+import { compare, genSalt, hash } from 'bcrypt'
+import { createSign, createVerify } from 'crypto'
import { Request } from 'express'
+import { cloneDeep } from 'lodash'
+import { sha256 } from '@shared/extra-utils'
import { BCRYPT_SALT_SIZE, HTTP_SIGNATURE, PRIVATE_RSA_KEY_SIZE } from '../initializers/constants'
-import { createPrivateKey, getPublicKey, promisify1, promisify2, sha256 } from './core-utils'
+import { MActor } from '../types/models'
+import { generateRSAKeyPairPromise, promisify1, promisify2 } from './core-utils'
import { jsonld } from './custom-jsonld-signature'
import { logger } from './logger'
-import { cloneDeep } from 'lodash'
-import { createSign, createVerify } from 'crypto'
-import { buildDigest } from '../lib/job-queue/handlers/utils/activitypub-http-utils'
-import * as bcrypt from 'bcrypt'
-import { MActor } from '../typings/models'
-const bcryptComparePromise = promisify2<any, string, boolean>(bcrypt.compare)
-const bcryptGenSaltPromise = promisify1<number, string>(bcrypt.genSalt)
-const bcryptHashPromise = promisify2<any, string | number, string>(bcrypt.hash)
+const bcryptComparePromise = promisify2<any, string, boolean>(compare)
+const bcryptGenSaltPromise = promisify1<number, string>(genSalt)
+const bcryptHashPromise = promisify2<any, string | number, string>(hash)
-const httpSignature = require('http-signature')
+const httpSignature = require('@peertube/http-signature')
-async function createPrivateAndPublicKeys () {
+function createPrivateAndPublicKeys () {
logger.info('Generating a RSA key...')
- const { key } = await createPrivateKey(PRIVATE_RSA_KEY_SIZE)
- const { publicKey } = await getPublicKey(key)
-
- return { privateKey: key, publicKey }
+ return generateRSAKeyPairPromise(PRIVATE_RSA_KEY_SIZE)
}
// User password checks
}
function parseHTTPSignature (req: Request, clockSkew?: number) {
- return httpSignature.parse(req, { authorizationHeaderName: HTTP_SIGNATURE.HEADER_NAME, clockSkew })
+ const requiredHeaders = req.method === 'POST'
+ ? [ '(request-target)', 'host', 'digest' ]
+ : [ '(request-target)', 'host' ]
+
+ const parsed = httpSignature.parse(req, { clockSkew, headers: requiredHeaders })
+
+ const parsedHeaders = parsed.params.headers
+ if (!parsedHeaders.includes('date') && !parsedHeaders.includes('(created)')) {
+ throw new Error(`date or (created) must be included in signature`)
+ }
+
+ return parsed
}
// JSONLD
return verify.verify(fromActor.publicKey, signedDocument.signature.signatureValue, 'base64')
}
-async function signJsonLDObject (byActor: MActor, data: any) {
+async function signJsonLDObject <T> (byActor: MActor, data: T) {
const signature = {
type: 'RsaSignature2017',
creator: byActor.url,
return Object.assign(data, { signature })
}
+function buildDigest (body: any) {
+ const rawBody = typeof body === 'string' ? body : JSON.stringify(body)
+
+ return 'SHA-256=' + sha256(rawBody, 'base64')
+}
+
// ---------------------------------------------------------------------------
export {
isHTTPSignatureDigestValid,
parseHTTPSignature,
isHTTPSignatureVerified,
+ buildDigest,
isJsonLDSignatureVerified,
comparePassword,
createPrivateAndPublicKeys,
// ---------------------------------------------------------------------------
-function hash (obj: any): Promise<any> {
+function hashObject (obj: any): Promise<any> {
return jsonld.promises
.normalize(obj, {
algorithm: 'URDNA2015',
delete signatureCopy.id
delete signatureCopy.signatureValue
- return hash(signatureCopy)
+ return hashObject(signatureCopy)
}
function createDocWithoutSignatureHash (doc: any) {
const docWithoutSignature = cloneDeep(doc)
delete docWithoutSignature.signature
- return hash(docWithoutSignature)
+ return hashObject(docWithoutSignature)
}