active-boxes 0.0.1.dev2__py3-none-any.whl

active_boxes/backend.py

@@ -0,0 +1,128 @@
+import abc
+import binascii
+import json
+import os
+import typing
+from typing import Any
+from typing import Dict
+from typing import List
+from typing import Optional
+
+import requests
+
+from .__version__ import __version__
+from .collection import parse_collection
+from .errors import ActivityGoneError
+from .errors import ActivityNotFoundError
+from .errors import ActivityUnavailableError
+from .errors import NotAnActivityError
+from .urlutils import URLLookupFailedError
+from .urlutils import check_url as check_url
+
+if typing.TYPE_CHECKING:
+    from active_boxes import activitypub as ap  # noqa: type checking
+
+
+class Backend(abc.ABC):
+    def debug_mode(self) -> bool:
+        """Should be overidded to return `True` in order to enable the debug mode."""
+        return False
+
+    def check_url(self, url: str) -> None:
+        check_url(url, debug=self.debug_mode())
+
+    def user_agent(self) -> str:
+        return (
+            f"{requests.utils.default_user_agent()} (Active Boxes/{__version__};"
+            " +http://github.com/tsileo/little-boxes)"
+        )
+
+    def random_object_id(self) -> str:
+        """Generates a random object ID."""
+        return binascii.hexlify(os.urandom(8)).decode("utf-8")
+
+    def fetch_json(self, url: str, **kwargs):
+        self.check_url(url)
+        resp = requests.get(
+            url,
+            headers={"User-Agent": self.user_agent(), "Accept": "application/json"},
+            **kwargs,
+            timeout=15,
+            allow_redirects=True,
+        )
+
+        resp.raise_for_status()
+
+        return resp
+
+    def parse_collection(
+        self, payload: Optional[Dict[str, Any]] = None, url: Optional[str] = None
+    ) -> List[str]:
+        return parse_collection(payload=payload, url=url, fetcher=self.fetch_iri)
+
+    def extra_inboxes(self) -> List[str]:
+        """Allows to define inboxes that will be part of of the recipient for every activity."""
+        return []
+
+    def is_from_outbox(
+        self, as_actor: "ap.Person", activity: "ap.BaseActivity"
+    ) -> bool:
+        return activity.get_actor().id == as_actor.id
+
+    @abc.abstractmethod
+    def base_url(self) -> str:
+        pass  # pragma: no cover
+
+    def fetch_iri(self, iri: str, **kwargs) -> "ap.ObjectType":  # pragma: no cover
+        if not iri.startswith("http"):
+            raise NotAnActivityError(f"{iri} is not a valid IRI")
+
+        try:
+            self.check_url(iri)
+        except URLLookupFailedError:
+            # The IRI is inaccessible
+            raise ActivityUnavailableError(f"unable to fetch {iri}, url lookup failed")
+
+        try:
+            resp = requests.get(
+                iri,
+                headers={
+                    "User-Agent": self.user_agent(),
+                    "Accept": "application/activity+json",
+                },
+                timeout=15,
+                allow_redirects=False,
+                **kwargs,
+            )
+        except (
+            requests.exceptions.ConnectTimeout,
+            requests.exceptions.ReadTimeout,
+            requests.exceptions.ConnectionError,
+        ):
+            raise ActivityUnavailableError(f"unable to fetch {iri}, connection error")
+        if resp.status_code == 404:
+            raise ActivityNotFoundError(f"{iri} is not found")
+        elif resp.status_code == 410:
+            raise ActivityGoneError(f"{iri} is gone")
+        elif resp.status_code in [500, 502, 503]:
+            raise ActivityUnavailableError(
+                f"unable to fetch {iri}, server error ({resp.status_code})"
+            )
+
+        resp.raise_for_status()
+
+        try:
+            out = resp.json()
+        except (json.JSONDecodeError, ValueError):
+            # TODO(tsileo): a special error type?
+            raise NotAnActivityError(f"{iri} is not JSON")
+
+        return out
+
+    @abc.abstractmethod
+    def activity_url(self, obj_id: str) -> str:
+        pass  # pragma: no cover
+
+    @abc.abstractmethod
+    def note_url(self, obj_id: str) -> str:
+        pass  # pragma: no cover

