api/funkwhale_api/contrib/scrobbler/scrobbler.py

+import hashlib
+import time
+
+# https://github.com/jlieth/legacy-scrobbler
+from .funkwhale_startup import PLUGIN
+
+
+class ScrobblerException(Exception):
+    pass
+
+
+def handshake_v1(session, url, username, password):
+    timestamp = str(int(time.time())).encode("utf-8")
+    password_hash = hashlib.md5(password.encode("utf-8")).hexdigest()
+    auth = hashlib.md5(password_hash.encode("utf-8") + timestamp).hexdigest()
+    params = {
+        "hs": "true",
+        "p": "1.2",
+        "c": "fw",
+        "v": PLUGIN["version"],
+        "u": username,
+        "t": timestamp,
+        "a": auth,
+    }
+
+    PLUGIN["logger"].debug(
+        "Performing scrobbler handshake for username %s at %s", username, url
+    )
+    handshake_response = session.get(url, params=params)
+    # process response
+    result = handshake_response.text.split("\n")
+    if len(result) >= 4 and result[0] == "OK":
+        session_key = result[1]
+        nowplaying_url = result[2]
+        scrobble_url = result[3]
+    elif result[0] == "BANNED":
+        raise ScrobblerException("BANNED")
+    elif result[0] == "BADAUTH":
+        raise ScrobblerException("BADAUTH")
+    elif result[0] == "BADTIME":
+        raise ScrobblerException("BADTIME")
+    else:
+        raise ScrobblerException(handshake_response.text)
+
+    PLUGIN["logger"].debug("Handshake successful, scrobble url: %s", scrobble_url)
+    return session_key, nowplaying_url, scrobble_url
+
+
+def submit_scrobble_v1(session, scrobble_time, track, session_key, scrobble_url):
+    payload = get_scrobble_payload(track, scrobble_time)
+    PLUGIN["logger"].debug("Sending scrobble with payload %s", payload)
+    payload["s"] = session_key
+    response = session.post(scrobble_url, payload)
+    response.raise_for_status()
+    if response.text.startswith("OK"):
+        return
+    elif response.text.startswith("BADSESSION"):
+        raise ScrobblerException("Remote server says the session is invalid")
+    else:
+        raise ScrobblerException(response.text)
+
+    PLUGIN["logger"].debug("Scrobble successful!")
+
+
+def submit_now_playing_v1(session, track, session_key, now_playing_url):
+    payload = get_scrobble_payload(track, date=None, suffix="")
+    PLUGIN["logger"].debug("Sending now playing with payload %s", payload)
+    payload["s"] = session_key
+    response = session.post(now_playing_url, payload)
+    response.raise_for_status()
+    if response.text.startswith("OK"):
+        return
+    elif response.text.startswith("BADSESSION"):
+        raise ScrobblerException("Remote server says the session is invalid")
+    else:
+        raise ScrobblerException(response.text)
+
+    PLUGIN["logger"].debug("Now playing successful!")
+
+
+def get_scrobble_payload(track, date, suffix="[0]"):
+    """
+    Documentation available at https://web.archive.org/web/20190531021725/https://www.last.fm/api/submissions
+    """
+    upload = track.uploads.filter(duration__gte=0).first()
+    data = {
+        f"a{suffix}": track.get_artist_credit_string,
+        f"t{suffix}": track.title,
+        f"l{suffix}": upload.duration if upload else 0,
+        f"b{suffix}": (track.album.title if track.album else "") or "",
+        f"n{suffix}": track.position or "",
+        f"m{suffix}": str(track.mbid or ""),
+        f"o{suffix}": "P",  # Source: P = chosen by user
+    }
+    if date:
+        data[f"i{suffix}"] = int(date.timestamp())
+    return data
+
+
+def get_scrobble2_payload(track, date, suffix="[0]"):
+    """
+    Documentation available at https://web.archive.org/web/20190531021725/https://www.last.fm/api/submissions
+    """
+    upload = track.uploads.filter(duration__gte=0).first()
+    data = {
+        "artist": track.get_artist_credit_string,
+        "track": track.title,
+        "chosenByUser": 1,
+    }
+    if upload:
+        data["duration"] = upload.duration
+    if track.album:
+        data["album"] = track.album.title
+    if track.position:
+        data["trackNumber"] = track.position
+    if track.mbid:
+        data["mbid"] = str(track.mbid or "")
+    if date:
+        offset = upload.duration / 2 if upload.duration else 0
+        data["timestamp"] = int(int(date.timestamp()) - offset)
+    return data
+
+
+def handshake_v2(username, password, session, api_key, api_secret, scrobble_url):
+    params = {
+        "method": "auth.getMobileSession",
+        "username": username,
+        "password": password,
+        "api_key": api_key,
+    }
+    params["api_sig"] = hash_request(params, api_secret)
+    response = session.post(scrobble_url, params)
+    if 'status="ok"' not in response.text:
+        raise ScrobblerException(response.text)
+
+    session_key = response.text.split("<key>")[1].split("</key>")[0]
+    return session_key
+
+
+def submit_scrobble_v2(
+    session,
+    track,
+    scrobble_time,
+    session_key,
+    scrobble_url,
+    api_key,
+    api_secret,
+):
+    params = {
+        "method": "track.scrobble",
+        "api_key": api_key,
+        "sk": session_key,
+    }
+    scrobble = get_scrobble2_payload(track, scrobble_time)
+    PLUGIN["logger"].debug("Scrobble payload: %s", scrobble)
+    params.update(scrobble)
+    params["api_sig"] = hash_request(params, api_secret)
+    response = session.post(scrobble_url, params)
+    if 'status="ok"' not in response.text:
+        raise ScrobblerException(response.text)
+
+
+def hash_request(data, secret_key):
+    string = ""
+    items = data.keys()
+    items = sorted(items)
+    for i in items:
+        string += str(i)
+        string += str(data[i])
+    string += secret_key
+    string_to_hash = string.encode("utf8")
+    return hashlib.md5(string_to_hash).hexdigest()

api/funkwhale_api/contrib/sites/__init__.py

-# -*- coding: utf-8 -*-

api/funkwhale_api/contrib/sites/migrations/0004_alter_site_options.py

+# Generated by Django 3.2.4 on 2021-07-03 18:10
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('sites', '0003_auto_20171214_2205'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='site',
+            options={'ordering': ['domain'], 'verbose_name': 'site', 'verbose_name_plural': 'sites'},
+        ),
+    ]

api/funkwhale_api/downloader/__init__.py

-from .downloader import download
-
-__all__ = ["download"]

api/funkwhale_api/downloader/downloader.py

-import os
-
-import youtube_dl
-from django.conf import settings
-
-
-def download(
-    url, target_directory=settings.MEDIA_ROOT, name="%(id)s.%(ext)s", bitrate=192
-):
-    target_path = os.path.join(target_directory, name)
-    ydl_opts = {
-        "quiet": True,
-        "outtmpl": target_path,
-        "postprocessors": [{"key": "FFmpegExtractAudio", "preferredcodec": "vorbis"}],
-    }
-    _downloader = youtube_dl.YoutubeDL(ydl_opts)
-    info = _downloader.extract_info(url)
-    info["audio_file_path"] = target_path % {"id": info["id"], "ext": "ogg"}
-    return info

api/funkwhale_api/factories.py

+import random
+import uuid
+
 import factory
 import persisting_theory
+from django.conf import settings
+from faker.providers import internet as internet_provider
 
 
 class FactoriesRegistry(persisting_theory.Registry):
@@ -28,3 +33,333 @@ def ManyToManyFromList(field_name):
             field.add(*extracted)
 
