fedipub 0.9.0 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e48fe0306a23dd822ac8e755412635303612686408512d9cd36139050fc961a7
-  data.tar.gz: ca741f66e2d65b4501b9ae80465fde3500f81d65f55b56b0eef1d0a96bf2b97c
+  metadata.gz: 506f49df52ad99cb113b5526bace6666e2a916cfe13f0abcfe7afe49d08e295f
+  data.tar.gz: 1f9cb4fa11e555fec1ea7b0e9e0b600dc14b2d9ba9b31f5ebe7c63f22c554818
 SHA512:
-  metadata.gz: e96c6dcb707777a477078d15b750e2257dafecdd7c489a21f2c8beea9c965be237da1ed414ac27327e684874d840d11274336106defb1d1fe43df242b6b274e8
-  data.tar.gz: da1eca4e3c5d882a0dabec9668d521f1f9a707a6dfcbfe36d4ed6d42ffa761d0c7049ffc67d3d1666cae535d85af6ff80cdb11582ff4e6d068365e0949ed737c
+  metadata.gz: 915f0da60e1cdde3e9f10f3f3737e21063eacadc8ca5d7ace7f46a478aa0332f884d54df9796feecf4278278f856e8ffde2bba07fc0ea8ca06d347dcf600460a
+  data.tar.gz: e44d799ce12d87b68a89befa4135c06596554452b8ac37d74bda7213d841641854dfe1567c0ceb774991120fb3ed325f76fbdc3b32f5edac9816e77950793d53

data/README.md

@@ -48,9 +48,14 @@ It _may_ work on other versions, but we won't provide support.
 
 Extensions add extra features to Fedipub:
 
-- [Fedipub Moderation](https://github.com/fedipub/fedipub-moderation/)
+- [Fedipub Moderation](https://gitlab.com/fedipub/fedipub-moderation/)
   > A gem that provides trust & safety for Fedipub
 
+## Projects using Fedipub
+
+- [Manyfold](https://github.com/manyfold3d/manyfold)
+- [Prismo](https://github.com/mbajur/prismo)
+
 ## License
 
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
@@ -62,6 +67,7 @@ See [CONTRIBUTING](CONTRIBUTING.md) to have an overview of the process and the t
 ### Contributors
 
 - [echarp](https://gitlab.com/echarp)
+- [Francesco Urdih](https://gitlab.com/francesco.urdih)
 - [James Smith](https://gitlab.com/floppy.uk)
 - [Manuel Tancoigne](https://gitlab.com/mtancoigne)
 - [pessi-v](https://github.com/pessi-v)

data/app/controllers/fedipub/server/web_finger_controller.rb

@@ -6,17 +6,16 @@ module Fedipub
       def find
         skip_authorization
 
-        resource = params.require(:resource)
-        case resource
+        case resource = params.require(:resource)
+        when %r{^https?://#{Fedipub::Utils::Host.localhost}/?$}
+          @actor = Fedipub::Actor.application_actor
         when %r{^https?://.+}
-          @user = Fedipub::Actor.find_by_federation_url!(resource).entity # rubocop:disable Rails/DynamicFindBy
+          @actor = Fedipub::Actor.find_by_federation_url!(resource) # rubocop:disable Rails/DynamicFindBy
         when /^acct:.+/
-          actor = Fedipub::Actor.find_local_by_username(username)
-          raise Fedipub::Actor::TombstonedError if actor&.tombstoned?
-
-          @user = actor&.entity
+          @actor = Fedipub::Actor.find_local_by_username(username)
+          raise Fedipub::Actor::TombstonedError if @actor&.tombstoned?
         end
-        raise ActiveRecord::RecordNotFound if @user.nil?
+        raise ActiveRecord::RecordNotFound if @actor.nil?
 
         render formats: [:jrd]
       end

data/app/controllers/fedipub/server_controller.rb

@@ -2,6 +2,7 @@ module Fedipub
   class ServerController < ::ActionController::Base # rubocop:disable Rails/ApplicationController
     include Pundit::Authorization
 
+    before_action :verify_request_signature!
     after_action :verify_authorized
 
     protect_from_forgery with: :null_session
@@ -12,8 +13,18 @@ module Fedipub
                 Fedipub::DataEntity::TombstonedError,
                 with: :error_gone
 
