activity-pub implementation

crates/adapters/activitypub/Cargo.toml

@@ -0,0 +1,24 @@
+[package]
+name = "activitypub"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+domain = { workspace = true }
+application = { workspace = true }
+tokio = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+reqwest = { workspace = true }
+uuid = { workspace = true }
+chrono = { workspace = true }
+thiserror = { workspace = true }
+anyhow = { workspace = true }
+tracing = { workspace = true }
+async-trait = { workspace = true }
+event-publisher = { workspace = true }
+
+activitypub_federation = "0.7.0-beta.11"
+url = { version = "2", features = ["serde"] }
+enum_delegate = "0.2"
+axum = "0.8"

crates/adapters/activitypub/src/activities.rs

@@ -0,0 +1,314 @@
+use activitypub_federation::{
+    config::Data,
+    fetch::object_id::ObjectId,
+    kinds::activity::{AcceptType, CreateType, DeleteType, FollowType, RejectType, UndoType},
+    traits::{Activity, Actor, Object},
+};
+use serde::{Deserialize, Serialize};
+use url::Url;
+
+use crate::actors::DbActor;
+use crate::data::FederationData;
+use crate::error::Error;
+use crate::objects::{DbReview, ReviewObject};
+use crate::repository::FollowerStatus;
+
+// --- Follow ---
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct FollowActivity {
+    pub(crate) id: Url,
+    #[serde(rename = "type")]
+    pub(crate) kind: FollowType,
+    pub(crate) actor: ObjectId<DbActor>,
+    pub(crate) object: ObjectId<DbActor>,
+}
+
+#[async_trait::async_trait]
+impl Activity for FollowActivity {
+    type DataType = FederationData;
+    type Error = Error;
+
+    fn id(&self) -> &Url {
+        &self.id
+    }
+
+    fn actor(&self) -> &Url {
+        self.actor.inner()
+    }
+
+    async fn verify(&self, data: &Data<Self::DataType>) -> Result<(), Self::Error> {
+        // Verify the target is a local actor
+        let target_url = self.object.inner();
+        if target_url.domain() != Some(&data.domain) {
+            return Err(Error(anyhow::anyhow!(
+                "follow target is not a local actor"
+            )));
+        }
+        Ok(())
+    }
+
+    async fn receive(self, data: &Data<Self::DataType>) -> Result<(), Self::Error> {
+        let follower = self.actor.dereference(data).await?;
+        let local_actor = self.object.dereference(data).await?;
+
+        data.federation_repo
+            .add_follower(
+                local_actor.user_id.clone(),
+                self.actor.inner().as_str(),
+                FollowerStatus::Accepted,
+            )
+            .await?;
+
+        // Send Accept back
+        let accept_id =
+            Url::parse(&format!("{}/activities/{}", data.base_url, uuid::Uuid::new_v4()))
+                .expect("valid url");
+        let accept = AcceptActivity {
+            id: accept_id,
+            kind: Default::default(),
+            actor: self.object.clone(),
+            object: self.clone(),
+        };
+
+        use activitypub_federation::activity_sending::SendActivityTask;
+        use activitypub_federation::protocol::context::WithContext;
+
+        let accept_with_ctx = WithContext::new_default(accept);
+        let sends =
+            SendActivityTask::prepare(&accept_with_ctx, &local_actor, vec![follower.inbox()], data)
+                .await?;
+        for send in sends {
+            send.sign_and_send(data).await?;
+        }
+
+        tracing::info!(
+            follower = %self.actor.inner(),
+            local_user = %local_actor.user_id.value(),
+            "accepted follow"
+        );
+
+        Ok(())
+    }
+}
+
+// --- Accept ---
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AcceptActivity {
+    pub(crate) id: Url,
+    #[serde(rename = "type")]
+    pub(crate) kind: AcceptType,
+    pub(crate) actor: ObjectId<DbActor>,
+    pub(crate) object: FollowActivity,
+}
+
+#[async_trait::async_trait]
+impl Activity for AcceptActivity {
+    type DataType = FederationData;
+    type Error = Error;
+
+    fn id(&self) -> &Url {
+        &self.id
+    }
+
+    fn actor(&self) -> &Url {
+        self.actor.inner()
+    }
+
+    async fn verify(&self, _data: &Data<Self::DataType>) -> Result<(), Self::Error> {
+        Ok(())
+    }
+
+    async fn receive(self, _data: &Data<Self::DataType>) -> Result<(), Self::Error> {
+        let remote_actor_url = self.actor.into_inner().to_string();
+        tracing::info!(remote_actor_url = %remote_actor_url, "Follow accepted by remote instance");
+        // TODO(ap): update ap_following to track accepted status
+        Ok(())
+    }
+}
+
+// --- Reject ---
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct RejectActivity {
+    pub(crate) id: Url,
+    #[serde(rename = "type")]
+    pub(crate) kind: RejectType,
+    pub(crate) actor: ObjectId<DbActor>,