     return inner
+
+
+class NoUpdateOnCreate:
+    """
+    Factory boy calls save after the initial create. In most case, this
+    is not needed, so we disable this behaviour
+    """
+
+    @classmethod
+    def _after_postgeneration(cls, instance, create, results=None):
+        return
+
+
+TAGS_DATA = {
+    "type": [
+        "acoustic",
+        "acid",
+        "ambient",
+        "alternative",
+        "brutalist",
+        "chill",
+        "club",
+        "cold",
+        "cool",
+        "contemporary",
+        "dark",
+        "doom",
+        "electro",
+        "folk",
+        "freestyle",
+        "fusion",
+        "garage",
+        "glitch",
+        "hard",
+        "healing",
+        "industrial",
+        "instrumental",
+        "hardcore",
+        "holiday",
+        "hot",
+        "liquid",
+        "modern",
+        "minimalist",
+        "new",
+        "parody",
+        "postmodern",
+        "progressive",
+        "smooth",
+        "symphonic",
+        "traditional",
+        "tribal",
+        "metal",
+    ],
+    "genre": [
+        "blues",
+        "classical",
+        "chiptune",
+        "dance",
+        "disco",
+        "funk",
+        "jazz",
+        "house",
+        "hiphop",
+        "NewAge",
+        "pop",
+        "punk",
+        "rap",
+        "RnB",
+        "reggae",
+        "rock",
+        "soul",
+        "soundtrack",
+        "ska",
+        "swing",
+        "trance",
+    ],
+    "nationality": [
+        "Afghan",
+        "Albanian",
+        "Algerian",
+        "American",
+        "Andorran",
+        "Angolan",
+        "Antiguans",
+        "Argentinean",
+        "Armenian",
+        "Australian",
+        "Austrian",
+        "Azerbaijani",
+        "Bahamian",
+        "Bahraini",
+        "Bangladeshi",
+        "Barbadian",
+        "Barbudans",
+        "Batswana",
+        "Belarusian",
+        "Belgian",
+        "Belizean",
+        "Beninese",
+        "Bhutanese",
+        "Bolivian",
+        "Bosnian",
+        "Brazilian",
+        "British",
+        "Bruneian",
+        "Bulgarian",
+        "Burkinabe",
+        "Burmese",
+        "Burundian",
+        "Cambodian",
+        "Cameroonian",
+        "Canadian",
+        "Cape Verdean",
+        "Central African",
+        "Chadian",
+        "Chilean",
+        "Chinese",
+        "Colombian",
+        "Comoran",
+        "Congolese",
+        "Costa Rican",
+        "Croatian",
+        "Cuban",
+        "Cypriot",
+        "Czech",
+        "Danish",
+        "Djibouti",
+        "Dominican",
+        "Dutch",
+        "East Timorese",
+        "Ecuadorean",
+        "Egyptian",
+        "Emirian",
+        "Equatorial Guinean",
+        "Eritrean",
+        "Estonian",
+        "Ethiopian",
+        "Fijian",
+        "Filipino",
+        "Finnish",
+        "French",
+        "Gabonese",
+        "Gambian",
+        "Georgian",
+        "German",
+        "Ghanaian",
+        "Greek",
+        "Grenadian",
+        "Guatemalan",
+        "Guinea-Bissauan",
+        "Guinean",
+        "Guyanese",
+        "Haitian",
+        "Herzegovinian",
+        "Honduran",
+        "Hungarian",
+        "I-Kiribati",
+        "Icelander",
+        "Indian",
+        "Indonesian",
+        "Iranian",
+        "Iraqi",
+        "Irish",
+        "Israeli",
+        "Italian",
+        "Ivorian",
+        "Jamaican",
+        "Japanese",
+        "Jordanian",
+        "Kazakhstani",
+        "Kenyan",
+        "Kittian and Nevisian",
+        "Kuwaiti",
+        "Kyrgyz",
+        "Laotian",
+        "Latvian",
+        "Lebanese",
+        "Liberian",
+        "Libyan",
+        "Liechtensteiner",
+        "Lithuanian",
+        "Luxembourger",
+        "Macedonian",
+        "Malagasy",
+        "Malawian",
+        "Malaysian",
+        "Maldivian",
+        "Malian",
+        "Maltese",
+        "Marshallese",
+        "Mauritanian",
+        "Mauritian",
+        "Mexican",
+        "Micronesian",
+        "Moldovan",
+        "Monacan",
+        "Mongolian",
+        "Moroccan",
+        "Mosotho",
+        "Motswana",
+        "Mozambican",
+        "Namibian",
+        "Nauruan",
+        "Nepalese",
+        "New Zealander",
+        "Ni-Vanuatu",
+        "Nicaraguan",
+        "Nigerian",
+        "Nigerien",
+        "North Korean",
+        "Northern Irish",
+        "Norwegian",
+        "Omani",
+        "Pakistani",
+        "Palauan",
+        "Panamanian",
+        "Papua New Guinean",
+        "Paraguayan",
+        "Peruvian",
+        "Polish",
+        "Portuguese",
+        "Qatari",
+        "Romanian",
+        "Russian",
+        "Rwandan",
+        "Saint Lucian",
+        "Salvadoran",
+        "Samoan",
+        "San Marinese",
+        "Sao Tomean",
+        "Saudi",
+        "Scottish",
+        "Senegalese",
+        "Serbian",
+        "Seychellois",
+        "Sierra Leonean",
+        "Singaporean",
+        "Slovakian",
+        "Slovenian",
+        "Solomon Islander",
+        "Somali",
+        "South African",
+        "South Korean",
+        "Spanish",
+        "Sri Lankan",
+        "Sudanese",
+        "Surinamer",
+        "Swazi",
+        "Swedish",
+        "Swiss",
+        "Syrian",
+        "Taiwanese",
+        "Tajik",
+        "Tanzanian",
+        "Thai",
+        "Togolese",
+        "Tongan",
+        "Trinidadian",
+        "Tunisian",
+        "Turkish",
+        "Tuvaluan",
+        "Ugandan",
+        "Ukrainian",
+        "Uruguayan",
+        "Uzbekistani",
+        "Venezuelan",
+        "Vietnamese",
+        "Welsh",
+        "Yemenite",
+        "Zambian",
+        "Zimbabwean",
+    ],
+}
+
+
+class FunkwhaleProvider(internet_provider.Provider):
+    """
+    Our own faker data generator, since built-in ones are sometimes
+    not random enough
+    """
+
+    def federation_url(self, prefix="", obj_uuid=None, local=False):
+        if not obj_uuid:
+            obj_uuid = uuid.uuid4()
+
+        def path_generator():
+            return f"{prefix}/{obj_uuid}"
+
+        domain = settings.FEDERATION_HOSTNAME if local else self.domain_name()
+        protocol = "https"
+        path = path_generator()
+        return f"{protocol}://{domain}/{path}"
+
+    def user_name(self):
+        u = super().user_name()
+        return f"{u}{random.randint(10, 999)}"
+
+    def music_genre(self):
+        return random.choice(TAGS_DATA["genre"])
+
+    def music_type(self):
+        return random.choice(TAGS_DATA["type"])
+
+    def music_nationality(self):
+        return random.choice(TAGS_DATA["nationality"])
+
+    def music_hashtag(self, prefix_length=4):
+        genre = self.music_genre()
+        prefixes = [genre]
+        nationality = False
+        while len(prefixes) < prefix_length:
+            if nationality:
+                t = "type"
+            else:
+                t = random.choice(["type", "nationality", "genre"])
+
+            if t == "nationality":
+                nationality = True
+
+            choice = random.choice(TAGS_DATA[t])
+            if choice in prefixes:
+                continue
+            prefixes.append(choice)
+
+        return "".join(
+            [p.capitalize().strip().replace(" ", "") for p in reversed(prefixes)]
+        )
+
+
+factory.Faker.add_provider(FunkwhaleProvider)

api/funkwhale_api/favorites/activities.py

@@ -8,7 +8,7 @@ record.registry.register_serializer(serializers.TrackFavoriteActivitySerializer)
 
 @record.registry.register_consumer("favorites.TrackFavorite")
 def broadcast_track_favorite_to_instance_activity(data, obj):
-    if obj.user.privacy_level not in ["instance", "everyone"]:
+    if obj.actor.user.privacy_level not in ["instance", "everyone"]:
         return
 
     channels.group_send(

api/funkwhale_api/favorites/admin.py

-from django.contrib import admin
+from funkwhale_api.common import admin
 
 from . import models
 
 
 @admin.register(models.TrackFavorite)
 class TrackFavoriteAdmin(admin.ModelAdmin):
-    list_display = ["user", "track", "creation_date"]
-    list_select_related = ["user", "track"]
+    list_display = ["actor", "track", "creation_date"]
+    list_select_related = ["actor", "track"]

api/funkwhale_api/favorites/factories.py

 import factory
+from django.conf import settings
 
-from funkwhale_api.factories import registry
+from funkwhale_api.factories import NoUpdateOnCreate, registry
+from funkwhale_api.federation import models
+from funkwhale_api.federation.factories import ActorFactory
 from funkwhale_api.music.factories import TrackFactory
-from funkwhale_api.users.factories import UserFactory
 
