@takosjp/yurucommu-core 3.2.1 → 3.3.0

package/src/backend/lib/rtc/signal-transport.ts

@@ -0,0 +1,125 @@
+/**
+ * Cross-instance call signaling transport (server-to-server).
+ *
+ * Signaling for a call between two self-hosted instances travels as an
+ * HTTP-Signature-signed POST to the peer instance's `/ap/rtc/signal` endpoint.
+ * This deliberately does NOT use the queued federation delivery path
+ * (`enqueueDeliveryToActor`, with its circuit-breaker + retry/backoff): an SDP
+ * offer or ICE candidate is ephemeral and latency-sensitive, so a stale retry is
+ * useless. We reuse the same low-level signing (`signRequest`) + SSRF-guarded
+ * fetch (`fetchWithTimeout`) primitives the delivery worker uses, but send
+ * synchronously and directly. It also does NOT go through the inbox activity
+ * pipeline (`claimActivityForDispatch` / `parseActivity`), which would both strip
+ * the SDP/ICE fields and pollute the `activities` ledger with ephemeral frames.
+ */
+
+import { eq } from "drizzle-orm";
+import type { Database } from "../../../db/index.ts";
+import { actorCache } from "../../../db/index.ts";
+import type { RtcSignalEnvelopeV1 } from "../../../../packages/api/src/types/call.ts";
+import { signRequest } from "../ap-signing.ts";
+import { fetchWithTimeout } from "../federation-fetch.ts";
+import { fetchAndUpsertActorCache } from "../activitypub-actor-cache.ts";
+import { isSafeRemoteUrl } from "../ssrf.ts";
+import { logger } from "../logger.ts";
+
+const log = logger.child({ component: "rtc.signal-transport" });
+
+const SIGNAL_PATH = "/ap/rtc/signal";
+const SIGNAL_TIMEOUT_MS = 8000;
+
+export interface CallSigner {
+  apId: string;
+  privateKeyPem: string;
+}
+
+/** Derive a peer's signaling endpoint from a cached actor row. */
+function endpointFromActorRow(row: {
+  inbox: string;
+  rawJson: string;
+}): string | null {
+  // Prefer an explicitly advertised endpoint (actor `endpoints.rtcSignal`).
+  try {
+    const doc = JSON.parse(row.rawJson) as {
+      endpoints?: { rtcSignal?: unknown };
+    };
+    const advertised = doc.endpoints?.rtcSignal;
+    if (typeof advertised === "string" && isSafeRemoteUrl(advertised)) {
+      return advertised;
+    }
+  } catch {
+    // fall through to inbox-origin derivation
+  }
+  // Fall back to `<inbox-origin>/ap/rtc/signal` (every yurucommu instance
+  // serves this path). Peers that are not yurucommu simply won't answer.
+  try {
+    const origin = new URL(row.inbox).origin;
+    const endpoint = `${origin}${SIGNAL_PATH}`;
+    return isSafeRemoteUrl(endpoint) ? endpoint : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Resolve (and cache) the peer instance's signaling endpoint URL. */
+export async function resolvePeerSignalEndpoint(
+  db: Database,
+  peerApId: string,
+): Promise<string | null> {
+  let row = await db.query.actorCache.findFirst({
+    where: eq(actorCache.apId, peerApId),
+    columns: { inbox: true, rawJson: true },
+  });
+  if (!row) {
+    const result = await fetchAndUpsertActorCache(db, peerApId, {});
+    if (result.ok) {
+      row = { inbox: result.row.inbox, rawJson: result.row.rawJson };
+    }
+  }
+  if (!row) return null;
+  return endpointFromActorRow(row);
+}
+
+/**
+ * Sign + POST a signaling envelope to the peer instance. Throws on any
+ * unreachable / non-2xx outcome so the caller can fail the call fast.
+ */
+export async function sendCallSignal(
+  db: Database,
+  signer: CallSigner,
+  envelope: RtcSignalEnvelopeV1,
+  peerSignalEndpoint?: string,
+): Promise<void> {
+  const endpoint =
+    peerSignalEndpoint ?? (await resolvePeerSignalEndpoint(db, envelope.to));
+  if (!endpoint) {
+    throw new Error(`no signaling endpoint for ${envelope.to}`);
+  }
+  const body = JSON.stringify(envelope);
+  const keyId = `${signer.apId}#main-key`;
+  const signed = await signRequest(
+    signer.privateKeyPem,
+    keyId,
+    "POST",
+    endpoint,
+    body,
+  );
+  const res = await fetchWithTimeout(endpoint, {
+    method: "POST",
+    headers: {
+      ...signed,
+      "Content-Type": "application/activity+json",
+      Accept: "application/json",
+    },
+    body,
+    timeout: SIGNAL_TIMEOUT_MS,
+  });
+  if (!res.ok) {
+    log.warn("Signaling POST rejected", {
+      callId: envelope.callId,
+      type: envelope.type,
+      status: res.status,
+    });
+    throw new Error(`signal POST ${res.status}`);
+  }
+}

package/src/backend/public.ts

@@ -13,6 +13,9 @@ export { default } from "./index.ts";
 export { default as app } from "./index.ts";
 export { type Database, getDb, getDbSQLite } from "../db/index.ts";
 export { wrapCloudflareBindings } from "./runtime/cloudflare.ts";
+// Call feature: the signaling Durable Object class each product's generated
+// worker entry must re-export so Wrangler can bind CALL_SIGNALING to it.
+export { CallSignalingDurableObject } from "./runtime/call-signaling-do.ts";
 export type { Env, EnvVars } from "./types.ts";
 export type {
   DeliveryDlqMessageV1,

package/src/backend/routes/activitypub.ts

@@ -440,9 +440,13 @@ ap.get(
       following: showCollections ? actor.followingUrl : undefined,
       // Advertise sharedInbox so remote servers can deduplicate fan-out
       // delivery (Mastodon convention). The endpoint accepts signed
-      // activities just like the per-actor inbox.
+      // activities just like the per-actor inbox. `rtcSignal` advertises the
+      // call-signaling ingest so a caller's instance can reach this user
+      // directly (yurucommu extension; peers that don't recognize it just fall
+      // back to deriving it from the inbox origin).
       endpoints: {
         sharedInbox: `${baseUrl}/ap/inbox`,
+        rtcSignal: `${baseUrl}/ap/rtc/signal`,
       },
       publicKey: buildPublicKey(actor.apId, actor.publicKeyPem),
       discoverable: !actor.isPrivate,

package/src/backend/routes/auth.ts

@@ -63,6 +63,12 @@ const auth = new Hono<{ Bindings: Env; Variables: Variables }>();
 // abuse even from the legitimate owner session (#23).
 const MAX_SUB_ACCOUNTS = 20;
 
+function parsePassword(value: unknown): string | null {
+  // Passwords are opaque credentials. Trimming changes a valid secret and can
+  // make the native and browser login behavior diverge from the stored hash.
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+
 // 認証設定取得
 auth.get("/providers", async (c) => {
   const config = getAuthConfig(c.env);
@@ -151,7 +157,7 @@ auth.post("/login", async (c) => {
     return c.json({ error: "Invalid request body", code: "BAD_REQUEST" }, 400);
   }
 
-  const password = parseNonEmptyString(body.password);
+  const password = parsePassword(body.password);
   if (!password) {
     return c.json({ error: "password is required", code: "BAD_REQUEST" }, 400);
   }
@@ -233,7 +239,7 @@ auth.post("/mobile/login", async (c) => {
   }
 
   const body = await parseJsonObject(c);
-  const password = body ? parseNonEmptyString(body.password) : undefined;
+  const password = body ? parsePassword(body.password) : null;
   if (!password) {
     return c.json({ error: "password is required", code: "BAD_REQUEST" }, 400);
   }