+    def self.require_signature?
+      false
+    end
+
     private
 
+    def verify_request_signature!
+      Fediverse::Signature.verify!(request: request, require_signature: ServerController.require_signature?)
+    rescue Fediverse::Signature::BadSignature
+      head :unauthorized
+    end
+
     def error_fallback(exception, fallback_message, status)
       message = exception&.message || fallback_message
       respond_to do |format|

data/app/models/concerns/fedipub/actor_entity.rb

@@ -38,7 +38,7 @@ module Fedipub
       #
       # @example
       #   acts_as_fedipub_actor username_field: :username, name_field: :display_name, profile_url_method: :url_for, actor_type: 'Person'
-      # rubocop:disable Metrics/ParameterLists
+      # rubocop:disable-next Metrics/ParameterLists
       def acts_as_fedipub_actor(
         name_field:,
         username_field:,
@@ -57,7 +57,6 @@ module Fedipub
           auto_create_actors: auto_create_actors
         )
       end
-      # rubocop:enable Metrics/ParameterLists
 
       # Define a method that will be called after the entity receives a follow request.
       # The follow request will be passed as an argument to the method.

data/app/models/concerns/fedipub/application_actor.rb

@@ -0,0 +1,25 @@
+module Fedipub
+  # Definition for a single local Application Actor, which represents the instance/server itself.
+  #
+  # Keys from this actor are used to sign outgoing GET requests.
+  module ApplicationActor
+    extend ActiveSupport::Concern
+
+    APPLICATION_ACTOR_ATTRIBUTES = {
+      username:   '__application',
+      actor_type: 'Application',
+      entity:     nil,
+      local:      true,
+    }.freeze
+
+    included do
+      def self.application_actor
+        find_or_create_by!(APPLICATION_ACTOR_ATTRIBUTES)
+      end
+
+      def application_actor?
+        APPLICATION_ACTOR_ATTRIBUTES.all? { |attribute, value| attributes[attribute.to_s] == value }
+      end
+    end
+  end
+end

data/app/models/concerns/fedipub/data_entity.rb

@@ -126,7 +126,7 @@ module Fedipub
       #
       # @example
       #   acts_as_fedipub_data handles: 'Note', with: :note_handler, route_path_segment: :articles, actor_entity_method: :user
-      # rubocop:disable Metrics/ParameterLists, Metrics/MethodLength
+      # rubocop:disable-next Metrics/ParameterLists, Metrics/MethodLength
       def acts_as_fedipub_data(
         handles:,
         with: :handle_incoming_fediverse_data,
@@ -155,7 +155,6 @@ module Fedipub
         Fediverse::Inbox.register_handler 'Create', handles, self, with
         Fediverse::Inbox.register_handler 'Update', handles, self, with
       end
-      # rubocop:enable Metrics/ParameterLists, Metrics/MethodLength
 
       # Instantiates a new instance from an ActivityPub object
       #

data/app/models/fedipub/actor.rb

@@ -16,18 +16,17 @@ module Fedipub
     include Fedipub::HandlesDeleteRequests
     include Fedipub::Likeable
     include Fedipub::Announceable
+    include Fedipub::ApplicationActor
 
-    validates :federated_url, presence: { unless: :entity }, uniqueness: { unless: :local? }
+    validates :federated_url, presence: { unless: -> { entity || application_actor? } }, uniqueness: { unless: :local? }
     validates :username, presence: { unless: :local? }
     validates :server, presence: { unless: :local? }
     validates :inbox_url, presence: { unless: :local? }
     validates :outbox_url, presence: { unless: :local? }
-    validates :followers_url, presence: { unless: :local? }
-    validates :followings_url, presence: { unless: :local? }
     validates :profile_url, presence: { unless: :local? }
-    validates :actor_type, presence: { unless: :local? }
+    validates :actor_type, presence: { unless: -> { local? && !application_actor? } }
     validates :entity_id, uniqueness: { scope: :entity_type }, if: :entity_type
-    validates :entity, presence: true, if: -> { local? && !tombstoned? }
+    validates :entity, presence: true, if: -> { local? && !tombstoned? && !application_actor? }
 
     belongs_to :entity, polymorphic: true, optional: true
     # FIXME: Handle this with something like undelete
@@ -59,7 +58,7 @@ module Fedipub
     end
 
