@takosjp/yurucommu-core 3.0.0

package/src/backend/lib/account-migration.ts

@@ -0,0 +1,106 @@
+// Account-migration (ActivityPub Move) consent verification, shared by the
+// INBOUND Move handler (which only honors a Move whose destination consents) and
+// the OUTBOUND /me/move endpoint (which refuses to advertise a migration the
+// destination has not consented to, so the local user gets an actionable error
+// instead of a silent no-op on every compliant receiver).
+
+import { fetchWithTimeout } from "./federation-fetch.ts";
+import { signRequest } from "./ap-signing.ts";
+import type { RemoteFetchSigner } from "./activitypub-actor-cache.ts";
+import { parseWebFinger } from "./activitypub-validators.ts";
+import { isSafeRemoteUrl, normalizeRemoteDomain } from "./ssrf.ts";
+
+const ALIAS_FETCH_TIMEOUT_MS = 15000;
+
+// `@user@domain` or `user@domain` (a fediverse handle). Rejects embedded
+// whitespace and extra `@` so it never matches a URL or a malformed string.
+const HANDLE_RE = /^@?([^@\s]+)@([^@\s]+)$/;
+
+/**
+ * Resolve a migration target that may be EITHER a full actor URL or a
+ * `@user@domain` fediverse handle (what users actually know — and what the
+ * Settings move field's placeholder shows). A handle is resolved via WebFinger
+ * to its `self` ActivityPub actor URL; a URL is returned untouched for the
+ * caller to SSRF-validate. Returns null if the input is neither a usable URL
+ * nor a resolvable handle. Fails closed on any error.
+ */
+export async function resolveMoveTarget(input: string): Promise<string | null> {
+  const trimmed = input.trim();
+  if (/^https?:\/\//i.test(trimmed)) {
+    // Full actor URL: the caller still runs isValidHttpUrl + isSafeRemoteUrl.
+    return trimmed;
+  }
+  const match = trimmed.match(HANDLE_RE);
+  if (!match) return null;
+  const [, username, domain] = match;
+  const safeDomain = normalizeRemoteDomain(domain);
+  if (!safeDomain) return null;
+  try {
+    const webfingerUrl = `https://${safeDomain}/.well-known/webfinger?resource=acct:${username}@${safeDomain}`;
+    const res = await fetchWithTimeout(webfingerUrl, {
+      headers: { Accept: "application/jrd+json" },
+      timeout: ALIAS_FETCH_TIMEOUT_MS,
+    });
+    if (!res.ok) return null;
+    const raw: unknown = await res.json();
+    const doc = parseWebFinger(raw);
+    const self = doc.links?.find(
+      (l) => l.rel === "self" && l.type === "application/activity+json",
+    );
+    if (!self?.href || !isSafeRemoteUrl(self.href)) return null;
+    return self.href;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Verify the destination actor of a Move declares the origin actor in its
+ * `alsoKnownAs` (the standard Mastodon account-migration consent check): a
+ * signed Move only proves the ORIGIN consents to leave; the destination's
+ * back-reference is what proves the two accounts are the same person and stops
+ * a follower-stealing redirect to an unconsenting account.
+ *
+ * Fetches the destination actor document fresh and FAILS CLOSED on any error
+ * (network failure, non-2xx, malformed document, id mismatch, missing alias).
+ * Callers must SSRF-guard `newActorApId` before calling.
+ */
+export async function destinationDeclaresAlias(
+  newActorApId: string,
+  oldActorApId: string,
+  signer?: RemoteFetchSigner,
+): Promise<boolean> {
+  try {
+    const res = await fetchWithTimeout(newActorApId, {
+      headers: {
+        Accept: "application/activity+json, application/ld+json",
+        // Sign as the instance actor so a destination on a secure-mode
+        // instance serves its actor doc — otherwise the alias (consent) check
+        // 401s and the Move fails closed even when consent was declared.