+    pub(crate) object: FollowActivity,
+}
+
+#[async_trait::async_trait]
+impl Activity for RejectActivity {
+    type DataType = FederationData;
+    type Error = Error;
+
+    fn id(&self) -> &Url {
+        &self.id
+    }
+
+    fn actor(&self) -> &Url {
+        self.actor.inner()
+    }
+
+    async fn verify(&self, _data: &Data<Self::DataType>) -> Result<(), Self::Error> {
+        Ok(())
+    }
+
+    async fn receive(self, data: &Data<Self::DataType>) -> Result<(), Self::Error> {
+        // The actor rejected our follow. Extract the local user from the original Follow's actor.
+        let local_user_url = self.object.actor.inner();
+        let path = local_user_url.path();
+        if let Some(uid_str) = path.strip_prefix("/users/").and_then(|s| s.split('/').next()) {
+            if let Ok(uuid) = uuid::Uuid::parse_str(uid_str) {
+                let user_id = domain::value_objects::UserId::from_uuid(uuid);
+                data.federation_repo
+                    .remove_following(user_id, self.actor.inner().as_str())
+                    .await?;
+            }
+        }
+        tracing::info!(actor = %self.actor.inner(), "follow rejected");
+        Ok(())
+    }
+}
+
+// --- Undo ---
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct UndoActivity {
+    pub(crate) id: Url,
+    #[serde(rename = "type")]
+    pub(crate) kind: UndoType,
+    pub(crate) actor: ObjectId<DbActor>,
+    pub(crate) object: FollowActivity,
+}
+
+#[async_trait::async_trait]
+impl Activity for UndoActivity {
+    type DataType = FederationData;
+    type Error = Error;
+
+    fn id(&self) -> &Url {
+        &self.id
+    }
+
+    fn actor(&self) -> &Url {
+        self.actor.inner()
+    }
+
+    async fn verify(&self, _data: &Data<Self::DataType>) -> Result<(), Self::Error> {
+        Ok(())
+    }
+
+    async fn receive(self, data: &Data<Self::DataType>) -> Result<(), Self::Error> {
+        // Remote actor is unfollowing a local user
+        let local_user_url = self.object.object.inner();
+        let path = local_user_url.path();
+        if let Some(uid_str) = path.strip_prefix("/users/").and_then(|s| s.split('/').next()) {
+            if let Ok(uuid) = uuid::Uuid::parse_str(uid_str) {
+                let user_id = domain::value_objects::UserId::from_uuid(uuid);
+                data.federation_repo
+                    .remove_follower(user_id, self.actor.inner().as_str())
+                    .await?;
+            }
+        }
+        tracing::info!(actor = %self.actor.inner(), "unfollowed");
+        Ok(())
+    }
+}
+
+// --- Create ---
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CreateActivity {
+    pub(crate) id: Url,
+    #[serde(rename = "type")]
+    pub(crate) kind: CreateType,
+    pub(crate) actor: ObjectId<DbActor>,
+    pub(crate) object: ReviewObject,
+}
+
+#[async_trait::async_trait]
+impl Activity for CreateActivity {
+    type DataType = FederationData;
+    type Error = Error;
+
+    fn id(&self) -> &Url {
+        &self.id
+    }
+
+    fn actor(&self) -> &Url {
+        self.actor.inner()
+    }
+
+    async fn verify(&self, _data: &Data<Self::DataType>) -> Result<(), Self::Error> {
+        Ok(())
+    }
+
+    async fn receive(self, data: &Data<Self::DataType>) -> Result<(), Self::Error> {
+        DbReview::from_json(self.object, data).await?;
+        tracing::info!(actor = %self.actor.inner(), "received review");
+        Ok(())
+    }
+}
+
+// --- Delete ---
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DeleteActivity {
+    pub(crate) id: Url,
+    #[serde(rename = "type")]
+    pub(crate) kind: DeleteType,
+    pub(crate) actor: ObjectId<DbActor>,
+    pub(crate) object: Url,
+}
+
+#[async_trait::async_trait]
+impl Activity for DeleteActivity {
+    type DataType = FederationData;
+    type Error = Error;
+
+    fn id(&self) -> &Url {
+        &self.id
+    }
+
+    fn actor(&self) -> &Url {
+        self.actor.inner()
+    }
+
+    async fn verify(&self, _data: &Data<Self::DataType>) -> Result<(), Self::Error> {
+        Ok(())
+    }
+
+    async fn receive(self, _data: &Data<Self::DataType>) -> Result<(), Self::Error> {
+        tracing::info!(actor = %self.actor.inner(), object = %self.object, "delete received (no-op)");
+        Ok(())
+    }
+}
+
+// --- Inbox dispatch enum ---
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(tag = "type")]
+#[enum_delegate::implement(Activity)]
+pub enum InboxActivities {
+    #[serde(rename = "Follow")]
+    Follow(FollowActivity),
+    #[serde(rename = "Accept")]
+    Accept(AcceptActivity),
+    #[serde(rename = "Reject")]
+    Reject(RejectActivity),
+    #[serde(rename = "Undo")]
+    Undo(UndoActivity),
+    #[serde(rename = "Create")]
+    Create(CreateActivity),
+    #[serde(rename = "Delete")]
+    Delete(DeleteActivity),
+}

