From 149887a0ffc81b588520ff82ab9fda8dff7bce6c Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Sat, 11 Feb 2017 02:12:05 +0100
Subject: Make follow requests federate

---
 app/services/authorize_follow_service.rb       | 11 +++++++++++
 app/services/block_service.rb                  |  4 +++-
 app/services/concerns/stream_entry_renderer.rb |  8 ++++++++
 app/services/favourite_service.rb              |  4 +++-
 app/services/follow_service.rb                 | 13 +++++++++----
 app/services/process_interaction_service.rb    | 14 ++++++++++++++
 app/services/process_mentions_service.rb       |  4 +++-
 app/services/reblog_service.rb                 | 10 +++-------
 app/services/reject_follow_service.rb          | 11 +++++++++++
 app/services/remove_status_service.rb          |  4 +++-
 app/services/send_interaction_service.rb       | 19 ++++---------------
 app/services/unblock_service.rb                |  4 +++-
 app/services/unfavourite_service.rb            |  4 +++-
 app/services/unfollow_service.rb               |  4 +++-
 app/services/update_remote_profile_service.rb  |  1 +
 15 files changed, 82 insertions(+), 33 deletions(-)
 create mode 100644 app/services/authorize_follow_service.rb
 create mode 100644 app/services/concerns/stream_entry_renderer.rb
 create mode 100644 app/services/reject_follow_service.rb

(limited to 'app/services')

diff --git a/app/services/authorize_follow_service.rb b/app/services/authorize_follow_service.rb
new file mode 100644
index 000000000..1590d8433
--- /dev/null
+++ b/app/services/authorize_follow_service.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class AuthorizeFollowService < BaseService
+  include StreamEntryRenderer
+
+  def call(source_account, target_account)
+    follow_request = FollowRequest.find_by!(account: source_account, target_account: target_account)
+    follow_request.authorize!
+    NotificationWorker.perform_async(stream_entry_to_xml(follow_request.stream_entry), target_account.id, source_account.id) unless source_account.local?
+  end
+end
diff --git a/app/services/block_service.rb b/app/services/block_service.rb
index e04b6cc39..095d2a8eb 100644
--- a/app/services/block_service.rb
+++ b/app/services/block_service.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class BlockService < BaseService
+  include StreamEntryRenderer
+
   def call(account, target_account)
     return if account.id == target_account.id
 
@@ -10,6 +12,6 @@ class BlockService < BaseService
     block = account.block!(target_account)
 
     BlockWorker.perform_async(account.id, target_account.id)
-    NotificationWorker.perform_async(block.stream_entry.id, target_account.id) unless target_account.local?
+    NotificationWorker.perform_async(stream_entry_to_xml(block.stream_entry), account.id, target_account.id) unless target_account.local?
   end
 end
diff --git a/app/services/concerns/stream_entry_renderer.rb b/app/services/concerns/stream_entry_renderer.rb
new file mode 100644
index 000000000..a4255daea
--- /dev/null
+++ b/app/services/concerns/stream_entry_renderer.rb
@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module StreamEntryRenderer
+  def stream_entry_to_xml(stream_entry)
+    renderer = StreamEntriesController.renderer.new(method: 'get', http_host: Rails.configuration.x.local_domain, https: Rails.configuration.x.use_https)
+    renderer.render(:show, assigns: { stream_entry: stream_entry }, formats: [:atom])
+  end
+end
diff --git a/app/services/favourite_service.rb b/app/services/favourite_service.rb
index d5fbd29e9..ce1722b77 100644
--- a/app/services/favourite_service.rb
+++ b/app/services/favourite_service.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class FavouriteService < BaseService
+  include StreamEntryRenderer
+
   # Favourite a status and notify remote user
   # @param [Account] account
   # @param [Status] status
@@ -15,7 +17,7 @@ class FavouriteService < BaseService
     if status.local?
       NotifyService.new.call(favourite.status.account, favourite)
     else
-      NotificationWorker.perform_async(favourite.stream_entry.id, status.account_id)
+      NotificationWorker.perform_async(stream_entry_to_xml(favourite.stream_entry), account.id, status.account_id)
     end
 
