From 84ea8334feedffdc0067a21cb8cb605ff547d37b Mon Sep 17 00:00:00 2001
From: David Roetzel <david@roetzel.de>
Date: Wed, 25 Mar 2026 14:04:05 +0100
Subject: [PATCH] Do not auto-accept remote collection items (#38386)

---
 app/services/add_account_to_collection_service.rb       | 6 ++----
 app/services/create_collection_service.rb               | 3 ++-
 spec/services/add_account_to_collection_service_spec.rb | 5 ++++-
 spec/services/create_collection_service_spec.rb         | 6 +++++-
 4 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/app/services/add_account_to_collection_service.rb b/app/services/add_account_to_collection_service.rb
index e53c67b57f..c5a4697e79 100644
--- a/app/services/add_account_to_collection_service.rb
+++ b/app/services/add_account_to_collection_service.rb
@@ -22,10 +22,8 @@ class AddAccountToCollectionService
   private
 
   def create_collection_item
-    @collection.collection_items.create!(
-      account: @account,
-      state: :accepted
-    )
+    state = @account.local? ? :accepted : :pending
+    @collection.collection_items.create!(account: @account, state:)
   end
 
   def distribute_add_activity
diff --git a/app/services/create_collection_service.rb b/app/services/create_collection_service.rb
index b0d291d7c3..979794224a 100644
--- a/app/services/create_collection_service.rb
+++ b/app/services/create_collection_service.rb
@@ -36,7 +36,8 @@ class CreateCollectionService
     @accounts_to_add.each do |account_to_add|
       raise Mastodon::NotPermittedError, I18n.t('accounts.errors.cannot_be_added_to_collections') unless AccountPolicy.new(@account, account_to_add).feature?
 
-      @collection.collection_items.build(account: account_to_add, state: :accepted)
+      state = account_to_add.local? ? :accepted : :pending
+      @collection.collection_items.build(account: account_to_add, state:)
     end
   end
 
diff --git a/spec/services/add_account_to_collection_service_spec.rb b/spec/services/add_account_to_collection_service_spec.rb
index 35c7432ebe..c1e3ab45c8 100644
--- a/spec/services/add_account_to_collection_service_spec.rb
+++ b/spec/services/add_account_to_collection_service_spec.rb
@@ -32,9 +32,12 @@ RSpec.describe AddAccountToCollectionService do
       context 'when the account is remote', feature: :collections_federation do
         let(:account) { Fabricate(:remote_account, feature_approval_policy: (0b10 << 16)) }
 
-        it 'federates a `FeatureRequest` activity' do
+        it 'marks the item as `pending` and federates a `FeatureRequest` activity' do
           subject.call(collection, account)
 
+          new_item = collection.collection_items.last
+          expect(new_item).to be_pending
+
           expect(ActivityPub::FeatureRequestWorker).to have_enqueued_sidekiq_job
         end
       end
diff --git a/spec/services/create_collection_service_spec.rb b/spec/services/create_collection_service_spec.rb
index 0d71117e73..976782679f 100644
--- a/spec/services/create_collection_service_spec.rb
+++ b/spec/services/create_collection_service_spec.rb
@@ -65,9 +65,13 @@ RSpec.describe CreateCollectionService do
         context 'when some accounts are remote' do
           let(:accounts) { Fabricate.times(2, :remote_account, feature_approval_policy: (0b10 << 16)) }
 
-          it 'federates `FeatureRequest` activities', feature: :collections_federation do
+          it 'marks the new items as `pending` and federates `FeatureRequest` activities', feature: :collections_federation do
             subject.call(params, author)
 
+            new_collection = author.collections.last
+            expect(new_collection.collection_items.size).to eq 2
+            expect(new_collection.collection_items).to all(be_pending)
+
             expect(ActivityPub::FeatureRequestWorker).to have_enqueued_sidekiq_job.exactly(2).times
           end
         end