Merge branch 'trunk' into add/relay-mode

Author: pfefferle

.claude/skills/activitypub-pr-workflow/SKILL.md

@@ -35,7 +35,7 @@ try/{idea}       # Experimental ideas.
 git checkout -b add/new-feature
 
 # Create PR with GitHub CLI.
-gh pr create --assignee @me --reviewer Fediverse
+gh pr create --assignee @me --reviewer Automattic/fediverse
 
 # Check PR status and CI.
 gh pr status

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [7.7.1] - 2025-12-04
+### Fixed
+- Fix admin styling for quote comments to match likes and reposts [#2584]
+- Mastodon importer now unpacks nested archives instead of getting confused by the extra folder. [#2581]
+- Add individually specified recipients to public activities in shared inbox. [#2585]
+
 ## [7.7.0] - 2025-12-03
 ### Added
 - Add documentation guide for using ActivityPub blocks in classic themes with Block Template Parts [#2577]
@@ -1567,6 +1573,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - initial
 
+[7.7.1]: https://github.com/Automattic/wordpress-activitypub/compare/7.7.0...7.7.1
 [7.7.0]: https://github.com/Automattic/wordpress-activitypub/compare/7.6.1...7.7.0
 [7.6.1]: https://github.com/Automattic/wordpress-activitypub/compare/7.6.0...7.6.1
 [7.6.0]: https://github.com/Automattic/wordpress-activitypub/compare/7.5.0...7.6.0

activitypub.php

@@ -3,7 +3,7 @@
  * Plugin Name: ActivityPub
  * Plugin URI: https://github.com/Automattic/wordpress-activitypub
  * Description: The ActivityPub protocol is a decentralized social networking protocol based upon the ActivityStreams 2.0 data format.
- * Version: 7.7.0
+ * Version: 7.7.1
  * Author: Matthias Pfefferle & Automattic
  * Author URI: https://automattic.com/
  * License: MIT
@@ -17,7 +17,7 @@
 
 namespace Activitypub;
 
-\define( 'ACTIVITYPUB_PLUGIN_VERSION', '7.7.0' );
+\define( 'ACTIVITYPUB_PLUGIN_VERSION', '7.7.1' );
 
 // Plugin related constants.
 \define( 'ACTIVITYPUB_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );

assets/css/activitypub-admin.css

@@ -230,13 +230,11 @@ input.blog-user-identifier {
 	font-family: dashicons;
 }
 
-.repost .dashboard-comment-wrap,
-.like .dashboard-comment-wrap {
+.activitypub-comment .dashboard-comment-wrap {
 	padding-inline-start: 63px;
 }
 
-.repost .dashboard-comment-wrap .comment-author,
-.like .dashboard-comment-wrap .comment-author {
+.activitypub-comment .dashboard-comment-wrap .comment-author {
 	margin-block: 0;
 }
 

includes/rest/class-inbox-controller.php

@@ -368,12 +368,13 @@ public function get_item_schema() {
 	 * @return array An array of user IDs who are the recipients of the activity.
 	 */
 	private function get_local_recipients( $activity ) {
-		if ( is_activity_public( $activity ) ) { // Public activity, deliver to followers of the actor.
-			return Following::get_follower_ids( $activity['actor'] );
+		$user_ids = array();
+
+		if ( is_activity_public( $activity ) ) {
+			$user_ids = Following::get_follower_ids( $activity['actor'] );
 		}
 
 		$recipients = extract_recipients_from_activity( $activity );
-		$user_ids   = array();
 
 		foreach ( $recipients as $recipient ) {
 

includes/wp-admin/import/class-mastodon.php

@@ -225,15 +225,15 @@ public static function import() {
 
 		// Unzip package to working directory.
 		\unzip_file( $file, self::$archive );
-		$files = $wp_filesystem->dirlist( self::$archive );
+		self::maybe_unwrap_archive();
 
-		if ( ! isset( $files['outbox.json'] ) ) {
+		if ( ! $wp_filesystem->exists( self::$archive . '/outbox.json' ) ) {
 			echo '<p><strong>' . \esc_html( $error_message ) . '</strong><br />';
 			echo \esc_html__( 'The archive does not contain an Outbox file, please try again.', 'activitypub' ) . '</p>';
+			return;
 		}
 