     favourite
diff --git a/app/services/follow_service.rb b/app/services/follow_service.rb
index 9f34cb6ac..45b7895b6 100644
--- a/app/services/follow_service.rb
+++ b/app/services/follow_service.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class FollowService < BaseService
+  include StreamEntryRenderer
+
   # Follow a remote user, notify remote user about the follow
   # @param [Account] source_account From which to follow
   # @param [String] uri User URI to follow in the form of username@domain
@@ -20,10 +22,13 @@ class FollowService < BaseService
   private
 
   def request_follow(source_account, target_account)
-    return unless target_account.local?
-
     follow_request = FollowRequest.create!(account: source_account, target_account: target_account)
-    NotifyService.new.call(target_account, follow_request)
+
+    if target_account.local?
+      NotifyService.new.call(target_account, follow_request)
+    else
+      NotificationWorker.perform_async(stream_entry_to_xml(follow_request.stream_entry), source_account.id, target_account.id)
+    end
 
     follow_request
   end
@@ -35,7 +40,7 @@ class FollowService < BaseService
       NotifyService.new.call(target_account, follow)
     else
       subscribe_service.call(target_account)
-      NotificationWorker.perform_async(follow.stream_entry.id, target_account.id)
+      NotificationWorker.perform_async(stream_entry_to_xml(follow.stream_entry), source_account.id, target_account.id)
     end
 
     MergeWorker.perform_async(target_account.id, source_account.id)
diff --git a/app/services/process_interaction_service.rb b/app/services/process_interaction_service.rb
index 5f91e3127..27f0758ce 100644
--- a/app/services/process_interaction_service.rb
+++ b/app/services/process_interaction_service.rb
@@ -29,6 +29,10 @@ class ProcessInteractionService < BaseService
       case verb(xml)
       when :follow
         follow!(account, target_account) unless target_account.locked? || target_account.blocking?(account)
+      when :request_friend
+        follow_request!(account, target_account) unless !target_account.locked? || target_account.blocking?(account)
+      when :authorize
+        authorize_follow_request!(account, target_account)
       when :unfollow
         unfollow!(account, target_account)
       when :favorite
@@ -72,6 +76,16 @@ class ProcessInteractionService < BaseService
     NotifyService.new.call(target_account, follow)
   end
 
+  def follow_request(account, target_account)
+    follow_request = FollowRequest.create!(account: account, target_account: target_account)
+    NotifyService.new.call(target_account, follow_request)
+  end
+
+  def authorize_target_account!(account, target_account)
+    follow_request = FollowRequest.find_by(account: target_account, target_account: account)
+    follow_request&.authorize!
+  end
+
   def unfollow!(account, target_account)
     account.unfollow!(target_account)
   end
diff --git a/app/services/process_mentions_service.rb b/app/services/process_mentions_service.rb
index 72568e702..67fd3dcf7 100644
--- a/app/services/process_mentions_service.rb
+++ b/app/services/process_mentions_service.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class ProcessMentionsService < BaseService
+  include StreamEntryRenderer
+
   # Scan status for mentions and fetch remote mentioned users, create
   # local mention pointers, send Salmon notifications to mentioned
   # remote users
@@ -33,7 +35,7 @@ class ProcessMentionsService < BaseService
       if mentioned_account.local?
         NotifyService.new.call(mentioned_account, mention)
       else
-        NotificationWorker.perform_async(status.stream_entry.id, mentioned_account.id)
+        NotificationWorker.perform_async(stream_entry_to_xml(status.stream_entry), status.account_id, mentioned_account.id)
       end
     end
   end
diff --git a/app/services/reblog_service.rb b/app/services/reblog_service.rb
index 4ea0dbf6c..7a52f041f 100644
--- a/app/services/reblog_service.rb
+++ b/app/services/reblog_service.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class ReblogService < BaseService
+  include StreamEntryRenderer
+
   # Reblog a status and notify its remote author
   # @param [Account] account Account to reblog from
   # @param [Status] reblogged_status Status to be reblogged
@@ -18,15 +20,9 @@ class ReblogService < BaseService
     if reblogged_status.local?
       NotifyService.new.call(reblog.reblog.account, reblog)
     else
-      NotificationWorker.perform_async(reblog.stream_entry.id, reblog.reblog.account_id)
+      NotificationWorker.perform_async(stream_entry_to_xml(reblog.stream_entry), account.id, reblog.reblog.account_id)
     end
 
