Fixed 267U.pre2
This commit is contained in:
@@ -0,0 +1,482 @@
|
||||
import Router from "@koa/router";
|
||||
import bodyParser from "koa-bodyparser";
|
||||
import httpSignature from "@peertube/http-signature";
|
||||
import { In, IsNull, Not } from "typeorm";
|
||||
import { renderActivity } from "../remote/activitypub/renderer/index.js";
|
||||
import renderNote from "../remote/activitypub/renderer/note.js";
|
||||
import renderKey from "../remote/activitypub/renderer/key.js";
|
||||
import { renderPerson } from "../remote/activitypub/renderer/person.js";
|
||||
import renderEmoji from "../remote/activitypub/renderer/emoji.js";
|
||||
import { inbox as processInbox } from "../queue/index.js";
|
||||
import { isSelfHost } from "../misc/convert-host.js";
|
||||
import { Notes, Users, Emojis, NoteReactions, FollowRequests, Bites, InteractionStamps } from "../models/index.js";
|
||||
import { renderLike } from "../remote/activitypub/renderer/like.js";
|
||||
import { getUserKeypair } from "../misc/keypair-store.js";
|
||||
import { checkFetch, getSignatureUser, verifyDigest } from "../remote/activitypub/check-fetch.js";
|
||||
import { getInstanceActor } from "../services/instance-actor.js";
|
||||
import { fetchMeta } from "../misc/fetch-meta.js";
|
||||
import renderFollow from "../remote/activitypub/renderer/follow.js";
|
||||
import Featured from "./activitypub/featured.js";
|
||||
import Following from "./activitypub/following.js";
|
||||
import Followers from "./activitypub/followers.js";
|
||||
import Outbox, { packActivity } from "./activitypub/outbox.js";
|
||||
import { serverLogger } from "./index.js";
|
||||
import config from "../config/index.js";
|
||||
import { tickFetch } from "../metrics.js";
|
||||
import renderBite from "../remote/activitypub/renderer/bite.js";
|
||||
import renderQuoteAuthorization from "../remote/activitypub/renderer/quote-authorization.js";
|
||||
// Init router
|
||||
const router = new Router();
|
||||
//#region Routing
|
||||
function inbox(ctx) {
|
||||
if (ctx.req.headers.host !== config.host) {
|
||||
ctx.status = 400;
|
||||
return;
|
||||
}
|
||||
let signature;
|
||||
try {
|
||||
signature = httpSignature.parseRequest(ctx.req, {
|
||||
headers: [
|
||||
'(request-target)',
|
||||
'digest',
|
||||
'host',
|
||||
'date'
|
||||
],
|
||||
authorizationHeaderName: 'signature'
|
||||
});
|
||||
} catch (e) {
|
||||
ctx.status = 401;
|
||||
return;
|
||||
}
|
||||
if (!verifyDigest(ctx.request.rawBody, ctx.headers.digest)) {
|
||||
ctx.status = 401;
|
||||
return;
|
||||
}
|
||||
processInbox(ctx.request.body, signature);
|
||||
ctx.status = 202;
|
||||
}
|
||||
const ACTIVITY_JSON = "application/activity+json; charset=utf-8";
|
||||
const LD_JSON = 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"; charset=utf-8';
|
||||
function isActivityPubReq(ctx) {
|
||||
ctx.response.vary("Accept");
|
||||
const accepted = ctx.accepts("html", ACTIVITY_JSON, LD_JSON);
|
||||
return typeof accepted === "string" && !accepted.match(/html/);
