Allow to dereference Follow object for ActivityPub (#5772)

* Allow to dereference Follow object for ActivityPub

* Accept IRI as object representation for Accept activity

app/controllers/activitypub/follows_controller.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+class ActivityPub::FollowsController < Api::BaseController
+  include SignatureVerification
+
+  def show
+    render(
+      json: FollowRequest.includes(:account).references(:account).find_by!(
+        id: params.require(:id),
+        accounts: { domain: nil, username: params.require(:account_username) },
+        target_account: signed_request_account
+      ),
+      serializer: ActivityPub::FollowSerializer,
+      adapter: ActivityPub::Adapter,
+      content_type: 'application/activity+json'
+    )
+  end
+end

app/lib/activitypub/activity/accept.rb

@@ -2,16 +2,18 @@
 
 class ActivityPub::Activity::Accept < ActivityPub::Activity
   def perform
-    case @object['type']
-    when 'Follow'
-      accept_follow
+    if @object.respond_to?(:[]) &&
+       @object['type'] == 'Follow' && @object['actor'].present?
+      accept_follow_from @object['actor']
+    else
+      accept_follow_object @object
     end
   end
 
   private
 
-  def accept_follow
-    target_account = account_from_uri(target_uri)
+  def accept_follow_from(actor)
+    target_account = account_from_uri(value_or_id(actor))
 
     return if target_account.nil? || !target_account.local?
 
@@ -19,7 +21,8 @@ class ActivityPub::Activity::Accept < ActivityPub::Activity
     follow_request&.authorize!
   end
 
-  def target_uri
-    @target_uri ||= value_or_id(@object['actor'])
+  def accept_follow_object(object)
+    follow_request = ActivityPub::TagManager.instance.uri_to_resource(value_or_id(object), FollowRequest)
+    follow_request&.authorize!
   end
 end

app/lib/activitypub/tag_manager.rb

@@ -28,6 +28,8 @@ class ActivityPub::TagManager
     return target.uri if target.respond_to?(:local?) && !target.local?
 
     case target.object_type
+    when :follow
+      account_follow_url(target.account.username, target)
     when :person
       account_url(target)
     when :note, :comment, :activity
@@ -97,6 +99,12 @@ class ActivityPub::TagManager
       case klass.name
       when 'Account'
         klass.find_local(uri_to_local_id(uri, :username))
+      when 'FollowRequest'
+        params = Rails.application.routes.recognize_path(uri)
+        klass.joins(:account).find_by!(
+          accounts: { domain: nil, username: params[:account_username] },
+          id: params[:id]
+        )
       else
         StatusFinder.new(uri).status
       end

app/models/follow_request.rb

@@ -21,6 +21,10 @@ class FollowRequest < ApplicationRecord
 
   validates :account_id, uniqueness: { scope: :target_account_id }
 
+  def object_type
+    :follow
+  end
+
   def authorize!
     account.follow!(target_account, reblogs: show_reblogs)
     MergeWorker.perform_async(target_account.id, account.id)

app/serializers/activitypub/follow_serializer.rb

@@ -1,11 +1,12 @@
 # frozen_string_literal: true
 
 class ActivityPub::FollowSerializer < ActiveModel::Serializer
-  attributes :id, :type, :actor
+  attributes :type, :actor
+  attribute :id, if: :dereferencable?
   attribute :virtual_object, key: :object
 
   def id
-    [ActivityPub::TagManager.instance.uri_for(object.account), '#follows/', object.id].join
+    ActivityPub::TagManager.instance.uri_for(object)
   end
 
   def type
@@ -19,4 +20,8 @@ class ActivityPub::FollowSerializer < ActiveModel::Serializer
   def virtual_object
     ActivityPub::TagManager.instance.uri_for(object.target_account)
   end
+
+  def dereferencable?
+    object.respond_to?(:object_type)
+  end
 end

app/views/accounts/_header.html.haml

@@ -8,7 +8,7 @@
               = fa_icon 'user-times'
               = t('accounts.unfollow')
           - else
-            = link_to account_follow_path(account), data: { method: :post }, class: 'icon-button' do
+            = link_to account_follows_path(account), data: { method: :post }, class: 'icon-button' do
               = fa_icon 'user-plus'
               = t('accounts.follow')
       - elsif !user_signed_in?