     def federated_url
-      use_entity_attributes? ? Fedipub::Engine.routes.url_helpers.server_actor_url(self) : attributes['federated_url'].presence
+      use_entity_attributes? || application_actor? ? Fedipub::Engine.routes.url_helpers.server_actor_url(self) : attributes['federated_url'].presence
     end
 
     def username
@@ -75,7 +74,7 @@ module Fedipub
     end
 
     def server
-      use_entity_attributes? ? Utils::Host.localhost : attributes['server']
+      use_entity_attributes? || application_actor? ? Utils::Host.localhost : attributes['server']
     end
 
     def actor_type
@@ -83,19 +82,19 @@ module Fedipub
     end
 
     def inbox_url
-      use_entity_attributes? ? Fedipub::Engine.routes.url_helpers.server_actor_inbox_url(self) : attributes['inbox_url']
+      use_entity_attributes? || application_actor? ? Fedipub::Engine.routes.url_helpers.server_actor_inbox_url(self) : attributes['inbox_url']
     end
 
     def outbox_url
-      use_entity_attributes? ? Fedipub::Engine.routes.url_helpers.server_actor_outbox_url(self) : attributes['outbox_url']
+      use_entity_attributes? || application_actor? ? Fedipub::Engine.routes.url_helpers.server_actor_outbox_url(self) : attributes['outbox_url']
     end
 
     def followers_url
-      use_entity_attributes? ? Fedipub::Engine.routes.url_helpers.followers_server_actor_url(self) : attributes['followers_url']
+      use_entity_attributes? || application_actor? ? Fedipub::Engine.routes.url_helpers.followers_server_actor_url(self) : attributes['followers_url']
     end
 
     def followings_url
-      use_entity_attributes? ? Fedipub::Engine.routes.url_helpers.following_server_actor_url(self) : attributes['followings_url']
+      use_entity_attributes? || application_actor? ? Fedipub::Engine.routes.url_helpers.following_server_actor_url(self) : attributes['followings_url']
     end
 
     def profile_url
@@ -244,6 +243,10 @@ module Fedipub
         end
         return actor if actor
 
+        # Look for pure actors (e.g. the application actor)
+        actor = Fedipub::Actor.local.find_by username: username
+        return actor if actor
+
         # Last hope: Search for tombstoned actors
         Fedipub::Actor.local.tombstoned.find_by username: username
       end

data/app/views/fedipub/server/actors/_actor.activitypub.jbuilder

@@ -25,3 +25,17 @@ if actor.public_key
   end
 end
 json.merge! actor_data
+
+# FEP-844e capability discovery
+if actor.application_actor?
+  json.implements([
+    'https://www.w3.org/TR/activitypub/',
+    'https://datatracker.ietf.org/doc/html/rfc9421',
+    'https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-12',
+    'https://w3id.org/fep/844e',
+    'https://w3id.org/fep/2677',
+    'https://w3id.org/fep/d556',
+  ].map { |url| { 'href' => url } })
+else
+  json.generator Fedipub::Actor.application_actor.federated_url
+end

data/app/views/fedipub/server/nodeinfo/index.nodeinfo.jbuilder

@@ -3,4 +3,8 @@ json.links [
     rel:  'http://nodeinfo.diaspora.software/ns/schema/2.0',
     href: show_node_info_url,
   },
+  {
+    rel:  'https://www.w3.org/ns/activitystreams#Application',
+    href: Fedipub::Actor.application_actor.federated_url,
+  },
 ]

data/app/views/fedipub/server/web_finger/find.jrd.jbuilder

@@ -5,16 +5,24 @@ links = [
   {
     rel:  'self',
     type: Mime[:activitypub].to_s,
-    href: @user.fedipub_actor.federated_url,
+    href: @actor.federated_url,
   },
 ]
 
+if @actor.application_actor?
+  links << {
+    rel:  'https://www.w3.org/ns/activitystreams#Service',
+    type: Mime[:activitypub].to_s,
+    href: @actor.federated_url,
+  }
+end
+
 # User profile URL if configured
 # TODO: Add a profile controller/action in dummy to test this
-if @user.fedipub_actor.profile_url
+if @actor.profile_url
   links.push rel:  'https://webfinger.net/rel/profile-page',
              type: 'text/html',
-             href: @user.fedipub_actor.profile_url
+             href: @actor.profile_url
 end
 
