Show local-only statuses in public timeline for authenticated users

Ref: fix-local-public

lib/pleroma/web/activity_pub/activity_pub.ex

@@ -501,9 +501,18 @@ def fetch_activities(recipients, opts \\ %{}, pagination \\ :keyset) do
 
   @spec fetch_public_or_unlisted_activities(map(), Pagination.type()) :: [Activity.t()]
   def fetch_public_or_unlisted_activities(opts \\ %{}, pagination \\ :keyset) do
+    includes_local_public = Map.get(opts, :includes_local_public, false)
+
     opts = Map.delete(opts, :user)
 
+    intended_recipients =
+      if includes_local_public do
+        [Constants.as_public(), as_local_public()]
+      else
         [Constants.as_public()]
+      end
+
+    intended_recipients
     |> fetch_activities_query(opts)
     |> restrict_unlisted(opts)
     |> fetch_paginated_optimized(opts, pagination)

lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex

@@ -112,6 +112,8 @@ def public(%{assigns: %{user: user}} = conn, params) do
         |> Map.put(:muting_user, user)
         |> Map.put(:reply_filtering_user, user)
         |> Map.put(:instance, params[:instance])
+        # Restricts unfederated content to authenticated users
+        |> Map.put(:includes_local_public, not is_nil(user))
         |> ActivityPub.fetch_public_activities()
 
       conn

test/pleroma/web/mastodon_api/controllers/status_controller_test.exs

@@ -1901,6 +1901,7 @@ test "expires_at is nil for another user" do
              |> json_response_and_validate_schema(:ok)
   end
 
+  describe "local-only statuses" do
     test "posting a local only status" do
       %{user: _user, conn: conn} = oauth_access(["write:statuses"])
 
@@ -1920,6 +1921,35 @@ test "posting a local only status" do
       assert %Activity{id: ^id, data: %{"to" => [^local]}} = Activity.get_by_id(id)
     end
 
+    test "other users can read local-only posts" do
+      user = insert(:user)
+      %{user: reader, conn: conn} = oauth_access(["read:statuses"])
+
+      {:ok, activity} = CommonAPI.post(user, %{status: "#2hu #2HU", visibility: "local"})
+
+      received =
+        conn
+        |> get("/api/v1/statuses/#{activity.id}")
+        |> json_response_and_validate_schema(:ok)
+
+      assert received["id"] == activity.id
+    end
+
+    test "other users can see local-only posts" do
+      user = insert(:user)
+      %{user: _reader, conn: conn} = oauth_access(["read:statuses"])
+
+      {:ok, activity} = CommonAPI.post(user, %{status: "#2hu #2HU", visibility: "local"})
+
+      received =
+        conn
+        |> get("/api/v1/statuses/#{activity.id}")
+        |> json_response_and_validate_schema(:ok)
+
+      assert received["id"] == activity.id
+    end
+  end
+
   describe "muted reactions" do
     test "index" do
       %{conn: conn, user: user} = oauth_access(["read:statuses"])

test/pleroma/web/mastodon_api/controllers/timeline_controller_test.exs

@@ -367,6 +367,47 @@ test "muted emotions", %{conn: conn} do
                }
              ] = result
     end
+
+    test "should return local-only posts for authenticated users" do
+      user = insert(:user)
+      %{user: _reader, conn: conn} = oauth_access(["read:statuses"])
+
+      {:ok, %{id: id}} = CommonAPI.post(user, %{status: "#2hu #2HU", visibility: "local"})
+
+      result =
+        conn
+        |> get("/api/v1/timelines/public")
+        |> json_response_and_validate_schema(200)
+
+      assert [%{"id" => ^id}] = result
+    end
+
+    test "should not return local-only posts for users without read:statuses" do
+      user = insert(:user)
+      %{user: _reader, conn: conn} = oauth_access([])
+
+      {:ok, _activity} = CommonAPI.post(user, %{status: "#2hu #2HU", visibility: "local"})
+
+      result =
+        conn
+        |> get("/api/v1/timelines/public")
+        |> json_response_and_validate_schema(200)
+
+      assert [] = result
+    end
+
+    test "should not return local-only posts for anonymous users" do
+      user = insert(:user)
+
+      {:ok, _activity} = CommonAPI.post(user, %{status: "#2hu #2HU", visibility: "local"})
+
+      result =
+        build_conn()
+        |> get("/api/v1/timelines/public")
+        |> json_response_and_validate_schema(200)
+
+      assert [] = result
+    end
   end
 
   defp local_and_remote_activities do