ActivityPub C2S: Inbox and Outbox contents are incorrect
According to the ActivityPub specification, the outbox contains all the activities published by an actor and the inbox contains all the activities received by an actor.
Currently when a GET request is done on the outbox, the outbox only contains the public activities, even when the actor is authenticated (with an OAuth bearer token for instance). When an actor is authenticated and is reading their outbox, the actor should be able to see all the activities, not just the public ones.
When a GET request is done on the inbox, the inbox contains the home timeline. So it also contains activities published by the actor, and not just the activities received by the actor. The home timeline is the merge of the inbox and the outbox. When using the ActivityPub C2S protocol, the home timeline should be built on the client side by fetching the inbox and the outbox, not on the server side by fetching the inbox.