Missing Follow.@id check when processing Undo.Follow

[Tamschi]

Technically this is a bit of a protocol violation in Bridgy Fed. It's supposed to persist the @id of the [most recent, at least] Follow and then check against that when Undoing it. However, Mastodon seemingly also doesn't do this properly when the object is inlined.

Originally posted by @Tamschi in #1626 (comment)

Mastodon correctly uses unique Follow-IDs and includes them with the Undo, so Bridgy Fed can and should check for those:

{
  "@context":"https://www.w3.org/ns/activitystreams",
  "id":"https://activitypub.academy/40c15d58-2d4b-4842-9342-7fb5e231831d",
  "type":"Follow",
  "actor":"https://activitypub.academy/users/aubotus_grahess",
  "object":"https://mastodon.gamedev.place/users/Tamschi"
}

{
  "@context":"https://www.w3.org/ns/activitystreams",
  "id":"https://activitypub.academy/users/aubotus_grahess#follows/4360/undo",
  "type":"Undo",
  "actor":"https://activitypub.academy/users/aubotus_grahess",
  "object":{
    "id":"https://activitypub.academy/40c15d58-2d4b-4842-9342-7fb5e231831d",
    "type":"Follow",
    "actor":"https://activitypub.academy/users/aubotus_grahess",
    "object":"https://mastodon.gamedev.place/users/Tamschi"
  }
}

{
  "@context":"https://www.w3.org/ns/activitystreams",
  "id":"https://activitypub.academy/16dd2fcf-2851-422b-92f4-5c209f01bde3",
  "type":"Follow",
  "actor":"https://activitypub.academy/users/aubotus_grahess",
  "object":"https://mastodon.gamedev.place/users/Tamschi"
}

{
  "@context":"https://www.w3.org/ns/activitystreams",
  "id":"https://activitypub.academy/users/aubotus_grahess#follows/4361/undo",
  "type":"Undo",
  "actor":"https://activitypub.academy/users/aubotus_grahess",
  "object":{
    "id":"https://activitypub.academy/16dd2fcf-2851-422b-92f4-5c209f01bde3",
    "type":"Follow",
    "actor":"https://activitypub.academy/users/aubotus_grahess",
    "object":"https://mastodon.gamedev.place/users/Tamschi"
  }
}

If it doesn't, this can cause follower set desyncs of local users as in #1626, since neither Mastodon's outbox nor Bridgy Fed's inbox processing are reliably ordered at least per remote instance. (Both would have to be reliably ordered to skip this check.)

[Tamschi]

I think a good solution here would be to persist the most recent unwrapped Follow's id. (When another arrives, overwrite.)
Then, when an Undo.Follow arrives, only process it if the Undo.Follow.id matches the persisted one.

(I haven't checked if this applies to other activities, but I would assume anything that flips a binary state or relation may be affected to an extent.)

[snarfed]

Great point! This only works for Undos of activities with ids, not transient activities without them, but most activities do have ids. And we already store the most recent Follow per follower, so this should be straightforward. Thanks for filing.