X-Git-Url: http://git.squeep.com/?a=blobdiff_plain;f=lib%2Fpleroma%2Fweb%2Fplugs%2Fmapped_signature_to_identity_plug.ex;h=a73def682238430a62510287abc21584f863916b;hb=refs%2Fheads%2Fstable;hp=f44d4dee533b0bb7b2cd978b8b0662167fde8286;hpb=409f694e4f90d34285b43c7e7afc594bc386d893;p=akkoma
diff --git a/lib/pleroma/web/plugs/mapped_signature_to_identity_plug.ex b/lib/pleroma/web/plugs/mapped_signature_to_identity_plug.ex
index f44d4dee5..a73def682 100644
--- a/lib/pleroma/web/plugs/mapped_signature_to_identity_plug.ex
+++ b/lib/pleroma/web/plugs/mapped_signature_to_identity_plug.ex
@@ -1,8 +1,9 @@
# Pleroma: A lightweight social networking server
-# Copyright © 2017-2020 Pleroma Authors
+# Copyright © 2017-2021 Pleroma Authors
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Web.Plugs.MappedSignatureToIdentityPlug do
+ alias Pleroma.Helpers.AuthHelper
alias Pleroma.Signature
alias Pleroma.User
alias Pleroma.Web.ActivityPub.Utils
@@ -12,60 +13,112 @@ defmodule Pleroma.Web.Plugs.MappedSignatureToIdentityPlug do
def init(options), do: options
- defp key_id_from_conn(conn) do
- with %{"keyId" => key_id} <- HTTPSignatures.signature_for_conn(conn),
- {:ok, ap_id} <- Signature.key_id_to_actor_id(key_id) do
- ap_id
- else
- _ ->
- nil
- end
- end
-
- defp user_from_key_id(conn) do
- with key_actor_id when is_binary(key_actor_id) <- key_id_from_conn(conn),
- {:ok, %User{} = user} <- User.get_or_fetch_by_ap_id(key_actor_id) do
- user
- else
- _ ->
- nil
- end
- end
-
- def call(%{assigns: %{user: _}} = conn, _opts), do: conn
+ def call(%{assigns: %{user: %User{}}} = conn, _opts), do: conn
# if this has payload make sure it is signed by the same actor that made it
def call(%{assigns: %{valid_signature: true}, params: %{"actor" => actor}} = conn, _opts) do
with actor_id <- Utils.get_ap_id(actor),
{:user, %User{} = user} <- {:user, user_from_key_id(conn)},
+ {:federate, true} <- {:federate, should_federate?(user)},
{:user_match, true} <- {:user_match, user.ap_id == actor_id} do
- assign(conn, :user, user)
+ conn
+ |> assign(:user, user)
+ |> AuthHelper.skip_oauth()
else
{:user_match, false} ->
Logger.debug("Failed to map identity from signature (payload actor mismatch)")
Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}, actor=#{inspect(actor)}")
- assign(conn, :valid_signature, false)
+
+ conn
+ |> assign(:valid_signature, false)
# remove me once testsuite uses mapped capabilities instead of what we do now
{:user, nil} ->
Logger.debug("Failed to map identity from signature (lookup failure)")
Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}, actor=#{actor}")
+
+ conn
+ |> assign(:valid_signature, false)
+
+ {:federate, false} ->
+ Logger.debug("Identity from signature is instance blocked")
+ Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}, actor=#{actor}")
+
conn
+ |> assign(:valid_signature, false)
end
end
# no payload, probably a signed fetch
def call(%{assigns: %{valid_signature: true}} = conn, _opts) do
- with %User{} = user <- user_from_key_id(conn) do
- assign(conn, :user, user)
+ with %User{} = user <- user_from_key_id(conn),
+ {:federate, true} <- {:federate, should_federate?(user)} do
+ conn
+ |> assign(:user, user)
+ |> AuthHelper.skip_oauth()
else
+ {:federate, false} ->
+ Logger.debug("Identity from signature is instance blocked")
+ Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}")
+
+ conn
+ |> assign(:valid_signature, false)
+
+ nil ->
+ Logger.debug("Failed to map identity from signature (lookup failure)")
+ Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}")
+
+ only_permit_user_routes(conn)
+
_ ->
Logger.debug("Failed to map identity from signature (no payload actor mismatch)")
Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}")
- assign(conn, :valid_signature, false)
+
+ conn
+ |> assign(:valid_signature, false)
end
end
# no signature at all
def call(conn, _opts), do: conn
+
+ defp only_permit_user_routes(%{path_info: ["users", _]} = conn) do
+ conn
+ |> assign(:limited_ap, true)
+ end
+
+ defp only_permit_user_routes(conn) do
+ conn
+ |> assign(:valid_signature, false)
+ end
+
+ defp key_id_from_conn(conn) do
+ with %{"keyId" => key_id} <- HTTPSignatures.signature_for_conn(conn),
+ {:ok, ap_id} <- Signature.key_id_to_actor_id(key_id) do
+ ap_id
+ else
+ _ ->
+ nil
+ end
+ end
+
+ defp user_from_key_id(conn) do
+ with key_actor_id when is_binary(key_actor_id) <- key_id_from_conn(conn),
+ {:ok, %User{} = user} <- User.get_or_fetch_by_ap_id(key_actor_id) do
+ user
+ else
+ _ ->
+ nil
+ end
+ end
+
+ defp should_federate?(%User{ap_id: ap_id}), do: should_federate?(ap_id)
+
+ defp should_federate?(ap_id) do
+ if Pleroma.Config.get([:activitypub, :authorized_fetch_mode], false) do
+ Pleroma.Web.ActivityPub.Publisher.should_federate?(ap_id)
+ else
+ true
+ end
+ end
end