 # Remote following

data/lib/fedipub/utils/json_request.rb

@@ -1,41 +1,89 @@
 require 'faraday'
 require 'faraday/follow_redirects'
+require 'fediverse/signature'
 
 module Fedipub
   module Utils
-    # Simple wrapper to make requests expecting JSON
-    module JsonRequest
-      class UnhandledResponseStatus < StandardError; end
+    # Wrapper around HTTP calls which ensures signatures etc are applied.
+    class JsonRequest
+      include Singleton
+
+      class << self
+        extend Forwardable
+
+        def_delegators :instance, :get_json, :get, :post
+      end
 
-      BASE_HEADERS = {
-        'Content-Type' => 'application/json',
-        'Accept'       => 'application/json',
-      }.freeze
+      class UnhandledResponseStatus < StandardError; end
 
       # Makes a GET request and returns a +Hash+ from the parsed body
       #
       # @param url [String] Target URL
       # @param params [Hash] Querystring parameters
       # @param headers [Hash] Additional headers
-      # @param follow_redirects [Boolean] Whether to follow redirections
       # @param expected_status [Integer] Expected response status. Will raise a +UnhandledResponseStatus+ when status is different
       #
       # @return The parsed JSON object
       #
       # @raise [UnhandledResponseStatus] when response status is not the expected_status
-      def self.get_json(url, params: {}, headers: {}, follow_redirects: false, expected_status: 200)
-        headers = BASE_HEADERS.merge headers
-
-        connection = Faraday.new url: url, params: params, headers: headers do |faraday|
-          faraday.response :follow_redirects if follow_redirects
-          faraday.adapter Faraday.default_adapter
-        end
-
-        response = connection.get
+      def get_json(url, params: {}, headers: {}, expected_status: 200, from: nil)
+        response = get url: url, params: params, headers: headers, from: from
         raise UnhandledResponseStatus, "Unhandled status code #{response.status} for GET #{url}" if expected_status && response.status != expected_status
 
         JSON.parse(response.body)
       end
+
+      def get(url:, params: {}, headers: {}, from: nil)
+        execute_request method: :get, url: url, params: params, headers: headers, from: from || Fedipub::Actor.application_actor
+      end
+
+      def post(url:, message:, headers: {}, from: nil)
+        execute_request method: :post, url: url, headers: headers, message: message, from: from
+      end
+
+      private
+
+      # Send to remote server with RFC9421 signature and double-knocking for draft-cavage-12 if that fails
+      def execute_request(method:, url:, params: {}, headers: {}, message: nil, from: nil) # rubocop:disable Metrics/ParameterLists
+        req = build_request(method: method, url: url, params: params, headers: headers, message: message)
+        response = connection.builder.build_response(
+          connection,
+          from ? Fediverse::Signature.sign(sender: from, request: req.dup) : req
+        )
+        # If signature was present and rejected, try double-knocking
+        return response unless from && response.status.in?([400, 401])
+
+        connection.builder.build_response(
+          connection,
+          Fediverse::Signature.sign(sender: from, request: req, legacy_signature: true)
+        )
+      end
+
+      def build_request(method:, url:, params: {}, headers: {}, message: nil) # rubocop:todo Metrics/AbcSize, Metrics/MethodLength
+        # Extract params from URL string if they're in there instead of the hash
+        uri = URI(url)
+        params.merge! Rack::Utils.parse_nested_query(uri.query)
+        uri.query = nil
+        # Build the request
+        connection.build_request(method) do |req|
+          req.url uri
+          req.body = message
+          req.params = params
+          req.headers = {
+            'Content-Type'     => Mime[:activitypub].to_s,
+            'Accept'           => [Mime[:activitypub].to_s, Mime[:activitypub].send(:synonyms), "#{Mime[:json]};q=0.5"].flatten.join(', '),
+            'User-Agent'       => req.headers['User-Agent'] || "Fedipub/#{Fedipub::VERSION}",
+            'Accept-Signature' => 'sig1=()',
+          }.compact.merge(headers)
+        end
+      end
+
+      def connection
+        @connection ||= Faraday.new do |faraday|
+          faraday.response :follow_redirects
+          faraday.adapter Faraday.default_adapter
+        end
+      end
     end
   end
 end

