@benpate Let's assume that my client is a music player. It publishes a Listen activity where object is an Audio. This activity should increase playCount on the Audio object.

One way to support this on the server side is to teach it about Listen, Audio and how to update playCount. This is how most existing servers are built.

But a server described in my FEP would work differently:

- It doesn't know anything about Listen, Audio or playCount.
- Upon receiving Listen, it will recognize it as an activity, and embedded Audio as an object.
- Since this is not a CRUD operation, it will not check permissions.
- If Listen activity has a result property, the server will process that activity as well.
- If result is an Update activity, the server will recognize it as a CRUD operation and will check permissions: Update.actor and Audio.attributedTo must be the same.
- The server will save both activities, Listen and Update.
- Then it will deliver them to intended recipients (to and cc).

Effects are client's responsibility now, it must provide an Update activity if it wants to update playCount. There are other requirements too, for example all objects should have an attributedTo property, which is needed for permission checks.

But in this setup a single server can work with any kind of client.

@mariusor @trwnh

@benpate @silverpill @mariusor none of the IDs should have any semantics; from the outside, there is no distinction between a client managed or server managed collection. likes/shares/etc could be managed by a "client" like mastodon, or even a "default" one. it's not any more complex unless you want to vary the collection responses based on the request headers. for that you need a minimal dynamic layer with an access control policy of some sort. (WAC is the simplest, but ACP is more powerful)

@julian It looks simple on the surface, but in reality it is much more complicated than a non-generic server. In addition to activity transfer, generic server needs to maintain collections. First of all, a followers collection, which is often used as a delivery target. Then likes, shares etc. It needs to enforce permissions, to prevent actors on the same server from deleting each other posts.

This is doable if you only care about activities defined in ActivityPub. But then you want to introduce context collection. And then 50 other extensions. How to do that without special-casing every one of them?

This is where duck typing (FEP-2277) and unified security model (FEP-fe34) become really handy. No matter what the client sends, you can figure out what it is (an object, an actor, or a collection), and enforce permissions.

@julian It looks simple on the surface, but in reality it is much more complicated than a non-generic server. In addition to activity transfer, generic server needs to maintain collections. First of all, a followers collection, which is often used as a delivery target. Then likes, shares etc. It needs to enforce permissions, to prevent actors on the same server from deleting each other posts.

This is doable if you only care about activities defined in ActivityPub. But then you want to introduce context collection. And then 50 other extensions. How to do that without special-casing every one of them?

This is where duck typing (FEP-2277) and unified security model (FEP-fe34) become really handy. No matter what the client sends, you can figure out what it is (an object, an actor, or a collection), and enforce permissions.

@mariusor Mastodon supports all standard activities and has a wide variety of clients. I don't find softwares with similar capabilities impressive, although I respect your work (the only ActivityPub server-client project that is not a vaporware).

I doubt that language choice makes much difference, and Rust is not a dynamically typed language anyway. The difficulty you might be facing is likely due to JSON-LD.

The thanks was for your input with regards to collection management.