 
 @registry.register
-class TrackFavorite(factory.django.DjangoModelFactory):
+class TrackFavorite(NoUpdateOnCreate, factory.django.DjangoModelFactory):
     track = factory.SubFactory(TrackFactory)
-    user = factory.SubFactory(UserFactory)
+    actor = factory.SubFactory(ActorFactory)
+    fid = factory.Faker("federation_url")
+    uuid = factory.Faker("uuid4")
+    privacy_level = "everyone"
 
     class Meta:
         model = "favorites.TrackFavorite"
+
+    @factory.post_generation
+    def local(self, create, extracted, **kwargs):
+        if not extracted and not kwargs:
+            return
+        domain = models.Domain.objects.get_or_create(name=settings.FEDERATION_HOSTNAME)[
+            0
+        ]
+        self.fid = f"https://{domain}/federation/music/favorite/{self.uuid}"
+        self.save(update_fields=["fid"])

api/funkwhale_api/favorites/filters.py

+from funkwhale_api.common import fields
+from funkwhale_api.common import filters as common_filters
+from funkwhale_api.moderation import filters as moderation_filters
+
+from . import models
+
+
+class TrackFavoriteFilter(moderation_filters.HiddenContentFilterSet):
+    q = fields.SearchFilter(
+        search_fields=["track__title", "track__artist__name", "track__album__title"]
+    )
+    scope = common_filters.ActorScopeFilter(actor_field="actor", distinct=True)
+
+    class Meta:
+        model = models.TrackFavorite
+        fields = []
+        hidden_content_fields_mapping = moderation_filters.USER_FILTER_CONFIG[
+            "TRACK_FAVORITE"
+        ]

api/funkwhale_api/favorites/migrations/0002_trackfavorite_source.py

+# Generated by Django 3.2.20 on 2023-12-09 14:25
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('favorites', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='trackfavorite',
+            name='source',
+            field=models.CharField(blank=True, max_length=100, null=True),
+        ),
+    ]

api/funkwhale_api/favorites/migrations/0003_trackfavorite_actor_trackfavorite_fid_and_more.py

+# Generated by Django 4.2.9 on 2024-03-28 23:32
+
+import uuid
+
+from django.db import migrations, models, transaction
+import django.db.models.deletion
+
+from django.conf import settings
+
+from funkwhale_api.federation import utils
+from django.urls import reverse
+
+
+def gen_uuid(apps, schema_editor):
+    MyModel = apps.get_model("favorites", "TrackFavorite")
+    for row in MyModel.objects.all():
+        unique_uuid = uuid.uuid4()
+        while MyModel.objects.filter(uuid=unique_uuid).exists():
+            unique_uuid = uuid.uuid4()
+
+        fid = utils.full_url(
+            reverse("federation:music:likes-detail", kwargs={"uuid": unique_uuid})
+        )
+        row.uuid = unique_uuid
+        row.fid = fid
+        row.save(update_fields=["uuid", "fid"])
+
+
+def get_user_actor(apps, schema_editor):
+    MyModel = apps.get_model("favorites", "TrackFavorite")
+    for row in MyModel.objects.all():
+        actor = row.user.actor
+        row.actor = actor
+        row.save(update_fields=["actor"])
+
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("favorites", "0002_trackfavorite_source"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="trackfavorite",
+            name="actor",
+            field=models.ForeignKey(
+                blank=True,
+                null=True,
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name="track_favorites",
+                to="federation.actor",
+            ),
+        ),
+        migrations.AddField(
+            model_name="trackfavorite",
+            name="fid",
+            field=models.URLField(default="https://default.fid"),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name="trackfavorite",
+            name="url",
+            field=models.URLField(blank=True, max_length=500, null=True),
+        ),
+        migrations.AddField(
+            model_name="trackfavorite",
+            name="uuid",
+            field=models.UUIDField(null=True),
+        ),
+        migrations.RunPython(gen_uuid, reverse_code=migrations.RunPython.noop),
+        migrations.AlterField(
+            model_name="trackfavorite",
+            name="uuid",
+            field=models.UUIDField(default=uuid.uuid4, unique=True, null=False),
+        ),
+        migrations.AlterField(
+            model_name="trackfavorite",
+            name="fid",
+            field=models.URLField(
+                db_index=True,
+                max_length=500,
+                unique=True,
+            ),
+        ),
+        migrations.RunPython(get_user_actor, reverse_code=migrations.RunPython.noop),
+        migrations.AlterField(
+            model_name="trackfavorite",
+            name="actor",
+            field=models.ForeignKey(
+                blank=False,
+                null=False,
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name="track_favorites",
+                to="federation.actor",
+            ),      ),
+        migrations.AlterUniqueTogether(
+            name="trackfavorite",
+            unique_together={("track", "actor")},
+        ),
+        migrations.RemoveField(
+            model_name="trackfavorite",
+            name="user",
+        ),
+
+    ]

api/funkwhale_api/favorites/migrations/0004_alter_trackfavorite_privacy_level.py

+# Generated by Django 5.1.6 on 2025-09-12 08:27
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("favorites", "0003_trackfavorite_actor_trackfavorite_fid_and_more"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="trackfavorite",
+            name="privacy_level",
+            field=models.CharField(
+                choices=[
+                    ("me", "Only me"),
+                    ("followers", "Me and my followers"),
+                    ("instance", "Everyone on my instance, and my followers"),
+                    ("everyone", "Everyone, including people on other instances"),
+                ],
+                max_length=30,
+                default="me",
+            ),
+        ),
+    ]

api/funkwhale_api/favorites/models.py

+import uuid
+
 from django.db import models
+from django.urls import reverse
 from django.utils import timezone
 
+from funkwhale_api.common import fields
+from funkwhale_api.common import models as common_models
+from funkwhale_api.federation import models as federation_models
+from funkwhale_api.federation import utils as federation_utils
 from funkwhale_api.music.models import Track
 
 
-class TrackFavorite(models.Model):
+class TrackFavoriteQuerySet(models.QuerySet, common_models.LocalFromFidQuerySet):
+    def viewable_by(self, actor):
+        if actor is None:
+            return self.filter(actor__user__privacy_level="everyone")
+
+        if hasattr(actor, "user"):
+            me_query = models.Q(actor__user__privacy_level="me", actor=actor)
+        me_query = models.Q(actor__user__privacy_level="me", actor=actor)
+
+        instance_query = models.Q(
+            actor__user__privacy_level="instance", actor__domain=actor.domain
+        )
+        instance_actor_query = models.Q(
+            actor__user__privacy_level="instance", actor__domain=actor.domain
+        )
+
+        return self.filter(
+            me_query
+            | instance_query
+            | instance_actor_query
+            | models.Q(actor__user__privacy_level="everyone")
+        )
+
+
+class TrackFavorite(federation_models.FederationMixin):
+    uuid = models.UUIDField(default=uuid.uuid4, unique=True)
     creation_date = models.DateTimeField(default=timezone.now)
-    user = models.ForeignKey(
-        "users.User", related_name="track_favorites", on_delete=models.CASCADE
+    actor = models.ForeignKey(
+        "federation.Actor",
+        related_name="track_favorites",
+        on_delete=models.CASCADE,
+        null=False,
+        blank=False,
     )
+    privacy_level = fields.get_privacy_field()
     track = models.ForeignKey(
         Track, related_name="track_favorites", on_delete=models.CASCADE
     )
+    source = models.CharField(max_length=100, null=True, blank=True)
+
+    federation_namespace = "likes"
+    objects = TrackFavoriteQuerySet.as_manager()
 
     class Meta:
-        unique_together = ("track", "user")
+        unique_together = ("track", "actor")
+
         ordering = ("-creation_date",)
 
     @classmethod
-    def add(cls, track, user):
-        favorite, created = cls.objects.get_or_create(user=user, track=track)
+    def add(cls, track, actor):
+        favorite, created = cls.objects.get_or_create(actor=actor, track=track)
         return favorite
 
     def get_activity_url(self):
-        return "{}/favorites/tracks/{}".format(self.user.get_activity_url(), self.pk)
+        return f"{self.actor.get_absolute_url()}/favorites/tracks/{self.pk}"
+
+    def get_absolute_url(self):
+        return f"/library/tracks/{self.track.pk}"
+
+    def get_federation_id(self):
+        if self.fid:
+            return self.fid
+
+        return federation_utils.full_url(
+            reverse(
+                f"federation:music:{self.federation_namespace}-detail",
+                kwargs={"uuid": self.uuid},
+            )
+        )
+
+    def save(self, **kwargs):
+        if not self.pk and not self.fid:
+            self.fid = self.get_federation_id()
+        if not self.privacy_level:
+            self.privacy_level = self.actor.user.privacy_level
+        return super().save(**kwargs)

api/funkwhale_api/favorites/serializers.py

-
 from rest_framework import serializers
 
 from funkwhale_api.activity import serializers as activity_serializers
-from funkwhale_api.music.serializers import TrackActivitySerializer
-from funkwhale_api.users.serializers import UserActivitySerializer
+from funkwhale_api.federation import serializers as federation_serializers
+from funkwhale_api.music.serializers import TrackActivitySerializer, TrackSerializer
 
 from . import models
 
@@ -11,21 +10,40 @@ from . import models
 class TrackFavoriteActivitySerializer(activity_serializers.ModelSerializer):
     type = serializers.SerializerMethodField()
     object = TrackActivitySerializer(source="track")
-    actor = UserActivitySerializer(source="user")
+    actor = federation_serializers.APIActorSerializer(read_only=True)
     published = serializers.DateTimeField(source="creation_date")
 
     class Meta:
         model = models.TrackFavorite
         fields = ["id", "local_id", "object", "type", "actor", "published"]
 
