@takosjp/yurucommu-core 3.0.0

package/src/backend/lib/activitypub-validators.ts

@@ -0,0 +1,323 @@
+/**
+ * ActivityPub structural validators.
+ *
+ * Network ingress from arbitrary fediverse servers is untyped JSON. This
+ * module narrows `unknown` into the shapes Yurucommu expects, throwing a
+ * typed {@link ActivityPubContractError} with a field path on contract
+ * violations so callers can log + reject rather than panic on `undefined`
+ * field access deep in handler code.
+ *
+ * Rules:
+ * - ActivityPub is lenient about extension fields; parsers accept unknown
+ *   extra fields and copy through only the keys we care about.
+ * - Required-but-wrong-type fields fail closed.
+ * - Optional fields that are present but malformed are dropped silently
+ *   (treated as absent) rather than rejecting the whole document.
+ */
+
+/** Error thrown when a remote ActivityPub document violates our contract. */
+export class ActivityPubContractError extends Error {
+  readonly path: string;
+  constructor(path: string, message: string) {
+    super(`[ActivityPub contract] ${path}: ${message}`);
+    this.name = "ActivityPubContractError";
+    this.path = path;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Generic JSON helpers
+// ---------------------------------------------------------------------------
+
+export function isJsonRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function asString(value: unknown): string | undefined {
+  return typeof value === "string" ? value : undefined;
+}
+
+function getString(
+  record: Record<string, unknown>,
+  key: string,
+): string | undefined {
+  return asString(record[key]);
+}
+
+function getRecord(
+  record: Record<string, unknown>,
+  key: string,
+): Record<string, unknown> | undefined {
+  const value = record[key];
+  return isJsonRecord(value) ? value : undefined;
+}
+
+function getStringArray(
+  record: Record<string, unknown>,
+  key: string,
+): string[] | undefined {
+  const value = record[key];
+  // AS2 permits an addressing field (`to`/`cc`) to be a SINGLE IRI string OR an
+  // array. Normalize a scalar to a one-element array so the array-shape
+  // consumers don't silently drop it: a scalar-addressed Note would otherwise
+  // fail isDirectNote (a DM mis-routed as a visible unlisted post) and a scalar
+  // `to: "…#Public"` would be classified unlisted instead of public.
+  if (typeof value === "string") return [value];
+  if (!Array.isArray(value)) return undefined;
+  const result: string[] = [];
+  for (const item of value) {
+    if (typeof item === "string") result.push(item);
+  }
+  return result;
+}
+
+// AS2 permits `type` to be a single string OR an array (e.g. yurucommu's own
+// stories emit `type: ["Story", "Note"]`). Preserve both shapes so the
+// array-aware downstream classifiers (isStoryType / isActorTypeUpdate /
+// typeIncludes) actually receive the array instead of a collapsed `undefined`.
+function getStringOrStringArray(
+  record: Record<string, unknown>,
+  key: string,
+): string | string[] | undefined {
+  const value = record[key];
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) {
+    const result = value.filter((v): v is string => typeof v === "string");
+    return result.length > 0 ? result : undefined;
+  }
+  return undefined;
+}
+
+function requireRecord(value: unknown, path: string): Record<string, unknown> {
+  if (!isJsonRecord(value)) {
+    throw new ActivityPubContractError(
+      path,