active_boxes/collection.py

@@ -0,0 +1,70 @@
+"""Collection releated utils."""
+from typing import Any
+from typing import Callable
+from typing import Dict
+from typing import List
+from typing import Optional
+
+from .errors import RecursionLimitExceededError
+from .errors import UnexpectedActivityTypeError
+
+
+def parse_collection(  # noqa: C901
+    payload: Optional[Dict[str, Any]] = None,
+    url: Optional[str] = None,
+    level: int = 0,
+    fetcher: Optional[Callable[[str], Dict[str, Any]]] = None,
+) -> List[Any]:
+    """Resolve/fetch a `Collection`/`OrderedCollection`."""
+    if not fetcher:
+        raise Exception("must provide a fetcher")
+    if level > 3:
+        raise RecursionLimitExceededError("recursion limit exceeded")
+
+    # Go through all the pages
+    out: List[Any] = []
+    if url:
+        payload = fetcher(url)
+    if not payload:
+        raise ValueError("must at least prove a payload or an URL")
+
+    if payload["type"] in ["Collection", "OrderedCollection"]:
+        if "orderedItems" in payload:
+            return payload["orderedItems"]
+        if "items" in payload:
+            return payload["items"]
+        if "first" in payload:
+            if isinstance(payload["first"], str):
+                out.extend(
+                    parse_collection(
+                        url=payload["first"], level=level + 1, fetcher=fetcher
+                    )
+                )
+            else:
+                if "orderedItems" in payload["first"]:
+                    out.extend(payload["first"]["orderedItems"])
+                if "items" in payload["first"]:
+                    out.extend(payload["first"]["items"])
+                n = payload["first"].get("next")
+                if n:
+                    out.extend(
+                        parse_collection(url=n, level=level + 1, fetcher=fetcher)
+                    )
+        return out
+
+    while payload:
+        if payload["type"] in ["CollectionPage", "OrderedCollectionPage"]:
+            if "orderedItems" in payload:
+                out.extend(payload["orderedItems"])
+            if "items" in payload:
+                out.extend(payload["items"])
+            n = payload.get("next")
+            if n is None:
+                break
+            payload = fetcher(n)
+        else:
+            raise UnexpectedActivityTypeError(
+                "unexpected activity type {}".format(payload["type"])
+            )
+
+    return out

active_boxes/content_helper.py

@@ -0,0 +1,69 @@
+from typing import Dict
+from typing import List
+from typing import Tuple
+
+from markdown import markdown
+
+import regex as re
+
+from .activitypub import get_backend
+from .webfinger import get_actor_url
+
+
+def _set_attrs(attrs, new=False):
+    attrs[(None, "target")] = "_blank"
+    attrs[(None, "class")] = "external"
+    attrs[(None, "rel")] = "noopener"
+    attrs[(None, "title")] = attrs[(None, "href")]
+    return attrs
+
+
+HASHTAG_REGEX = re.compile(r"(#[\d\w]+)")
+MENTION_REGEX = re.compile(r"@[\d\w_.+-]+@[\d\w-]+\.[\d\w\-.]+")
+
+
+def hashtagify(content: str) -> Tuple[str, List[Dict[str, str]]]:
+    base_url = get_backend().base_url()
+    tags = []
+    hashtags = re.findall(HASHTAG_REGEX, content)
+    hashtags = list(set(hashtags))  # unique tags
+    hashtags.sort()
+    hashtags.reverse()  # replace longest tag first
+    for hashtag in hashtags:
+        tag = hashtag[1:]
+        link = f'<a href="{base_url}/tags/{tag}" class="mention hashtag" rel="tag">#<span>{tag}</span></a>'
+        tags.append(dict(href=f"{base_url}/tags/{tag}", name=hashtag, type="Hashtag"))
+        content = content.replace(hashtag, link)
+    return content, tags
+
+
+def mentionify(
+    content: str, hide_domain: bool = False
+) -> Tuple[str, List[Dict[str, str]]]:
+    tags = []
+    for mention in re.findall(MENTION_REGEX, content):
+        _, username, domain = mention.split("@")
+        actor_url = get_actor_url(mention)
+        if not actor_url:
+            # FIXME(tsileo): raise an error?
+            continue
+        p = get_backend().fetch_iri(actor_url)
+        tags.append(dict(type="Mention", href=p["id"], name=mention))
+
+        d = f"@{domain}"
+        if hide_domain:
+            d = ""
+
+        link = f'<span class="h-card"><a href="{p["url"]}" class="u-url mention">@<span>{username}</span>{d}</a></span>'
+        content = content.replace(mention, link)
+    return content, tags
+
+
+def parse_markdown(content: str) -> Tuple[str, List[Dict[str, str]]]:
+    tags = []
+    content, hashtag_tags = hashtagify(content)
+    tags.extend(hashtag_tags)
+    content, mention_tags = mentionify(content)
+    tags.extend(mention_tags)
+    content = markdown(content, extensions=["mdx_linkify"])
+    return content, tags

