git.squeep.com Git - akkoma/blob - lib/pleroma/plugs/mapped_signature_to_identity_plug.ex

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.Plugs.MappedSignatureToIdentityPlug do
   6   alias Pleroma.Signature
   7   alias Pleroma.User
   8   alias Pleroma.Web.ActivityPub.Utils
   9
  10   import Plug.Conn
  11   require Logger
  12
  13   def init(options), do: options
  14
  15   defp key_id_from_conn(conn) do
  16     with %{"keyId" => key_id} <- HTTPSignatures.signature_for_conn(conn) do
  17       Signature.key_id_to_actor_id(key_id)
  18     else
  19       _ ->
  20         nil
  21     end
  22   end
  23
  24   defp user_from_key_id(conn) do
  25     with key_actor_id when is_binary(key_actor_id) <- key_id_from_conn(conn),
  26          {:ok, %User{} = user} <- User.get_or_fetch_by_ap_id(key_actor_id) do
  27       user
  28     else
  29       _ ->
  30         nil
  31     end
  32   end
  33
  34   def call(%{assigns: %{user: _}} = conn, _opts), do: conn
  35
  36   # if this has payload make sure it is signed by the same actor that made it
  37   def call(%{assigns: %{valid_signature: true}, params: %{"actor" => actor}} = conn, _opts) do
  38     with actor_id <- Utils.get_ap_id(actor),
  39          {:user, %User{} = user} <- {:user, user_from_key_id(conn)},
  40          {:user_match, true} <- {:user_match, user.ap_id == actor_id} do
  41       assign(conn, :user, user)
  42     else
  43       {:user_match, false} ->
  44         Logger.debug("Failed to map identity from signature (payload actor mismatch)")
  45         Logger.debug("key_id=#{key_id_from_conn(conn)}, actor=#{actor}")
  46         assign(conn, :valid_signature, false)
  47
  48       # remove me once testsuite uses mapped capabilities instead of what we do now
  49       {:user, nil} ->
  50         Logger.debug("Failed to map identity from signature (lookup failure)")
  51         Logger.debug("key_id=#{key_id_from_conn(conn)}, actor=#{actor}")
  52         conn
  53     end
  54   end
  55
  56   # no payload, probably a signed fetch
  57   def call(%{assigns: %{valid_signature: true}} = conn, _opts) do
  58     with %User{} = user <- user_from_key_id(conn) do
  59       assign(conn, :user, user)
  60     else
  61       _ ->
  62         Logger.debug("Failed to map identity from signature (no payload actor mismatch)")
  63         Logger.debug("key_id=#{key_id_from_conn(conn)}")
  64         assign(conn, :valid_signature, false)
  65     end
  66   end
  67
  68   # no signature at all
  69   def call(conn, _opts), do: conn
  70 end