From 4c29366fe503fb383544efc71a5f78f0602613cb Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Tue, 26 Dec 2023 15:54:14 -0500
Subject: [PATCH] Mark instances as unreachable when returning a 403 from an
 object fetch

This is a definite sign the instance is blocked and they are enforcing authorized_fetch
---
 lib/pleroma/object/fetcher.ex                |  9 +++++++++
 lib/pleroma/workers/remote_fetcher_worker.ex | 11 +++++++++++
 test/pleroma/object/fetcher_test.exs         | 14 ++++++++++++++
 3 files changed, 34 insertions(+)

diff --git a/lib/pleroma/object/fetcher.ex b/lib/pleroma/object/fetcher.ex
index c0be6dc49..dc13810c8 100644
--- a/lib/pleroma/object/fetcher.ex
+++ b/lib/pleroma/object/fetcher.ex
@@ -181,6 +181,15 @@ def fetch_object_from_id(id, options \\ []) do
       {:fetch_object, %Object{} = object} ->
         {:ok, object}
 
+      {:fetch, {:error, {:ok, %Tesla.Env{status: 403}}}} ->
+        Instances.set_consistently_unreachable(id)
+
+        Logger.error(
+          "Error while fetching #{id}: HTTP 403 likely due to instance block rejecting the signed fetch."
+        )
+
+        {:error, "Object fetch has been denied"}
+
       {:fetch, {:error, error}} ->
         Logger.error("Error while fetching #{id}: #{inspect(error)}")
         {:error, error}
diff --git a/lib/pleroma/workers/remote_fetcher_worker.ex b/lib/pleroma/workers/remote_fetcher_worker.ex
index ad4d785a1..80d34e303 100644
--- a/lib/pleroma/workers/remote_fetcher_worker.ex
+++ b/lib/pleroma/workers/remote_fetcher_worker.ex
@@ -10,5 +10,16 @@ defmodule Pleroma.Workers.RemoteFetcherWorker do
   @impl Oban.Worker
   def perform(%Job{args: %{"op" => "fetch_remote", "id" => id} = args}) do
     {:ok, _object} = Fetcher.fetch_object_from_id(id, depth: args["depth"])
+
+    case Fetcher.fetch_object_from_id(id, depth: args["depth"]) do
+      {:ok, _object} ->
+        :ok
+
+      {:error, reason = "Object fetch has been denied"} ->
+        {:cancel, reason}
+
+      _ ->
+        :error
+    end
   end
 end
diff --git a/test/pleroma/object/fetcher_test.exs b/test/pleroma/object/fetcher_test.exs
index 4c4831af3..fa6259ff4 100644
--- a/test/pleroma/object/fetcher_test.exs
+++ b/test/pleroma/object/fetcher_test.exs
@@ -57,6 +57,8 @@ defp spoofed_object_with_ids(
           body: spoofed_object_with_ids("https://patch.cx/objects/spoof_content_type")
         }
 
+      %{method: :get, url: "https://octodon.social/users/cwebber/statuses/111647596861000656"} ->
+        %Tesla.Env{status: 403}
       # Spoof: mismatching ids
       # Variant 1: Non-exisitng fake id
       %{
@@ -417,6 +419,18 @@ test "handle HTTP 404 response" do
                )
     end
 
+    test "handle HTTP 403 response" do
+      object_id = "https://octodon.social/users/cwebber/statuses/111647596861000656"
+      Instances.set_reachable(object_id)
+
+      assert Instances.reachable?(object_id)
+
+      assert {:error, "Object fetch has been denied"} ==
+               Fetcher.fetch_object_from_id(object_id)
+
+      refute Instances.reachable?(object_id)
+    end
+
     test "it can fetch pleroma polls with attachments" do
       {:ok, object} =
         Fetcher.fetch_object_from_id("https://patch.cx/objects/tesla_mock/poll_attachment")