fedipub 0.0.1 → 0.9.0

data/lib/fedipub/utils/object.rb

@@ -0,0 +1,131 @@
+module Fedipub
+  module Utils
+    # Methods to manipulate incoming objects
+    class Object
+      class << self
+        # Finds data from an object or its ID.
+        #
+        # When data exists locally, the entity is returned.
+        # For distant data, a new instance is returned unless the target does not exist.
+        #
+        # @param object_or_id [String, Hash] String identifier or incoming object
+        #
+        # @return [ApplicationRecord, nil] Entity or nil when invalid/not found
+        def find_or_initialize(object_or_id)
+          federated_url = object_or_id.is_a?(Hash) ? object_or_id['id'] : object_or_id
+
+          route = local_route(federated_url)
+          return from_local_route(route) if route
+
+          from_distant_server(object_or_id)
+        end
+
+        # Search for a distant object in actors and configured data entities.
+        #
+        # This is useful to find something when the type is unknown, as an object from a Delete activity.
+        #
+        # @param federated_url [String] Object identifier
+        # @return [Fedipub::Actor, Fedipub::DataEntity, Fedipub::Following, nil]
+        def find_distant_object_in_all(federated_url)
+          # Search in actors
+          object = Fedipub::Actor.find_by federated_url: federated_url
+          return object if object.present?
+
+          # Search in followings
+          object = Fedipub::Following.find_by federated_url: federated_url
+          return object if object.present?
+
+          # Search in data entities
+          Fedipub.configuration.data_types.keys.sort.each do |klass|
+            object = klass.constantize.find_by federated_url: federated_url
+
+            break if object.present?
+          end
+
+          object
+        end
+
+        # Finds or initializes an entity from an ActivityPub object or id
+        #
+        # @see .find_or_initialize
+        #
+        # @param object_or_id [String, Hash] String identifier or incoming object
+        #
+        # @return [ApplicationRecord, nil] Entity or nil when invalid/not found
+        def find_or_initialize!(object_or_id)
+          entity = find_or_initialize object_or_id
+          raise ActiveRecord::RecordNotFound unless entity
+
+          entity
+        end
+
+        # Finds or create an entity from an ActivityPub object or id
+        #
+        # Note that the data transformer MUST return timestamps from the ActivityPub object if used on the model,
+        # as they won't be set automatically.
+        #
+        # @see .find_or_initialize!
+        #
+        # @param object_or_id [String, Hash] String identifier or incoming object
+        #
+        # @return [ApplicationRecord, nil] Entity or nil when invalid/not found
+        def find_or_create!(object_or_id)
+          entity = find_or_initialize! object_or_id
+          return entity if entity.persisted?
+
+          entity.save!(touch: false)
+          entity
+        end
+
+        # Returns the timestamps to use from an ActivityPub object
+        #
+        # @param hash [Hash] ActivityPub object
+        #
+        # @return [Hash] Hash with timestamps
+        def timestamp_attributes(hash)
+          {
+            created_at: hash['published'] ||= Time.current,
+            updated_at: hash['updated'].presence || hash['published'],
+          }
+        end
+
+        private
+
+        def local_route(url)
+          route = Utils::Host.local_route(url)
+
+          return nil unless route && route[:controller] == 'fedipub/server/published' && route[:action] == 'show'
+
+          route
+        end
+
+        def from_local_route(route)
+          config = Fedipub.data_entity_handled_on route[:publishable_type]
+          return unless config
+
+          config[:class]&.find_by(config[:url_param] => route[:id])
+        rescue ActiveRecord::RecordNotFound
+          nil
+        end
+
+        def from_distant_server(federated_url)
+          hash = Fediverse::Request.dereference(federated_url)
+          return unless hash
+
+          handler = Fedipub.data_entity_handler_for hash
+          return unless handler
+
+          entity = handler[:class].find_by federated_url: hash['id']
+          return entity if entity
+
+          entity = handler[:class].new_from_activitypub_object(hash)
+          return unless entity
+
+          entity.fedipub_actor = Fedipub::Actor.find_by_federation_url hash['attributedTo'] if entity && !entity.fedipub_actor
+
+          entity
+        end
+      end
+    end
+  end
+end

data/lib/fedipub/utils/response_codes.rb

@@ -0,0 +1,11 @@
+module Fedipub
+  module Utils
+    module ResponseCodes
+      UNPROCESSABLE_CONTENT = if Gem::Version.new(Rack::RELEASE) < Gem::Version.new('3.1')
+                                :unprocessable_entity
+                              else
+                                :unprocessable_content
+                              end
+    end
+  end
+end

data/lib/fedipub/version.rb

@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Fedipub
-  VERSION = "0.0.1"
+  VERSION = '0.9.0'.freeze
 end

data/lib/fedipub.rb

@@ -1,8 +1,131 @@
-# frozen_string_literal: true
+require 'jbuilder'
+require 'kaminari'
+require 'pundit'
 
