4 files changed, 39 insertions, 1 deletions

diff --git a/README.md b/README.md
index 502e0d8db..ffe6ffa4e 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,9 @@ This instance is a fork of a fork: this has the [Mastodon Glitch Edition](https:
 
 See output of `git log glitch..main --oneline | grep -v '[mM]erge' | less` for a (more) complete history.
 
+* support for incoming indirect federation (cherry-picked from Monsterfork)
+	* does not yet support authoring posts this way. for that implementation, see "[Privacy] Federate references to objects..." "[Privacy] Add profile option for indirect federation..." "[Database] Add schema changes for ... indirect federation"
 * <ol> margin issue fixed so numbered lists aren't cut off a few pixels shy of 1 number
 * HTML summary/details tags are allowed in toots
 * gemini protocol links are supported (not yet supported: automatically marking gemini:// text as links)
-* authentication required for account api endpoints to block some naive scrapers
+* authentication required for account api endpoints to block some naive scrapers (cherry-picked from Monsterfork)
diff --git a/app/lib/activitypub/activity.rb b/app/lib/activitypub/activity.rb
index 0ce279d28..d6e17ba5d 100644
--- a/app/lib/activitypub/activity.rb
+++ b/app/lib/activitypub/activity.rb
@@ -157,6 +157,38 @@ class ActivityPub::Activity
     fetch_remote_original_status
   end
 
+  def dereference_object!
+    return unless @object.is_a?(String) && object_uri.start_with?('https://', 'http://')
+    return if ActivityPub::TagManager.instance.local_uri?(object_uri)
+
+    object = fetch_resource(@object, true, signed_fetch_account)
+    return unless object.present? && object.is_a?(Hash) && supported_context?(object) && equals_or_includes_any?(object['type'], SUPPORTED_TYPES + CONVERTED_TYPES)
+
+    actor_id = value_or_id(first_of_value(object['attributedTo']))
+    return if actor_id.nil? || object['id'].nil?
+    return unless Addressable::URI.parse(object['id']).normalized_host.casecmp(Addressable::URI.parse(actor_id).normalized_host).zero?
+
+    @object = object
+  end
+
+  def signed_fetch_account
+    first_mentioned_local_account || first_local_follower
+  end
+
+  def first_mentioned_local_account
+    audience = (as_array(@json['to']) + as_array(@json['cc'])).uniq
+    local_usernames = audience.select { |uri| ActivityPub::TagManager.instance.local_uri?(uri) }
+                              .map { |uri| ActivityPub::TagManager.instance.uri_to_local_id(uri, :username) }
+
+    return if local_usernames.empty?
+
+    Account.local.where(username: local_usernames).first
+  end
+
+  def first_local_follower
+    @account.followers.local.first
+  end
+
   def follow_request_from_object
     @follow_request ||= FollowRequest.find_by(target_account: @account, uri: object_uri) unless object_uri.nil?
   end
diff --git a/app/lib/activitypub/activity/create.rb b/app/lib/activitypub/activity/create.rb
index e81452e3c..08dd98e94 100644
--- a/app/lib/activitypub/activity/create.rb
+++ b/app/lib/activitypub/activity/create.rb
@@ -2,6 +2,8 @@
 
 class ActivityPub::Activity::Create < ActivityPub::Activity
   def perform
+    dereference_object!
+
     case @object['type']
     when 'EncryptedMessage'
       create_encrypted_message
diff --git a/app/lib/activitypub/activity/update.rb b/app/lib/activitypub/activity/update.rb
index 70035325b..018e2df54 100644
--- a/app/lib/activitypub/activity/update.rb
+++ b/app/lib/activitypub/activity/update.rb
@@ -4,6 +4,8 @@ class ActivityPub::Activity::Update < ActivityPub::Activity
   SUPPORTED_TYPES = %w(Application Group Organization Person Service).freeze
 
   def perform
+    dereference_object!
+
     if equals_or_includes_any?(@object['type'], SUPPORTED_TYPES)
       update_account
     elsif equals_or_includes_any?(@object['type'], %w(Question))