1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.Plugs.MappedSignatureToIdentityPlug do
6 alias Pleroma.Signature
8 alias Pleroma.Web.ActivityPub.Utils
13 def init(options), do: options
15 defp key_id_from_conn(conn) do
16 with %{"keyId" => key_id} <- HTTPSignatures.signature_for_conn(conn) do
17 Signature.key_id_to_actor_id(key_id)
24 defp user_from_key_id(conn) do
25 with key_actor_id when is_binary(key_actor_id) <- key_id_from_conn(conn),
26 {:ok, %User{} = user} <- User.get_or_fetch_by_ap_id(key_actor_id) do
34 def call(%{assigns: %{user: _}} = conn, _opts), do: conn
36 # if this has payload make sure it is signed by the same actor that made it
37 def call(%{assigns: %{valid_signature: true}, params: %{"actor" => actor}} = conn, _opts) do
38 with actor_id <- Utils.get_ap_id(actor),
39 {:user, %User{} = user} <- {:user, user_from_key_id(conn)},
40 {:user_match, true} <- {:user_match, user.ap_id == actor_id} do
41 assign(conn, :user, user)
43 {:user_match, false} ->
44 Logger.debug("Failed to map identity from signature (payload actor mismatch)")
45 Logger.debug("key_id=#{key_id_from_conn(conn)}, actor=#{actor}")
46 assign(conn, :valid_signature, false)
48 # remove me once testsuite uses mapped capabilities instead of what we do now
50 Logger.debug("Failed to map identity from signature (lookup failure)")
51 Logger.debug("key_id=#{key_id_from_conn(conn)}, actor=#{actor}")
56 # no payload, probably a signed fetch
57 def call(%{assigns: %{valid_signature: true}} = conn, _opts) do
58 with %User{} = user <- user_from_key_id(conn) do
59 assign(conn, :user, user)
62 Logger.debug("Failed to map identity from signature (no payload actor mismatch)")
63 Logger.debug("key_id=#{key_id_from_conn(conn)}")
64 assign(conn, :valid_signature, false)
69 def call(conn, _opts), do: conn