1
1
mirror of https://github.com/kokonect-link/cherrypick synced 2024-12-22 10:38:23 +09:00
cherrypick/packages/backend/src/queue/processors/InboxProcessorService.ts

196 lines
7.5 KiB
TypeScript
Raw Normal View History

2022-09-18 03:27:08 +09:00
import { URL } from 'node:url';
import { Inject, Injectable } from '@nestjs/common';
import { MoreThan } from 'typeorm';
import httpSignature from '@peertube/http-signature';
import { DI } from '@/di-symbols.js';
2022-09-21 05:33:11 +09:00
import type { DriveFilesRepository } from '@/models/index.js';
import type { Config } from '@/config.js';
2022-09-18 03:27:08 +09:00
import type Logger from '@/logger.js';
import { MetaService } from '@/core/MetaService.js';
import { ApRequestService } from '@/core/remote/activitypub/ApRequestService.js';
import { FederatedInstanceService } from '@/core/FederatedInstanceService.js';
import { FetchInstanceMetadataService } from '@/core/FetchInstanceMetadataService.js';
import { Cache } from '@/misc/cache.js';
import type { Instance } from '@/models/entities/Instance.js';
import InstanceChart from '@/core/chart/charts/instance.js';
import ApRequestChart from '@/core/chart/charts/ap-request.js';
import FederationChart from '@/core/chart/charts/federation.js';
import { getApId } from '@/core/remote/activitypub/type.js';
import type { CacheableRemoteUser } from '@/models/entities/User.js';
import type { UserPublickey } from '@/models/entities/UserPublickey.js';
import { ApDbResolverService } from '@/core/remote/activitypub/ApDbResolverService.js';
import { StatusError } from '@/misc/status-error.js';
import { UtilityService } from '@/core/UtilityService.js';
import { ApPersonService } from '@/core/remote/activitypub/models/ApPersonService.js';
import { LdSignatureService } from '@/core/remote/activitypub/LdSignatureService.js';
import { ApInboxService } from '@/core/remote/activitypub/ApInboxService.js';
import { QueueLoggerService } from '../QueueLoggerService.js';
import type Bull from 'bull';
import type { DeliverJobData, InboxJobData } from '../types.js';
// ユーザーのinboxにアクティビティが届いた時の処理
@Injectable()
export class InboxProcessorService {
2022-09-19 03:11:50 +09:00
private logger: Logger;
2022-09-18 03:27:08 +09:00
constructor(
@Inject(DI.config)
private config: Config,
@Inject(DI.instancesRepository)
private instancesRepository: InstancesRepository,
@Inject(DI.driveFilesRepository)
private driveFilesRepository: DriveFilesRepository,
private utilityService: UtilityService,
private metaService: MetaService,
private apInboxService: ApInboxService,
private federatedInstanceService: FederatedInstanceService,
private fetchInstanceMetadataService: FetchInstanceMetadataService,
private ldSignatureService: LdSignatureService,
private apRequestService: ApRequestService,
private apPersonService: ApPersonService,
private apDbResolverService: ApDbResolverService,
private instanceChart: InstanceChart,
private apRequestChart: ApRequestChart,
private federationChart: FederationChart,
private queueLoggerService: QueueLoggerService,
) {
2022-09-19 03:11:50 +09:00
this.logger = this.queueLoggerService.logger.createSubLogger('inbox');
2022-09-18 03:27:08 +09:00
}
public async process(job: Bull.Job<InboxJobData>): Promise<string> {
const signature = job.data.signature; // HTTP-signature
const activity = job.data.activity;
//#region Log
const info = Object.assign({}, activity) as any;
delete info['@context'];
2022-09-19 03:11:50 +09:00
this.logger.debug(JSON.stringify(info, null, 2));
2022-09-18 03:27:08 +09:00
//#endregion
const host = this.utilityService.toPuny(new URL(signature.keyId).hostname);
