git.squeep.com Git - akkoma/blob - lib/pleroma/web/activity_pub/activity_pub_controller.ex

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.ActivityPub.ActivityPubController do
   6   use Pleroma.Web, :controller
   7
   8   alias Pleroma.Activity
   9   alias Pleroma.Delivery
  10   alias Pleroma.Object
  11   alias Pleroma.Object.Fetcher
  12   alias Pleroma.User
  13   alias Pleroma.Web.ActivityPub.ActivityPub
  14   alias Pleroma.Web.ActivityPub.Builder
  15   alias Pleroma.Web.ActivityPub.InternalFetchActor
  16   alias Pleroma.Web.ActivityPub.ObjectView
  17   alias Pleroma.Web.ActivityPub.Pipeline
  18   alias Pleroma.Web.ActivityPub.Relay
  19   alias Pleroma.Web.ActivityPub.Transmogrifier
  20   alias Pleroma.Web.ActivityPub.UserView
  21   alias Pleroma.Web.ActivityPub.Utils
  22   alias Pleroma.Web.ActivityPub.Visibility
  23   alias Pleroma.Web.ControllerHelper
  24   alias Pleroma.Web.Endpoint
  25   alias Pleroma.Web.Federator
  26   alias Pleroma.Web.Plugs.EnsureAuthenticatedPlug
  27   alias Pleroma.Web.Plugs.FederatingPlug
  28
  29   require Logger
  30
  31   action_fallback(:errors)
  32
  33   @federating_only_actions [:internal_fetch, :relay, :relay_following, :relay_followers]
  34
  35   plug(FederatingPlug when action in @federating_only_actions)
  36
  37   plug(
  38     EnsureAuthenticatedPlug,
  39     [unless_func: &FederatingPlug.federating?/1] when action not in @federating_only_actions
  40   )
  41
  42   # Note: :following and :followers must be served even without authentication (as via :api)
  43   plug(
  44     EnsureAuthenticatedPlug
  45     when action in [:read_inbox, :update_outbox, :whoami, :upload_media]
  46   )
  47
  48   plug(Majic.Plug, [pool: Pleroma.MajicPool] when action in [:upload_media])
  49
  50   plug(
  51     Pleroma.Web.Plugs.Cache,
  52     [query_params: false, tracking_fun: &__MODULE__.track_object_fetch/2]
  53     when action in [:activity, :object]
  54   )
  55
  56   plug(:set_requester_reachable when action in [:inbox])
  57   plug(:relay_active? when action in [:relay])
  58
  59   defp relay_active?(conn, _) do
  60     if Pleroma.Config.get([:instance, :allow_relay]) do
  61       conn
  62     else
  63       conn
  64       |> render_error(:not_found, "not found")
  65       |> halt()
  66     end
  67   end
  68
  69   def user(conn, %{"nickname" => nickname}) do
  70     with %User{local: true} = user <- User.get_cached_by_nickname(nickname),
  71          {:ok, user} <- User.ensure_keys_present(user) do
  72       conn
  73       |> put_resp_content_type("application/activity+json")
  74       |> put_view(UserView)
  75       |> render("user.json", %{user: user})
  76     else
  77       nil -> {:error, :not_found}
  78       %{local: false} -> {:error, :not_found}
  79     end
  80   end
  81
  82   def object(%{assigns: assigns} = conn, _) do
  83     with ap_id <- Endpoint.url() <> conn.request_path,
  84          %Object{} = object <- Object.get_cached_by_ap_id(ap_id),
  85          user <- Map.get(assigns, :user, nil),
  86          {_, true} <- {:visible?, Visibility.visible_for_user?(object, user)} do
  87       conn
  88       |> assign(:tracking_fun_data, object.id)
  89       |> set_cache_ttl_for(object)
  90       |> put_resp_content_type("application/activity+json")
  91       |> put_view(ObjectView)
  92       |> render("object.json", object: object)
  93     else
  94       {:visible?, false} -> {:error, :not_found}
  95       nil -> {:error, :not_found}
  96     end
  97   end
  98
  99   def track_object_fetch(conn, nil), do: conn
 100
 101   def track_object_fetch(conn, object_id) do
 102     with %{assigns: %{user: %User{id: user_id}}} <- conn do
 103       Delivery.create(object_id, user_id)
 104     end
 105
 106     conn
 107   end
 108
 109   def activity(%{assigns: assigns} = conn, _) do
 110     with ap_id <- Endpoint.url() <> conn.request_path,
 111          %Activity{} = activity <- Activity.normalize(ap_id),