crates/adapters/activitypub/src/actor_handler.rs

@@ -0,0 +1,24 @@
+use activitypub_federation::{
+    axum::json::FederationJson, config::Data, protocol::context::WithContext, traits::Object,
+};
+use axum::extract::Path;
+
+use domain::value_objects::UserId;
+
+use crate::actors::{get_local_actor, Person};
+use crate::data::FederationData;
+use crate::error::Error;
+
+pub async fn actor_handler(
+    Path(user_id_str): Path<String>,
+    data: Data<FederationData>,
+) -> Result<FederationJson<WithContext<Person>>, Error> {
+    let uuid = uuid::Uuid::parse_str(&user_id_str)
+        .map_err(|_| Error(anyhow::anyhow!("invalid user id")))?;
+    let user_id = UserId::from_uuid(uuid);
+
+    let db_actor = get_local_actor(user_id, &data).await?;
+    let person = db_actor.into_json(&data).await?;
+
+    Ok(FederationJson(WithContext::new_default(person)))
+}

crates/adapters/activitypub/src/actors.rs

@@ -0,0 +1,258 @@
+use activitypub_federation::{
+    config::Data,
+    fetch::object_id::ObjectId,
+    http_signatures::generate_actor_keypair,
+    kinds::actor::PersonType,
+    protocol::{public_key::PublicKey, verification::verify_domains_match},
+    traits::{Actor, Object},
+};
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use url::Url;
+
+use domain::value_objects::UserId;
+
+use crate::data::FederationData;
+use crate::error::Error;
+use crate::repository::RemoteActor;
+
+#[derive(Debug, Clone)]
+pub struct DbActor {
+    pub user_id: UserId,
+    pub email: String,
+    pub public_key_pem: String,
+    pub private_key_pem: Option<String>,
+    pub inbox_url: Url,
+    pub outbox_url: Url,
+    pub followers_url: Url,
+    pub following_url: Url,
+    pub ap_id: Url,
+    pub last_refreshed_at: DateTime<Utc>,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Person {
+    #[serde(rename = "type")]
+    kind: PersonType,
+    id: ObjectId<DbActor>,
+    preferred_username: String,
+    inbox: Url,
+    outbox: Url,
+    followers: Url,
+    following: Url,
+    public_key: PublicKey,
+    name: Option<String>,
+}
+
+pub fn actor_url(base_url: &str, user_id: &UserId) -> Url {
+    Url::parse(&format!("{}/users/{}", base_url, user_id.value())).expect("valid actor url")
+}
+
+pub async fn get_local_actor(
+    user_id: UserId,
+    data: &Data<FederationData>,
+) -> Result<DbActor, Error> {
+    let user = data
+        .user_repo
+        .find_by_id(&user_id)
+        .await
+        .map_err(|e| Error(e.into()))?
+        .ok_or_else(|| Error(anyhow::anyhow!("user not found: {}", user_id.value())))?;
+
+    let (public_key, private_key) = match data
+        .federation_repo
+        .get_local_actor_keypair(user_id.clone())
+        .await?
+    {
+        Some(kp) => kp,
+        None => {
+            let kp = generate_actor_keypair()?;
+            data.federation_repo
+                .save_local_actor_keypair(
+                    user_id.clone(),
+                    kp.public_key.clone(),
+                    kp.private_key.clone(),
+                )
+                .await?;
+            (kp.public_key, kp.private_key)
+        }
+    };
+
+    let ap_id = actor_url(&data.base_url, user.id());
+    let inbox_url = Url::parse(&format!("{}/inbox", &ap_id)).expect("valid inbox url");
+    let outbox_url = Url::parse(&format!("{}/outbox", &ap_id)).expect("valid outbox url");
+    let followers_url = Url::parse(&format!("{}/followers", &ap_id)).expect("valid followers url");
+    let following_url = Url::parse(&format!("{}/following", &ap_id)).expect("valid following url");
+
+    Ok(DbActor {
+        user_id: user.id().clone(),
+        email: user.email().value().to_string(),
+        public_key_pem: public_key,
+        private_key_pem: Some(private_key),
+        inbox_url,
+        outbox_url,
+        followers_url,
+        following_url,
+        ap_id,
+        last_refreshed_at: Utc::now(),
+    })
+}
+
+#[async_trait::async_trait]
+impl Object for DbActor {
+    type DataType = FederationData;
+    type Kind = Person;
+    type Error = Error;
+
+    fn id(&self) -> &Url {
+        &self.ap_id
+    }
+
+    fn last_refreshed_at(&self) -> Option<DateTime<Utc>> {
+        Some(self.last_refreshed_at)
+    }
+
+    async fn read_from_id(
+        object_id: Url,
+        data: &Data<Self::DataType>,
+    ) -> Result<Option<Self>, Self::Error> {
+        // Extract user_id from URL path: /users/{uuid}
+        let path = object_id.path();
+        let user_id_str = path
+            .strip_prefix("/users/")
+            .and_then(|s| s.split('/').next());
+
+        let user_id_str = match user_id_str {
+            Some(s) => s,
+            None => return Ok(None),
+        };
+
+        let uuid = match uuid::Uuid::parse_str(user_id_str) {
+            Ok(u) => u,
+            Err(_) => return Ok(None),
+        };
+
+        let user_id = UserId::from_uuid(uuid);
+        let user = match data.user_repo.find_by_id(&user_id).await {
+            Ok(Some(u)) => u,
+            _ => return Ok(None),
+        };
+
+        let keypair = data
+            .federation_repo
+            .get_local_actor_keypair(user_id.clone())
+            .await?;
+
+        let (public_key, private_key) = match keypair {
+            Some(kp) => (kp.0, Some(kp.1)),
+            None => return Ok(None),
+        };
+
+        let ap_id = actor_url(&data.base_url, user.id());
+        let inbox_url = Url::parse(&format!("{}/inbox", &ap_id)).expect("valid url");
+        let outbox_url = Url::parse(&format!("{}/outbox", &ap_id)).expect("valid url");
+        let followers_url = Url::parse(&format!("{}/followers", &ap_id)).expect("valid url");
+        let following_url = Url::parse(&format!("{}/following", &ap_id)).expect("valid url");
+
+        Ok(Some(DbActor {
+            user_id: user.id().clone(),
+            email: user.email().value().to_string(),
+            public_key_pem: public_key,
+            private_key_pem: private_key,
+            inbox_url,
+            outbox_url,
+            followers_url,
+            following_url,
+            ap_id,
+            last_refreshed_at: Utc::now(),
+        }))
+    }
+
+    async fn into_json(self, _data: &Data<Self::DataType>) -> Result<Self::Kind, Self::Error> {
+        let public_key = PublicKey {
+            id: format!("{}#main-key", &self.ap_id),
+            owner: self.ap_id.clone(),
+            public_key_pem: self.public_key_pem.clone(),
+        };
+
+        Ok(Person {
+            kind: Default::default(),
+            id: self.ap_id.clone().into(),
+            preferred_username: self
+                .email
+                .split('@')
+                .next()
+                .unwrap_or(&self.email)
+                .to_string(),
+            inbox: self.inbox_url.clone(),
+            outbox: self.outbox_url.clone(),
+            followers: self.followers_url.clone(),
+            following: self.following_url.clone(),
+            public_key,
+            name: Some(self.email.clone()),
+        })
+    }
+
+    async fn verify(
+        json: &Self::Kind,
+        expected_domain: &Url,
+        _data: &Data<Self::DataType>,
+    ) -> Result<(), Self::Error> {
+        verify_domains_match(json.id.inner(), expected_domain)?;
+        Ok(())
+    }
+
+    async fn from_json(
+        json: Self::Kind,
+        data: &Data<Self::DataType>,
+    ) -> Result<Self, Self::Error> {
+        let actor = RemoteActor {
+            url: json.id.inner().to_string(),
+            handle: json.preferred_username.clone(),
+            inbox_url: json.inbox.to_string(),
+            shared_inbox_url: None,
+            display_name: json.name.clone(),
+        };
+        data.federation_repo.upsert_remote_actor(actor).await?;
+
+        // Deterministic UUID from actor URL so the same remote actor always maps to the same UserId
+        let url_str = json.id.inner().to_string();
+        let stable_id = uuid::Uuid::new_v5(&uuid::Uuid::NAMESPACE_URL, url_str.as_bytes());
+        let user_id = UserId::from_uuid(stable_id);
+        let ap_id = json.id.inner().clone();
+        let inbox_url = json.inbox.clone();
+        let outbox_url = json.outbox.clone();
+        let followers_url = json.followers.clone();
+        let following_url = json.following.clone();
+
+        Ok(DbActor {
+            user_id,
+            email: json
+                .name
+                .unwrap_or_else(|| json.preferred_username.clone()),
+            public_key_pem: json.public_key.public_key_pem,
+            private_key_pem: None,
+            inbox_url,
+            outbox_url,
+            followers_url,
+            following_url,
+            ap_id,
+            last_refreshed_at: Utc::now(),
+        })
+    }
+}
+
+impl Actor for DbActor {
+    fn public_key_pem(&self) -> &str {
+        &self.public_key_pem
+    }
+
+    fn private_key_pem(&self) -> Option<String> {
+        self.private_key_pem.clone()
+    }
+
+    fn inbox(&self) -> Url {
+        self.inbox_url.clone()
+    }
+}