+        ...(signer
+          ? await signRequest(
+              signer.privateKeyPem,
+              signer.keyId,
+              "GET",
+              newActorApId,
+            )
+          : {}),
+      },
+      timeout: ALIAS_FETCH_TIMEOUT_MS,
+    });
+    if (!res.ok) return false;
+    const raw: unknown = await res.json();
+    if (!raw || typeof raw !== "object") return false;
+    const doc = raw as { id?: unknown; alsoKnownAs?: unknown };
+    if (doc.id !== newActorApId) return false;
+    const aka = doc.alsoKnownAs;
+    const aliases = Array.isArray(aka)
+      ? aka
+      : typeof aka === "string"
+        ? [aka]
+        : [];
+    return aliases.includes(oldActorApId);
+  } catch {
+    return false;
+  }
+}

package/src/backend/lib/activitypub-actor-cache.ts

@@ -0,0 +1,238 @@
+/**
+ * Canonical remote-actor fetch + parse + cache helper.
+ *
+ * Before this module existed, four separate code paths (inbox cold-cache fill,
+ * Move-target refresh, delivery resolve-actor, and remote-follow) each inlined
+ * their own fetch/parse/guard/upsert block with *divergent* column sets. The
+ * inbox path in particular omitted `outbox` / `followersUrl` / `sharedInbox`,
+ * so which columns a cached actor row carried depended on whichever path
+ * happened to fetch it first. `sharedInbox` is the primary fan-out target for
+ * Mastodon-scale servers, so a row first seen via the inbox path silently lost
+ * the column that drives delivery — a federation-correctness bug.
+ *
+ * This helper owns the single canonical SUPERSET cache-field shape and the
+ * one fetch/guard/upsert flow, so every cached actor row is now populated
+ * identically regardless of entry path.
+ */
+import { eq } from "drizzle-orm";
+import { actorCache } from "../../db/index.ts";
+import type { Database } from "../../db/index.ts";
+import {
+  fetchWithTimeout,
+  isSafeRemoteUrl,
+  signRequest,
+} from "../federation-helpers.ts";
+import {
+  tryParseRemoteActor,
+  type RemoteActorDocument,
+} from "./activitypub-validators.ts";
+
+/**
+ * The signing identity used to HTTP-sign an outbound actor GET so instances
+ * running in authorized-fetch / secure mode (which 401 unsigned GETs) will
+ * serve the actor document. `keyId` must resolve to a publicly-fetchable key
+ * (e.g. the instance actor's `#main-key`) so the remote can verify us.
+ */
+export interface RemoteFetchSigner {
+  keyId: string;
+  privateKeyPem: string;
+}
+
+/**
+ * Load the instance actor's signing identity straight from the DB (there is
+ * exactly one instance actor row per deployment), WITHOUT lazy-creating it.
+ * Returns null if the row does not exist yet — callers then fall back to an
+ * unsigned fetch. Used by paths that have only a `db` handle (e.g. inbound
+ * signature verification) and not the request context the lazy-creating
+ * `getInstanceFetchSigner(c)` needs.
+ */
+export async function getInstanceFetchSignerByDb(
+  db: Database,
+): Promise<RemoteFetchSigner | null> {
+  const row = await db.query.instanceActor.findFirst({
+    columns: { apId: true, privateKeyPem: true },
+  });
+  if (!row?.privateKeyPem) return null;
+  return { keyId: `${row.apId}#main-key`, privateKeyPem: row.privateKeyPem };
+}
+
+const DEFAULT_FETCH_TIMEOUT_MS = 15000;
+
+/**
+ * Remote actor display fields are attacker-controlled — bounded only by the
+ * fetched document size, which can run to megabytes. The cached `name` /
+ * `summary` / `preferredUsername` columns are rendered verbatim in every feed
+ * row and search result, so an unbounded value bloats those payloads (and the
+ * handle the client builds). Truncate at the single cache chokepoint, mirroring
+ * the local profile caps (display name 50, summary 500). `rawJson` keeps the
+ * full document for re-parsing; only the indexed/rendered columns are bounded.
+ */
+const MAX_REMOTE_NAME_LENGTH = 50;
+const MAX_REMOTE_SUMMARY_LENGTH = 500;
+const MAX_REMOTE_USERNAME_LENGTH = 100;
+
+function boundField(s: string | null | undefined, max: number): string | null {
+  if (typeof s !== "string" || s.length === 0) return null;
+  return s.length > max ? s.slice(0, max) : s;
+}
+
+/** Drizzle insert-values shape for the `actor_cache` table. */
+type ActorCacheInsert = typeof actorCache.$inferInsert;
+
+/**
+ * The ONE canonical superset of columns written to `actor_cache`. Every fetch
+ * path goes through this so no entry point can silently drop a column (notably
+ * `outbox` / `followersUrl` / `sharedInbox`, the delivery-relevant ones).
+ */
+export function buildActorCacheFields(
+  data: RemoteActorDocument,
+): Omit<ActorCacheInsert, "apId" | "createdAt"> {
+  return {
+    type: data.type || "Person",
+    preferredUsername: boundField(
+      data.preferredUsername,
+      MAX_REMOTE_USERNAME_LENGTH,
+    ),
+    name: boundField(data.name, MAX_REMOTE_NAME_LENGTH),
+    summary: boundField(data.summary, MAX_REMOTE_SUMMARY_LENGTH),
+    iconUrl: data.icon?.url || null,
+    inbox: data.inbox!,
+    outbox: data.outbox || null,
+    followersUrl: data.followers || null,
+    followingUrl: data.following || null,
+    sharedInbox: data.endpoints?.sharedInbox || null,
+    publicKeyId: data.publicKey?.id || null,
+    publicKeyPem: data.publicKey?.publicKeyPem || null,
+    rawJson: JSON.stringify(data),
+    lastFetchedAt: new Date().toISOString(),
+  };
+}
+
+/** Why a fetch+upsert did not produce a cached row. */
+export type ActorCacheFailureReason =
+  | "fetch_failed" // network/timeout error or thrown during fetch
+  | "fetch_not_ok" // non-2xx HTTP response
+  | "invalid_document" // body did not parse as a remote actor
+  | "id_mismatch" // returned `id` did not match the requested URL
+  | "missing_inbox" // no inbox, or inbox/id failed the SSRF safety check
+  | "missing_public_key"; // required public key absent (mode === "require-key")
+
+export type ActorCacheResult =
+  | { ok: true; data: RemoteActorDocument; row: typeof actorCache.$inferSelect }
+  | { ok: false; reason: ActorCacheFailureReason };
+
+export interface FetchAndUpsertActorCacheOptions {
+  /** Fetch timeout in ms. Defaults to 15s. */
+  timeout?: number;
+  /**
+   * `"upsert"` (default) refreshes an existing row via `onConflictDoUpdate`.
+   * `"insert"` is cache-when-absent: it uses `onConflictDoNothing`, so a row
+   * that already exists is left untouched and the just-fetched `row` is still
+   * returned by re-reading it.
+   */
+  mode?: "upsert" | "insert";
+  /**
+   * When `"require-key"`, an actor document without a `publicKey.publicKeyPem`
+   * is rejected with `missing_public_key`. Defaults to `"allow-keyless"`,
+   * matching the refresh/delivery paths that tolerate a missing key.
+   */
+  publicKey?: "require-key" | "allow-keyless";
+  /**
+   * When provided, the outbound GET is HTTP-signed with this identity so a
+   * remote running in authorized-fetch / secure mode serves the document
+   * instead of 401ing the unsigned request. Omit for plain (unsigned) fetches.
+   */
+  signer?: RemoteFetchSigner;
+}
+
+/**
+ * Fetch a remote actor document, validate it, and upsert it into
+ * `actor_cache` using the single canonical column set. Returns a discriminated
+ * result so callers can surface their own error responses while still sharing
+ * the fetch/guard/upsert logic.
