Merge branch 'fix/access-mastofe-auth-on-private-instances' into 'develop'

[akkoma] / lib / pleroma / object / fetcher.ex

diff --git a/lib/pleroma/object/fetcher.ex b/lib/pleroma/object/fetcher.ex
index 14454ce9d4d3dd82d648d39e2346854b022526b6..305ce835702b9a279318033c641572971cb31e85 100644 (file)
--- a/lib/pleroma/object/fetcher.ex
+++ b/lib/pleroma/object/fetcher.ex
@@ -6,6 +6,8 @@ defmodule Pleroma.Object.Fetcher do
   alias Pleroma.HTTP
   alias Pleroma.Object
   alias Pleroma.Object.Containment
+  alias Pleroma.Signature
+  alias Pleroma.Web.ActivityPub.InternalFetchActor
   alias Pleroma.Web.ActivityPub.Transmogrifier
   alias Pleroma.Web.OStatus
 
@@ -31,43 +33,36 @@ defmodule Pleroma.Object.Fetcher do
       {:ok, object}
     else
       Logger.info("Fetching #{id} via AP")
-      {status, data} = fetch_and_contain_remote_object_from_id(id)
-      object = Object.normalize(data, false)
-
-      if status == :ok and object == nil do
-        with params <- %{
-               "type" => "Create",
-               "to" => data["to"],
-               "cc" => data["cc"],
-               # Should we seriously keep this attributedTo thing?
-               "actor" => data["actor"] || data["attributedTo"],
-               "object" => data
-             },
-             :ok <- Containment.contain_origin(id, params),
-             {:ok, activity} <- Transmogrifier.handle_incoming(params, options),
-             {:object, _data, %Object{} = object} <-
-               {:object, data, Object.normalize(activity, false)} do
-          {:ok, object}
-        else
-          {:error, {:reject, nil}} ->
-            {:reject, nil}
 
-          {:object, data, nil} ->
-            reinject_object(data)
+      with {:fetch, {:ok, data}} <- {:fetch, fetch_and_contain_remote_object_from_id(id)},
+           {:normalize, nil} <- {:normalize, Object.normalize(data, false)},
+           params <- %{
+             "type" => "Create",
+             "to" => data["to"],
+             "cc" => data["cc"],
+             # Should we seriously keep this attributedTo thing?
+             "actor" => data["actor"] || data["attributedTo"],
+             "object" => data
+           },
+           {:containment, :ok} <- {:containment, Containment.contain_origin(id, params)},
+           {:ok, activity} <- Transmogrifier.handle_incoming(params, options),
+           {:object, _data, %Object{} = object} <-
+             {:object, data, Object.normalize(activity, false)} do
+        {:ok, object}
+      else
+        {:containment, _} ->
+          {:error, "Object containment failed."}
 
-          object = %Object{} ->
-            {:ok, object}
+        {:error, {:reject, nil}} ->
+          {:reject, nil}
 
-          :error ->
-            {:error, "Object containment failed."}
+        {:object, data, nil} ->
+          reinject_object(data)
 
-          e ->
-            e
-        end
-      else
-        if status == :ok and object != nil do
+        {:normalize, object = %Object{}} ->
           {:ok, object}
-        else
+
+        _e ->
           # Only fallback when receiving a fetch/normalization error with ActivityPub
           Logger.info("Couldn't get object via AP, trying out OStatus fetching...")
 
@@ -76,7 +71,6 @@ defmodule Pleroma.Object.Fetcher do
             {:ok, [activity | _]} -> {:ok, Object.normalize(activity, false)}
             e -> e
           end
-        end
       end
     end
   end
@@ -90,15 +84,52 @@ defmodule Pleroma.Object.Fetcher do
     end
   end
 
+  defp make_signature(id, date) do
+    uri = URI.parse(id)
+
+    signature =
+      InternalFetchActor.get_actor()
+      |> Signature.sign(%{
+        "(request-target)": "get #{uri.path}",
+        host: uri.host,
+        date: date
+      })
+
+    [{:Signature, signature}]
+  end
+
+  defp sign_fetch(headers, id, date) do
+    if Pleroma.Config.get([:activitypub, :sign_object_fetches]) do
+      headers ++ make_signature(id, date)
+    else
+      headers
+    end
+  end
+
+  defp maybe_date_fetch(headers, date) do
+    if Pleroma.Config.get([:activitypub, :sign_object_fetches]) do
+      headers ++ [{:Date, date}]
+    else
+      headers
+    end
+  end
+
   def fetch_and_contain_remote_object_from_id(id) do
     Logger.info("Fetching object #{id} via AP")
 
+    date =
+      NaiveDateTime.utc_now()
+      |> Timex.format!("{WDshort}, {0D} {Mshort} {YYYY} {h24}:{m}:{s} GMT")
+
+    headers =
+      [{:Accept, "application/activity+json"}]
+      |> maybe_date_fetch(date)
+      |> sign_fetch(id, date)
+
+    Logger.debug("Fetch headers: #{inspect(headers)}")
+
     with true <- String.starts_with?(id, "http"),
-         {:ok, %{body: body, status: code}} when code in 200..299 <-
-           HTTP.get(
-             id,
-             [{:Accept, "application/activity+json"}]
-           ),
+         {:ok, %{body: body, status: code}} when code in 200..299 <- HTTP.get(id, headers),
          {:ok, data} <- Jason.decode(body),
          :ok <- Containment.contain_origin_from_id(id, data) do
       {:ok, data}