5 files changed, 41 insertions, 11 deletions

diff --git a/server/lib/jobs/activitypub-http-job-scheduler/activitypub-http-broadcast-handler.ts b/server/lib/jobs/activitypub-http-job-scheduler/activitypub-http-broadcast-handler.ts
index 8040dde2a..3c4d5556f 100644
--- a/server/lib/jobs/activitypub-http-job-scheduler/activitypub-http-broadcast-handler.ts
+++ b/server/lib/jobs/activitypub-http-job-scheduler/activitypub-http-broadcast-handler.ts
@@ -1,15 +1,17 @@
 import { doRequest, logger } from '../../../helpers'
-import { ActivityPubHttpPayload, computeBody, maybeRetryRequestLater } from './activitypub-http-job-scheduler'
+import { ActivityPubHttpPayload, buildSignedRequestOptions, computeBody, maybeRetryRequestLater } from './activitypub-http-job-scheduler'
 
 async function process (payload: ActivityPubHttpPayload, jobId: number) {
   logger.info('Processing ActivityPub broadcast in job %d.', jobId)
 
   const body = await computeBody(payload)
+  const httpSignatureOptions = await buildSignedRequestOptions(payload)
 
   const options = {
     method: 'POST',
     uri: '',
-    json: body
+    json: body,
+    httpSignature: httpSignatureOptions
   }
 
   for (const uri of payload.uris) {
diff --git a/server/lib/jobs/activitypub-http-job-scheduler/activitypub-http-job-scheduler.ts b/server/lib/jobs/activitypub-http-job-scheduler/activitypub-http-job-scheduler.ts
index 95a5d3ff2..88885cf97 100644
--- a/server/lib/jobs/activitypub-http-job-scheduler/activitypub-http-job-scheduler.ts
+++ b/server/lib/jobs/activitypub-http-job-scheduler/activitypub-http-job-scheduler.ts
@@ -1,5 +1,5 @@
 import { JobCategory } from '../../../../shared'
-import { buildSignedActivity, logger } from '../../../helpers'
+import { buildSignedActivity, getServerActor, logger } from '../../../helpers'
 import { ACTIVITY_PUB } from '../../../initializers'
 import { ActorModel } from '../../../models/activitypub/actor'
 import { JobHandler, JobScheduler } from '../job-scheduler'
@@ -46,16 +46,36 @@ async function computeBody (payload: ActivityPubHttpPayload) {
 
   if (payload.signatureActorId) {
     const actorSignature = await ActorModel.load(payload.signatureActorId)
-    if (!actorSignature) throw new Error('Unknown signature account id.')
+    if (!actorSignature) throw new Error('Unknown signature actor id.')
     body = await buildSignedActivity(actorSignature, payload.body)
   }
 
   return body
 }
 
+async function buildSignedRequestOptions (payload: ActivityPubHttpPayload) {
+  let actor: ActorModel
+  if (payload.signatureActorId) {
+    actor = await ActorModel.load(payload.signatureActorId)
+    if (!actor) throw new Error('Unknown signature actor id.')
+  } else {
+    // We need to sign the request, so use the server
+    actor = await getServerActor()
+  }
+
+  const keyId = actor.getWebfingerUrl()
+  return {
+    algorithm: 'rsa-sha256',
+    authorizationHeaderName: 'Signature',
+    keyId,
+    key: actor.privateKey
+  }
+}
+
 export {
   ActivityPubHttpPayload,
   activitypubHttpJobScheduler,
   maybeRetryRequestLater,
-  computeBody
+  computeBody,
+  buildSignedRequestOptions
 }
diff --git a/server/lib/jobs/activitypub-http-job-scheduler/activitypub-http-unicast-handler.ts b/server/lib/jobs/activitypub-http-job-scheduler/activitypub-http-unicast-handler.ts
index f16cfcec3..7a5caa679 100644
--- a/server/lib/jobs/activitypub-http-job-scheduler/activitypub-http-unicast-handler.ts
+++ b/server/lib/jobs/activitypub-http-job-scheduler/activitypub-http-unicast-handler.ts
@@ -1,16 +1,18 @@
 import { doRequest, logger } from '../../../helpers'
-import { ActivityPubHttpPayload, computeBody, maybeRetryRequestLater } from './activitypub-http-job-scheduler'
+import { ActivityPubHttpPayload, buildSignedRequestOptions, computeBody, maybeRetryRequestLater } from './activitypub-http-job-scheduler'
 
 async function process (payload: ActivityPubHttpPayload, jobId: number) {
   logger.info('Processing ActivityPub unicast in job %d.', jobId)
 
   const body = await computeBody(payload)
+  const httpSignatureOptions = await buildSignedRequestOptions(payload)
 
   const uri = payload.uris[0]
   const options = {
     method: 'POST',
     uri,
-    json: body
+    json: body,
+    httpSignature: httpSignatureOptions
   }
 
   try {
diff --git a/server/lib/jobs/transcoding-job-scheduler/video-file-optimizer-handler.ts b/server/lib/jobs/transcoding-job-scheduler/video-file-optimizer-handler.ts
index 47b12e66f..d905882be 100644
--- a/server/lib/jobs/transcoding-job-scheduler/video-file-optimizer-handler.ts
+++ b/server/lib/jobs/transcoding-job-scheduler/video-file-optimizer-handler.ts
@@ -1,4 +1,5 @@
 import * as Bluebird from 'bluebird'
+import { VideoPrivacy } from '../../../../shared/models/videos'
 import { computeResolutionsToTranscode, logger } from '../../../helpers'
 import { sequelizeTypescript } from '../../../initializers'
 import { VideoModel } from '../../../models/video/video'
@@ -35,9 +36,11 @@ async function onSuccess (jobId: number, video: VideoModel, jobScheduler: JobSch
   // Video does not exist anymore
   if (!videoDatabase) return undefined
 
-  // Now we'll add the video's meta data to our followers
-  await sendCreateVideo(video, undefined)
-  await shareVideoByServerAndChannel(video, undefined)
+  if (video.privacy !== VideoPrivacy.PRIVATE) {
+    // Now we'll add the video's meta data to our followers
+    await sendCreateVideo(video, undefined)
+    await shareVideoByServerAndChannel(video, undefined)
+  }
 
   const originalFileHeight = await videoDatabase.getOriginalFileHeight()
 
diff --git a/server/lib/jobs/transcoding-job-scheduler/video-file-transcoder-handler.ts b/server/lib/jobs/transcoding-job-scheduler/video-file-transcoder-handler.ts
index 8957b4565..409123bfe 100644
--- a/server/lib/jobs/transcoding-job-scheduler/video-file-transcoder-handler.ts
+++ b/server/lib/jobs/transcoding-job-scheduler/video-file-transcoder-handler.ts
@@ -1,4 +1,5 @@
 import { VideoResolution } from '../../../../shared'
+import { VideoPrivacy } from '../../../../shared/models/videos'
 import { logger } from '../../../helpers'
 import { VideoModel } from '../../../models/video/video'
 import { sendUpdateVideo } from '../../activitypub/send'
@@ -31,7 +32,9 @@ async function onSuccess (jobId: number, video: VideoModel) {
   // Video does not exist anymore
   if (!videoDatabase) return undefined
 
-  await sendUpdateVideo(video, undefined)
+  if (video.privacy !== VideoPrivacy.PRIVATE) {
+    await sendUpdateVideo(video, undefined)
+  }
 
   return undefined
 }