+ *
+ * Guards (in order): SSRF safety on the requested URL, HTTP ok, parseable
+ * actor document, `id` equals the requested URL, inbox present and SSRF-safe,
+ * and (optionally) a public key present.
+ */
+export async function fetchAndUpsertActorCache(
+  db: Database,
+  actorApId: string,
+  options: FetchAndUpsertActorCacheOptions = {},
+): Promise<ActorCacheResult> {
+  const {
+    timeout = DEFAULT_FETCH_TIMEOUT_MS,
+    mode = "upsert",
+    publicKey = "allow-keyless",
+    signer,
+  } = options;
+
+  if (!isSafeRemoteUrl(actorApId)) {
+    return { ok: false, reason: "missing_inbox" };
+  }
+
+  let data: RemoteActorDocument | null;
+  try {
+    const headers: Record<string, string> = {
+      Accept: "application/activity+json, application/ld+json",
+    };
+    if (signer) {
+      // Authorized-fetch: sign the bodyless GET as the instance actor so a
+      // secure-mode remote (which 401s unsigned GETs) serves the document.
+      // signRequest covers `(request-target) host date` for a bodyless request.
+      Object.assign(
+        headers,
+        await signRequest(signer.privateKeyPem, signer.keyId, "GET", actorApId),
+      );
+    }
+    const res = await fetchWithTimeout(actorApId, {
+      headers,
+      timeout,
+    });
+    if (!res.ok) return { ok: false, reason: "fetch_not_ok" };
+    const raw: unknown = await res.json();
+    data = tryParseRemoteActor(raw);
+  } catch {
+    return { ok: false, reason: "fetch_failed" };
+  }
+
+  if (!data) return { ok: false, reason: "invalid_document" };
+  if (data.id !== actorApId) return { ok: false, reason: "id_mismatch" };
+  if (
+    !data.inbox ||
+    !isSafeRemoteUrl(data.id) ||
+    !isSafeRemoteUrl(data.inbox)
+  ) {
+    return { ok: false, reason: "missing_inbox" };
+  }
+  if (publicKey === "require-key" && !data.publicKey?.publicKeyPem) {
+    return { ok: false, reason: "missing_public_key" };
+  }
+
+  const fields = buildActorCacheFields(data);
+
+  if (mode === "insert") {
+    // Cache-when-absent: leave an existing row untouched. The early-existence
+    // check at the call site is best-effort, so two isolates racing the same
+    // cold actor can both reach this insert; `onConflictDoNothing` keeps that
+    // race-safe instead of throwing a primary-key violation.
+    await db
+      .insert(actorCache)
+      .values({ apId: data.id, ...fields })
+      .onConflictDoNothing();
+  } else {
+    await db
+      .insert(actorCache)
+      .values({ apId: data.id, ...fields })
+      .onConflictDoUpdate({ target: actorCache.apId, set: fields });
+  }
+
+  const row = await db
+    .select()
+    .from(actorCache)
+    .where(eq(actorCache.apId, data.id))
+    .get();
+  if (!row) return { ok: false, reason: "fetch_failed" };
+
+  return { ok: true, data, row };
+}

package/src/backend/lib/activitypub-helpers.ts

@@ -0,0 +1,131 @@
+import type { Actor } from "../types.ts";
+
+interface StoryData {
+  apId: string;
+  attributedTo: string;
+  attachment: {
+    type: string;
+    mediaType: string;
+    url: string;
+    r2_key: string;
+  };
+  displayDuration: string;
+  // Optional caption/text shown over the story. Federated to remote instances
+  // as the AS2 Note `content` so they can render the same caption locally.
+  caption?: string;
+  overlays?: unknown[];
+  endTime: string;
+  published: string;
+}
+
+/**
+ * Safely join a base URL and a path segment.
+ * Returns the path unchanged if it is already an absolute URL.
