mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2025-08-05 09:55:20 +02:00
Improved signature handling & instance actor (#8275)
This PR is part of https://codeberg.org/forgejo/forgejo/pulls/4767 It improves the signature handling: 1. move logic to a service (might be used from other services as well) 2. make a clear difference between ` ReqHTTPUserSignature` and `ReqHTTPUserOrInstanceSignature` 3. improve test ability (activitypub/client & distant_federation_server_mock Adjust instance actor 1. name & 2. webfinger ## Strategy for next PRs is Integration tests are in the driving seat. I will step by step add integration tests form original PR and add code required by the integration test changes. ## Meta Proposal howto process large PRs can be discussed here: https://codeberg.org/forgejo-contrib/federation/pulls/37 Current state with rendered diagrams can be found here: https://codeberg.org/meissa/federation/src/branch/merge-large-pr/doc/merge-large-pr.md Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8275 Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org> Co-authored-by: Michael Jerger <michael.jerger@meissa-gmbh.de> Co-committed-by: Michael Jerger <michael.jerger@meissa-gmbh.de>
This commit is contained in:
Michael Jerger
Earl Warren
parent
7a8ff20bf3
commit
6f501b1fdf
20 changed files with 726 additions and 443 deletions
|
|
@ -5,15 +5,12 @@ package federation
|
|||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"database/sql"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"forgejo.org/models/forgefed"
|
||||
"forgejo.org/models/repo"
|
||||
"forgejo.org/models/user"
|
||||
"forgejo.org/modules/activitypub"
|
||||
"forgejo.org/modules/auth/password"
|
||||
|
|
@ -21,91 +18,84 @@ import (
|
|||
"forgejo.org/modules/log"
|
||||
"forgejo.org/modules/setting"
|
||||
"forgejo.org/modules/validation"
|
||||
context_service "forgejo.org/services/context"
|
||||
|
||||
"github.com/google/uuid"
|
||||
)
|
||||
|
||||
// ProcessLikeActivity receives a ForgeLike activity and does the following:
|
||||
// Validation of the activity
|
||||
// Creation of a (remote) federationHost if not existing
|
||||
// Creation of a forgefed Person if not existing
|
||||
// Validation of incoming RepositoryID against Local RepositoryID
|
||||
// Star the repo if it wasn't already stared
|
||||
// Do some mitigation against out of order attacks
|
||||
func ProcessLikeActivity(ctx context.Context, form any, repositoryID int64) (int, string, error) {
|
||||
activity := form.(*fm.ForgeLike)
|
||||
if res, err := validation.IsValid(activity); !res {
|
||||
return http.StatusNotAcceptable, "Invalid activity", err
|
||||
}
|
||||
log.Info("Activity validated:%v", activity)
|
||||
func Init() error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// parse actorID (person)
|
||||
actorURI := activity.Actor.GetID().String()
|
||||
log.Info("actorURI was: %v", actorURI)
|
||||
federationHost, err := GetFederationHostForURI(ctx, actorURI)
|
||||
func FindOrCreateFederationHost(ctx *context_service.Base, actorURI string) (*forgefed.FederationHost, error) {
|
||||
rawActorID, err := fm.NewActorID(actorURI)
|
||||
if err != nil {
|
||||
return http.StatusInternalServerError, "Wrong FederationHost", err
|
||||
return nil, err
|
||||
}
|
||||
if !activity.IsNewer(federationHost.LatestActivity) {
|
||||
return http.StatusNotAcceptable, "Activity out of order.", errors.New("Activity already processed")
|
||||
federationHost, err := forgefed.FindFederationHostByFqdnAndPort(ctx, rawActorID.Host, rawActorID.HostPort)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if federationHost == nil {
|
||||
result, err := createFederationHostFromAP(ctx, rawActorID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
federationHost = result
|
||||
}
|
||||
return federationHost, nil
|
||||
}
|
||||
|
||||
func FindOrCreateFederatedUser(ctx *context_service.Base, actorURI string) (*user.User, *user.FederatedUser, *forgefed.FederationHost, error) {
|
||||
user, federatedUser, federationHost, err := findFederatedUser(ctx, actorURI)
|
||||
if err != nil {
|
||||
return nil, nil, nil, err
|
||||
}
|
||||
personID, err := fm.NewPersonID(actorURI, string(federationHost.NodeInfo.SoftwareName))
|
||||
if err != nil {
|
||||
return nil, nil, nil, err
|
||||
}
|
||||
|
||||
if user != nil {
|
||||
log.Trace("Found local federatedUser: %#v", user)
|
||||
} else {
|
||||
user, federatedUser, err = createUserFromAP(ctx, personID, federationHost.ID)
|
||||
if err != nil {
|
||||
return nil, nil, nil, err
|
||||
}
|
||||
log.Trace("Created federatedUser from ap: %#v", user)
|
