Split-origin WebFinger should return the handle-host acct URI as the subject for server-origin acct aliases

[dahlia]

Problem

Fedify's WebFinger handler currently returns the queried resource as the JRD subject after it resolves an actor. This causes trouble for split-origin deployments where the ActivityPub server origin and the public handle host differ.

For example, Hollo can be configured like this:

HANDLE_HOST=campegg.com
WEB_ORIGIN=https://ap.campegg.com

In that setup, the canonical fediverse identity is:

acct:cam@campegg.com

and the actor lives at:

https://ap.campegg.com/@cam

Reproduction

A lookup for the canonical handle works as expected:

curl "https://ap.campegg.com/.well-known/webfinger?resource=acct:cam@campegg.com"

It returns a JRD with:

{
  "subject": "acct:cam@campegg.com",
  "aliases": ["https://ap.campegg.com/@cam"]
}

The problem appears when a remote server starts from the actor URL, then performs the reciprocal WebFinger check for the acct form on the server origin:

curl "https://ap.campegg.com/.well-known/webfinger?resource=acct:cam@ap.campegg.com"

Fedify resolves this to the same actor, but returns the queried resource as the subject:

{
  "subject": "acct:cam@ap.campegg.com",
  "aliases": [
    "https://ap.campegg.com/@cam",
    "acct:cam@campegg.com"
  ]
}

Expected behavior

I think the subject should still be the canonical handle-host identity:

{
  "subject": "acct:cam@campegg.com",
  "aliases": [
    "https://ap.campegg.com/@cam",
    "acct:cam@ap.campegg.com"
  ]
}

This matches the behavior expected by Mastodon for LOCAL_DOMAIN/WEB_DOMAIN-style split-domain deployments. In the current behavior, Mastodon appears to stop once the returned subject matches the queried resource, so it stores and displays the account as @cam@ap.campegg.com instead of @cam@campegg.com. The canonical handle is present only in aliases, which is too late for that code path.

Notes

I noticed this through fedify-dev/hollo#539, but the underlying behavior seems to come from Fedify's WebFinger handler. In Fedify 2.3.1, handleWebFingerInternal() builds the JRD with subject: resourceUrl.href; the handleHost value is only added as an alias when the queried acct host is the server origin.

When origin is configured with separate handleHost and webOrigin, and an acct: resource on the webOrigin host resolves to a local actor, the JRD subject should use acct:<preferredUsername>@<handleHost>. The queried acct:<preferredUsername>@<webOrigin host> can remain in aliases.