-    def get_actor(self, obj):
-        return UserActivitySerializer(obj.user).data
-
     def get_type(self, obj):
         return "Like"
 
 
 class UserTrackFavoriteSerializer(serializers.ModelSerializer):
+    track = TrackSerializer(read_only=True)
+    actor = federation_serializers.APIActorSerializer(read_only=True)
+
+    class Meta:
+        model = models.TrackFavorite
+        fields = ("id", "actor", "track", "creation_date", "actor")
+
+
+class UserTrackFavoriteWriteSerializer(serializers.ModelSerializer):
     class Meta:
         model = models.TrackFavorite
         fields = ("id", "track", "creation_date")
+
+
+class SimpleFavoriteSerializer(serializers.Serializer):
+    id = serializers.IntegerField()
+    track = serializers.IntegerField()
+
+
+class AllFavoriteSerializer(serializers.Serializer):
+    results = SimpleFavoriteSerializer(many=True, source="*")
+    count = serializers.SerializerMethodField()
+
+    def get_count(self, o) -> int:
+        return len(o)

api/funkwhale_api/favorites/urls.py

-from rest_framework import routers
+from funkwhale_api.common import routers
 
 from . import views
 
-router = routers.SimpleRouter()
+router = routers.OptionalSlashRouter()
 router.register(r"tracks", views.TrackFavoriteViewSet, "tracks")
 
 urlpatterns = router.urls

api/funkwhale_api/favorites/views.py

+from django.db.models import Prefetch
+from drf_spectacular.utils import extend_schema
 from rest_framework import mixins, status, viewsets
-from rest_framework.decorators import list_route
+from rest_framework.decorators import action
 from rest_framework.response import Response
 
+from config import plugins
 from funkwhale_api.activity import record
-from funkwhale_api.common.permissions import ConditionalAuthentication
+from funkwhale_api.common import fields, permissions
+from funkwhale_api.federation import routes
+from funkwhale_api.music import utils as music_utils
 from funkwhale_api.music.models import Track
+from funkwhale_api.users.oauth import permissions as oauth_permissions
 
-from . import models, serializers
+from . import filters, models, serializers
 
 
 class TrackFavoriteViewSet(
@@ -15,36 +21,116 @@ class TrackFavoriteViewSet(
     mixins.ListModelMixin,
     viewsets.GenericViewSet,
 ):
-
+    filterset_class = filters.TrackFavoriteFilter
     serializer_class = serializers.UserTrackFavoriteSerializer
-    queryset = models.TrackFavorite.objects.all()
-    permission_classes = [ConditionalAuthentication]
+    queryset = models.TrackFavorite.objects.all().select_related(
+        "actor__attachment_icon"
+    )
+    permission_classes = [
+        oauth_permissions.ScopePermission,
+        permissions.OwnerPermission,
+    ]
+    required_scope = "favorites"
+    anonymous_policy = "setting"
+    owner_checks = ["write"]
+    owner_field = "actor.user"
+
+    def get_serializer_class(self):
+        if self.request.method.lower() in ["head", "get", "options"]:
+            return serializers.UserTrackFavoriteSerializer
+        return serializers.UserTrackFavoriteWriteSerializer
 
+    @extend_schema(operation_id="favorite_track")
     def create(self, request, *args, **kwargs):
         serializer = self.get_serializer(data=request.data)
         serializer.is_valid(raise_exception=True)
         instance = self.perform_create(serializer)
         serializer = self.get_serializer(instance=instance)
         headers = self.get_success_headers(serializer.data)
+        plugins.trigger_hook(
+            plugins.FAVORITE_CREATED,
+            track_favorite=serializer.instance,
+            confs=plugins.get_confs(self.request.user),
+        )
         record.send(instance)
+        routes.outbox.dispatch(
+            {"type": "Like", "object": {"type": "Track"}},
+            context={
+                "track": instance.track,
+                "actor": instance.actor,
+                "id": instance.fid,
+            },
+        )
         return Response(
             serializer.data, status=status.HTTP_201_CREATED, headers=headers
         )
 
     def get_queryset(self):
-        return self.queryset.filter(user=self.request.user)
+        queryset = super().get_queryset()
+        queryset = queryset.filter(
+            fields.privacy_level_query(
+                self.request.user, "privacy_level", "actor__user"
+            )
+        )
+        tracks = (
+            Track.objects.with_playable_uploads(
+                music_utils.get_actor_from_request(self.request)
+            )
+            .prefetch_related(
+                "artist_credit__artist",
+                "album__artist_credit__artist",
+            )
+            .select_related(
+                "attributed_to",
+                "album__attachment_cover",
+            )
+        )
+
+        queryset = queryset.prefetch_related(Prefetch("track", queryset=tracks))
+        return queryset
 
     def perform_create(self, serializer):
         track = Track.objects.get(pk=serializer.data["track"])
-        favorite = models.TrackFavorite.add(track=track, user=self.request.user)
+        favorite = models.TrackFavorite.add(track=track, actor=self.request.user.actor)
         return favorite
 
-    @list_route(methods=["delete", "post"])
+    @extend_schema(operation_id="unfavorite_track")
+    @action(methods=["delete", "post"], detail=False)
     def remove(self, request, *args, **kwargs):
         try:
             pk = int(request.data["track"])
-            favorite = request.user.track_favorites.get(track__pk=pk)
+            favorite = request.user.actor.track_favorites.get(track__pk=pk)
         except (AttributeError, ValueError, models.TrackFavorite.DoesNotExist):
             return Response({}, status=400)
+        routes.outbox.dispatch(
+            {"type": "Dislike", "object": {"type": "Track"}},
+            context={"favorite": favorite},
+        )
         favorite.delete()
+        plugins.trigger_hook(
+            plugins.FAVORITE_DELETED,
+            track_favorite=favorite,
+            confs=plugins.get_confs(self.request.user),
+        )
         return Response([], status=status.HTTP_204_NO_CONTENT)
+
+    @extend_schema(
+        responses=serializers.AllFavoriteSerializer(),
+        operation_id="get_all_favorite_tracks",
+    )
+    @action(methods=["get"], detail=False)
+    def all(self, request, *args, **kwargs):
+        """
+        Return all the favorites of the current user, with only limited data
+        to have a performant endpoint and avoid lots of queries just to display
+        favorites status in the UI
+        """
+        if not request.user.is_authenticated:
+            return Response({"results": [], "count": 0}, status=401)
+
+        favorites = request.user.actor.track_favorites.values("id", "track").order_by(
+            "id"
+        )
+        payload = serializers.AllFavoriteSerializer(favorites).data
+
+        return Response(payload, status=200)

api/funkwhale_api/federation/activity.py

+import logging
+import urllib.parse
+import uuid
+
+from django.conf import settings
+from django.core.cache import cache
+from django.db import IntegrityError, transaction
+from django.db.models import Q
+
+from funkwhale_api.common import channels
+from funkwhale_api.common import utils as funkwhale_utils
+
+from . import contexts
+
+recursive_getattr = funkwhale_utils.recursive_getattr
+
+
+logger = logging.getLogger(__name__)
+PUBLIC_ADDRESS = contexts.AS.Public
+
 ACTIVITY_TYPES = [
     "Accept",
     "Add",
@@ -29,33 +49,596 @@ ACTIVITY_TYPES = [
     "View",
 ]
 
-
-OBJECT_TYPES = [
+FUNKWHALE_OBJECT_TYPES = [
+    ("Domain", "Domain"),
+    ("Artist", "Artist"),
+    ("Album", "Album"),
+    ("Track", "Track"),
+    ("Library", "Library"),
+]
+OBJECT_TYPES = (
+    [
+        "Application",
         "Article",
         "Audio",
         "Collection",
         "Document",
         "Event",
+        "Group",
         "Image",
         "Note",
+        "Object",
         "OrderedCollection",
+        "Organization",
         "Page",
+        "Person",
         "Place",
         "Profile",
         "Relationship",
+        "Service",
         "Tombstone",
         "Video",
-] + ACTIVITY_TYPES
+    ]
+    + ACTIVITY_TYPES
+    + FUNKWHALE_OBJECT_TYPES
+)
+
+
+BROADCAST_TO_USER_ACTIVITIES = ["Follow", "Accept"]
+
+
+def should_reject(fid, actor_id=None, payload={}):
+    if fid is None and actor_id is None:
+        return False
+
+    from funkwhale_api.moderation import models as moderation_models
+
+    policies = moderation_models.InstancePolicy.objects.active()
+
+    media_types = ["Audio", "Artist", "Album", "Track", "Library", "Image"]
+    relevant_values = [
+        recursive_getattr(payload, "type", permissive=True),
+        recursive_getattr(payload, "object.type", permissive=True),
+        recursive_getattr(payload, "target.type", permissive=True),
+    ]
+    # if one of the payload types match our internal media types, then
+    # we apply policies that reject media
+    if set(media_types) & set(relevant_values):
+        policy_type = Q(block_all=True) | Q(reject_media=True)
+    else:
+        policy_type = Q(block_all=True)
+
+    if fid:
+        query = policies.matching_url_query(fid) & policy_type
+    if fid and actor_id:
+        query |= policies.matching_url_query(actor_id) & policy_type
+    elif actor_id:
+        query = policies.matching_url_query(actor_id) & policy_type
+    return policies.filter(query).exists()
+
+
+@transaction.atomic
+def receive(activity, on_behalf_of, inbox_actor=None):
+    """
+    Receive an activity, find his recipients and save it to the database before dispatching it
+    """
+    from funkwhale_api.moderation import mrf
+
+    from . import models, serializers, tasks
+    from .routes import inbox
+
+    logger.debug(
+        "[federation] Received activity from %s : %s", on_behalf_of.fid, activity
+    )
+    # we ensure the activity has the bare minimum structure before storing
+    # it in our database
+    serializer = serializers.BaseActivitySerializer(
+        data=activity,
+        context={
+            "actor": on_behalf_of,
+            "local_recipients": True,
+            "recipients": [inbox_actor] if inbox_actor else [],
+        },
+    )
+    serializer.is_valid(raise_exception=True)
+
+    payload, updated = mrf.inbox.apply(activity, sender_id=on_behalf_of.fid)
+    if not payload:
+        logger.info(
+            "[federation] Discarding activity due to mrf %s",
+            serializer.validated_data.get("id"),
+        )
+        return
+
+    if not inbox.get_matching_handlers(payload):
+        # discard unhandlable activity
+        logger.debug(
+            "[federation] No matching route found for activity, discarding: %s", payload
+        )
+        return
+
+    try:
+        copy = serializer.save(payload=payload, type=payload["type"])
+    except IntegrityError:
+        logger.warning(
+            "[federation] Discarding already delivered activity %s",
+            serializer.validated_data.get("id"),
+        )
+        return
+
+    local_to_recipients = get_actors_from_audience(
+        serializer.validated_data.get("to", [])
+    )
+    local_to_recipients = local_to_recipients.local()
+    local_to_recipients = local_to_recipients.values_list("pk", flat=True)
+    local_to_recipients = list(local_to_recipients)
+    if inbox_actor:
+        local_to_recipients.append(inbox_actor.pk)
+
+    local_cc_recipients = get_actors_from_audience(
+        serializer.validated_data.get("cc", [])
+    )
+    local_cc_recipients = local_cc_recipients.local()
+    local_cc_recipients = local_cc_recipients.values_list("pk", flat=True)
+
+    inbox_items = []
+    for recipients, type in [(local_to_recipients, "to"), (local_cc_recipients, "cc")]:
+        for r in recipients:
+            inbox_items.append(models.InboxItem(actor_id=r, type=type, activity=copy))
+
+    models.InboxItem.objects.bulk_create(inbox_items)
+
+    # at this point, we have the activity in database. Even if we crash, it's
+    # okay, as we can retry later
+    funkwhale_utils.on_commit(tasks.dispatch_inbox.delay, activity_id=copy.pk)
+    return copy
+
+
+class Router:
+    def __init__(self):
+        self.routes = []
+
+    def connect(self, route, handler):
+        self.routes.append((route, handler))
+
+    def register(self, route):
+        def decorator(handler):
+            self.connect(route, handler)
+            return handler
+
+        return decorator
+
+
+class InboxRouter(Router):
+    def get_matching_handlers(self, payload):
+        return [
+            handler for route, handler in self.routes if match_route(route, payload)
+        ]
+
+    @transaction.atomic
+    def dispatch(self, payload, context, call_handlers=True):
+        """
+        Receives an Activity payload and some context and trigger our
+        business logic.
+
+        call_handlers should be False when are delivering a local activity, because
+        we want only want to bind activities to their recipients, not reapply the changes.
+        """
+        from . import api_serializers, models
+
+        logger.debug(
+            f"[federation] Inbox dispatch payload : {payload} with context : {context}"
+        )
+        handlers = self.get_matching_handlers(payload)
+        for handler in handlers:
+            if call_handlers:
+                r = handler(payload, context=context)
+            else:
+                r = None
+            activity_obj = context.get("activity")
+            if activity_obj and r:
+                # handler returned additional data we can use
+                # to update the activity target
+                for key, value in r.items():
+                    setattr(activity_obj, key, value)
+
+                update_fields = []
+                for k in r.keys():
+                    if k in ["object", "target", "related_object"]:
+                        update_fields += [
+                            f"{k}_id",
+                            f"{k}_content_type",
+                        ]
+                    else:
+                        update_fields.append(k)
+                activity_obj.save(update_fields=update_fields)
+
+            if payload["type"] not in BROADCAST_TO_USER_ACTIVITIES:
+                return
+
+            inbox_items = context.get("inbox_items", models.InboxItem.objects.none())
+            inbox_items = (
+                inbox_items.select_related()
+                .select_related("actor__user")
+                .prefetch_related(
+                    "activity__object", "activity__target", "activity__related_object"
+                )
+            )
+
+            for ii in inbox_items:
+                user = ii.actor.get_user()
+                if not user:
+                    continue
+                group = f"user.{user.pk}.inbox"
+                channels.group_send(
+                    group,
+                    {
+                        "type": "event.send",
+                        "text": "",
+                        "data": {
+                            "type": "inbox.item_added",
+                            "item": api_serializers.InboxItemSerializer(ii).data,
+                        },
+                    },
+                )
+            return
+
+
+ACTOR_KEY_ROTATION_LOCK_CACHE_KEY = "federation:actor-key-rotation-lock:{}"
+
+
+def should_rotate_actor_key(actor_id):
+    lock = cache.get(ACTOR_KEY_ROTATION_LOCK_CACHE_KEY.format(actor_id))
+    return lock is None
 
 
-def deliver(activity, on_behalf_of, to=[]):
+def schedule_key_rotation(actor_id, delay):
     from . import tasks
 
