Merge pull request #178 from cthulahoops/use_fetch_remote_user

Use fetch_remote_user and key refreshes.
This commit is contained in:
Mouse Reeve 2020-05-23 13:22:22 -07:00 committed by GitHub
commit 6b551709cc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 133 additions and 43 deletions

View file

@ -10,7 +10,7 @@ from django.views.decorators.csrf import csrf_exempt
from fedireads import books_manager, models, outgoing from fedireads import books_manager, models, outgoing
from fedireads import status as status_builder from fedireads import status as status_builder
from fedireads.remote_user import get_or_create_remote_user from fedireads.remote_user import get_or_create_remote_user, refresh_remote_user
from fedireads.tasks import app from fedireads.tasks import app
from fedireads.signatures import Signature from fedireads.signatures import Signature
@ -44,17 +44,11 @@ def shared_inbox(request):
if not activity.get('object'): if not activity.get('object'):
return HttpResponseBadRequest() return HttpResponseBadRequest()
try: if not has_valid_signature(request, activity):
signature = Signature.parse(request) if activity['type'] == 'Delete':
# Pretend that unauth'd deletes succeed. Auth may be failing because
key_actor = urldefrag(signature.key_id).url # the resource or owner of the resource might have been deleted.
if key_actor != activity.get('actor'): return HttpResponse()
raise ValueError("Wrong actor created signature.")
key = get_public_key(key_actor)
signature.verify(key, request)
except ValueError:
return HttpResponse(status=401) return HttpResponse(status=401)
handlers = { handlers = {
@ -89,22 +83,28 @@ def shared_inbox(request):
return HttpResponse() return HttpResponse()
def get_public_key(key_actor): def has_valid_signature(request, activity):
''' try a stored key or load it from remote '''
try: try:
user = models.User.objects.get(remote_id=key_actor) signature = Signature.parse(request)
public_key = user.public_key
except models.User.DoesNotExist: key_actor = urldefrag(signature.key_id).url
response = requests.get( if key_actor != activity.get('actor'):
key_actor, raise ValueError("Wrong actor created signature.")
headers={'Accept': 'application/activity+json'}
) remote_user = get_or_create_remote_user(key_actor)
if not response.ok:
raise ValueError('Could not load public key') try:
user_data = response.json() signature.verify(remote_user.public_key, request)
public_key = user_data['publicKey']['publicKeyPem'] except ValueError:
old_key = remote_user.public_key
refresh_remote_user(remote_user)
if remote_user.public_key == old_key:
raise # Key unchanged.
signature.verify(remote_user.public_key, request)
except (ValueError, requests.exceptions.HTTPError):
return False
return True
return public_key
@app.task @app.task
def handle_follow(activity): def handle_follow(activity):

View file

@ -17,6 +17,23 @@ def get_or_create_remote_user(actor):
except models.User.DoesNotExist: except models.User.DoesNotExist:
pass pass
data = fetch_user_data(actor)
actor_parts = urlparse(actor)
with transaction.atomic():
user = create_remote_user(data)
user.federated_server = get_or_create_remote_server(actor_parts.netloc)
user.save()
avatar = get_avatar(data)
if avatar:
user.avatar.save(*avatar)
if user.fedireads_user:
get_remote_reviews(user)
return user
def fetch_user_data(actor):
# load the user's info from the actor url # load the user's info from the actor url
response = requests.get( response = requests.get(
actor, actor,
@ -27,20 +44,9 @@ def get_or_create_remote_user(actor):
data = response.json() data = response.json()
# make sure our actor is who they say they are # make sure our actor is who they say they are
assert actor == data['id'] if actor != data['id']:
raise ValueError("Remote actor id must match url.")
actor_parts = urlparse(actor) return data
with transaction.atomic():
user = create_remote_user(data)
user.federated_server = get_or_create_remote_server(actor_parts.netloc)
user.save()
avatar = get_avatar(data)
user.avatar.save(*avatar)
if user.fedireads_user:
get_remote_reviews(user)
return user
def create_remote_user(data): def create_remote_user(data):
@ -71,6 +77,24 @@ def create_remote_user(data):
'manuallyApprovesFollowers', False), 'manuallyApprovesFollowers', False),
) )
def refresh_remote_user(user):
data = fetch_user_data(user.remote_id)
shared_inbox = data.get('endpoints').get('sharedInbox') if \
data.get('endpoints') else None
# TODO - I think dataclasses change will mean less repetition here later.
user.name = data.get('name')
user.summary = data.get('summary')
user.inbox = data['inbox'] #fail if there's no inbox
user.outbox = data['outbox'] # fail if there's no outbox
user.shared_inbox = shared_inbox
user.public_key = data.get('publicKey').get('publicKeyPem')
user.local = False
user.fedireads_user = data.get('fedireadsUser', False)
user.manually_approves_followers = data.get(
'manuallyApprovesFollowers', False)
user.save()
def get_avatar(data): def get_avatar(data):
''' find the icon attachment and load the image from the remote sever ''' ''' find the icon attachment and load the image from the remote sever '''