-		// phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
-		self::$outbox = \json_decode( \file_get_contents( self::$archive . '/outbox.json' ), true );
+		self::$outbox = \json_decode( $wp_filesystem->get_contents( self::$archive . '/outbox.json' ), true );
 
 		\wp_suspend_cache_invalidation();
 		\wp_defer_term_counting( true );
@@ -434,4 +434,32 @@ private static function prepend_archive_path( $attachment ) {
 
 		return $attachment;
 	}
+
+	/**
+	 * Detect and unwrap single nested directory in archive.
+	 *
+	 * Some Mastodon exports wrap all files in a root folder. This method
+	 * detects this pattern and updates the archive path to point inside it.
+	 */
+	private static function maybe_unwrap_archive() {
+		global $wp_filesystem;
+
+		$files = $wp_filesystem->dirlist( self::$archive );
+
+		// Check if there's exactly one directory at root level.
+		if ( count( $files ) !== 1 ) {
+			return;
+		}
+
+		$first = reset( $files );
+		if ( 'd' !== $first['type'] ) {
+			return;
+		}
+
+		// Check if outbox.json exists inside the nested directory.
+		$nested_path = self::$archive . '/' . $first['name'];
+		if ( $wp_filesystem->exists( $nested_path . '/outbox.json' ) ) {
+			self::$archive = $nested_path;
+		}
+	}
 }

readme.txt

@@ -3,7 +3,7 @@ Contributors: automattic, pfefferle, mattwiebe, obenland, akirk, jeherve, mediaf
 Tags: fediverse, activitypub, indieweb, activitystream, social web
 Requires at least: 6.5
 Tested up to: 6.9
-Stable tag: 7.7.0
+Stable tag: 7.7.1
 Requires PHP: 7.2
 License: MIT
 License URI: http://opensource.org/licenses/MIT
@@ -110,6 +110,12 @@ For reasons of data protection, it is not possible to see the followers of other
 
 == Changelog ==
 
+### 7.7.1 - 2025-12-04
+#### Fixed
+- Fix admin styling for quote comments to match likes and reposts
+- Mastodon importer now unpacks nested archives instead of getting confused by the extra folder.
+- Add individually specified recipients to public activities in shared inbox.
+
 ### 7.7.0 - 2025-12-03
 #### Added
 - Add documentation guide for using ActivityPub blocks in classic themes with Block Template Parts

