Summary

When Fedify tries to deduplicate inbox POSTs, it's accidentally deduplicating across all inboxes, not just for a given inbox. This means that if the sender tries to send the same activity to multiple individual inboxes on the one fedify server, only a single one of those activities succeeds in delivery. The rest are rejected as having already been received.

The cache key currently is global based on the origin and activity @id, but the inbox that the activity was posted to is not considered.

So for example:

// activity.json
{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "Create",
  "id": "https://example.com/create",
  "actor": "https://example.com/person"
}

$ curl -X POST -H 'accept: application/ld+json' -d @activity.json https://example.social/users/jane/inbox

$ curl -X POST -H 'accept: application/ld+json' -d @activity.json https://example.social/users/fred/inbox

Only jane will receive the activity, fred will not, because to Fedify, it appears as though the activity sent to fred was already processed.

Expected Behavior

Both inboxes should receive and process the activity independently.

Actual Behavior

Only one inbox receives and processes the activity, the other does not.

Environment

As far as I can tell, this isn't environment specific.

Logs / Screenshots

n/a

Steps to Reproduce

Given above.