active_boxes/errors.py

@@ -0,0 +1,92 @@
+"""Errors raised by this package."""
+from typing import Any
+from typing import Dict
+from typing import Optional
+
+
+class Error(Exception):
+    """Base error for exceptions raised by this package."""
+
+
+class DropActivityPreProcessError(Error):
+    """Raised in `_pre_process_from_inbox` to notify that we don't want to save the message.
+
+    (like when receiving `Announce` with an OStatus link).
+    """
+
+
+class ServerError(Error):
+    """HTTP-friendly base error, with a status code, a message and an optional payload."""
+
+    status_code = 400
+
+    def __init__(
+        self,
+        message: str,
+        status_code: Optional[int] = None,
+        payload: Optional[Dict[str, Any]] = None,
+    ) -> None:
+        Exception.__init__(self)
+        self.message = message
+        if status_code is not None:
+            self.status_code = status_code
+        self.payload = payload
+
+    def to_dict(self) -> Dict[str, Any]:
+        rv = dict(self.payload or {})
+        rv["message"] = self.message
+        return rv
+
+    def __repr__(self) -> str:  # pragma: no cover
+        return (
+            f"{self.__class__.__qualname__}({self.message!r}, "
+            f"payload={self.payload!r}, status_code={self.status_code})"
+        )
+
+    def __str__(self) -> str:  # pragma: no cover
+        return self.__repr__()
+
+
+class ActorBlockedError(ServerError):
+    """Raised when an activity from a blocked actor is received."""
+
+
+class NotFromOutboxError(ServerError):
+    """Raised when an activity targets an object from the inbox when an object from the oubox was expected."""
+
+
+class ActivityNotFoundError(ServerError):
+    """Raised when an activity is not found."""
+
+    status_code = 404
+
+
+class ActivityGoneError(ServerError):
+    """Raised when trying to fetch a remote activity that was deleted."""
+
+    status_code = 410
+
+
+class BadActivityError(ServerError):
+    """Raised when an activity could not be parsed/initialized."""
+
+
+class RecursionLimitExceededError(BadActivityError):
+    """Raised when the recursion limit for fetching remote object was exceeded (likely a collection)."""
+
+
+class UnexpectedActivityTypeError(BadActivityError):
+    """Raised when an another activty was expected."""
+
+
+class ActivityUnavailableError(ServerError):
+    """Raises when fetching a remote activity times out."""
+
+    status_code = 503
+
+
+class NotAnActivityError(ServerError):
+    """Raised when no JSON can be decoded.
+
+    Most likely raised when stumbling upon a OStatus notice or failed lookup.
+    """

