git.squeep.com Git - akkoma/blob - lib/pleroma/web/plugs/mapped_signature_to_identity_plug.ex

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.Plugs.MappedSignatureToIdentityPlug do
   6   alias Pleroma.Signature
   7   alias Pleroma.User
   8   alias Pleroma.Web.ActivityPub.Utils
   9
  10   import Plug.Conn
  11   require Logger
  12
  13   def init(options), do: options
  14
  15   defp key_id_from_conn(conn) do
  16     with %{"keyId" => key_id} <- HTTPSignatures.signature_for_conn(conn),
  17          {:ok, ap_id} <- Signature.key_id_to_actor_id(key_id) do
  18       ap_id
  19     else
  20       _ ->
  21         nil
  22     end
  23   end
  24
  25   defp user_from_key_id(conn) do
  26     with key_actor_id when is_binary(key_actor_id) <- key_id_from_conn(conn),
  27          {:ok, %User{} = user} <- User.get_or_fetch_by_ap_id(key_actor_id) do
  28       user
  29     else
  30       _ ->
  31         nil
  32     end
  33   end
  34
  35   def call(%{assigns: %{user: _}} = conn, _opts), do: conn
  36
  37   # if this has payload make sure it is signed by the same actor that made it
  38   def call(%{assigns: %{valid_signature: true}, params: %{"actor" => actor}} = conn, _opts) do
  39     with actor_id <- Utils.get_ap_id(actor),
  40          {:user, %User{} = user} <- {:user, user_from_key_id(conn)},
  41          {:user_match, true} <- {:user_match, user.ap_id == actor_id} do
  42       assign(conn, :user, user)
  43     else
  44       {:user_match, false} ->
  45         Logger.debug("Failed to map identity from signature (payload actor mismatch)")
  46         Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}, actor=#{inspect(actor)}")
  47         assign(conn, :valid_signature, false)
  48
  49       # remove me once testsuite uses mapped capabilities instead of what we do now
  50       {:user, nil} ->
  51         Logger.debug("Failed to map identity from signature (lookup failure)")
  52         Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}, actor=#{actor}")
  53         conn
  54     end
  55   end
  56
  57   # no payload, probably a signed fetch
  58   def call(%{assigns: %{valid_signature: true}} = conn, _opts) do
  59     with %User{} = user <- user_from_key_id(conn) do
  60       assign(conn, :user, user)
  61     else
  62       _ ->
  63         Logger.debug("Failed to map identity from signature (no payload actor mismatch)")
  64         Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}")
  65         assign(conn, :valid_signature, false)
  66     end
  67   end
  68
  69   # no signature at all
  70   def call(conn, _opts), do: conn
  71 end