fix(privileges): route ActivityPub URIs to fediverse pseudo-user check

When a remote ActivityPub actor sends a signed request, req.uid is set
to the actor's URI. Previously, non-numeric uids were treated as group
names and checked against registered-users privileges, bypassing the
expected permission model.

Remote actors are now routed to the fediverse pseudo-user (-2) check,
respecting the fediverse group's privileges on the category. This
preserves the admin-controlled UX while closing the bypass.

Assisted-by: unsloth/Qwen3.6-35B-A3B-GGUF

Author: julianlam

src/privileges/helpers.js

@@ -9,6 +9,7 @@ const user = require('../user');
 const categories = require('../categories');
 const plugins = require('../plugins');
 const utils = require('../utils');
+const activitypub = require('../activitypub');
 
 const helpers = module.exports;
 
@@ -75,6 +76,11 @@ async function isAllowedToCids(privilege, uidOrGroupName, cids) {
 
 	const groupKeys = cids.map(cid => `cid:${cid}:privileges:groups:${privilege}`);
 
+	// Remote ActivityPub actors (URIs) are treated as the fediverse pseudo-user
+	if (activitypub.helpers.isUri(uidOrGroupName)) {
+		return await isSystemGroupAllowedToCids(privilege, -2, cids);
+	}
+
 	// Group handling
 	if (!utils.isNumber(uidOrGroupName) && (uidOrGroupName || '').length) {
 		return await checkIfAllowedGroup(uidOrGroupName, groupKeys);
@@ -91,6 +97,11 @@ async function isAllowedToCids(privilege, uidOrGroupName, cids) {
 
 async function isAllowedToPrivileges(privileges, uidOrGroupName, cid) {
 	const groupKeys = privileges.map(privilege => `cid:${cid}:privileges:groups:${privilege}`);
+	// Remote ActivityPub actors (URIs) are treated as the fediverse pseudo-user
+	if (activitypub.helpers.isUri(uidOrGroupName)) {
+		return await isSystemGroupAllowedToPrivileges(privileges, -2, cid);
+	}
+
 	// Group handling
 	if (isNaN(parseInt(uidOrGroupName, 10)) && (uidOrGroupName || '').length) {
 		return await checkIfAllowedGroup(uidOrGroupName, groupKeys);