package/src/backend/routes/rtc/index.ts

@@ -0,0 +1,147 @@
+/**
+ * Call feature routes (WebRTC voice + video).
+ *
+ *   POST /ap/rtc/signal    server-to-server signaling ingest (HTTP-Signature)
+ *   GET  /api/rtc/socket   browser WebSocket upgrade -> per-user signaling hub
+ *   GET  /api/rtc/ice      mint short-lived ICE (STUN/TURN) servers
+ *   POST /api/rtc/calls    start a call (block-list gate + callId + ICE)
+ *   GET  /api/rtc/calls    call history (missed / recent)
+ *   GET  /api/rtc/calls/:id current state of one call
+ *
+ * Signaling is intentionally OUTSIDE the ActivityPub inbox pipeline: the
+ * `/ap/rtc/signal` endpoint bypasses `claimActivityForDispatch` /
+ * `parseActivity` (which would strip SDP/ICE and persist ephemeral frames to the
+ * `activities` ledger). It reuses the same HTTP-Signature auth every inbox uses.
+ */
+
+import { Hono } from "hono";
+import { eq } from "drizzle-orm";
+import type { Env, Variables } from "../../types.ts";
+import { actors } from "../../../db/index.ts";
+import { verifyHttpSignature } from "../../lib/ap-verify.ts";
+import {
+  isActorMismatch,
+  signingActorFromKeyId,
+} from "../activitypub/inbox.ts";
+import { isActorBlocked } from "../../lib/blocklist.ts";
+import {
+  getSignalingHub,
+  isSignalingAvailable,
+} from "../../runtime/signaling-hub.ts";
+import { createRtcProvider } from "../../lib/rtc/provider.ts";
+import { getCallSession, listCallSessions } from "../../lib/rtc/call-store.ts";
+import type {
+  CallMediaKind,
+  StartCallRequest,
+} from "../../../../packages/api/src/types/call.ts";
+import { parseRtcSignalEnvelope } from "../../../../packages/api/src/types/call.ts";
+
+const rtc = new Hono<{ Bindings: Env; Variables: Variables }>();
+
+function normalizeMedia(input: unknown): CallMediaKind {
+  if (input && typeof input === "object") {
+    const m = input as Partial<CallMediaKind>;
+    return { audio: m.audio !== false, video: Boolean(m.video) };
+  }
+  return { audio: true, video: false };
+}
+
+// --- Server-to-server signaling ingest -------------------------------------
+rtc.post("/ap/rtc/signal", async (c) => {
+  const db = c.get("db");
+  const body = await c.req.text();
+  const sig = await verifyHttpSignature(c.req.raw, db, body);
+  if (!sig.valid) return c.json({ error: "invalid_signature" }, 401);
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return c.json({ error: "bad_json" }, 400);
+  }
+  const envelope = parseRtcSignalEnvelope(parsed);
+  if (!envelope) return c.json({ error: "bad_envelope" }, 400);
+
+  // The HTTP-Signature signer must own the claimed `from` actor.
+  if (isActorMismatch(signingActorFromKeyId(sig.keyId), envelope.from)) {
+    return c.json({ error: "signer_mismatch" }, 403);
+  }
+
+  // The recipient must be a local actor served by this instance.
+  const local = await db.query.actors.findFirst({
+    where: eq(actors.apId, envelope.to),
+    columns: { apId: true },
+  });
+  if (!local) return c.json({ error: "unknown_recipient" }, 404);
+
+  // Never ring for a sender the local owner has blocked; drop silently.
+  if (await isActorBlocked(db, envelope.from)) return c.body(null, 204);
+
+  await getSignalingHub(c.env).deliver(envelope.to, envelope);
+  return c.body(null, 204);
+});
+
+// --- Browser WebSocket upgrade ---------------------------------------------
+rtc.get("/api/rtc/socket", async (c) => {
+  const actor = c.get("actor");
+  if (!actor) return c.json({ error: "unauthorized" }, 401);
+  if (!isSignalingAvailable(c.env)) {
+    return c.json({ error: "signaling_unavailable" }, 503);
+  }
+  return getSignalingHub(c.env).upgrade(c.req.raw, actor.ap_id);
+});
+
+// --- ICE servers ------------------------------------------------------------
+rtc.get("/api/rtc/ice", async (c) => {
+  const actor = c.get("actor");
+  if (!actor) return c.json({ error: "unauthorized" }, 401);
+  const iceServers = await createRtcProvider(c.env).getIceServers();
+  return c.json({ iceServers });
+});
+
+// --- Start a call -----------------------------------------------------------
+rtc.post("/api/rtc/calls", async (c) => {
+  const actor = c.get("actor");
+  if (!actor) return c.json({ error: "unauthorized" }, 401);
+  if (!isSignalingAvailable(c.env)) {
+    return c.json({ error: "signaling_unavailable" }, 503);
+  }
+  const db = c.get("db");
+  let payload: Partial<StartCallRequest>;
+  try {
+    payload = (await c.req.json()) as Partial<StartCallRequest>;
+  } catch {
+    return c.json({ error: "bad_json" }, 400);
+  }
+  const to = typeof payload.to === "string" ? payload.to.trim() : "";
+  if (!to || to === actor.ap_id) return c.json({ error: "bad_target" }, 400);
+  const media = normalizeMedia(payload.media);
+
+  // Do not let the local owner place a call to a contact they have blocked.
+  if (await isActorBlocked(db, to)) return c.json({ error: "blocked" }, 403);
+
+  const provider = createRtcProvider(c.env);
+  const [iceServers, sfuFocus] = await Promise.all([
+    provider.getIceServers(),
+    provider.getSfuFocus(media),
+  ]);
+  return c.json({ callId: crypto.randomUUID(), iceServers, sfuFocus });
+});
+
+// --- Call history + state ---------------------------------------------------
+rtc.get("/api/rtc/calls", async (c) => {
+  const actor = c.get("actor");
+  if (!actor) return c.json({ error: "unauthorized" }, 401);
+  const calls = await listCallSessions(c.get("db"), actor.ap_id);
+  return c.json({ calls });
+});
+
+rtc.get("/api/rtc/calls/:id", async (c) => {
+  const actor = c.get("actor");
+  if (!actor) return c.json({ error: "unauthorized" }, 401);
+  const call = await getCallSession(c.get("db"), actor.ap_id, c.req.param("id"));
+  if (!call) return c.json({ error: "not_found" }, 404);
+  return c.json({ call });
+});
+
+export default rtc;