+      `expected JSON object, got ${value === null ? "null" : typeof value}`,
+    );
+  }
+  return value;
+}
+
+// ---------------------------------------------------------------------------
+// Remote Actor
+// ---------------------------------------------------------------------------
+
+export interface RemoteActorDocument {
+  id: string;
+  type?: string;
+  preferredUsername?: string;
+  name?: string;
+  summary?: string;
+  icon?: { url?: string };
+  inbox?: string;
+  outbox?: string;
+  followers?: string;
+  following?: string;
+  endpoints?: { sharedInbox?: string };
+  publicKey?: { id?: string; publicKeyPem?: string };
+}
+
+function parseIcon(
+  record: Record<string, unknown>,
+): { url?: string } | undefined {
+  const icon = getRecord(record, "icon");
+  if (!icon) return undefined;
+  const url = getString(icon, "url");
+  return url ? { url } : {};
+}
+
+function parsePublicKey(
+  record: Record<string, unknown>,
+): { id?: string; publicKeyPem?: string } | undefined {
+  const publicKey = getRecord(record, "publicKey");
+  if (!publicKey) return undefined;
+  return {
+    id: getString(publicKey, "id"),
+    publicKeyPem: getString(publicKey, "publicKeyPem"),
+  };
+}
+
+function parseEndpoints(
+  record: Record<string, unknown>,
+): { sharedInbox?: string } | undefined {
+  const endpoints = getRecord(record, "endpoints");
+  if (!endpoints) return undefined;
+  const sharedInbox = getString(endpoints, "sharedInbox");
+  return sharedInbox ? { sharedInbox } : {};
+}
+
+/**
+ * Narrow an `unknown` (typically a `await res.json()` result from a remote
+ * actor endpoint) into a {@link RemoteActorDocument}. Throws
+ * {@link ActivityPubContractError} if `id` is missing/non-string. Other
+ * fields are best-effort: optional fields with wrong types are dropped.
+ */
+export function parseRemoteActor(
+  value: unknown,
+  path = "$",
+): RemoteActorDocument {
+  const record = requireRecord(value, path);
+  const id = getString(record, "id");
+  if (!id) {
+    throw new ActivityPubContractError(
+      `${path}.id`,
+      "actor must have a string id",
+    );
+  }
+  return {
+    id,
+    type: getString(record, "type"),
+    preferredUsername: getString(record, "preferredUsername"),
+    name: getString(record, "name"),
+    summary: getString(record, "summary"),
+    icon: parseIcon(record),
+    inbox: getString(record, "inbox"),
+    outbox: getString(record, "outbox"),
+    followers: getString(record, "followers"),
+    following: getString(record, "following"),
+    endpoints: parseEndpoints(record),
+    publicKey: parsePublicKey(record),
+  };
+}
+
+/**
+ * Like {@link parseRemoteActor} but returns `null` instead of throwing.
+ * Useful for best-effort caches where a malformed response should be
+ * skipped silently.
+ */
+export function tryParseRemoteActor(
+  value: unknown,
+): RemoteActorDocument | null {
+  try {
+    return parseRemoteActor(value);
+  } catch (e) {
+    if (e instanceof ActivityPubContractError) return null;
+    throw e;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Activity envelope
+// ---------------------------------------------------------------------------
+
+export interface ActivityObjectDocument {
+  id?: string;
+  type?: string | string[];
+  object?: string;
+  inReplyTo?: string;
+  to?: string[];
+  cc?: string[];
+  conversation?: string;
+  content?: string;
+  summary?: string | null;
+  attachment?: unknown;
+  // AS2 `tag` (Mention / Hashtag / Emoji). Passed through untyped like
