git.squeep.com Git - akkoma/blob - lib/pleroma/web/plugs/mapped_signature_to_identity_plug.ex

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.Plugs.MappedSignatureToIdentityPlug do
   6   alias Pleroma.Helpers.AuthHelper
   7   alias Pleroma.Signature
   8   alias Pleroma.User
   9   alias Pleroma.Web.ActivityPub.Utils
  10
  11   import Plug.Conn
  12   require Logger
  13
  14   def init(options), do: options
  15
  16   def call(%{assigns: %{user: %User{}}} = conn, _opts), do: conn
  17
  18   # if this has payload make sure it is signed by the same actor that made it
  19   def call(%{assigns: %{valid_signature: true}, params: %{"actor" => actor}} = conn, _opts) do
  20     with actor_id <- Utils.get_ap_id(actor),
  21          {:user, %User{} = user} <- {:user, user_from_key_id(conn)},
  22          {:federate, true} <- {:federate, should_federate?(user)},
  23          {:user_match, true} <- {:user_match, user.ap_id == actor_id} do
  24       conn
  25       |> assign(:user, user)
  26       |> AuthHelper.skip_oauth()
  27     else
  28       {:user_match, false} ->
  29         Logger.debug("Failed to map identity from signature (payload actor mismatch)")
  30         Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}, actor=#{inspect(actor)}")
  31
  32         conn
  33         |> assign(:valid_signature, false)
  34
  35       # remove me once testsuite uses mapped capabilities instead of what we do now
  36       {:user, nil} ->
  37         Logger.debug("Failed to map identity from signature (lookup failure)")
  38         Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}, actor=#{actor}")
  39
  40         conn
  41         |> assign(:valid_signature, false)
  42
  43       {:federate, false} ->
  44         Logger.debug("Identity from signature is instance blocked")
  45         Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}, actor=#{actor}")
  46
  47         conn
  48         |> assign(:valid_signature, false)
  49     end
  50   end
  51
  52   # no payload, probably a signed fetch
  53   def call(%{assigns: %{valid_signature: true}} = conn, _opts) do
  54     with %User{} = user <- user_from_key_id(conn),
  55          {:federate, true} <- {:federate, should_federate?(user)} do
  56       conn
  57       |> assign(:user, user)
  58       |> AuthHelper.skip_oauth()
  59     else
  60       {:federate, false} ->
  61         Logger.debug("Identity from signature is instance blocked")
  62         Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}")
  63
  64         conn
  65         |> assign(:valid_signature, false)
  66
  67       nil ->
  68         Logger.debug("Failed to map identity from signature (lookup failure)")
  69         Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}")
  70
  71         only_permit_user_routes(conn)
  72
  73       _ ->
  74         Logger.debug("Failed to map identity from signature (no payload actor mismatch)")
  75         Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}")
  76
  77         conn
  78         |> assign(:valid_signature, false)
  79     end
  80   end
  81
  82   # no signature at all
  83   def call(conn, _opts), do: conn
  84
  85   defp only_permit_user_routes(%{path_info: ["users", _]} = conn) do
  86     conn
  87     |> assign(:limited_ap, true)
  88   end
  89
  90   defp only_permit_user_routes(conn) do
  91     conn
  92     |> assign(:valid_signature, false)
  93   end
  94
  95   defp key_id_from_conn(conn) do
  96     with %{"keyId" => key_id} <- HTTPSignatures.signature_for_conn(conn),
  97          {:ok, ap_id} <- Signature.key_id_to_actor_id(key_id) do
  98       ap_id
  99     else
 100       _ ->
 101         nil
 102     end
 103   end
 104
 105   defp user_from_key_id(conn) do
 106     with key_actor_id when is_binary(key_actor_id) <- key_id_from_conn(conn),
 107          {:ok, %User{} = user} <- User.get_or_fetch_by_ap_id(key_actor_id) do
 108       user
 109     else
 110       _ ->
 111         nil
 112     end
 113   end
 114
 115   defp should_federate?(%User{ap_id: ap_id}), do: should_federate?(ap_id)
 116
 117   defp should_federate?(ap_id) do
 118     if Pleroma.Config.get([:activitypub, :authorized_fetch_mode], false) do
 119       Pleroma.Web.ActivityPub.Publisher.should_federate?(ap_id)
 120     else
 121       true
 122     end
 123   end
 124 end