From 531e755f7db7ea321f50f6f577ece7b706935c91 Mon Sep 17 00:00:00 2001
From: bashrc <bob@libreserver.org>
Date: Mon, 20 Jul 2026 11:47:26 +0100
Subject: [PATCH] Revoking granted feature authorizations

---
 src/collections.py            |  5 ++++-
 src/daemon_get_collections.py |  2 +-
 src/inbox_receive.py          | 42 +++++++++++++----------------------
 3 files changed, 20 insertions(+), 29 deletions(-)

diff --git a/src/collections.py b/src/collections.py
index 914f87e78..5af05aaea 100644
--- a/src/collections.py
+++ b/src/collections.py
@@ -299,10 +299,13 @@ def store_feature_authorization(base_dir: str, nickname: str, domain: str,
     accounts_dir: str = acct_dir(base_dir, nickname, domain)
     if not is_a_dir(accounts_dir + '/stamps'):
         makedir(accounts_dir + '/stamps')
+    if not is_a_dir(accounts_dir + '/stamps/granted'):
+        makedir(accounts_dir + '/stamps/granted')
     stamp_number = featured_item['featureAuthorization'].split('/stamps/')[1]
     if '/' in stamp_number:
         stamp_number = stamp_number.split('/')[0]
-    feature_authorization_filename = accounts_dir + '/stamps/' + stamp_number
+    feature_authorization_filename = \
+        accounts_dir + '/stamps/granted/' + stamp_number
     if not is_a_file(feature_authorization_filename):
         return False
     return save_json(featured_item, feature_authorization_filename)
diff --git a/src/daemon_get_collections.py b/src/daemon_get_collections.py
index cfafb1794..49c0d55a9 100644
--- a/src/daemon_get_collections.py
+++ b/src/daemon_get_collections.py
@@ -44,7 +44,7 @@ def get_feature_authorization(self, calling_domain: str,
         return
     # does the stamp exist?
     account_dir = acct_dir(base_dir, nickname, domain)
-    stamp_filename = account_dir + '/stamps/' + stamp_number
+    stamp_filename = account_dir + '/stamps/granted/' + stamp_number
     if not is_a_file(stamp_filename):
         return
     # load the stamp from file
diff --git a/src/inbox_receive.py b/src/inbox_receive.py
index ff6d85aa0..b8c3527b2 100644
--- a/src/inbox_receive.py
+++ b/src/inbox_receive.py
@@ -1941,37 +1941,27 @@ def _receive_delete_feature_authorization(handle: str, base_dir: str,
         return False
     if http_prefix + '://' + domain not in message_json['object']['id']:
         return False
-    if '/stamps/' not in message_json['object']['id']:
-        return False
-    stamp_number = message_json['object']['id'].split('/stamps/')[1]
-    if '/' in stamp_number:
-        stamp_number = stamp_number.split('/')[0]
-    if not stamp_number.isdigit():
-        return False
     handle_nickname = handle.split('@')[0]
     handle_domain = handle.split('@')[1]
     account_dir = acct_dir(base_dir, handle_nickname, handle_domain)
-    stamp_filename = account_dir + '/stamps/' + stamp_number
-    if not is_a_file(stamp_filename):
-        return False
-    stamp_json = load_json(stamp_filename)
-    if not stamp_json:
-        return False
     # the featured url is typically an actor
-    featured_url = stamp_json['object']
-    if featured_url != message_json['object']['interactionTarget']:
-        return False
-    if erase_file(stamp_filename,
-                  "EX: unable to remove feature authorization " +
-                  stamp_filename):
-        if debug:
-            print('Revoked feature authorization ' + stamp_filename)
+    featured_url = message_json['object']['interactionTarget']
+    granted_filename = \
+        account_dir + '/stamps/granted/' + featured_url.replace('/', '#')
+    if is_a_file(granted_filename):
+        if erase_file(granted_filename,
+                      "EX: unable to remove feature authorization " +
+                      granted_filename):
+            if debug:
+                print('Revoked feature authorization ' + granted_filename)
     # remove link from featured collections
     collection_filename: str = account_dir + '/featured_collections.txt'
-    collections_text = load_string(collection_filename,
-                                   'EX: unable to load ' +
-                                   'featured_collections.txt of ' +
-                                   handle_nickname)
+    collections_text = ''
+    if text_in_file(featured_url, collection_filename, True):
+        collections_text = load_string(collection_filename,
+                                       'EX: unable to load ' +
+                                       'featured_collections.txt of ' +
+                                       handle_nickname)
     if collections_text:
         if not collections_text.endswith('\n'):
             collections_text += '\n'
@@ -1997,8 +1987,6 @@ def _receive_delete_feature_authorization(handle: str, base_dir: str,
             if debug:
                 print('Unauthorized link removed from featured collections ' +
                       featured_url + ' ' + collection_filename)
-    if debug:
-        print('feature authorization stamp removed ' + stamp_filename)
     return True