data/lib/fedipub/version.rb

@@ -1,3 +1,3 @@
 module Fedipub
-  VERSION = '0.9.0'.freeze
+  VERSION = '0.10.0'.freeze
 end

data/lib/fediverse/node_info.rb

@@ -28,7 +28,7 @@ module Fediverse
       end
 
       def nodeinfo_url(domain)
-        response = Fedipub::Utils::JsonRequest.get_json "#{base_url(domain)}/.well-known/nodeinfo", follow_redirects: true
+        response = Fedipub::Utils::JsonRequest.get_json "#{base_url(domain)}/.well-known/nodeinfo"
         entry = response['links']&.find { |link| link['rel'] == 'http://nodeinfo.diaspora.software/ns/schema/2.0' }
 
         entry['href']

data/lib/fediverse/notifier.rb

@@ -21,6 +21,11 @@ module Fediverse
 
       private
 
+      # Overridden by Fedipub::Moderation for filtering
+      def post_to_inbox(inbox_url:, message:, from: nil)
+        Fedipub::Utils::JsonRequest.post(url: inbox_url, message: message, from: from)
+      end
+
       # Determines the list of inboxes that the activity should be delivered to
       #
       # @return [Array<Fedipub::Actor>]
@@ -53,38 +58,6 @@ module Fediverse
           format:   :json
         )
       end
-
-      def post_to_inbox(inbox_url:, message:, from: nil)
-        conn = Faraday.default_connection
-        conn.builder.build_response(
-          conn,
-          signed_request(url: inbox_url, message: message, from: from)
-        )
-      end
-
-      def signed_request(url:, message:, from:)
-        req = request(url: url, message: message)
-        req.headers['Signature'] = Fediverse::Signature.sign(sender: from, request: req) if from
-        req
-      end
-
-      def request(url:, message:) # rubocop:todo Metrics/AbcSize
-        Faraday.default_connection.build_request(:post) do |req|
-          req.url url
-          req.body = message
-          req.headers['Content-Type'] = Mime[:activitypub].to_s
-          req.headers['Accept'] = Mime[:activitypub].to_s
-          req.headers['Host'] = URI.parse(url).host
-          req.headers['Date'] = Time.now.utc.httpdate
-          req.headers['Digest'] = digest(message)
-        end
-      end
-
-      def digest(message)
-        "SHA-256=#{Base64.strict_encode64(
-          OpenSSL::Digest.new('SHA256').digest(message)
-        )}"
-      end
     end
   end
 end

