Commit graph

639 commits

Author SHA1 Message Date
fr33domlover
2eade80cfb Rewrite the localMessageCreate migration to insert real activities
A thing still missing there is that it sets empty audience for comments on
remote tickets, but that's fine because dev.angeley.es doesn't have such
comments in the database.
2019-05-25 12:44:09 +00:00
fr33domlover
e81eb80b8b Add field localMessageCreate, pointing to the OutboxItem that created it
I added a migration that creates an ugly fake OutboxItem for messages that
don't have one. I'll try to turn it into a real one. And then very possibly
remove the whole ugly migration, replacing it with addFielfRefRequiredEmpty,
which should work for empty instances.
2019-05-25 03:23:57 +00:00
fr33domlover
d77877eba5 In persistent models for migrations, suffix the names of uniques too 2019-05-25 03:20:01 +00:00
fr33domlover
5479c99e1c Serve trivial HTML (that just displays the JSON object) in getMessageR 2019-05-24 16:09:58 +00:00
fr33domlover
bd99729656 Loading settings was using deprecated functions, switch to new ones 2019-05-24 15:45:36 +00:00
fr33domlover
23e760e373 Build with LTS 13, GHC 8.6 2019-05-24 11:49:39 +00:00
fr33domlover
b64984495f Switch all HandlerT/WidgetT uses to HandlerFor/WidgetFor 2019-05-23 09:12:24 +00:00
fr33domlover
c531f41565 Implement basic notifications in DB and UI 2019-05-22 21:50:30 +00:00
fr33domlover
6d55b8c5d7 Display remote actor name in remote message view 2019-05-21 09:11:13 +00:00
fr33domlover
d1fea9eb51 Store names of remote actors in DB for display 2019-05-21 08:44:11 +00:00
fr33domlover
2573ff1d93 Parse and publish actor outboxes 2019-05-21 00:36:05 +00:00
fr33domlover
40d9a0990d Serve AS2 in getSharerInboxR 2019-05-21 00:14:49 +00:00
fr33domlover
7bcbe52274 Implement getOutboxR, both (trivial) HTML and AS2 2019-05-20 23:51:06 +00:00
fr33domlover
f07b56c259 Implement getOutboxItemR, serving AS2 and basic HTML 2019-05-18 10:09:47 +00:00
fr33domlover
6d304b9307 Smarter treatment of recipients that are collections
- Allow client to specify recipients that don't need to be delivered to
- When fetching recipient, recognize collections and don't try to deliver to
  them
- Remember collections in DB, and use that to skip HTTP delivery
2019-05-17 22:42:01 +00:00
fr33domlover
48882d65ad Allow AP C2S client to list recipients that aren't actors to deliver to 2019-05-17 10:47:53 +00:00
fr33domlover
07281f6900 Fix infinite loop in ActivityPub audience parsing 2019-05-16 21:22:45 +00:00
fr33domlover
b12ad49b62 Remove unused accidentally left line 2019-05-16 21:21:51 +00:00
fr33domlover
ebc3f016b6 In outbox POST handler logging, fix the display of OutboxItemId number 2019-05-12 20:24:33 +00:00
fr33domlover
d70d34bb6b Debug logs for periodic delivery 2019-05-11 22:26:06 +00:00
fr33domlover
48cfccd3d2 Use forkFinally in ResultShare to be sure we always catch exceptions & set MVar 2019-05-10 21:33:08 +00:00
fr33domlover
f88dcef0d7 Do some debug logging during delivery in outbox POST handler 2019-05-10 20:38:55 +00:00
fr33domlover
770983e829 In outbox POST handler, run async delivery using Worker instead of Handler
Worker is enough and seems much simpler. forkHandler does stuff with
forkResourceT and more stuff that I don't exactly understand and which may
involve more resource allocation. I guess forkWorker would generally be the
preferred approach, and there are bugs with delivery leading to sudden
CPU/memory peaks forcing me to kill the process. Maybe not related, just
mentioning it ^_^
2019-05-10 04:36:21 +00:00
fr33domlover
e29053145f Log errors for linked delivery from outbox, both in handler and periodic 2019-05-09 23:09:34 +00:00
fr33domlover
635952a797 When parsing a LocalURI, use a *valid* dummy host
The previous dummy host was "h", which doesn't contain periods, so the `FedURI`
parser rejects it.
2019-05-09 22:03:19 +00:00
fr33domlover
273fcf972f When delivering activities, sign the Digest header
Looks like I forgot to add it to the list of headers to sign
2019-05-09 21:26:33 +00:00
fr33domlover
ddb6bb0472 When publishing a comment via PublishR, don't specify 'published' time
The server expects not to see it, and wants to set it by itself
2019-05-07 03:12:47 +00:00
fr33domlover
0e4070db75 In ticket discussion, have links to the individual messages (MessageR route) 2019-05-07 02:54:45 +00:00
fr33domlover
9bc78bf303 When posting ticket comment in regular UI, don't specify published time
