Match spammed and trashed comments when deduplicating incoming reactions

[pfefferle]

Related to #3215 (follow-up to #3468).

Proposed changes:

• The deduplication lookup for incoming Likes and Announces now matches comments of any status. Comment::object_id_to_comment() uses WP_Comment_Query with the default status, which core interprets as comment_approved IN ('0','1') — pending and approved only. A like that was marked as spam (e.g. by Akismet) or moved to the trash was therefore invisible to the dedupe from Fix: Prevent duplicate Like comments from repeated deliveries #3468, and every retried delivery of the same activity created a fresh comment. That matches the reports in Getting repeated comments from a single Mastodon "like" #3215, where duplicates kept appearing even with Fix: Prevent duplicate Like comments from repeated deliveries #3468 applied.
• Comment::object_id_to_comment() gains an optional $args parameter for additional WP_Comment_Query arguments; meta_key/meta_value cannot be overridden. Existing callers are unaffected (byte-identical query without the new argument).
• Only the Like and Announce dedupe lookups opt into status => 'any'. The Create handler and Interactions::update_comment() lookups drive update-vs-insert decisions, where matching spammed comments could resurrect spam, so they deliberately keep the default behavior.

Other information:

• Have you written new tests for your changes, if applicable?

Both new regression tests were verified to fail against trunk and pass with the fix. The spam variant varies the comment author name between deliveries, since WordPress' native author/content duplicate check also matches spam comments and would otherwise mask a dedupe regression — mirroring the mangled emoji author names from the issue reports.

Testing instructions:

• Enable likes (Settings → ActivityPub → allow likes) and deliver a Like activity to the inbox; a like comment is created.
• Mark that comment as spam (or trash it).
• Deliver the exact same Like activity again.
• Before this change a second comment appears; with it, the retry is ignored.
• Covered by Test_Like::test_handle_like_duplicate_skipped_when_original_is_spam and test_handle_like_duplicate_skipped_when_original_is_trashed.

Changelog entry

Changelog entry is committed in .github/changelog/fix-reaction-dedup-spam-blind.

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message

[Copilot]

Pull request overview

This PR fixes reaction deduplication for incoming Like and Announce activities by ensuring the “already seen” lookup also matches comments that have been marked as spam or moved to the trash, preventing duplicate reaction comments on retried deliveries (follow-up to #3468, addressing #3215).

Changes:

• Extend Comment::object_id_to_comment() with an optional $args parameter to pass additional WP_Comment_Query arguments (while still enforcing meta_key/meta_value).
• Update Like and Announce handlers to dedupe using status => 'any', so spammed/trashed reaction comments are still detected.
• Add PHPUnit regression tests covering dedupe behavior when the original Like comment is spammed or trashed.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/phpunit/tests/includes/handler/class-test-like.php	Adds regression tests ensuring duplicate Likes are skipped even if the original comment is spam/trashed.
includes/handler/class-like.php	Dedupe lookup now includes comments of any status when checking for an existing Like reaction.
includes/handler/class-announce.php	Dedupe lookup now includes comments of any status when checking for an existing Announce/repost reaction.
includes/class-comment.php	Adds optional $args to object_id_to_comment() to support status-aware lookups.
.github/changelog/fix-reaction-dedup-spam-blind	Changelog entry describing the user-visible fix for spam/trashed reaction dedupe.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.