crates/adapters/activitypub/src/data.rs

@@ -0,0 +1,35 @@
+use std::sync::Arc;
+
+use domain::ports::UserRepository;
+
+use crate::repository::FederationRepository;
+
+#[derive(Clone)]
+pub struct FederationData {
+    pub(crate) federation_repo: Arc<dyn FederationRepository>,
+    pub(crate) user_repo: Arc<dyn UserRepository>,
+    pub(crate) base_url: String,
+    pub(crate) domain: String,
+}
+
+impl FederationData {
+    pub fn new(
+        federation_repo: Arc<dyn FederationRepository>,
+        user_repo: Arc<dyn UserRepository>,
+        base_url: String,
+    ) -> Self {
+        let domain = base_url
+            .trim_start_matches("https://")
+            .trim_start_matches("http://")
+            .split('/')
+            .next()
+            .unwrap_or("")
+            .to_string();
+        Self {
+            federation_repo,
+            user_repo,
+            base_url,
+            domain,
+        }
+    }
+}

crates/adapters/activitypub/src/error.rs

@@ -0,0 +1,36 @@
+use std::fmt::{Display, Formatter};
+
+#[derive(Debug)]
+pub struct Error(pub(crate) anyhow::Error);
+
+impl Display for Error {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        std::fmt::Display::fmt(&self.0, f)
+    }
+}
+
+impl<T> From<T> for Error
+where
+    T: Into<anyhow::Error>,
+{
+    fn from(t: T) -> Self {
+        Error(t.into())
+    }
+}
+
+impl axum::response::IntoResponse for Error {
+    fn into_response(self) -> axum::response::Response {
+        let msg = self.0.to_string();
+        let status = if msg.contains("not found") {
+            tracing::debug!(error = %msg, "AP: not found");
+            (axum::http::StatusCode::NOT_FOUND, "Not found")
+        } else if msg.contains("invalid") || msg.contains("bad") {
+            tracing::debug!(error = %msg, "AP: bad request");
+            (axum::http::StatusCode::BAD_REQUEST, "Bad request")
+        } else {
+            tracing::error!(error = %msg, "AP: internal error");
+            (axum::http::StatusCode::INTERNAL_SERVER_ERROR, "Internal server error")
+        };
+        status.into_response()
+    }
+}