|
||||
}
|
||||
export function setResponseType(ctx) {
|
||||
const accept = ctx.accepts(ACTIVITY_JSON, LD_JSON);
|
||||
if (accept === LD_JSON) {
|
||||
ctx.response.type = LD_JSON;
|
||||
} else {
|
||||
ctx.response.type = ACTIVITY_JSON;
|
||||
}
|
||||
}
|
||||
async function parseJsonBodyOrFail(ctx, next) {
|
||||
const koaBodyParser = bodyParser({
|
||||
enableTypes: [
|
||||
"json"
|
||||
],
|
||||
detectJSON: ()=>true
|
||||
});
|
||||
try {
|
||||
await koaBodyParser(ctx, next);
|
||||
} catch {
|
||||
ctx.status = 400;
|
||||
return;
|
||||
}
|
||||
}
|
||||
// inbox
|
||||
router.post("/inbox", parseJsonBodyOrFail, inbox);
|
||||
router.post("/users/:user/inbox", parseJsonBodyOrFail, inbox);
|
||||
// note
|
||||
router.get("/notes/:note", async (ctx, next)=>{
|
||||
if (!isActivityPubReq(ctx)) return await next();
|
||||
const verify = await checkFetch(ctx.req);
|
||||
if (verify !== 200) {
|
||||
ctx.status = verify;
|
||||
return;
|
||||
}
|
||||
const note = await Notes.findOneBy({
|
||||
id: ctx.params.note,
|
||||
visibility: In([
|
||||
"public",
|
||||
"home",
|
||||
"followers"
|
||||
]),
|
||||
localOnly: false
|
||||
});
|
||||
if (note == null) {
|
||||
ctx.status = 404;
|
||||
return;
|
||||
}
|
||||
// redirect if remote
|
||||
if (note.userHost !== null) {
|
||||
if (note.uri == null || isSelfHost(note.userHost)) {
|
||||
ctx.status = 500;
|
||||
return;
|
||||
}
|
||||
ctx.redirect(note.uri);
|
||||
return;
|
||||
}
|
||||
if (note.visibility === "followers") {
|
||||
serverLogger.debug("Responding to request for follower-only note, validating access...");
|
||||
const remoteUser = await getSignatureUser(ctx.req);
|
||||
serverLogger.debug("Local note author user:");
|
||||
serverLogger.debug(JSON.stringify(note, null, 2));
|
||||
serverLogger.debug("Authenticated remote user:");
|
||||
serverLogger.debug(JSON.stringify(remoteUser, null, 2));
|
||||
if (remoteUser == null) {
|
||||
serverLogger.debug("Rejecting: no user");
|
||||
ctx.status = 401;
|
||||
return;
|
||||
}
|
||||
const relation = await Users.getRelation(remoteUser.user.id, note.userId);
|
||||
serverLogger.debug("Relation:");
|
||||
serverLogger.debug(JSON.stringify(relation, null, 2));
|
||||
if (!relation.isFollowing || relation.isBlocked) {
|
||||
serverLogger.debug("Rejecting: authenticated user is not following us or was blocked by us");
|
||||
ctx.status = 403;
|
||||
return;
|
||||
}
|
||||
serverLogger.debug("Accepting: access criteria met");
|
||||
}
|
||||
ctx.body = renderActivity(await renderNote(note, false));
|
||||
const meta = await fetchMeta();
|
||||
if (meta.secureMode || meta.privateMode) {
|
||||
ctx.set("Cache-Control", "private, max-age=0, must-revalidate");
|
||||
} else {
|
||||
ctx.set("Cache-Control", "public, max-age=180");
|
||||
}
|
||||
setResponseType(ctx);
|
||||
});
|
||||
// note activity
|
||||
router.get("/notes/:note/activity", async (ctx)=>{
|
||||
const verify = await checkFetch(ctx.req);
|
||||
if (verify !== 200) {
|
||||
ctx.status = verify;
