Mark instances as unreachable when returning a 403 from an object fetch

This is a definite sign the instance is blocked and they are enforcing authorized_fetch

2 files changed, 20 insertions, 0 deletions

diff --git a/lib/pleroma/object/fetcher.ex b/lib/pleroma/object/fetcher.ex
index 13fb50639..a07b35d6f 100644
--- a/lib/pleroma/object/fetcher.ex
+++ b/lib/pleroma/object/fetcher.ex
@@ -99,6 +99,15 @@ defmodule Pleroma.Object.Fetcher do
       {:fetch_object, %Object{} = object} ->
         {:ok, object}
 
+      {:fetch, {:error, {:ok, %Tesla.Env{status: 403}}}} ->
+        Instances.set_consistently_unreachable(id)
+
+        Logger.error(
+          "Error while fetching #{id}: HTTP 403 likely due to instance block rejecting the signed fetch."
+        )
+
+        {:error, "Object fetch has been denied"}
+
       {:fetch, {:error, error}} ->
         Logger.error("Error while fetching #{id}: #{inspect(error)}")
         {:error, error}
diff --git a/lib/pleroma/workers/remote_fetcher_worker.ex b/lib/pleroma/workers/remote_fetcher_worker.ex
index d2a77aa17..70d074c1c 100644
--- a/lib/pleroma/workers/remote_fetcher_worker.ex
+++ b/lib/pleroma/workers/remote_fetcher_worker.ex
@@ -10,6 +10,17 @@ defmodule Pleroma.Workers.RemoteFetcherWorker do
   @impl Oban.Worker
   def perform(%Job{args: %{"op" => "fetch_remote", "id" => id} = args}) do
     {:ok, _object} = Fetcher.fetch_object_from_id(id, depth: args["depth"])
+
+    case Fetcher.fetch_object_from_id(id, depth: args["depth"]) do
+      {:ok, _object} ->
+        :ok
+
+      {:error, reason = "Object fetch has been denied"} ->
+        {:cancel, reason}
+
+      _ ->
+        :error
+    end
   end
 
   @impl Oban.Worker