@evanp/activitypub-bot 0.38.4 → 0.39.0

package/lib/activitypubclient.js

@@ -4,9 +4,10 @@ import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 import fetch from 'node-fetch'
-import createHttpError from 'http-errors'
+import { ProblemDetailsError } from './errors.js'
 
 import as2 from './activitystreams.js'
+import { SignaturePolicyStorage } from './signaturepolicystorage.js'
 
 const __filename = fileURLToPath(import.meta.url)
 const __dirname = path.dirname(__filename)
@@ -37,8 +38,10 @@ export class ActivityPubClient {
   #logger = null
   #limiter
   #cache
+  #messageSigner
+  #policyStorage
 
-  constructor (keyStorage, urlFormatter, signer, digester, logger, limiter, cache) {
+  constructor (keyStorage, urlFormatter, signer, digester, logger, limiter, cache, messageSigner, policyStorage) {
     assert.strictEqual(typeof keyStorage, 'object')
     assert.strictEqual(typeof urlFormatter, 'object')
     assert.strictEqual(typeof signer, 'object')
@@ -46,6 +49,8 @@ export class ActivityPubClient {
     assert.strictEqual(typeof logger, 'object')
     assert.strictEqual(typeof limiter, 'object')
     assert.strictEqual(typeof cache, 'object')
+    assert.strictEqual(typeof messageSigner, 'object')
+    assert.strictEqual(typeof policyStorage, 'object')
     this.#keyStorage = keyStorage
     this.#urlFormatter = urlFormatter
     this.#signer = signer
@@ -53,6 +58,8 @@ export class ActivityPubClient {
     this.#logger = logger.child({ class: this.constructor.name })
     this.#limiter = limiter
     this.#cache = cache
+    this.#messageSigner = messageSigner
+    this.#policyStorage = policyStorage
   }
 
   async get (url, username = this.#urlFormatter.hostname) {
@@ -129,21 +136,47 @@ export class ActivityPubClient {
     this.#logger.debug({ headers }, 'Sending headers')
     const method = 'GET'
     this.#logger.debug({ url: baseUrl }, 'Signing GET request')
+    let storedPolicy, lastPolicy
     if (sign) {
-      headers.signature =
+      storedPolicy = await this.#policyStorage.get(parsed.origin)
+      if (!storedPolicy || storedPolicy === SignaturePolicyStorage.RFC9421) {
+        lastPolicy = SignaturePolicyStorage.RFC9421
+        const sigHeaders = await this.#messageSign({ username, url: baseUrl, method, headers })
+        Object.assign(headers, sigHeaders || {})
+      } else if (storedPolicy === SignaturePolicyStorage.DRAFT_CAVAGE_12) {
+        lastPolicy = SignaturePolicyStorage.DRAFT_CAVAGE_12
+        headers.signature =
         await this.#sign({ username, url: baseUrl, method, headers })
+      } else {
+        throw new Error(`Unexpected signature policy ${storedPolicy}`)
+      }
     }
     const hostname = parsed.hostname
     this.#logger.debug({ url: baseUrl, hostname }, 'Waiting for rate limiter')
     await this.#limiter.limit(hostname)
     this.#logger.debug({ url: baseUrl }, 'Fetching with GET')
-    const res = await fetch(baseUrl,
+    let res = await fetch(baseUrl,
       {
         method,
         headers
       }
     )
     this.#logger.debug({ hostname, status: res.status }, 'response received')
+    if ([401, 403].includes(res.status) &&
+        sign &&
+        !storedPolicy) {
+      lastPolicy = SignaturePolicyStorage.DRAFT_CAVAGE_12
+      delete headers['signature-input']
+      headers.signature =
+        await this.#sign({ username, url: baseUrl, method, headers })
+      res = await fetch(baseUrl,
+        {
+          method,
+          headers
+        }
+      )
+    }
+
     await this.#limiter.update(hostname, res.headers)
     this.#logger.debug({ url }, 'Finished GET')
     if (useCache && res.status === 304) {
@@ -155,8 +188,8 @@ export class ActivityPubClient {
         { status: res.status, body, url: baseUrl },
         'Could not fetch url'
       )
-      throw createHttpError(
-        res.status,
+      throw new ProblemDetailsError(
+        500,
         `Could not fetch ${baseUrl}`,
         { headers: res.headers }
       )
@@ -176,6 +209,10 @@ export class ActivityPubClient {
       throw err
     }
 
+    if (sign && !storedPolicy && lastPolicy) {
+      await this.#policyStorage.set(parsed.origin, lastPolicy)
+    }
+
     await this.#cache.set(baseUrl, username, json, res.headers)
 
     return json
@@ -206,6 +243,7 @@ export class ActivityPubClient {
     assert.ok(username)
     assert.equal(typeof username, 'string')
     assert.ok(username !== '*')
+    const parsed = (new URL(url))
     const json = await obj.export()
     this.#fixupJson(json)
     const body = JSON.stringify(json)
@@ -218,28 +256,56 @@ export class ActivityPubClient {
     const method = 'POST'
     assert.ok(headers)
     this.#logger.debug({ url }, 'Signing POST')
-    headers.signature = await this.#sign({ username, url, method, headers })
-    const hostname = (new URL(url)).hostname
+    let lastPolicy
+    const storedPolicy = await this.#policyStorage.get(parsed.origin)
+    if (!storedPolicy || storedPolicy === SignaturePolicyStorage.RFC9421) {
+      lastPolicy = SignaturePolicyStorage.RFC9421
+      const sigHeaders = await this.#messageSign({ username, url, method, headers })
+      Object.assign(headers, sigHeaders || {})
+    } else if (storedPolicy === SignaturePolicyStorage.DRAFT_CAVAGE_12) {
+      lastPolicy = SignaturePolicyStorage.DRAFT_CAVAGE_12
+      headers.signature =
+        await this.#sign({ username, url, method, headers })
+    } else {
+      throw new Error(`Unexpected signature policy ${storedPolicy}`)
+    }
+    const hostname = parsed.hostname
     this.#logger.debug({ url, hostname }, 'Waiting for rate limiter')
     await this.#limiter.limit(hostname)
     this.#logger.debug({ url }, 'Fetching POST')
-    const res = await fetch(url,
+    let res = await fetch(url,
       {
         method,
         headers,
         body
       }
     )
+    if ([401, 403].includes(res.status) && !storedPolicy) {
+      lastPolicy = SignaturePolicyStorage.DRAFT_CAVAGE_12
+      delete headers['signature-input']
+      headers.signature =
+        await this.#sign({ username, url, method, headers })
+      res = await fetch(url,
+        {
+          method,
+          headers,
+          body
+        }
+      )
+    }
     this.#logger.debug({ hostname }, 'updating limiter')
     await this.#limiter.update(hostname, res.headers)
     this.#logger.debug({ url }, 'Done fetching POST')
     if (res.status < 200 || res.status > 299) {
-      throw createHttpError(
-        res.status,
-        await res.text(),
+      throw new ProblemDetailsError(
+        500,
+        `Could not post to ${url}`,
         { headers: res.headers }
       )
     }
+    if (!storedPolicy && lastPolicy) {
+      await this.#policyStorage.set(parsed.origin, lastPolicy)
+    }
   }
 