+  // `attachment`/`overlays` — handlers read object.tag (e.g. inbound @-mention
+  // notifications in handleCreate). Without copying it here, every handler sees
+  // `tag === undefined` and federated mentions/hashtags are silently dropped.
+  tag?: unknown;
+  overlays?: unknown;
+  endTime?: string;
+  displayDuration?: string;
+  published?: string;
+  room?: string;
+}
+
+export interface ActivityDocument {
+  id?: string;
+  type?: string;
+  actor?: string;
+  object?: string | ActivityObjectDocument;
+  target?: string | ActivityObjectDocument;
+  room?: string;
+}
+
+function parseActivityObjectFields(
+  record: Record<string, unknown>,
+): ActivityObjectDocument {
+  const summaryRaw = record["summary"];
+  return {
+    id: getString(record, "id"),
+    type: getStringOrStringArray(record, "type"),
+    object: getString(record, "object"),
+    inReplyTo: getString(record, "inReplyTo"),
+    to: getStringArray(record, "to"),
+    cc: getStringArray(record, "cc"),
+    conversation: getString(record, "conversation"),
+    content: getString(record, "content"),
+    summary:
+      typeof summaryRaw === "string"
+        ? summaryRaw
+        : summaryRaw === null
+          ? null
+          : undefined,
+    attachment: record["attachment"],
+    tag: record["tag"],
+    overlays: record["overlays"],
+    endTime: getString(record, "endTime"),
+    displayDuration: getString(record, "displayDuration"),
+    published: getString(record, "published"),
+    room: getString(record, "room"),
+  };
+}
+
+function parseActivityObjectOrIri(
+  value: unknown,
+): string | ActivityObjectDocument | undefined {
+  if (typeof value === "string") return value;
+  if (isJsonRecord(value)) return parseActivityObjectFields(value);
+  return undefined;
+}
+
+/**
+ * Narrow an `unknown` (an already-`JSON.parse`d inbox body) into an
+ * {@link ActivityDocument}. Throws if the value is not a JSON object.
+ * Callers are expected to enforce required activity fields (`type`,
+ * `actor`) separately, since the legitimate set of required fields
+ * varies by activity type.
+ */
+export function parseActivity(value: unknown, path = "$"): ActivityDocument {
+  const record = requireRecord(value, path);
+  return {
+    id: getString(record, "id"),
+    type: getString(record, "type"),
+    actor: getString(record, "actor"),
+    object: parseActivityObjectOrIri(record["object"]),
+    target: parseActivityObjectOrIri(record["target"]),
+    room: getString(record, "room"),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// WebFinger
+// ---------------------------------------------------------------------------
+
+export interface WebFingerLinkDocument {
+  rel?: string;
+  type?: string;
+  href?: string;
+}
+
+export interface WebFingerDocument {
+  links?: WebFingerLinkDocument[];
+}
+
+/**
+ * Narrow an `unknown` from a `.well-known/webfinger` response into
+ * {@link WebFingerDocument}. Links with non-string fields are dropped.
+ */
+export function parseWebFinger(value: unknown, path = "$"): WebFingerDocument {
+  const record = requireRecord(value, path);
+  const rawLinks = record["links"];
+  if (!Array.isArray(rawLinks)) return {};
+  const links: WebFingerLinkDocument[] = [];
+  for (const link of rawLinks) {
+    if (!isJsonRecord(link)) continue;
+    links.push({
+      rel: getString(link, "rel"),
+      type: getString(link, "type"),
+      href: getString(link, "href"),
+    });
+  }
+  return { links };
+}

