1 /* tslint:disable:no-unused-expression */
7 flushAndRunMultipleServers,
12 } from '../../../../shared/extra-utils'
13 import { HTTP_SIGNATURE } from '../../../initializers/constants'
14 import { buildDigest, buildGlobalHeaders } from '../../../lib/job-queue/handlers/utils/activitypub-http-utils'
15 import * as chai from 'chai'
16 import { activityPubContextify, buildSignedActivity } from '../../../helpers/activitypub'
17 import { makeFollowRequest, makePOSTAPRequest } from '../../../../shared/extra-utils/requests/activitypub'
19 const expect = chai.expect
21 function setKeysOfServer2 (serverNumber: number, publicKey: string, privateKey: string) {
23 setActorField(serverNumber, 'http://localhost:9002/accounts/peertube', 'publicKey', publicKey),
24 setActorField(serverNumber, 'http://localhost:9002/accounts/peertube', 'privateKey', privateKey)
28 function setKeysOfServer3 (serverNumber: number, publicKey: string, privateKey: string) {
30 setActorField(serverNumber, 'http://localhost:9003/accounts/peertube', 'publicKey', publicKey),
31 setActorField(serverNumber, 'http://localhost:9003/accounts/peertube', 'privateKey', privateKey)
35 describe('Test ActivityPub security', function () {
36 let servers: ServerInfo[]
39 const keys = require('./json/peertube/keys.json')
40 const invalidKeys = require('./json/peertube/invalid-keys.json')
41 const baseHttpSignature = {
42 algorithm: HTTP_SIGNATURE.ALGORITHM,
43 authorizationHeaderName: HTTP_SIGNATURE.HEADER_NAME,
44 keyId: 'acct:peertube@localhost:9002',
46 headers: HTTP_SIGNATURE.HEADERS_TO_SIGN
49 // ---------------------------------------------------------------
51 before(async function () {
54 servers = await flushAndRunMultipleServers(3)
56 url = servers[0].url + '/inbox'
58 await setKeysOfServer2(1, keys.publicKey, keys.privateKey)
60 const to = { url: 'http://localhost:9001/accounts/peertube' }
61 const by = { url: 'http://localhost:9002/accounts/peertube', privateKey: keys.privateKey }
62 await makeFollowRequest(to, by)
65 describe('When checking HTTP signature', function () {
67 it('Should fail with an invalid digest', async function () {
68 const body = activityPubContextify(require('./json/peertube/announce-without-context.json'))
70 Digest: buildDigest({ hello: 'coucou' })
73 const { response } = await makePOSTAPRequest(url, body, baseHttpSignature, headers)
75 expect(response.statusCode).to.equal(403)
78 it('Should fail with an invalid date', async function () {
79 const body = activityPubContextify(require('./json/peertube/announce-without-context.json'))
80 const headers = buildGlobalHeaders(body)
81 headers['date'] = 'Wed, 21 Oct 2015 07:28:00 GMT'
83 const { response } = await makePOSTAPRequest(url, body, baseHttpSignature, headers)
85 expect(response.statusCode).to.equal(403)
88 it('Should fail with bad keys', async function () {
89 await setKeysOfServer2(1, invalidKeys.publicKey, invalidKeys.privateKey)
90 await setKeysOfServer2(2, invalidKeys.publicKey, invalidKeys.privateKey)
92 const body = activityPubContextify(require('./json/peertube/announce-without-context.json'))
93 const headers = buildGlobalHeaders(body)
95 const { response } = await makePOSTAPRequest(url, body, baseHttpSignature, headers)
97 expect(response.statusCode).to.equal(403)
100 it('Should succeed with a valid HTTP signature', async function () {
101 await setKeysOfServer2(1, keys.publicKey, keys.privateKey)
102 await setKeysOfServer2(2, keys.publicKey, keys.privateKey)
104 const body = activityPubContextify(require('./json/peertube/announce-without-context.json'))
105 const headers = buildGlobalHeaders(body)
107 const { response } = await makePOSTAPRequest(url, body, baseHttpSignature, headers)
109 expect(response.statusCode).to.equal(204)
113 describe('When checking Linked Data Signature', function () {
115 await setKeysOfServer3(3, keys.publicKey, keys.privateKey)
117 const to = { url: 'http://localhost:9001/accounts/peertube' }
118 const by = { url: 'http://localhost:9003/accounts/peertube', privateKey: keys.privateKey }
119 await makeFollowRequest(to, by)
122 it('Should fail with bad keys', async function () {
125 await setKeysOfServer3(1, invalidKeys.publicKey, invalidKeys.privateKey)
126 await setKeysOfServer3(3, invalidKeys.publicKey, invalidKeys.privateKey)
128 const body = require('./json/peertube/announce-without-context.json')
129 body.actor = 'http://localhost:9003/accounts/peertube'
131 const signer: any = { privateKey: invalidKeys.privateKey, url: 'http://localhost:9003/accounts/peertube' }
132 const signedBody = await buildSignedActivity(signer, body)
134 const headers = buildGlobalHeaders(signedBody)
136 const { response } = await makePOSTAPRequest(url, signedBody, baseHttpSignature, headers)
138 expect(response.statusCode).to.equal(403)
141 it('Should fail with an altered body', async function () {
144 await setKeysOfServer3(1, keys.publicKey, keys.privateKey)
145 await setKeysOfServer3(3, keys.publicKey, keys.privateKey)
147 const body = require('./json/peertube/announce-without-context.json')
148 body.actor = 'http://localhost:9003/accounts/peertube'
150 const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:9003/accounts/peertube' }
151 const signedBody = await buildSignedActivity(signer, body)
153 signedBody.actor = 'http://localhost:9003/account/peertube'
155 const headers = buildGlobalHeaders(signedBody)
157 const { response } = await makePOSTAPRequest(url, signedBody, baseHttpSignature, headers)
159 expect(response.statusCode).to.equal(403)
162 it('Should succeed with a valid signature', async function () {
165 const body = require('./json/peertube/announce-without-context.json')
166 body.actor = 'http://localhost:9003/accounts/peertube'
168 const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:9003/accounts/peertube' }
169 const signedBody = await buildSignedActivity(signer, body)
171 const headers = buildGlobalHeaders(signedBody)
173 const { response } = await makePOSTAPRequest(url, signedBody, baseHttpSignature, headers)
175 expect(response.statusCode).to.equal(204)
179 after(async function () {
180 killallServers(servers)
182 await closeAllSequelize(servers)