   async #sign ({ username, url, method, headers }) {
@@ -252,6 +318,16 @@ export class ActivityPubClient {
     return this.#signer.sign({ privateKey, keyId, url, method, headers })
   }
 
+  async #messageSign ({ username, url, method, headers }) {
+    assert.ok(url)
+    assert.ok(method)
+    assert.ok(headers)
+    assert.ok(username)
+    const privateKey = await this.#keyStorage.getPrivateKey(username)
+    const keyId = this.#urlFormatter.format({ username, type: 'publickey' })
+    return this.#messageSigner.sign({ privateKey, keyId, url, method, headers })
+  }
+
   #isCollection (obj) {
     return (Array.isArray(obj.type))
       ? obj.type.some(item => COLLECTION_TYPES.includes(item))

package/lib/app.js

@@ -1,6 +1,7 @@
 import http from 'node:http'
 import { resolve, dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { randomUUID } from 'node:crypto'
 
 import { Sequelize } from 'sequelize'
 import express from 'express'
@@ -45,7 +46,7 @@ import { FanoutWorker } from './fanoutworker.js'
 import { IntakeWorker } from './intakeworker.js'
 import { RemoteObjectCache } from './remoteobjectcache.js'
 import { HTTPMessageSignature } from './httpmessagesignature.js'
-import { randomUUID } from 'node:crypto'
+import { SignaturePolicyStorage } from './signaturepolicystorage.js'
 
 const currentDir = dirname(fileURLToPath(import.meta.url))
 const DEFAULT_INDEX_FILENAME = resolve(currentDir, '..', 'web', 'index.html')
@@ -77,7 +78,8 @@ export async function makeApp ({ databaseUrl, origin, bots, logLevel = 'silent',
   const objectStorage = new ObjectStorage(connection)
   const limiter = new RateLimiter(connection, logger)
   const remoteObjectCache = new RemoteObjectCache(connection, logger)
-  const client = new ActivityPubClient(keyStorage, formatter, signer, digester, logger, limiter, remoteObjectCache)
+  const policyStore = new SignaturePolicyStorage(connection, logger)
+  const client = new ActivityPubClient(keyStorage, formatter, signer, digester, logger, limiter, remoteObjectCache, messageSigner, policyStore)
   const remoteKeyStorage = new RemoteKeyStorage(client, connection, logger)
   const signature = new HTTPSignatureAuthenticator(remoteKeyStorage, signer, messageSigner, digester, logger)
   const jobQueue = new JobQueue(connection, logger)
@@ -268,9 +270,16 @@ export async function makeApp ({ databaseUrl, origin, bots, logLevel = 'silent',
     } else {
       logger.debug(err)
     }
+    const type = err.type || 'about:blank'
+    const problemTitle = err.title || title
+    const extra = Object.fromEntries(
+      Object.entries(err).filter(
+        ([k]) => !['status', 'type', 'title', 'detail', 'stack'].includes(k)
+      )
+    )
     res.status(status)
     res.type('application/problem+json')
-    res.json({ type: 'about:blank', title, status, detail: err.message })
+    res.json({ type, title: problemTitle, status, detail: err.message, ...extra })
   })
 