data/lib/fediverse/signature/draft_cavage12.rb

@@ -0,0 +1,109 @@
+require 'fediverse/signature'
+
+module Fediverse
+  module Signature
+    class DraftCavage12
+      class << self
+        def sign(sender:, request:)
+          request = set_headers(request)
+
+          parts = {
+            keyId:     sender.key_id,
+            headers:   signature_headers(request).join(' '),
+            signature: signature(sender: sender, request: request),
+          }
+          request.headers['Signature'] = parts.map { |k, v| "#{k}=\"#{v}\"" }.join(',')
+          request
+        end
+
+        def verify!(request:)
+          # Do we have a signature to verify?
+          return false unless request.headers.key?('Signature')
+
+          # Have we got what we need?
+          components = signature_components(request)
+          raise Fediverse::Signature::BadSignature, 'Malformed signature' unless components['signature'] && components['headers']
+
+          # Find the sender
+          sender = find_sender_by_key_id(components['keyId'])
+          raise Fediverse::Signature::BadSignature, "Couldn't find sender" unless sender
+
+          # Build the expected payload
+          comparison_string = signature_payload(request: request, headers: components['headers'])
+
+          # Verify the payload against the signature
+          result = do_verification(components['signature'], sender, comparison_string)
+          raise Fediverse::Signature::BadSignature unless result
+
+          result
+        end
+
+        private
+
+        def do_verification(signature, sender, comparison_string)
+          signature = Base64.decode64(signature)
+          key       = OpenSSL::PKey::RSA.new(sender.public_key)
+          key.verify(OpenSSL::Digest.new('SHA256'), signature, comparison_string)
+        end
+
+        def find_sender_by_key_id(key_id)
+          return unless key_id
+
+          Fedipub::Actor.find_or_create_by_federation_url(
+            key_id.split('#', 2).first
+          )
+        end
+
+        def set_headers(request) #  rubocop:disable Naming/AccessorMethodName
+          request.headers['Digest'] = digest(request.body) if request.body
+          request.headers['Host'] = URI.parse(request.path).host
+          request.headers['Date'] = Time.now.utc.httpdate
+          request
+        end
+
+        def signature_components(request)
+          request.headers['Signature'].split(',').to_h do |pair|
+            /\A(?<key>\w+)="(?<value>.*)"\z/ =~ pair
+            [key, value]
+          end
+        end
+
+        def digest(message)
+          "SHA-256=#{Base64.strict_encode64(
+            OpenSSL::Digest.new('SHA256').digest(message)
+          )}"
+        end
+
+        def signature_payload(request:, headers: signature_headers(request))
+          headers = headers.split if headers.is_a?(String)
+          headers.map do |header|
+            case header
+            when '(request-target)'
+              "(request-target): #{(request.try(:http_method) || request.try(:method)).downcase} #{URI.parse(request.path).path}"
+            else
+              "#{header}: #{request.headers[header.capitalize]}"
+            end
+          end.join("\n")
+        end
+
+        def signature_headers(request)
+          if request.body
+            %w[(request-target) host date digest]
+          else
+            %w[(request-target) host date]
+          end
+        end
+
+        def signature(sender:, request:)
+          private_key = OpenSSL::PKey::RSA.new sender.private_key, Rails.application.credentials.secret_key_base
+          Base64.strict_encode64(
+            private_key.sign(
+              OpenSSL::Digest.new('SHA256'),
+              signature_payload(request: request)
+            )
+          )
+        end
+      end
+    end
+  end
+end

data/lib/fediverse/signature/rfc9421.rb

@@ -0,0 +1,69 @@
+require 'linzer'
+require 'linzer/faraday'
+require 'linzer/rack'
+
+Linzer::Message.register_adapter ActionDispatch::Request, Linzer::Message::Adapter::Rack::Request
+
+module Fediverse
+  module Signature
+    class Rfc9421
+      class << self
+        def sign(sender:, request:)
+          request.headers['Content-Digest'] = digest(request.body) if request.body
+          Linzer.sign!(
+            request,
+            key:        linzer_private_key(sender),
+            components: components(request),
+            params:     {
+              created: Time.now.to_i,
+              alg:     'rsa-v1_5-sha256',
+            }
+          )
+          request
+        end
+
+        def verify!(request:)
+          # Do we have a signature to verify?
+          return false if !request.headers.key?('Signature-Input') || !request.headers.key?('Signature')
+
+          # Verify the signature
+          Linzer.verify!(request) do |key_id|
+            sender = Fedipub::Actor.find_or_create_by_federation_url(key_id.split('#', 2).first)
+            raise Fediverse::Signature::BadSignature if sender.nil?
+
+            linzer_public_key(sender)
+          end
+        rescue Linzer::Error
+          raise Fediverse::Signature::BadSignature
+        end
+
+        private
+
+        # Converts key to right structure for Linzer to use
+        def linzer_private_key(sender)
+          private_key = OpenSSL::PKey::RSA.new sender.private_key, Rails.application.credentials.secret_key_base
+          Linzer.new_rsa_v1_5_sha256_key(private_key.to_pem, sender.key_id)
+        end
+
+        def linzer_public_key(sender)
+          public_key = OpenSSL::PKey::RSA.new(sender.public_key)
+          Linzer.new_rsa_v1_5_sha256_key(public_key.to_pem, sender.key_id)
+        end
+
+        def components(request)
+          if request.body
+            %w[@method @target-uri content-digest]
+          else
+            %w[@method @target-uri]
+          end
+        end
+
+        def digest(message)
+          "sha-256=:#{Base64.strict_encode64(
+            OpenSSL::Digest.new('SHA256').digest(message)
+          )}:"
+        end
+      end
+    end
+  end
+end

data/lib/fediverse/signature.rb

@@ -1,49 +1,26 @@
 module Fediverse
-  class Signature
-    class << self
-      def sign(sender:, request:)
-        private_key = OpenSSL::PKey::RSA.new sender.private_key, Rails.application.credentials.secret_key_base
-        headers = '(request-target) host date digest'
-        sig = Base64.strict_encode64(
-          private_key.sign(
-            OpenSSL::Digest.new('SHA256'), signature_payload(request: request, headers: headers)
-          )
-        )
-        {
-          keyId:     sender.key_id,
-          headers:   headers,
-          signature: sig,
-        }.map { |k, v| "#{k}=\"#{v}\"" }.join(',')
-      end
+  module Signature
+    class BadSignature < StandardError; end
 