View file

@ -1,6 +1,7 @@
import time import time
from collections import namedtuple from collections import namedtuple
from urllib.parse import urlsplit from urllib.parse import urlsplit
import pathlib
import json import json
import responses import responses
@ -73,17 +74,82 @@ class Signature(TestCase):
@responses.activate @responses.activate
def test_remote_signer(self): def test_remote_signer(self):
datafile = pathlib.Path(__file__).parent.joinpath('data/ap_user.json')
data = json.loads(datafile.read_bytes())
data['id'] = self.fake_remote.remote_id
data['publicKey']['publicKeyPem'] = self.fake_remote.public_key
del data['icon'] # Avoid having to return an avatar.
responses.add( responses.add(
responses.GET, responses.GET,
self.fake_remote.remote_id, self.fake_remote.remote_id,
json={'publicKey': { json=data,
'publicKeyPem': self.fake_remote.public_key
}},
status=200) status=200)
responses.add(
responses.GET,
'https://localhost/.well-known/nodeinfo',
status=404)
responses.add(
responses.GET,
'https://example.com/user/mouse/outbox?page=true',
json={'orderedItems': []},
status=200
)
response = self.send_test_request(sender=self.fake_remote) response = self.send_test_request(sender=self.fake_remote)
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
@responses.activate
def test_key_needs_refresh(self):
datafile = pathlib.Path(__file__).parent.joinpath('data/ap_user.json')
data = json.loads(datafile.read_bytes())
data['id'] = self.fake_remote.remote_id
data['publicKey']['publicKeyPem'] = self.fake_remote.public_key
del data['icon'] # Avoid having to return an avatar.
responses.add(
responses.GET,
self.fake_remote.remote_id,
json=data,
status=200)
responses.add(
responses.GET,
'https://localhost/.well-known/nodeinfo',
status=404)
responses.add(
responses.GET,
'https://example.com/user/mouse/outbox?page=true',
json={'orderedItems': []},
status=200
)
# Second and subsequent fetches get a different key:
new_private_key, new_public_key = create_key_pair()
new_sender = Sender(
self.fake_remote.remote_id, new_private_key, new_public_key)
data['publicKey']['publicKeyPem'] = new_public_key
responses.add(
responses.GET,
self.fake_remote.remote_id,
json=data,
status=200)
# Key correct:
response = self.send_test_request(sender=self.fake_remote)
self.assertEqual(response.status_code, 200)
# Old key is cached, so still works:
response = self.send_test_request(sender=self.fake_remote)
self.assertEqual(response.status_code, 200)
# Try with new key:
response = self.send_test_request(sender=new_sender)
self.assertEqual(response.status_code, 200)
# Now the old key will fail:
response = self.send_test_request(sender=self.fake_remote)
self.assertEqual(response.status_code, 401)
@responses.activate @responses.activate
def test_nonexistent_signer(self): def test_nonexistent_signer(self):
responses.add( responses.add(