||||
}
|
||||
log.Trace("Got user: %v", user.Name)
|
||||
|
||||
return user, federatedUser, federationHost, nil
|
||||
}
|
||||
|
||||
func findFederatedUser(ctx *context_service.Base, actorURI string) (*user.User, *user.FederatedUser, *forgefed.FederationHost, error) {
|
||||
federationHost, err := FindOrCreateFederationHost(ctx, actorURI)
|
||||
if err != nil {
|
||||
return nil, nil, nil, err
|
||||
}
|
||||
actorID, err := fm.NewPersonID(actorURI, string(federationHost.NodeInfo.SoftwareName))
|
||||
if err != nil {
|
||||
return http.StatusNotAcceptable, "Invalid PersonID", err
|
||||
return nil, nil, nil, err
|
||||
}
|
||||
log.Info("Actor accepted:%v", actorID)
|
||||
|
||||
// parse objectID (repository)
|
||||
objectID, err := fm.NewRepositoryID(activity.Object.GetID().String(), string(forgefed.ForgejoSourceType))
|
||||
user, federatedUser, err := user.FindFederatedUser(ctx, actorID.ID, federationHost.ID)
|
||||
if err != nil {
|
||||
return http.StatusNotAcceptable, "Invalid objectId", err
|
||||
}
|
||||
if objectID.ID != fmt.Sprint(repositoryID) {
|
||||
return http.StatusNotAcceptable, "Invalid objectId", err
|
||||
}
|
||||
log.Info("Object accepted:%v", objectID)
|
||||
|
||||
// Check if user already exists
|
||||
user, _, err := user.FindFederatedUser(ctx, actorID.ID, federationHost.ID)
|
||||
if err != nil {
|
||||
return http.StatusInternalServerError, "Searching for user failed", err
|
||||
}
|
||||
if user != nil {
|
||||
log.Info("Found local federatedUser: %v", user)
|
||||
} else {
|
||||
user, _, err = CreateUserFromAP(ctx, actorID, federationHost.ID)
|
||||
if err != nil {
|
||||
return http.StatusInternalServerError, "Error creating federatedUser", err
|
||||
}
|
||||
log.Info("Created federatedUser from ap: %v", user)
|
||||
}
|
||||
log.Info("Got user:%v", user.Name)
|
||||
|
||||
// execute the activity if the repo was not stared already
|
||||
alreadyStared := repo.IsStaring(ctx, user.ID, repositoryID)
|
||||
if !alreadyStared {
|
||||
err = repo.StarRepo(ctx, user.ID, repositoryID, true)
|
||||
if err != nil {
|
||||
return http.StatusNotAcceptable, "Error staring", err
|
||||
}
|
||||
}
|
||||
federationHost.LatestActivity = activity.StartTime
|
||||
err = forgefed.UpdateFederationHost(ctx, federationHost)
|
||||
if err != nil {
|
||||
return http.StatusNotAcceptable, "Error updating federatedHost", err
|
||||
return nil, nil, nil, err
|
||||
}
|
||||
|
||||
return 0, "", nil
|
||||
return user, federatedUser, federationHost, nil
|
||||
}
|
||||
|
||||
func CreateFederationHostFromAP(ctx context.Context, actorID fm.ActorID) (*forgefed.FederationHost, error) {
|
||||
func createFederationHostFromAP(ctx context.Context, actorID fm.ActorID) (*forgefed.FederationHost, error) {
|
||||
actionsUser := user.NewAPServerActor()
|
||||
clientFactory, err := activitypub.GetClientFactory(ctx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
client, err := clientFactory.WithKeys(ctx, actionsUser, actionsUser.APActorKeyID())
|
||||
client, err := clientFactory.WithKeys(ctx, actionsUser, actionsUser.KeyID())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
|
@ -130,6 +120,7 @@ func CreateFederationHostFromAP(ctx context.Context, actorID fm.ActorID) (*forge
|
|||
return nil, err
|
||||
}
|
||||
|
||||
// TODO: we should get key material here also to have it immediately
|
||||
result, err := forgefed.NewFederationHost(actorID.Host, nodeInfo, actorID.HostPort, actorID.HostSchema)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
|
|
@ -143,34 +134,14 @@ func CreateFederationHostFromAP(ctx context.Context, actorID fm.ActorID) (*forge
|
|||
return &result, nil
|
||||
}
|
||||
|
||||
func GetFederationHostForURI(ctx context.Context, actorURI string) (*forgefed.FederationHost, error) {
|
||||
log.Info("Input was: %v", actorURI)
|
||||
rawActorID, err := fm.NewActorID(actorURI)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
federationHost, err := forgefed.FindFederationHostByFqdnAndPort(ctx, rawActorID.Host, rawActorID.HostPort)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if federationHost == nil {
|
||||
result, err := CreateFederationHostFromAP(ctx, rawActorID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
federationHost = result
|
||||
}
|
||||
return federationHost, nil
|
||||
}
|
||||
|
||||
func CreateUserFromAP(ctx context.Context, personID fm.PersonID, federationHostID int64) (*user.User, *user.FederatedUser, error) {
|
||||
func fetchUserFromAP(ctx context.Context, personID fm.PersonID, federationHostID int64) (*user.User, *user.FederatedUser, error) {
|
||||
actionsUser := user.NewAPServerActor()
