Repository: LemmyNet/lemmy (language: rust)

Issue:
[Bug]: fetching outbox of a community fails if it only allow mod posts
### Requirements

- [x] Is this a bug report? For questions or discussions use https://lemmy.ml/c/lemmy_support
- [x] Did you check to see if this issue already exists?
- [x] Is this only a single bug? Do not put multiple bugs in one issue.
- [x] Do you agree to follow the rules in our [Code of Conduct](https://join-lemmy.org/docs/code_of_conduct.html)?
- [x] Is this a backend issue? Use the [lemmy-ui](https://github.com/LemmyNet/lemmy-ui) repo for UI / frontend issues.

### Summary

> It looks like they [Lemmy] got the community details - and know that posting is restricted to the mod, but they didn’t fetch who the mod is. This meant that posts in the outbox were rejected, and all subsequent activity (that would normally cause them to resolve the missing posts) is being rejected too.

I guess one solution would be to trust the outbox and don't decline the posts coming from it? Especially makes sense if the community was marked as mod-posts-only AFTER the posts were already made.

### Steps to Reproduce

1. go to `!piefed_2025@piefed.social`
2. see no posts


### Technical Details

https://piefed.social/comment/4268050 aka https://programming.dev/post/23909870/14310406

### Version

0.19.5

### Lemmy Instance URL

https://programming.dev/c/piefed_2025@piefed.social


Discussion / hints:
I fixed this a while ago in https://github.com/LemmyNet/lemmy/pull/5169. Anyway thanks for reporting!
"Fetch community mods synchronously"

"Need to fetch mods synchronously, otherwise fetching a post in community with posting_restricted_to_mods can fail if mods havent been fetched yet."

what if a user makes a post before the community is posting_restricted_to_mods? the user's post should still be there unless it is explicitly deleted, but it sounds like a new fetch will reject the user's post so it won't be shown?

shouldn't the home instance be the source of truth anyways, so the outbox should always be correct and trusted?

Fix patch:
diff --git a/crates/apub/src/objects/community.rs b/crates/apub/src/objects/community.rs
index 6896419101..25ff7a91fb 100644
--- a/crates/apub/src/objects/community.rs
+++ b/crates/apub/src/objects/community.rs
@@ -193,16 +193,10 @@ impl Object for ApubCommunity {
       LanguageTag::to_language_id_multiple(group.language, &mut context.pool()).await?;
 
     let timestamp = group.updated.or(group.published).unwrap_or_else(Utc::now);
-    let community: ApubCommunity = Community::insert_apub(&mut context.pool(), timestamp, &form)
-      .await?
-      .into();
+    let community = Community::insert_apub(&mut context.pool(), timestamp, &form).await?;
     CommunityLanguage::update(&mut context.pool(), languages, community.id).await?;
 
-    // Need to fetch mods synchronously, otherwise fetching a post in community with
-    // `posting_restricted_to_mods` can fail if mods havent been fetched yet.
-    if let Some(moderators) = group.attributed_to {
-      moderators.dereference(&community, context).await.ok();
-    }
+    let community: ApubCommunity = community.into();
 
     // These collections are not necessary for Lemmy to work, so ignore errors.
     let community_ = community.clone();
@@ -215,6 +209,9 @@ impl Object for ApubCommunity {
       if let Some(featured) = group.featured {
         featured.dereference(&community_, &context_).await.ok();
       }
+      if let Some(moderators) = group.attributed_to {
+        moderators.dereference(&community_, &context_).await.ok();
+      }
       Ok(())
     });
 
diff --git a/crates/apub/src/objects/post.rs b/crates/apub/src/objects/post.rs
index 64effbe6a6..73d937ad56 100644
--- a/crates/apub/src/objects/post.rs
+++ b/crates/apub/src/objects/post.rs
@@ -177,7 +177,11 @@ impl Object for ApubPost {
   async fn from_json(page: Page, context: &Data<Self::DataType>) -> LemmyResult<ApubPost> {
     let creator = page.creator()?.dereference(context).await?;
     let community = page.community(context).await?;
-    if community.posting_restricted_to_mods {
+
+    // Prevent posts from non-mod users in local, restricted community. If its a remote community
+    // then its possible that the restricted setting was enabled recently, so existing user posts
+    // should still be fetched.
+    if community.local && community.posting_restricted_to_mods {
       CommunityModeratorView::check_is_community_moderator(
         &mut context.pool(),
         community.id,


Test patch: