Close the adversarial review round: auth hardening, data fidelity against the platform context, backend grants and docker coherence

backend/services/registration.service.js

@@ -8,6 +8,29 @@ module.exports = {
   async started() {
     this.logger.info('Registration watcher subscribed');
   },
+  methods: {
+    /**
+     * The Event's `apods:attendees` collection is attached asynchronously by
+     * PodCollectionsHandlerMixin on create, so a Join/Leave processed in that window sees no
+     * collection. Returning immediately would drop the activity forever (the client overlay
+     * shows joined, nothing reconciles). Re-fetch the Event a bounded number of times until the
+     * collection appears; only then give up.
+     */
+    async fetchAttendeesCollectionUri(ctx, event, actorUri) {
+      if (event['apods:attendees'] || !event.id) return event['apods:attendees'];
+
+      for (let attempt = 0; attempt < 3; attempt++) {
+        await new Promise(resolve => setTimeout(resolve, 500));
+        try {
+          const { ok, body } = await ctx.call('pod-resources.get', { resourceUri: event.id, actorUri });
+          if (ok && body && body['apods:attendees']) return body['apods:attendees'];
+        } catch (e) {
+          this.logger.warn(`Could not re-fetch ${event.id} while waiting for its attendees collection: ${e.message}`);
+        }
+      }
+      return undefined;
+    }
+  },
   activities: {
     join: {
       match: {
@@ -36,7 +59,7 @@ module.exports = {
       },
       async onReceive(ctx, activity, actorUri) {
         const event = activity.object;
-        const attendeesCollectionUri = event['apods:attendees'];
+        const attendeesCollectionUri = await this.fetchAttendeesCollectionUri(ctx, event, actorUri);
 
         if (!attendeesCollectionUri) {
           this.logger.warn(`No attendees collection on ${event.id}, skipping Join`);
@@ -69,7 +92,7 @@ module.exports = {
       },
       async onReceive(ctx, activity, actorUri) {
         const event = activity.object;
-        const attendeesCollectionUri = event['apods:attendees'];
+        const attendeesCollectionUri = await this.fetchAttendeesCollectionUri(ctx, event, actorUri);
 
         if (!attendeesCollectionUri) {
           this.logger.warn(`No attendees collection on ${event.id}, skipping Leave`);