From 008f377a370eab93909ebaf07d68c807f955349f Mon Sep 17 00:00:00 2001
From: David Roetzel <david@roetzel.de>
Date: Wed, 10 Jun 2026 17:54:50 +0200
Subject: [PATCH] Redirect if collection AP ID is requested as HTML (#39361)

---
 app/controllers/collections_controller.rb | 5 +++++
 spec/requests/collections_spec.rb         | 8 ++++++++
 2 files changed, 13 insertions(+)

diff --git a/app/controllers/collections_controller.rb b/app/controllers/collections_controller.rb
index fe737810d5..46f9badb89 100644
--- a/app/controllers/collections_controller.rb
+++ b/app/controllers/collections_controller.rb
@@ -10,6 +10,7 @@ class CollectionsController < ApplicationController
 
   before_action :require_account_signature!, only: :show, if: -> { request.format == :json && authorized_fetch_mode? }
   before_action :set_collection
+  before_action :redirect_to_canonical_url
 
   skip_around_action :set_locale, if: -> { request.format == :json }
   skip_before_action :require_functional!, only: :show, unless: :limited_federation_mode?
@@ -45,6 +46,10 @@ class CollectionsController < ApplicationController
     not_found
   end
 
+  def redirect_to_canonical_url
+    redirect_to collection_path(@collection) if request.format.html? && request.path.starts_with?('/ap/')
+  end
+
   def expiration_duration
     recently_updated = @collection.updated_at > 15.minutes.ago
     recently_updated ? 30.seconds : 5.minutes
diff --git a/spec/requests/collections_spec.rb b/spec/requests/collections_spec.rb
index 72622b5cab..91436f656f 100644
--- a/spec/requests/collections_spec.rb
+++ b/spec/requests/collections_spec.rb
@@ -29,6 +29,14 @@ RSpec.describe 'Collections' do
     let(:collection) { Fabricate(:collection) }
     let(:account) { collection.account }
 
+    context 'when requested as HTML' do
+      it 'redirects to canonical URL' do
+        get ap_account_collection_path(account.id, collection)
+
+        expect(response).to redirect_to(collection_path(collection))
+      end
+    end
+
     context 'when signed out' do
       context 'when account is permanently suspended' do
         before do