feat: implement inbox forwarding (AP spec section 7.1.2) #21

New Issue

GKaszewski · 2026-07-25T14:25:32Z

GKaszewski commented

2026-07-25 14:25:32 +00:00

Problem

The AP spec (section 7.1.2) says servers SHOULD forward activities to members of collections mentioned in to/cc/audience when those members are on different servers. k-ap currently does not implement inbox forwarding — inbound activities are processed locally but never re-delivered to other servers that should receive them.

This matters for multi-user instances where User A receives a reply addressed to cc: [User B's followers collection] and User B's followers are on other servers.

What needs to happen

When an inbound activity's to/cc/audience contains a collection URL that belongs to a local user (e.g. https://example.com/users/{id}/followers):

Resolve which remote inboxes are in that collection
Re-deliver the activity to those inboxes (signed by the collection owner)

Scope

Only forward activities from authenticated remote actors (signature verified)
Only forward when the collection URL matches a local user's followers/following URL
Deduplicate against inboxes that already received the activity directly
Rate-limit forwarding to prevent amplification attacks

Not required for single-user instances

This is a SHOULD in the spec, not a MUST. Single-user instances (like movies-diary) don't need it since there's only one user whose collections matter.

## Problem The AP spec (section 7.1.2) says servers SHOULD forward activities to members of collections mentioned in `to`/`cc`/`audience` when those members are on different servers. k-ap currently does not implement inbox forwarding — inbound activities are processed locally but never re-delivered to other servers that should receive them. This matters for multi-user instances where User A receives a reply addressed to `cc: [User B's followers collection]` and User B's followers are on other servers. ## What needs to happen When an inbound activity's `to`/`cc`/`audience` contains a collection URL that belongs to a local user (e.g. `https://example.com/users/{id}/followers`): 1. Resolve which remote inboxes are in that collection 2. Re-deliver the activity to those inboxes (signed by the collection owner) ## Scope - Only forward activities from authenticated remote actors (signature verified) - Only forward when the collection URL matches a local user's followers/following URL - Deduplicate against inboxes that already received the activity directly - Rate-limit forwarding to prevent amplification attacks ## Not required for single-user instances This is a SHOULD in the spec, not a MUST. Single-user instances (like movies-diary) don't need it since there's only one user whose collections matter.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GKaszewski/k-ap#21