Fix Move activity losing target when sent to followers

[pfefferle]

Fixes https://wordpress.org/support/topic/unmigrate-followers/

Proposed changes:

• Remove the buggy outbox_activity filter for Move activities that was overwriting the target with the object value. This caused all outgoing Move activities to have origin == target, so remote instances correctly ignored them as no-ops. The stored outbox JSON already has the correct values, making the filter unnecessary.
• Fix verify_move to use camelCase JSON keys (alsoKnownAs) matching raw HTTP responses from Http::get_remote_object(), which returns json_decode'd data without key transformation.
• Broaden origin matching in verify_move to check id, url, and webfinger identifiers against the target's alsoKnownAs array.

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

• Set up two accounts: a local WordPress site with ActivityPub and an external account (e.g. Mastodon).
• Configure account aliases so both accounts reference each other via alsoKnownAs.
• Run wp activitypub move <local-actor-url> <remote-actor-url> to trigger an external Move.
• Verify the outbox contains a Move activity where target points to the remote account (not the local one).
• Verify followers on remote instances receive the Move and migrate accordingly.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch

Type

• Fixed - for any bug fixes

Message

Fix account migration (Move) not working when moving back to an external account.

[Copilot]

Pull request overview

This PR fixes ActivityPub account migration (Move) issues where outgoing Move activities could lose their intended target, and improves inbound Move verification to match real-world actor JSON shapes.

Changes:

• Removed the activitypub_get_outbox_activity filter for Move activities that could overwrite target.
• Updated inbound Move verification to use alsoKnownAs (camelCase) and to match origin via id, url, or webfinger.
• Updated/added PHPUnit coverage for Move handler scenarios and key casing.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
includes/handler/class-move.php	Removes the outbox filter for Move; updates verify_move() to use alsoKnownAs and broaden origin matching.
tests/phpunit/tests/includes/handler/class-test-move.php	Updates mocked actor payload keys to alsoKnownAs; adds tests for origin matching by url and webfinger.
tests/phpunit/tests/includes/class-test-move.php	Updates test fixture JSON to use alsoKnownAs.
.github/changelog/fix-move-activity-target	Adds a changelog entry documenting the fix.