active_boxes/httpsig.py

@@ -0,0 +1,145 @@
+"""Implements HTTP signature for Flask requests.
+
+Mastodon instances won't accept requests that are not signed using this scheme.
+
+"""
+import base64
+import hashlib
+import logging
+from datetime import datetime
+from typing import Any
+from typing import Dict
+from typing import Optional
+from urllib.parse import urlparse
+
+from Crypto.Hash import SHA256
+from Crypto.Signature import PKCS1_v1_5
+from requests.auth import AuthBase
+
+from .activitypub import get_backend
+from .activitypub import _has_type
+from .errors import ActivityNotFoundError
+from .errors import ActivityGoneError
+from .key import Key
+
+logger = logging.getLogger(__name__)
+
+
+def _build_signed_string(
+    signed_headers: str, method: str, path: str, headers: Any, body_digest: str
+) -> str:
+    out = []
+    for signed_header in signed_headers.split(" "):
+        if signed_header == "(request-target)":
+            out.append("(request-target): " + method.lower() + " " + path)
+        elif signed_header == "digest":
+            out.append("digest: " + body_digest)
+        else:
+            out.append(signed_header + ": " + headers[signed_header])
+    return "\n".join(out)
+
+
+def _parse_sig_header(val: Optional[str]) -> Optional[Dict[str, str]]:
+    if not val:
+        return None
+    out = {}
+    for data in val.split(","):
+        k, v = data.split("=", 1)
+        out[k] = v[1 : len(v) - 1]  # noqa: black conflict
+    return out
+
+
+def _verify_h(signed_string, signature, pubkey):
+    signer = PKCS1_v1_5.new(pubkey)
+    digest = SHA256.new()
+    digest.update(signed_string.encode("utf-8"))
+    return signer.verify(digest, signature)
+
+
+def _body_digest(body: str) -> str:
+    h = hashlib.new("sha256")
+    h.update(body)  # type: ignore
+    return "SHA-256=" + base64.b64encode(h.digest()).decode("utf-8")
+
+
+def _get_public_key(key_id: str) -> Key:
+    actor = get_backend().fetch_iri(key_id)
+    if _has_type(actor["type"], "Key"):
+        # The Key is not embedded in the Person
+        k = Key(actor["owner"], actor["id"])
+        k.load_pub(actor["publicKeyPem"])
+    else:
+        k = Key(actor["id"], actor["publicKey"]["id"])
+        k.load_pub(actor["publicKey"]["publicKeyPem"])
+
+    # Ensure the right key was fetch
+    if key_id != k.key_id():
+        raise ValueError(
+            f"failed to fetch requested key {key_id}: got {actor['publicKey']['id']}"
+        )
+
+    return k
+
+
+def verify_request(method: str, path: str, headers: Any, body: str) -> bool:
+    hsig = _parse_sig_header(headers.get("Signature"))
+    if not hsig:
+        logger.debug("no signature in header")
+        return False
+    logger.debug(f"hsig={hsig}")
+    signed_string = _build_signed_string(
+        hsig["headers"], method, path, headers, _body_digest(body)
+    )
+
+    try:
+        k = _get_public_key(hsig["keyId"])
+    except (ActivityGoneError, ActivityNotFoundError):
+        logger.debug("cannot get public key")
+        return False
+
+    return _verify_h(signed_string, base64.b64decode(hsig["signature"]), k.pubkey)
+
+
+class HTTPSigAuth(AuthBase):
+    """Requests auth plugin for signing requests on the fly."""
+
+    def __init__(self, key: Key) -> None:
+        self.key = key
+
+    def __call__(self, r):
+        logger.info(f"keyid={self.key.key_id()}")
+        host = urlparse(r.url).netloc
+
+        bh = hashlib.new("sha256")
+        body = r.body
+        try:
+            body = r.body.encode("utf-8")
+        except AttributeError:
+            pass
+        bh.update(body)
+        bodydigest = "SHA-256=" + base64.b64encode(bh.digest()).decode("utf-8")
+
+        date = datetime.utcnow().strftime("%a, %d %b %Y %H:%M:%S GMT")
+
+        r.headers.update({"Digest": bodydigest, "Date": date, "Host": host})
+
+        sigheaders = "(request-target) user-agent host date digest content-type"
+
+        to_be_signed = _build_signed_string(
+            sigheaders, r.method, r.path_url, r.headers, bodydigest
+        )
+        signer = PKCS1_v1_5.new(self.key.privkey)
+        digest = SHA256.new()
+        digest.update(to_be_signed.encode("utf-8"))
+        sig = base64.b64encode(signer.sign(digest))
+        sig = sig.decode("utf-8")
+
+        key_id = self.key.key_id()
+        headers = {
+            "Signature": f'keyId="{key_id}",algorithm="rsa-sha256",headers="{sigheaders}",signature="{sig}"'
+        }
+        logger.debug(f"signed request headers={headers}")
+
+        r.headers.update(headers)
+
+        return r

