Add sensitive column to activities table, so PMs arent served over HTTP

lemmy_apub/src/activity_queue.rs

@@ -57,6 +57,7 @@ where
       vec![inbox],
       context.pool(),
       true,
+      true,
     )
     .await?;
   }
@@ -102,6 +103,7 @@ where
     follower_inboxes,
     context.pool(),
     true,
+    false,
   )
   .await?;
 
@@ -145,6 +147,7 @@ where
       vec![inbox],
       context.pool(),
       true,
+      false,
     )
     .await?;
   }
@@ -185,6 +188,7 @@ where
     mentions,
     context.pool(),
     false, // Don't create a new DB row
+    false,
   )
   .await?;
   Ok(())
@@ -202,6 +206,7 @@ async fn send_activity_internal<T, Kind>(
   inboxes: Vec<Url>,
   pool: &DbPool,
   insert_into_db: bool,
+  sensitive: bool,
 ) -> Result<(), LemmyError>
 where
   T: AsObject<Kind> + Extends<Kind> + Debug,
@@ -219,7 +224,7 @@ where
   // might send the same ap_id
   if insert_into_db {
     let id = activity.id().context(location_info!())?;
-    insert_activity(id, activity.clone(), true, pool).await?;
+    insert_activity(id, activity.clone(), true, sensitive, pool).await?;
   }
 
   for i in inboxes {

lemmy_apub/src/http/mod.rs

@@ -54,5 +54,9 @@ pub async fn get_activity(
   })
   .await??;
 
+  if !activity.local || activity.sensitive {
+    Ok(HttpResponse::NotFound().finish())
+  } else {
     Ok(create_apub_response(&activity.data))
+  }
 }

lemmy_apub/src/inbox/community_inbox.rs

@@ -93,7 +93,7 @@ pub async fn community_inbox(
     ValidTypes::Undo => handle_undo_follow(any_base, user, community, &context).await,
   };
 
-  insert_activity(&activity_id, activity.clone(), false, context.pool()).await?;
+  insert_activity(&activity_id, activity.clone(), false, true, context.pool()).await?;
   res
 }
 

lemmy_apub/src/inbox/shared_inbox.rs

@@ -125,7 +125,7 @@ pub async fn shared_inbox(
     ValidTypes::Undo => receive_undo(&context, any_base, actor_id, request_counter).await,
   };
 
-  insert_activity(&activity_id, activity.clone(), false, context.pool()).await?;
+  insert_activity(&activity_id, activity.clone(), false, true, context.pool()).await?;
   res
 }
 

lemmy_apub/src/inbox/user_inbox.rs

@@ -107,7 +107,7 @@ pub async fn user_inbox(
     }
   };
 
-  insert_activity(&activity_id, activity.clone(), false, context.pool()).await?;
+  insert_activity(&activity_id, activity.clone(), false, true, context.pool()).await?;
   res
 }
 

lemmy_apub/src/lib.rs

@@ -255,6 +255,7 @@ pub async fn insert_activity<T>(
   ap_id: &Url,
   activity: T,
   local: bool,
+  sensitive: bool,
   pool: &DbPool,
 ) -> Result<(), LemmyError>
 where
@@ -262,7 +263,7 @@ where
 {
   let ap_id = ap_id.to_string();
   blocking(pool, move |conn| {
-    Activity::insert(conn, ap_id, &activity, local)
+    Activity::insert(conn, ap_id, &activity, local, sensitive)
   })
   .await??;
   Ok(())

lemmy_db/src/activity.rs

@@ -15,6 +15,7 @@ pub struct Activity {
   pub ap_id: String,
   pub data: Value,
   pub local: bool,
+  pub sensitive: bool,
   pub published: chrono::NaiveDateTime,
   pub updated: Option<chrono::NaiveDateTime>,
 }
@@ -25,6 +26,7 @@ pub struct ActivityForm {
   pub ap_id: String,
   pub data: Value,
   pub local: bool,
+  pub sensitive: bool,
   pub updated: Option<chrono::NaiveDateTime>,
 }
 
@@ -59,6 +61,7 @@ impl Activity {
     ap_id: String,
     data: &T,
     local: bool,
+    sensitive: bool,
   ) -> Result<Self, IoError>
   where
     T: Serialize + Debug,
@@ -68,6 +71,7 @@ impl Activity {
       ap_id,
       data: serde_json::to_value(&data)?,
       local,
+      sensitive,
       updated: None,
     };
     let result = Activity::create(&conn, &activity_form);
@@ -149,9 +153,9 @@ mod tests {
     .unwrap();
     let activity_form = ActivityForm {
       ap_id: ap_id.to_string(),
-      user_id: inserted_creator.id,
       data: test_json.to_owned(),
       local: true,
+      sensitive: false,
       updated: None,
     };
 
@@ -160,9 +164,9 @@ mod tests {
     let expected_activity = Activity {
       ap_id: ap_id.to_string(),
       id: inserted_activity.id,
-      user_id: inserted_creator.id,
       data: test_json,
       local: true,
+      sensitive: false,
       published: inserted_activity.published,
       updated: None,
     };

lemmy_db/src/schema.rs

@@ -4,6 +4,7 @@ table! {
         ap_id -> Text,
         data -> Jsonb,
         local -> Bool,
+        sensitive -> Bool,
         published -> Timestamp,
         updated -> Nullable<Timestamp>,
     }