More rework to make private communities working #11253
Conversation
src/Worker/Notifier.php
Outdated
| foreach (Tag::getByURIId($target_item['uri-id'], [Tag::EXCLUSIVE_MENTION]) as $tag) { | ||
| $target_contact = Contact::getByURL(Strings::normaliseLink($tag['url']), null, [], $uid); | ||
| if (($target_contact['contact-type'] == Contact::TYPE_COMMUNITY) && $target_contact['manually-approve']) { | ||
| Group::getMembersForForum($target_contact['id']); |
There was a problem hiding this comment.
Why do we need this inaccurately named method? It should be named updateMembersForforum but more to the point, why do we need a made-up group of followers now that Group::FOLLOWERS exists?
There was a problem hiding this comment.
When I send a message to a private forum then this message will be announced to the members. The members then receive the announce and then will request the message. Since the message is not public, I need to know who is allowed to fetch the message. So I request a current list of forum subscribers before performing the transmission.
There was a problem hiding this comment.
But can't this just be done with the rel field in the contact table, surely the forum node records which remote contacts are following the forum?
There was a problem hiding this comment.
It's not the forum that needs to know the forum users. It's the forum users who need to grant access to the other forum users.
There was a problem hiding this comment.
So there's a hidden user group per user per forum?
There was a problem hiding this comment.
This doesn't sound very scalable, is there no way we can go through the forum account to forward the posts submitted by members using the forum node local list of followers?
There was a problem hiding this comment.
It's all about the trust. The message flow is like this:
You have got Anna and Bob. Both are following the private community Alpha. Both aren't following each other. Now Anna creates a post. This post is transmitted to Alpha. Alpha then announces the post URL to their followers. Bob receives the announce, so he now fetches the content from Anna. At this point Anna has got to know whom she have to grant access to the post.
There was a problem hiding this comment.
Ah, I get it. Can't we do this with the contact-relation table instead? It would have everything in one place, including showing the group member list to its members on their respective node.
There was a problem hiding this comment.
No. The contact-relation contains only public data. So when a group disallow fetching the followers then it won't return anything. And in fact this PR introduces an automatic so that group members can never be fetched by non members.
The solution in this PR has the advantage that we need it any way for the post permissions.
|
Causing #11218 (comment)
At this point all we have is a list of contact ids, I don't know how to easily get the |
|
That PHP notice alternates with a PHP warning of the same wording on my system.
|
|
Yep, same issue. |
|
Yeah, I have a fix ready. |
This is another follow up to the previous PR.
It contains several different things to make private forums work. We hadn't stored the forum members when publishing a post. And also we are now working with "followers" in the group permissions and in the AP payload.
We also had a problem detecting the best user when no receiver was tagged. Also when fetching content locally we have to add ourselves to the permissions as well.
And finally some settings are now hardcoded for communities.