user can bypass capacity if using Mastodon bridge

[alifeee]

if you create an event with a maximum capacity of 4, you cannot click "Add Me". This makes sense.

if you follow the event on https://mastodon.social/, and reply to this poll…

…you are added to the list of event attendees even if the event is at capacity

this does not seem intended.

thank you all for this great software :]

[alifeee]

the code to send this message is here

gathio/src/activitypub.js

Lines 731 to 798 in 2d7507a

	// if users can self-RSVP, send a Question to the new follower
	if (event.usersCanAttend) {
	const jsonObject = {
	"@context":
	"https://www.w3.org/ns/activitystreams",
	name: `RSVP to ${event.name}`,
	type: "Question",
	content: `<span class=\"h-card\"><a href="${req.body.actor}" class="u-url mention">@<span>${name}</span></a></span> Will you attend ${event.name}?`,
	oneOf: [
	{
	type: "Note",
	name: "Yes, and show me in the public list",
	"replies": { "type": "Collection", "totalItems": 0 }
	},
	{
	type: "Note",
	name: "Yes, but hide me from the public list",
	"replies": { "type": "Collection", "totalItems": 0 }
	},
	{
	type: "Note",
	name: "No",
	"replies": { "type": "Collection", "totalItems": 0 }
	},
	],
	endTime:
	event.start.toISOString(),
	tag: [
	{
	type: "Mention",
	href: req.body
	.actor,
	name: name,
	},
	],
	};
	// send direct message to user
	sendDirectMessage(
	jsonObject,
	req.body.actor,
	eventID,
	function (
	error,
	response,
	statuscode,
	) {
	if (error) {
	console.log(
	"Error sending direct message:",
	error,
	);
	return res
	.status(
	statuscode,
	)
	.json(error);
	} else {
	return res
	.status(
	statuscode,
	)
	.json({
	messageid:
	response,
	});
	}
	},
	);

the code to add the user to the event is here

gathio/src/activitypub.js

Lines 900 to 984 in 2d7507a

	if (message) {
	// it's a match
	request(
	{
	url: actor,
	headers: {
	Accept: activityPubContentType,
	"Content-Type": activityPubContentType,
	},
	},
	function (error, response, body) {
	body = JSON.parse(body);
	// if this account is NOT already in our attendees list, add it
	if (
	!event.attendees.map((el) => el.id).includes(actor)
	) {
	const attendeeName =
	body.preferredUsername || body.name || actor;
	const newAttendee = {
	name: attendeeName,
	status: "attending",
	id: actor,
	number: 1,
	};
	event.attendees.push(newAttendee);
	event
	.save()
	.then((fullEvent) => {
	addToLog(
	"addEventAttendee",
	"success",
	"Attendee added to event " +
	req.params.eventID,
	);
	// get the new attendee with its hidden id from the full event
	let fullAttendee = fullEvent.attendees.find(
	(el) => el.id === actor,
	);
	// send a "click here to remove yourself" link back to the user as a DM
	const jsonObject = {
	"@context":
	"https://www.w3.org/ns/activitystreams",
	name: `RSVP to ${event.name}`,
	type: "Note",
	content: `<span class=\"h-card\"><a href="${newAttendee.id}" class="u-url mention">@<span>${newAttendee.name}</span></a></span> Thanks for RSVPing! You can remove yourself from the RSVP list by clicking here: <a href="https://${domain}/oneclickunattendevent/${event.id}/${fullAttendee._id}">https://${domain}/oneclickunattendevent/${event.id}/${fullAttendee._id}</a>`,
	tag: [
	{
	type: "Mention",
	href: newAttendee.id,
	name: newAttendee.name,
	},
	],
	};
	// send direct message to user
	sendDirectMessage(
	jsonObject,
	newAttendee.id,
	event.id,
	);
	return res.sendStatus(200);
	})
	.catch((err) => {
	addToLog(
	"addEventAttendee",
	"error",
	"Attempt to add attendee to event " +
	req.params.eventID +
	" failed with error: " +
	err,
	);
	return res
	.status(500)
	.send(
	"Database error, please try again :(",
	);
	});
	} else {
	// it's a duplicate and this person is already rsvped so just say OK
	return res
	.status(200)
	.send("Attendee is already registered.");
	}
	},
	);
	}

the latter should be modified to reject the user if the event is full

[alifeee]

this line should have a conditional statement

gathio/src/activitypub.js

Line 924 in 2d7507a

event.attendees.push(newAttendee);

[lowercasename]

Thank you for the detective work! Your fix should work, I'm just worried about the UX - if I click 'yes, please add me', and then the request silently fails because the event is at capacity, I may come away confused/assume I've been added when I haven't been. I think the instance should at that point send another Mastodon message saying "Unfortunately we couldn't add you to the event because it's at capacity."

[dev-nicolaos]

From a UX standpoint, wouldn't it be best to not give people the option to add themselves in the first place if the event is at capacity?

[lowercasename]

The issue is the following flow:

• I follow an event via Mastodon
• I get a 'will you attend?' poll
• I wait a day, during which time more people sign up for the event. The event is now at capacity.
• I finally click 'yes' on the poll.

We could try deleting the poll message once the event is at capacity, but deleting AP messages is imperfect, and what if the event once again goes below capacity? Do we send another poll?

[alifeee]

this is what I think too - it seems simplest to me to send the poll regardless, and the same as you'd reply…

"Thanks for RSVPing! ..."

…you instead reply something like…

"Sorry! The event is now full. Check the numbers on [link] and subscribe to updates on [link]" (perhaps the 2nd is not possible but you get the gist)

[alifeee]

there is also this TypeScript code that looks to do the same thing

gathio/src/lib/activitypub.ts

Lines 165 to 184 in 2328376

	// send a "click here to remove yourself" link back to the user as a DM
	const jsonObject = {
	"@context": "https://www.w3.org/ns/activitystreams",
	name: `RSVP to ${event.name}`,
	type: "Note",
	content: successfulRSVPResponse({
	event,
	newAttendee,
	fullAttendee,
	}),
	tag: [
	{
	type: "Mention",
	href: newAttendee.id,
	name: newAttendee.name,
	},
	],
	};
	// send direct message to user
	sendDirectMessage(jsonObject, newAttendee.id, event.id);

and in-fact, I believe is what sends the message. The JS is old code

[alifeee]

I had a hack at this but using Mastodon takes quite a while for each test. Got to a point where I created a branching path if the event was full, but no message was sent. Perhaps a badly formed request.

[alifeee]

hm... perhaps I could have a hack at creating a Cypress test...