diff --git a/routers/api/v1/activitypub/reqsignature.go b/routers/api/v1/activitypub/reqsignature.go index 3ced5ea60d..fd6d6520c3 100644 --- a/routers/api/v1/activitypub/reqsignature.go +++ b/routers/api/v1/activitypub/reqsignature.go @@ -14,7 +14,7 @@ import ( "github.com/42wim/httpsig" ) -func verifyHTTPUserOrInstanceSignature(ctx app_context.APIContext) (authenticated bool, err error) { +func verifyHTTPSignature(ctx app_context.APIContext) (authenticated bool, err error) { if !setting.Federation.SignatureEnforced { return true, nil } @@ -43,49 +43,11 @@ func verifyHTTPUserOrInstanceSignature(ctx app_context.APIContext) (authenticate return true, nil } -func verifyHTTPUserSignature(ctx app_context.APIContext) (authenticated bool, err error) { - if !setting.Federation.SignatureEnforced { - return true, nil - } - - r := ctx.Req - - // 1. Figure out what key we need to verify - v, err := httpsig.NewVerifier(r) - if err != nil { - return false, err - } - - signatureAlgorithm := httpsig.Algorithm(setting.Federation.SignatureAlgorithms[0]) - pubKey, err := federation.FindOrCreateFederatedUserKey(ctx, v.KeyId()) - if err != nil { - return false, err - } - - err = v.Verify(pubKey, signatureAlgorithm) - if err != nil { - return false, err - } - return true, nil -} - // ReqHTTPSignature function -func ReqHTTPUserOrInstanceSignature() func(ctx *app_context.APIContext) { +func ReqHTTPSignature() func(ctx *app_context.APIContext) { return func(ctx *app_context.APIContext) { - if authenticated, err := verifyHTTPUserOrInstanceSignature(*ctx); err != nil { - log.Warn("verifyHttpSignatures failed: %v", err) - ctx.Error(http.StatusBadRequest, "reqSignature", "request signature verification failed") - } else if !authenticated { - ctx.Error(http.StatusForbidden, "reqSignature", "request signature verification failed") - } - } -} - -// ReqHTTPUserSignature function -func ReqHTTPUserSignature() func(ctx *app_context.APIContext) { - return func(ctx *app_context.APIContext) { - if authenticated, err := verifyHTTPUserSignature(*ctx); err != nil { - log.Warn("verifyHttpSignatures failed: %v", err) + if authenticated, err := verifyHTTPSignature(*ctx); err != nil { + log.Warn("verifyHttpSignature failed: %v", err) ctx.Error(http.StatusBadRequest, "reqSignature", "request signature verification failed") } else if !authenticated { ctx.Error(http.StatusForbidden, "reqSignature", "request signature verification failed") diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go index 322469d240..1206d653c1 100644 --- a/routers/api/v1/api.go +++ b/routers/api/v1/api.go @@ -878,29 +878,29 @@ func Routes() *web.Route { m.Get("/nodeinfo", misc.NodeInfo) m.Group("/activitypub", func() { m.Group("/user-id/{user-id}", func() { - m.Get("", activitypub.ReqHTTPUserOrInstanceSignature(), activitypub.Person) + m.Get("", activitypub.ReqHTTPSignature(), activitypub.Person) m.Post("/inbox", - activitypub.ReqHTTPUserSignature(), + activitypub.ReqHTTPSignature(), bind(ap.Activity{}), activitypub.PersonInbox) m.Group("/activities/{activity-id}", func() { m.Get("", activitypub.PersonActivityNote) m.Get("/activity", activitypub.PersonActivity) }) - m.Get("/outbox", activitypub.ReqHTTPUserSignature(), activitypub.PersonFeed) + m.Get("/outbox", activitypub.ReqHTTPSignature(), activitypub.PersonFeed) }, context.UserIDAssignmentAPI(), checkTokenPublicOnly()) m.Group("/actor", func() { m.Get("", activitypub.Actor) - m.Post("/inbox", activitypub.ReqHTTPUserOrInstanceSignature(), activitypub.ActorInbox) + m.Post("/inbox", activitypub.ReqHTTPSignature(), activitypub.ActorInbox) m.Get("/outbox", activitypub.ActorOutbox) }) m.Group("/repository-id/{repository-id}", func() { - m.Get("", activitypub.ReqHTTPUserSignature(), activitypub.Repository) + m.Get("", activitypub.ReqHTTPSignature(), activitypub.Repository) m.Post("/inbox", bind(ap.Activity{}), - activitypub.ReqHTTPUserSignature(), + activitypub.ReqHTTPSignature(), activitypub.RepositoryInbox) - m.Get("/outbox", activitypub.ReqHTTPUserSignature(), activitypub.RepositoryOutbox) + m.Get("/outbox", activitypub.ReqHTTPSignature(), activitypub.RepositoryOutbox) }, context.RepositoryIDAssignmentAPI()) }, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryActivityPub)) }