|
||||
return;
|
||||
}
|
||||
const note = await Notes.findOneBy({
|
||||
id: ctx.params.note,
|
||||
userHost: IsNull(),
|
||||
visibility: In([
|
||||
"public",
|
||||
"home"
|
||||
]),
|
||||
localOnly: false
|
||||
});
|
||||
if (note == null) {
|
||||
ctx.status = 404;
|
||||
return;
|
||||
}
|
||||
ctx.body = renderActivity(await packActivity(note));
|
||||
const meta = await fetchMeta();
|
||||
if (meta.secureMode || meta.privateMode) {
|
||||
ctx.set("Cache-Control", "private, max-age=0, must-revalidate");
|
||||
} else {
|
||||
ctx.set("Cache-Control", "public, max-age=180");
|
||||
}
|
||||
setResponseType(ctx);
|
||||
});
|
||||
// outbox
|
||||
router.get("/users/:user/outbox", Outbox);
|
||||
// followers
|
||||
router.get("/users/:user/followers", Followers);
|
||||
// following
|
||||
router.get("/users/:user/following", Following);
|
||||
// featured
|
||||
router.get("/users/:user/collections/featured", Featured);
|
||||
// publickey
|
||||
router.get("/users/:user/publickey", async (ctx)=>{
|
||||
const instanceActor = await getInstanceActor();
|
||||
if (ctx.params.user === instanceActor.id) {
|
||||
tickFetch();
|
||||
ctx.body = renderActivity(renderKey(instanceActor, await getUserKeypair(instanceActor.id)));
|
||||
ctx.set("Cache-Control", "public, max-age=180");
|
||||
setResponseType(ctx);
|
||||
return;
|
||||
}
|
||||
const verify = await checkFetch(ctx.req);
|
||||
if (verify !== 200) {
|
||||
ctx.status = verify;
|
||||
return;
|
||||
}
|
||||
const userId = ctx.params.user;
|
||||
const user = await Users.findOneBy({
|
||||
id: userId,
|
||||
host: IsNull()
|
||||
});
|
||||
if (user == null) {
|
||||
ctx.status = 404;
|
||||
return;
|
||||
}
|
||||
const keypair = await getUserKeypair(user.id);
|
||||
if (Users.isLocalUser(user)) {
|
||||
ctx.body = renderActivity(renderKey(user, keypair));
|
||||
const meta = await fetchMeta();
|
||||
if (meta.secureMode || meta.privateMode) {
|
||||
ctx.set("Cache-Control", "private, max-age=0, must-revalidate");
|
||||
} else {
|
||||
ctx.set("Cache-Control", "public, max-age=180");
|
||||
}
|
||||
setResponseType(ctx);
|
||||
} else {
|
||||
ctx.status = 400;
|
||||
}
|
||||
});
|
||||
// user
|
||||
async function userInfo(ctx, user) {
|
||||
if (user == null) {
|
||||
ctx.status = 404;
|
||||
return;
|
||||
}
|
||||
ctx.body = renderActivity(await renderPerson(user));
|
||||
const meta = await fetchMeta();
|
||||
if (meta.secureMode || meta.privateMode) {
|
||||
ctx.set("Cache-Control", "private, max-age=0, must-revalidate");
|
||||
} else {
|
||||
ctx.set("Cache-Control", "public, max-age=180");
|
||||
}
|
||||
setResponseType(ctx);
|
||||
}
|
||||
router.get("/users/:user", async (ctx, next)=>{
|
||||
if (!isActivityPubReq(ctx)) return await next();
|
||||
const instanceActor = await getInstanceActor();
|
||||
if (ctx.params.user === instanceActor.id) {
|
||||
tickFetch();
|
||||
await userInfo(ctx, instanceActor);
|
||||
return;
|
||||
}
|
||||
const verify = await checkFetch(ctx.req);
|
||||
