HTTP signatures respect allowlist federation

[akkoma] / lib / pleroma / web / activity_pub / publisher.ex

diff --git a/lib/pleroma/web/activity_pub/publisher.ex b/lib/pleroma/web/activity_pub/publisher.ex
index b12b2fc24a82e74a68747223eb93842c03c0d92c..3071c1b770593a8fe3702b2bad336285a169935f 100644 (file)
--- a/lib/pleroma/web/activity_pub/publisher.ex
+++ b/lib/pleroma/web/activity_pub/publisher.ex
@@ -63,18 +63,17 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
         date: date
       })
 
-    with {:ok, %{status: code}} when code in 200..299 <-
-           result =
-             HTTP.post(
-               inbox,
-               json,
-               [
-                 {"Content-Type", "application/activity+json"},
-                 {"Date", date},
-                 {"signature", signature},
-                 {"digest", digest}
-               ]
-             ) do
+    with {:ok, %{status: code}} = result when code in 200..299 <-
+           HTTP.post(
+             inbox,
+             json,
+             [
+               {"Content-Type", "application/activity+json"},
+               {"Date", date},
+               {"signature", signature},
+               {"digest", digest}
+             ]
+           ) do
       if not Map.has_key?(params, :unreachable_since) || params[:unreachable_since] do
         Instances.set_reachable(inbox)
       end
@@ -104,17 +103,32 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
     end
   end
 
-  defp should_federate?(inbox, public) do
-    if public do
-      true
-    else
-      %{host: host} = URI.parse(inbox)
+  defp blocked_instances do
+    Config.get([:instance, :quarantined_instances], []) ++
+      Config.get([:mrf_simple, :reject], [])
+  end
+
+  defp allowed_instances do
+    Config.get([:mrf_simple, :accept])
+  end
+
+  def should_federate?(url) do
+    %{host: host} = URI.parse(url)
 
-      quarantined_instances =
-        Config.get([:instance, :quarantined_instances], [])
-        |> Pleroma.Web.ActivityPub.MRF.subdomains_regex()
+    with allowed <- allowed_instances(),
+         false <- Enum.empty?(allowed) do
+      allowed
+      |> Pleroma.Web.ActivityPub.MRF.instance_list_from_tuples()
+      |> Pleroma.Web.ActivityPub.MRF.subdomains_regex()
+      |> Pleroma.Web.ActivityPub.MRF.subdomain_match?(host)
+    else
+      _ ->
+        quarantined_instances =
+          blocked_instances()
+          |> Pleroma.Web.ActivityPub.MRF.instance_list_from_tuples()
+          |> Pleroma.Web.ActivityPub.MRF.subdomains_regex()
 
-      !Pleroma.Web.ActivityPub.MRF.subdomain_match?(quarantined_instances, host)
+        not Pleroma.Web.ActivityPub.MRF.subdomain_match?(quarantined_instances, host)
     end
   end
 
@@ -192,7 +206,6 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
 
   def publish(%User{} = actor, %{data: %{"bcc" => bcc}} = activity)
       when is_list(bcc) and bcc != [] do
-    public = is_public?(activity)
     {:ok, data} = Transmogrifier.prepare_outgoing(activity.data)
 
     recipients = recipients(actor, activity)
@@ -201,7 +214,7 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
       recipients
       |> Enum.filter(&User.ap_enabled?/1)
       |> Enum.map(fn actor -> actor.inbox end)
-      |> Enum.filter(fn inbox -> should_federate?(inbox, public) end)
+      |> Enum.filter(fn inbox -> should_federate?(inbox) end)
       |> Instances.filter_reachable()
 
     Repo.checkout(fn ->
@@ -246,7 +259,7 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
       determine_inbox(activity, user)
     end)
     |> Enum.uniq()
-    |> Enum.filter(fn inbox -> should_federate?(inbox, public) end)
+    |> Enum.filter(fn inbox -> should_federate?(inbox) end)
     |> Instances.filter_reachable()
     |> Enum.each(fn {inbox, unreachable_since} ->
       Pleroma.Web.Federator.Publisher.enqueue_one(
@@ -272,7 +285,7 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
       },
       %{
         "rel" => "http://ostatus.org/schema/1.0/subscribe",
-        "template" => "#{Pleroma.Web.base_url()}/ostatus_subscribe?acct={uri}"
+        "template" => "#{Pleroma.Web.Endpoint.url()}/ostatus_subscribe?acct={uri}"
       }
     ]
   end