tests/phpunit/tests/includes/rest/class-test-inbox-controller.php

@@ -935,4 +935,215 @@ public function test_regular_inbox_action_with_shared_inbox_context() {
 		\remove_action( 'activitypub_inbox', $inbox_action );
 		\delete_option( 'activitypub_actor_mode' );
 	}
+
+	/**
+	 * Test get_local_recipients combines followers and explicit recipients for public activities.
+	 *
+	 * @covers ::get_local_recipients
+	 */
+	public function test_get_local_recipients_public_activity_with_explicit_recipients() {
+		// Enable actor mode to allow user actors.
+		\update_option( 'activitypub_actor_mode', ACTIVITYPUB_ACTOR_MODE );
+
+		// Create test users (authors have activitypub capability by default).
+		$follower_user_id  = self::factory()->user->create( array( 'role' => 'author' ) );
+		$mentioned_user_id = self::factory()->user->create( array( 'role' => 'author' ) );
+
+		// Get actor IDs.
+		$mentioned_actor    = Actors::get_by_id( $mentioned_user_id );
+		$mentioned_actor_id = $mentioned_actor->get_id();
+
+		// Create a remote actor and make follower_user follow them.
+		$remote_actor_url = 'https://example.com/actor/combined-test';
+
+		// Mock the remote actor fetch.
+		$remote_object_filter = function ( $pre, $url ) use ( $remote_actor_url ) {
+			if ( $url === $remote_actor_url ) {
+				return array(
+					'@context'          => 'https://www.w3.org/ns/activitystreams',
+					'id'                => $remote_actor_url,
+					'type'              => 'Person',
+					'preferredUsername' => 'testactor',
+					'name'              => 'Test Actor',
+					'inbox'             => 'https://example.com/actor/combined-test/inbox',
+				);
+			}
+			return $pre;
+		};
+		\add_filter( 'activitypub_pre_http_get_remote_object', $remote_object_filter, 10, 2 );
+
+		$remote_actor = \Activitypub\Collection\Remote_Actors::fetch_by_uri( $remote_actor_url );
+
+		// Make follower_user follow the remote actor.
+		\add_post_meta( $remote_actor->ID, '_activitypub_followed_by', $follower_user_id );
+
+		// Public activity that explicitly addresses mentioned_user (who is NOT a follower).
+		$activity = array(
+			'type'  => 'Create',
+			'actor' => $remote_actor_url,
+			'to'    => array(
+				'https://www.w3.org/ns/activitystreams#Public',
+				$mentioned_actor_id,
+			),
+		);
+
+		// Use reflection to test the private method.
+		$reflection = new \ReflectionClass( $this->inbox_controller );
+		$method     = $reflection->getMethod( 'get_local_recipients' );
+		if ( \PHP_VERSION_ID < 80100 ) {
+			$method->setAccessible( true );
+		}
+
+		$result = $method->invoke( $this->inbox_controller, $activity );
+
+		// Should return BOTH the follower AND the explicitly mentioned user.
+		$this->assertNotEmpty( $result, 'Should return recipients for public activity with explicit addressing' );
+		$this->assertContains( $follower_user_id, $result, 'Should contain follower' );
+		$this->assertContains( $mentioned_user_id, $result, 'Should contain explicitly mentioned user' );
+
+		// Verify no duplicates if someone is both a follower and explicitly mentioned.
+		$this->assertEquals( count( $result ), count( array_unique( $result ) ), 'Should not contain duplicate user IDs' );
+
+		// Clean up.
+		\delete_option( 'activitypub_actor_mode' );
+		\remove_filter( 'activitypub_pre_http_get_remote_object', $remote_object_filter );
+	}
+
+	/**
+	 * Test get_local_recipients deduplicates when user is both follower and explicit recipient.
+	 *
+	 * @covers ::get_local_recipients
+	 */
+	public function test_get_local_recipients_deduplicates_follower_and_explicit() {
+		// Enable actor mode to allow user actors.
+		\update_option( 'activitypub_actor_mode', ACTIVITYPUB_ACTOR_MODE );
+
+		// Create test user (author has activitypub capability by default).
+		$user_id = self::factory()->user->create( array( 'role' => 'author' ) );
+
+		// Get actor ID.
+		$user_actor    = Actors::get_by_id( $user_id );
+		$user_actor_id = $user_actor->get_id();
+
+		// Create a remote actor and make user follow them.
+		$remote_actor_url = 'https://example.com/actor/dedup-test';
+
+		// Mock the remote actor fetch.
+		$remote_object_filter = function ( $pre, $url ) use ( $remote_actor_url ) {
+			if ( $url === $remote_actor_url ) {
+				return array(
+					'@context'          => 'https://www.w3.org/ns/activitystreams',
+					'id'                => $remote_actor_url,
+					'type'              => 'Person',