   app.onIdle = async () => {

package/lib/errors.js

@@ -0,0 +1,158 @@
+import http from 'node:http'
+
+const FEP_C180 = 'https://w3id.org/fep/c180'
+
+export class ProblemDetailsError extends Error {
+  constructor (status, detail, extra = {}) {
+    super(detail)
+    this.status = status
+    const { type, title, ...rest } = extra
+    this.type = type || 'about:blank'
+    this.title = title || http.STATUS_CODES[status] || 'Unknown Status'
+    this.detail = detail
+    Object.assign(this, rest)
+  }
+}
+
+export class UnsupportedTypeError extends ProblemDetailsError {
+  constructor (detail, extra = {}) {
+    // Rename `type` to `objectType` to avoid conflict with the problem type URI field
+    const { type: objectType, ...rest } = extra
+    super(400, detail, {
+      type: `${FEP_C180}#unsupported-type`,
+      title: 'Unsupported type',
+      ...rest,
+      ...(objectType != null ? { objectType } : {})
+    })
+  }
+}
+
+export class ObjectDoesNotExistError extends ProblemDetailsError {
+  constructor (detail, extra = {}) {
+    super(400, detail, {
+      type: `${FEP_C180}#object-does-not-exist`,
+      title: 'Object does not exist',
+      ...extra
+    })
+  }
+}
+
+export class DuplicateDeliveryError extends ProblemDetailsError {
+  constructor (detail, extra = {}) {
+    super(400, detail, {
+      type: `${FEP_C180}#duplicate-delivery`,
+      title: 'Duplicate delivery',
+      ...extra
+    })
+  }
+}
+
+export class RedundantActivityError extends ProblemDetailsError {
+  constructor (detail, extra = {}) {
+    super(400, detail, {
+      type: `${FEP_C180}#redundant-activity`,
+      title: 'Redundant activity',
+      ...extra
+    })
+  }
+}
+
+export class ApprovalRequiredError extends ProblemDetailsError {
+  constructor (detail, extra = {}) {
+    super(202, detail, {
+      type: `${FEP_C180}#approval-required`,
+      title: 'Approval required',
+      ...extra
+    })
+  }
+}
+
+export class NotAnActorError extends ProblemDetailsError {
+  constructor (detail, extra = {}) {
+    super(400, detail, {
+      type: `${FEP_C180}#not-an-actor`,
+      title: 'Not an actor',
+      ...extra
+    })
+  }
+}
+
+export class PrincipalActorMismatchError extends ProblemDetailsError {
+  constructor (detail, extra = {}) {
+    super(400, detail, {
+      type: `${FEP_C180}#principal-actor-mismatch`,
+      title: 'Principal-actor mismatch',
+      ...extra
+    })
+  }
+}
+
+export class ActorNotAuthorizedError extends ProblemDetailsError {
+  constructor (detail, extra = {}) {
+    super(403, detail, {
+      type: `${FEP_C180}#actor-not-authorized`,
+      title: 'Actor not authorized',
+      ...extra
+    })
+  }
+}
+
+export class PrincipalNotAuthorizedError extends ProblemDetailsError {
+  constructor (detail, extra = {}) {
+    super(403, detail, {
+      type: `${FEP_C180}#principal-not-authorized`,
+      title: 'Principal not authorized',
+      ...extra
+    })
+  }
+}
+
+export class ClientNotAuthorizedError extends ProblemDetailsError {
+  constructor (detail, extra = {}) {
+    super(403, detail, {
+      type: `${FEP_C180}#client-not-authorized`,
+      title: 'Client not authorized',
+      ...extra
+    })
+  }
+}
+
+export class UnsupportedMediaTypeError extends ProblemDetailsError {
+  constructor (detail, extra = {}) {
+    super(400, detail, {
+      type: `${FEP_C180}#unsupported-media-type`,
+      title: 'Unsupported media type',
+      ...extra
+    })
+  }
+}
+
+export class MediaTooLargeError extends ProblemDetailsError {
+  constructor (detail, extra = {}) {
+    super(413, detail, {
+      type: `${FEP_C180}#media-too-large`,
+      title: 'Media too large',
+      ...extra
+    })
+  }
+}
+
+export class NoApplicableAddresseesError extends ProblemDetailsError {
+  constructor (detail, extra = {}) {
+    super(400, detail, {
+      type: `${FEP_C180}#no-applicable-addressees`,
+      title: 'No applicable addressees',
+      ...extra
+    })
+  }
+}
+
+export class RateLimitExceededError extends ProblemDetailsError {
+  constructor (detail, extra = {}) {
+    super(429, detail, {
+      type: `${FEP_C180}#rate-limit-exceeded`,
+      title: 'Rate limit exceeded',
+      ...extra
+    })
+  }
+}

package/lib/httpsignature.js

@@ -1,7 +1,7 @@
 import crypto from 'node:crypto'
 import assert from 'node:assert'
 
-import createHttpError from 'http-errors'
+import { ProblemDetailsError } from './errors.js'
 
 export class HTTPSignature {
   static #maxDateDiff = 5 * 60 * 1000 // 5 minutes
@@ -13,48 +13,48 @@ export class HTTPSignature {
   keyId (signature) {
     const params = this.#parseSignatureHeader(signature)
     if (!params.keyId) {
-      throw createHttpError(401, 'No keyId provided')
+      throw new ProblemDetailsError(401, 'No keyId provided')
     }
     return params.keyId
   }
 
   async validate (publicKeyPem, signature, method, path, headers) {
     if (!signature) {
-      throw createHttpError(401, 'No signature provided')
+      throw new ProblemDetailsError(401, 'No signature provided')
     }
     if (!method) {
-      throw createHttpError(400, 'No HTTP method provided')
+      throw new ProblemDetailsError(400, 'No HTTP method provided')
     }
     if (!path) {
-      throw createHttpError(400, 'No URL path provided')
+      throw new ProblemDetailsError(400, 'No URL path provided')
     }
     if (!headers) {
-      throw createHttpError(400, 'No request headers provided')
+      throw new ProblemDetailsError(400, 'No request headers provided')
     }
 
     const params = this.#parseSignatureHeader(signature)
 
     const keyId = params.keyId
     if (!keyId) {
-      throw createHttpError(401, 'No keyId provided')
+      throw new ProblemDetailsError(401, 'No keyId provided')
     }
     this.#logger.debug({ keyId }, 'validating signature')
     const algorithm = params.algorithm
     if (!algorithm) {
-      throw createHttpError(401, 'No algorithm provided')
+      throw new ProblemDetailsError(401, 'No algorithm provided')
     }
     this.#logger.debug({ algorithm }, 'validating signature')
     if (!(algorithm === 'rsa-sha256' || (algorithm === 'hs2019' && this.#isRSAKey(publicKeyPem)))) {
-      throw createHttpError(401, 'Only rsa-sha256 or hs2019 with RSA supported')
+      throw new ProblemDetailsError(401, 'Only rsa-sha256 or hs2019 with RSA supported')
     }
     if (!params.headers) {
-      throw createHttpError(401, 'No headers provided')
+      throw new ProblemDetailsError(401, 'No headers provided')
     }
     const signedHeaders = params.headers.split(' ')
     this.#logger.debug({ signedHeaders }, 'validating signature')
     const signatureString = params.signature
     if (!signatureString) {
-      throw createHttpError(401, 'No signature field provided in signature header')
+      throw new ProblemDetailsError(401, 'No signature field provided in signature header')
     }
     this.#logger.debug({ signatureString }, 'validating signature')
     const signingString = this.#signingString({

package/lib/httpsignatureauthenticator.js

@@ -1,6 +1,6 @@
 import assert from 'node:assert'
 