crates/adapters/activitypub/src/event_handler.rs

@@ -0,0 +1,127 @@
+use activitypub_federation::{
+    activity_sending::SendActivityTask,
+    fetch::object_id::ObjectId,
+    protocol::context::WithContext,
+};
+use async_trait::async_trait;
+use chrono::{DateTime, Utc};
+use domain::{
+    errors::DomainError,
+    events::DomainEvent,
+    value_objects::{ReviewId, UserId},
+};
+use event_publisher::EventHandler;
+use url::Url;
+
+use crate::{
+    activities::CreateActivity,
+    actors::{actor_url, get_local_actor},
+    federation::ApFederationConfig,
+    objects::{review_url, ReviewObject},
+    repository::FollowerStatus,
+};
+
+pub struct ActivityPubEventHandler {
+    federation_config: ApFederationConfig,
+    base_url: String,
+}
+
+impl ActivityPubEventHandler {
+    pub fn new(federation_config: ApFederationConfig, base_url: String) -> Self {
+        Self {
+            federation_config,
+            base_url,
+        }
+    }
+}
+
+#[async_trait]
+impl EventHandler for ActivityPubEventHandler {
+    async fn handle(&self, event: &DomainEvent) -> Result<(), DomainError> {
+        match event {
+            DomainEvent::ReviewLogged {
+                review_id,
+                user_id,
+                rating,
+                watched_at,
+                ..
+            } => self
+                .on_review_logged(user_id, review_id, rating.value(), *watched_at)
+                .await
+                .map_err(|e| DomainError::InfrastructureError(e.to_string())),
+            _ => Ok(()),
+        }
+    }
+}
+
+impl ActivityPubEventHandler {
+    async fn on_review_logged(
+        &self,
+        user_id: &UserId,
+        review_id: &ReviewId,
+        rating: u8,
+        watched_at: chrono::NaiveDateTime,
+    ) -> anyhow::Result<()> {
+        let data = self.federation_config.to_request_data();
+
+        let followers = data.federation_repo.get_followers(user_id.clone()).await?;
+        let accepted: Vec<_> = followers
+            .into_iter()
+            .filter(|f| f.status == FollowerStatus::Accepted)
+            .collect();
+
+        if accepted.is_empty() {
+            return Ok(());
+        }
+
+        let local_actor = get_local_actor(user_id.clone(), &data)
+            .await
+            .map_err(|e| anyhow::anyhow!("{e}"))?;
+
+        let review_id_url = review_url(&self.base_url, review_id);
+        let actor_id = actor_url(&self.base_url, user_id);
+        let activity_id = Url::parse(&format!(
+            "{}/activities/{}",
+            self.base_url,
+            uuid::Uuid::new_v4()
+        ))?;
+
+        let stars = "\u{2B50}".repeat(rating as usize);
+        let now = DateTime::from_naive_utc_and_offset(watched_at, Utc);
+
+        let object = ReviewObject {
+            kind: "Review".to_string(),
+            id: review_id_url.into(),
+            attributed_to: actor_id.into(),
+            content: format!("{} (movie review)", stars),
+            published: Utc::now(),
+            movie_title: "Unknown".to_string(), // TODO: fetch from MovieRepository
+            rating,
+            comment: None,
+            watched_at: now,
+        };
+
+        let create = CreateActivity {
+            id: activity_id,
+            kind: Default::default(),
+            actor: ObjectId::from(local_actor.ap_id.clone()),
+            object,
+        };
+        let create_with_ctx = WithContext::new_default(create);
+
+        let inboxes: Vec<Url> = accepted
+            .iter()
+            .filter_map(|f| Url::parse(&f.actor.inbox_url).ok())
+            .collect();
+
+        let sends =
+            SendActivityTask::prepare(&create_with_ctx, &local_actor, inboxes, &data).await?;
+        for send in sends {
+            if let Err(e) = send.sign_and_send(&data).await {
+                tracing::warn!(error = %e, "failed to deliver activity to follower");
+            }
+        }
+
+        Ok(())
+    }
+}

crates/adapters/activitypub/src/federation.rs

@@ -0,0 +1,26 @@
+use activitypub_federation::config::{Data, FederationConfig, FederationMiddleware};
+
+use crate::data::FederationData;
+
+#[derive(Clone)]
+pub struct ApFederationConfig(pub FederationConfig<FederationData>);
+
+impl ApFederationConfig {
+    pub async fn new(data: FederationData, debug: bool) -> anyhow::Result<Self> {
+        let config = FederationConfig::builder()
+            .domain(&data.domain)
+            .app_data(data)
+            .debug(debug)
+            .build()
+            .await?;
+        Ok(Self(config))
+    }
+
+    pub fn to_request_data(&self) -> Data<FederationData> {
+        self.0.to_request_data()
+    }
+
+    pub fn middleware(&self) -> FederationMiddleware<FederationData> {
+        FederationMiddleware::new(self.0.clone())
+    }
+}

crates/adapters/activitypub/src/followers_handler.rs

@@ -0,0 +1,62 @@
+use activitypub_federation::{axum::json::FederationJson, config::Data};
+use axum::extract::Path;
+use serde_json::json;
+
+use domain::value_objects::UserId;
+
+use crate::data::FederationData;
+use crate::error::Error;
+
+pub async fn followers_handler(
+    Path(user_id_str): Path<String>,
+    data: Data<FederationData>,
+) -> Result<FederationJson<serde_json::Value>, Error> {
+    let user_id = UserId::from_uuid(
+        uuid::Uuid::parse_str(&user_id_str)
+            .map_err(|_| Error(anyhow::anyhow!("invalid user id")))?,
+    );
+
+    // verify user exists
+    data.user_repo
+        .find_by_id(&user_id)
+        .await
+        .map_err(|e| Error(e.into()))?
+        .ok_or_else(|| Error(anyhow::anyhow!("user not found")))?;
+
+    let id = format!("{}/users/{}/followers", data.base_url, user_id_str);
+    // TODO(ap): implement pagination
+    Ok(FederationJson(json!({
+        "@context": "https://www.w3.org/ns/activitystreams",
+        "type": "OrderedCollection",
+        "id": id,
+        "totalItems": 0,
+        "orderedItems": []
+    })))
+}
+
+pub async fn following_handler(
+    Path(user_id_str): Path<String>,
+    data: Data<FederationData>,
+) -> Result<FederationJson<serde_json::Value>, Error> {
+    let user_id = UserId::from_uuid(
+        uuid::Uuid::parse_str(&user_id_str)
+            .map_err(|_| Error(anyhow::anyhow!("invalid user id")))?,
+    );
+
+    // verify user exists
+    data.user_repo
+        .find_by_id(&user_id)
+        .await
+        .map_err(|e| Error(e.into()))?
+        .ok_or_else(|| Error(anyhow::anyhow!("user not found")))?;
+
+    let id = format!("{}/users/{}/following", data.base_url, user_id_str);
+    // TODO(ap): implement pagination
+    Ok(FederationJson(json!({
+        "@context": "https://www.w3.org/ns/activitystreams",
+        "type": "OrderedCollection",
+        "id": id,
+        "totalItems": 0,
+        "orderedItems": []
+    })))
+}

crates/adapters/activitypub/src/inbox.rs

@@ -0,0 +1,20 @@
+use activitypub_federation::{
+    axum::inbox::{receive_activity, ActivityData},
+    config::Data,
+    protocol::context::WithContext,
+};
+
+use crate::activities::InboxActivities;
+use crate::actors::DbActor;
+use crate::data::FederationData;
+use crate::error::Error;
+
+pub async fn inbox_handler(
+    data: Data<FederationData>,
+    activity_data: ActivityData,
+) -> Result<(), Error> {
+    receive_activity::<WithContext<InboxActivities>, DbActor, FederationData>(
+        activity_data, &data,
+    )
+    .await
+}

