fedipub 0.0.1 → 0.10.0

data/lib/fediverse/request.rb

@@ -0,0 +1,29 @@
+require 'json/ld'
+
+module Fediverse
+  class Request
+    class << self
+      # Dereferences a value
+      #
+      # @param value [String, Hash]
+      #
+      # @return [Hash, nil]
+      def dereference(value)
+        return value if value.is_a? Hash
+        return get(value) if value.is_a? String
+
+        raise "Unhandled object type #{value.class}"
+      end
+
+      private
+
+      def get(id)
+        json = Fedipub::Utils::JsonRequest.get_json(id)
+
+        JSON::LD::API.compact json, json['@context']
+      rescue JSON::ParserError
+        nil
+      end
+    end
+  end
+end

data/lib/fediverse/signature/draft_cavage12.rb

@@ -0,0 +1,109 @@
+require 'fediverse/signature'
+
+module Fediverse
+  module Signature
+    class DraftCavage12
+      class << self
+        def sign(sender:, request:)
+          request = set_headers(request)
+
+          parts = {
+            keyId:     sender.key_id,
+            headers:   signature_headers(request).join(' '),
+            signature: signature(sender: sender, request: request),
+          }
+          request.headers['Signature'] = parts.map { |k, v| "#{k}=\"#{v}\"" }.join(',')
+          request
+        end
+
+        def verify!(request:)
+          # Do we have a signature to verify?
+          return false unless request.headers.key?('Signature')
+
+          # Have we got what we need?
+          components = signature_components(request)
+          raise Fediverse::Signature::BadSignature, 'Malformed signature' unless components['signature'] && components['headers']
+
+          # Find the sender
+          sender = find_sender_by_key_id(components['keyId'])
+          raise Fediverse::Signature::BadSignature, "Couldn't find sender" unless sender
+
+          # Build the expected payload
+          comparison_string = signature_payload(request: request, headers: components['headers'])
+
+          # Verify the payload against the signature
+          result = do_verification(components['signature'], sender, comparison_string)
+          raise Fediverse::Signature::BadSignature unless result
+
+          result
+        end
+
+        private
+
+        def do_verification(signature, sender, comparison_string)
+          signature = Base64.decode64(signature)
+          key       = OpenSSL::PKey::RSA.new(sender.public_key)
+          key.verify(OpenSSL::Digest.new('SHA256'), signature, comparison_string)
+        end
+
+        def find_sender_by_key_id(key_id)
+          return unless key_id
+
+          Fedipub::Actor.find_or_create_by_federation_url(
+            key_id.split('#', 2).first
+          )
+        end
+
+        def set_headers(request) #  rubocop:disable Naming/AccessorMethodName
+          request.headers['Digest'] = digest(request.body) if request.body
+          request.headers['Host'] = URI.parse(request.path).host
+          request.headers['Date'] = Time.now.utc.httpdate
+          request
+        end
+
+        def signature_components(request)
+          request.headers['Signature'].split(',').to_h do |pair|
+            /\A(?<key>\w+)="(?<value>.*)"\z/ =~ pair
+            [key, value]
+          end
+        end
+
+        def digest(message)
+          "SHA-256=#{Base64.strict_encode64(
+            OpenSSL::Digest.new('SHA256').digest(message)
+          )}"
+        end
+
+        def signature_payload(request:, headers: signature_headers(request))
+          headers = headers.split if headers.is_a?(String)
+          headers.map do |header|
+            case header
+            when '(request-target)'
+              "(request-target): #{(request.try(:http_method) || request.try(:method)).downcase} #{URI.parse(request.path).path}"
+            else
+              "#{header}: #{request.headers[header.capitalize]}"
+            end
+          end.join("\n")
+        end
+
+        def signature_headers(request)
+          if request.body
+            %w[(request-target) host date digest]
+          else
+            %w[(request-target) host date]
+          end
+        end
+
+        def signature(sender:, request:)
+          private_key = OpenSSL::PKey::RSA.new sender.private_key, Rails.application.credentials.secret_key_base
+          Base64.strict_encode64(
+            private_key.sign(
+              OpenSSL::Digest.new('SHA256'),
+              signature_payload(request: request)
+            )
+          )
+        end
+      end
+    end
+  end
+end

