server/middlewares/activitypub.ts

   1 import { NextFunction, Request, Response } from 'express'
   2 import { ActivityDelete, ActivityPubSignature } from '../../shared'
   3 import { logger } from '../helpers/logger'
   4 import { isHTTPSignatureVerified, isJsonLDSignatureVerified, parseHTTPSignature } from '../helpers/peertube-crypto'
   5 import { ACCEPT_HEADERS, ACTIVITY_PUB, HTTP_SIGNATURE } from '../initializers/constants'
   6 import { getOrCreateActorAndServerAndModel } from '../lib/activitypub'
   7 import { loadActorUrlOrGetFromWebfinger } from '../helpers/webfinger'
   8 import { isActorDeleteActivityValid } from '@server/helpers/custom-validators/activitypub/actor'
   9
  10 async function checkSignature (req: Request, res: Response, next: NextFunction) {
  11   try {
  12     const httpSignatureChecked = await checkHttpSignature(req, res)
  13     if (httpSignatureChecked !== true) return
  14
  15     const actor = res.locals.signature.actor
  16
  17     // Forwarded activity
  18     const bodyActor = req.body.actor
  19     const bodyActorId = bodyActor && bodyActor.id ? bodyActor.id : bodyActor
  20     if (bodyActorId && bodyActorId !== actor.url) {
  21       const jsonLDSignatureChecked = await checkJsonLDSignature(req, res)
  22       if (jsonLDSignatureChecked !== true) return
  23     }
  24
  25     return next()
  26   } catch (err) {
  27     const activity: ActivityDelete = req.body
  28     if (isActorDeleteActivityValid(activity) && activity.object === activity.actor) {
  29       logger.debug('Handling signature error on actor delete activity', { err })
  30       return res.sendStatus(204)
  31     }
  32
  33     logger.warn('Error in ActivityPub signature checker.', { err })
  34     return res.sendStatus(403)
  35   }
  36 }
  37
  38 function executeIfActivityPub (req: Request, res: Response, next: NextFunction) {
  39   const accepted = req.accepts(ACCEPT_HEADERS)
  40   if (accepted === false || ACTIVITY_PUB.POTENTIAL_ACCEPT_HEADERS.indexOf(accepted) === -1) {
  41     // Bypass this route
  42     return next('route')
  43   }
  44
  45   logger.debug('ActivityPub request for %s.', req.url)
  46
  47   return next()
  48 }
  49
  50 // ---------------------------------------------------------------------------
  51
  52 export {
  53   checkSignature,
  54   executeIfActivityPub,
  55   checkHttpSignature
  56 }
  57
  58 // ---------------------------------------------------------------------------
  59
  60 async function checkHttpSignature (req: Request, res: Response) {
  61   // FIXME: compatibility with http-signature < v1.3
  62   const sig = req.headers[HTTP_SIGNATURE.HEADER_NAME] as string
  63   if (sig && sig.startsWith('Signature ') === true) req.headers[HTTP_SIGNATURE.HEADER_NAME] = sig.replace(/^Signature /, '')
  64
  65   const parsed = parseHTTPSignature(req, HTTP_SIGNATURE.CLOCK_SKEW_SECONDS)
  66
  67   const keyId = parsed.keyId
  68   if (!keyId) {
  69     res.sendStatus(403)
  70     return false
  71   }
  72
  73   logger.debug('Checking HTTP signature of actor %s...', keyId)
  74
  75   let [ actorUrl ] = keyId.split('#')
  76   if (actorUrl.startsWith('acct:')) {
  77     actorUrl = await loadActorUrlOrGetFromWebfinger(actorUrl.replace(/^acct:/, ''))
  78   }
  79
  80   const actor = await getOrCreateActorAndServerAndModel(actorUrl)
  81
  82   const verified = isHTTPSignatureVerified(parsed, actor)
  83   if (verified !== true) {
  84     logger.warn('Signature from %s is invalid', actorUrl, { parsed })
  85
  86     res.sendStatus(403)
  87     return false
  88   }
  89
  90   res.locals.signature = { actor }
  91
  92   return true
  93 }
  94
  95 async function checkJsonLDSignature (req: Request, res: Response) {
  96   const signatureObject: ActivityPubSignature = req.body.signature
  97
  98   if (!signatureObject || !signatureObject.creator) {
  99     res.sendStatus(403)
 100     return false
 101   }
 102
 103   const [ creator ] = signatureObject.creator.split('#')
 104
 105   logger.debug('Checking JsonLD signature of actor %s...', creator)
 106
 107   const actor = await getOrCreateActorAndServerAndModel(creator)
 108   const verified = await isJsonLDSignatureVerified(actor, req.body)
 109
 110   if (verified !== true) {
 111     logger.warn('Signature not verified.', req.body)
 112
 113     res.sendStatus(403)
 114     return false
 115   }
 116
 117   res.locals.signature = { actor }
 118
 119   return true
 120 }