-    return tasks.send.delay(activity=activity, actor_id=on_behalf_of.pk, to=to)
+    cache.set(ACTOR_KEY_ROTATION_LOCK_CACHE_KEY.format(actor_id), True, timeout=delay)
+    tasks.rotate_actor_key.apply_async(kwargs={"actor_id": actor_id}, countdown=delay)
+
+
+def activity_pass_user_privacy_level(context, routing):
+    TYPE_FOLLOW_USER_PRIVACY_LEVEL = ["Listen", "Like", "Create"]
+    TYPE_IGNORE_USER_PRIVACY_LEVEL = ["Delete", "Accept", "Follow"]
+    MUSIC_OBJECT_TYPE = ["Audio", "Track", "Album", "Artist"]
+
+    actor = context.get("actor", False)
+    type = routing.get("type", False)
+    object_type = routing.get("object", {}).get("type", None)
+
+    if not actor:
+        logger.warning(
+            "No actor provided in activity context : \
+                we cannot follow actor.privacy_level, activity will be sent by default."
+        )
+
+    # We do not consider music metadata has private
+    if object_type in MUSIC_OBJECT_TYPE:
+        return True
+
+    if type:
+        if type in TYPE_IGNORE_USER_PRIVACY_LEVEL:
+            return True
+        if type in TYPE_FOLLOW_USER_PRIVACY_LEVEL and actor and actor.is_local:
+            if actor.user.privacy_level in [
+                "me",
+                "instance",
+            ]:
+                return False
+
+            return True
+
+    return True
+
+
+def activity_pass_object_privacy_level(context, routing):
+    MUSIC_OBJECT_TYPE = ["Audio", "Track", "Album", "Artist"]
+
+    # we only support playlist federation for now (other objects follow user.privacy_level)
+    object = context.get("playlist", False)
+
+    obj_privacy_level = object.privacy_level if object else None
+    object_type = routing.get("object", {}).get("type", None)
+
+    # We do not consider music metadata has private
+    if object_type in MUSIC_OBJECT_TYPE:
+        return True
+    if routing["type"] == "Delete":
+        return True
+
+    if routing["type"] == "Update" and obj_privacy_level in ["me", "instance"]:
+        # we send a delete request instead
+        logger.debug(
+            "[federation] Object privacy level is me or instance, sending delete instead of update"
+        )
+        routing["type"] = "Delete"
+        return True
+
+    if object and obj_privacy_level and obj_privacy_level in ["me", "instance"]:
+        return False
+
+    return True
+
+
+class OutboxRouter(Router):
+    @transaction.atomic
+    def dispatch(self, routing, context):
+        """
+        Receives a routing payload and some business objects in the context
+        and may yield data that should be persisted in the Activity model
+        for further delivery.
+        """
+        from funkwhale_api.common import preferences
+
+        from . import models, tasks
+
+        logger.debug(
+            f"[federation] Outbox dispatch context : {context} and routing : {routing}"
+        )
+        allow_list_enabled = preferences.get("moderation__allow_list_enabled")
+        allowed_domains = None
+        if allow_list_enabled:
+            allowed_domains = set(
+                models.Domain.objects.filter(allowed=True).values_list(
+                    "name", flat=True
+                )
+            )
+
+        if activity_pass_user_privacy_level(context, routing) is False:
+            logger.info(
+                "[federation] Discarding outbox dispatch due to user privacy_level"
+            )
+            return
+
+        if activity_pass_object_privacy_level(context, routing) is False:
+            logger.info(
+                "[federation] Discarding outbox dispatch due to object privacy_level"
+            )
+            return
+
+        for route, handler in self.routes:
+            if not match_route(route, routing):
+                continue
+
+            activities_data = []
+            for e in handler(context):
+                # a route can yield zero, one or more activity payloads
+                if e:
+                    activities_data.append(e)
+            deletions = [
+                a["actor"].id
+                for a in activities_data
+                if a["payload"]["type"] == "Delete"
+            ]
+            for actor_id in deletions:
+                # we way need to triggers a blind key rotation
+                if should_rotate_actor_key(actor_id):
+                    schedule_key_rotation(actor_id, settings.ACTOR_KEY_ROTATION_DELAY)
+            inbox_items_by_activity_uuid = {}
+            deliveries_by_activity_uuid = {}
+            prepared_activities = []
+            for activity_data in activities_data:
+                activity_data["payload"]["actor"] = activity_data["actor"].fid
+                to = activity_data["payload"].pop("to", [])
+                cc = activity_data["payload"].pop("cc", [])
+                a = models.Activity(**activity_data)
+                a.uuid = uuid.uuid4()
+                (
+                    to_inbox_items,
+                    to_deliveries,
+                    new_to,
+                ) = prepare_deliveries_and_inbox_items(
+                    to, "to", allowed_domains=allowed_domains
+                )
+                (
+                    cc_inbox_items,
+                    cc_deliveries,
+                    new_cc,
+                ) = prepare_deliveries_and_inbox_items(
+                    cc, "cc", allowed_domains=allowed_domains
+                )
+                if not any(
+                    [to_inbox_items, to_deliveries, cc_inbox_items, cc_deliveries]
+                ):
+                    continue
+                deliveries_by_activity_uuid[str(a.uuid)] = to_deliveries + cc_deliveries
+                inbox_items_by_activity_uuid[str(a.uuid)] = (
+                    to_inbox_items + cc_inbox_items
+                )
+                if new_to:
+                    a.payload["to"] = new_to
+                if new_cc:
+                    a.payload["cc"] = new_cc
+                prepared_activities.append(a)
+
+            activities = models.Activity.objects.bulk_create(prepared_activities)
+
+            for activity in activities:
+                if str(activity.uuid) in deliveries_by_activity_uuid:
+                    for obj in deliveries_by_activity_uuid[str(a.uuid)]:
+                        obj.activity = activity
+
+                if str(activity.uuid) in inbox_items_by_activity_uuid:
+                    for obj in inbox_items_by_activity_uuid[str(a.uuid)]:
+                        obj.activity = activity
+
+            # create all deliveries and items, in bulk
+            models.Delivery.objects.bulk_create(
+                [
+                    obj
+                    for collection in deliveries_by_activity_uuid.values()
+                    for obj in collection
+                ]
+            )
+            models.InboxItem.objects.bulk_create(
+                [
+                    obj
+                    for collection in inbox_items_by_activity_uuid.values()
+                    for obj in collection
+                ]
+            )
+
+            for a in activities:
+                logger.info(f"[federation] Outbox sending activity : {a.pk}")
+                funkwhale_utils.on_commit(tasks.dispatch_outbox.delay, activity_id=a.pk)
+            return activities
+
+
+def match_route(route, payload):
+    for key, value in route.items():
+        payload_value = recursive_getattr(payload, key, permissive=True)
+        if isinstance(value, list):
+            if payload_value not in value:
+                return False
+        elif payload_value != value:
+            return False
+
+    return True
+
+
+def is_allowed_url(url, allowed_domains):
+    return (
+        allowed_domains is None
+        or urllib.parse.urlparse(url).hostname in allowed_domains
+    )
+
+
+def prepare_deliveries_and_inbox_items(recipient_list, type, allowed_domains=None):
+    """
+    Given a list of recipients (
+        either actor instances, public addresses, a dictionary with a "type" and "target"
+        keys for followers collections)
+    returns a list of deliveries, alist of inbox_items and a list
+    of urls to persist in the activity in place of the initial recipient list.
+    """
+    from . import models
+
+    if allowed_domains is not None:
+        allowed_domains = set(allowed_domains)
+        allowed_domains.add(settings.FEDERATION_HOSTNAME)
+    local_recipients = set()
+    remote_inbox_urls = set()
+    urls = []
+    for r in recipient_list:
+        if isinstance(r, models.Actor):
+            if r.is_local:
+                local_recipients.add(r)
+            else:
+                remote_inbox_urls.add(r.shared_inbox_url or r.inbox_url)
+            urls.append(r.fid)
+        elif r == PUBLIC_ADDRESS:
+            urls.append(r)
+        elif isinstance(r, dict) and r["type"] == "followers":
+            received_follows = (
+                r["target"]
+                .received_follows.filter(approved=True)
+                .select_related("actor__user")
+            )
+            for follow in received_follows:
+                actor = follow.actor
+                if actor.is_local:
+                    local_recipients.add(actor)
+                else:
+                    remote_inbox_urls.add(actor.shared_inbox_url or actor.inbox_url)
+            urls.append(r["target"].followers_url)
+        elif isinstance(r, dict) and r["type"] == "actor_inbox":
+            actor = r["actor"]
+            urls.append(actor.fid)
+            if actor.is_local:
+                local_recipients.add(actor)
+            else:
+                remote_inbox_urls.add(actor.inbox_url)
+
+        elif isinstance(r, dict) and r["type"] == "instances_with_followers":
+            # we want to broadcast the activity to other instances service actors
+            # when we have at least one follower from this instance
+            follows = (
+                models.LibraryFollow.objects.filter(approved=True)
+                .exclude(actor__domain_id=settings.FEDERATION_HOSTNAME)
+                .exclude(actor__domain=None)
+                .union(
+                    models.Follow.objects.filter(approved=True)
+                    .exclude(actor__domain_id=settings.FEDERATION_HOSTNAME)
+                    .exclude(actor__domain=None)
+                )
+            )
+            followed_domains = list(follows.values_list("actor__domain_id", flat=True))
+            actors = models.Actor.objects.filter(
+                managed_domains__name__in=followed_domains
+            )
+            values = actors.values("shared_inbox_url", "inbox_url", "domain_id")
+            handled_domains = set()
+            for v in values:
+                remote_inbox_urls.add(v["shared_inbox_url"] or v["inbox_url"])
+                handled_domains.add(v["domain_id"])
+
+            if len(handled_domains) >= len(followed_domains):
+                continue
+
+            # for all remaining domains (probably non-funkwhale instances, with no
+            # service actors), we also pick the latest known actor per domain and send the message
+            # there instead
+            remaining_domains = models.Domain.objects.exclude(name__in=handled_domains)
+            remaining_domains = remaining_domains.filter(name__in=followed_domains)
+            actors = models.Actor.objects.filter(domain__in=remaining_domains)
+            actors = (
+                actors.order_by("domain_id", "-last_fetch_date")
+                .distinct("domain_id")
+                .values("shared_inbox_url", "inbox_url")
+            )
+            for v in actors:
+                remote_inbox_urls.add(v["shared_inbox_url"] or v["inbox_url"])
+
+    deliveries = [
+        models.Delivery(inbox_url=url)
+        for url in remote_inbox_urls
+        if is_allowed_url(url, allowed_domains)
+    ]
+    urls = [url for url in urls if is_allowed_url(url, allowed_domains)]
+    inbox_items = [
+        models.InboxItem(actor=actor, type=type) for actor in local_recipients
+    ]
+
+    return inbox_items, deliveries, urls
+
+
+def get_actors_from_audience(urls):
+    """
+    Given a list of urls such as [
+        "https://hello.world/@bob/followers",
+        "https://eldritch.cafe/@alice/followers",
+        "https://funkwhale.demo/libraries/uuid/followers",
+    ]
+    Returns a queryset of actors that are member of the collections
+    listed in the given urls. The urls may contain urls referring
+    to an actor, an actor followers collection or an library followers
+    collection.
 