-require_relative "fedipub/version"
+require 'fedipub/version'
+require 'fedipub/engine'
+require 'fedipub/configuration'
+require 'fedipub/utils/object'
+require 'fedipub/utils/json_request'
+require 'fedipub/utils/response_codes'
 
+require 'fediverse'
+
+# rubocop:disable Style/ClassVars
+
+# This module includes classes and methods related to Ruby on Rails: engine configuration, models, controllers, etc.
 module Fedipub
-  class Error < StandardError; end
-  # Your code goes here...
+  DEFAULT_DATA_FILTER_METHOD = :handle_federated_object?
+
+  mattr_reader :configuration
+  @@configuration = Configuration
+
+  class << self
+    def configure
+      yield @@configuration
+    end
+
+    def config_from(name) # rubocop:disable Metrics/MethodLength
+      config = Rails.application.config_for name
+      [
+        :app_name,
+        :app_version,
+        :force_ssl,
+        :site_host,
+        :site_port,
+        :enable_discovery,
+        :open_registrations,
+        :nodeinfo_metadata,
+        :app_layout,
+        :server_routes_path,
+        :client_routes_path,
+        :remote_follow_url_method,
+        :base_client_controller,
+        :remote_entities_cache_duration,
+        :job_queue,
+      ].each { |key| Configuration.send :"#{key}=", config[key] if config.key?(key) }
+    end
+
+    # @return [Boolean] True if the given model is a possible actor
+    #
+    # @example
+    #   puts "Follow #{some_actor.name}" if actor_entity? current_user
+    def actor_entity?(class_or_instance)
+      Configuration.actor_types.key? class_or_instance_name(class_or_instance)
+    end
+
+    # @return [Hash] The configuration for the given actor entity
+    def actor_entity(class_or_instance)
+      klass = class_or_instance_name(class_or_instance)
+      raise "#{klass} is not a configured actor entity" unless Configuration.actor_types.key?(klass)
+
+      Configuration.actor_types[klass]
+    end
+
+    # @return [Boolean] True if the given model is a possible data entity
+    def data_entity?(class_or_instance)
+      Configuration.data_types.key? class_or_instance_name(class_or_instance)
+    end
+
+    # Finds configured data types from ActivityPub type
+    #
+    # @param type [String] ActivityPub object type, as configured with `:handles`
+    # @return [Array] List of data entity configurations
+    #
+    # @example
+    #   data_entity_handlers_for 'Note'
+    def data_entity_handlers_for(type)
+      Fedipub::Configuration.data_types.select { |_, v| v[:handles] == type }.map(&:last)
+    end
+
+    # Finds the configured handler for a given ActivityPub object
+    #
+    # @param hash [Hash] ActivityPub object hash
+    #
+    # @return [Hash, nil] Data entity configuration
+    def data_entity_handler_for(hash)
+      data_entity_handlers_for(hash['type']).find do |handler|
+        if handler[:filter_method] || handler[:class].respond_to?(DEFAULT_DATA_FILTER_METHOD)
+          handler[:class].send(handler[:filter_method] || DEFAULT_DATA_FILTER_METHOD, hash)
+        else
+          true
+        end
+      end
+    end
+
+    # Finds configured data type from route path segment
+    #
+    # @param route_path_segment [Symbol, String] Route path segment, as configured with `:route_path_segment`
+    # @return [Hash, nil] Entity configuration
+    #
+    # @example
+    #   data_entity_handled_on :articles
+    def data_entity_handled_on(route_path_segment)
+      route_path_segment = route_path_segment.to_sym
+      Fedipub::Configuration.data_types.find { |_, v| v[:route_path_segment] == route_path_segment }&.last
+    end
+
+    # @return [Hash] The configuration for the given data entity
+    def data_entity_configuration(class_or_instance)
+      klass = class_or_instance_name(class_or_instance)
+      raise "#{klass} is not a configured data entity" unless Configuration.data_types.key?(klass)
+
+      Configuration.data_types[klass]
+    end
+
+    private
+
+    # @return [String] Class name of the provided class or instance
+    def class_or_instance_name(class_or_instance)
+      case class_or_instance
+      when String
+        class_or_instance
+      when Class
+        class_or_instance.name
+      else
+        class_or_instance.class.name
+      end
+    end
+  end
 end
+# rubocop:enable Style/ClassVars