data/lib/fediverse/signature/rfc9421.rb

@@ -0,0 +1,69 @@
+require 'linzer'
+require 'linzer/faraday'
+require 'linzer/rack'
+
+Linzer::Message.register_adapter ActionDispatch::Request, Linzer::Message::Adapter::Rack::Request
+
+module Fediverse
+  module Signature
+    class Rfc9421
+      class << self
+        def sign(sender:, request:)
+          request.headers['Content-Digest'] = digest(request.body) if request.body
+          Linzer.sign!(
+            request,
+            key:        linzer_private_key(sender),
+            components: components(request),
+            params:     {
+              created: Time.now.to_i,
+              alg:     'rsa-v1_5-sha256',
+            }
+          )
+          request
+        end
+
+        def verify!(request:)
+          # Do we have a signature to verify?
+          return false if !request.headers.key?('Signature-Input') || !request.headers.key?('Signature')
+
+          # Verify the signature
+          Linzer.verify!(request) do |key_id|
+            sender = Fedipub::Actor.find_or_create_by_federation_url(key_id.split('#', 2).first)
+            raise Fediverse::Signature::BadSignature if sender.nil?
+
+            linzer_public_key(sender)
+          end
+        rescue Linzer::Error
+          raise Fediverse::Signature::BadSignature
+        end
+
+        private
+
+        # Converts key to right structure for Linzer to use
+        def linzer_private_key(sender)
+          private_key = OpenSSL::PKey::RSA.new sender.private_key, Rails.application.credentials.secret_key_base
+          Linzer.new_rsa_v1_5_sha256_key(private_key.to_pem, sender.key_id)
+        end
+
+        def linzer_public_key(sender)
+          public_key = OpenSSL::PKey::RSA.new(sender.public_key)
+          Linzer.new_rsa_v1_5_sha256_key(public_key.to_pem, sender.key_id)
+        end
+
+        def components(request)
+          if request.body
+            %w[@method @target-uri content-digest]
+          else
+            %w[@method @target-uri]
+          end
+        end
+
+        def digest(message)
+          "sha-256=:#{Base64.strict_encode64(
+            OpenSSL::Digest.new('SHA256').digest(message)
+          )}:"
+        end
+      end
+    end
+  end
+end

data/lib/fediverse/signature.rb

@@ -0,0 +1,26 @@
+module Fediverse
+  module Signature
+    class BadSignature < StandardError; end
+
+    class << self
+      def sign(sender:, request:, legacy_signature: false)
+        if legacy_signature
+          Fediverse::Signature::DraftCavage12.sign(sender: sender, request: request)
+        else
+          Fediverse::Signature::Rfc9421.sign(sender: sender, request: request)
+        end
+      end
+
+      def verify!(request:, require_signature: false) # rubocop:disable Naming/PredicateMethod
+        success = Fediverse::Signature::Rfc9421.verify!(request: request) ||
+                  Fediverse::Signature::DraftCavage12.verify!(request: request)
+        raise(BadSignature) if require_signature && !success
+
+        true
+      end
+    end
+  end
+end
+
+require 'fediverse/signature/draft_cavage12'
+require 'fediverse/signature/rfc9421'

