summaryrefslogtreecommitdiffstats
path: root/users
diff options
context:
space:
mode:
Diffstat (limited to 'users')
-rw-r--r--users/apps.py6
-rw-r--r--users/models/__init__.py1
-rw-r--r--users/models/identity.py102
-rw-r--r--users/models/system_actor.py68
-rw-r--r--users/tests/conftest.py51
-rw-r--r--users/tests/models/test_identity.py2
-rw-r--r--users/views/activitypub.py84
-rw-r--r--users/views/identity.py4
8 files changed, 235 insertions, 83 deletions
diff --git a/users/apps.py b/users/apps.py
index 88f7b17..05b5c3f 100644
--- a/users/apps.py
+++ b/users/apps.py
@@ -4,3 +4,9 @@ from django.apps import AppConfig
class UsersConfig(AppConfig):
default_auto_field = "django.db.models.BigAutoField"
name = "users"
+
+ def ready(self) -> None:
+ # Generate the server actor keypair if needed
+ from users.models import SystemActor
+
+ SystemActor.generate_keys_if_needed()
diff --git a/users/models/__init__.py b/users/models/__init__.py
index fc0d402..1c5f519 100644
--- a/users/models/__init__.py
+++ b/users/models/__init__.py
@@ -5,5 +5,6 @@ from .identity import Identity, IdentityStates # noqa
from .inbox_message import InboxMessage, InboxMessageStates # noqa
from .invite import Invite # noqa
from .password_reset import PasswordReset # noqa
+from .system_actor import SystemActor # noqa
from .user import User # noqa
from .user_event import UserEvent # noqa
diff --git a/users/models/identity.py b/users/models/identity.py
index 2190c9c..98e7df9 100644
--- a/users/models/identity.py
+++ b/users/models/identity.py
@@ -5,8 +5,6 @@ from urllib.parse import urlparse
import httpx
import urlman
from asgiref.sync import async_to_sync, sync_to_async
-from cryptography.hazmat.primitives import serialization
-from cryptography.hazmat.primitives.asymmetric import rsa
from django.db import models
from django.template.defaultfilters import linebreaks_filter
from django.templatetags.static import static
@@ -15,9 +13,11 @@ from django.utils import timezone
from core.exceptions import ActorMismatchError
from core.html import sanitize_post
from core.ld import canonicalise, media_type_from_filename
+from core.signatures import RsaKeys
from core.uploads import upload_namer
from stator.models import State, StateField, StateGraph, StatorModel
from users.models.domain import Domain
+from users.models.system_actor import SystemActor
class IdentityStates(StateGraph):
@@ -301,15 +301,16 @@ class Identity(StatorModel):
"""
domain = handle.split("@")[1]
try:
- async with httpx.AsyncClient() as client:
- response = await client.get(
- f"https://{domain}/.well-known/webfinger?resource=acct:{handle}",
- headers={"Accept": "application/json"},
- follow_redirects=True,
- )
+ response = await SystemActor().signed_request(
+ method="get",
+ uri=f"https://{domain}/.well-known/webfinger?resource=acct:{handle}",
+ )
except httpx.RequestError:
return None, None
- if response.status_code >= 400:
+ if response.status_code == 404:
+ # We don't trust this as much as 410 Gone, but skip for now
+ return None, None
+ if response.status_code >= 500:
return None, None
data = response.json()
if data["subject"].startswith("acct:"):
@@ -329,40 +330,39 @@ class Identity(StatorModel):
"""
if self.local:
raise ValueError("Cannot fetch local identities")
- async with httpx.AsyncClient() as client:
- try:
- response = await client.get(
- self.actor_uri,
- headers={"Accept": "application/json"},
- follow_redirects=True,
- )
- except httpx.RequestError:
- return False
- if response.status_code == 410:
- # Their account got deleted, so let's do the same.
- if self.pk:
- await Identity.objects.filter(pk=self.pk).adelete()
- return False
- if response.status_code >= 400:
- return False
- document = canonicalise(response.json(), include_security=True)
- self.name = document.get("name")
- self.profile_uri = document.get("url")
- self.inbox_uri = document.get("inbox")
- self.outbox_uri = document.get("outbox")
- self.summary = document.get("summary")
- self.username = document.get("preferredUsername")
- if self.username and "@value" in self.username:
- self.username = self.username["@value"]
- if self.username:
- self.username = self.username.lower()
- self.manually_approves_followers = document.get(
- "as:manuallyApprovesFollowers"
+ try:
+ response = await SystemActor().signed_request(
+ method="get",
+ uri=self.actor_uri,
)
- self.public_key = document.get("publicKey", {}).get("publicKeyPem")
- self.public_key_id = document.get("publicKey", {}).get("id")
- self.icon_uri = document.get("icon", {}).get("url")
- self.image_uri = document.get("image", {}).get("url")
+ except httpx.RequestError:
+ return False
+ if response.status_code == 410:
+ # Their account got deleted, so let's do the same.
