merging receive: skip same-domain targets

for #529

protocol.py

@@ -816,8 +816,25 @@ class Protocol:
 
                 # HACK: use last target object from above for reposts, which
                 # has its resolved id
-                obj = orig_obj if verb == 'share' else None
-                targets[Target(protocol=user.LABEL, uri=target)] = obj
+                targets[Target(protocol=user.LABEL, uri=target)] = \
+                    orig_obj if verb == 'share' else None
+
+        # de-dupe targets, discard same-domain and blocklisted
+        candidates = {t.uri: (t, obj) for t, obj in targets.items()}
+        targets = {}
+        source_domains = [
+            util.domain_from_link(url) for url in
+            (obj.as1.get('id'), obj.as1.get('url'), as1.get_owner(obj.as1))
+            if util.is_web(url)
+        ]
+        for url in sorted(util.dedupe_urls(candidates.keys())):
+            if is_blocklisted(url):
+                logger.info(f'Skipping blocklisted target {url}')
+            elif util.is_web(url) and util.domain_from_link(url) in source_domains:
+                logger.info(f'Skipping same-domain target {url}')
+            else:
+                target, obj = candidates[url]
+                targets[target] = obj
 
         return targets
 

tests/test_protocol.py

@@ -2,6 +2,7 @@
 from unittest.mock import patch
 
 from flask import g
+from google.cloud import ndb
 from granary import as2
 from oauth_dropins.webutil.flask_util import NoContent
 from oauth_dropins.webutil.testutil import requests_response
@@ -1062,4 +1063,30 @@ class ProtocolReceiveTest(TestCase):
         self.assertIsNone(Object.get_by_id('https://ap.brid.gy/user.com'))
 
     def test_skip_same_domain_target(self):
-        TODO
+        Fake.fetchable = {
+            'http://x.com/alice': {},
+            'http://x.com/bob': {},
+            'http://x.com/eve': {},
+        }
+
+        follow_as1 = {
+            'id': 'http://x.com/follow',
+            'objectType': 'activity',
+            'verb': 'follow',
+            'actor': 'http://x.com/alice',
+            'object': ['http://x.com/bob', 'http://x.com/eve'],
+        }
+
+        with self.assertRaises(NoContent) as e:
+            Fake.receive(follow_as1)
+
+        self.assert_object('http://x.com/follow',
+                           our_as1=follow_as1,
+                           status='ignored',
+                           labels=['activity', 'user', 'notification'],
+                           users=[ndb.Key(Fake, 'http://x.com/alice'),
+                                  ndb.Key(Fake, 'http://x.com/bob'),
+                                  ndb.Key(Fake, 'http://x.com/eve')],
+                           )
+        self.assertEqual(2, Follower.query().count())
+