crates/adapters/activitypub/src/lib.rs

@@ -0,0 +1,21 @@
+pub mod activities;
+pub mod actor_handler;
+pub mod actors;
+pub mod data;
+pub mod error;
+pub mod event_handler;
+pub mod federation;
+pub mod followers_handler;
+pub mod inbox;
+pub mod objects;
+pub mod outbox;
+pub mod repository;
+pub mod service;
+pub mod webfinger;
+
+pub use data::FederationData;
+pub use error::Error;
+pub use event_handler::ActivityPubEventHandler;
+pub use federation::ApFederationConfig;
+pub use repository::{FederationRepository, Follower, FollowerStatus, RemoteActor};
+pub use service::ActivityPubService;

crates/adapters/activitypub/src/objects.rs

@@ -0,0 +1,137 @@
+use activitypub_federation::{
+    config::Data,
+    fetch::object_id::ObjectId,
+    protocol::verification::verify_domains_match,
+    traits::Object,
+};
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use url::Url;
+
+use domain::models::{Review, ReviewSource};
+use domain::value_objects::ReviewId;
+
+use crate::actors::DbActor;
+use crate::data::FederationData;
+use crate::error::Error;
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ReviewObject {
+    #[serde(rename = "type")]
+    pub(crate) kind: String,
+    pub(crate) id: ObjectId<DbReview>,
+    pub(crate) attributed_to: ObjectId<DbActor>,
+    pub(crate) content: String,
+    pub(crate) published: DateTime<Utc>,
+    pub(crate) movie_title: String,
+    pub(crate) rating: u8,
+    pub(crate) comment: Option<String>,
+    pub(crate) watched_at: DateTime<Utc>,
+}
+
+#[derive(Debug, Clone)]
+pub struct DbReview {
+    pub review: Review,
+    pub ap_id: Url,
+}
+
+pub fn review_url(base_url: &str, review_id: &ReviewId) -> Url {
+    Url::parse(&format!("{}/reviews/{}", base_url, review_id.value())).expect("valid review url")
+}
+
+#[async_trait::async_trait]
+impl Object for DbReview {
+    type DataType = FederationData;
+    type Kind = ReviewObject;
+    type Error = Error;
+
+    fn id(&self) -> &Url {
+        &self.ap_id
+    }
+
+    async fn read_from_id(
+        _object_id: Url,
+        _data: &Data<Self::DataType>,
+    ) -> Result<Option<Self>, Self::Error> {
+        // Incoming activities provide the full object; no need to dereference local reviews
+        Ok(None)
+    }
+
+    async fn into_json(self, data: &Data<Self::DataType>) -> Result<Self::Kind, Self::Error> {
+        let r = &self.review;
+        let ap_id = review_url(&data.base_url, r.id());
+        let actor_url = crate::actors::actor_url(&data.base_url, r.user_id());
+
+        let stars: String = "\u{2B50}".repeat(r.rating().value() as usize);
+        let comment_text = r.comment().map(|c| c.value().to_string());
+        // TODO(ap): fetch movie title from MovieRepository via FederationData
+        let movie_title = "Unknown".to_string();
+
+        let fallback = match &comment_text {
+            Some(c) => format!("{} Watched '{}': {}", stars, movie_title, c),
+            None => format!("{} Watched '{}'", stars, movie_title),
+        };
+
+        Ok(ReviewObject {
+            kind: "Review".to_string(),
+            id: ap_id.into(),
+            attributed_to: actor_url.into(),
+            content: fallback,
+            published: DateTime::from_naive_utc_and_offset(*r.created_at(), Utc),
+            movie_title,
+            rating: r.rating().value(),
+            comment: comment_text,
+            watched_at: DateTime::from_naive_utc_and_offset(*r.watched_at(), Utc),
+        })
+    }
+
+    async fn verify(
+        json: &Self::Kind,
+        expected_domain: &Url,
+        _data: &Data<Self::DataType>,
+    ) -> Result<(), Self::Error> {
+        verify_domains_match(json.attributed_to.inner(), expected_domain)?;
+        Ok(())
+    }
+
+    async fn from_json(
+        json: Self::Kind,
+        data: &Data<Self::DataType>,
+    ) -> Result<Self, Self::Error> {
+        let actor_url = json.attributed_to.inner().to_string();
+
+        let review_id = ReviewId::generate();
+        // TODO(ap): create stub movie/user entries in DB so feed JOIN queries work.
+        // For now, use deterministic UUIDs from content hash; reviews will be orphaned in JOINs.
+        let movie_id_uuid = uuid::Uuid::new_v5(&uuid::Uuid::NAMESPACE_URL, json.movie_title.as_bytes());
+        let movie_id = domain::value_objects::MovieId::from_uuid(movie_id_uuid);
+        let user_id_uuid = uuid::Uuid::new_v5(&uuid::Uuid::NAMESPACE_URL, actor_url.as_bytes());
+        let user_id = domain::value_objects::UserId::from_uuid(user_id_uuid);
+        let rating = domain::value_objects::Rating::new(json.rating.min(5))
+            .map_err(|e| Error(anyhow::anyhow!("{}", e)))?;
+        let comment = json
+            .comment
+            .map(|c| domain::value_objects::Comment::new(c))
+            .transpose()
+            .map_err(|e| Error(anyhow::anyhow!("{}", e)))?;
+        let watched_at = json.watched_at.naive_utc();
+        let created_at = json.published.naive_utc();
+
+        let review = Review::from_persistence(
+            review_id,
+            movie_id,
+            user_id,
+            rating,
+            comment,
+            watched_at,
+            created_at,
+            ReviewSource::Remote { actor_url },
+        );
+
+        let ap_id = review_url(&data.base_url, review.id());
+        data.federation_repo.save_remote_review(&review).await?;
+
+        Ok(DbReview { review, ap_id })
+    }
+}

