2
1

activitypub.ts 3.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111
  1. import { NextFunction, Request, Response } from 'express'
  2. import { ActivityPubSignature } from '../../shared'
  3. import { logger } from '../helpers/logger'
  4. import { isHTTPSignatureVerified, isJsonLDSignatureVerified, parseHTTPSignature } from '../helpers/peertube-crypto'
  5. import { ACCEPT_HEADERS, ACTIVITY_PUB, HTTP_SIGNATURE } from '../initializers/constants'
  6. import { getOrCreateActorAndServerAndModel } from '../lib/activitypub'
  7. import { loadActorUrlOrGetFromWebfinger } from '../helpers/webfinger'
  8. async function checkSignature (req: Request, res: Response, next: NextFunction) {
  9. try {
  10. const httpSignatureChecked = await checkHttpSignature(req, res)
  11. if (httpSignatureChecked !== true) return
  12. const actor = res.locals.signature.actor
  13. // Forwarded activity
  14. const bodyActor = req.body.actor
  15. const bodyActorId = bodyActor && bodyActor.id ? bodyActor.id : bodyActor
  16. if (bodyActorId && bodyActorId !== actor.url) {
  17. const jsonLDSignatureChecked = await checkJsonLDSignature(req, res)
  18. if (jsonLDSignatureChecked !== true) return
  19. }
  20. return next()
  21. } catch (err) {
  22. logger.error('Error in ActivityPub signature checker.', err)
  23. return res.sendStatus(403)
  24. }
  25. }
  26. function executeIfActivityPub (req: Request, res: Response, next: NextFunction) {
  27. const accepted = req.accepts(ACCEPT_HEADERS)
  28. if (accepted === false || ACTIVITY_PUB.POTENTIAL_ACCEPT_HEADERS.indexOf(accepted) === -1) {
  29. // Bypass this route
  30. return next('route')
  31. }
  32. logger.debug('ActivityPub request for %s.', req.url)
  33. return next()
  34. }
  35. // ---------------------------------------------------------------------------
  36. export {
  37. checkSignature,
  38. executeIfActivityPub,
  39. checkHttpSignature
  40. }
  41. // ---------------------------------------------------------------------------
  42. async function checkHttpSignature (req: Request, res: Response) {
  43. // FIXME: mastodon does not include the Signature scheme
  44. const sig = req.headers[HTTP_SIGNATURE.HEADER_NAME] as string
  45. if (sig && sig.startsWith('Signature ') === false) req.headers[HTTP_SIGNATURE.HEADER_NAME] = 'Signature ' + sig
  46. const parsed = parseHTTPSignature(req)
  47. const keyId = parsed.keyId
  48. if (!keyId) {
  49. res.sendStatus(403)
  50. return false
  51. }
  52. logger.debug('Checking HTTP signature of actor %s...', keyId)
  53. let [ actorUrl ] = keyId.split('#')
  54. if (actorUrl.startsWith('acct:')) {
  55. actorUrl = await loadActorUrlOrGetFromWebfinger(actorUrl.replace(/^acct:/, ''))
  56. }
  57. const actor = await getOrCreateActorAndServerAndModel(actorUrl)
  58. const verified = isHTTPSignatureVerified(parsed, actor)
  59. if (verified !== true) {
  60. logger.warn('Signature from %s is invalid', actorUrl, { parsed })
  61. res.sendStatus(403)
  62. return false
  63. }
  64. res.locals.signature = { actor }
  65. return true
  66. }
  67. async function checkJsonLDSignature (req: Request, res: Response) {
  68. const signatureObject: ActivityPubSignature = req.body.signature
  69. if (!signatureObject || !signatureObject.creator) {
  70. res.sendStatus(403)
  71. return false
  72. }
  73. const [ creator ] = signatureObject.creator.split('#')
  74. logger.debug('Checking JsonLD signature of actor %s...', creator)
  75. const actor = await getOrCreateActorAndServerAndModel(creator)
  76. const verified = await isJsonLDSignatureVerified(actor, req.body)
  77. if (verified !== true) {
  78. res.sendStatus(403)
  79. return false
  80. }
  81. res.locals.signature = { actor }
  82. return true
  83. }