Automattic / Automattic/wordpress-activitypub

Do not add server mentions to replies written through the ActivityPub API

Open
#3,683 0 comments 1 reaction 0 assignees View on GitHub
Enhancement
Dominant language
PHP
Stars
579
Forks
92
Avg merge
13h 5m
Merged PRs (30d)
85

Description

Follow-up from #3646 / #3680.

A reply written through the ActivityPub API arrives with the client's own mentions, and the reporter's position (https://github.com/Automattic/wordpress-activitypub/pull/3680#issuecomment-5454991704) is that committing to the API should mean the server adds no mention of its own to such a reply at all, and leaves mentions to the client and the user. I think that is right, and it is how Mastodon treats client content. #3680 does not do it; it removes the duplicate, which is the visible symptom, and leaves the reply context in place.

The reason it cannot be done in #3680 is that a client-authored comment is not distinguishable from a comment a logged-in user typed into the WordPress form. `Interactions::activity_to_comment()` writes `user_id` on the outbound branch and nothing else; `protocol` and `source_id` are only written for inbound remote comments. So there is nothing for `Transformer\Comment::get_content()` to check.

Proposed shape:

* Mark comments created through the outbox as client-authored, on the `$user_id` branch of `activity_to_comment()`. `source_id` set to the object id, the way inbound already does, plus a marker for the origin.
* In `Transformer\Comment::get_content()` (and `get_mentions()`), skip `extract_reply_context()` for a client-authored comment. The client sent the content; the server should not rewrite it.
* WordPress-native replies keep the reply context, since a comment form has no way to type a mention.

Existing comments have no marker, so the skip only applies to comments created after the change. The dedupe from #3680 stays as the safety net for those.

Contributor guide

Open the contributing guide

Research direction

Start with Interactions::activity_to_comment() and trace the $user_id branch that creates comments from ActivityPub API replies. Then inspect Transformer\Comment::get_content() and get_mentions(), including extract_reply_context(), to see how the origin marker should affect processing. Done means client-authored replies retain only client-provided mentions, while WordPress-native replies keep their reply context and existing deduplication remains effective.

Written by the indexing model from the issue text.

Assessment

Tech stack
php, wordpress
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.