+ if self.pk:
+ await Identity.objects.filter(pk=self.pk).adelete()
+ return False
+ if response.status_code == 404:
+ # We don't trust this as much as 410 Gone, but skip for now
+ return False
+ if response.status_code >= 500:
+ return False
+ document = canonicalise(response.json(), include_security=True)
+ self.name = document.get("name")
+ self.profile_uri = document.get("url")
+ self.inbox_uri = document.get("inbox")
+ self.outbox_uri = document.get("outbox")
+ self.summary = document.get("summary")
+ self.username = document.get("preferredUsername")
+ if self.username and "@value" in self.username:
+ self.username = self.username["@value"]
+ if self.username:
+ self.username = self.username.lower()
+ self.manually_approves_followers = document.get("as:manuallyApprovesFollowers")
+ self.public_key = document.get("publicKey", {}).get("publicKeyPem")
+ self.public_key_id = document.get("publicKey", {}).get("id")
+ self.icon_uri = document.get("icon", {}).get("url")
+ self.image_uri = document.get("image", {}).get("url")
# Now go do webfinger with that info to see if we can get a canonical domain
actor_url_parts = urlparse(self.actor_uri)
get_domain = sync_to_async(Domain.get_remote_domain)
@@ -387,22 +387,6 @@ class Identity(StatorModel):
def generate_keypair(self):
if not self.local:
raise ValueError("Cannot generate keypair for remote user")
- private_key = rsa.generate_private_key(
- public_exponent=65537,
- key_size=2048,
- )
- self.private_key = private_key.private_bytes(
- encoding=serialization.Encoding.PEM,
- format=serialization.PrivateFormat.PKCS8,
- encryption_algorithm=serialization.NoEncryption(),
- ).decode("ascii")
- self.public_key = (
- private_key.public_key()
- .public_bytes(
- encoding=serialization.Encoding.PEM,
- format=serialization.PublicFormat.SubjectPublicKeyInfo,
- )
- .decode("ascii")
- )
+ self.private_key, self.public_key = RsaKeys.generate_keypair()
self.public_key_id = self.actor_uri + "#main-key"
self.save()
diff --git a/users/models/system_actor.py b/users/models/system_actor.py
new file mode 100644
index 0000000..28ef1a8
--- /dev/null
+++ b/users/models/system_actor.py
@@ -0,0 +1,68 @@
+from typing import Dict, Literal, Optional
+
+from django.conf import settings
+
+from core.models import Config
+from core.signatures import HttpSignature, RsaKeys
+
+
+class SystemActor:
+ """
+ Represents the system actor, that we use to sign all HTTP requests
+ that are not on behalf of an Identity.
+
+ Note that this needs Config.system to be set to be initialised.
+ """
+
+ def __init__(self):
+ self.private_key = Config.system.system_actor_private_key
+ self.public_key = Config.system.system_actor_public_key
+ self.actor_uri = f"https://{settings.MAIN_DOMAIN}/actor/"
+ self.public_key_id = self.actor_uri + "#main-key"
+ self.profile_uri = f"https://{settings.MAIN_DOMAIN}/about/"
+ self.username = "__system__"
+
+ def generate_keys(self):
+ self.private_key, self.public_key = RsaKeys.generate_keypair()
+ Config.set_system("system_actor_private_key", self.private_key)
+ Config.set_system("system_actor_public_key", self.public_key)
+
+ @classmethod
+ def generate_keys_if_needed(cls):
+ # Load the system config into the right place
+ Config.system = Config.load_system()
+ instance = cls()
+ if "-----BEGIN" not in instance.private_key:
+ instance.generate_keys()
+
+ def to_ap(self):
+ return {
+ "id": self.actor_uri,
+ "type": "Application",
+ "inbox": self.actor_uri + "/inbox/",
+ "preferredUsername": self.username,
+ "url": self.profile_uri,
+ "as:manuallyApprovesFollowers": True,
+ "publicKey": {
+ "id": self.public_key_id,
+ "owner": self.actor_uri,
+ "publicKeyPem": self.public_key,
+ },
+ }
+
+ async def signed_request(
+ self,
+ method: Literal["get", "post"],
+ uri: str,
+ body: Optional[Dict] = None,
+ ):
+ """
+ Performs a signed request on behalf of the System Actor.