     reblog
   end
-
-  private
-
-  def send_interaction_service
-    @send_interaction_service ||= SendInteractionService.new
-  end
 end
diff --git a/app/services/reject_follow_service.rb b/app/services/reject_follow_service.rb
new file mode 100644
index 000000000..0c568b981
--- /dev/null
+++ b/app/services/reject_follow_service.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class RejectFollowService < BaseService
+  include StreamEntryRenderer
+
+  def call(source_account, target_account)
+    follow_request = FollowRequest.find_by!(account: source_account, target_account: target_account)
+    follow_request.reject!
+    NotificationWorker.perform_async(stream_entry_to_xml(follow_request.stream_entry), target_account.id, source_account.id) unless source_account.local?
+  end
+end
diff --git a/app/services/remove_status_service.rb b/app/services/remove_status_service.rb
index 48e8dd3b8..b1a646b14 100644
--- a/app/services/remove_status_service.rb
+++ b/app/services/remove_status_service.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class RemoveStatusService < BaseService
+  include StreamEntryRenderer
+
   def call(status)
     remove_from_self(status) if status.account.local?
     remove_from_followers(status)
@@ -43,7 +45,7 @@ class RemoveStatusService < BaseService
 
   def send_delete_salmon(account, status)
     return unless status.local?
-    NotificationWorker.perform_async(status.stream_entry.id, account.id)
+    NotificationWorker.perform_async(stream_entry_to_xml(status.stream_entry), status.account_id, account.id)
   end
 
   def remove_reblogs(status)
diff --git a/app/services/send_interaction_service.rb b/app/services/send_interaction_service.rb
index 05a1e77e3..99113eeca 100644
--- a/app/services/send_interaction_service.rb
+++ b/app/services/send_interaction_service.rb
@@ -2,27 +2,16 @@
 
 class SendInteractionService < BaseService
   # Send an Atom representation of an interaction to a remote Salmon endpoint
-  # @param [StreamEntry] stream_entry
+  # @param [String] Entry XML
+  # @param [Account] source_account
   # @param [Account] target_account
-  def call(stream_entry, target_account)
-    envelope = salmon.pack(entry_xml(stream_entry), stream_entry.account.keypair)
+  def call(xml, source_account, target_account)
+    envelope = salmon.pack(xml, source_account.keypair)
     salmon.post(target_account.salmon_url, envelope)
   end
 
   private
 
-  def entry_xml(stream_entry)
-    Nokogiri::XML::Builder.new do |xml|
-      entry(xml, true) do
-        author(xml) do
-          include_author xml, stream_entry.account
-        end
-
-        include_entry xml, stream_entry
-      end
-    end.to_xml
-  end
-
   def salmon
     @salmon ||= OStatus2::Salmon.new
   end
diff --git a/app/services/unblock_service.rb b/app/services/unblock_service.rb
index f389364f9..84b1050c1 100644
--- a/app/services/unblock_service.rb
+++ b/app/services/unblock_service.rb
@@ -1,10 +1,12 @@
 # frozen_string_literal: true
 
 class UnblockService < BaseService
+  include StreamEntryRenderer
+
   def call(account, target_account)
     return unless account.blocking?(target_account)
 
     unblock = account.unblock!(target_account)
-    NotificationWorker.perform_async(unblock.stream_entry.id, target_account.id) unless target_account.local?
+    NotificationWorker.perform_async(stream_entry_to_xml(unblock.stream_entry), account.id, target_account.id) unless target_account.local?
   end
 end
diff --git a/app/services/unfavourite_service.rb b/app/services/unfavourite_service.rb
index de6e84e7d..04293ee08 100644
--- a/app/services/unfavourite_service.rb
+++ b/app/services/unfavourite_service.rb
@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 class UnfavouriteService < BaseService
+  include StreamEntryRenderer
+
   def call(account, status)
     favourite = Favourite.find_by!(account: account, status: status)
     favourite.destroy!
 