-      def verify(sender:, request:)
-        raise 'Unsigned headers' unless request.headers['Signature']
-
-        signature_header = request.headers['Signature'].split(',').to_h do |pair|
-          /\A(?<key>\w+)="(?<value>.*)"\z/ =~ pair
-          [key, value]
+    class << self
+      def sign(sender:, request:, legacy_signature: false)
+        if legacy_signature
+          Fediverse::Signature::DraftCavage12.sign(sender: sender, request: request)
+        else
+          Fediverse::Signature::Rfc9421.sign(sender: sender, request: request)
         end
-
-        headers   = signature_header['headers']
-        signature = Base64.decode64(signature_header['signature'])
-        key       = OpenSSL::PKey::RSA.new(sender.public_key)
-
-        comparison_string = signature_payload(request: request, headers: headers)
-
-        key.verify(OpenSSL::Digest.new('SHA256'), signature, comparison_string)
       end
 
-      private
+      def verify!(request:, require_signature: false) # rubocop:disable Naming/PredicateMethod
+        success = Fediverse::Signature::Rfc9421.verify!(request: request) ||
+                  Fediverse::Signature::DraftCavage12.verify!(request: request)
+        raise(BadSignature) if require_signature && !success
 
-      def signature_payload(request:, headers:)
-        headers.split.map do |signed_header_name|
-          if signed_header_name == '(request-target)'
-            "(request-target): #{request.http_method} #{URI.parse(request.path).path}"
-          else
-            "#{signed_header_name}: #{request.headers[signed_header_name.capitalize]}"
-          end
-        end.join("\n")
+        true
       end
     end
   end
 end
+
+require 'fediverse/signature/draft_cavage12'
+require 'fediverse/signature/rfc9421'

data/lib/fediverse/webfinger.rb

@@ -121,7 +121,7 @@ module Fediverse
       # @return [Hash]
       # @raise [ActiveRecord::RecordNotFound] when the response is invalid
       def get_json(url, params = {})
-        Fedipub::Utils::JsonRequest.get_json(url, params: params, follow_redirects: true, headers: { accept: 'application/json' })
+        Fedipub::Utils::JsonRequest.get_json(url, params: params, headers: { accept: 'application/json' })
       rescue Fedipub::Utils::JsonRequest::UnhandledResponseStatus => e
         Rails.logger.debug { e.message }
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fedipub
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.10.0
 platform: ruby
 authors:
 - Manuel Tancoigne
@@ -93,6 +93,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.0
+- !ruby/object:Gem::Dependency
+  name: linzer
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.8'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.8'
 - !ruby/object:Gem::Dependency
   name: ostruct
   requirement: !ruby/object:Gem::Requirement
@@ -166,6 +180,7 @@ files:
 - app/mailers/fedipub/application_mailer.rb
 - app/models/concerns/fedipub/actor_entity.rb
 - app/models/concerns/fedipub/announceable.rb
+- app/models/concerns/fedipub/application_actor.rb
 - app/models/concerns/fedipub/data_entity.rb
 - app/models/concerns/fedipub/handles_delete_requests.rb
 - app/models/concerns/fedipub/has_uuid.rb
@@ -260,6 +275,8 @@ files:
 - lib/fediverse/notifier.rb
 - lib/fediverse/request.rb
 - lib/fediverse/signature.rb
+- lib/fediverse/signature/draft_cavage12.rb
+- lib/fediverse/signature/rfc9421.rb
 - lib/fediverse/webfinger.rb
 - lib/generators/fedipub/copy_client_policies/USAGE
 - lib/generators/fedipub/copy_client_policies/copy_client_policies_generator.rb