+ """
+ return await HttpSignature.signed_request(
+ method=method,
+ uri=uri,
+ body=body,
+ private_key=self.private_key,
+ key_id=self.public_key_id,
+ )
diff --git a/users/tests/conftest.py b/users/tests/conftest.py
new file mode 100644
index 0000000..e1eeb4b
--- /dev/null
+++ b/users/tests/conftest.py
@@ -0,0 +1,51 @@
+import pytest
+
+from core.models import Config
+
+# Our testing-only keypair
+private_key = """-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCzNJa9JIxQpOtQ
+z8UQKXDPREF9DyBliGu3uPWo6DMnkOm7hoh2+nOryrWDqWOFaVK//n7kltHXUEbm
+U3exh0/0iWfzx2AbNrI04csAvW/hRvHbHBnVTotSxzqTd3ESkpcSW4xVuz9aCcFR
+kW3unSCO3fF0Lh8Jsy9N/CT6oTnwG+ZpeGvHVbh9xfR5Ww6zA7z8A6B17hbzdMd/
+3qUPijyIb5se4cWVtGg/ZJ0X1syn9u9kpwUjhHlyWH/esMRHxPuW49BPZPhhKs1+
+t//4xgZcRX515qFqPS2EtYgZAfh7M3TRv8uCSzL4TT+8ka9IUwKdV6TFaqH27bAG
+KyJQfGaTAgMBAAECggEALZY5qFjlRtiFMfQApdlc5KTw4d7Yt2tqN3zaJUMYTD7d
+boJNMbMJfNCetyT+d6Aw2D1ly0GglNzLhGkEQElzKfpQUt/Lj3CtCa3Mpd4K2Wxi
+NwJhgfUulPqwaHYQchCPVLCsNNziw0VLA7Rymionb6B+/TaEV8PYy0ZSo90ir3UD
+CL5t+IWgIPiy6pk1wGOmeB+tU4+V7/hFel+vPFNahafqVhLE311dfx2aOfweAEfN
+e4JoPeJP1/fB+BVZMyVSAraKz6wheymBBNKKn/vpFsdd6it2AP4UZeFp6ma9wT9t
+nk65IpHg1MBxazQd7621GrPH+ZnhMg62H/FEj6rIDQKBgQC1w1fEbk+zjI54DXU8
+FAe5cJbZS89fMP5CtzlWKzTzfdaavT+5cUYp3XAv37tSGsqYAXxY+4bHGa+qdCQO
+I41cmylWGNX2e29/p2BspDPM6YQ0Z21MxFRBTWvHFrhd0bF1cXKBKPttdkKvzOEP
+6uNy+/QtRNn9xF/ZjaMHcyPPTQKBgQD8ZdOmZ3TMsYJchAjjseN8S+Objw2oZzmK
+6I1ULJBz3DWiyCUfir+pMjSH4fsAf9zrHkiM7xUgMByTukVRt16BrT7TlEBanAxc
+/AKdNB3f0pza829LCz1lMAUn+ngZLTmRR+1rQFXqTjhB+0peJzKiMli+9BBhL9Ry
+jMeTuLHdXwKBgGiz9kL5KIBNX2RYnEfXYfu4l6zktrgnCNB1q1mv2fjJbG4GxkaU
+sc47+Pwa7VUGid22PWMkwSa/7SlLbdmXMT8/QjiOZfJueHQYfrsWe6B2g+mMCrJG
+BiL37jXpKJsiyA7XIxaz/OG5VgDfDGaW8B60dJv/JXPBQ1WW+Wq5MM+hAoGAAUdS
+xykHAnJzwpw4n06rZFnOEV+sJgo/1GBRNvfy02NuMiDpbzt4tRa4BWgzqVD8gYRp
+wa0EYmFcA7OR3lQbenSyOMgre0oHFgGA0eMNs7CRctqA2dR4vyZ7IDS4nwgHnqDK
+pxxwUvuKdWsceVWhgAjZQj5iRtvDK8Fi0XDCFekCgYALTU1v5iMIpaRAe+eyA2B1
+42qm4B/uhXznvOu2YXU6iJFmMgHGYgpa+Dq8uUjKtpn/LIFeX1KN0hH8z/0LW3gB
+e7tN7taW0oLK3RQcEMfkZ7diE9x3LGqo/xMxsZMtxAr88p5eMEU/nxxznOqq+W9b
+qxRbXYzEtHz+cW9+FZkyVw==
+-----END PRIVATE KEY-----"""
+
+public_key = """-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAszSWvSSMUKTrUM/FEClw
+z0RBfQ8gZYhrt7j1qOgzJ5Dpu4aIdvpzq8q1g6ljhWlSv/5+5JbR11BG5lN3sYdP
+9Iln88dgGzayNOHLAL1v4Ubx2xwZ1U6LUsc6k3dxEpKXEluMVbs/WgnBUZFt7p0g
+jt3xdC4fCbMvTfwk+qE58BvmaXhrx1W4fcX0eVsOswO8/AOgde4W83THf96lD4o8
+iG+bHuHFlbRoP2SdF9bMp/bvZKcFI4R5clh/3rDER8T7luPQT2T4YSrNfrf/+MYG
+XEV+deahaj0thLWIGQH4ezN00b/Lgksy+E0/vJGvSFMCnVekxWqh9u2wBisiUHxm
+kwIDAQAB
+-----END PUBLIC KEY-----"""
+
+
+@pytest.fixture
+def config_system(db):
+ Config.system = Config.SystemOptions(
+ system_actor_private_key=private_key, system_actor_public_key=public_key
+ )
+ yield Config.system
diff --git a/users/tests/models/test_identity.py b/users/tests/models/test_identity.py
index 868894a..738abe3 100644
--- a/users/tests/models/test_identity.py
+++ b/users/tests/models/test_identity.py
@@ -96,7 +96,7 @@ def test_identity_max_per_user(client):
@pytest.mark.django_db