+    Urls that don't match anything are simply discarded
+    """
+    from . import models
 
-def accept_follow(follow):
-    from . import serializers
+    queries = {"followed": None, "actors": []}
+    for url in urls:
+        if url == PUBLIC_ADDRESS:
+            continue
+        queries["actors"].append(url)
+        queries["followed"] = funkwhale_utils.join_queries_or(
+            queries["followed"], Q(target__followers_url=url)
+        )
+    final_query = None
+    if queries["actors"]:
+        final_query = funkwhale_utils.join_queries_or(
+            final_query, Q(fid__in=queries["actors"])
+        )
+    if queries["followed"]:
+        actor_follows = models.Follow.objects.filter(queries["followed"], approved=True)
+        final_query = funkwhale_utils.join_queries_or(
+            final_query, Q(pk__in=actor_follows.values_list("actor", flat=True))
+        )
 
-    serializer = serializers.AcceptFollowSerializer(follow)
-    return deliver(serializer.data, to=[follow.actor.url], on_behalf_of=follow.target)
+    if not final_query:
+        return models.Actor.objects.none()
+    return models.Actor.objects.filter(final_query)

api/funkwhale_api/federation/actors.py

 import datetime
 import logging
-import xml
 
 from django.conf import settings
-from django.db import transaction
-from django.urls import reverse
 from django.utils import timezone
-from rest_framework.exceptions import PermissionDenied
 
 from funkwhale_api.common import preferences, session
-from funkwhale_api.common import utils as funkwhale_utils
-from funkwhale_api.music import models as music_models
-from funkwhale_api.music import tasks as music_tasks
+from funkwhale_api.users import models as users_models
 
-from . import activity, keys, models, serializers, signing, utils
+from . import keys, models, serializers
 
 logger = logging.getLogger(__name__)
 
 
-def remove_tags(text):
-    logger.debug("Removing tags from %s", text)
-    return "".join(
-        xml.etree.ElementTree.fromstring("<div>{}</div>".format(text)).itertext()
-    )
-
-
 def get_actor_data(actor_url):
+    logger.debug("Fetching actor %s", actor_url)
     response = session.get_session().get(
         actor_url,
-        timeout=5,
-        verify=settings.EXTERNAL_REQUESTS_VERIFY_SSL,
         headers={"Accept": "application/activity+json"},
     )
     response.raise_for_status()
     try:
         return response.json()
     except Exception:
-        raise ValueError("Invalid actor payload: {}".format(response.text))
+        raise ValueError(f"Invalid actor payload: {response.text}")
 
 
-def get_actor(actor_url):
+def get_actor(fid, skip_cache=False):
+    if not skip_cache:
         try:
-        actor = models.Actor.objects.get(url=actor_url)
+            actor = models.Actor.objects.select_related().get(fid=fid)
         except models.Actor.DoesNotExist:
             actor = None
         fetch_delta = datetime.timedelta(
@@ -50,330 +37,39 @@ def get_actor(actor_url):
         if actor and actor.last_fetch_date > timezone.now() - fetch_delta:
             # cache is hot, we can return as is
             return actor
-    data = get_actor_data(actor_url)
+    data = get_actor_data(fid)
     serializer = serializers.ActorSerializer(data=data)
     serializer.is_valid(raise_exception=True)
 
     return serializer.save(last_fetch_date=timezone.now())
 
 
-class SystemActor(object):
-    additional_attributes = {}
-    manually_approves_followers = False
+_CACHE = {}
 
-    def get_request_auth(self):
-        actor = self.get_actor_instance()
-        return signing.get_auth(actor.private_key, actor.private_key_id)
 
-    def serialize(self):
-        actor = self.get_actor_instance()
-        serializer = serializers.ActorSerializer(actor)
-        return serializer.data
+def get_service_actor(cache=True):
+    if cache and "service_actor" in _CACHE:
+        return _CACHE["service_actor"]
 
-    def get_actor_instance(self):
+    name, domain = (
+        settings.FEDERATION_SERVICE_ACTOR_USERNAME,
+        settings.FEDERATION_HOSTNAME,
+    )
     try:
-            return models.Actor.objects.get(url=self.get_actor_url())
+        actor = models.Actor.objects.select_related().get(
+            preferred_username=name, domain__name=domain
+        )
     except models.Actor.DoesNotExist:
         pass
+    else:
+        _CACHE["service_actor"] = actor
+        return actor
+
+    args = users_models.get_actor_data(name)
     private, public = keys.get_key_pair()
-        args = self.get_instance_argument(
-            self.id, name=self.name, summary=self.summary, **self.additional_attributes
-        )
     args["private_key"] = private.decode("utf-8")
     args["public_key"] = public.decode("utf-8")
-        return models.Actor.objects.create(**args)
-
-    def get_actor_url(self):
-        return utils.full_url(
-            reverse("federation:instance-actors-detail", kwargs={"actor": self.id})
-        )
-
-    def get_instance_argument(self, id, name, summary, **kwargs):
-        p = {
-            "preferred_username": id,
-            "domain": settings.FEDERATION_HOSTNAME,
-            "type": "Person",
-            "name": name.format(host=settings.FEDERATION_HOSTNAME),
-            "manually_approves_followers": True,
-            "url": self.get_actor_url(),
-            "shared_inbox_url": utils.full_url(
-                reverse("federation:instance-actors-inbox", kwargs={"actor": id})
-            ),
-            "inbox_url": utils.full_url(
-                reverse("federation:instance-actors-inbox", kwargs={"actor": id})
-            ),
-            "outbox_url": utils.full_url(
-                reverse("federation:instance-actors-outbox", kwargs={"actor": id})
-            ),
-            "summary": summary.format(host=settings.FEDERATION_HOSTNAME),
-        }
-        p.update(kwargs)
-        return p
-
-    def get_inbox(self, data, actor=None):
-        raise NotImplementedError
-
-    def post_inbox(self, data, actor=None):
-        return self.handle(data, actor=actor)
-
-    def get_outbox(self, data, actor=None):
-        raise NotImplementedError
-
-    def post_outbox(self, data, actor=None):
-        raise NotImplementedError
-
-    def handle(self, data, actor=None):
-        """
-        Main entrypoint for handling activities posted to the
-        actor's inbox
-        """
-        logger.info("Received activity on %s inbox", self.id)
-
-        if actor is None:
-            raise PermissionDenied("Actor not authenticated")
-
-        serializer = serializers.ActivitySerializer(data=data, context={"actor": actor})
-        serializer.is_valid(raise_exception=True)
-
-        ac = serializer.data
-        try:
-            handler = getattr(self, "handle_{}".format(ac["type"].lower()))
-        except (KeyError, AttributeError):
-            logger.debug("No handler for activity %s", ac["type"])
-            return
-
-        return handler(data, actor)
-
-    def handle_follow(self, ac, sender):
-        serializer = serializers.FollowSerializer(
-            data=ac, context={"follow_actor": sender}
-        )
-        if not serializer.is_valid():
-            return logger.info("Invalid follow payload")
-        approved = True if not self.manually_approves_followers else None
-        follow = serializer.save(approved=approved)
-        if follow.approved:
-            return activity.accept_follow(follow)
-
-    def handle_accept(self, ac, sender):
-        system_actor = self.get_actor_instance()
-        serializer = serializers.AcceptFollowSerializer(
-            data=ac, context={"follow_target": sender, "follow_actor": system_actor}
-        )
-        if not serializer.is_valid(raise_exception=True):
-            return logger.info("Received invalid payload")
-
-        return serializer.save()
-
-    def handle_undo_follow(self, ac, sender):
-        system_actor = self.get_actor_instance()
-        serializer = serializers.UndoFollowSerializer(
-            data=ac, context={"actor": sender, "target": system_actor}
-        )
-        if not serializer.is_valid():
-            return logger.info("Received invalid payload")
-        serializer.save()
-
-    def handle_undo(self, ac, sender):
-        if ac["object"]["type"] != "Follow":
-            return
-
-        if ac["object"]["actor"] != sender.url:
-            # not the same actor, permission issue
-            return
-
-        self.handle_undo_follow(ac, sender)
-
-
-class LibraryActor(SystemActor):
-    id = "library"
-    name = "{host}'s library"
-    summary = "Bot account to federate with {host}'s library"
-    additional_attributes = {"manually_approves_followers": True}
-
-    def serialize(self):
-        data = super().serialize()
-        urls = data.setdefault("url", [])
-        urls.append(
-            {
-                "type": "Link",
-                "mediaType": "application/activity+json",
-                "name": "library",
-                "href": utils.full_url(reverse("federation:music:files-list")),
-            }
-        )
-        return data
-
-    @property
-    def manually_approves_followers(self):
-        return preferences.get("federation__music_needs_approval")
-
-    @transaction.atomic
-    def handle_create(self, ac, sender):
-        try:
-            remote_library = models.Library.objects.get(
-                actor=sender, federation_enabled=True
-            )
-        except models.Library.DoesNotExist:
-            logger.info("Skipping import, we're not following %s", sender.url)
-            return
-
-        if ac["object"]["type"] != "Collection":
-            return
-
-        if ac["object"]["totalItems"] <= 0:
-            return
-
-        try:
-            items = ac["object"]["items"]
-        except KeyError:
-            logger.warning("No items in collection!")
-            return
-
-        item_serializers = [
-            serializers.AudioSerializer(data=i, context={"library": remote_library})
-            for i in items
-        ]
-        now = timezone.now()
-        valid_serializers = []
-        for s in item_serializers:
-            if s.is_valid():
-                valid_serializers.append(s)
-            else:
-                logger.debug("Skipping invalid item %s, %s", s.initial_data, s.errors)
-
-        lts = []
-        for s in valid_serializers:
-            lts.append(s.save())
-
-        if remote_library.autoimport:
-            batch = music_models.ImportBatch.objects.create(source="federation")
-            for lt in lts:
-                if lt.creation_date < now:
-                    # track was already in the library, we do not trigger
-                    # an import
-                    continue
-                job = music_models.ImportJob.objects.create(
-                    batch=batch, library_track=lt, mbid=lt.mbid, source=lt.url
-                )
-                funkwhale_utils.on_commit(
-                    music_tasks.import_job_run.delay,
-                    import_job_id=job.pk,
-                    use_acoustid=False,
-                )
-
-
-class TestActor(SystemActor):
-    id = "test"
-    name = "{host}'s test account"
-    summary = (
-        "Bot account to test federation with {host}. "
-        "Send me /ping and I'll answer you."
-    )
-    additional_attributes = {"manually_approves_followers": False}
-    manually_approves_followers = False
-
-    def get_outbox(self, data, actor=None):
-        return {
-            "@context": [
-                "https://www.w3.org/ns/activitystreams",
-                "https://w3id.org/security/v1",
-                {},
-            ],
-            "id": utils.full_url(
-                reverse("federation:instance-actors-outbox", kwargs={"actor": self.id})
-            ),
-            "type": "OrderedCollection",
-            "totalItems": 0,
-            "orderedItems": [],
-        }
-
-    def parse_command(self, message):
-        """
-        Remove any links or fancy markup to extract /command from
-        a note message.
-        """
-        raw = remove_tags(message)
-        try:
-            return raw.split("/")[1]
-        except IndexError:
-            return
-
-    def handle_create(self, ac, sender):
-        if ac["object"]["type"] != "Note":
-            return
-
-        # we received a toot \o/
-        command = self.parse_command(ac["object"]["content"])
-        logger.debug("Parsed command: %s", command)
-        if command != "ping":
-            return
-
-        now = timezone.now()
-        test_actor = self.get_actor_instance()
-        reply_url = "https://{}/activities/note/{}".format(
-            settings.FEDERATION_HOSTNAME, now.timestamp()
-        )
-        reply_activity = {
-            "@context": [
-                "https://www.w3.org/ns/activitystreams",
-                "https://w3id.org/security/v1",
-                {},
-            ],
-            "type": "Create",
-            "actor": test_actor.url,
-            "id": "{}/activity".format(reply_url),
-            "published": now.isoformat(),
-            "to": ac["actor"],
-            "cc": [],
-            "object": {
-                "type": "Note",
-                "content": "Pong!",
-                "summary": None,
-                "published": now.isoformat(),
-                "id": reply_url,
-                "inReplyTo": ac["object"]["id"],
-                "sensitive": False,
-                "url": reply_url,
-                "to": [ac["actor"]],
-                "attributedTo": test_actor.url,
-                "cc": [],
-                "attachment": [],
-                "tag": [
-                    {
-                        "type": "Mention",
-                        "href": ac["actor"],
-                        "name": sender.mention_username,
-                    }
-                ],
-            },
-        }
-        activity.deliver(reply_activity, to=[ac["actor"]], on_behalf_of=test_actor)
-
-    def handle_follow(self, ac, sender):
-        super().handle_follow(ac, sender)
-        # also, we follow back
-        test_actor = self.get_actor_instance()
-        follow_back = models.Follow.objects.get_or_create(
-            actor=test_actor, target=sender, approved=None
-        )[0]
-        activity.deliver(
-            serializers.FollowSerializer(follow_back).data,
-            to=[follow_back.target.url],
-            on_behalf_of=follow_back.actor,
-        )
-
-    def handle_undo_follow(self, ac, sender):
-        super().handle_undo_follow(ac, sender)
-        actor = self.get_actor_instance()
-        # we also unfollow the sender, if possible
-        try:
-            follow = models.Follow.objects.get(target=sender, actor=actor)
-        except models.Follow.DoesNotExist:
-            return
-        undo = serializers.UndoFollowSerializer(follow).data
-        follow.delete()
-        activity.deliver(undo, to=[sender.url], on_behalf_of=actor)
-
-
-SYSTEM_ACTORS = {"library": LibraryActor(), "test": TestActor()}
+    args["type"] = "Service"
+    actor = models.Actor.objects.create(**args)
+    _CACHE["service_actor"] = actor
+    return actor