if (verify !== 200) {
|
||||
ctx.status = verify;
|
||||
return;
|
||||
}
|
||||
const userId = ctx.params.user;
|
||||
const user = await Users.findOneBy({
|
||||
id: userId,
|
||||
host: IsNull(),
|
||||
isSuspended: false
|
||||
});
|
||||
await userInfo(ctx, user);
|
||||
});
|
||||
router.get("/@:user", async (ctx, next)=>{
|
||||
if (!isActivityPubReq(ctx)) return await next();
|
||||
if (ctx.params.user === "instance.actor") {
|
||||
tickFetch();
|
||||
const instanceActor = await getInstanceActor();
|
||||
await userInfo(ctx, instanceActor);
|
||||
return;
|
||||
}
|
||||
const verify = await checkFetch(ctx.req);
|
||||
if (verify !== 200) {
|
||||
ctx.status = verify;
|
||||
return;
|
||||
}
|
||||
const user = await Users.findOneBy({
|
||||
usernameLower: ctx.params.user.toLowerCase(),
|
||||
host: IsNull(),
|
||||
isSuspended: false
|
||||
});
|
||||
await userInfo(ctx, user);
|
||||
});
|
||||
router.get("/actor", async (ctx, next)=>{
|
||||
tickFetch();
|
||||
const instanceActor = await getInstanceActor();
|
||||
await userInfo(ctx, instanceActor);
|
||||
});
|
||||
//#endregion
|
||||
// emoji
|
||||
router.get("/emojis/:emoji", async (ctx)=>{
|
||||
const verify = await checkFetch(ctx.req);
|
||||
if (verify !== 200) {
|
||||
ctx.status = verify;
|
||||
return;
|
||||
}
|
||||
const emoji = await Emojis.findOneBy({
|
||||
host: IsNull(),
|
||||
name: ctx.params.emoji
|
||||
});
|
||||
if (emoji == null) {
|
||||
ctx.status = 404;
|
||||
return;
|
||||
}
|
||||
ctx.body = renderActivity(await renderEmoji(emoji));
|
||||
const meta = await fetchMeta();
|
||||
if (meta.secureMode || meta.privateMode) {
|
||||
ctx.set("Cache-Control", "private, max-age=0, must-revalidate");
|
||||
} else {
|
||||
ctx.set("Cache-Control", "public, max-age=180");
|
||||
}
|
||||
setResponseType(ctx);
|
||||
});
|
||||
// like
|
||||
router.get("/likes/:like", async (ctx)=>{
|
||||
const verify = await checkFetch(ctx.req);
|
||||
if (verify !== 200) {
|
||||
ctx.status = verify;
|
||||
return;
|
||||
}
|
||||
const reaction = await NoteReactions.findOneBy({
|
||||
id: ctx.params.like
|
||||
});
|
||||
if (reaction == null) {
|
||||
ctx.status = 404;
|
||||
return;
|
||||
}
|
||||
const note = await Notes.findOneBy({
|
||||
id: reaction.noteId
|
||||
});
|
||||
if (note == null) {
|
||||
ctx.status = 404;
|
||||
return;
|
||||
}
|
||||
ctx.body = renderActivity(await renderLike(reaction, note));
|
||||
const meta = await fetchMeta();
|
||||
if (meta.secureMode || meta.privateMode) {
|
||||
ctx.set("Cache-Control", "private, max-age=0, must-revalidate");
|
||||
} else {
|
||||
ctx.set("Cache-Control", "public, max-age=180");
|
||||
}
|
||||
setResponseType(ctx);
|
||||
});
|
||||
// follow
|
||||
router.get("/follows/:follower/:followee", async (ctx)=>{
|
||||
const verify = await checkFetch(ctx.req);
|
||||
if (verify !== 200) {
|
||||
ctx.status = verify;
|
||||
return;
|
||||
}
|
||||
// This may be used before the follow is completed, so we do not
|
||||
// check if the following exists.