active_boxes/key.py

@@ -0,0 +1,63 @@
+import base64
+from typing import Any
+from typing import Dict
+from typing import Optional
+
+from Crypto.PublicKey import RSA
+from Crypto.Util import number
+
+
+class Key(object):
+    DEFAULT_KEY_SIZE = 2048
+
+    def __init__(self, owner: str, id_: Optional[str] = None) -> None:
+        self.owner = owner
+        self.privkey_pem: Optional[str] = None
+        self.pubkey_pem: Optional[str] = None
+        self.privkey: Optional[RSA.RsaKey] = None
+        self.pubkey: Optional[RSA.RsaKey] = None
+        self.id_ = id_
+
+    def load_pub(self, pubkey_pem: str) -> None:
+        self.pubkey_pem = pubkey_pem
+        self.pubkey = RSA.importKey(pubkey_pem)
+
+    def load(self, privkey_pem: str) -> None:
+        self.privkey_pem = privkey_pem
+        self.privkey = RSA.importKey(self.privkey_pem)
+        self.pubkey_pem = self.privkey.publickey().exportKey("PEM").decode("utf-8")
+
+    def new(self) -> None:
+        k = RSA.generate(self.DEFAULT_KEY_SIZE)
+        self.privkey_pem = k.exportKey("PEM").decode("utf-8")
+        self.pubkey_pem = k.publickey().exportKey("PEM").decode("utf-8")
+        self.privkey = k
+
+    def key_id(self) -> str:
+        return self.id_ or f"{self.owner}#main-key"
+
+    def to_dict(self) -> Dict[str, Any]:
+        return {
+            "id": self.key_id(),
+            "owner": self.owner,
+            "publicKeyPem": self.pubkey_pem,
+            "type": "Key",
+        }
+
+    @classmethod
+    def from_dict(cls, data):
+        try:
+            k = cls(data["owner"], data["id"])
+            k.load_pub(data["publicKeyPem"])
+        except KeyError:
+            raise ValueError(f"bad key data {data!r}")
+        return k
+
+    def to_magic_key(self) -> str:
+        mod = base64.urlsafe_b64encode(
+            number.long_to_bytes(self.privkey.n)  # type: ignore
+        ).decode("utf-8")
+        pubexp = base64.urlsafe_b64encode(
+            number.long_to_bytes(self.privkey.e)  # type: ignore
+        ).decode("utf-8")
+        return f"data:application/magic-public-key,RSA.{mod}.{pubexp}"

active_boxes/linked_data_sig.py

@@ -0,0 +1,83 @@
+import base64
+import hashlib
+import typing
+from datetime import datetime
+from typing import Any
+from typing import Dict
+
+from Crypto.Hash import SHA256
+from Crypto.Signature import PKCS1_v1_5
+from pyld import jsonld
+
+if typing.TYPE_CHECKING:
+    from .key import Key  # noqa: type checking
+
+
+# cache the downloaded "schemas", otherwise the library is super slow
+# (https://github.com/digitalbazaar/pyld/issues/70)
+_CACHE: Dict[str, Any] = {}
+LOADER = jsonld.requests_document_loader()
+
+
+def _caching_document_loader(url: str) -> Any:
+    if url in _CACHE:
+        return _CACHE[url]
+    resp = LOADER(url)
+    _CACHE[url] = resp
+    return resp
+
+
+jsonld.set_document_loader(_caching_document_loader)
+
+
+def _options_hash(doc):
+    doc = dict(doc["signature"])
+    for k in ["type", "id", "signatureValue"]:
+        if k in doc:
+            del doc[k]
+    doc["@context"] = "https://w3id.org/identity/v1"
+    normalized = jsonld.normalize(
+        doc, {"algorithm": "URDNA2015", "format": "application/nquads"}
+    )
+    h = hashlib.new("sha256")
+    h.update(normalized.encode("utf-8"))
+    return h.hexdigest()
+
+
+def _doc_hash(doc):
+    doc = dict(doc)
+    if "signature" in doc:
+        del doc["signature"]
+    normalized = jsonld.normalize(
+        doc, {"algorithm": "URDNA2015", "format": "application/nquads"}
+    )
+    h = hashlib.new("sha256")
+    h.update(normalized.encode("utf-8"))
+    return h.hexdigest()
+
+
+def verify_signature(doc, key: "Key"):
+    to_be_signed = _options_hash(doc) + _doc_hash(doc)
+    signature = doc["signature"]["signatureValue"]
+    signer = PKCS1_v1_5.new(key.pubkey or key.privkey)  # type: ignore
+    digest = SHA256.new()
+    digest.update(to_be_signed.encode("utf-8"))
+    return signer.verify(digest, base64.b64decode(signature))  # type: ignore
+
+
+def generate_signature(doc, key: "Key"):
+    options = {
+        "type": "RsaSignature2017",
+        "creator": doc["actor"] + "#main-key",
+        "created": datetime.utcnow().replace(microsecond=0).isoformat() + "Z",
+    }
+    doc["signature"] = options
+    to_be_signed = _options_hash(doc) + _doc_hash(doc)
+    if not key.privkey:
+        raise ValueError(f"missing privkey on key {key!r}")
+
+    signer = PKCS1_v1_5.new(key.privkey)
+    digest = SHA256.new()
+    digest.update(to_be_signed.encode("utf-8"))
+    sig = base64.b64encode(signer.sign(digest))  # type: ignore
+    options["signatureValue"] = sig.decode("utf-8")