@evanp/activitypub-bot 0.37.1 → 0.38.1

package/lib/app.js

@@ -45,10 +45,12 @@ import { FanoutWorker } from './fanoutworker.js'
 import { IntakeWorker } from './intakeworker.js'
 import { RemoteObjectCache } from './remoteobjectcache.js'
 import { HTTPMessageSignature } from './httpmessagesignature.js'
+import { randomUUID } from 'node:crypto'
 
 const currentDir = dirname(fileURLToPath(import.meta.url))
 const DEFAULT_INDEX_FILENAME = resolve(currentDir, '..', 'web', 'index.html')
 const DEFAULT_PROFILE_FILENAME = resolve(currentDir, '..', 'web', 'profile.html')
+const UUID_REGEXP = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
 
 function createWorkers (logger, count, WorkerClass, ...args) {
   const workers = Array.from({ length: count }, () => new WorkerClass(...args))
@@ -182,9 +184,20 @@ export async function makeApp ({ databaseUrl, origin, bots, logLevel = 'silent',
     profileFileName
   }
 
+  app.use(async (req, res, next) => {
+    let id = req.get('x-request-id')
+    if (!id || !id.match(UUID_REGEXP)) {
+      id = randomUUID()
+    }
+    req.id = id
+    res.set('X-Request-ID', id)
+    next()
+  })
+
   app.use(HTTPLogger({
     logger,
-    level: logLevel
+    level: logLevel,
+    genReqId: (req) => req.id
   }))
 
   app.use(express.json({

package/lib/httpmessagesignature.js

@@ -39,6 +39,8 @@ export class HTTPMessageSignature {
   }
 
   async sign ({ privateKey, keyId, url, method, headers }) {
+    this.#logger.debug({ privateKey, keyId, url, method, headers }, 'signing')
+
     const parsed = new URL(url)
 
     const signatureInput = []
@@ -61,30 +63,50 @@ export class HTTPMessageSignature {
 
     signatureInput.push(['@signature-params', signatureParams])
 
+    this.#logger.debug({ signatureInput }, 'built data structure')
+
     const data = signatureInput.map(pair => `"${pair[0]}": ${pair[1]}`).join('\n')
 
+    this.#logger.debug({ data }, 'data')
+
     const signer = crypto.createSign('sha256')
     signer.update(data)
     const signature = signer.sign(privateKey).toString('base64')
     signer.end()
 
-    return {
+    const result = {
       'signature-input': `sig1=${signatureParams}`,
       signature: `sig1=:${signature}:`
     }
+
+    this.#logger.debug({ result }, 'returning headers')
+
+    return result
   }
 
   async validate (publicKeyPem, signatureInput, signature, method, url, headers) {
+    this.#logger.debug(
+      { publicKeyPem, signatureInput, signature, method, url, headers }, 'validating signature'
+    )
     const inputs = this.#parseSignatureInput(signatureInput)
+    this.#logger.debug(
+      { inputs }, 'validating signature'
+    )
     const input = this.#bestInput(inputs)
     if (!input) {
       throw new Error('No input with supported algorithms')
     }
+    this.#logger.debug(
+      { input }, 'best input'
+    )
     const bytes = this.#sigBytes(signature, input.name)
     if (!bytes) {
       throw new Error('No input with supported algorithms')
     }
     const data = this.#inputData(input, method, url, headers)
+    this.#logger.debug(
+      { data }, 'input data'
+    )
     const verifier = this.#getVerifier(input.alg)
     verifier.update(data)
     const options = this.#getVerifierOptions(input.alg)

package/lib/httpsignatureauthenticator.js

@@ -130,6 +130,15 @@ export class HTTPSignatureAuthenticator {
   }
 
   async #authenticateMessageSignature (signature, signatureInput, originalUrl, req, res, next) {
+    this.#logger.debug(
+      { signature, signatureInput, originalUrl },
+      'authenticating message signature'
+    )
+    const date = req.get('Date')
+    if (date && Math.abs(Date.parse(date) - Date.now()) >
+        HTTPSignatureAuthenticator.#maxDateDiff) {
+      throw createHttpError(400, 'Time skew too large')
+    }
     if (req.rawBodyText && req.rawBodyText.length > 0) {
       const digest = req.get('Content-Digest')
       if (!digest) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.37.1",
+  "version": "0.38.1",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",
@@ -37,7 +37,6 @@
     "lru-cache": "^11.1.0",
     "nanoid": "^5.1.5",
     "node-fetch": "^3.3.2",
-    "p-queue": "^9.1.0",
     "pino": "^10.1.1",
     "pino-http": "^11.0.0",
     "sequelize": "^6.37.7"