-import createHttpError from 'http-errors'
+import { ProblemDetailsError } from './errors.js'
 
 import BotMaker from './botmaker.js'
 
@@ -77,21 +77,21 @@ export class HTTPSignatureAuthenticator {
     this.#logger.debug({ reqId: req.id, signature }, 'Got signed request')
     const date = req.get('Date')
     if (!date) {
-      throw createHttpError(400, 'No date provided')
+      throw new ProblemDetailsError(400, 'No date provided')
     }
     if (Math.abs(Date.parse(date) - Date.now()) >
         HTTPSignatureAuthenticator.#maxDateDiff) {
-      throw createHttpError(400, 'Time skew too large')
+      throw new ProblemDetailsError(400, 'Time skew too large')
     }
     if (req.rawBodyText && req.rawBodyText.length > 0) {
       const digest = req.get('Digest')
       if (!digest) {
-        throw createHttpError(400, 'No digest provided')
+        throw new ProblemDetailsError(400, 'No digest provided')
       }
       const calculated = await this.#digester.digest(req.rawBodyText)
       if (!this.#digester.equals(digest, calculated)) {
         this.#logger.debug({ reqId: req.id, calculated, digest }, 'Digest mismatch')
-        throw createHttpError(400, 'Digest mismatch')
+        throw new ProblemDetailsError(400, 'Digest mismatch')
       }
     }
     const { method, headers } = req
@@ -100,7 +100,7 @@ export class HTTPSignatureAuthenticator {
     this.#logger.debug({ reqId: req.id, keyId }, 'Signed with keyId')
     const ok = await this.#remoteKeyStorage.getPublicKey(keyId)
     if (!ok) {
-      throw createHttpError(400, 'public key not found')
+      throw new ProblemDetailsError(400, 'public key not found')
     }
     let owner = ok.owner
     let publicKeyPem = ok.publicKeyPem
@@ -125,7 +125,7 @@ export class HTTPSignatureAuthenticator {
       req.auth.subject = owner
       return next()
     } else {
-      throw createHttpError(401, 'Unauthorized')
+      throw new ProblemDetailsError(401, 'Unauthorized')
     }
   }
 
@@ -137,25 +137,25 @@ export class HTTPSignatureAuthenticator {
     const date = req.get('Date')
     if (date && Math.abs(Date.parse(date) - Date.now()) >
         HTTPSignatureAuthenticator.#maxDateDiff) {
-      throw createHttpError(400, 'Time skew too large')
+      throw new ProblemDetailsError(400, 'Time skew too large')
     }
     if (req.rawBodyText && req.rawBodyText.length > 0) {
       const digest = req.get('Content-Digest')
       if (!digest) {
-        throw createHttpError(400, 'No digest provided')
+        throw new ProblemDetailsError(400, 'No digest provided')
       }
       const calculated = await this.#digester.contentDigest(req.rawBodyText)
       if (!this.#digester.equals(digest, calculated)) {
         this.#logger.debug({ reqId: req.id, calculated, digest }, 'Digest mismatch')
-        throw createHttpError(400, 'Digest mismatch')
+        throw new ProblemDetailsError(400, 'Digest mismatch')
       }
     }
     const created = this.#messageSigner.created(signatureInput)
     if (!created) {
-      throw createHttpError(400, 'No created timestamp provided')
+      throw new ProblemDetailsError(400, 'No created timestamp provided')
     }
     if (Math.abs(Date.now() - created * 1000) > HTTPSignatureAuthenticator.#maxDateDiff) {
-      throw createHttpError(400, 'Time skew too large')
+      throw new ProblemDetailsError(400, 'Time skew too large')
     }
     const { method, headers } = req
     const { origin } = req.app.locals
@@ -163,12 +163,12 @@ export class HTTPSignatureAuthenticator {
 
     const keyId = this.#messageSigner.keyId(signatureInput)
     if (!keyId) {
-      throw createHttpError(400, 'no public key provided')
+      throw new ProblemDetailsError(400, 'no public key provided')
     }
     this.#logger.debug({ reqId: req.id, keyId }, 'Signed with keyId')
     const ok = await this.#remoteKeyStorage.getPublicKey(keyId)
     if (!ok) {
-      throw createHttpError(400, 'public key not found')
+      throw new ProblemDetailsError(400, 'public key not found')
     }
     let owner = ok.owner
     let publicKeyPem = ok.publicKeyPem
@@ -193,7 +193,7 @@ export class HTTPSignatureAuthenticator {
       req.auth.subject = owner
       return next()
     } else {
-      throw createHttpError(401, 'Unauthorized')
+      throw new ProblemDetailsError(401, 'Unauthorized')
     }
   }
 }

package/lib/migrations/008-signature-policy.js

@@ -0,0 +1,16 @@
+export const id = '008-signature-policy'
+
+export async function up (connection, queryOptions = {}) {
+  await connection.query(`
+    CREATE TABLE signature_policy (
+      origin varchar(256) NOT NULL PRIMARY KEY,
+      policy varchar(32) NOT NULL,
+      expiry TIMESTAMP NOT NULL,
+      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+    );
+  `, queryOptions)
+  await connection.query(`
+    CREATE INDEX signature_policy_expiry on signature_policy (expiry);
+  `, queryOptions)
+}

package/lib/routes/collection.js

@@ -1,10 +1,10 @@
 import assert from 'node:assert'
 
 import express from 'express'
-import createHttpError from 'http-errors'
 
 import as2 from '../activitystreams.js'
 import BotMaker from '../botmaker.js'
+import { ProblemDetailsError, PrincipalNotAuthorizedError } from '../errors.js'
 