data/lib/fediverse/collection.rb

@@ -0,0 +1,31 @@
+module Fediverse
+  class Collection < Array
+    PUBLIC = 'https://www.w3.org/ns/activitystreams#Public'.freeze
+
+    attr_reader :total_items, :id, :type
+
+    def self.fetch(url)
+      new.fetch(url)
+    end
+
+    def fetch(url)
+      json = Fediverse::Request.dereference(url)
+      @total_items = json['totalItems']
+      @id = json['id']
+      @type = json['type']
+      raise Errors::NotACollection unless %w[OrderedCollection Collection].include?(@type)
+
+      next_url = json['first']
+      while next_url
+        page = Fediverse::Request.dereference(next_url)
+        concat(page['orderedItems'] || page['items'])
+        next_url = page['next']
+      end
+      self
+    end
+  end
+
+  module Errors
+    class NotACollection < StandardError; end
+  end
+end

data/lib/fediverse/inbox.rb

@@ -0,0 +1,110 @@
+require 'fediverse/request'
+
+module Fediverse
+  class Inbox
+    @@handlers = {} # rubocop:todo Style/ClassVars
+    class << self
+      # Registers a handler for incoming data
+      #
+      # Unless a specific type is not implemented in Fedipub, you should leave the 'Delete' activity to Fedipub:
+      # it will dispatch a `on_fedipub_delete_requested` event on the right objects.
+      #
+      # @param activity_type [String] Target activity type ('Create', 'Follow', 'Like', ...)
+      #   See https://www.w3.org/TR/activitystreams-vocabulary/#activity-types for a list of common ones
+      # @param object_type [String] Type of the related object ('Article', 'Note', ...)
+      #   See https://www.w3.org/TR/activitystreams-vocabulary/#object-types for a list of common object types
+      # @param klass [String] Class handling the incoming object
+      # @param method [Symbol] Method in the class that will handle the object
+      def register_handler(activity_type, object_type, klass, method)
+        @@handlers[activity_type] ||= {}
+        @@handlers[activity_type][object_type] ||= {}
+        @@handlers[activity_type][object_type][klass] = method
+      end
+
+      # Executes the registered handler for an incoming object
+      #
+      # @param payload [Hash] Dereferenced activity
+      def dispatch_request(payload)
+        return dispatch_delete_request(payload) if payload['type'] == 'Delete'
+
+        payload['object'] = Fediverse::Request.dereference(payload['object']) if payload.key? 'object'
+
+        handlers = get_handlers(payload['type'], payload.dig('object', 'type'))
+        handlers.each_pair do |klass, method|
+          klass.send method, payload
+        end
+        return true unless handlers.empty?
+
+        Rails.logger.debug { "Unhandled activity type: #{payload['type']}" }
+        false
+      end
+
+      private
+
+      def dispatch_delete_request(payload)
+        payload['object'] = payload['object']['id'] unless payload['object'].is_a? String
+        object = Fedipub::Utils::Object.find_distant_object_in_all payload['object']
+        return if object.blank?
+
+        object.run_callbacks :on_fedipub_delete_requested
+      end
+
+      def get_handlers(activity_type, object_type)
+        {}.merge(@@handlers.dig(activity_type, object_type) || {})
+          .merge(@@handlers.dig(activity_type, '*') || {})
+          .merge(@@handlers.dig('*', '*') || {})
+          .merge(@@handlers.dig('*', object_type) || {})
+      end
+
+      def handle_create_follow_request(activity)
+        actor        = Fedipub::Actor.find_or_create_by_object activity['actor']
+        target_actor = Fedipub::Actor.find_or_create_by_object activity['object']
+
+        Fedipub::Following.create! actor: actor, target_actor: target_actor, federated_url: activity['id']
+      end
+
+      def handle_accept_follow_request(activity)
+        original_activity = Request.dereference(activity['object'])
+
+        actor        = Fedipub::Actor.find_or_create_by_object original_activity['actor']
+        target_actor = Fedipub::Actor.find_or_create_by_object original_activity['object']
+        raise 'Follow not accepted by target actor but by someone else' if activity['actor'] != target_actor.federated_url
+
+        follow = Fedipub::Following.find_by actor: actor, target_actor: target_actor
+        follow.accept!
+      end
+
+      def handle_undo_follow_request(activity)
+        original_activity = activity['object']
+
+        actor        = Fedipub::Actor.find_or_create_by_object original_activity['actor']
+        target_actor = Fedipub::Actor.find_or_create_by_object original_activity['object']
+
+        follow = Fedipub::Following.find_by actor: actor, target_actor: target_actor
+        follow&.destroy
+      end
+
+      def handle_delete_request(activity)
+        object = Fedipub::Utils::Object.find_distant_object_in_all(activity['object'])
+        return if object.blank?
+
+        object.run_callbacks :on_fedipub_delete_requested
+      end
+
+      def handle_undelete_request(activity)
+        # Get to original object
+        delete_activity = Request.dereference(activity['object'])
+        object = Fedipub::Utils::Object.find_distant_object_in_all(delete_activity['object'])
+        return if object.blank?
+
+        object.run_callbacks :on_fedipub_undelete_requested
+      end
+    end
+
+    register_handler 'Follow', '*', self, :handle_create_follow_request
+    register_handler 'Accept', 'Follow', self, :handle_accept_follow_request
+    register_handler 'Undo', 'Follow', self, :handle_undo_follow_request
+    register_handler 'Delete', '*', self, :handle_delete_request
+    register_handler 'Undo', 'Delete', self, :handle_undelete_request
+  end
+end

