AP: handle opted out users in following/ers, outbox collections

pages.py

@@ -80,7 +80,7 @@ def load_user(protocol, id):
     elif user and id != user.key.id():  # use_instead redirect
         error('', status=302, location=user.user_page_path())
 
-    if not user or not user.direct or user.status == 'opt-out':
+    if not user or not user.direct:
         # TODO: switch back to USER_NOT_FOUND_HTML
         # not easy via exception/abort because this uses Werkzeug's built in
         # NotFound exception subclass, and we'd need to make it implement

protocol.py

@@ -204,7 +204,7 @@ class Protocol:
             return proto.key_for(id) if proto else None
 
         # load user so that we follow use_instead
-        existing = cls.get_by_id(id)
+        existing = cls.get_by_id(id, allow_opt_out=True)
         if existing:
             if existing.status == 'opt-out':
                 return None
@@ -598,7 +598,7 @@ class Protocol:
                 logger.warning(f"actor {actor} isn't authed user {authed_as}")
 
         from_user = from_cls.get_or_create(id=actor)
-        if not from_user or from_user.status == 'opt-out':
+        if not from_user:
             error(f'Actor {actor} is opted out', status=204)
 
         # update copy ids to originals

tests/test_activitypub.py

@@ -1589,6 +1589,13 @@ class ActivityPubTest(TestCase):
         self.assertEqual(200, resp.status_code)
         self.assertEqual('', resp.get_data(as_text=True))
 
+    def test_following_collection_opted_out(self, *_):
+        self.user.obj.our_as1['summary'] = '#nobridge'
+        self.user.obj.put()
+        self.user.put()
+        resp = self.client.get(f'/user.com/following', base_url='https://web.brid.gy')
+        self.assertEqual(404, resp.status_code)
+
     def test_outbox_fake_empty(self, *_):
         self.make_user('fake:foo', cls=Fake)
         resp = self.client.get(f'/ap/fake:foo/outbox',
@@ -1677,6 +1684,14 @@ class ActivityPubTest(TestCase):
         self.assertEqual(200, resp.status_code)
         self.assertEqual('', resp.get_data(as_text=True))
 
+    def test_outbox_opted_out(self, *_):
+        self.user.obj.our_as1['summary'] = '#nobridge'
+        self.user.obj.put()
+        self.user.put()
+        resp = self.client.get(f'/ap/user.com/outbox',
+                               base_url='https://web.brid.gy')
+        self.assertEqual(404, resp.status_code)
+
 
 class ActivityPubUtilsTest(TestCase):
     def setUp(self):