     unless status.local?
-      NotificationWorker.perform_async(favourite.stream_entry.id, status.account_id)
+      NotificationWorker.perform_async(stream_entry_to_xml(favourite.stream_entry), account.id, status.account_id)
     end
 
     favourite
diff --git a/app/services/unfollow_service.rb b/app/services/unfollow_service.rb
index f469793c1..178da4da3 100644
--- a/app/services/unfollow_service.rb
+++ b/app/services/unfollow_service.rb
@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 class UnfollowService < BaseService
+  include StreamEntryRenderer
+
   # Unfollow and notify the remote user
   # @param [Account] source_account Where to unfollow from
   # @param [Account] target_account Which to unfollow
   def call(source_account, target_account)
     follow = source_account.unfollow!(target_account)
-    NotificationWorker.perform_async(follow.stream_entry.id, target_account.id) unless target_account.local?
+    NotificationWorker.perform_async(stream_entry_to_xml(follow.stream_entry), source_account.id, target_account.id) unless target_account.local?
     UnmergeWorker.perform_async(target_account.id, source_account.id)
   end
 end
diff --git a/app/services/update_remote_profile_service.rb b/app/services/update_remote_profile_service.rb
index ad9c56540..dc315db19 100644
--- a/app/services/update_remote_profile_service.rb
+++ b/app/services/update_remote_profile_service.rb
@@ -10,6 +10,7 @@ class UpdateRemoteProfileService < BaseService
     unless author_xml.nil?
       account.display_name = author_xml.at_xpath('./poco:displayName', poco: TagManager::POCO_XMLNS).content unless author_xml.at_xpath('./poco:displayName', poco: TagManager::POCO_XMLNS).nil?
       account.note         = author_xml.at_xpath('./poco:note', poco: TagManager::POCO_XMLNS).content unless author_xml.at_xpath('./poco:note', poco: TagManager::POCO_XMLNS).nil?
+      account.locked       = author_xml.at_xpath('./mastodon:scope', mastodon: TagManager::MTDN_XMLNS)&.content == 'private'
 
       unless account.suspended? || DomainBlock.find_by(domain: account.domain)&.reject_media?
         account.avatar_remote_url = author_xml.at_xpath('./xmlns:link[@rel="avatar"]', xmlns: TagManager::XMLNS)['href'] unless author_xml.at_xpath('./xmlns:link[@rel="avatar"]', xmlns: TagManager::XMLNS).nil? || author_xml.at_xpath('./xmlns:link[@rel="avatar"]', xmlns: TagManager::XMLNS)['href'].blank?
-- 
cgit 


From 514fdfa268989fad3a6dcf1a0bc5077ec23be6df Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Sat, 11 Feb 2017 13:48:28 +0100
Subject: Don't PuSH-resubscribe if already subscribed

---
 app/services/follow_service.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'app/services')

diff --git a/app/services/follow_service.rb b/app/services/follow_service.rb
index 45b7895b6..6ca834c19 100644
--- a/app/services/follow_service.rb
+++ b/app/services/follow_service.rb
@@ -39,7 +39,7 @@ class FollowService < BaseService
     if target_account.local?
       NotifyService.new.call(target_account, follow)
     else
-      subscribe_service.call(target_account)
+      subscribe_service.call(target_account) unless target_account.subscribed?
       NotificationWorker.perform_async(stream_entry_to_xml(follow.stream_entry), source_account.id, target_account.id)
     end
 
-- 
cgit 


From e610555e10356374d1f4e0e7ca11056580ec9f3b Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Sat, 11 Feb 2017 13:55:07 +0100
Subject: Fix processing of incoming authorizations/rejections

---
 app/services/process_interaction_service.rb | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