 const collections = ['outbox', 'liked', 'followers', 'following']
 const router = express.Router()
@@ -40,7 +40,7 @@ function collectionHandler (collection) {
     const { actorStorage, bots } = req.app.locals
     const bot = await BotMaker.makeBot(bots, username)
     if (!bot) {
-      return next(createHttpError(404, `User ${username} not found`))
+      return next(new ProblemDetailsError(404, `User ${username} not found`))
     }
     const coll = await actorStorage.getCollection(username, collection)
     res.status(200)
@@ -57,20 +57,20 @@ function collectionPageHandler (collection) {
     try {
       pageNo = parseInt(n)
     } catch (err) {
-      return next(createHttpError(400, `Invalid page ${n}`))
+      return next(new ProblemDetailsError(400, `Invalid page ${n}`))
     }
     const { actorStorage, bots, authorizer, objectStorage, formatter, client } = req.app.locals
     const bot = await BotMaker.makeBot(bots, username)
 
     if (!bot) {
-      return next(createHttpError(404, `User ${username} not found`))
+      return next(new ProblemDetailsError(404, `User ${username} not found`))
     }
 
     if (collection === 'inbox') {
-      return next(createHttpError(403, `No access to ${collection} collection`))
+      return next(new PrincipalNotAuthorizedError(`No access to ${collection} collection`, { resource: req.url }))
     }
     if (!await actorStorage.hasPage(username, collection, parseInt(n))) {
-      return next(createHttpError(404, `No such page ${n} for collection ${collection} for user ${username}`))
+      return next(new ProblemDetailsError(404, `No such page ${n} for collection ${collection} for user ${username}`))
     }
 
     let exported = null
@@ -113,7 +113,7 @@ function collectionPageHandler (collection) {
         { err: error, username, collection, n },
         'error loading collection page'
       )
-      return next(createHttpError(500, 'Error loading collection page'))
+      return next(new ProblemDetailsError(500, 'Error loading collection page'))
     }
     res.status(200)
     res.type(as2.mediaType)

package/lib/routes/health.js

@@ -1,5 +1,5 @@
 import express from 'express'
-import createHttpError from 'http-errors'
+import { ProblemDetailsError } from '../errors.js'
 
 const router = express.Router()
 
@@ -17,7 +17,7 @@ router.get('/readyz', async (req, res, next) => {
     res.type('text/plain')
     res.end('OK')
   } catch (err) {
-    return next(createHttpError(503, 'Service Unavailable'))
+    return next(new ProblemDetailsError(503, 'Service Unavailable'))
   }
 })
 

package/lib/routes/inbox.js

@@ -1,10 +1,17 @@
 import http from 'node:http'
 
 import express from 'express'
-import createHttpError from 'http-errors'
 
 import as2 from '../activitystreams.js'
 import BotMaker from '../botmaker.js'
+import {
+  ProblemDetailsError,
+  UnsupportedTypeError,
+  DuplicateDeliveryError,
+  PrincipalActorMismatchError,
+  ActorNotAuthorizedError,
+  PrincipalNotAuthorizedError
+} from '../errors.js'
 
 const router = express.Router()
 
@@ -16,15 +23,15 @@ router.post('/user/:username/inbox', async (req, res, next) => {
 
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `User ${username} not found`))
+    return next(new ProblemDetailsError(404, `User ${username} not found`))
   }
 
   if (!subject) {
-    return next(createHttpError(401, 'Unauthorized'))
+    return next(new ProblemDetailsError(401, 'Unauthorized'))
   }
 
   if (!req.body) {
-    return next(createHttpError(400, 'No request body provided'))
+    return next(new ProblemDetailsError(400, 'No request body provided'))
   }
 
   let activity
@@ -34,37 +41,37 @@ router.post('/user/:username/inbox', async (req, res, next) => {
   } catch (err) {
     logger.warn({ reqId: req.id, err }, 'Failed to import activity')
     logger.debug({ reqId: req.id, body: req.body }, 'Request body')
-    return next(createHttpError(400, 'Invalid request body'))
+    return next(new ProblemDetailsError(400, 'Invalid request body'))
   }
 
   if (!activity.isActivity()) {
-    return next(createHttpError(400, 'Request body is not an activity'))
+    return next(new UnsupportedTypeError('Request body is not an activity', { objectType: activity.type }))
   }
 
   const actor = deliverer.getActor(activity)
 
   if (!actor) {
-    return next(createHttpError(400, 'No actor found in activity'))
+    return next(new ProblemDetailsError(400, 'No actor found in activity'))
   }
 
   if (!actor.id) {
-    return next(createHttpError(400, 'No actor id found in activity'))
+    return next(new ProblemDetailsError(400, 'No actor id found in activity'))
   }
 
   if (actor.id !== subject && !(await bot.actorOK(subject, activity))) {
-    return next(createHttpError(403, `${subject} is not the actor ${actor.id}`))
+    return next(new PrincipalActorMismatchError(`${subject} is not the actor ${actor.id}`, { principal: subject, actor: actor.id }))
   }
 
   if (await actorStorage.isInCollection(username, 'blocked', actor)) {
-    return next(createHttpError(403, 'Forbidden'))
+    return next(new ActorNotAuthorizedError('Blocked actor', { actor: actor.id, resource: req.url }))
   }
 
   if (!activity.id) {
-    return next(createHttpError(400, 'No activity id found in activity'))
+    return next(new ProblemDetailsError(400, 'No activity id found in activity'))
   }
 
   if (await actorStorage.isInCollection(bot.username, 'inbox', activity)) {
-    return next(createHttpError(400, 'Activity already delivered'))
+    return next(new DuplicateDeliveryError('Activity already delivered', { id: activity.id }))
   }
 
   logger.info(
@@ -84,11 +91,11 @@ router.post('/user/:username/inbox', async (req, res, next) => {
 })
 
 router.get('/user/:username/inbox', async (req, res, next) => {
-  return next(createHttpError(403, 'No access to inbox collection'))
+  return next(new PrincipalNotAuthorizedError('No access to inbox collection', { resource: req.url }))
 })
 
 router.get('/user/:username/inbox/:n', async (req, res, next) => {
-  return next(createHttpError(403, 'No access to inbox collection'))
+  return next(new PrincipalNotAuthorizedError('No access to inbox collection', { resource: req.url }))
 })
 
 export default router

package/lib/routes/object.js

@@ -1,7 +1,7 @@
 import express from 'express'
-import createHttpError from 'http-errors'
 
 import as2 from '../activitystreams.js'
+import { ProblemDetailsError, PrincipalNotAuthorizedError } from '../errors.js'
 
 const router = express.Router()
 