-def test_fetch_actor(httpx_mock):
+def test_fetch_actor(httpx_mock, config_system):
"""
Ensures that making identities via actor fetching works
"""
diff --git a/users/views/activitypub.py b/users/views/activitypub.py
index c0fcd98..bb52f8a 100644
--- a/users/views/activitypub.py
+++ b/users/views/activitypub.py
@@ -18,7 +18,7 @@ from core.signatures import (
VerificationFormatError,
)
from takahe import __version__
-from users.models import Identity, InboxMessage
+from users.models import Identity, InboxMessage, SystemActor
from users.shortcuts import by_handle_or_404
@@ -96,28 +96,52 @@ class Webfinger(View):
resource = request.GET.get("resource")
if not resource.startswith("acct:"):
raise Http404("Not an account resource")
- handle = resource[5:].replace("testfedi", "feditest")
- identity = by_handle_or_404(request, handle)
- return JsonResponse(
- {
- "subject": f"acct:{identity.handle}",
- "aliases": [
- str(identity.urls.view_nice),
- ],
- "links": [
- {
- "rel": "http://webfinger.net/rel/profile-page",
- "type": "text/html",
- "href": str(identity.urls.view_nice),
- },
- {
- "rel": "self",
- "type": "application/activity+json",
- "href": identity.actor_uri,
- },
- ],
- }
- )
+ handle = resource[5:]
+ if handle.startswith("__system__@"):
+ # They are trying to webfinger the system actor
+ system_actor = SystemActor()
+ return JsonResponse(
+ {
+ "subject": f"acct:{handle}",
+ "aliases": [
+ system_actor.profile_uri,
+ ],
+ "links": [
+ {
+ "rel": "http://webfinger.net/rel/profile-page",
+ "type": "text/html",
+ "href": system_actor.profile_uri,
+ },
+ {
+ "rel": "self",
+ "type": "application/activity+json",
+ "href": system_actor.actor_uri,
+ },
+ ],
+ }
+ )
+ else:
+ identity = by_handle_or_404(request, handle)
+ return JsonResponse(
+ {
+ "subject": f"acct:{identity.handle}",
+ "aliases": [
+ str(identity.urls.view_nice),
+ ],
+ "links": [
+ {
+ "rel": "http://webfinger.net/rel/profile-page",
+ "type": "text/html",
+ "href": str(identity.urls.view_nice),
+ },
+ {
+ "rel": "self",
+ "type": "application/activity+json",
+ "href": identity.actor_uri,
+ },
+ ],
+ }
+ )
@method_decorator(csrf_exempt, name="dispatch")
@@ -171,3 +195,17 @@ class Inbox(View):
# Hand off the item to be processed by the queue
InboxMessage.objects.create(message=document)
return HttpResponse(status=202)
+
+
+class SystemActorView(View):
+ """
+ Special endpoint for the overall system actor
+ """
+
+ def get(self, request):
+ return JsonResponse(
+ canonicalise(
+ SystemActor().to_ap(),
+ include_security=True,
+ )
+ )
diff --git a/users/views/identity.py b/users/views/identity.py
index 4dae6d5..b96d2eb 100644
--- a/users/views/identity.py
+++ b/users/views/identity.py
@@ -161,6 +161,10 @@ class CreateIdentity(FormView):
raise forms.ValidationError(
"This username is restricted to administrators only."
)
+ if value in ["__system__"]:
+ raise forms.ValidationError(
+ "This username is reserved for system use."
+ )
# Validate it's all ascii characters
for character in value:
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 02:31:06 +0000