data/lib/fediverse/node_info.rb

@@ -0,0 +1,38 @@
+module Fediverse
+  class NodeInfo
+    class NotFoundError < StandardError; end
+    class NoActivityPubError < StandardError; end
+
+    class << self
+      def fetch(domain)
+        url = nodeinfo_url(domain)
+
+        hash = Fedipub::Utils::JsonRequest.get_json url
+        raise NoActivityPubError, "#{domain} does not handle activitypub protocol" unless hash['protocols'].include? 'activitypub'
+
+        {
+          domain:           domain,
+          nodeinfo_url:     url,
+          software_version: hash.dig('software', 'version'),
+          software_name:    hash.dig('software', 'name'),
+          protocols:        hash['protocols'],
+          services:         hash['services'],
+        }
+      end
+
+      private
+
+      def base_url(domain)
+        scheme = Fedipub::Configuration.force_ssl ? 'https' : 'http'
+        @base_url = "#{scheme}://#{domain}"
+      end
+
+      def nodeinfo_url(domain)
+        response = Fedipub::Utils::JsonRequest.get_json "#{base_url(domain)}/.well-known/nodeinfo", follow_redirects: true
+        entry = response['links']&.find { |link| link['rel'] == 'http://nodeinfo.diaspora.software/ns/schema/2.0' }
+
+        entry['href']
+      end
+    end
+  end
+end

