From f3567797bf198fe3d570734a778f5aed0dd293ae Mon Sep 17 00:00:00 2001
From: Claire <claire.github-309c@sitedethib.com>
Date: Wed, 22 Jul 2026 16:29:39 +0200
Subject: [PATCH] Fix `ActivityPub::Activity::Create` trying to re-create known
 statuses when author changes (#39916)

---
 app/lib/activitypub/activity/create.rb       |  5 +++-
 spec/lib/activitypub/activity/create_spec.rb | 26 +++++++++++++++++++-
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/app/lib/activitypub/activity/create.rb b/app/lib/activitypub/activity/create.rb
index d543a967667..0da526aa251 100644
--- a/app/lib/activitypub/activity/create.rb
+++ b/app/lib/activitypub/activity/create.rb
@@ -33,6 +33,9 @@ class ActivityPub::Activity::Create < ActivityPub::Activity
 
       if @status.nil?
         process_status
+      elsif @status.account_id != @account.id
+        Rails.logger.debug { "Not processing #{object_uri}: authorship change is not supported" }
+        return reject_payload!
       elsif @options[:delivered_to_account_id].present?
         postprocess_audience_and_deliver
       end
@@ -84,7 +87,7 @@ class ActivityPub::Activity::Create < ActivityPub::Activity
   def find_existing_status
     status   = status_from_uri(object_uri)
     status ||= Status.find_by(uri: @object['atomUri']) if @object['atomUri'].present?
-    status if status&.account_id == @account.id
+    status
   end
 
   def process_status_params
diff --git a/spec/lib/activitypub/activity/create_spec.rb b/spec/lib/activitypub/activity/create_spec.rb
index df4eca5f336..0fc789037cd 100644
--- a/spec/lib/activitypub/activity/create_spec.rb
+++ b/spec/lib/activitypub/activity/create_spec.rb
@@ -448,6 +448,30 @@ RSpec.describe ActivityPub::Activity::Create do
         end
       end
 
+      context 'when the status is already known' do
+        let(:recipient) { Fabricate(:account) }
+
+        let(:object_json) do
+          build_object(
+            to: ActivityPub::TagManager.instance.uri_for(recipient)
+          )
+        end
+
+        let!(:status) { Fabricate(:status, uri: object_json[:id], account: sender, text: object_json[:content]) }
+
+        it 'keeps the status intact' do
+          expect(subject.perform).to eq status
+        end
+
+        context 'when the known status is attributed to a different actor' do
+          let(:status) { Fabricate(:status, uri: object_json[:id], account: Fabricate(:account, domain: 'example.com')) }
+
+          it 'returns nil' do
+            expect(subject.perform).to be_nil
+          end
+        end
+      end
+
       context 'when direct' do
         let(:recipient) { Fabricate(:account) }
 
@@ -1335,7 +1359,7 @@ RSpec.describe ActivityPub::Activity::Create do
 
     def build_object(options = {})
       {
-        id: [ActivityPub::TagManager.instance.uri_for(sender), '#bar'].join,
+        id: [ActivityPub::TagManager.instance.uri_for(sender), '/bar'].join,
         type: 'Note',
         content: 'Lorem ipsum',
       }.merge(options)