|
||||
const [follower, followee] = await Promise.all([
|
||||
Users.findOneBy({
|
||||
id: ctx.params.follower,
|
||||
host: IsNull()
|
||||
}),
|
||||
Users.findOneBy({
|
||||
id: ctx.params.followee,
|
||||
host: Not(IsNull())
|
||||
})
|
||||
]);
|
||||
if (follower == null || followee == null) {
|
||||
ctx.status = 404;
|
||||
return;
|
||||
}
|
||||
ctx.body = renderActivity(renderFollow(follower, followee));
|
||||
const meta = await fetchMeta();
|
||||
if (meta.secureMode || meta.privateMode) {
|
||||
ctx.set("Cache-Control", "private, max-age=0, must-revalidate");
|
||||
} else {
|
||||
ctx.set("Cache-Control", "public, max-age=180");
|
||||
}
|
||||
setResponseType(ctx);
|
||||
});
|
||||
// follow request
|
||||
router.get("/follows/:followRequestId", async (ctx)=>{
|
||||
const verify = await checkFetch(ctx.req);
|
||||
if (verify !== 200) {
|
||||
ctx.status = verify;
|
||||
return;
|
||||
}
|
||||
const followRequest = await FollowRequests.findOneBy({
|
||||
id: ctx.params.followRequestId
|
||||
});
|
||||
if (followRequest == null) {
|
||||
ctx.status = 404;
|
||||
return;
|
||||
}
|
||||
const [follower, followee] = await Promise.all([
|
||||
Users.findOneBy({
|
||||
id: followRequest.followerId,
|
||||
host: IsNull()
|
||||
}),
|
||||
Users.findOneBy({
|
||||
id: followRequest.followeeId,
|
||||
host: Not(IsNull())
|
||||
})
|
||||
]);
|
||||
if (follower == null || followee == null) {
|
||||
ctx.status = 404;
|
||||
return;
|
||||
}
|
||||
const meta = await fetchMeta();
|
||||
if (meta.secureMode || meta.privateMode) {
|
||||
ctx.set("Cache-Control", "private, max-age=0, must-revalidate");
|
||||
} else {
|
||||
ctx.set("Cache-Control", "public, max-age=180");
|
||||
}
|
||||
ctx.body = renderActivity(renderFollow(follower, followee));
|
||||
setResponseType(ctx);
|
||||
});
|
||||
// bite
|
||||
router.get("/bites/:biteId", async (ctx)=>{
|
||||
const verify = await checkFetch(ctx.req);
|
||||
if (verify !== 200) {
|
||||
ctx.status = verify;
|
||||
return;
|
||||
}
|
||||
const bite = await Bites.findOne({
|
||||
where: {
|
||||
id: ctx.params.biteId
|
||||
},
|
||||
relations: [
|
||||
"targetUser",
|
||||
"targetBite"
|
||||
]
|
||||
});
|
||||
if (bite === null) {
|
||||
ctx.status = 404;
|
||||
return;
|
||||
}
|
||||
const meta = await fetchMeta();
|
||||
if (meta.secureMode || meta.privateMode) {
|
||||
ctx.set("Cache-Control", "private, max-age=0, must-revalidate");
|
||||
} else {
|
||||
ctx.set("Cache-Control", "public, max-age=180");
|
||||
}
|
||||
ctx.body = renderActivity(await renderBite(bite));
|
||||
setResponseType(ctx);
|
||||
});
|
||||
// mastodon-style quote authorizations
|
||||
router.get("/stamp/:id", async (ctx)=>{
|
||||
const verify = await checkFetch(ctx.req);
|
||||
if (verify !== 200) {
|
||||
ctx.status = verify;
|
||||
return;
|
||||
}
|
||||
const stamp = await InteractionStamps.findOne({
|
||||
where: {
|
||||
id: ctx.params.id
|
||||
},
|
||||
relations: [
|
||||
"note",
|
||||
"targetNote"
|
||||
]
|
||||
});
|
||||
if (stamp === null) {
|
||||
ctx.status = 404;
|
||||
return;
|
||||
}
|
||||
// make sure the requester has access to the note, otherwise this endpoint can leak the existence of a private note.
|
||||
// we can't directly validate that the requester can view the quoting post, but servers should only get this uri
|
||||
// from the metadata on the quote's note object, so the possibility and scope of leakage is minor
|
||||
const requester = await getSignatureUser(ctx.req);
|
||||
if (requester === null) {
|
||||
ctx.status = 404;
|
||||
return;
|
||||
}
|
||||
const targetNoteVisibile = await Notes.isVisibleForMe(stamp.targetNote, requester.user.id);
|
||||
if (!targetNoteVisibile) {
|
||||
ctx.status = 404;
|
||||
return;
|
||||
}
|
||||
const meta = await fetchMeta();
|
||||
if (meta.secureMode || meta.privateMode) {
|
||||
ctx.set("Cache-Control", "private, max-age=0, must-revalidate");
|
||||
} else {
|
||||
ctx.set("Cache-Control", "public, max-age=180");
|
||||
}
|
||||
ctx.body = renderActivity(renderQuoteAuthorization(stamp));
|
||||
setResponseType(ctx);
|
||||
});
|
||||
export default router;
|
||||
Reference in New Issue
Block a user