Handle quote comment deletion with Reject activity

includes/collection/class-inbox.php

@@ -83,6 +83,17 @@ public static function add( $activity, $recipients ) {
 		$title      = self::get_object_title( $activity->get_object() );
 		$visibility = is_activity_public( $activity ) ? ACTIVITYPUB_CONTENT_VISIBILITY_PUBLIC : ACTIVITYPUB_CONTENT_VISIBILITY_PRIVATE;
 
+		/*
+		 * For activities with an 'instrument' property (e.g., QuoteRequest), we store
+		 * the instrument URL as the object_id. This allows efficient querying by instrument.
+		 * For all other activities, we store the object URL as before.
+		 */
+		if ( $activity->has( 'instrument' ) && $activity->get_instrument() ) {
+			$object_id = object_to_uri( $activity->get_instrument() );
+		} else {
+			$object_id = object_to_uri( $activity->get_object() );
+		}
+
 		$inbox_item = array(
 			'post_type'    => self::POST_TYPE,
 			'post_title'   => sprintf(
@@ -96,7 +107,7 @@ public static function add( $activity, $recipients ) {
 			'post_status'  => 'publish',
 			'guid'         => $activity->get_id(),
 			'meta_input'   => array(
-				'_activitypub_object_id'             => object_to_uri( $activity->get_object() ),
+				'_activitypub_object_id'             => $object_id,
 				'_activitypub_activity_type'         => $activity->get_type(),
 				'_activitypub_activity_remote_actor' => object_to_uri( $activity->get_actor() ),
 				'activitypub_content_visibility'     => $visibility,
@@ -369,6 +380,50 @@ public static function get_by_guid_and_recipient( $guid, $user_id ) {
 		return $post;
 	}
 
+	/**
+	 * Get an inbox item by activity type and object ID.
+	 *
+	 * This is useful for finding specific activity types (like QuoteRequest)
+	 * by their object identifier. For QuoteRequest activities, the object_id
+	 * is the instrument URL (the quote post).
+	 *
+	 * @param string $activity_type The activity type (e.g., 'QuoteRequest').
+	 * @param string $object_id     The object identifier to search for.
+	 *
+	 * @return \WP_Post|\WP_Error The inbox item or WP_Error if not found.
+	 */
+	public static function get_by_type_and_object( $activity_type, $object_id ) {
+		global $wpdb;
+
+		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
+		$post_id = $wpdb->get_var(
+			$wpdb->prepare(
+				"SELECT p.ID
+				FROM {$wpdb->posts} p
+				INNER JOIN {$wpdb->postmeta} pm1 ON p.ID = pm1.post_id AND pm1.meta_key = '_activitypub_activity_type'
+				INNER JOIN {$wpdb->postmeta} pm2 ON p.ID = pm2.post_id AND pm2.meta_key = '_activitypub_object_id'
+				WHERE p.post_type = %s
+				AND pm1.meta_value = %s
+				AND pm2.meta_value = %s
+				ORDER BY p.ID DESC
+				LIMIT 1",
+				self::POST_TYPE,
+				$activity_type,
+				$object_id
+			)
+		);
+
+		if ( ! $post_id ) {
+			return new \WP_Error(
+				'activitypub_inbox_item_not_found',
+				\__( 'Inbox item not found', 'activitypub' ),
+				array( 'status' => 404 )
+			);
+		}
+
+		return \get_post( $post_id );
+	}
+
 	/**
 	 * Deduplicate inbox items with the same GUID.
 	 *

includes/handler/class-quote-request.php

@@ -10,6 +10,7 @@
 use Activitypub\Activity\Activity;
 use Activitypub\Collection\Actors;
 use Activitypub\Collection\Followers;
+use Activitypub\Collection\Inbox;
 use Activitypub\Collection\Remote_Actors;
 
 use function Activitypub\add_to_outbox;
@@ -27,6 +28,7 @@ class Quote_Request {
 	public static function init() {
 		\add_action( 'activitypub_inbox_quote_request', array( self::class, 'handle_quote_request' ), 10, 2 );
 		\add_action( 'activitypub_rest_inbox_disallowed', array( self::class, 'handle_blocked_request' ), 10, 3 );
+		\add_action( 'delete_comment', array( self::class, 'handle_quote_delete' ), 10, 2 );
 
 		\add_filter( 'activitypub_validate_object', array( self::class, 'validate_object' ), 10, 3 );
 	}
@@ -100,6 +102,85 @@ public static function handle_blocked_request( $activity, $user_ids, $type ) {
 		self::queue_reject( $activity, $user_id );
 	}
 
+	/**
+	 * Handle deletion of a quote comment.
+	 *
+	 * When a local quote comment is deleted, send a Reject activity to revoke
+	 * the previously accepted QuoteRequest.
+	 *
+	 * @param int         $comment_id The comment ID being deleted.
+	 * @param \WP_Comment $comment    The comment object.
+	 */
+	public static function handle_quote_delete( $comment_id, $comment ) {
+		// Only handle quote comments.
+		if ( 'quote' !== $comment->comment_type ) {
+			return;
+		}
+
+		// Get the post being quoted.
+		$post_id = $comment->comment_post_ID;
+		if ( ! $post_id ) {
+			return;
+		}
+
+		// Get the instrument URL (the quote post URL) from comment meta.
+		$instrument_url = \get_comment_meta( $comment_id, 'source_url', true );
+		if ( ! $instrument_url ) {
+			$instrument_url = \get_comment_meta( $comment_id, 'source_id', true );
+		}
+
+		if ( ! $instrument_url ) {
+			return;
+		}
+
+		// Get the post author (who accepted the quote).
+		$post = \get_post( $post_id );
+		if ( ! $post || ! $post->post_author ) {
+			return;
+		}
+
+		/*
+		 * Try to retrieve the original QuoteRequest from the inbox.
+		 * For QuoteRequest activities, the inbox stores the instrument URL
+		 * in _activitypub_object_id, so we can query by that.
+		 */
+		$activity_object = null;
+		$inbox_item      = Inbox::get_by_type_and_object( 'QuoteRequest', $instrument_url );
+
+		if ( ! \is_wp_error( $inbox_item ) && $inbox_item instanceof \WP_Post ) {
+			$activity_object = \json_decode( $inbox_item->post_content, true );
+		}
+
+		// Fallback: If inbox item not found, reconstruct from available data.
+		if ( ! $activity_object ) {
+			// Log when fallback is used for monitoring/debugging.
+			\do_action( 'activitypub_quote_request_inbox_not_found', $instrument_url, $post_id );
+
+			$activity_object = array(
+				'type'       => 'QuoteRequest',
+				'actor'      => $comment->comment_author_url,
+				'object'     => \get_permalink( $post_id ),
+				'instrument' => $instrument_url,
+			);
+		}
+
+		// Remove from _activitypub_quoted_by meta.
+		\delete_post_meta( $post_id, '_activitypub_quoted_by', $instrument_url );
+
+		// Send Reject activity to revoke the quote permission.
+		self::queue_reject( $activity_object, $post->post_author );
+
+		/**
+		 * Fires after a quote comment has been deleted and Reject activity sent.
+		 *
+		 * @param int    $comment_id       The deleted comment ID.
+		 * @param int    $post_id          The post ID that was quoted.
+		 * @param string $instrument_url   The instrument URL (quote post).
+		 * @param array  $activity_object  The QuoteRequest activity that was rejected.
+		 */
+		\do_action( 'activitypub_quote_comment_deleted', $comment_id, $post_id, $instrument_url, $activity_object );
+	}
+
 	/**
 	 * Send an Accept activity in response to the QuoteRequest.
 	 *