Add FEP-7aa9 consent endpoint for featured collections

[pfefferle]

Proposed changes:

Phase 1 of FEP-7aa9 (Featured Collections, also known as Mastodon Starter Packs). This PR implements the receive-side consent layer only. The plugin can now respond to incoming FeatureRequest activities from remote servers with Accept (issuing a verifiable FeatureAuthorization stamp) or Reject, governed by a new opt-in site policy.

Architecturally a near-mirror of the existing FEP-044f quote-request layer (Quote_Request, Quote_Authorization, activitypub_default_quote_policy), with three deliberate differences: actor-scoped storage instead of post-scoped, default me (deny) instead of anyone per the FEP "absence of policy = no consent" rule, and interactionPolicy.canFeature advertised on the actor rather than per-post.

• New inbox handler Activitypub\Handler\Feature_Request — auto-accepts/rejects per policy, emits an Accept with a result URL pointing to the stamp, or a Reject.
• New extended object Activitypub\Activity\Extended_Object\Feature_Authorization — the JSON-LD stamp document served when remote servers verify a featured item.
• New global option activitypub_default_feature_policy (anyone / followers / me, default me).
• New "Featured collection requests" dropdown on Settings → ActivityPub → Activities, sibling of the quote policy field.
• Actor-level interactionPolicy.canFeature on every User, Blog, and Application actor (single override on the shared Actor base class).
• Stamps live in _activitypub_featured_by user_meta. The umeta_id doubles as the stamp identifier; ownership enforced by cross-checking the row's user_id against the queried actor on dereference.
• Stamp URL pattern: ?actor=USER_ID&stamp=UMETA_ID. Resolved by an extension to Activitypub\Query::maybe_get_stamp() that handles the actor-scoped variant alongside the existing post-scoped quote stamps. Includes a guard in Router::template_redirect so stamp URLs are not 404'd by the actor-username lookup.

Out of scope (deferred):

• Manual approval / review queue — explicitly phase 2.
• Curating outgoing FeaturedCollections — separate, larger feature.
• Emitting Delete for FeatureAuthorization on revocation.
• Per-user override of the global policy.

Other information:

• Have you written new tests for your changes, if applicable?

27 new test cases / 87 assertions across Test_Feature_Authorization, Test_Feature_Request, Test_Interaction_Policy, Test_Query_Feature_Stamp, plus router-guard and end-to-end coverage in Test_Router and Test_Query_Feature_Stamp::test_stamp_url_routes_and_resolves_end_to_end.

Testing instructions:

1. On a clean wp-env, go to Settings → ActivityPub → Activities.
2. Confirm the new Featured collection requests dropdown appears below Default quote policy, defaulted to No one.
3. Fetch your actor JSON, e.g. curl -H 'Accept: application/activity+json' https://example.com/?author=1. Confirm the response includes:

   "interactionPolicy": {
       "canFeature": { "automaticApproval": ["https://example.com/?author=1"] }
   }

   This is FEP-7aa9 explicit denial: only the actor itself is allowed, i.e. nobody.
4. Switch the dropdown to Anyone and refetch the actor. automaticApproval should now be ["https://www.w3.org/ns/activitystreams#Public"].
5. Send a FeatureRequest activity to the actor inbox while the policy is Anyone. Confirm an Accept is emitted to the outbox and the result URL dereferences to a FeatureAuthorization JSON document with interactingObject set to the requester's collection URI.
6. Repeat with the policy on No one. Confirm a Reject is emitted and no usermeta row is created.
7. With the policy on Anyone, send the same FeatureRequest twice. Confirm only one usermeta row exists (idempotency).
8. Try fetching the stamp URL with a tampered actor ID, e.g. ?actor=2&stamp=<umeta_id_belonging_to_user_1>. Confirm a 404 — cross-actor stamps are rejected.

Changelog entry

Already added at .github/changelog/feature-collections-consent (significance: minor, type: added). No auto-create needed.

[Copilot]

Pull request overview

Implements the receive-side consent flow for FEP-7aa9 Featured Collections (Starter Packs): the plugin can now handle incoming FeatureRequest activities, reply with Accept (including a dereferenceable FeatureAuthorization stamp) or Reject based on a new site policy, and advertise interactionPolicy.canFeature on actor documents.

Changes:

• Added FeatureRequest inbox handler with policy-controlled accept/reject behavior and actor-scoped stamp storage in user meta.
• Added FeatureAuthorization extended object plus routing/query support to dereference stamps via ?actor=ID&stamp=UMETA_ID.
• Added admin setting + option registration for activitypub_default_feature_policy, and comprehensive PHPUnit coverage for policy output and stamp lifecycle.

Reviewed changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/phpunit/tests/includes/model/class-test-interaction-policy.php	Verifies actor-level interactionPolicy.canFeature output for user/blog actors under each policy.
tests/phpunit/tests/includes/handler/class-test-feature-request.php	Tests validation, blocked-request handling, policy branching, accept/reject queuing, and idempotent stamp creation.
tests/phpunit/tests/includes/class-test-router.php	Adds coverage to ensure stamp URLs aren’t 404’d by the actor branch in template_redirect.
tests/phpunit/tests/includes/class-test-query-feature-stamp.php	Tests Query resolution for actor-scoped stamps, including cross-actor rejection and end-to-end routing.
tests/phpunit/tests/includes/activity/extended-object/class-test-feature-authorization.php	Verifies Feature_Authorization type and JSON-LD context mappings.
includes/wp-admin/class-settings-fields.php	Adds “Featured collection requests” dropdown to ActivityPub settings UI.
includes/handler/class-feature-request.php	New inbox handler for FeatureRequest, including policy enforcement and stamp issuance.
includes/class-router.php	Adds guard to avoid actor-username 404 path for stamp URLs.
includes/class-query.php	Extends stamp resolution to support actor-scoped FeatureAuthorization stamps.
includes/class-options.php	Registers the new activitypub_default_feature_policy option with sanitization and default.
includes/class-handler.php	Registers the new FeatureRequest handler during handler initialization.
includes/activity/extended-object/class-feature-authorization.php	Introduces Feature_Authorization extended object and its JSON-LD context.
includes/activity/class-base-object.php	Adds canFeature term to base JSON-LD context.
includes/activity/class-actor.php	Emits actor-level interactionPolicy.canFeature derived from the site policy.
includes/activity/class-activity.php	Adds FeatureRequest to Activity JSON-LD context and allowed activity types.
.gitignore	Ignores docs/superpowers/.
.github/changelog/feature-collections-consent	Adds changelogger entry documenting the new opt-in consent setting.