Fix quote_id leaking into boost wrapper status

When boosting a quote post, the reblog endpoint spread the original
post's fields into the new wrapper row, which caused quoteTargetId
to be copied to the outer boost status.  Clients like SubwayTooter
would then see quote_id on the wrapper instead of only on the inner
reblog object, breaking quote display.

Fix by explicitly setting quoteTargetId: null when inserting the
boost wrapper post, so quote_id and quote only appear inside the
inner reblog object as expected.

Also added a test case verifying that the outer wrapper has a null
quote_id while the inner reblog retains the correct quote_id.

Fixes #480

Assisted-by: Claude Code:claude-sonnet-4-6

Author: dahlia

CHANGES.md

@@ -6,12 +6,19 @@ Version 0.8.4
 
 To be released.
 
+ -  Fixed a bug where boosting a quote post would incorrectly copy the
+    `quote_id` to the outer boost wrapper status, causing clients like
+    SubwayTooter to fail to display the quoted post correctly.  The
+    `quote_id` and `quote` fields now only appear inside the inner `reblog`
+    object.  [[#480]]
+
  -  Fixed a bug where no logs were output when running as a worker node
     (`NODE_TYPE=worker`).  The logging system was only initialized when the
     web server started, so worker-only processes ran silently regardless of
     the `LOG_LEVEL` setting.  [[#478]]
 
 [#478]: https://github.com/fedify-dev/hollo/issues/478
+[#480]: https://github.com/fedify-dev/hollo/issues/480
 
 
 Version 0.8.3

src/api/v1/statuses.test.ts

@@ -214,6 +214,70 @@ describe.sequential("/api/v1/accounts/verify_credentials", () => {
   });
 });
 
+describe.sequential("/api/v1/statuses/:id/reblog", () => {
+  let client: Awaited<ReturnType<typeof createOAuthApplication>>;
+  let account: Awaited<ReturnType<typeof createAccount>>;
+  let accessToken: Awaited<ReturnType<typeof getAccessToken>>;
+
+  beforeEach(async () => {
+    await cleanDatabase();
+
+    account = await createAccount({ generateKeyPair: true });
+    client = await createOAuthApplication({ scopes: ["write:statuses"] });
+    accessToken = await getAccessToken(client, account, ["write:statuses"]);
+  });
+
+  it("does not carry quote_id on the boost wrapper when boosting a quote post", async () => {
+    expect.assertions(5);
+
+    // Create the quoted post
+    const quotedPostId = uuidv7();
+    await db.insert(posts).values({
+      id: quotedPostId,
+      iri: `https://hollo.test/@hollo/${quotedPostId}`,
+      type: "Note",
+      accountId: account.id,
+      visibility: "public",
+      content: "Original post",
+      contentHtml: "<p>Original post</p>",
+      published: new Date(),
+    });
+
+    // Create a quote post referencing the quoted post
+    const quotePostId = uuidv7();
+    await db.insert(posts).values({
+      id: quotePostId,
+      iri: `https://hollo.test/@hollo/${quotePostId}`,
+      type: "Note",
+      accountId: account.id,
+      visibility: "public",
+      content: "Quote post",
+      contentHtml: "<p>Quote post</p>",
+      quoteTargetId: quotedPostId,
+      published: new Date(),
+    });
+
+    // Boost the quote post
+    const response = await app.request(
+      `/api/v1/statuses/${quotePostId}/reblog`,
+      {
+        method: "POST",
+        headers: { authorization: bearerAuthorization(accessToken) },
+      },
+    );
+
+    expect(response.status).toBe(200);
+    const json = await response.json();
+
+    // The outer boost wrapper must not carry quote_id
+    expect(json.quote_id).toBeNull();
+    // The inner reblog object must retain the quote_id
+    expect(json.reblog).not.toBeNull();
+    expect(json.reblog.id).toBe(quotePostId);
+    expect(json.reblog.quote_id).toBe(quotedPostId);
+  });
+});
+
 describe.sequential("/api/v1/statuses visibility", () => {
   let viewer: Awaited<ReturnType<typeof createAccount>>;
   let approvedAuthor: Awaited<ReturnType<typeof createAccount>>;

src/api/v1/statuses.ts

@@ -845,6 +845,7 @@ app.post(
           accountId: owner.id,
           applicationId: token.applicationId,
           replyTargetId: null,
+          quoteTargetId: null,
           sharingId: originalPostId,
           visibility,
           url: url.href,