package/src/backend/lib/ap-context.ts

@@ -0,0 +1,16 @@
+// Shared JSON-LD @context for SERVED / DELIVERED objects (Note + the Create that
+// wraps it). The objects we emit carry `tag` entries of type `Hashtag` and a
+// `sensitive` flag (content warnings) — neither is defined in the vanilla AS2
+// context, so a strict JSON-LD processor (relays / indexers that expand)
+// silently DROPS them: a CW post can render unblurred and a hashtag is not
+// indexed remotely. Declaring the terms (to their AS2 IRIs) keeps our egress
+// JSON-LD-valid. Mirrors the ACTOR_CONTEXT_EXTENSION pattern used for the actor
+// doc (routes/activitypub.ts) but for the object/Create surfaces.
+export const OBJECT_CONTEXT = [
+  "https://www.w3.org/ns/activitystreams",
+  "https://w3id.org/security/v1",
+  {
+    Hashtag: "https://www.w3.org/ns/activitystreams#Hashtag",
+    sensitive: "https://www.w3.org/ns/activitystreams#sensitive",
+  },
+] as const;

package/src/backend/lib/ap-ids.ts

@@ -0,0 +1,101 @@
+import { logger } from "./logger.ts";
+import { bytesToHex } from "./hex.ts";
+
+const utilsLog = logger.child({ component: "utils" });
+
+export function safeJsonParse<T>(
+  json: string | null | undefined,
+  defaultValue: T,
+): T {
+  if (!json) return defaultValue;
+  try {
+    return JSON.parse(json) as T;
+  } catch (err) {
+    // MEDIUM FIX: Log the error for debugging
+    utilsLog.warn("safeJsonParse failed", {
+      event: "utils.json.parse_failed",
+      error: err,
+    });
+    return defaultValue;
+  }
+}
+
+export function parseLimit(
+  value: string | undefined,
+  fallback: number,
+  max: number,
+): number {
+  const parsed = parseInt(value || "", 10);
+  if (!Number.isFinite(parsed)) return fallback;
+  return Math.min(Math.max(parsed, 1), max);
+}
+
+export function parseOffset(
+  value: string | undefined,
+  fallback: number,
+  max: number,
+): number {
+  const parsed = parseInt(value || "", 10);
+  if (!Number.isFinite(parsed)) return fallback;
+  return Math.min(Math.max(parsed, 0), max);
+}
+
+export function generateId(): string {
+  // 256-bit (32-byte) session/OAuth identifiers. Session ids in particular are
+  // bearer credentials, so we keep the entropy high; 96-bit was too low.
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return bytesToHex(bytes);
+}
+
+export function actorApId(baseUrl: string, username: string): string {
+  return `${baseUrl}/ap/users/${username}`;
+}
+
+export function objectApId(baseUrl: string, id: string): string {
+  return `${baseUrl}/ap/objects/${id}`;
+}
+
+export function activityApId(baseUrl: string, id: string): string {
+  return `${baseUrl}/ap/activities/${id}`;
+}
+
+export function communityApId(baseUrl: string, name: string): string {
+  // Normalize a trailing slash so the apId minted at community CREATION matches
+  // the one reconstructed on every federation READ (actor doc / inbox / outbox /
+  // followers / moderators / webfinger). Without this, a `APP_URL` configured
+  // with a trailing slash would store `…//ap/groups/<name>` while reads look up
+  // `…/ap/groups/<name>`, 404ing every community.
+  return `${baseUrl.replace(/\/+$/, "")}/ap/groups/${name}`;
+}
+
+export function getDomain(apId: string): string {
+  return new URL(apId).host;
+}
+
+export function isLocal(apId: string, baseUrl: string): boolean {
+  // Compare hostname (and port, if specified by `baseUrl`) rather than
+  // string-prefix `baseUrl`. Prefix comparison is unsafe because a remote
+  // host like `https://yurucommu.example.evil` would match a baseUrl of
+  // `https://yurucommu.example`.
+  try {
+    const apUrl = new URL(apId);
+    const baseUrlObj = new URL(baseUrl);
+    if (apUrl.hostname !== baseUrlObj.hostname) return false;
+    if (baseUrlObj.port !== "") {
+      return apUrl.port === baseUrlObj.port;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function formatUsername(apId: string): string {
+  const url = new URL(apId);
+  const match = apId.match(/\/users\/([^\/]+)$/);
+  if (match) {
+    return `${match[1]}@${url.host}`;
+  }
+  return apId;
+}

package/src/backend/lib/ap-response.ts

@@ -0,0 +1,30 @@
+// AP / WebFinger responses must carry the correct Content-Type. Hono's
+// `c.json()` force-sets `application/json` and CLOBBERS any `Content-Type`
+// header set before it — so an ActivityPub document served via `c.json()`
+// reaches a remote (Mastodon et al.) as `application/json`, which strict
+// consumers REJECT (`Request` only accepts `application/activity+json` /
+// `application/ld+json`), breaking inbound federation: a remote cannot resolve
+// this actor/object/collection. These helpers serialize manually and set the
+// spec content type via `c.body()`, which does not override it.
+
+// Minimal structural shape of the Hono context we touch, so this stays
+// decoupled from a route's specific Bindings/Variables typing.
+interface ApResponseContext {
+  header(name: string, value: string): void;
+  body(data: string): Response;
+}
+
+const AP_CONTENT_TYPE = "application/activity+json";
+const JRD_CONTENT_TYPE = "application/jrd+json";
+
+/** Serialize `body` as an ActivityStreams document (`application/activity+json`). */
+export function activityJson(c: ApResponseContext, body: unknown): Response {
+  c.header("Content-Type", AP_CONTENT_TYPE);
+  return c.body(JSON.stringify(body));
+}
+
+/** Serialize `body` as a WebFinger JRD document (`application/jrd+json`). */
+export function jrdJson(c: ApResponseContext, body: unknown): Response {
+  c.header("Content-Type", JRD_CONTENT_TYPE);
+  return c.body(JSON.stringify(body));
+}