api/funkwhale_api/federation/admin.py

-from django.contrib import admin
+from funkwhale_api.common import admin
 
-from . import models
+from . import models, tasks
+
+
+def redeliver_deliveries(modeladmin, request, queryset):
+    queryset.update(is_delivered=False)
+    for delivery in queryset:
+        tasks.deliver_to_remote.delay(delivery_id=delivery.pk)
+
+
+redeliver_deliveries.short_description = "Redeliver"
+
+
+def redeliver_activities(modeladmin, request, queryset):
+    for activity in queryset.select_related("actor__user"):
+        if activity.actor.get_user():
+            tasks.dispatch_outbox.delay(activity_id=activity.pk)
+        else:
+            tasks.dispatch_inbox.delay(activity_id=activity.pk)
+
+
+redeliver_activities.short_description = "Redeliver"
+
+
+@admin.register(models.Domain)
+class DomainAdmin(admin.ModelAdmin):
+    list_display = ["name", "allowed", "creation_date"]
+    list_filter = ["allowed"]
+    search_fields = ["name"]
+
+
+@admin.register(models.Fetch)
+class FetchAdmin(admin.ModelAdmin):
+    list_display = ["url", "actor", "status", "creation_date", "fetch_date", "detail"]
+    search_fields = ["url", "actor__username"]
+    list_filter = ["status"]
+    list_select_related = True
+
+
+@admin.register(models.Activity)
+class ActivityAdmin(admin.ModelAdmin):
+    list_display = ["uuid", "type", "fid", "url", "actor", "creation_date"]
+    search_fields = ["payload", "fid", "url", "actor__domain__name"]
+    list_filter = ["type", "actor__domain__name"]
+    actions = [redeliver_activities]
+    list_select_related = True
 
 
 @admin.register(models.Actor)
 class ActorAdmin(admin.ModelAdmin):
     list_display = [
-        "url",
+        "fid",
         "domain",
         "preferred_username",
         "type",
         "creation_date",
         "last_fetch_date",
     ]
-    search_fields = ["url", "domain", "preferred_username"]
+    search_fields = ["fid", "domain__name", "preferred_username"]
     list_filter = ["type"]
 
 
@@ -21,28 +65,36 @@ class ActorAdmin(admin.ModelAdmin):
 class FollowAdmin(admin.ModelAdmin):
     list_display = ["actor", "target", "approved", "creation_date"]
     list_filter = ["approved"]
-    search_fields = ["actor__url", "target__url"]
+    search_fields = ["actor__fid", "target__fid"]
     list_select_related = True
 
 
-@admin.register(models.Library)
-class LibraryAdmin(admin.ModelAdmin):
-    list_display = ["actor", "url", "creation_date", "fetched_date", "tracks_count"]
-    search_fields = ["actor__url", "url"]
-    list_filter = ["federation_enabled", "download_files", "autoimport"]
+@admin.register(models.LibraryFollow)
+class LibraryFollowAdmin(admin.ModelAdmin):
+    list_display = ["actor", "target", "approved", "creation_date"]
+    list_filter = ["approved"]
+    search_fields = ["actor__fid", "target__fid"]
     list_select_related = True
 
 
-@admin.register(models.LibraryTrack)
-class LibraryTrackAdmin(admin.ModelAdmin):
+@admin.register(models.InboxItem)
+class InboxItemAdmin(admin.ModelAdmin):
+    list_display = ["actor", "activity", "type", "is_read"]
+    list_filter = ["type", "activity__type", "is_read"]
+    search_fields = ["actor__fid", "activity__fid"]
+    list_select_related = True
+
+
+@admin.register(models.Delivery)
+class DeliveryAdmin(admin.ModelAdmin):
     list_display = [
-        "title",
-        "artist_name",
-        "album_title",
-        "url",
-        "library",
-        "creation_date",
-        "published_date",
+        "inbox_url",
+        "activity",
+        "last_attempt_date",
+        "attempts",
+        "is_delivered",
     ]
-    search_fields = ["library__url", "url", "artist_name", "title", "album_title"]
+    list_filter = ["activity__type", "is_delivered"]
+    search_fields = ["inbox_url"]
     list_select_related = True
+    actions = [redeliver_deliveries]