From ed0c28b6a25c968acd584e7f840ed4d51003486e Mon Sep 17 00:00:00 2001
From: Ted Unangst <tedu@tedunangst.com>
Date: Mon, 3 Jun 2019 03:20:03 -0400
Subject: [PATCH] dig into actor url to verify id

---
 activity.go     | 24 ++++++++++++++++++++++++
 docs/manual.txt |  3 +--
 honk.go         |  7 +------
 3 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/activity.go b/activity.go
index 0e69923..8187b5e 100644
--- a/activity.go
+++ b/activity.go
@@ -929,3 +929,27 @@ func gofish(name string) string {
 	handlock.Unlock()
 	return ""
 }
+
+func investigate(name string) string {
+	if name == "" {
+		return ""
+	}
+	if name[0] == '@' {
+		name = gofish(name)
+	}
+	if name == "" {
+		return ""
+	}
+	obj, err := GetJunk(name)
+	if err != nil {
+		log.Printf("error investigating honker: %s", err)
+		return ""
+	}
+	t, _ := jsongetstring(obj, "type")
+	id, _ := jsongetstring(obj, "id")
+	if t != "Person" {
+		log.Printf("it's not a person! %s", name)
+		return ""
+	}
+	return id
+}
diff --git a/docs/manual.txt b/docs/manual.txt
index 0b201fa..2fcb65f 100644
--- a/docs/manual.txt
+++ b/docs/manual.txt
@@ -20,8 +20,7 @@ The easiest is probably their handle, the thing that resembles an email.
 @name@example.com for example.
 
 Alternatively, one may directly enter the actor ID, which is a URL that looks
-like https://example.com/users/name. Note that the commonly seen URL with
-@name in it is not their actor ID and won't work.
+like https://example.com/users/name.
 
 Followed honkers may be assigned to combos, listing all their honks together.
 
diff --git a/honk.go b/honk.go
index 8ebeb89..46a015a 100644
--- a/honk.go
+++ b/honk.go
@@ -1036,12 +1036,7 @@ func savehonker(w http.ResponseWriter, r *http.Request) {
 	if peep == "peep" {
 		flavor = "peep"
 	}
-	if url == "" {
-		return
-	}
-	if url[0] == '@' {
-		url = gofish(url)
-	}
+	url = investigate(url)
 	if url == "" {
 		return
 	}