 112          {_, true} <- {:local?, activity.local},
 113          user <- Map.get(assigns, :user, nil),
 114          {_, true} <- {:visible?, Visibility.visible_for_user?(activity, user)} do
 115       conn
 116       |> maybe_set_tracking_data(activity)
 117       |> set_cache_ttl_for(activity)
 118       |> put_resp_content_type("application/activity+json")
 119       |> put_view(ObjectView)
 120       |> render("object.json", object: activity)
 121     else
 122       {:visible?, false} -> {:error, :not_found}
 123       {:local?, false} -> {:error, :not_found}
 124       nil -> {:error, :not_found}
 125     end
 126   end
 127
 128   defp maybe_set_tracking_data(conn, %Activity{data: %{"type" => "Create"}} = activity) do
 129     object_id = Object.normalize(activity, fetch: false).id
 130     assign(conn, :tracking_fun_data, object_id)
 131   end
 132
 133   defp maybe_set_tracking_data(conn, _activity), do: conn
 134
 135   defp set_cache_ttl_for(conn, %Activity{object: object}) do
 136     set_cache_ttl_for(conn, object)
 137   end
 138
 139   defp set_cache_ttl_for(conn, entity) do
 140     ttl =
 141       case entity do
 142         %Object{data: %{"type" => "Question"}} ->
 143           Pleroma.Config.get([:web_cache_ttl, :activity_pub_question])
 144
 145         %Object{} ->
 146           Pleroma.Config.get([:web_cache_ttl, :activity_pub])
 147
 148         _ ->
 149           nil
 150       end
 151
 152     assign(conn, :cache_ttl, ttl)
 153   end
 154
 155   # GET /relay/following
 156   def relay_following(conn, _params) do
 157     with %{halted: false} = conn <- FederatingPlug.call(conn, []) do
 158       conn
 159       |> put_resp_content_type("application/activity+json")
 160       |> put_view(UserView)
 161       |> render("following.json", %{user: Relay.get_actor()})
 162     end
 163   end
 164
 165   def following(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname, "page" => page}) do
 166     with %User{} = user <- User.get_cached_by_nickname(nickname),
 167          {user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user),
 168          {:show_follows, true} <-
 169            {:show_follows, (for_user && for_user == user) || !user.hide_follows} do
 170       {page, _} = Integer.parse(page)
 171
 172       conn
 173       |> put_resp_content_type("application/activity+json")
 174       |> put_view(UserView)
 175       |> render("following.json", %{user: user, page: page, for: for_user})
 176     else
 177       {:show_follows, _} ->
 178         conn
 179         |> put_resp_content_type("application/activity+json")
 180         |> send_resp(403, "")
 181     end
 182   end
 183
 184   def following(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname}) do
 185     with %User{} = user <- User.get_cached_by_nickname(nickname),
 186          {user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) do
 187       conn
 188       |> put_resp_content_type("application/activity+json")
 189       |> put_view(UserView)
 190       |> render("following.json", %{user: user, for: for_user})
 191     end
 192   end
 193
 194   # GET /relay/followers
 195   def relay_followers(conn, _params) do
 196     with %{halted: false} = conn <- FederatingPlug.call(conn, []) do
 197       conn
 198       |> put_resp_content_type("application/activity+json")
 199       |> put_view(UserView)
 200       |> render("followers.json", %{user: Relay.get_actor()})
 201     end
 202   end
 203
 204   def followers(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname, "page" => page}) do
 205     with %User{} = user <- User.get_cached_by_nickname(nickname),
 206          {user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user),
 207          {:show_followers, true} <-
 208            {:show_followers, (for_user && for_user == user) || !user.hide_followers} do
 209       {page, _} = Integer.parse(page)
 210
 211       conn
 212       |> put_resp_content_type("application/activity+json")
 213       |> put_view(UserView)