|
||||
clientFactory, err := activitypub.GetClientFactory(ctx)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
apClient, err := clientFactory.WithKeys(ctx, actionsUser, actionsUser.APActorKeyID())
|
||||
apClient, err := clientFactory.WithKeys(ctx, actionsUser, actionsUser.KeyID())
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
|
@ -216,6 +187,11 @@ func CreateUserFromAP(ctx context.Context, personID fm.PersonID, federationHostI
|
|||
return nil, nil, err
|
||||
}
|
||||
|
||||
pubKeyBytes, err := decodePublicKeyPem(person.PublicKey.PublicKeyPem)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
newUser := user.User{
|
||||
LowerName: strings.ToLower(name),
|
||||
Name: name,
|
||||
|
|
@ -234,86 +210,30 @@ func CreateUserFromAP(ctx context.Context, personID fm.PersonID, federationHostI
|
|||
FederationHostID: federationHostID,
|
||||
InboxPath: inbox.Path,
|
||||
NormalizedOriginalURL: personID.AsURI(),
|
||||
KeyID: sql.NullString{
|
||||
String: person.PublicKey.ID.String(),
|
||||
Valid: true,
|
||||
},
|
||||
PublicKey: sql.Null[sql.RawBytes]{
|
||||
V: pubKeyBytes,
|
||||
Valid: true,
|
||||
},
|
||||
}
|
||||
|
||||
err = user.CreateFederatedUser(ctx, &newUser, &federatedUser)
|
||||
log.Info("Fetch federatedUser:%q", federatedUser)
|
||||
return &newUser, &federatedUser, nil
|
||||
}
|
||||
|
||||
func createUserFromAP(ctx context.Context, personID fm.PersonID, federationHostID int64) (*user.User, *user.FederatedUser, error) {
|
||||
newUser, federatedUser, err := fetchUserFromAP(ctx, personID, federationHostID)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
err = user.CreateFederatedUser(ctx, newUser, federatedUser)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
log.Info("Created federatedUser:%q", federatedUser)
|
||||
return &newUser, &federatedUser, nil
|
||||
}
|
||||
|
||||
// Create or update a list of FollowingRepo structs
|
||||
func StoreFollowingRepoList(ctx context.Context, localRepoID int64, followingRepoList []string) (int, string, error) {
|
||||
followingRepos := make([]*repo.FollowingRepo, 0, len(followingRepoList))
|
||||
for _, uri := range followingRepoList {
|
||||
federationHost, err := GetFederationHostForURI(ctx, uri)
|
||||
if err != nil {
|
||||
return http.StatusInternalServerError, "Wrong FederationHost", err
|
||||
}
|
||||
followingRepoID, err := fm.NewRepositoryID(uri, string(federationHost.NodeInfo.SoftwareName))
|
||||
if err != nil {
|
||||
return http.StatusNotAcceptable, "Invalid federated repo", err
|
||||
}
|
||||
followingRepo, err := repo.NewFollowingRepo(localRepoID, followingRepoID.ID, federationHost.ID, uri)
|
||||
if err != nil {
|
||||
return http.StatusNotAcceptable, "Invalid federated repo", err
|
||||
}
|
||||
followingRepos = append(followingRepos, &followingRepo)
|
||||
}
|
||||
|
||||
if err := repo.StoreFollowingRepos(ctx, localRepoID, followingRepos); err != nil {
|
||||
return 0, "", err
|
||||
}
|
||||
|
||||
return 0, "", nil
|
||||
}
|
||||
|
||||
func DeleteFollowingRepos(ctx context.Context, localRepoID int64) error {
|
||||
return repo.StoreFollowingRepos(ctx, localRepoID, []*repo.FollowingRepo{})
|
||||
}
|
||||
|
||||
func SendLikeActivities(ctx context.Context, doer user.User, repoID int64) error {
|
||||
followingRepos, err := repo.FindFollowingReposByRepoID(ctx, repoID)
|
||||
log.Info("Federated Repos is: %v", followingRepos)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
likeActivityList := make([]fm.ForgeLike, 0)
|
||||
for _, followingRepo := range followingRepos {
|
||||
log.Info("Found following repo: %v", followingRepo)
|
||||
target := followingRepo.URI
|
||||
likeActivity, err := fm.NewForgeLike(doer.APActorID(), target, time.Now())
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
likeActivityList = append(likeActivityList, likeActivity)
|
||||
}
|
||||
|
||||
apclientFactory, err := activitypub.GetClientFactory(ctx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
apclient, err := apclientFactory.WithKeys(ctx, &doer, doer.APActorKeyID())
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
for i, activity := range likeActivityList {
|
||||
activity.StartTime = activity.StartTime.Add(time.Duration(i) * time.Second)
|
||||
json, err := activity.MarshalJSON()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
_, err = apclient.Post(json, fmt.Sprintf("%s/inbox", activity.Object))
|
||||
if err != nil {
|
||||
log.Error("error %v while sending activity: %q", err, activity)
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
return newUser, federatedUser, nil
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue