mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2025-07-07 09:55:41 +02:00
Some checks are pending
/ release (push) Waiting to run
testing-integration / test-unit (push) Waiting to run
testing-integration / test-sqlite (push) Waiting to run
testing / backend-checks (push) Waiting to run
testing / frontend-checks (push) Waiting to run
testing / test-unit (push) Blocked by required conditions
testing / test-e2e (push) Blocked by required conditions
testing / test-remote-cacher (redis) (push) Blocked by required conditions
testing / test-remote-cacher (valkey) (push) Blocked by required conditions
testing / test-remote-cacher (garnet) (push) Blocked by required conditions
testing / test-remote-cacher (redict) (push) Blocked by required conditions
testing / test-mysql (push) Blocked by required conditions
testing / test-pgsql (push) Blocked by required conditions
testing / test-sqlite (push) Blocked by required conditions
testing / security-check (push) Blocked by required conditions
This PR is part of https://codeberg.org/forgejo/forgejo/pulls/4767 It improves the signature handling: 1. move logic to a service (might be used from other services as well) 2. make a clear difference between ` ReqHTTPUserSignature` and `ReqHTTPUserOrInstanceSignature` 3. improve test ability (activitypub/client & distant_federation_server_mock Adjust instance actor 1. name & 2. webfinger ## Strategy for next PRs is Integration tests are in the driving seat. I will step by step add integration tests form original PR and add code required by the integration test changes. ## Meta Proposal howto process large PRs can be discussed here: https://codeberg.org/forgejo-contrib/federation/pulls/37 Current state with rendered diagrams can be found here: https://codeberg.org/meissa/federation/src/branch/merge-large-pr/doc/merge-large-pr.md Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8275 Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org> Co-authored-by: Michael Jerger <michael.jerger@meissa-gmbh.de> Co-committed-by: Michael Jerger <michael.jerger@meissa-gmbh.de>
239 lines
6.1 KiB
Go
239 lines
6.1 KiB
Go
// Copyright 2024, 2025 The Forgejo Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package federation
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"fmt"
|
|
"net/url"
|
|
"strings"
|
|
|
|
"forgejo.org/models/forgefed"
|
|
"forgejo.org/models/user"
|
|
"forgejo.org/modules/activitypub"
|
|
"forgejo.org/modules/auth/password"
|
|
fm "forgejo.org/modules/forgefed"
|
|
"forgejo.org/modules/log"
|
|
"forgejo.org/modules/setting"
|
|
"forgejo.org/modules/validation"
|
|
context_service "forgejo.org/services/context"
|
|
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
func Init() error {
|
|
return nil
|
|
}
|
|
|
|
func FindOrCreateFederationHost(ctx *context_service.Base, actorURI string) (*forgefed.FederationHost, error) {
|
|
rawActorID, err := fm.NewActorID(actorURI)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
federationHost, err := forgefed.FindFederationHostByFqdnAndPort(ctx, rawActorID.Host, rawActorID.HostPort)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if federationHost == nil {
|
|
result, err := createFederationHostFromAP(ctx, rawActorID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
federationHost = result
|
|
}
|
|
return federationHost, nil
|
|
}
|
|
|
|
func FindOrCreateFederatedUser(ctx *context_service.Base, actorURI string) (*user.User, *user.FederatedUser, *forgefed.FederationHost, error) {
|
|
user, federatedUser, federationHost, err := findFederatedUser(ctx, actorURI)
|
|
if err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
personID, err := fm.NewPersonID(actorURI, string(federationHost.NodeInfo.SoftwareName))
|
|
if err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
|
|
if user != nil {
|
|
log.Trace("Found local federatedUser: %#v", user)
|
|
} else {
|
|
user, federatedUser, err = createUserFromAP(ctx, personID, federationHost.ID)
|
|
if err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
log.Trace("Created federatedUser from ap: %#v", user)
|
|
}
|
|
log.Trace("Got user: %v", user.Name)
|
|
|
|
return user, federatedUser, federationHost, nil
|
|
}
|
|
|
|
func findFederatedUser(ctx *context_service.Base, actorURI string) (*user.User, *user.FederatedUser, *forgefed.FederationHost, error) {
|
|
federationHost, err := FindOrCreateFederationHost(ctx, actorURI)
|
|
if err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
actorID, err := fm.NewPersonID(actorURI, string(federationHost.NodeInfo.SoftwareName))
|
|
if err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
|
|
user, federatedUser, err := user.FindFederatedUser(ctx, actorID.ID, federationHost.ID)
|
|
if err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
|
|
return user, federatedUser, federationHost, nil
|
|
}
|
|
|
|
func createFederationHostFromAP(ctx context.Context, actorID fm.ActorID) (*forgefed.FederationHost, error) {
|
|
actionsUser := user.NewAPServerActor()
|
|
clientFactory, err := activitypub.GetClientFactory(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
client, err := clientFactory.WithKeys(ctx, actionsUser, actionsUser.KeyID())
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
body, err := client.GetBody(actorID.AsWellKnownNodeInfoURI())
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
nodeInfoWellKnown, err := forgefed.NewNodeInfoWellKnown(body)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
body, err = client.GetBody(nodeInfoWellKnown.Href)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
nodeInfo, err := forgefed.NewNodeInfo(body)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// TODO: we should get key material here also to have it immediately
|
|
result, err := forgefed.NewFederationHost(actorID.Host, nodeInfo, actorID.HostPort, actorID.HostSchema)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
err = forgefed.CreateFederationHost(ctx, &result)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &result, nil
|
|
}
|
|
|
|
func fetchUserFromAP(ctx context.Context, personID fm.PersonID, federationHostID int64) (*user.User, *user.FederatedUser, error) {
|
|
actionsUser := user.NewAPServerActor()
|
|
clientFactory, err := activitypub.GetClientFactory(ctx)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
apClient, err := clientFactory.WithKeys(ctx, actionsUser, actionsUser.KeyID())
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
body, err := apClient.GetBody(personID.AsURI())
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
person := fm.ForgePerson{}
|
|
err = person.UnmarshalJSON(body)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
if res, err := validation.IsValid(person); !res {
|
|
return nil, nil, err
|
|
}
|
|
|
|
log.Info("Fetched valid person:%q", person)
|
|
|
|
localFqdn, err := url.ParseRequestURI(setting.AppURL)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
email := fmt.Sprintf("f%v@%v", uuid.New().String(), localFqdn.Hostname())
|
|
loginName := personID.AsLoginName()
|
|
name := fmt.Sprintf("%v%v", person.PreferredUsername.String(), personID.HostSuffix())
|
|
fullName := person.Name.String()
|
|
|
|
if len(person.Name) == 0 {
|
|
fullName = name
|
|
}
|
|
|
|
password, err := password.Generate(32)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
inbox, err := url.ParseRequestURI(person.Inbox.GetLink().String())
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
pubKeyBytes, err := decodePublicKeyPem(person.PublicKey.PublicKeyPem)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
newUser := user.User{
|
|
LowerName: strings.ToLower(name),
|
|
Name: name,
|
|
FullName: fullName,
|
|
Email: email,
|
|
EmailNotificationsPreference: "disabled",
|
|
Passwd: password,
|
|
MustChangePassword: false,
|
|
LoginName: loginName,
|
|
Type: user.UserTypeRemoteUser,
|
|
IsAdmin: false,
|
|
}
|
|
|
|
federatedUser := user.FederatedUser{
|
|
ExternalID: personID.ID,
|
|
FederationHostID: federationHostID,
|
|
InboxPath: inbox.Path,
|
|
NormalizedOriginalURL: personID.AsURI(),
|
|
KeyID: sql.NullString{
|
|
String: person.PublicKey.ID.String(),
|
|
Valid: true,
|
|
},
|
|
PublicKey: sql.Null[sql.RawBytes]{
|
|
V: pubKeyBytes,
|
|
Valid: true,
|
|
},
|
|
}
|
|
|
|
log.Info("Fetch federatedUser:%q", federatedUser)
|
|
return &newUser, &federatedUser, nil
|
|
}
|
|
|
|
func createUserFromAP(ctx context.Context, personID fm.PersonID, federationHostID int64) (*user.User, *user.FederatedUser, error) {
|
|
newUser, federatedUser, err := fetchUserFromAP(ctx, personID, federationHostID)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
err = user.CreateFederatedUser(ctx, newUser, federatedUser)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
log.Info("Created federatedUser:%q", federatedUser)
|
|
return newUser, federatedUser, nil
|
|
}
|