Only persist a collection item's approval URI once it is verified (#38255)

spec/fabricators/collection_item_fabricator.rb

@@ -11,6 +11,5 @@ Fabricator(:unverified_remote_collection_item, from: :collection_item) do
   account      nil
   state        :pending
   object_uri   { Fabricate.build(:remote_account).uri }
-  approval_uri { sequence(:uri) { |i| "https://example.com/authorizations/#{i}" } }
   uri { sequence(:uri) { |i| "https://example.com/collection_items/#{i}" } }
 end

spec/services/activitypub/process_featured_item_service_spec.rb

@@ -52,7 +52,7 @@ RSpec.describe ActivityPub::ProcessFeaturedItemService do
 
       new_item = collection.collection_items.last
       expect(new_item.object_uri).to eq 'https://example.com/actor/1'
-      expect(new_item.approval_uri).to eq 'https://example.com/auth/1'
+      expect(new_item.approval_uri).to be_nil
     end
 
     context 'when an item exists for a local featured account' do
@@ -93,7 +93,7 @@ RSpec.describe ActivityPub::ProcessFeaturedItemService do
 
       new_item = collection.collection_items.last
       expect(new_item.object_uri).to eq 'https://example.com/actor/1'
-      expect(new_item.approval_uri).to eq 'https://example.com/auth/1'
+      expect(new_item.approval_uri).to be_nil
     end
   end
 end

spec/services/activitypub/verify_featured_item_service_spec.rb

@@ -12,14 +12,14 @@ RSpec.describe ActivityPub::VerifyFeaturedItemService do
               account: nil,
               state: :pending,
               uri: 'https://other.example.com/items/1',
-              object_uri: 'https://example.com/actor/1',
-              approval_uri: verification_json['id'])
+              object_uri: 'https://example.com/actor/1')
   end
+  let(:approval_uri) { 'https://example.com/auth/1' }
   let(:verification_json) do
     {
       '@context' => 'https://www.w3.org/ns/activitystreams',
       'type' => 'FeatureAuthorization',
-      'id' => 'https://example.com/auth/1',
+      'id' => approval_uri,
       'interactionTarget' => 'https://example.com/actor/1',
       'interactingObject' => collection.uri,
     }
@@ -41,12 +41,13 @@ RSpec.describe ActivityPub::VerifyFeaturedItemService do
       before { featured_account }
 
       it 'verifies and creates the item' do
-        subject.call(collection_item)
+        subject.call(collection_item, approval_uri)
 
         expect(verification_request).to have_been_requested
 
         expect(collection_item.account_id).to eq featured_account.id
         expect(collection_item).to be_accepted
+        expect(collection_item.approval_uri).to eq approval_uri
       end
     end
 
@@ -59,13 +60,14 @@ RSpec.describe ActivityPub::VerifyFeaturedItemService do
       end
 
       it 'fetches the actor and creates the item' do
-        subject.call(collection_item)
+        subject.call(collection_item, approval_uri)
 
         expect(stubbed_service).to have_received(:call)
         expect(verification_request).to have_been_requested
 
         expect(collection_item.account_id).to eq featured_account.id
         expect(collection_item).to be_accepted
+        expect(collection_item.approval_uri).to eq approval_uri
       end
     end
   end
@@ -77,7 +79,7 @@ RSpec.describe ActivityPub::VerifyFeaturedItemService do
     end
 
     it 'creates item without attached account and in proper state' do
-      subject.call(collection_item)
+      subject.call(collection_item, approval_uri)
 
       expect(collection_item.account_id).to be_nil
       expect(collection_item).to be_rejected

spec/workers/activitypub/verify_featured_item_worker_spec.rb

@@ -12,13 +12,13 @@ RSpec.describe ActivityPub::VerifyFeaturedItemWorker do
     before { stub_service }
 
     it 'sends the status to the service' do
-      worker.perform(collection_item.id)
+      worker.perform(collection_item.id, 'https://example.com/authorizations/1')
 
-      expect(service).to have_received(:call).with(collection_item)
+      expect(service).to have_received(:call).with(collection_item, 'https://example.com/authorizations/1')
     end
 
     it 'returns nil for non-existent record' do
-      result = worker.perform(123_123_123)
+      result = worker.perform(123_123_123, 'https://example.com/authorizations/1')
 
       expect(result).to be_nil
     end