
   let note = Note::from_any_base(update.object().as_one().unwrap().to_owned())?.unwrap();
 
-  let private_message_form = PrivateMessageForm::from_apub(&note, client, pool).await?;
+  let domain = Some(update.id_unchecked().unwrap().to_owned());

@@ -133,3 +143,4 @@
     apub: &Self::ApubType,
     client: &Client,
     pool: &DbPool,
+    expected_domain: Option<Url>,

@@ -214,2 +225,4 @@
       .as_ref()
       .map(|c| c.as_single_xsd_string().unwrap().to_string());
+    check_slurs(&name)?;
+    check_slurs_opt(&body)?;