Add more checks and tests

app/lib/activitypub/activity/update.rb

@@ -52,7 +52,12 @@ class ActivityPub::Activity::Update < ActivityPub::Activity
   end
 
   def updated_username_confirmed?
+    begin
       webfinger = Webfinger.new("acct:#{@object['preferredUsername']}@#{@account.domain}").perform
+    rescue Webfinger::Error
+      return false
+    end
+
     confirmed_username, confirmed_domain = webfinger.subject.delete_prefix('acct:').split('@')
     confirmed_username == @object['preferredUsername'] && confirmed_domain == @account.domain
   end

spec/lib/activitypub/activity/update_spec.rb

@@ -77,8 +77,16 @@ RSpec.describe ActivityPub::Activity::Update do
             object: updated_username_json,
           }.with_indifferent_access
         end
-        let(:webfinger_response) do
+
-          {
+        before do
+          stub_request(:get, 'https://example.com/.well-known/host-meta').to_return(status: 404)
+        end
+
+        context 'when updated username is unique and confirmed' do
+          before do
+            stub_request(:get, "https://example.com/.well-known/webfinger?resource=acct:#{updated_handle}")
+              .to_return(
+                body: {
                   subject: "acct:#{updated_handle}",
                   links: [
                     {
@@ -87,13 +95,7 @@ RSpec.describe ActivityPub::Activity::Update do
                       href: sender.uri,
                     },
                   ],
-          }
+                }.to_json,
-        end
-
-        before do
-          stub_request(:get, "https://example.com/.well-known/webfinger?resource=acct:#{updated_handle}")
-            .to_return(
-              body: webfinger_response.to_json,
                 headers: {
                   'Content-Type' => 'application/json',
                 },
@@ -110,6 +112,7 @@ RSpec.describe ActivityPub::Activity::Update do
             subject.perform
             expect(sender.reload.username).to eq updated_username
           end
+        end
 
         context 'when updated username is not unique for domain' do
           before do
@@ -131,9 +134,11 @@ RSpec.describe ActivityPub::Activity::Update do
           end
         end
 
-        context 'when updated username is not confirmed via webfinger' do
+        context 'when webfinger of updated username does not contain updated username' do
-          let(:webfinger_response) do
+          before do
-            {
+            stub_request(:get, "https://example.com/.well-known/webfinger?resource=acct:#{updated_handle}")
+              .to_return(
+                body: {
                   subject: "acct:#{original_handle}",
                   links: [
                     {
@@ -142,7 +147,29 @@ RSpec.describe ActivityPub::Activity::Update do
                       href: sender.uri,
                     },
                   ],
-            }
+                }.to_json,
+                headers: {
+                  'Content-Type' => 'application/json',
+                },
+                status: 200
+              )
+          end
+
+          it 'updates profile' do
+            subject.perform
+            expect(sender.reload.display_name).to eq 'Totally modified now'
+          end
+
+          it 'does not update username' do
+            subject.perform
+            expect(sender.reload.username).to eq original_username
+          end
+        end
+
+        context 'when webfinger request of updated username fails' do
+          before do
+            stub_request(:get, "https://example.com/.well-known/webfinger?resource=acct:#{updated_handle}")
+              .to_return(status: 404)
           end
 
           it 'updates profile' do