(limited to 'app/services')

diff --git a/app/services/process_interaction_service.rb b/app/services/process_interaction_service.rb
index 27f0758ce..8420ca351 100644
--- a/app/services/process_interaction_service.rb
+++ b/app/services/process_interaction_service.rb
@@ -33,6 +33,8 @@ class ProcessInteractionService < BaseService
         follow_request!(account, target_account) unless !target_account.locked? || target_account.blocking?(account)
       when :authorize
         authorize_follow_request!(account, target_account)
+      when :reject
+        reject_follow_request!(account, target_account)
       when :unfollow
         unfollow!(account, target_account)
       when :favorite
@@ -76,14 +78,20 @@ class ProcessInteractionService < BaseService
     NotifyService.new.call(target_account, follow)
   end
 
-  def follow_request(account, target_account)
+  def follow_request!(account, target_account)
     follow_request = FollowRequest.create!(account: account, target_account: target_account)
     NotifyService.new.call(target_account, follow_request)
   end
 
-  def authorize_target_account!(account, target_account)
+  def authorize_follow_request!(account, target_account)
     follow_request = FollowRequest.find_by(account: target_account, target_account: account)
     follow_request&.authorize!
+    SubscribeService.new.call(account) unless account.subscribed?
+  end
+
+  def reject_follow_request!(account, target_account)
+    follow_request = FollowRequest.find_by(account: target_account, target_account: account)
+    follow_request&.reject!
   end
 
   def unfollow!(account, target_account)
-- 
cgit 


From 00b5731ecb2c29dd5c79a233f046a9655031ec71 Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Sat, 11 Feb 2017 14:12:29 +0100
Subject: After FollowService, re-fetch remote account asynchronously, do
 nothing if account lock info was up to date, otherwise re-do the
 FollowService with now updated information

---
 app/services/fetch_remote_account_service.rb       |  4 +++-
 app/services/follow_service.rb                     |  2 ++
 app/workers/after_remote_follow_request_worker.rb  | 17 +++++++++++++++++
 app/workers/after_remote_follow_worker.rb          | 17 +++++++++++++++++
 spec/controllers/api/v1/follows_controller_spec.rb |  1 +
 5 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 app/workers/after_remote_follow_request_worker.rb
 create mode 100644 app/workers/after_remote_follow_worker.rb

(limited to 'app/services')

diff --git a/app/services/fetch_remote_account_service.rb b/app/services/fetch_remote_account_service.rb
index 3c3694a65..baefa3a86 100644
--- a/app/services/fetch_remote_account_service.rb
+++ b/app/services/fetch_remote_account_service.rb
@@ -22,7 +22,9 @@ class FetchRemoteAccountService < BaseService
 
     Rails.logger.debug "Going to webfinger #{username}@#{domain}"
 
-    return FollowRemoteAccountService.new.call("#{username}@#{domain}")
+    account = FollowRemoteAccountService.new.call("#{username}@#{domain}")
+    UpdateRemoteProfileService.new.call(xml, account) unless account.nil?
+    account
   rescue TypeError
     Rails.logger.debug "Unparseable URL given: #{url}"
     nil
diff --git a/app/services/follow_service.rb b/app/services/follow_service.rb
index 6ca834c19..ac0392d16 100644
--- a/app/services/follow_service.rb
+++ b/app/services/follow_service.rb
@@ -28,6 +28,7 @@ class FollowService < BaseService
       NotifyService.new.call(target_account, follow_request)
     else
       NotificationWorker.perform_async(stream_entry_to_xml(follow_request.stream_entry), source_account.id, target_account.id)
+      AfterRemoteFollowRequestWorker.perform_async(follow_request.id)
     end
 
     follow_request
@@ -41,6 +42,7 @@ class FollowService < BaseService
     else
       subscribe_service.call(target_account) unless target_account.subscribed?
       NotificationWorker.perform_async(stream_entry_to_xml(follow.stream_entry), source_account.id, target_account.id)
+      AfterRemoteFollowWorker.perform_async(follow.id)
     end
 