crates/adapters/activitypub/src/outbox.rs

@@ -0,0 +1,46 @@
+use activitypub_federation::{axum::json::FederationJson, config::Data};
+use axum::extract::Path;
+use serde::{Deserialize, Serialize};
+
+use domain::value_objects::UserId;
+
+use crate::data::FederationData;
+use crate::error::Error;
+
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct OrderedCollection {
+    #[serde(rename = "@context")]
+    context: String,
+    #[serde(rename = "type")]
+    kind: String,
+    id: String,
+    total_items: u64,
+    ordered_items: Vec<serde_json::Value>,
+}
+
+pub async fn outbox_handler(
+    Path(user_id_str): Path<String>,
+    data: Data<FederationData>,
+) -> Result<FederationJson<OrderedCollection>, Error> {
+    let uuid = uuid::Uuid::parse_str(&user_id_str)
+        .map_err(|_| Error(anyhow::anyhow!("invalid user id")))?;
+    let user_id = UserId::from_uuid(uuid);
+
+    // verify user exists
+    data.user_repo
+        .find_by_id(&user_id)
+        .await
+        .map_err(|e| Error(e.into()))?
+        .ok_or_else(|| Error(anyhow::anyhow!("user not found")))?;
+
+    let outbox_url = format!("{}/users/{}/outbox", data.base_url, user_id_str);
+
+    Ok(FederationJson(OrderedCollection {
+        context: "https://www.w3.org/ns/activitystreams".to_string(),
+        kind: "OrderedCollection".to_string(),
+        id: outbox_url,
+        total_items: 0,
+        ordered_items: vec![],
+    }))
+}

crates/adapters/activitypub/src/repository.rs

@@ -0,0 +1,43 @@
+use anyhow::Result;
+use async_trait::async_trait;
+use domain::models::Review;
+use domain::value_objects::UserId;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum FollowerStatus {
+    Pending,
+    Accepted,
+    Rejected,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct RemoteActor {
+    pub url: String,
+    pub handle: String,
+    pub inbox_url: String,
+    pub shared_inbox_url: Option<String>,
+    pub display_name: Option<String>,
+}
+
+#[derive(Debug, Clone)]
+pub struct Follower {
+    pub actor: RemoteActor,
+    pub status: FollowerStatus,
+}
+
+#[async_trait]
+pub trait FederationRepository: Send + Sync {
+    async fn add_follower(&self, local_user_id: UserId, remote_actor_url: &str, status: FollowerStatus) -> Result<()>;
+    async fn remove_follower(&self, local_user_id: UserId, remote_actor_url: &str) -> Result<()>;
+    async fn get_followers(&self, local_user_id: UserId) -> Result<Vec<Follower>>;
+    async fn update_follower_status(&self, local_user_id: UserId, remote_actor_url: &str, status: FollowerStatus) -> Result<()>;
+    async fn add_following(&self, local_user_id: UserId, actor: RemoteActor) -> Result<()>;
+    async fn remove_following(&self, local_user_id: UserId, actor_url: &str) -> Result<()>;
+    async fn get_following(&self, local_user_id: UserId) -> Result<Vec<RemoteActor>>;
+    async fn count_following(&self, local_user_id: UserId) -> Result<usize>;
+    async fn upsert_remote_actor(&self, actor: RemoteActor) -> Result<()>;
+    async fn get_remote_actor(&self, actor_url: &str) -> Result<Option<RemoteActor>>;
+    async fn save_remote_review(&self, review: &Review) -> Result<()>;
+    async fn get_local_actor_keypair(&self, user_id: UserId) -> Result<Option<(String, String)>>;
+    async fn save_local_actor_keypair(&self, user_id: UserId, public_key: String, private_key: String) -> Result<()>;
+}

