Rename MobilizonWeb to Mobilizon.Web

lib/web/plugs/federating.ex

@@ -0,0 +1,28 @@
+# Portions of this file are derived from Pleroma:
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Mobilizon.Web.Plugs.Federating do
+  @moduledoc """
+  Restrict ActivityPub routes when not federating
+  """
+
+  import Plug.Conn
+
+  def init(options) do
+    options
+  end
+
+  def call(conn, _opts) do
+    if Mobilizon.Config.get([:instance, :federating]) do
+      conn
+    else
+      conn
+      |> put_status(404)
+      |> Phoenix.Controller.put_view(Mobilizon.Web.ErrorView)
+      |> Phoenix.Controller.render("404.json")
+      |> halt()
+    end
+  end
+end

lib/web/plugs/http_signatures.ex

@@ -0,0 +1,56 @@
+# Portions of this file are derived from Pleroma:
+# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social>
+# SPDX-License-Identifier: AGPL-3.0-only
+# Upstream: https://git.pleroma.social/pleroma/pleroma/blob/develop/lib/pleroma/plugs/http_signature.ex
+
+defmodule Mobilizon.Web.Plugs.HTTPSignatures do
+  @moduledoc """
+  Plug to check HTTP Signatures on every incoming request
+  """
+
+  import Plug.Conn
+
+  require Logger
+
+  def init(options) do
+    options
+  end
+
+  def call(%{assigns: %{valid_signature: true}} = conn, _opts) do
+    conn
+  end
+
+  def call(conn, _opts) do
+    case get_req_header(conn, "signature") do
+      [signature | _] ->
+        if signature do
+          # set (request-target) header to the appropriate value
+          # we also replace the digest header with the one we computed
+          conn =
+            conn
+            |> put_req_header(
+              "(request-target)",
+              String.downcase("#{conn.method}") <> " #{conn.request_path}"
+            )
+
+          conn =
+            if conn.assigns[:digest] do
+              conn
+              |> put_req_header("digest", conn.assigns[:digest])
+            else
+              conn
+            end
+
+          signature_valid = HTTPSignatures.validate_conn(conn)
+          Logger.debug("Is signature valid ? #{inspect(signature_valid)}")
+          assign(conn, :valid_signature, signature_valid)
+        else
+          Logger.debug("No signature header!")
+          conn
+        end
+
+      _ ->
+        conn
+    end
+  end
+end

lib/web/plugs/mapped_signature_to_identity.ex

@@ -0,0 +1,82 @@
+# Portions of this file are derived from Pleroma:
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Mobilizon.Web.Plugs.MappedSignatureToIdentity do
+  @moduledoc """
+  Get actor identity from Signature when handing fetches
+  """
+
+  import Plug.Conn
+
+  alias Mobilizon.Actors.Actor
+
+  alias Mobilizon.Federation.ActivityPub
+  alias Mobilizon.Federation.ActivityPub.Utils
+  alias Mobilizon.Federation.HTTPSignatures.Signature
+
+  require Logger
+
+  def init(options), do: options
+
+  @spec key_id_from_conn(Plug.Conn.t()) :: String.t() | nil
+  defp key_id_from_conn(conn) do
+    case HTTPSignatures.signature_for_conn(conn) do
+      %{"keyId" => key_id} ->
+        Signature.key_id_to_actor_url(key_id)
+
+      _ ->
+        nil
+    end
+  end
+
+  @spec actor_from_key_id(Plug.Conn.t()) :: Actor.t() | nil
+  defp actor_from_key_id(conn) do
+    with key_actor_id when is_binary(key_actor_id) <- key_id_from_conn(conn),
+         {:ok, %Actor{} = actor} <- ActivityPub.get_or_fetch_actor_by_url(key_actor_id) do
+      actor
+    else
+      _ ->
+        nil
+    end
+  end
+
+  def call(%{assigns: %{actor: _}} = conn, _opts), do: conn
+
+  # if this has payload make sure it is signed by the same actor that made it
+  def call(%{assigns: %{valid_signature: true}, params: %{"actor" => actor}} = conn, _opts) do
+    with actor_id <- Utils.get_url(actor),
+         {:actor, %Actor{} = actor} <- {:actor, actor_from_key_id(conn)},
+         {:actor_match, true} <- {:actor_match, actor.url == actor_id} do
+      assign(conn, :actor, actor)
+    else
+      {:actor_match, false} ->
+        Logger.debug("Failed to map identity from signature (payload actor mismatch)")
+        Logger.debug("key_id=#{key_id_from_conn(conn)}, actor=#{actor}")
+        assign(conn, :valid_signature, false)
+
+      # remove me once testsuite uses mapped capabilities instead of what we do now
+      {:actor, nil} ->
+        Logger.debug("Failed to map identity from signature (lookup failure)")
+        Logger.debug("key_id=#{key_id_from_conn(conn)}, actor=#{actor}")
+        conn
+    end
+  end
+
+  # no payload, probably a signed fetch
+  def call(%{assigns: %{valid_signature: true}} = conn, _opts) do
+    case actor_from_key_id(conn) do
+      %Actor{} = actor ->
+        assign(conn, :actor, actor)
+
+      _ ->
+        Logger.debug("Failed to map identity from signature (no payload actor mismatch)")
+        Logger.debug("key_id=#{key_id_from_conn(conn)}")
+        assign(conn, :valid_signature, false)
+    end
+  end
+
+  # no signature at all
+  def call(conn, _opts), do: conn
+end