+ */
+export function safeUrlJoin(baseUrl: string, path: string): string {
+  if (path.startsWith("http://") || path.startsWith("https://")) {
+    return path;
+  }
+
+  const cleanBase = baseUrl.replace(/\/+$/, "");
+  const normalizedPath = path.startsWith("/") ? path : "/" + path;
+
+  try {
+    const base = new URL(cleanBase);
+    return base.origin + base.pathname.replace(/\/+$/, "") + normalizedPath;
+  } catch {
+    return cleanBase + normalizedPath;
+  }
+}
+
+/**
+ * Map stored attachment rows to AP-standard `Document` attachments for every
+ * federation egress point (the embedded object in an outbound Create, and the
+ * served `/ap/objects/:id` document). The internal shape is
+ * `{ url: "/media/<hash>", content_type, r2_key }`; a remote needs
+ * `{ type: "Document", mediaType, url: <absolute> }`:
+ *   - `url` is absolutized (a relative `/media/...` would resolve against the
+ *     REMOTE's origin and 404);
+ *   - `content_type` is renamed to `mediaType` — the AP/Mastodon field used to
+ *     recognize and render the media (without it, the image may not display);
+ *   - `type: "Document"` is added (the standard AP media-attachment type);
+ *   - the internal `r2_key` (and any other non-AP field) is DROPPED so storage
+ *     details never leak to remotes;
+ *   - `name` (alt text) is preserved when present.
+ * Attachments without a usable `url` are skipped.
+ */
+export function toApAttachments(
+  attachments: unknown[],
+  baseUrl: string,
+): Array<Record<string, unknown>> {
+  return attachments.flatMap((att) => {
+    if (!att || typeof att !== "object" || Array.isArray(att)) return [];
+    const a = att as Record<string, unknown>;
+    const url = typeof a.url === "string" ? a.url : "";
+    if (url.length === 0) return [];
+    const mediaType =
+      (typeof a.mediaType === "string" && a.mediaType) ||
+      (typeof a.content_type === "string" && a.content_type) ||
+      undefined;
+    const name =
+      typeof a.name === "string" && a.name.length > 0 ? a.name : undefined;
+    return [
+      {
+        type: "Document",
+        ...(mediaType ? { mediaType } : {}),
+        url: safeUrlJoin(baseUrl, url),
+        ...(name ? { name } : {}),
+      },
+    ];
+  });
+}
+
+/**
+ * Convert a Story to ActivityPub format
+ */
+export function storyToActivityPub(
+  story: StoryData,
+  actor: Actor,
+  baseUrl: string,
+): object {
+  const attachmentUrl = safeUrlJoin(baseUrl, story.attachment.url);
+
+  return {
+    // Terms are inlined (not just a remote context URL) so plain AS2 consumers
+    // need not dereference https://yurucommu.com/ns/story. This object MUST stay
+    // byte-for-term identical to the published context at
+    // the public yurucommu namespace context hosted by the official client site.
+    "@context": [
+      "https://www.w3.org/ns/activitystreams",
+      {
+        story: "https://yurucommu.com/ns/story#",
+        xsd: "http://www.w3.org/2001/XMLSchema#",
+        Story: "story:Story",
+        displayDuration: {
+          "@id": "story:displayDuration",
+          "@type": "xsd:duration",
+        },
+        overlays: { "@id": "story:overlays", "@container": "@list" },
+        position: "story:position",
+      },
+    ],
+    id: story.apId,
+    type: ["Story", "Note"],
+    attributedTo: actor.ap_id,
+    published: story.published,
+    endTime: story.endTime,
+    to: [`${actor.ap_id}/followers`],
+    // The story caption is the Note text; emit it so remote instances render
+    // the same caption. Omitted entirely when there is no caption.
+    ...(story.caption ? { content: story.caption } : {}),
+    attachment: {
+      type: story.attachment.type,
+      mediaType: story.attachment.mediaType,
+      url: attachmentUrl,
+    },
+    displayDuration: story.displayDuration,
+    ...(story.overlays && story.overlays.length > 0
+      ? { overlays: story.overlays }
+      : {}),
+  };
+}