The outbox handler wants to set it, and it expects it not be set by the client.
2019-05-07 01:51:21 +00:00
fr33domlover
a6bfb0cf36 Show note about federation being disabled, and list other known instances 2019-05-05 22:00:26 +00:00
fr33domlover
6bba8ff47f Fix breadcrumb of TicketMessageR 2019-05-05 21:02:26 +00:00
fr33domlover
67a77b1897 In layout header, link to federation status info page 2019-05-05 11:36:10 +00:00
fr33domlover
8303baa69d Implement GETing the personal inbox 2019-05-05 10:20:55 +00:00
fr33domlover
f6eaca2fa8 When project receives remote ticket comment, add author to followers 2019-05-03 23:55:49 +00:00
fr33domlover
5770c62692 Plug the project inbox handler code into the actual POST handler function 2019-05-03 23:18:57 +00:00
fr33domlover
b0a26722d3 Do inbox forwarding in project inbox handler 2019-05-03 21:04:53 +00:00
fr33domlover
5d5c56695e Remember for deliveries in the DB, whether they should sign forwarding 2019-05-02 09:31:56 +00:00
fr33domlover
93cf861ed0 When delivering a comment on a remote ticket, enable inbox forwarding
In the new inbox forwarding scheme, we use an additional special HTTP signature
to indicate that we allow or expect forwarding, and to allow that forwarding to
later be verified. When delivering a comment on a remote ticket, we'd like the
project to do inbox forwarding. Based on the URI alone, it's impossible to tell
which recipient is the project, and I guess there are various tricks we could
use here, but for now a very simple solution is used: Enable forwarding for all
remote recipients whose host is the same as the ticket's host.
2019-05-02 02:06:47 +00:00
fr33domlover
3d9438714b In sharer inbox, accept forwarded activities, including ones of local users 2019-05-01 23:13:22 +00:00
fr33domlover
f789a773e4 Stop using YesodHttpSig, move code from Foundation to Federation 2019-04-29 07:39:20 +00:00
fr33domlover
951364036f Update activity POSTing code to use the new forwarding mechanism
It's not documented yet, but basically I replaced the custom input string with
an HTTPSig based one.
2019-04-28 10:18:50 +00:00
fr33domlover
1fcec035f0 Do some checks on the host in FedURI parsing
Until now, there were some simple host checks when verifying the HTTP sig,
meant to forbid hosts that are IP addresses, local hosts, and maybe other weird
cases. These checks moved to Network.FedURI, so now FedURIs in general aren't
allowed to have such hosts. The host type is still `Text` though, for now.
2019-04-28 09:47:32 +00:00
fr33domlover
342467297a Put inbox activity auth code in a dedicated function in Vervis.Federation 2019-04-26 21:41:01 +00:00
fr33domlover
9d5399d636 Give project actors signing keys, just like user actors, needed for forwarding
Since project actors are the ones sending inbox forwards, they need to announce
keys and allow their HTTP Signatures to be verified.
2019-04-26 13:04:00 +00:00
fr33domlover
811217fd17 Return keyid and digest after inbox verification, for use in forwarding 2019-04-26 04:15:07 +00:00
fr33domlover
f346da9106 New module Yesod.ActivityPub, use it in Vervis.Federation for delivery POSTing 2019-04-26 03:23:49 +00:00
fr33domlover
71d21ad459 In httpPostAP, support the new signature headers 2019-04-26 00:25:50 +00:00
fr33domlover
46fb4d1512 Add settings switch for activity debug reports 2019-04-25 22:46:27 +00:00
fr33domlover
d24710c46a When receiving activity to inbox, verify the body digest
This patch does a small simple change, however at the cost of the request body
not being available for display in the latest activity list, unless processing
succeeds. I'll fix this situation in a separate patch.
2019-04-25 18:05:02 +00:00
fr33domlover
57374ec816 When POSTing activities, set a Digest header using SHA-256 2019-04-25 15:49:15 +00:00
fr33domlover
825a91d185 Incomplete project inbox handler 2019-04-24 00:47:21 +00:00
fr33domlover
f462a67680 Implement sharer inbox handler
It runs checks against all the relevant tables, but ultimately just inserts the
activity into the recipient's inbox and nothing more, leaving the RemoteMessage
creation and inbox forwarding to the project inbox handler.
2019-04-23 02:57:53 +00:00
fr33domlover
e06f40b665 Switch from single inbox to individual inbox URIs; disable inbox post for now
Inbox post is disabled but in the next patches I'll code and integrate a fixed
complete one, hopefully finally getting ticket comment federation ready for
testing.