lib/web/plugs/uploaded_media.ex

@@ -0,0 +1,95 @@
+# Portions of this file are derived from Pleroma:
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+# Upstream: https://git.pleroma.social/pleroma/pleroma/blob/develop/lib/pleroma/plugs/uploaded_media.ex
+
+defmodule Mobilizon.Web.Plugs.UploadedMedia do
+  @moduledoc """
+  Serves uploaded media files
+  """
+
+  @behaviour Plug
+
+  import Plug.Conn
+
+  alias Mobilizon.Config
+
+  require Logger
+
+  # no slashes
+  @path "media"
+
+  def init(_opts) do
+    static_plug_opts =
+      []
+      |> Keyword.put(:from, "__unconfigured_media_plug")
+      |> Keyword.put(:at, "/__unconfigured_media_plug")
+      |> Plug.Static.init()
+
+    %{static_plug_opts: static_plug_opts}
+  end
+
+  def call(%{request_path: <<"/", @path, "/", file::binary>>} = conn, opts) do
+    conn =
+      case fetch_query_params(conn) do
+        %{query_params: %{"name" => name}} = conn ->
+          name = String.replace(name, "\"", "\\\"")
+
+          put_resp_header(conn, "content-disposition", "filename=\"#{name}\"")
+
+        conn ->
+          conn
+      end
+
+    config = Config.get([Mobilizon.Web.Upload])
+
+    with uploader <- Keyword.fetch!(config, :uploader),
+         proxy_remote = Keyword.get(config, :proxy_remote, false),
+         {:ok, get_method} <- uploader.get_file(file) do
+      get_media(conn, get_method, proxy_remote, opts)
+    else
+      _ ->
+        conn
+        |> send_resp(500, "Failed")
+        |> halt()
+    end
+  end
+
+  def call(conn, _opts), do: conn
+
+  defp get_media(conn, {:static_dir, directory}, _, opts) do
+    static_opts =
+      opts
+      |> Map.get(:static_plug_opts)
+      |> Map.put(:at, [@path])
+      |> Map.put(:from, directory)
+
+    conn = Plug.Static.call(conn, static_opts)
+
+    if conn.halted do
+      conn
+    else
+      conn
+      |> send_resp(404, "Not found")
+      |> halt()
+    end
+  end
+
+  defp get_media(conn, {:url, url}, true, _) do
+    Mobilizon.Web.ReverseProxy.call(conn, url, Config.get([Mobilizon.Upload, :proxy_opts], []))
+  end
+
+  defp get_media(conn, {:url, url}, _, _) do
+    conn
+    |> Phoenix.Controller.redirect(external: url)
+    |> halt()
+  end
+
+  defp get_media(conn, unknown, _, _) do
+    Logger.error("#{__MODULE__}: Unknown get startegy: #{inspect(unknown)}")
+
+    conn
+    |> send_resp(500, "Internal Error")
+    |> halt()
+  end
+end