@@ -10,17 +10,17 @@ export default router
 router.get('/user/:username/:type/:nanoid', async (req, res, next) => {
   const { username, type, nanoid } = req.params
   if (!nanoid.match(/^[A-Za-z0-9_\\-]{21}$/)) {
-    return next(createHttpError(400, `Invalid nanoid ${nanoid}`))
+    return next(new ProblemDetailsError(400, `Invalid nanoid ${nanoid}`))
   }
   const { objectStorage, formatter, authorizer } = req.app.locals
   const id = formatter.format({ username, type, nanoid })
   const object = await objectStorage.read(id)
   if (!object) {
-    return next(createHttpError(404, `Object ${id} not found`))
+    return next(new ProblemDetailsError(404, `Object ${id} not found`))
   }
   const remote = (req.auth?.subject) ? await as2.import({ id: req.auth.subject }) : null
   if (!await authorizer.canRead(remote, object)) {
-    return next(createHttpError(403, `Forbidden to read object ${id}`))
+    return next(new PrincipalNotAuthorizedError('Forbidden to read object', { id }))
   }
   res.status(200)
   res.type(as2.mediaType)
@@ -30,20 +30,20 @@ router.get('/user/:username/:type/:nanoid', async (req, res, next) => {
 router.get('/user/:username/:type/:nanoid/:collection', async (req, res, next) => {
   const { objectStorage, formatter, authorizer } = req.app.locals
   if (!['replies', 'likes', 'shares', 'thread'].includes(req.params.collection)) {
-    return next(createHttpError(404, 'Not Found'))
+    return next(new ProblemDetailsError(404, 'Not Found'))
   }
   const { username, type, nanoid } = req.params
   if (!nanoid.match(/^[A-Za-z0-9_\\-]{21}$/)) {
-    return next(createHttpError(400, `Invalid nanoid ${nanoid}`))
+    return next(new ProblemDetailsError(400, `Invalid nanoid ${nanoid}`))
   }
   const id = formatter.format({ username, type, nanoid })
   const object = await objectStorage.read(id)
   if (!object) {
-    return next(createHttpError(404, 'Not Found'))
+    return next(new ProblemDetailsError(404, 'Not Found'))
   }
   const remote = (req.auth?.subject) ? await as2.import({ id: req.auth.subject }) : null
   if (!await authorizer.canRead(remote, object)) {
-    return next(createHttpError(403, 'Forbidden'))
+    return next(new ProblemDetailsError(403, 'Forbidden'))
   }
   const collection = await objectStorage.getCollection(id, req.params.collection)
   res.status(200)
@@ -57,23 +57,23 @@ router.get('/user/:username/:type/:nanoid/:collection/:n', async (req, res, next
   try {
     pageNo = parseInt(n)
   } catch (err) {
-    return next(createHttpError(400, `Invalid page ${n}`))
+    return next(new ProblemDetailsError(400, `Invalid page ${n}`))
   }
   if (!nanoid.match(/^[A-Za-z0-9_\\-]{21}$/)) {
-    return next(createHttpError(400, `Invalid nanoid ${nanoid}`))
+    return next(new ProblemDetailsError(400, `Invalid nanoid ${nanoid}`))
   }
   const { objectStorage, formatter, authorizer } = req.app.locals
   if (!['replies', 'likes', 'shares', 'thread'].includes(req.params.collection)) {
-    return next(createHttpError(404, 'Not Found'))
+    return next(new ProblemDetailsError(404, 'Not Found'))
   }
   const id = formatter.format({ username, type, nanoid })
   const object = await objectStorage.read(id)
   if (!object) {
-    return next(createHttpError(404, 'Not Found'))
+    return next(new ProblemDetailsError(404, 'Not Found'))
   }
   const remote = (req.auth?.subject) ? await as2.import({ id: req.auth.subject }) : null
   if (!await authorizer.canRead(remote, object)) {
-    return next(createHttpError(403, 'Forbidden'))
+    return next(new ProblemDetailsError(403, 'Forbidden'))
   }
   const collectionPage = await objectStorage.getCollectionPage(
     id,

package/lib/routes/profile.js

@@ -1,5 +1,5 @@
 import express from 'express'
-import createHttpError from 'http-errors'
+import { ProblemDetailsError } from '../errors.js'
 import BotMaker from '../botmaker.js'
 
 const router = express.Router()
@@ -9,7 +9,7 @@ router.get('/profile/:username', async (req, res, next) => {
   const { profileFileName, bots } = req.app.locals
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `User ${username} not found`))
+    return next(new ProblemDetailsError(404, `User ${username} not found`))
   }
   res.type('html')
   res.sendFile(profileFileName)

package/lib/routes/proxy.js

@@ -1,7 +1,7 @@
 import express from 'express'
 
 import as2 from '../activitystreams.js'
-import createHttpError from 'http-errors'
+import { ProblemDetailsError } from '../errors.js'
 
 const router = express.Router()
 