I'm making this change because if an actor receives an activity due to being
addressed in bto, ot bcc, or being listed in some remote collection, the server
doesn't have a way to tell which actor(s) are the intended recipients, without
having an individual inbox URL for each actor. I could use a different hack for
this, but it wouldn't be compatible with other AP servers (unless the whole
fediverse agrees on a method).

I wasn't using sharedInbox anyway, and it's an optimization either way.
2019-04-21 10:58:57 +00:00
fr33domlover
f7f15e0f63 When sending ticket comment in regular Vervis UI, deliver it using ActivityPub 2019-04-20 21:34:45 +00:00
fr33domlover
4f5c6532ee Switch postOutboxR to the new handler 2019-04-19 03:14:12 +00:00
fr33domlover
fc2ace3370 Insert ticket commenter to ticket followers, and never deliver to themselves 2019-04-18 23:37:33 +00:00
fr33domlover
47a9e0b5a0 Group by sharer ID too, hopefully this time it's enough 2019-04-18 20:20:58 +00:00
fr33domlover
4386e0f8af If federation is disabled, don't run periodic delivery 2019-04-18 19:50:31 +00:00
fr33domlover
50f12f855d In ticket summary SQL query, group by ticket ID, not by discussion ID
Each ticket has a single discussion ID, and each ticket has a unique one, so,
given an inner join of tickets and discussions, I think there should be exactly
1 way select a (ticket, discussion) pair given any of these.

But for some reason, PostgreSQL started complaining. Not sure what changed.
Anyway, for now, I switched the groupBy from discussion.id to ticket.id, which
is essentially the same, but for some reason makes PostgreSQL happy. It can't
tell that given a discussion ID, there's exactly 1 way to choose the ticket. Or
something like that. I wonder if I messed up something in DB migrations.
2019-04-18 19:35:04 +00:00
fr33domlover
b8c669f6fc New outbox post: Raise error if federation disabled but remote recipients found 2019-04-18 11:43:33 +00:00
fr33domlover
f37b9b3f52 Run the delivery worker priodically, settings control how often to run 2019-04-18 10:38:01 +00:00
fr33domlover
c9c7da5902 More insertBy' usage, and remove withHostLock from new outbox post handler 2019-04-16 18:03:02 +00:00
fr33domlover
735a6a39cb Use insertBy' in instanceAndActor 2019-04-16 17:26:06 +00:00
fr33domlover
b0da8747a2 In ActorFetchShare, use insertBy' to allow non-shared insertions
Before this patch, the shared fetch used plain insert, because it relied on
being the only place in the codebase where new RemoteActors get inserted. I was
hoping for that to be the case, but while I tweak things and handle fetching
URIs that can be an actor or a public key (for which ActorFetchShare isn't
sufficient without some smart modification), I'd like concurrent insertions to
be safe, without getting in the way of ActorFetchShare.