data/lib/fediverse/notifier.rb

@@ -0,0 +1,90 @@
+require 'fediverse/signature'
+
+module Fediverse
+  class Notifier
+    class << self
+      # Posts an activity to its recipients
+      #
+      # @param activity [Fedipub::Activity]
+      def post_to_inboxes(activity)
+        # Get the list of actors we need to send the activity to
+        inboxes = inboxes_for(activity)
+        Rails.logger.debug('Nobody to notice') && return if inboxes.none?
+
+        # Deliver to each inbox
+        message = payload(activity)
+        inboxes.each do |url|
+          Rails.logger.debug { "Sending activity ##{activity.id} to inbox at #{url}" }
+          post_to_inbox(inbox_url: url, message: message, from: activity.actor)
+        end
+      end
+
+      private
+
+      # Determines the list of inboxes that the activity should be delivered to
+      #
+      # @return [Array<Fedipub::Actor>]
+      def inboxes_for(activity)
+        return [] unless activity.actor.local?
+
+        [activity.to, activity.cc].flatten.compact.reject { |x| x == Fediverse::Collection::PUBLIC }.map do |url|
+          actor = Fedipub::Actor.find_or_create_by_federation_url(url)
+          [actor.inbox_url]
+        rescue ActiveRecord::RecordNotFound, ActiveRecord::RecordInvalid
+          collection_to_actors(url).map(&:inbox_url)
+        end.flatten.compact
+      end
+
+      def collection_to_actors(url)
+        collection = Collection.fetch(url)
+        collection.filter_map do |actor_url|
+          Fedipub::Actor.find_or_create_by_federation_url(actor_url)
+        rescue ActiveRecord::RecordNotFound, ActiveRecord::RecordInvalid
+          nil
+        end
+      rescue Errors::NotACollection
+        []
+      end
+
+      def payload(activity)
+        Fedipub::ServerController.renderer.new.render(
+          template: 'fedipub/server/activities/show',
+          assigns:  { activity: activity },
+          format:   :json
+        )
+      end
+
+      def post_to_inbox(inbox_url:, message:, from: nil)
+        conn = Faraday.default_connection
+        conn.builder.build_response(
+          conn,
+          signed_request(url: inbox_url, message: message, from: from)
+        )
+      end
+
+      def signed_request(url:, message:, from:)
+        req = request(url: url, message: message)
+        req.headers['Signature'] = Fediverse::Signature.sign(sender: from, request: req) if from
+        req
+      end
+
+      def request(url:, message:) # rubocop:todo Metrics/AbcSize
+        Faraday.default_connection.build_request(:post) do |req|
+          req.url url
+          req.body = message
+          req.headers['Content-Type'] = Mime[:activitypub].to_s
+          req.headers['Accept'] = Mime[:activitypub].to_s
+          req.headers['Host'] = URI.parse(url).host
+          req.headers['Date'] = Time.now.utc.httpdate
+          req.headers['Digest'] = digest(message)
+        end
+      end
+
+      def digest(message)
+        "SHA-256=#{Base64.strict_encode64(
+          OpenSSL::Digest.new('SHA256').digest(message)
+        )}"
+      end
+    end
+  end
+end

data/lib/fediverse/request.rb

@@ -0,0 +1,29 @@
+require 'json/ld'
+
+module Fediverse
+  class Request
+    class << self
+      # Dereferences a value
+      #
+      # @param value [String, Hash]
+      #
+      # @return [Hash, nil]
+      def dereference(value)
+        return value if value.is_a? Hash
+        return get(value) if value.is_a? String
+
+        raise "Unhandled object type #{value.class}"
+      end
+
+      private
+
+      def get(id)
+        json = Fedipub::Utils::JsonRequest.get_json(id)
+
+        JSON::LD::API.compact json, json['@context']
+      rescue JSON::ParserError
+        nil
+      end
+    end
+  end
+end

data/lib/fediverse/signature.rb

@@ -0,0 +1,49 @@
+module Fediverse
+  class Signature
+    class << self
+      def sign(sender:, request:)
+        private_key = OpenSSL::PKey::RSA.new sender.private_key, Rails.application.credentials.secret_key_base
+        headers = '(request-target) host date digest'
+        sig = Base64.strict_encode64(
+          private_key.sign(
+            OpenSSL::Digest.new('SHA256'), signature_payload(request: request, headers: headers)
+          )
+        )
+        {
+          keyId:     sender.key_id,
+          headers:   headers,
+          signature: sig,
+        }.map { |k, v| "#{k}=\"#{v}\"" }.join(',')
+      end
+
+      def verify(sender:, request:)
+        raise 'Unsigned headers' unless request.headers['Signature']
+
+        signature_header = request.headers['Signature'].split(',').to_h do |pair|
+          /\A(?<key>\w+)="(?<value>.*)"\z/ =~ pair
+          [key, value]
+        end
+
+        headers   = signature_header['headers']
+        signature = Base64.decode64(signature_header['signature'])
+        key       = OpenSSL::PKey::RSA.new(sender.public_key)
+
+        comparison_string = signature_payload(request: request, headers: headers)
+
+        key.verify(OpenSSL::Digest.new('SHA256'), signature, comparison_string)
+      end
+
+      private
+
+      def signature_payload(request:, headers:)
+        headers.split.map do |signed_header_name|
+          if signed_header_name == '(request-target)'
+            "(request-target): #{request.http_method} #{URI.parse(request.path).path}"
+          else
+            "#{signed_header_name}: #{request.headers[signed_header_name.capitalize]}"
+          end
+        end.join("\n")
+      end
+    end
+  end
+end