     MergeWorker.perform_async(target_account.id, source_account.id)
diff --git a/app/workers/after_remote_follow_request_worker.rb b/app/workers/after_remote_follow_request_worker.rb
new file mode 100644
index 000000000..ad94d2769
--- /dev/null
+++ b/app/workers/after_remote_follow_request_worker.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class AfterRemoteFollowRequestWorker
+  include Sidekiq::Worker
+
+  sidekiq_options retry: 5
+
+  def perform(follow_request_id)
+    follow_request  = FollowRequest.find(follow_request_id)
+    updated_account = FetchRemoteAccountService.new.call(follow_request.target_account.remote_url)
+
+    return if updated_account.locked?
+
+    follow_request.destroy
+    FollowService.new.call(follow_request.account, updated_account.acct)
+  end
+end
diff --git a/app/workers/after_remote_follow_worker.rb b/app/workers/after_remote_follow_worker.rb
new file mode 100644
index 000000000..496aaf73e
--- /dev/null
+++ b/app/workers/after_remote_follow_worker.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class AfterRemoteFollowWorker
+  include Sidekiq::Worker
+
+  sidekiq_options retry: 5
+
+  def perform(follow_id)
+    follow          = Follow.find(follow_id)
+    updated_account = FetchRemoteAccountService.new.call(follow.target_account.remote_url)
+
+    return unless updated_account.locked?
+
+    follow.destroy
+    FollowService.new.call(follow.account, updated_account.acct)
+  end
+end
diff --git a/spec/controllers/api/v1/follows_controller_spec.rb b/spec/controllers/api/v1/follows_controller_spec.rb
index 97d69ab7b..cc4958ab5 100644
--- a/spec/controllers/api/v1/follows_controller_spec.rb
+++ b/spec/controllers/api/v1/follows_controller_spec.rb
@@ -14,6 +14,7 @@ RSpec.describe Api::V1::FollowsController, type: :controller do
     before do
       stub_request(:get,  "https://quitter.no/.well-known/host-meta").to_return(request_fixture('.host-meta.txt'))
       stub_request(:get,  "https://quitter.no/.well-known/webfinger?resource=acct:gargron@quitter.no").to_return(request_fixture('webfinger.txt'))
+      stub_request(:head, "https://quitter.no/api/statuses/user_timeline/7477.atom").to_return(:status => 405, :body => "", :headers => {})
       stub_request(:get,  "https://quitter.no/api/statuses/user_timeline/7477.atom").to_return(request_fixture('feed.txt'))
       stub_request(:get,  "https://quitter.no/avatar/7477-300-20160211190340.png").to_return(request_fixture('avatar.txt'))
       stub_request(:post, "https://quitter.no/main/push/hub").to_return(:status => 200, :body => "", :headers => {})
-- 
cgit 


From dc851c922ee1c244146baf1415a7bce4a25cccef Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Sat, 11 Feb 2017 15:10:22 +0100
Subject: Mentions in private statuses allow mentioned people to see them

---
 app/lib/feed_manager.rb                  |  1 -
 app/models/status.rb                     | 10 +++++++++-
 app/services/process_feed_service.rb     | 18 +++++++-----------
 app/services/process_mentions_service.rb |  2 --
 4 files changed, 16 insertions(+), 15 deletions(-)

(limited to 'app/services')

diff --git a/app/lib/feed_manager.rb b/app/lib/feed_manager.rb
index f0928a945..623a1af03 100644
--- a/app/lib/feed_manager.rb
+++ b/app/lib/feed_manager.rb
@@ -107,7 +107,6 @@ class FeedManager
     should_filter ||= receiver.blocking?(status.account)                                    # or it's from someone I blocked
     should_filter ||= receiver.blocking?(status.mentions.includes(:account).map(&:account)) # or if it mentions someone I blocked
     should_filter ||= (status.account.silenced? && !receiver.following?(status.account))    # of if the account is silenced and I'm not following them
-    should_filter ||= (status.private_visibility? && !receiver.following?(status.account))  # or if the mentioned account is not permitted to see the private status
 