With this patch, it now uses insertBy', which doesn't mind concurrent
insertions.
2019-04-16 16:33:08 +00:00
fr33domlover
7c2fad7417 Implement fetchAPIDOrH using a dedicated error type 2019-04-16 16:10:17 +00:00
fr33domlover
25fcceabde postOutboxR: Use ResultShare for fetching recipient actor 2019-04-16 14:34:17 +00:00
fr33domlover
d5eefd1553 Implement outbox remote delivery, in handler and periodic, not used yet 2019-04-16 14:27:50 +00:00
fr33domlover
7946fe441d Add field errorSince to RemoteActor to track inbox POST unreachability 2019-04-12 01:09:45 +00:00
fr33domlover
3f9364e4aa Rename RemoteSharer entity to RemoteActor 2019-04-12 00:56:27 +00:00
fr33domlover
7621c0280a Rewrite ticketFollowers migration without insertKey, it causes problems 2019-04-11 16:43:46 +00:00
fr33domlover
9a306e762c Unfinished updated outbox handler 2019-04-11 13:44:44 +00:00
fr33domlover
7dda068ba3 Make the DB migrations not depend on current model 2019-04-11 13:26:57 +00:00
fr33domlover
1d854423cb Switch Audience from Vector to list and fix Public bug
* No good reason to use Vector, let's use list, it's just easier
* The Public URI recognizing code wasn't being used; now it is
2019-04-01 23:40:29 +00:00
fr33domlover
0c280c7af6 Add setting that says how much time to keep retrying activity delivery 2019-04-01 23:38:44 +00:00
fr33domlover
c2415301bc More type-safe handling of DB key Hashids 2019-03-29 03:25:32 +00:00
fr33domlover
228e954706 Create Note outbox handler, not in use yet
I wrote a function handleOutboxNote that's supposed to do the whole outbox POST
handler process. There's an outbox item table in the DB now, I adapted things
in various source files. Ticket comment federation work is still in progress.
2019-03-28 21:08:30 +00:00
fr33domlover
cdb1c8b121 Add settings option to disable federation 2019-03-25 00:17:24 +00:00
fr33domlover
e36d960d2b Rename handleActivity to handleInboxActivity 2019-03-23 15:45:44 +00:00
fr33domlover
85c6354291 Switch jsonb support from persistent-postgresql to a custom module
The custom module provides a parametric wrapper, allowing any specific
FromJSON/ToJSON instance to be used. It's a standalone module though, and not a
wrapper of persistent-postgresql, because persistent-postgresql uses aeson
Value and it prevents using toEncoding to get from the value directly to a
string.
2019-03-23 15:29:50 +00:00
fr33domlover
0032456925 Add noteAudience; record recipient of local remotely-targetted activities in DB 2019-03-23 02:57:34 +00:00
fr33domlover
58a56b6743 Make noteId optional, to support taking a Note in postOutboxR 2019-03-23 02:05:30 +00:00
fr33domlover
88d4c976ee Add route getMessageR, returns an Activity Note for any locally created Message 2019-03-22 20:46:42 +00:00
fr33domlover
6c186355f3 Change some top-level routes' breadcrumbs to be under HomeR 2019-03-22 05:17:58 +00:00
fr33domlover
c27636a438 Add route /publish for sending activities, getOutboxR now free to return outbox 2019-03-22 05:17:54 +00:00
fr33domlover