data/lib/fediverse/webfinger.rb

@@ -0,0 +1,140 @@
+require 'fedipub/utils/host'
+require 'fedipub/utils/json_request'
+
+module Fediverse
+  # Methods related to Webfinger: find accounts, fetch actors,...
+  class Webfinger
+    class << self
+      ACCOUNT_REGEX = /(?<username>[a-z0-9\-_.]+)(?:@(?<domain>.*))?/
+
+      # Extracts username and domain from an account string.
+      # Accepts forms "user@domain", "@user@domain" and "acct:user@domain"
+      #
+      # @param account [String] Account string
+      #
+      # @return [MatchData, nil] Matches with +:username+ and +:domain+ or +nil+
+      def split_account(account)
+        /\A(acct:|@)?#{ACCOUNT_REGEX}\z/io.match account
+      end
+
+      # Determines if a given account string should be a local account (same host as configured one)
+      #
+      # @param hash [Hash, MatchData] Object with +:username+ and +:domain+ keys
+      #
+      # @return [Boolean]
+      def local_user?(hash)
+        hash[:username] && (hash[:domain].nil? || (hash[:domain] == Fedipub::Utils::Host.localhost))
+      end
+
+      # Fetches a distant actor
+      #
+      # @param username [String]
+      # @param domain [String]
+      #
+      # @return [Fedipub::Actor, nil] Fedipub actor or nothing when not found
+      def fetch_actor(username, domain)
+        fetch_actor_url webfinger(username, domain)
+      end
+
+      # Fetches an actor given its URL
+      #
+      # @param url [String] Actor's federation URL
+      #
+      # @return [Fedipub::Actor, nil] Fedipub actor or nothing when not found
+      def fetch_actor_url(url)
+        webfinger_to_actor get_json url
+      end
+
+      # Gets the real actor's federation URL from its username and domain
+      #
+      # @param username [String]
+      # @param domain [String]
+      #
+      # @return [String, nil] Federation URL if found
+      def webfinger(username, domain)
+        json = webfinger_response(username, domain)
+        link = json['links'].find { |l| Mime::Type.lookup(l['type']).to_sym == :activitypub }
+
+        link['href'] if link
+      end
+
+      # Returns remote follow link template, or complete link if actor_url is provided
+      #
+      # @param username [String]
+      # @param domain [String]
+      # @param actor_url [String] Optional Federation URL to provide when known
+      #
+      # @return [String] The URL to use as follow URL
+      def remote_follow_url(username, domain, actor_url: nil)
+        json = webfinger_response(username, domain)
+        link = json['links'].find { |l| l['rel'] == 'http://ostatus.org/schema/1.0/subscribe' }
+        return nil if link&.dig('template').nil?
+
+        if actor_url
+          link['template'].gsub('{uri}', CGI.escape(actor_url))
+        else
+          link['template']
+        end
+      end
+
+      private
+
+      # Makes a webfinger request for a given username/domain
+      # @return [Hash] Webfinger response's content
+      def webfinger_response(username, domain)
+        scheme = Fedipub.configuration.force_ssl ? 'https' : 'http'
+        get_json "#{scheme}://#{domain}/.well-known/webfinger", resource: "acct:#{username}@#{domain}"
+      end
+
+      # Extracts the server and port from a string, omitting common ports
+      # @return [String] Server and port
+      def server_and_port(string)
+        uri = URI.parse string
+        if uri.port && [80, 443].exclude?(uri.port)
+          "#{uri.host}:#{uri.port}"
+        else
+          uri.host
+        end
+      end
+
+      # Builds a +Fedipub::Actor+ from a Webfinger response
+      # @param data [Hash] Webfinger response
+      # @return [Fedipub::Actor]
+      def webfinger_to_actor(data) # rubocop:disable Metrics/MethodLength
+        data = data.clone
+        id = data.delete('id')
+        Fedipub::Actor.new federated_url:  id,
+                           username:       data.delete('preferredUsername'),
+                           actor_type:     data.delete('type'),
+                           name:           data.delete('name'),
+                           server:         server_and_port(id),
+                           inbox_url:      data.delete('inbox'),
+                           outbox_url:     data.delete('outbox'),
+                           followers_url:  data.delete('followers'),
+                           followings_url: data.delete('following'),
+                           profile_url:    data.delete('url'),
+                           public_key:     data.delete('publicKey')&.dig('publicKeyPem'),
+                           extensions:     data.except('@context')
+      end
+
+      # Makes a simple GET request and returns a +Hash+ from the parsed body
+      # @return [Hash]
+      # @raise [ActiveRecord::RecordNotFound] when the response is invalid
+      def get_json(url, params = {})
+        Fedipub::Utils::JsonRequest.get_json(url, params: params, headers: { accept: 'application/json' })
+      rescue Fedipub::Utils::JsonRequest::UnhandledResponseStatus => e
+        Rails.logger.debug { e.message }
+
+        raise ActiveRecord::RecordNotFound
+      rescue Faraday::ConnectionFailed
+        Rails.logger.debug { "Failed to reach server for GET #{url}" }
+
+        raise ActiveRecord::RecordNotFound
+      rescue JSON::ParserError
+        Rails.logger.debug { "Invalid JSON response for GET #{url}" }
+
+        raise ActiveRecord::RecordNotFound
+      end
+    end
+  end
+end

data/lib/fediverse.rb

@@ -0,0 +1,5 @@
+require 'fediverse/collection'
+
+# This module includes classes and helpers to interact with the Fediverse.
+module Fediverse
+end

data/lib/generators/fedipub/copy_client_policies/USAGE

@@ -0,0 +1,8 @@
+Description:
+    Copies the Pundit client policies to be overridden in main application.
+
+Example:
+    bin/rails generate copy_client_policies
+
+    This will create:
+        app/policies/fedipub/client/*

data/lib/generators/fedipub/copy_client_policies/copy_client_policies_generator.rb

@@ -0,0 +1,9 @@
+module Fedipub
+  class CopyClientPoliciesGenerator < Rails::Generators::Base
+    source_root File.expand_path('../../../../app/policies/fedipub', __dir__)
+
+    def copy_policies
+      directory 'client', Rails.root.join('app', 'policies', 'fedipub', 'client')
+    end
+  end
+end

data/lib/generators/fedipub/copy_client_views/USAGE

@@ -0,0 +1,8 @@
+Description:
+    Copies the client views to be overridden in main application
+
+Example:
+    bin/rails generate copy_client_views
+
+    This will create:
+        app/views/fedipub/client/**/*

data/lib/generators/fedipub/copy_client_views/copy_client_views_generator.rb

@@ -0,0 +1,9 @@
+module Fedipub
+  class CopyClientViewsGenerator < Rails::Generators::Base
+    source_root File.expand_path('../../../../app/views', __dir__)
+
+    def copy_views
+      directory 'fedipub/client', Rails.root.join('app', 'views', 'fedipub', 'client')
+    end
+  end
+end

