@evanp/activitypub-bot 0.37.0 → 0.38.0

package/lib/app.js

@@ -45,10 +45,12 @@ import { FanoutWorker } from './fanoutworker.js'
 import { IntakeWorker } from './intakeworker.js'
 import { RemoteObjectCache } from './remoteobjectcache.js'
 import { HTTPMessageSignature } from './httpmessagesignature.js'
+import { randomUUID } from 'node:crypto'
 
 const currentDir = dirname(fileURLToPath(import.meta.url))
 const DEFAULT_INDEX_FILENAME = resolve(currentDir, '..', 'web', 'index.html')
 const DEFAULT_PROFILE_FILENAME = resolve(currentDir, '..', 'web', 'profile.html')
+const UUID_REGEXP = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
 
 function createWorkers (logger, count, WorkerClass, ...args) {
   const workers = Array.from({ length: count }, () => new WorkerClass(...args))
@@ -182,9 +184,20 @@ export async function makeApp ({ databaseUrl, origin, bots, logLevel = 'silent',
     profileFileName
   }
 
+  app.use(async (req, res, next) => {
+    let id = req.get('x-request-id')
+    if (!id || !id.match(UUID_REGEXP)) {
+      id = randomUUID()
+    }
+    req.id = id
+    res.set('X-Request-ID', id)
+    next()
+  })
+
   app.use(HTTPLogger({
     logger,
-    level: logLevel
+    level: logLevel,
+    genReqId: (req) => req.id
   }))
 
   app.use(express.json({

package/lib/httpmessagesignature.js

@@ -24,7 +24,7 @@ export class HTTPMessageSignature {
     const inputs = this.#parseSignatureInput(signatureInput)
     const input = this.#bestInput(inputs)
     return (input)
-      ? input.keyId
+      ? input.keyid
       : null
   }
 
@@ -39,12 +39,14 @@ export class HTTPMessageSignature {
   }
 
   async sign ({ privateKey, keyId, url, method, headers }) {
+    this.#logger.debug({ privateKey, keyId, url, method, headers }, 'signing')
+
     const parsed = new URL(url)
 
     const signatureInput = []
 
-    signatureInput.push(['@method', method])
-    signatureInput.push(['@authority', parsed.hostname])
+    signatureInput.push(['@method', method.toUpperCase()])
+    signatureInput.push(['@authority', parsed.host])
     signatureInput.push(['@path', parsed.pathname])
     if (parsed.search) {
       signatureInput.push(['@query', parsed.search])
@@ -57,34 +59,54 @@ export class HTTPMessageSignature {
 
     const created = Math.floor(Date.now() / 1000)
     const componentList = signatureInput.map(([name]) => `"${name}"`).join(' ')
-    const signatureParams = `(${componentList});keyId="${keyId}";alg="rsa-v1_5-sha256";created=${created}`
+    const signatureParams = `(${componentList});keyid="${keyId}";alg="rsa-v1_5-sha256";created=${created}`
 
     signatureInput.push(['@signature-params', signatureParams])
 
+    this.#logger.debug({ signatureInput }, 'built data structure')
+
     const data = signatureInput.map(pair => `"${pair[0]}": ${pair[1]}`).join('\n')
 
+    this.#logger.debug({ data }, 'data')
+
     const signer = crypto.createSign('sha256')
     signer.update(data)
     const signature = signer.sign(privateKey).toString('base64')
     signer.end()
 
-    return {
+    const result = {
       'signature-input': `sig1=${signatureParams}`,
       signature: `sig1=:${signature}:`
     }
+
+    this.#logger.debug({ result }, 'returning headers')
+
+    return result
   }
 
-  async validate (publicKeyPem, signatureInput, signature, method, path, query, headers) {
+  async validate (publicKeyPem, signatureInput, signature, method, url, headers) {
+    this.#logger.debug(
+      { publicKeyPem, signatureInput, signature, method, url, headers }, 'validating signature'
+    )
     const inputs = this.#parseSignatureInput(signatureInput)
+    this.#logger.debug(
+      { inputs }, 'validating signature'
+    )
     const input = this.#bestInput(inputs)
     if (!input) {
       throw new Error('No input with supported algorithms')
     }
+    this.#logger.debug(
+      { input }, 'best input'
+    )
     const bytes = this.#sigBytes(signature, input.name)
     if (!bytes) {
       throw new Error('No input with supported algorithms')
     }
-    const data = this.#inputData(input, method, path, query, headers)
+    const data = this.#inputData(input, method, url, headers)
+    this.#logger.debug(
+      { data }, 'input data'
+    )
     const verifier = this.#getVerifier(input.alg)
     verifier.update(data)
     const options = this.#getVerifierOptions(input.alg)
@@ -101,7 +123,11 @@ export class HTTPMessageSignature {
       const params = match[2].slice(1, -1)
         .split(' ')
         .filter(s => s.length > 0)
-        .map(quoted => quoted.slice(1, -1))
+        .map(token => {
+          const m = token.match(/^"([^"]+)"(.*)$/)
+          if (!m) return token
+          return m[2] ? `${m[1]}${m[2]}` : m[1]
+        })
       const sigvals = {}
       for (const paramMatch of match[3].matchAll(PARAM_RE)) {
         const k = paramMatch[1]
@@ -123,8 +149,9 @@ export class HTTPMessageSignature {
     return null
   }
 