d40e1b8891 In outbox post form, provide parent and context, and default to ticket comment 2019-03-21 23:56:47 +00:00
fr33domlover
ad3a20d783 Receive remote comments on local ticket discussion 2019-03-21 22:57:15 +00:00
fr33domlover
72f96a0dff When verifying HTTPsig, return iid&rsid and remove duplicate shared usage check
* Adapt DB related code to return the InstanceId and RemoteSharerId
* Previously, when fetching a known shared key, we were running a DB
  check/update for the shared usage record. I noticed - and hopefully I
  correctly noticed - that this check already runs when we discover the keyId
  points to a shared key we already know. So, after successful sig
  verification, there's no need to run the check again. So I removed it.
2019-03-21 21:38:59 +00:00
fr33domlover
061c84349d Recognize the 3 variants of the Public collection URI when parsing audience 2019-03-21 19:13:36 +00:00
fr33domlover
77324442fc Fetch local messages by LocalMessageId, not by MessageId 2019-03-21 19:06:52 +00:00
fr33domlover
68b0ae7829 When receiving HTTP signed request, check the keyId host for weird cases
- Exclude hosts without periods, so things like localhost and IPv6 are rejected
- Exclude hosts without letters, so things like IPv4 are rejected
- Exclude the instance's own host, just in case somehow some fake activity
  slips in and gets approved, maybe even accidentally when delivered by another
  server
2019-03-20 12:27:40 +00:00
fr33domlover
747bbd5f0c Publish actor documents for projects, and add some new properties to Actor 2019-03-20 12:01:10 +00:00
fr33domlover
ade1157a04 Add a custom ActivityPub actor type: Project 2019-03-20 10:36:00 +00:00
fr33domlover
3f2a178830 New module Yesod.FedURI: Render routes into FedURI and LocalURI 2019-03-20 10:08:36 +00:00
fr33domlover
6f3df6d569 Allow actors not to list any public keys at all 2019-03-20 09:31:08 +00:00
fr33domlover
716487f2b8 In ticket comment tree, support mixing local and remote (federated) comments 2019-03-20 08:07:37 +00:00
fr33domlover
e0de4cdcc7 Remove Discussion's nextMessage field, it's not being used anymore 2019-03-18 20:18:25 +00:00
fr33domlover
4b351ef62e Automatically set approot to https://HOST and require Host header to match 2019-03-16 17:15:31 +00:00
fr33domlover
a9eaf35d5e When verifying HTTP sig, require ActivityPub-Actor to be signed only if present 2019-03-16 15:48:25 +00:00
fr33domlover
475e398d6d Switch ticket comment IDs to use Hashids-of-MessageId instead of custom number 2019-03-15 16:36:02 +00:00
fr33domlover
9e881554ea Make frg:isShared key property optional, it was accidentally required 2019-03-15 16:33:10 +00:00
fr33domlover
0e0afa78f9 Parse/encoding audience targetting activity fields 2019-03-14 02:30:36 +00:00
fr33domlover
24c091a248 Add activity types Follow, Accept, Reject 2019-03-13 23:37:58 +00:00
fr33domlover
f6cbc1eb8a Use file based switches to relax keyfile loading rules 2019-03-11 02:01:41 +00:00
fr33domlover
2a39378468 HTTP Signature verification: RSA-SHA256 and PEM/ASN1 support
Before, things worked like this:

