115 lines
4.2 KiB
JavaScript
115 lines
4.2 KiB
JavaScript
const fetch = require('node-fetch')
|
|
// const request = require('request')
|
|
const crypto = require('crypto')
|
|
const config = require('config')
|
|
const httpSignature = require('http-signature')
|
|
const debug = require('debug')('fediverse:helpers')
|
|
const { user: User } = require('../api/models')
|
|
const url = require('url')
|
|
|
|
const actorCache = []
|
|
|
|
const Helpers = {
|
|
async signAndSend(message, user, to) {
|
|
// get the URI of the actor object and append 'inbox' to it
|
|
const toInbox = to + '/inbox'
|
|
const toOrigin = url.parse(to)
|
|
const toPath = toOrigin.path + '/inbox'
|
|
// get the private key
|
|
const privkey = user.rsa.privateKey
|
|
const signer = crypto.createSign('sha256')
|
|
const d = new Date()
|
|
const stringToSign = `(request-target): post ${toPath}\nhost: ${toOrigin.hostname}\ndate: ${d.toUTCString()}`
|
|
|
|
signer.update(stringToSign)
|
|
signer.end()
|
|
const signature = signer.sign(privkey)
|
|
const signature_b64 = signature.toString('base64')
|
|
const header = `keyId="${config.baseurl}/federation/u/${user.username}",headers="(request-target) host date",signature="${signature_b64}"`
|
|
return await fetch(toInbox, {
|
|
headers: {
|
|
'Host': toOrigin.hostname,
|
|
'Date': d.toUTCString(),
|
|
'Signature': header,
|
|
'Content-Type': 'application/activity+json; charset=utf-8',
|
|
'Accept': 'application/activity+json, application/json; chartset=utf-8'
|
|
},
|
|
method: 'POST',
|
|
body: JSON.stringify(message) })
|
|
|
|
},
|
|
|
|
async sendEvent(event, user) {
|
|
// TODO: has to use sharedInbox!
|
|
// event is sent by user that published it and by the admin instance
|
|
const instanceAdmin = await User.findOne({where: { email: config.admin }})
|
|
if(!instanceAdmin) return
|
|
|
|
for(let follower of instanceAdmin.followers) {
|
|
debug('Notify %s with event %s', follower, event.title)
|
|
const body = event.toAP(instanceAdmin.username, follower)
|
|
body['@context'] = 'https://www.w3.org/ns/activitystreams'
|
|
Helpers.signAndSend(body, user, follower)
|
|
}
|
|
|
|
// in case the event is published by the Admin itself do not republish
|
|
if (instanceAdmin.id === user.id) return
|
|
for(let follower of user.followers) {
|
|
debug('Notify %s with event %s', follower, event.title)
|
|
const body = event.toAP(user.username, follower)
|
|
body['@context'] = 'https://www.w3.org/ns/activitystreams'
|
|
Helpers.signAndSend(body, user, follower)
|
|
}
|
|
},
|
|
|
|
async getFederatedUser(address) {
|
|
address = address.trim()
|
|
const [ username, host ] = address.split('@')
|
|
const url = `https://${host}/.well-known/webfinger?resource=acct:${username}@${host}`
|
|
return Helpers.getActor(url)
|
|
},
|
|
|
|
// TODO: cache
|
|
async getActor(url, force=false) {
|
|
// try with cache first
|
|
if (!force && actorCache[url]) return actorCache[url]
|
|
const user = await fetch(url, { headers: {'Accept': 'application/jrd+json, application/json'} })
|
|
.then(res => {
|
|
if (!res.ok) {
|
|
debug('[ERR] Actor %s => %s', url, res.statusText)
|
|
return false
|
|
}
|
|
return res.json()
|
|
})
|
|
actorCache[url] = user
|
|
return user
|
|
},
|
|
|
|
// ref: https://blog.joinmastodon.org/2018/07/how-to-make-friends-and-verify-requests/
|
|
async verifySignature(req, res, next) {
|
|
debug('Inside verify signature', req.body.actor)
|
|
let user = await Helpers.getActor(req.body.actor)
|
|
if (!user) return res.status(401).send('Actor not found')
|
|
|
|
// little hack -> https://github.com/joyent/node-http-signature/pull/83
|
|
req.headers.authorization = 'Signature ' + req.headers.signature
|
|
|
|
// another little hack :/
|
|
// https://github.com/joyent/node-http-signature/issues/87
|
|
req.url = '/federation' + req.url
|
|
const parsed = httpSignature.parseRequest(req)
|
|
if (httpSignature.verifySignature(parsed, user.publicKey.publicKeyPem)) return next()
|
|
|
|
// signature not valid, try without cache
|
|
user = await Helpers.getActor(req.body.actor, true)
|
|
if (!user) return res.status(401).send('Actor not found')
|
|
if (httpSignature.verifySignature(parsed, user.publicKey.publicKeyPem)) return next()
|
|
|
|
// still not valid
|
|
debug('Invalid signature from user %s', req.body.actor)
|
|
res.send('Request signature could not be verified', 401)
|
|
}
|
|
}
|
|
|
|
module.exports = Helpers
|