     if status.reply? && !status.in_reply_to_account_id.nil?                                 # or it's a reply
       should_filter ||= receiver.blocking?(status.in_reply_to_account)                      # to a user I blocked
diff --git a/app/models/status.rb b/app/models/status.rb
index d2be72308..93594ec8f 100644
--- a/app/models/status.rb
+++ b/app/models/status.rb
@@ -76,7 +76,11 @@ class Status < ApplicationRecord
   end
 
   def permitted?(other_account = nil)
-    private_visibility? ? (account.id == other_account&.id || other_account&.following?(account)) : other_account.nil? || !account.blocking?(other_account)
+    if private_visibility?
+      (account.id == other_account&.id || other_account&.following?(account) || mentions.include?(other_account))
+    else
+      other_account.nil? || !account.blocking?(other_account)
+    end
   end
 
   def ancestors(account = nil)
@@ -153,6 +157,10 @@ class Status < ApplicationRecord
         where('1 = 1')
       elsif !account.nil? && target_account.blocking?(account)
         where('1 = 0')
+      elsif !account.nil?
+        joins('LEFT OUTER JOIN mentions ON statuses.id = mentions.status_id')
+          .where('mentions.account_id = ?', account.id)
+          .where('statuses.visibility != ? OR mentions.id IS NOT NULL', Status.visibilities[:private])
       else
         where.not(visibility: :private)
       end
diff --git a/app/services/process_feed_service.rb b/app/services/process_feed_service.rb
index c411e3e82..f0a62aa14 100644
--- a/app/services/process_feed_service.rb
+++ b/app/services/process_feed_service.rb
@@ -106,7 +106,8 @@ class ProcessFeedService < BaseService
         text: content(entry),
         spoiler_text: content_warning(entry),
         created_at: published(entry),
-        reply: thread?(entry)
+        reply: thread?(entry),
+        visibility: visibility_scope(entry)
       )
 
       if thread?(entry)
@@ -144,15 +145,9 @@ class ProcessFeedService < BaseService
 
     def mentions_from_xml(parent, xml)
       processed_account_ids = []
-      public_visibility     = false
 
       xml.xpath('./xmlns:link[@rel="mentioned"]', xmlns: TagManager::XMLNS).each do |link|
-        if link['ostatus:object-type'] == TagManager::TYPES[:collection] && link['href'] == TagManager::COLLECTIONS[:public]
-          public_visibility = true
-          next
-        elsif link['ostatus:object-type'] == TagManager::TYPES[:group]
-          next
-        end
+        next if [TagManager::TYPES[:group], TagManager::TYPES[:collection]].include? link['ostatus:object-type']
 
         url = Addressable::URI.parse(link['href'])
 
@@ -172,9 +167,6 @@ class ProcessFeedService < BaseService
         # So we can skip duplicate mentions
         processed_account_ids << mentioned_account.id
       end
-
-      parent.visibility = public_visibility ? :public : :unlisted
-      parent.save!
     end
 
     def hashtags_from_xml(parent, xml)
@@ -230,6 +222,10 @@ class ProcessFeedService < BaseService
       xml.at_xpath('./xmlns:summary', xmlns: TagManager::XMLNS)&.content || ''
     end
 
+    def visibility_scope(xml = @xml)
+      xml.at_xpath('./mastodon:scope', mastodon: TagManager::MTDN_XMLNS)&.content&.to_sym || :public
+    end
+
     def published(xml = @xml)
       xml.at_xpath('./xmlns:published', xmlns: TagManager::XMLNS).content
     end
diff --git a/app/services/process_mentions_service.rb b/app/services/process_mentions_service.rb
index 67fd3dcf7..d3d3af8af 100644
--- a/app/services/process_mentions_service.rb
+++ b/app/services/process_mentions_service.rb
@@ -30,8 +30,6 @@ class ProcessMentionsService < BaseService
     status.mentions.each do |mention|
       mentioned_account = mention.account
 
-      next if status.private_visibility? && (!mentioned_account.following?(status.account) || !mentioned_account.local?)
-
       if mentioned_account.local?
         NotifyService.new.call(mentioned_account, mention)
       else
-- 
cgit