* Only signatures of Ed25519 keys could be verified
* Key encoding placed the plain binary Ed25519 key in the PEM, instead of the
  key's ASN1 encoding

With this patch it now works like this:

* Ed25519 signatures are supported as before
* RSA keys are now supported too, assuming RSA-SHA256 signatures
* Both Ed25519 and RSA keys are encoded and decoded using actual PEM with ASN1
2019-03-10 23:15:42 +00:00
fr33domlover
ef57f29a54 Adapt Activity/Create/Note to new ActivityPub typeclass and add safety checks 2019-03-10 06:42:03 +00:00
fr33domlover
61d1aa6720 Define HMAC based access token and switch CapSignKey from Ed25519 to HMAC 2019-03-09 21:21:36 +00:00
fr33domlover
fdbe46741b When POSTing an activity, protect remote actor DB insertion with withHostLock 2019-03-09 17:12:43 +00:00
fr33domlover
e341f62587 Fix typo in comment 2019-03-09 15:44:31 +00:00
fr33domlover
468202cf45 Fix instance mutex deadlock, accidentally initialized the MVar empty 2019-03-09 15:43:30 +00:00
fr33domlover
37216d9045 Move remote actor DB code from Foundation to separate module 2019-03-09 15:40:02 +00:00
fr33domlover
b0e33af4d8 Fix typo in actor key route 2019-03-06 01:49:55 +00:00
fr33domlover
043022d117 When verifying HTTP sig, make Ed25519 verification failure message clearer 2019-03-06 01:31:30 +00:00
fr33domlover
c26289cf42 Don't check CSRF token in InboxR, POSTs there freely come from other servers 2019-03-05 09:00:22 +00:00
fr33domlover
6e721797e9 Catch sig generation error when sending signed HTTP POST 2019-03-05 08:26:41 +00:00
fr33domlover
97594dc945 Fix default actor URI in OutboxR form, from /p to /s 2019-03-04 20:12:19 +00:00
fr33domlover
378ca1b3d4 Fix bug in FedURI parsing 2019-03-04 20:11:58 +00:00
fr33domlover
bb662e798f Display clearer error message when GETing recipient actor fails 2019-03-04 15:47:22 +00:00
fr33domlover
78b5bad2c4 Support bypassing email verification of new users 2019-03-04 14:51:51 +00:00
fr33domlover
c41f1183e0 Display instance host at the top of all pages 2019-03-04 09:06:23 +00:00
fr33domlover
ad034dbacc Make the registration switch work again 2019-03-04 08:14:36 +00:00
fr33domlover
6bbba4ce5c Use MVars to protect concurrenct access to instance/actor/key DB records 2019-03-02 19:13:51 +00:00
fr33domlover
f09bdd4141 Add key storage mode that replaces old keys instead of rejecting new ones 2019-02-26 14:00:22 +00:00
fr33domlover
2e705b6868 Make key storage limits configurable instead of hardcoding to 2 2019-02-24 01:35:07 +00:00
fr33domlover
17524b6ee1 Remove hardcoded-to-2 limit on length of an actor's list of public keys 2019-02-24 01:21:42 +00:00
fr33domlover
0912b8e291 Use the DB for checking key usage by actors
* When we refetch a personal key, we never need to separately fetch the actor
* When we refetch a shared key, check usage in DB and insert usage to DB
2019-02-23 17:17:52 +00:00
fr33domlover
b53a7b4f48 Refactor actor key fetching code a bit 2019-02-22 08:30:43 +00:00
fr33domlover
1affe269bb Refactor HTTP sig verification DB update code 2019-02-22 07:20:19 +00:00
fr33domlover
d3e14b3edf Add LocalURI type for recording shared URI host 2019-02-21 23:59:53 +00:00
fr33domlover
aefb2aaee7 Add InstanceURI datatype 2019-02-20 07:40:25 +00:00
fr33domlover
4053f2f2b4 Record usage of instance keys in the DB
When we verify an HTTP signature,

* If we know the key, check in the DB whether we know the actor lists it. If it
  doesn't, and there's room left for keys, HTTP GET the actor and update the DB
  accordingly.
* If we know the key but had to update it, do the same, check usage in DB and
  update DB if needed
* If we don't know the key, record usage in DB

However,

* If we're GETing a key and discovering it's a shared key, we GET the actor to
  verify it lists the key. When we don't know the key at all yet, that's fine
  (can be further optimized but it's marginal), but if it's a key we do know,
  it means we already know the actor and for now it's enough for us to rely
  only on the DB to test usage.
2019-02-19 10:54:55 +00:00
fr33domlover
312ccf6979 When verifying HTTP sig with known shared key, verify actor lists the key
Previously, when verifying an HTTP signature and we fetched the key and
discovered it's shared, we'd fetch the actor and make sure it lists the key URI
in the `publicKey` field. But if we already knew the key, had it cached in our
DB, we wouldn't check the actor at all, despite not knowing whether it lists
the key.

With this patch, we now always GET the actor when the key is shared,
determining the actor URI from the `ActivityPub-Actor` request header, and we
verify that the actor lists the key URI. We do that regardless of whether or
not we have the key in the DB, although these two cases and handled in
different parts of the code right now (for a new key, it's in Web.ActivityPub
fetchKey; for a known key, it's in Vervis.Foundation httpVerifySig).
2019-02-18 09:20:13 +00:00
fr33domlover
9b8cae79e0 Remove old commented out line of code 2019-02-18 09:18:50 +00:00
fr33domlover
69e807214d Even if we have the specified keyid in the DB, check AP actor header if present
Previously, when verifying an HTTP signature and we find out we have the
provided keyid in the DB, and this key is a personal key, we would just grab
the key owner from the DB and ignore the ActivityPub-Actor header.

This patch adds a check: If we find the key in the DB and it's a personal key,
do grab the owner from that DB row, but also check the actor header: If it's
provided, it has to be identical to the key owner ID URI.
2019-02-17 00:32:38 +00:00
fr33domlover
fa5c509a25 When we fetch a stand-alone personal key, make sure AP-Actor matches key owner
If the key we fetched is a shared key, the only way to determine the actor to
which the signature applies is to read the HTTP header ActivityPub-Actor. But
if it's a personal key, we can detect the actor by checking the key's owner
field. Still, if that actor header is provided, we now compare it to the key
owner and make sure they're identical.

