activitypub.ts 3.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118
  1. import { eachSeries } from 'async'
  2. import { NextFunction, Request, RequestHandler, Response } from 'express'
  3. import { ActivityPubSignature } from '../../shared'
  4. import { logger } from '../helpers/logger'
  5. import { isHTTPSignatureVerified, isJsonLDSignatureVerified, parseHTTPSignature } from '../helpers/peertube-crypto'
  6. import { ACCEPT_HEADERS, ACTIVITY_PUB, HTTP_SIGNATURE } from '../initializers'
  7. import { getOrCreateActorAndServerAndModel } from '../lib/activitypub'
  8. import { ActorModel } from '../models/activitypub/actor'
  9. import { loadActorUrlOrGetFromWebfinger } from '../helpers/webfinger'
  10. async function checkSignature (req: Request, res: Response, next: NextFunction) {
  11. try {
  12. const httpSignatureChecked = await checkHttpSignature(req, res)
  13. if (httpSignatureChecked !== true) return
  14. const actor: ActorModel = res.locals.signature.actor
  15. // Forwarded activity
  16. const bodyActor = req.body.actor
  17. const bodyActorId = bodyActor && bodyActor.id ? bodyActor.id : bodyActor
  18. if (bodyActorId && bodyActorId !== actor.url) {
  19. const jsonLDSignatureChecked = await checkJsonLDSignature(req, res)
  20. if (jsonLDSignatureChecked !== true) return
  21. }
  22. return next()
  23. } catch (err) {
  24. logger.error('Error in ActivityPub signature checker.', err)
  25. return res.sendStatus(403)
  26. }
  27. }
  28. function executeIfActivityPub (fun: RequestHandler | RequestHandler[]) {
  29. return (req: Request, res: Response, next: NextFunction) => {
  30. const accepted = req.accepts(ACCEPT_HEADERS)
  31. if (accepted === false || ACTIVITY_PUB.POTENTIAL_ACCEPT_HEADERS.indexOf(accepted) === -1) {
  32. return next()
  33. }
  34. logger.debug('ActivityPub request for %s.', req.url)
  35. if (Array.isArray(fun) === true) {
  36. return eachSeries(fun as RequestHandler[], (f, cb) => {
  37. f(req, res, cb)
  38. }, next)
  39. }
  40. return (fun as RequestHandler)(req, res, next)
  41. }
  42. }
  43. // ---------------------------------------------------------------------------
  44. export {
  45. checkSignature,
  46. executeIfActivityPub,
  47. checkHttpSignature
  48. }
  49. // ---------------------------------------------------------------------------
  50. async function checkHttpSignature (req: Request, res: Response) {
  51. // FIXME: mastodon does not include the Signature scheme
  52. const sig = req.headers[HTTP_SIGNATURE.HEADER_NAME] as string
  53. if (sig && sig.startsWith('Signature ') === false) req.headers[HTTP_SIGNATURE.HEADER_NAME] = 'Signature ' + sig
  54. const parsed = parseHTTPSignature(req)
  55. const keyId = parsed.keyId
  56. if (!keyId) {
  57. res.sendStatus(403)
  58. return false
  59. }
  60. logger.debug('Checking HTTP signature of actor %s...', keyId)
  61. let [ actorUrl ] = keyId.split('#')
  62. if (actorUrl.startsWith('acct:')) {
  63. actorUrl = await loadActorUrlOrGetFromWebfinger(actorUrl.replace(/^acct:/, ''))
  64. }
  65. const actor = await getOrCreateActorAndServerAndModel(actorUrl)
  66. const verified = isHTTPSignatureVerified(parsed, actor)
  67. if (verified !== true) {
  68. res.sendStatus(403)
  69. return false
  70. }
  71. res.locals.signature = { actor }
  72. return true
  73. }
  74. async function checkJsonLDSignature (req: Request, res: Response) {
  75. const signatureObject: ActivityPubSignature = req.body.signature
  76. if (!signatureObject || !signatureObject.creator) {
  77. res.sendStatus(403)
  78. return false
  79. }
  80. const [ creator ] = signatureObject.creator.split('#')
  81. logger.debug('Checking JsonLD signature of actor %s...', creator)
  82. const actor = await getOrCreateActorAndServerAndModel(creator)
  83. const verified = await isJsonLDSignatureVerified(actor, req.body)
  84. if (verified !== true) {
  85. res.sendStatus(403)
  86. return false
  87. }
  88. res.locals.signature = { actor }
  89. return true
  90. }