// ブロックしてたら中断
const meta = await this.metaService.fetch();
if (meta.blockedHosts.includes(host)) {
return `Blocked request: ${host}`;
}
const keyIdLower = signature.keyId.toLowerCase();
if (keyIdLower.startsWith('acct:')) {
return `Old keyId is no longer supported. ${keyIdLower}`;
}
// HTTP-Signature keyIdを元にDBから取得
let authUser: {
user: CacheableRemoteUser;
key: UserPublickey | null;
} | null = await this.apDbResolverService.getAuthUserFromKeyId(signature.keyId);
// keyIdでわからなければ、activity.actorを元にDBから取得 || activity.actorを元にリモートから取得
if (authUser == null) {
try {
authUser = await this.apDbResolverService.getAuthUserFromApId(getApId(activity.actor));
} catch (err) {
// 対象が4xxならスキップ
if (err instanceof StatusError) {
if (err.isClientError) {
return `skip: Ignored deleted actors on both ends ${activity.actor} - ${err.statusCode}`;
}
throw `Error in actor ${activity.actor} - ${err.statusCode ?? err}`;
}
}
}
// それでもわからなければ終了
if (authUser == null) {
return 'skip: failed to resolve user';
}
// publicKey がなくても終了
if (authUser.key == null) {
return 'skip: failed to resolve user publicKey';
}
// HTTP-Signatureの検証
const httpSignatureValidated = httpSignature.verifySignature(signature, authUser.key.keyPem);
// また、signatureのsignerは、activity.actorと一致する必要がある
if (!httpSignatureValidated || authUser.user.uri !== activity.actor) {
// 一致しなくても、でもLD-Signatureがありそうならそっちも見る
if (activity.signature) {
if (activity.signature.type !== 'RsaSignature2017') {
return `skip: unsupported LD-signature type ${activity.signature.type}`;
}
// activity.signature.creator: https://example.oom/users/user#main-key
// みたいになっててUserを引っ張れば公開キーも入ることを期待する
if (activity.signature.creator) {
const candicate = activity.signature.creator.replace(/#.*/, '');
await this.apPersonService.resolvePerson(candicate).catch(() => null);
}
// keyIdからLD-Signatureのユーザーを取得
authUser = await this.apDbResolverService.getAuthUserFromKeyId(activity.signature.creator);
if (authUser == null) {
return 'skip: LD-Signatureのユーザーが取得できませんでした';
}
if (authUser.key == null) {
return 'skip: LD-SignatureのユーザーはpublicKeyを持っていませんでした';
}
// LD-Signature検証
const ldSignature = this.ldSignatureService.use();
const verified = await ldSignature.verifyRsaSignature2017(activity, authUser.key.keyPem).catch(() => false);
if (!verified) {
return 'skip: LD-Signatureの検証に失敗しました';
}
// もう一度actorチェック
if (authUser.user.uri !== activity.actor) {
return `skip: LD-Signature user(${authUser.user.uri}) !== activity.actor(${activity.actor})`;
}
// ブロックしてたら中断
const ldHost = this.utilityService.extractDbHost(authUser.user.uri);
if (meta.blockedHosts.includes(ldHost)) {
return `Blocked request: ${ldHost}`;
}
} else {
return `skip: http-signature verification failed and no LD-Signature. keyId=${signature.keyId}`;
}
}
// activity.idがあればホストが署名者のホストであることを確認する
if (typeof activity.id === 'string') {
const signerHost = this.utilityService.extractDbHost(authUser.user.uri!);
const activityIdHost = this.utilityService.extractDbHost(activity.id);
if (signerHost !== activityIdHost) {
return `skip: signerHost(${signerHost}) !== activity.id host(${activityIdHost}`;
}
}
// Update stats
this.federatedInstanceService.registerOrFetchInstanceDoc(authUser.user.host).then(i => {
this.instancesRepository.update(i.id, {
latestRequestReceivedAt: new Date(),
lastCommunicatedAt: new Date(),
isNotResponding: false,
});
this.fetchInstanceMetadataService.fetchInstanceMetadata(i);
this.instanceChart.requestReceived(i.host);
this.apRequestChart.inbox();
this.federationChart.inbox(i.host);
});
// アクティビティを処理
await this.apInboxService.performActivity(authUser.user, activity);
return 'ok';
}
}