 214       |> render("followers.json", %{user: user, page: page, for: for_user})
 215     else
 216       {:show_followers, _} ->
 217         conn
 218         |> put_resp_content_type("application/activity+json")
 219         |> send_resp(403, "")
 220     end
 221   end
 222
 223   def followers(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname}) do
 224     with %User{} = user <- User.get_cached_by_nickname(nickname),
 225          {user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) do
 226       conn
 227       |> put_resp_content_type("application/activity+json")
 228       |> put_view(UserView)
 229       |> render("followers.json", %{user: user, for: for_user})
 230     end
 231   end
 232
 233   def outbox(
 234         %{assigns: %{user: for_user}} = conn,
 235         %{"nickname" => nickname, "page" => page?} = params
 236       )
 237       when page? in [true, "true"] do
 238     with %User{} = user <- User.get_cached_by_nickname(nickname),
 239          {:ok, user} <- User.ensure_keys_present(user) do
 240       # "include_poll_votes" is a hack because postgres generates inefficient
 241       # queries when filtering by 'Answer', poll votes will be hidden by the
 242       # visibility filter in this case anyway
 243       params =
 244         params
 245         |> Map.drop(["nickname", "page"])
 246         |> Map.put("include_poll_votes", true)
 247         |> Map.new(fn {k, v} -> {String.to_existing_atom(k), v} end)
 248
 249       activities = ActivityPub.fetch_user_activities(user, for_user, params)
 250
 251       conn
 252       |> put_resp_content_type("application/activity+json")
 253       |> put_view(UserView)
 254       |> render("activity_collection_page.json", %{
 255         activities: activities,
 256         pagination: ControllerHelper.get_pagination_fields(conn, activities),
 257         iri: "#{user.ap_id}/outbox"
 258       })
 259     end
 260   end
 261
 262   def outbox(conn, %{"nickname" => nickname}) do
 263     with %User{} = user <- User.get_cached_by_nickname(nickname),
 264          {:ok, user} <- User.ensure_keys_present(user) do
 265       conn
 266       |> put_resp_content_type("application/activity+json")
 267       |> put_view(UserView)
 268       |> render("activity_collection.json", %{iri: "#{user.ap_id}/outbox"})
 269     end
 270   end
 271
 272   def inbox(%{assigns: %{valid_signature: true}} = conn, %{"nickname" => nickname} = params) do
 273     with %User{} = recipient <- User.get_cached_by_nickname(nickname),
 274          {:ok, %User{} = actor} <- User.get_or_fetch_by_ap_id(params["actor"]),
 275          true <- Utils.recipient_in_message(recipient, actor, params),
 276          params <- Utils.maybe_splice_recipient(recipient.ap_id, params) do
 277       Federator.incoming_ap_doc(params)
 278       json(conn, "ok")
 279     end
 280   end
 281
 282   def inbox(%{assigns: %{valid_signature: true}} = conn, params) do
 283     Federator.incoming_ap_doc(params)
 284     json(conn, "ok")
 285   end
 286
 287   # POST /relay/inbox -or- POST /internal/fetch/inbox
 288   def inbox(conn, params) do
 289     if params["type"] == "Create" && FederatingPlug.federating?() do
 290       post_inbox_relayed_create(conn, params)
 291     else
 292       post_inbox_fallback(conn, params)
 293     end
 294   end
 295
 296   defp post_inbox_relayed_create(conn, params) do
 297     Logger.debug(
 298       "Signature missing or not from author, relayed Create message, fetching object from source"
 299     )
 300
 301     Fetcher.fetch_object_from_id(params["object"]["id"])
 302
 303     json(conn, "ok")
 304   end
 305
 306   defp post_inbox_fallback(conn, params) do
 307     headers = Enum.into(conn.req_headers, %{})
 308
 309     if headers["signature"] && params["actor"] &&
 310          String.contains?(headers["signature"], params["actor"]) do
 311       Logger.debug(
 312         "Signature validation error for: #{params["actor"]}, make sure you are forwarding the HTTP Host header!"
 313       )
 314
 315       Logger.debug(inspect(conn.req_headers))
 316     end
 317
 318     conn
 319     |> put_status(:bad_request)
 320     |> json(dgettext("errors", "error"))
 321   end
 322
 323   defp represent_service_actor(%User{} = user, conn) do
 324     with {:ok, user} <- User.ensure_keys_present(user) do
 325       conn
 326       |> put_resp_content_type("application/activity+json")
 327       |> put_view(UserView)
 328       |> render("user.json", %{user: user})
 329     else
 330       nil -> {:error, :not_found}
 331     end
 332   end
 333
 334   defp represent_service_actor(nil, _), do: {:error, :not_found}
 335
 336   def relay(conn, _params) do
 337     Relay.get_actor()
 338     |> represent_service_actor(conn)
 339   end
 340
 341   def internal_fetch(conn, _params) do
 342     InternalFetchActor.get_actor()
 343     |> represent_service_actor(conn)
 344   end
 345
 346   @doc "Returns the authenticated user's ActivityPub User object or a 404 Not Found if non-authenticated"
 347   def whoami(%{assigns: %{user: %User{} = user}} = conn, _params) do
 348     conn
 349     |> put_resp_content_type("application/activity+json")
 350     |> put_view(UserView)
 351     |> render("user.json", %{user: user})
 352   end
 353
 354   def read_inbox(
 355         %{assigns: %{user: %User{nickname: nickname} = user}} = conn,
 356         %{"nickname" => nickname, "page" => page?} = params
 357       )
 358       when page? in [true, "true"] do
 359     params =
 360       params
 361       |> Map.drop(["nickname", "page"])
 362       |> Map.put("blocking_user", user)
 363       |> Map.put("user", user)
 364       |> Map.new(fn {k, v} -> {String.to_existing_atom(k), v} end)
 365
 366     activities =
 367       [user.ap_id | User.following(user)]
 368       |> ActivityPub.fetch_activities(params)
 369       |> Enum.reverse()
 370
 371     conn
 372     |> put_resp_content_type("application/activity+json")
 373     |> put_view(UserView)
 374     |> render("activity_collection_page.json", %{
 375       activities: activities,
 376       pagination: ControllerHelper.get_pagination_fields(conn, activities),
 377       iri: "#{user.ap_id}/inbox"
 378     })
 379   end
 380
 381   def read_inbox(%{assigns: %{user: %User{nickname: nickname} = user}} = conn, %{
 382         "nickname" => nickname
 383       }) do
 384     with {:ok, user} <- User.ensure_keys_present(user) do
 385       conn
 386       |> put_resp_content_type("application/activity+json")
 387       |> put_view(UserView)
 388       |> render("activity_collection.json", %{iri: "#{user.ap_id}/inbox"})
 389     end
 390   end
 391
 392   def read_inbox(%{assigns: %{user: %User{nickname: as_nickname}}} = conn, %{
 393         "nickname" => nickname
 394       }) do
 395     err =
 396       dgettext("errors", "can't read inbox of %{nickname} as %{as_nickname}",
 397         nickname: nickname,
 398         as_nickname: as_nickname
 399       )
 400
 401     conn
 402     |> put_status(:forbidden)
 403     |> json(err)
 404   end
 405
 406   defp handle_user_activity(
 407          %User{} = user,
 408          %{"type" => "Create", "object" => %{"type" => "Note"} = object} = params
 409        ) do
 410     content = if is_binary(object["content"]), do: object["content"], else: ""
 411     name = if is_binary(object["name"]), do: object["name"], else: ""
 412     summary = if is_binary(object["summary"]), do: object["summary"], else: ""
 413     length = String.length(content <> name <> summary)
 414
 415     if length > Pleroma.Config.get([:instance, :limit]) do
 416       {:error, dgettext("errors", "Note is over the character limit")}
 417     else
 418       object =
 419         object
 420         |> Map.merge(Map.take(params, ["to", "cc"]))
 421         |> Map.put("attributedTo", user.ap_id)
 422         |> Transmogrifier.fix_object()
 423
 424       ActivityPub.create(%{
 425         to: params["to"],
 426         actor: user,
 427         context: object["context"],
 428         object: object,
 429         additional: Map.take(params, ["cc"])
 430       })
 431     end
 432   end
 433
 434   defp handle_user_activity(%User{} = user, %{"type" => "Delete"} = params) do
 435     with %Object{} = object <- Object.normalize(params["object"], fetch: false),
 436          true <- user.is_moderator || user.ap_id == object.data["actor"],
 437          {:ok, delete_data, _} <- Builder.delete(user, object.data["id"]),
 438          {:ok, delete, _} <- Pipeline.common_pipeline(delete_data, local: true) do
 439       {:ok, delete}
 440     else
 441       _ -> {:error, dgettext("errors", "Can't delete object")}
 442     end
 443   end
 444
 445   defp handle_user_activity(%User{} = user, %{"type" => "Like"} = params) do
 446     with %Object{} = object <- Object.normalize(params["object"], fetch: false),
 447          {_, {:ok, like_object, meta}} <- {:build_object, Builder.like(user, object)},
 448          {_, {:ok, %Activity{} = activity, _meta}} <-
 449            {:common_pipeline,
 450             Pipeline.common_pipeline(like_object, Keyword.put(meta, :local, true))} do
 451       {:ok, activity}
 452     else
 453       _ -> {:error, dgettext("errors", "Can't like object")}
 454     end
 455   end
 456
 457   defp handle_user_activity(_, _) do
 458     {:error, dgettext("errors", "Unhandled activity type")}
 459   end
 460
 461   def update_outbox(
 462         %{assigns: %{user: %User{nickname: nickname} = user}} = conn,
 463         %{"nickname" => nickname} = params
 464       ) do
 465     actor = user.ap_id
 466
 467     params =
 468       params
 469       |> Map.drop(["id"])
 470       |> Map.put("actor", actor)
 471       |> Transmogrifier.fix_addressing()
 472
 473     with {:ok, %Activity{} = activity} <- handle_user_activity(user, params) do
 474       conn
 475       |> put_status(:created)
 476       |> put_resp_header("location", activity.data["id"])
 477       |> json(activity.data)
 478     else
 479       {:error, message} ->
 480         conn
 481         |> put_status(:bad_request)
 482         |> json(message)
 483     end
 484   end
 485
 486   def update_outbox(%{assigns: %{user: %User{} = user}} = conn, %{"nickname" => nickname}) do
 487     err =
 488       dgettext("errors", "can't update outbox of %{nickname} as %{as_nickname}",
 489         nickname: nickname,
 490         as_nickname: user.nickname
 491       )
 492
 493     conn
 494     |> put_status(:forbidden)
 495     |> json(err)
 496   end
 497
 498   defp errors(conn, {:error, :not_found}) do
 499     conn
 500     |> put_status(:not_found)
 501     |> json(dgettext("errors", "Not found"))
 502   end
 503
 504   defp errors(conn, _e) do
 505     conn
 506     |> put_status(:internal_server_error)
 507     |> json(dgettext("errors", "error"))
 508   end
 509
 510   defp set_requester_reachable(%Plug.Conn{} = conn, _) do
 511     with actor <- conn.params["actor"],
 512          true <- is_binary(actor) do
 513       Pleroma.Instances.set_reachable(actor)
 514     end
 515
 516     conn
 517   end
 518
 519   defp ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) do
 520     {:ok, new_user} = User.ensure_keys_present(user)
 521
 522     for_user =
 523       if new_user != user and match?(%User{}, for_user) do
 524         User.get_cached_by_nickname(for_user.nickname)
 525       else
 526         for_user
 527       end
 528
 529     {new_user, for_user}
 530   end
 531
 532   def upload_media(%{assigns: %{user: %User{} = user}} = conn, %{"file" => file} = data) do
 533     with {:ok, object} <-
 534            ActivityPub.upload(
 535              file,
 536              actor: User.ap_id(user),
 537              description: Map.get(data, "description")
 538            ) do
 539       Logger.debug(inspect(object))
 540
 541       conn
 542       |> put_status(:created)
 543       |> json(object.data)
 544     end
 545   end
 546
 547   def pinned(conn, %{"nickname" => nickname}) do
 548     with %User{} = user <- User.get_cached_by_nickname(nickname) do
 549       conn
 550       |> put_resp_header("content-type", "application/activity+json")
 551       |> json(UserView.render("featured.json", %{user: user}))
 552     end
 553   end
 554 end