From 91c8bd00d6c04560c4ef628dc7a611759ca7b2c4 Mon Sep 17 00:00:00 2001 From: Claire Date: Tue, 14 Apr 2026 15:37:41 +0200 Subject: [PATCH] Harden account processing code --- app/services/activitypub/process_account_service.rb | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/app/services/activitypub/process_account_service.rb b/app/services/activitypub/process_account_service.rb index be71b0b6458..9c52f5c04ce 100644 --- a/app/services/activitypub/process_account_service.rb +++ b/app/services/activitypub/process_account_service.rb @@ -28,8 +28,15 @@ class ActivityPub::ProcessAccountService < BaseService @options[:request_id] ||= "#{Time.now.utc.to_i}-#{username}@#{domain}" with_redis_lock("process_account:#{@uri}") do - @account = Account.remote.find_by(uri: @uri) if @options[:only_key] - @account ||= Account.find_remote(@username, @domain) + if @options[:only_key] + # `only_key` is used to update an existing account known by its `uri`. + # Lookup by handle and new account creation do not make sense in this case. + @account = Account.remote.find_by(uri: @uri) + return if @account.nil? + else + @account = Account.find_remote(@username, @domain) + end + @old_public_key = @account&.public_key @old_protocol = @account&.protocol @suspension_changed = false