@evanp/activitypub-bot 0.37.0 → 0.37.1

package/lib/httpmessagesignature.js

@@ -24,7 +24,7 @@ export class HTTPMessageSignature {
     const inputs = this.#parseSignatureInput(signatureInput)
     const input = this.#bestInput(inputs)
     return (input)
-      ? input.keyId
+      ? input.keyid
       : null
   }
 
@@ -43,8 +43,8 @@ export class HTTPMessageSignature {
 
     const signatureInput = []
 
-    signatureInput.push(['@method', method])
-    signatureInput.push(['@authority', parsed.hostname])
+    signatureInput.push(['@method', method.toUpperCase()])
+    signatureInput.push(['@authority', parsed.host])
     signatureInput.push(['@path', parsed.pathname])
     if (parsed.search) {
       signatureInput.push(['@query', parsed.search])
@@ -57,7 +57,7 @@ export class HTTPMessageSignature {
 
     const created = Math.floor(Date.now() / 1000)
     const componentList = signatureInput.map(([name]) => `"${name}"`).join(' ')
-    const signatureParams = `(${componentList});keyId="${keyId}";alg="rsa-v1_5-sha256";created=${created}`
+    const signatureParams = `(${componentList});keyid="${keyId}";alg="rsa-v1_5-sha256";created=${created}`
 
     signatureInput.push(['@signature-params', signatureParams])
 
@@ -74,7 +74,7 @@ export class HTTPMessageSignature {
     }
   }
 
-  async validate (publicKeyPem, signatureInput, signature, method, path, query, headers) {
+  async validate (publicKeyPem, signatureInput, signature, method, url, headers) {
     const inputs = this.#parseSignatureInput(signatureInput)
     const input = this.#bestInput(inputs)
     if (!input) {
@@ -84,7 +84,7 @@ export class HTTPMessageSignature {
     if (!bytes) {
       throw new Error('No input with supported algorithms')
     }
-    const data = this.#inputData(input, method, path, query, headers)
+    const data = this.#inputData(input, method, url, headers)
     const verifier = this.#getVerifier(input.alg)
     verifier.update(data)
     const options = this.#getVerifierOptions(input.alg)
@@ -101,7 +101,11 @@ export class HTTPMessageSignature {
       const params = match[2].slice(1, -1)
         .split(' ')
         .filter(s => s.length > 0)
-        .map(quoted => quoted.slice(1, -1))
+        .map(token => {
+          const m = token.match(/^"([^"]+)"(.*)$/)
+          if (!m) return token
+          return m[2] ? `${m[1]}${m[2]}` : m[1]
+        })
       const sigvals = {}
       for (const paramMatch of match[3].matchAll(PARAM_RE)) {
         const k = paramMatch[1]
@@ -123,8 +127,9 @@ export class HTTPMessageSignature {
     return null
   }
 
-  #inputData (input, method, path, query, headers) {
+  #inputData (input, method, url, headers) {
     const signatureParams = []
+    const parsed = URL.parse(url)
     for (const param of input.params) {
       let value
       switch (param) {
@@ -135,18 +140,43 @@ export class HTTPMessageSignature {
           value = headers.host
           break
         case '@path':
-          value = path
+          value = parsed.pathname
           break
         case '@query':
-          value = query
+          value = parsed.search
+          break
+        case '@target-uri':
+          value = url
+          break
+        case '@scheme':
+          value = parsed.protocol.slice(0, -1)
+          break
+        case '@request-target':
+          value = (parsed.search)
+            ? `${parsed.pathname}${parsed.search}`
+            : parsed.pathname
           break
         default:
+          if (param.startsWith('@query-param')) {
+            const nameMatch = param.match(/;name="([^"]+)"/)
+            if (!nameMatch) throw new Error('Missing name for @query-param')
+            const paramName = nameMatch[1]
+            signatureParams.push(['@query-param', parsed.searchParams.get(paramName), `name="${paramName}"`])
+            continue
+          }
+          if (param.length > 0 && param[0] === '@') {
+            throw new Error(`Unrecognized derived component ${param}`)
+          }
           value = headers[param]
       }
       signatureParams.push([param, value])
     }
     signatureParams.push(['@signature-params', input.attrStr])
-    return signatureParams.map(pair => `"${pair[0]}": ${pair[1]}`).join('\n')
+    return signatureParams.map(
+      arr => arr.length === 3
+        ? `"${arr[0]}";${arr[2]}: ${arr[1]}`
+        : `"${arr[0]}": ${arr[1]}`
+    ).join('\n')
   }
 
   #getVerifier (alg) {

package/lib/httpsignatureauthenticator.js

@@ -150,7 +150,7 @@ export class HTTPSignatureAuthenticator {
     }
     const { method, headers } = req
     const { origin } = req.app.locals
-    const { pathname: path, search: query } = URL.parse(`${origin}${originalUrl}`)
+    const url = `${origin}${originalUrl}`
 
     const keyId = this.#messageSigner.keyId(signatureInput)
     if (!keyId) {
@@ -163,7 +163,7 @@ export class HTTPSignatureAuthenticator {
     }
     let owner = ok.owner
     let publicKeyPem = ok.publicKeyPem
-    let result = await this.#messageSigner.validate(publicKeyPem, signatureInput, signature, method, path, query, headers)
+    let result = await this.#messageSigner.validate(publicKeyPem, signatureInput, signature, method, url, headers)
     this.#logger.debug(`First validation result: ${result}`)
     if (!result) {
       // May be key rotation. Try again with uncached key
@@ -174,7 +174,7 @@ export class HTTPSignatureAuthenticator {
         this.#logger.debug('different keys')
         owner = ok2.owner
         publicKeyPem = ok2.publicKeyPem
-        result = await this.#messageSigner.validate(publicKeyPem, signatureInput, signature, method, path, query, headers)
+        result = await this.#messageSigner.validate(publicKeyPem, signatureInput, signature, method, url, headers)
         this.#logger.debug(`Validation result: ${result}`)
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.37.0",
+  "version": "0.37.1",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",
@@ -43,7 +43,7 @@
     "sequelize": "^6.37.7"
   },
   "devDependencies": {
-    "@evanp/activitypub-nock": "^0.8.1",
+    "@evanp/activitypub-nock": "^0.9.2",
     "eslint": "^8.57.1",
     "eslint-config-standard": "^17.1.0",
     "eslint-plugin-import": "^2.29.1",