ReceiverWorker: cancel job if user fetch is forbidden

An instance block with authenticated fetch being required can cause this as we couldn't get the user to find their public key to verify the signature. Commonly observed if someone boosts/Announces a post from an instance that blocked you.

1 files changed, 48 insertions, 0 deletions

diff --git a/test/pleroma/workers/receiver_worker_test.exs b/test/pleroma/workers/receiver_worker_test.exs
index 33be91085..640cefb78 100644
--- a/test/pleroma/workers/receiver_worker_test.exs
+++ b/test/pleroma/workers/receiver_worker_test.exs
@@ -51,6 +51,54 @@ defmodule Pleroma.Workers.ReceiverWorkerTest do
              })
   end
 
+  test "it does not retry if a user fetch fails with a 403" do
+    Tesla.Mock.mock(fn
+      %{url: "https://simpsons.com/users/bart"} ->
+        %Tesla.Env{
+          status: 403,
+          body: ""
+        }
+    end)
+
+    params =
+      %{
+        "@context" => [
+          "https://www.w3.org/ns/activitystreams",
+          "https://w3id.org/security/v1"
+        ],
+        "actor" => "https://simpsons.com/users/bart",
+        "cc" => [],
+        "id" => "https://simpsons.com/activity/eat-my-shorts",
+        "object" => %{},
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "type" => "Create"
+      }
+
+    req_headers = [
+      ["accept-encoding", "gzip"],
+      ["content-length", "31337"],
+      ["content-type", "application/activity+json"],
+      ["date", "Wed, 28 Aug 2024 15:36:31 GMT"],
+      ["digest", "SHA-256=ouge/6HP2/QryG6F3JNtZ6vzs/hSwMk67xdxe87eH7A="],
+      ["host", "bikeshed.party"],
+      [
+        "signature",
+        "does not matter as user needs to be fetched first"
+      ]
+    ]
+
+    {:ok, oban_job} =
+      Federator.incoming_ap_doc(%{
+        method: "POST",
+        req_headers: req_headers,
+        request_path: "/inbox",
+        params: params,
+        query_string: ""
+      })
+
+    assert {:cancel, {:error, :forbidden}} = ReceiverWorker.perform(oban_job)
+  end
+
   test "it can validate the signature" do
     Tesla.Mock.mock(fn
       %{url: "https://mastodon.social/users/bastianallgeier"} ->