@@ -17,7 +17,7 @@ router.post('/shared/proxy', async (req, res, next) => {
   const { id } = req.body
 
   if (!id) {
-    return next(createHttpError(400, 'Missing id parameter'))
+    return next(new ProblemDetailsError(400, 'Missing id parameter'))
   }
 
   let url
@@ -25,11 +25,11 @@ router.post('/shared/proxy', async (req, res, next) => {
   try {
     url = new URL(id)
   } catch (error) {
-    return next(createHttpError(400, 'id must be an URL'))
+    return next(new ProblemDetailsError(400, 'id must be an URL'))
   }
 
   if (url.protocol !== 'https:') {
-    return next(createHttpError(400, 'id must be an https: URL'))
+    return next(new ProblemDetailsError(400, 'id must be an https: URL'))
   }
 
   let obj
@@ -38,7 +38,7 @@ router.post('/shared/proxy', async (req, res, next) => {
     obj = await client.get(id)
   } catch (err) {
     logger.warn({ reqId: req.id, err, id }, 'Error fetching object in proxy')
-    return next(createHttpError(400, `Error fetching object ${id}`))
+    return next(new ProblemDetailsError(400, `Error fetching object ${id}`))
   }
 
   res.status(200)

package/lib/routes/sharedinbox.js

@@ -1,9 +1,13 @@
 import http from 'node:http'
 
 import express from 'express'
-import createHttpError from 'http-errors'
 
 import as2 from '../activitystreams.js'
+import {
+  ProblemDetailsError,
+  UnsupportedTypeError,
+  PrincipalActorMismatchError
+} from '../errors.js'
 
 const router = express.Router()
 
@@ -28,11 +32,11 @@ router.post('/shared/inbox', async (req, res, next) => {
   const { subject } = req.auth
 
   if (!subject) {
-    return next(createHttpError(401, 'Unauthorized'))
+    return next(new ProblemDetailsError(401, 'Unauthorized'))
   }
 
   if (!req.body) {
-    return next(createHttpError(400, 'No request body provided'))
+    return next(new ProblemDetailsError(400, 'No request body provided'))
   }
 
   let activity
@@ -42,29 +46,29 @@ router.post('/shared/inbox', async (req, res, next) => {
   } catch (err) {
     logger.warn({ reqId: req.id, err }, 'Failed to import activity')
     logger.debug({ reqId: req.id, body: req.body }, 'Request body')
-    return next(createHttpError(400, 'Invalid request body'))
+    return next(new ProblemDetailsError(400, 'Invalid request body'))
   }
 
   if (!activity.isActivity()) {
-    return next(createHttpError(400, 'Request body is not an activity'))
+    return next(new UnsupportedTypeError('Request body is not an activity', { objectType: activity.type }))
   }
 
   const actor = deliverer.getActor(activity)
 
   if (!actor) {
-    return next(createHttpError(400, 'No actor found in activity'))
+    return next(new ProblemDetailsError(400, 'No actor found in activity'))
   }
 
   if (!actor.id) {
-    return next(createHttpError(400, 'No actor id found in activity'))
+    return next(new ProblemDetailsError(400, 'No actor id found in activity'))
   }
 
   if (actor.id !== subject && !(await actorOK(subject, activity, bots))) {
-    return next(createHttpError(403, `${subject} is not the actor ${actor.id}`))
+    return next(new PrincipalActorMismatchError(`${subject} is not the actor ${actor.id}`, { principal: subject, actor: actor.id }))
   }
 
   if (!activity.id) {
-    return next(createHttpError(400, 'No activity id found in activity'))
+    return next(new ProblemDetailsError(400, 'No activity id found in activity'))
   }
 
   logger.info(

package/lib/routes/user.js

@@ -1,7 +1,7 @@
 import { fileURLToPath } from 'node:url'
 import express from 'express'
 import as2 from '../activitystreams.js'
-import createHttpError from 'http-errors'
+import { ProblemDetailsError } from '../errors.js'
 import BotMaker from '../botmaker.js'
 
 const router = express.Router()
@@ -28,7 +28,7 @@ router.get('/user/:username', async (req, res, next) => {
   const { actorStorage, keyStorage, formatter, bots, origin } = req.app.locals
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `User ${username} not found`))
+    return next(new ProblemDetailsError(404, `User ${username} not found`))
   }
   const publicKeyPem = await keyStorage.getPublicKey(username)
   const acct = formatter.acct(username)
@@ -73,7 +73,7 @@ router.get('/user/:username/publickey', async (req, res, next) => {
   const { formatter, keyStorage, bots } = req.app.locals
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `User ${username} not found`))
+    return next(new ProblemDetailsError(404, `User ${username} not found`))
   }
   const publicKeyPem = await keyStorage.getPublicKey(username)
   const publicKey = await as2.import({
@@ -100,14 +100,14 @@ router.get('/user/:username/icon', async (req, res, next) => {
   const { bots } = req.app.locals
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `User ${username} not found`))
+    return next(new ProblemDetailsError(404, `User ${username} not found`))
   }
   if (!bot.icon) {
-    return next(createHttpError(404, `No icon for ${username} found`))
+    return next(new ProblemDetailsError(404, `No icon for ${username} found`))
   }
 
   if (typeof bot.icon !== 'object' || !(bot.icon instanceof URL)) {
-    return next(createHttpError(500, 'Incorrect image format from bot'))
+    return next(new ProblemDetailsError(500, 'Incorrect image format from bot'))
   }
 
   if (bot.icon.protocol === 'file:') {
@@ -122,14 +122,14 @@ router.get('/user/:username/image', async (req, res, next) => {
   const { bots } = req.app.locals
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `User ${username} not found`))
+    return next(new ProblemDetailsError(404, `User ${username} not found`))
   }
   if (!bot.image) {
-    return next(createHttpError(404, `No image for ${username} found`))
+    return next(new ProblemDetailsError(404, `No image for ${username} found`))
   }
 
   if (typeof bot.image !== 'object' || !(bot.image instanceof URL)) {
-    return next(createHttpError(500, 'Incorrect image format from bot'))
+    return next(new ProblemDetailsError(500, 'Incorrect image format from bot'))
   }
 
   if (bot.image.protocol === 'file:') {

package/lib/routes/webfinger.js

@@ -1,7 +1,7 @@
 import assert from 'node:assert'
 
 import { Router } from 'express'
-import createHttpError from 'http-errors'
+import { ProblemDetailsError } from '../errors.js'
 
 import BotMaker from '../botmaker.js'
 
