Merge branch 'main' into accept-hs2019-in-signatures

activities/services/post.py

@@ -105,6 +105,7 @@ class PostService:
         # Retrieve descendants via breadth-first-search
         descendants: list[Post] = []
         queue = [self.post]
+        seen: set[str] = set()
         while queue and len(descendants) < num_descendants:
             node = queue.pop()
             child_queryset = (
@@ -119,8 +120,10 @@ class PostService:
             else:
                 child_queryset = child_queryset.unlisted(include_replies=True)
             for child in child_queryset:
-                descendants.append(child)
-                queue.append(child)
+                if child.pk not in seen:
+                    descendants.append(child)
+                    queue.append(child)
+                    seen.add(child.pk)
         return ancestors, descendants
 
     def delete(self):

api/decorators.py

@@ -32,12 +32,18 @@ def scope_required(scope: str, requires_identity=True):
         @wraps(function)
         def inner(request, *args, **kwargs):
             if not request.token:
-                return JsonResponse({"error": "identity_token_required"}, status=401)
+                if request.identity:
+                    # They're just logged in via cookie - give full access
+                    pass
+                else:
+                    return JsonResponse(
+                        {"error": "identity_token_required"}, status=401
+                    )
+            elif not request.token.has_scope(scope):
+                return JsonResponse({"error": "out_of_scope_for_token"}, status=403)
             # They need an identity
             if not request.identity and requires_identity:
                 return JsonResponse({"error": "identity_token_required"}, status=401)
-            if not request.token.has_scope(scope):
-                return JsonResponse({"error": "out_of_scope_for_token"}, status=403)
             return function(request, *args, **kwargs)
 
         inner.csrf_exempt = True  # type:ignore