diff options
| -rw-r--r-- | tests/conftest.py | 3 | ||||
| -rw-r--r-- | tests/users/views/test_activitypub.py | 22 | ||||
| -rw-r--r-- | users/views/activitypub.py | 13 |
3 files changed, 38 insertions, 0 deletions
diff --git a/tests/conftest.py b/tests/conftest.py index c67717c..283de76 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -92,6 +92,7 @@ def identity(user, domain) -> Identity: """ identity = Identity.objects.create( actor_uri="https://example.com/@test@example.com/", + inbox_uri="https://example.com/@test@example.com/inbox/", username="test", domain=domain, name="Test User", @@ -125,6 +126,7 @@ def other_identity(user, domain) -> Identity: """ identity = Identity.objects.create( actor_uri="https://example.com/@other@example.com/", + inbox_uri="https://example.com/@other@example.com/inbox/", username="other", domain=domain, name="Other User", @@ -143,6 +145,7 @@ def remote_identity() -> Identity: domain = Domain.objects.create(domain="remote.test", local=False) return Identity.objects.create( actor_uri="https://remote.test/test-actor/", + inbox_uri="https://remote.test/@test/inbox/", profile_uri="https://remote.test/@test/", username="test", domain=domain, diff --git a/tests/users/views/test_activitypub.py b/tests/users/views/test_activitypub.py index d9ad578..c6e7faf 100644 --- a/tests/users/views/test_activitypub.py +++ b/tests/users/views/test_activitypub.py @@ -31,3 +31,25 @@ def test_webfinger_system_actor(client): data = client.get("/actor/", HTTP_ACCEPT="application/ld+json").json() assert data["id"] == "https://example.com/actor/" assert data["inbox"] == "https://example.com/actor/inbox/" + + +@pytest.mark.django_db +def test_delete_actor(client, identity): + data = { + "@context": "https://www.w3.org/ns/activitystreams", + "actor": "https://mastodon.social/users/fakec8b6984105c8f15070a2", + "id": "https://mastodon.social/users/fakec8b6984105c8f15070a2#delete", + "object": "https://mastodon.social/users/fakec8b6984105c8f15070a2", + "signature": { + "created": "2022-12-06T03:54:28Z", + "creator": "https://mastodon.social/users/fakec8b6984105c8f15070a2#main-key", + "signatureValue": "This value doesn't matter", + "type": "RsaSignature2017", + }, + "to": ["https://www.w3.org/ns/activitystreams#Public"], + "type": "Delete", + } + resp = client.post( + identity.inbox_uri, data=data, content_type="application/activity+json" + ) + assert resp.status_code == 202 diff --git a/users/views/activitypub.py b/users/views/activitypub.py index b155b08..93a6eae 100644 --- a/users/views/activitypub.py +++ b/users/views/activitypub.py @@ -145,9 +145,21 @@ class Inbox(View): # This ensures that the signature used for the headers matches the actor # described in the payload. identity = Identity.by_actor_uri(document["actor"], create=True, transient=True) + if ( + document["type"] == "Delete" + and document["actor"] == document["object"] + and not identity.pk + ): + # We don't have an Identity record for the user. No-op + exceptions.capture_message( + f"Inbox: Discarded delete message for unknown actor {document['actor']}" + ) + return HttpResponse(status=202) + if not identity.public_key: # See if we can fetch it right now async_to_sync(identity.fetch_actor)() + if not identity.public_key: exceptions.capture_message( f"Inbox error: cannot fetch actor {document['actor']}" @@ -160,6 +172,7 @@ class Inbox(View): f"Inbox: Discarded message from {identity.domain}" ) return HttpResponse(status=202) + # If there's a "signature" payload, verify against that if "signature" in document: try: |