@@ -11,7 +11,7 @@ async function botWebfinger (username, req, res, next) {
   const { formatter, bots } = req.app.locals
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `No such bot '${username}'`))
+    return next(new ProblemDetailsError(404, `No such bot '${username}'`))
   }
   res.status(200)
   res.type('application/jrd+json')
@@ -37,7 +37,7 @@ async function profileWebfinger (username, profileUrl, req, res, next) {
   const { formatter, bots } = req.app.locals
   const bot = await BotMaker.makeBot(bots, username)
   if (!bot) {
-    return next(createHttpError(404, `No such bot '${username}'`))
+    return next(new ProblemDetailsError(404, `No such bot '${username}'`))
   }
   res.status(200)
   res.type('application/jrd+json')
@@ -57,7 +57,7 @@ async function httpsWebfinger (resource, req, res, next) {
   const { formatter } = req.app.locals
   assert.ok(formatter)
   if (!formatter.isLocal(resource)) {
-    return next(createHttpError(400, 'Only local URLs'))
+    return next(new ProblemDetailsError(400, 'Only local URLs'))
   }
   const parts = formatter.unformat(resource)
   if (parts.username && !parts.type && !parts.collection) {
@@ -65,18 +65,18 @@ async function httpsWebfinger (resource, req, res, next) {
   } else if (parts.username && parts.type === 'profile') {
     return await profileWebfinger(parts.username, resource, req, res, next)
   } else {
-    return next(createHttpError(400, `No webfinger lookup for url ${resource}`))
+    return next(new ProblemDetailsError(400, `No webfinger lookup for url ${resource}`))
   }
 }
 
 async function acctWebfinger (resource, req, res, next) {
   const [username, domain] = resource.substring(5).split('@')
   if (!username || !domain) {
-    return next(createHttpError(400, `Invalid resource parameter ${resource}`))
+    return next(new ProblemDetailsError(400, `Invalid resource parameter ${resource}`))
   }
   const { host } = new URL(req.app.locals.origin)
   if (domain !== host) {
-    return next(createHttpError(400, `Invalid domain ${domain} in resource parameter`))
+    return next(new ProblemDetailsError(400, `Invalid domain ${domain} in resource parameter`))
   }
   return await botWebfinger(username, req, res, next)
 }
@@ -84,7 +84,7 @@ async function acctWebfinger (resource, req, res, next) {
 router.get('/.well-known/webfinger', async (req, res, next) => {
   const { resource } = req.query
   if (!resource) {
-    return next(createHttpError(400, 'resource parameter is required'))
+    return next(new ProblemDetailsError(400, 'resource parameter is required'))
   }
   const colon = resource.indexOf(':')
   const protocol = resource.slice(0, colon)
@@ -96,7 +96,7 @@ router.get('/.well-known/webfinger', async (req, res, next) => {
       return await httpsWebfinger(resource, req, res, next)
     default:
       return next(
-        createHttpError(400, `Unsupported resource protocol '${protocol}'`)
+        new ProblemDetailsError(400, `Unsupported resource protocol '${protocol}'`)
       )
   }
 })

package/lib/signaturepolicystorage.js

@@ -0,0 +1,61 @@
+import assert from 'node:assert'
+
+export class SignaturePolicyStorage {
+  static RFC9421 = 'rfc9421'
+  static DRAFT_CAVAGE_12 = 'draft-cavage-12'
+  static #policies = [
+    SignaturePolicyStorage.RFC9421,
+    SignaturePolicyStorage.DRAFT_CAVAGE_12
+  ]
+
+  static #EXPIRY_OFFSET = 30 * 24 * 60 * 60 * 1000
+
+  #connection
+  #logger
+  constructor (connection, logger) {
+    assert.ok(connection)
+    assert.strictEqual(typeof connection, 'object')
+    assert.ok(logger)
+    assert.strictEqual(typeof logger, 'object')
+    this.#connection = connection
+    this.#logger = logger
+  }
+
+  async get (origin) {
+    assert.ok(origin)
+    assert.strictEqual(typeof origin, 'string')
+    const [rows] = await this.#connection.query(
+      'SELECT policy, expiry FROM signature_policy WHERE origin = ?',
+      { replacements: [origin] }
+    )
+    if (rows.length === 0) {
+      return null
+    }
+    const { policy, expiry } = rows[0]
+    return ((new Date(expiry)) > (new Date()))
+      ? policy
+      : null
+  }
+
+  async set (origin, policy) {
+    assert.ok(origin)
+    assert.strictEqual(typeof origin, 'string')
+    assert.ok(policy)
+    assert.strictEqual(typeof policy, 'string')
+    assert.ok(SignaturePolicyStorage.#policies.includes(policy))
+
+    const expiry = new Date(
+      Date.now() + SignaturePolicyStorage.#EXPIRY_OFFSET
+    )
+
+    await this.#connection.query(
+      `INSERT INTO signature_policy (origin, policy, expiry)
+       VALUES (?, ?, ?)
+       ON CONFLICT (origin) DO UPDATE
+       SET policy = EXCLUDED.policy,
+           expiry = EXCLUDED.expiry,
+           updated_at = CURRENT_TIMESTAMP`,
+      { replacements: [origin, policy, expiry] }
+    )
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.38.4",
+  "version": "0.39.0",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",
@@ -32,7 +32,6 @@
     "@isaacs/ttlcache": "^2.1.4",
     "activitystrea.ms": "^3.3.0",
     "express": "^5.2.1",
-    "http-errors": "^2.0.0",
     "humanhash": "^1.0.4",
     "lru-cache": "^11.1.0",
     "nanoid": "^5.1.5",

package/web/profile.html

@@ -45,14 +45,18 @@
         const u = new URL(url)
         if (u.origin == page.origin) {
           return await fetch(u, options)
-        } else {
+        }
+
+        try {
+          return await fetch(u, options)
+        } catch (err) {
           return await fetch('/shared/proxy', {
-              method: "POST",
-              headers: {
-                "Content-Type": "application/x-www-form-urlencoded"
-              },
-              body: new URLSearchParams({ id: url }),
-            });
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/x-www-form-urlencoded'
+            },
+            body: new URLSearchParams({ id: url })
+          })
         }
       }
 
@@ -69,4 +73,4 @@
   </script>
 </body>
 
-</html>
+</html>