Anyway... figured i should have made an account for cardboard.NET related things so @CardboardNet@kitsunes.club exists now. I'll still post dev stuff here but for announcements, milestones and specific to cardboard.net dev stuff i'll probably move it all over there.
Please view @puppygirlhornypost2@transfem.social This account is now a read-only archive. I am unable to use it any meaningful capacity
Posts
As a result of this experiment and several others (figuring out that the *key api does not have protections in place) Cardboard.NET is going to prevent footgunning here.
https://activitypub.software/TransFem-org/Sharkey/-/issues/625#note_5155
Mainly, I am going to make DeleteAsync() and other actions you can take on a user account virtual so RestInstanceActor can override them. There will also be some checks for GetUserAsync() and various other parts of the library in which you can fetch the instance actor as type RestUser instead of RestInstanceActor to prevent instance actors from being treated as normal users. The library does not allow you to instantiate RestUsers from a pure model or anything like that (all of the stuff for that is internal only) so it shouldn't be that hard to encapsulate.
RE: https://transfem.social/notes/9xrrrrj7jekd0107
the results are in... It turns out that you're really not supposed to delete your instance actor. No really, what is wrong with you? Don't suspend it either.
me in the gitlab issues going
Doing this will allow you to log in as the instance actor, what you can do from there is up to you but I have a couple of recommendations.
3) Delete the actor again (after backing up preferably)