data/lib/generators/fedipub/copy_factories/USAGE

@@ -0,0 +1,8 @@
+Description:
+    Copies FactoryBot factories in the "spec" directory
+
+Example:
+    bin/rails generate copy_factories
+
+    This will create:
+        spec/factories/*

data/lib/generators/fedipub/copy_factories/copy_factories_generator.rb

@@ -0,0 +1,43 @@
+module Fedipub
+  class CopyFactoriesGenerator < Rails::Generators::Base
+    SOURCE_DIRECTORY = File.expand_path('../../../../spec/factories/fedipub', __dir__)
+    FACTORY_DEFINITION_REGEX = /(FactoryBot.define do\n\s+factory) :(\w+),/
+
+    source_root SOURCE_DIRECTORY
+
+    def initialize
+      super
+      @files = []
+      @factories = []
+    end
+
+    def copy_factories
+      dest = Rails.root.join('spec', 'factories')
+
+      Dir.entries(SOURCE_DIRECTORY).each do |node|
+        source_path = File.join(SOURCE_DIRECTORY, node)
+        next unless File.file?(source_path) && node.match?(/\.rb\Z/)
+
+        file_path = File.join(dest, "fedipub_#{node}")
+        copy_file node, file_path
+        @files << file_path
+        @factories << File.read(file_path).match(FACTORY_DEFINITION_REGEX)&.[](2)
+      end
+
+      substitute_values!
+    end
+
+    private
+
+    def substitute_values!
+      @factories.compact!
+      @files.each do |file|
+        gsub_file file, FACTORY_DEFINITION_REGEX, '\1 :fedipub_\2,'
+
+        @factories.each do |factory|
+          gsub_file file, ":#{factory}", ":fedipub_#{factory}"
+        end
+      end
+    end
+  end
+end

data/lib/generators/fedipub/install/USAGE

@@ -0,0 +1,9 @@
+Description:
+    Copies configuration file and initializer
+
+Example:
+    bin/rails generate fedipub:install
+
+    This will create:
+        config/fedipub.yml
+        config/initializers/fedipub.rb

data/lib/generators/fedipub/install/install_generator.rb

@@ -0,0 +1,10 @@
+module Fedipub
+  class InstallGenerator < Rails::Generators::Base
+    source_root File.expand_path('templates', __dir__)
+
+    def copy_files
+      copy_file 'fedipub.yml', Rails.root.join('config', 'fedipub.yml')
+      copy_file 'fedipub.rb', Rails.root.join('config', 'initializers', 'fedipub.rb')
+    end
+  end
+end

data/lib/generators/fedipub/install/templates/fedipub.rb

@@ -0,0 +1 @@
+Fedipub.config_from 'fedipub'

data/lib/generators/fedipub/install/templates/fedipub.yml

@@ -0,0 +1,27 @@
+---
+defaults: &defaults
+  app_name:
+  app_version:
+  force_ssl: false
+  site_host: http://localhost
+  site_port: 3000
+  enable_discovery: true
+  open_registrations: false
+  app_layout: 'layouts/application'
+  server_routes_path: federation
+  client_routes_path: app
+  job_queue: default
+  #remote_entities_cache_duration: 86400 # 1 day in seconds
+  #base_client_controller: ::ActionController::Base
+
+development:
+  <<: *defaults
+
+test:
+  <<: *defaults
+  site_port: null
+
+production:
+  <<: *defaults
+  force_ssl: true
+  site_port: 443

data/lib/tasks/factory_bot.rake

@@ -0,0 +1,15 @@
+namespace :factory_bot do
+  desc 'Verify that all FactoryBot factories are valid'
+  task lint: :environment do
+    if Rails.env.test?
+      conn = ActiveRecord::Base.connection
+      conn.transaction do
+        FactoryBot.lint traits: true
+        raise ActiveRecord::Rollback
+      end
+    else
+      system("bundle exec rake app:factory_bot:lint RAILS_ENV='test'")
+      raise if $CHILD_STATUS.exitstatus.nonzero?
+    end
+  end
+end

data/lib/tasks/fedipub_tasks.rake

@@ -0,0 +1,13 @@
+namespace :fedipub do
+  desc 'Re-fetches every remote actors to update database'
+  task sync_actors: :environment do
+    Fedipub::Maintenance::ActorUpdater.run do |actor, status|
+      puts "#{actor.federated_url}: #{status}"
+    end
+  end
+
+  desc 'Re-fetches every host and completes missing ones'
+  task sync_hosts: :environment do
+    Fedipub::Maintenance::HostsUpdater.run
+  end
+end