When fetching a key that is embedded in the actor document, we were already
comparing the actor ID with the actor header, so that part didn't require
changes.
2019-02-17 00:14:05 +00:00
fr33domlover
bf56ebf158 Make the verification key update logic clearer 2019-02-16 21:47:58 +00:00
fr33domlover
9e0314fa09 Store remote actors' inbox URIs in DB, avoiding some actor fetch
When a local user wants to publish an activity, we were always GETing the
recipient actor, so that we could determine their inbox and POST the activity
to it. But now, instead, whenever we GET an actor (whether it's for the key sig
verification or for determining inbox URI), we keep their inbox URI in the
database, and we don't need to GET it again next time.
2019-02-14 23:27:40 +00:00
fr33domlover
128f1297ec In postInboxR, use the Activity type, so we only accept Create Note for now 2019-02-14 22:29:59 +00:00
fr33domlover
fb396bb984 Define breadcrumbs for shared actor key routes 2019-02-14 22:17:04 +00:00
fr33domlover
e6b7a5297a Fix error in key expiration check caused by a typo 2019-02-14 22:16:15 +00:00
fr33domlover
e8ba301c6a Switch actor ID URIs to be /s/ACTOR instead of /p and /g
See Vervis ticket #60.
2019-02-14 22:13:58 +00:00
fr33domlover
754709833a When a client posts to their outbox, allow only Create Note, not near-any JSON 2019-02-12 11:53:24 +00:00
fr33domlover
c2bf470fb6 Generate and keep permanent salt for generating hashids for URIs 2019-02-08 21:54:22 +00:00
fr33domlover
9536d870e5 Add utility for loading permanent key files, and use it for ocap signing key 2019-02-08 03:13:56 +00:00
fr33domlover
8ac559d064 New datatype FedURI for @id URIs
Using a dedicated type allows to record in the type the guarantees that we
provide, such as scheme being HTTPS and authority being present. Allows to
replace ugly `fromJust` and such with direct field access.
2019-02-07 23:08:28 +00:00
fr33domlover
e325175a9c Publish 2 rotating instance-scope keys instead of the one-implicitly-shared-key
Before, there was a single key used as a personal key for all actors. Now,
things work like this:

- There are 2 keys, each time one is rotated, this way the old key remains
  valid and we can freely rotate without a risk of race conditions on other
  servers and end up with our posts being rejected
- The keys are explicitly instance-scope keys, all actors refer to them
- We add the ActivityPub-Actor header to all activity POSTs we send, to declare
  for which specific actor our signature applies. Activities and otherwise
  different payloads may have varying ways to specify attribution; using this
  header will be a standard uniform way to specify the actor, regardless of
  payload format. Of course, servers should make sure the actual activity is
  attributed to the same actor we specified in the header. (This is important
  with instance-scope keys; for personal keys it's not critical)
2019-02-07 10:34:33 +00:00
fr33domlover
8166d5b5eb Support for instance-scope keys when verifying HTTP signature 2019-02-06 02:48:23 +00:00
fr33domlover
400245cf34 Accept HTTP signatures made with shared instance-scope actor keys 2019-02-05 13:02:15 +00:00
fr33domlover
e8a5ef4e86 Replace unused symbol name with underscore 2019-02-05 12:56:06 +00:00
fr33domlover
d4c7fa5809 When parsing ID URIs in AP JSON, make sure their authority part is non-empty 2019-02-05 12:54:55 +00:00
fr33domlover
c2c4e24497 Support actor key expiration
Allow keys to specify expiration time using w3c security vocabulary. If a key
has expired, we treat it like sig validation failure and re-fetch the key from
the other server. And we never accept a sig, even a valid sig, if the key has
expired.

Since servers keep actors and keys in the DB, expiration can be a nice way to
ask that keys aren't used more than we want them to. The security vocab spec
also recommends to set expiration time on keys, so it's nice to support this
feature.
2019-02-05 04:05:44 +00:00