package/src/backend/lib/ap-signing.ts

@@ -0,0 +1,87 @@
+import { bufferToBase64 } from "./base64.ts";
+
+const RSA_ALGORITHM = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+
+function wrapPem(label: string, base64: string): string {
+  const lines = base64.match(/.{1,64}/g)?.join("\n") ?? base64;
+  return `-----BEGIN ${label}-----\n${lines}\n-----END ${label}-----`;
+}
+
+export async function generateKeyPair(): Promise<{
+  publicKeyPem: string;
+  privateKeyPem: string;
+}> {
+  const keyPair = await crypto.subtle.generateKey(
+    {
+      ...RSA_ALGORITHM,
+      modulusLength: 2048,
+      publicExponent: new Uint8Array([1, 0, 1]),
+    },
+    true,
+    ["sign", "verify"],
+  );
+
+  const [publicKey, privateKey] = await Promise.all([
+    crypto.subtle.exportKey("spki", keyPair.publicKey),
+    crypto.subtle.exportKey("pkcs8", keyPair.privateKey),
+  ]);
+
+  return {
+    publicKeyPem: wrapPem("PUBLIC KEY", bufferToBase64(publicKey)),
+    privateKeyPem: wrapPem("PRIVATE KEY", bufferToBase64(privateKey)),
+  };
+}
+
+export async function signRequest(
+  privateKeyPem: string,
+  keyId: string,
+  method: string,
+  url: string,
+  body?: string,
+): Promise<Record<string, string>> {
+  const urlObj = new URL(url);
+  const date = new Date().toUTCString();
+  const digest = body
+    ? `SHA-256=${bufferToBase64(
+        await crypto.subtle.digest("SHA-256", new TextEncoder().encode(body)),
+      )}`
+    : undefined;
+
+  const signedHeaders = digest
+    ? "(request-target) host date digest"
+    : "(request-target) host date";
+  // The request-target must include the query string (verifiers reconstruct
+  // `pathname + search`). For the common query-less actor/inbox URL `search` is
+  // empty, so this is a no-op there and a correctness fix for any URL that does
+  // carry a query (e.g. a signed object GET).
+  const requestTarget = `${urlObj.pathname}${urlObj.search}`;
+  let signatureString = `(request-target): ${method.toLowerCase()} ${requestTarget}\nhost: ${urlObj.host}\ndate: ${date}`;
+  if (digest) signatureString += `\ndigest: ${digest}`;
+
+  const pemContents = privateKeyPem
+    .replace(/-----[^-]+-----/g, "")
+    .replace(/\s/g, "");
+  const binaryKey = Uint8Array.from(atob(pemContents), (c) => c.charCodeAt(0));
+  const cryptoKey = await crypto.subtle.importKey(
+    "pkcs8",
+    binaryKey,
+    RSA_ALGORITHM,
+    false,
+    ["sign"],
+  );
+  const signatureBuffer = await crypto.subtle.sign(
+    "RSASSA-PKCS1-v1_5",
+    cryptoKey,
+    new TextEncoder().encode(signatureString),
+  );
+  const signature = bufferToBase64(signatureBuffer);
+
+  const headers: Record<string, string> = {
+    Date: date,
+    Host: urlObj.host,
+    Signature: `keyId="${keyId}",algorithm="rsa-sha256",headers="${signedHeaders}",signature="${signature}"`,
+  };
+  if (digest) headers["Digest"] = digest;
+
+  return headers;
+}