Use ID instead of username in ActivityPub API

[trwnh]

Feature Description

In #19133 a basic ActivityPub API was added to the router, allowing lookup of an actor document and POSTing to inbox. However, the API as present in Swagger currently depends on the username, which means that username changes are not possible without causing breakages in federation. This should be fixed before federation is ready. Further rationale is included in #19133 (comment) and quoted below for convenience:

You can avoid having to issue a Move if you just don't use the username in any ids. Move should be reserved for moving to different domains, not changing usernames. It's completely unnecessary and completely avoidable for local username changes. I heavily recommend using something like snowflake, hash, uuid, etc instead of plain usernames. You want the ActivityPub id to be as stable as possible and ideally never change.

Screenshots

Relevant code:

gitea/routers/api/v1/activitypub/person.go

Lines 20 to 36 in 3e8db31

	func Person(ctx *context.APIContext) {
	// swagger:operation GET /activitypub/user/{username} activitypub activitypubPerson
	// ---
	// summary: Returns the Person actor for a user
	// produces:
	// - application/json
	// parameters:
	// - name: username
	// in: path
	// description: username of the user
	// type: string
	// required: true
	// responses:
	// "200":
	// "$ref": "#/responses/ActivityPub"
	link := strings.TrimSuffix(setting.AppURL, "/") + "/api/v1/activitypub/user/" + ctx.ContextUser.Name

I believe this should be ctx.ContextUser.ID or something similar.

[lunny]

But wouldn't the id be changed in a different system?

[trwnh]

No, the ActivityPub id is an HTTPS URI that should remain constant. For example, if we have something like https://example.com/userid then the username is free to change without breaking the id. But if we make the id something like https://example.com/username then a change from username to different_username will be seen as a completely different actor. All old comments, repos, etc. will no longer be linked, and all followers will have to be migrated to the "new" account.

@trwnh Thanks for the reminder. I'll implement this soon in forgejo-federation.