crates/adapters/activitypub/src/service.rs

@@ -0,0 +1,188 @@
+use std::sync::Arc;
+
+use activitypub_federation::{
+    activity_sending::SendActivityTask,
+    config::Data,
+    fetch::{object_id::ObjectId, webfinger::webfinger_resolve_actor},
+    protocol::context::WithContext,
+    traits::Actor,
+};
+use axum::{routing::get, routing::post, Router};
+use domain::{ports::UserRepository, value_objects::UserId};
+use url::Url;
+
+use crate::{
+    activities::{FollowActivity, UndoActivity},
+    actor_handler::actor_handler,
+    actors::{get_local_actor, DbActor},
+    data::FederationData,
+    event_handler::ActivityPubEventHandler,
+    federation::ApFederationConfig,
+    followers_handler::{followers_handler, following_handler},
+    inbox::inbox_handler,
+    outbox::outbox_handler,
+    repository::{FederationRepository, RemoteActor},
+    webfinger::webfinger_handler,
+};
+
+pub struct ActivityPubService {
+    federation_config: ApFederationConfig,
+    base_url: String,
+}
+
+impl ActivityPubService {
+    pub async fn new(
+        repo: Arc<dyn FederationRepository>,
+        user_repo: Arc<dyn UserRepository>,
+        base_url: String,
+        debug: bool,
+    ) -> anyhow::Result<Self> {
+        let data = FederationData::new(repo, user_repo, base_url.clone());
+        let federation_config = ApFederationConfig::new(data, debug).await?;
+        Ok(Self {
+            federation_config,
+            base_url,
+        })
+    }
+
+    pub fn federation_config(&self) -> &ApFederationConfig {
+        &self.federation_config
+    }
+
+    pub fn request_data(&self) -> Data<FederationData> {
+        self.federation_config.to_request_data()
+    }
+
+    pub fn router(&self) -> Router {
+        Router::new()
+            .route("/.well-known/webfinger", get(webfinger_handler))
+            .route("/users/{user_id}", get(actor_handler))
+            .route("/users/{user_id}/inbox", post(inbox_handler))
+            .route("/users/{user_id}/outbox", get(outbox_handler))
+            .route("/users/{user_id}/followers", get(followers_handler))
+            .route("/users/{user_id}/following", get(following_handler))
+            .layer(self.federation_config.middleware())
+    }
+
+    pub fn event_handler(&self) -> ActivityPubEventHandler {
+        ActivityPubEventHandler::new(self.federation_config.clone(), self.base_url.clone())
+    }
+
+    pub async fn follow(&self, local_user_id: UserId, handle: &str) -> anyhow::Result<()> {
+        let data = self.federation_config.to_request_data();
+
+        let remote_actor: DbActor = webfinger_resolve_actor(handle, &data)
+            .await
+            .map_err(|e| anyhow::anyhow!("{e}"))?;
+
+        let local_actor = get_local_actor(local_user_id.clone(), &data)
+            .await
+            .map_err(|e| anyhow::anyhow!("{e}"))?;
+
+        let follow_id = Url::parse(&format!(
+            "{}/activities/{}",
+            self.base_url,
+            uuid::Uuid::new_v4()
+        ))?;
+        let follow = FollowActivity {
+            id: follow_id,
+            kind: Default::default(),
+            actor: ObjectId::from(local_actor.ap_id.clone()),
+            object: ObjectId::from(remote_actor.ap_id.clone()),
+        };
+        let follow_with_ctx = WithContext::new_default(follow);
+
+        let sends = SendActivityTask::prepare(
+            &follow_with_ctx,
+            &local_actor,
+            vec![remote_actor.inbox()],
+            &data,
+        )
+        .await?;
+        for send in sends {
+            send.sign_and_send(&data).await?;
+        }
+
+        let remote = RemoteActor {
+            url: remote_actor.ap_id.to_string(),
+            handle: remote_actor
+                .email
+                .split('@')
+                .next()
+                .unwrap_or(&remote_actor.email)
+                .to_string(),
+            inbox_url: remote_actor.inbox_url.to_string(),
+            shared_inbox_url: None,
+            display_name: Some(remote_actor.email.clone()),
+        };
+        data.federation_repo
+            .add_following(local_user_id, remote)
+            .await?;
+
+        Ok(())
+    }
+
+    pub async fn unfollow(&self, local_user_id: UserId, actor_url_str: &str) -> anyhow::Result<()> {
+        let data = self.federation_config.to_request_data();
+
+        let remote = data
+            .federation_repo
+            .get_remote_actor(actor_url_str)
+            .await?
+            .ok_or_else(|| anyhow::anyhow!("remote actor not found: {}", actor_url_str))?;
+
+        let local_actor = get_local_actor(local_user_id.clone(), &data)
+            .await
+            .map_err(|e| anyhow::anyhow!("{e}"))?;
+
+        let remote_ap_id = Url::parse(actor_url_str)?;
+        let inbox = Url::parse(&remote.inbox_url)?;
+
+        let follow_id = Url::parse(&format!(
+            "{}/activities/{}",
+            self.base_url,
+            uuid::Uuid::new_v4()
+        ))?;
+        let follow = FollowActivity {
+            id: follow_id,
+            kind: Default::default(),
+            actor: ObjectId::from(local_actor.ap_id.clone()),
+            object: ObjectId::from(remote_ap_id),
+        };
+
+        let undo_id = Url::parse(&format!(
+            "{}/activities/{}",
+            self.base_url,
+            uuid::Uuid::new_v4()
+        ))?;
+        let undo = UndoActivity {
+            id: undo_id,
+            kind: Default::default(),
+            actor: ObjectId::from(local_actor.ap_id.clone()),
+            object: follow,
+        };
+        let undo_with_ctx = WithContext::new_default(undo);
+
+        let sends =
+            SendActivityTask::prepare(&undo_with_ctx, &local_actor, vec![inbox], &data).await?;
+        for send in sends {
+            send.sign_and_send(&data).await?;
+        }
+
+        data.federation_repo
+            .remove_following(local_user_id, actor_url_str)
+            .await?;
+
+        Ok(())
+    }
+
+    pub async fn get_following(&self, local_user_id: UserId) -> anyhow::Result<Vec<RemoteActor>> {
+        let data = self.federation_config.to_request_data();
+        data.federation_repo.get_following(local_user_id).await
+    }
+
+    pub async fn count_following(&self, local_user_id: UserId) -> anyhow::Result<usize> {
+        let data = self.federation_config.to_request_data();
+        data.federation_repo.count_following(local_user_id).await
+    }
+}

crates/adapters/activitypub/src/webfinger.rs

@@ -0,0 +1,48 @@
+use activitypub_federation::{
+    config::Data,
+    fetch::webfinger::{build_webfinger_response, extract_webfinger_name, Webfinger},
+};
+use axum::{
+    extract::Query,
+    http::header,
+    response::{IntoResponse, Response},
+};
+use serde::Deserialize;
+
+use crate::actors::actor_url;
+use crate::data::FederationData;
+use crate::error::Error;
+
+#[derive(Deserialize)]
+pub struct WebfingerQuery {
+    resource: String,
+}
+
+pub async fn webfinger_handler(
+    Query(query): Query<WebfingerQuery>,
+    data: Data<FederationData>,
+) -> Result<Response, Error> {
+    let name = extract_webfinger_name(&query.resource, &data)?;
+
+    // Look up user by email username@domain
+    let email_str = format!("{}@{}", name, data.domain);
+    let email = domain::value_objects::Email::new(email_str)
+        .map_err(|e| Error(anyhow::anyhow!("{}", e)))?;
+
+    let user = data
+        .user_repo
+        .find_by_email(&email)
+        .await
+        .map_err(|e| Error(e.into()))?
+        .ok_or_else(|| Error(anyhow::anyhow!("user not found")))?;
+
+    let ap_id = actor_url(&data.base_url, user.id());
+
+    let wf: Webfinger = build_webfinger_response(query.resource, ap_id);
+    let body = serde_json::to_string(&wf)
+        .map_err(|e| Error::from(anyhow::anyhow!(e)))?;
+    Ok((
+        [(header::CONTENT_TYPE, "application/jrd+json")],
+        body,
+    ).into_response())
+}