+					'preferredUsername' => 'testactor',
+					'name'              => 'Test Actor',
+					'inbox'             => 'https://example.com/actor/dedup-test/inbox',
+				);
+			}
+			return $pre;
+		};
+		\add_filter( 'activitypub_pre_http_get_remote_object', $remote_object_filter, 10, 2 );
+
+		$remote_actor = \Activitypub\Collection\Remote_Actors::fetch_by_uri( $remote_actor_url );
+
+		// Make user follow the remote actor.
+		\add_post_meta( $remote_actor->ID, '_activitypub_followed_by', $user_id );
+
+		// Public activity that ALSO explicitly addresses the same user.
+		$activity = array(
+			'type'  => 'Create',
+			'actor' => $remote_actor_url,
+			'to'    => array(
+				'https://www.w3.org/ns/activitystreams#Public',
+				$user_actor_id,  // User is both follower AND explicitly addressed.
+			),
+		);
+
+		// Use reflection to test the private method.
+		$reflection = new \ReflectionClass( $this->inbox_controller );
+		$method     = $reflection->getMethod( 'get_local_recipients' );
+		if ( \PHP_VERSION_ID < 80100 ) {
+			$method->setAccessible( true );
+		}
+
+		$result = $method->invoke( $this->inbox_controller, $activity );
+
+		// Should return the user only once (no duplicates).
+		$this->assertContains( $user_id, $result, 'Should contain user' );
+
+		// Count occurrences of user_id in result.
+		$occurrences = count( array_keys( $result, $user_id, true ) );
+		$this->assertEquals( 1, $occurrences, 'User should appear exactly once in result' );
+
+		// Clean up.
+		\delete_option( 'activitypub_actor_mode' );
+		\remove_filter( 'activitypub_pre_http_get_remote_object', $remote_object_filter );
+	}
+
+	/**
+	 * Test get_local_recipients for non-public activity with followers.
+	 *
+	 * @covers ::get_local_recipients
+	 */
+	public function test_get_local_recipients_non_public_activity_ignores_followers() {
+		// Enable actor mode to allow user actors.
+		\update_option( 'activitypub_actor_mode', ACTIVITYPUB_ACTOR_MODE );
+
+		// Create test users.
+		$follower_user_id  = self::factory()->user->create( array( 'role' => 'author' ) );
+		$mentioned_user_id = self::factory()->user->create( array( 'role' => 'author' ) );
+
+		// Get actor ID for mentioned user.
+		$mentioned_actor    = Actors::get_by_id( $mentioned_user_id );
+		$mentioned_actor_id = $mentioned_actor->get_id();
+
+		// Create a remote actor and make follower_user follow them.
+		$remote_actor_url = 'https://example.com/actor/non-public-test';
+
+		// Mock the remote actor fetch.
+		$remote_object_filter = function ( $pre, $url ) use ( $remote_actor_url ) {
+			if ( $url === $remote_actor_url ) {
+				return array(
+					'@context'          => 'https://www.w3.org/ns/activitystreams',
+					'id'                => $remote_actor_url,
+					'type'              => 'Person',
+					'preferredUsername' => 'testactor',
+					'name'              => 'Test Actor',
+					'inbox'             => 'https://example.com/actor/non-public-test/inbox',
+				);
+			}
+			return $pre;
+		};
+		\add_filter( 'activitypub_pre_http_get_remote_object', $remote_object_filter, 10, 2 );
+
+		$remote_actor = \Activitypub\Collection\Remote_Actors::fetch_by_uri( $remote_actor_url );
+
+		// Make follower_user follow the remote actor.
+		\add_post_meta( $remote_actor->ID, '_activitypub_followed_by', $follower_user_id );
+
+		// Non-public activity (direct message) that explicitly addresses only mentioned_user.
+		$activity = array(
+			'type'  => 'Create',
+			'actor' => $remote_actor_url,
+			'to'    => array( $mentioned_actor_id ),  // Only mentioned user, NOT public.
+		);
+
+		// Use reflection to test the private method.
+		$reflection = new \ReflectionClass( $this->inbox_controller );
+		$method     = $reflection->getMethod( 'get_local_recipients' );
+		if ( \PHP_VERSION_ID < 80100 ) {
+			$method->setAccessible( true );
+		}
+
+		$result = $method->invoke( $this->inbox_controller, $activity );
+
+		// Should return ONLY the mentioned user, NOT the follower.
+		$this->assertNotEmpty( $result, 'Should return explicitly addressed recipient' );
+		$this->assertContains( $mentioned_user_id, $result, 'Should contain mentioned user' );
+		$this->assertNotContains( $follower_user_id, $result, 'Should NOT contain follower for non-public activity' );
+
+		// Clean up.
+		\delete_option( 'activitypub_actor_mode' );
+		\remove_filter( 'activitypub_pre_http_get_remote_object', $remote_object_filter );
+	}
 }