-  #inputData (input, method, path, query, headers) {
+  #inputData (input, method, url, headers) {
     const signatureParams = []
+    const parsed = URL.parse(url)
     for (const param of input.params) {
       let value
       switch (param) {
@@ -135,18 +162,43 @@ export class HTTPMessageSignature {
           value = headers.host
           break
         case '@path':
-          value = path
+          value = parsed.pathname
           break
         case '@query':
-          value = query
+          value = parsed.search
+          break
+        case '@target-uri':
+          value = url
+          break
+        case '@scheme':
+          value = parsed.protocol.slice(0, -1)
+          break
+        case '@request-target':
+          value = (parsed.search)
+            ? `${parsed.pathname}${parsed.search}`
+            : parsed.pathname
           break
         default:
+          if (param.startsWith('@query-param')) {
+            const nameMatch = param.match(/;name="([^"]+)"/)
+            if (!nameMatch) throw new Error('Missing name for @query-param')
+            const paramName = nameMatch[1]
+            signatureParams.push(['@query-param', parsed.searchParams.get(paramName), `name="${paramName}"`])
+            continue
+          }
+          if (param.length > 0 && param[0] === '@') {
+            throw new Error(`Unrecognized derived component ${param}`)
+          }
           value = headers[param]
       }
       signatureParams.push([param, value])
     }
     signatureParams.push(['@signature-params', input.attrStr])
-    return signatureParams.map(pair => `"${pair[0]}": ${pair[1]}`).join('\n')
+    return signatureParams.map(
+      arr => arr.length === 3
+        ? `"${arr[0]}";${arr[2]}: ${arr[1]}`
+        : `"${arr[0]}": ${arr[1]}`
+    ).join('\n')
   }
 
   #getVerifier (alg) {

package/lib/httpsignatureauthenticator.js

@@ -130,6 +130,15 @@ export class HTTPSignatureAuthenticator {
   }
 
   async #authenticateMessageSignature (signature, signatureInput, originalUrl, req, res, next) {
+    this.#logger.debug(
+      { signature, signatureInput, originalUrl },
+      'authenticating message signature'
+    )
+    const date = req.get('Date')
+    if (date && Math.abs(Date.parse(date) - Date.now()) >
+        HTTPSignatureAuthenticator.#maxDateDiff) {
+      throw createHttpError(400, 'Time skew too large')
+    }
     if (req.rawBodyText && req.rawBodyText.length > 0) {
       const digest = req.get('Content-Digest')
       if (!digest) {
@@ -150,7 +159,7 @@ export class HTTPSignatureAuthenticator {
     }
     const { method, headers } = req
     const { origin } = req.app.locals
-    const { pathname: path, search: query } = URL.parse(`${origin}${originalUrl}`)
+    const url = `${origin}${originalUrl}`
 
     const keyId = this.#messageSigner.keyId(signatureInput)
     if (!keyId) {
@@ -163,7 +172,7 @@ export class HTTPSignatureAuthenticator {
     }
     let owner = ok.owner
     let publicKeyPem = ok.publicKeyPem
-    let result = await this.#messageSigner.validate(publicKeyPem, signatureInput, signature, method, path, query, headers)
+    let result = await this.#messageSigner.validate(publicKeyPem, signatureInput, signature, method, url, headers)
     this.#logger.debug(`First validation result: ${result}`)
     if (!result) {
       // May be key rotation. Try again with uncached key
@@ -174,7 +183,7 @@ export class HTTPSignatureAuthenticator {
         this.#logger.debug('different keys')
         owner = ok2.owner
         publicKeyPem = ok2.publicKeyPem
-        result = await this.#messageSigner.validate(publicKeyPem, signatureInput, signature, method, path, query, headers)
+        result = await this.#messageSigner.validate(publicKeyPem, signatureInput, signature, method, url, headers)
         this.#logger.debug(`Validation result: ${result}`)
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",
@@ -43,7 +43,7 @@
     "sequelize": "^6.37.7"
   },
   "devDependencies": {
-    "@evanp/activitypub-nock": "^0.8.1",
+    "@evanp/activitypub-nock": "^0.9.2",
     "eslint": "^8.57.1",
     "eslint-config-standard": "^17.1.0",
     "eslint-plugin-import": "^2.29.1",