@evanp/activitypub-bot 0.28.3 → 0.28.5

package/lib/activitypubclient.js

@@ -103,9 +103,30 @@ export class ActivityPubClient {
     if (res.status < 200 || res.status > 299) {
       throw createHttpError(res.status, `Could not fetch ${url}`)
     }
-    const json = await res.json()
-    const obj = await as2.import(json)
-    return obj
+    const contentType = res.headers.get('content-type')
+    const mimeType = contentType?.split(';')[0].trim()
+    if (mimeType !== 'application/json' && !mimeType.endsWith('+json')) {
+      this.#logger.warn({ mimeType, url }, 'Unexpected mime type')
+      throw new Error(`Got unexpected mime type ${mimeType} for URL ${url}`)
+    }
+    let json
+    try {
+      json = await res.json()
+    } catch (err) {
+      this.#logger.warn({ url }, 'Error parsing fetch results')
+      throw err
+    }
+    let obj
+    try {
+      obj = await as2.import(json)
+    } catch (err) {
+      this.#logger.warn({ url, json }, 'Error importing JSON as AS2')
+      throw err
+    }
+    const resolved = (URL.parse(url).hash)
+      ? this.#resolveObject(obj, url)
+      : obj
+    return resolved
   }
 
   async post (url, obj, username) {
@@ -220,4 +241,37 @@ export class ActivityPubClient {
       json.object.object = 'https://www.w3.org/ns/activitystreams#Public'
     }
   }
+
+  #resolveObject (obj, url, visited = new Set()) {
+    if (obj.id && obj.id === url) {
+      return obj
+    }
+
+    if (obj.id) {
+      if (visited.has(obj.id)) {
+        return null
+      }
+      visited.add(obj.id)
+    }
+
+    for (const key of obj) {
+      if (key === '@type' || key === '@id') continue
+
+      const val = obj.get(key)
+
+      if (val == null || typeof val[Symbol.iterator] !== 'function') {
+        continue
+      }
+
+      for (const item of val) {
+        if (item instanceof as2.models.Base) {
+          const found = this.#resolveObject(item, url, visited)
+          if (found) {
+            return found
+          }
+        }
+      }
+    }
+    return null
+  }
 }

package/lib/httpsignatureauthenticator.js

@@ -19,6 +19,7 @@ export class HTTPSignatureAuthenticator {
       // Just continue
       return next()
     }
+    this.#logger.debug({ signature }, 'Got signed request')
     const date = req.get('Date')
     if (!date) {
       return next(createHttpError(400, 'No date provided'))
@@ -48,6 +49,7 @@ export class HTTPSignatureAuthenticator {
     this.#logger.debug({ originalUrl }, 'original URL')
     try {
       const keyId = this.#signer.keyId(signature)
+      this.#logger.debug({ keyId }, 'Signed with keyId')
       const ok = await this.#remoteKeyStorage.getPublicKey(keyId)
       if (!ok) {
         throw createHttpError(400, 'public key not found')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.28.3",
+  "version": "0.28.5",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",