inbox returns "202 Accepted" for invalid actor

[n-bernat]

Expected behaviour

4XX error

Actual behaviour

202 Accepted

Steps to reproduce the problem

Mastodon's [POST] /inbox endpoint returns 202 Accepted when provided to parameter in a Note is invalid. It's not something really important, but if someone else runs into this problem it may be a good idea to double-check this param.

Related issue that kinda mentions it but not really: #8328

Simple request that returns 202:

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "id": "https://example.com/notes/12345678/activity",
  "type": "Create",
  "actor": "https://example.com/actor",
  "object": {
    "id": "https://example.com/notes/12345678",
    "type": "Note",
    "published": "2021-09-21T14:19:18Z",
    "attributedTo": "https://example.com/actor",
    "content": "<p>Hello world</p>",
    "to": "https://mastodon.social/random-invalid-url"
  }
}

Specifications

Mastodon v3.4.1 (latest live on mastodon.social)

[ClearlyClaire]

Only very superficial checking is done synchronously when receiving an activity (basically, is the request signed, is it a valid json, does it look like ActivityStreams), the actual processing (and more advanced checking) is performed in a worker, so the results cannot be reflected by the response's status code.

I guess we could perform checks before queuing the job and returning a status code, but I'm not completely sure this is worth splitting the processing code that way.

[sventiffe]

I also find this behavior confusing although 202 seems to be totally accurate ("request has been accepted for processing, but the processing has not been completed").

I ran into this when accepting a Follow activity (from a relay). A relay will accept but if the payload is wrong (ie the original Follow activity) then the relay will not know that the Mastodon instance could not accept the Accept. It puts a lot of responsibility on the sender to get things right (and on the communication between the admins of sender and recipient if users notice that something is wrong).

I would probably expect a HTTP 4** if the Accept is syntactically/semantically incorrect. Given that I am not familiar how complex the change would be, I do not have a strong opinion though.

[matthewp]

In general, the 202 status makes it very hard to debug what you are doing wrong when building an ActivityPub app. You probably made a mistake but without any error responses you don't know where the problem might be.