| 1 |
<?php |
| 2 |
namespace Activitypub\Rest; |
| 3 |
|
| 4 |
use stdClass; |
| 5 |
use WP_REST_Response; |
| 6 |
use Activitypub\Signature; |
| 7 |
use Activitypub\Model\Application_User; |
| 8 |
|
| 9 |
/** |
| 10 |
* ActivityPub Server REST-Class |
| 11 |
* |
| 12 |
* @author Django Doucet |
| 13 |
* |
| 14 |
* @see https://www.w3.org/TR/activitypub/#security-verification |
| 15 |
*/ |
| 16 |
class Server { |
| 17 |
/** |
| 18 |
* Initialize the class, registering WordPress hooks |
| 19 |
*/ |
| 20 |
public static function init() { |
| 21 |
self::register_routes(); |
| 22 |
|
| 23 |
\add_filter( 'rest_request_before_callbacks', array( self::class, 'authorize_activitypub_requests' ), 10, 3 ); |
| 24 |
} |
| 25 |
|
| 26 |
/** |
| 27 |
* Register routes |
| 28 |
*/ |
| 29 |
public static function register_routes() { |
| 30 |
\register_rest_route( |
| 31 |
ACTIVITYPUB_REST_NAMESPACE, |
| 32 |
'/application', |
| 33 |
array( |
| 34 |
array( |
| 35 |
'methods' => \WP_REST_Server::READABLE, |
| 36 |
'callback' => array( self::class, 'application_actor' ), |
| 37 |
'permission_callback' => '__return_true', |
| 38 |
), |
| 39 |
) |
| 40 |
); |
| 41 |
} |
| 42 |
|
| 43 |
/** |
| 44 |
* Render Application actor profile |
| 45 |
* |
| 46 |
* @return WP_REST_Response The JSON profile of the Application Actor. |
| 47 |
*/ |
| 48 |
public static function application_actor() { |
| 49 |
$user = new Application_User(); |
| 50 |
|
| 51 |
$user->set_context( |
| 52 |
\Activitypub\Activity\Activity::CONTEXT |
| 53 |
); |
| 54 |
|
| 55 |
$json = $user->to_array(); |
| 56 |
|
| 57 |
$response = new WP_REST_Response( $json, 200 ); |
| 58 |
|
| 59 |
$response->header( 'Content-Type', 'application/activity+json' ); |
| 60 |
|
| 61 |
return $response; |
| 62 |
} |
| 63 |
|
| 64 |
/** |
| 65 |
* Callback function to authorize each api requests |
| 66 |
* |
| 67 |
* @see WP_REST_Request |
| 68 |
* |
| 69 |
* @param WP_REST_Response|WP_HTTP_Response|WP_Error|mixed $response Result to send to the client. |
| 70 |
* Usually a WP_REST_Response or WP_Error. |
| 71 |
* @param array $handler Route handler used for the request. |
| 72 |
* @param WP_REST_Request $request Request used to generate the response. |
| 73 |
* |
| 74 |
* @return mixed|WP_Error The response, error, or modified response. |
| 75 |
*/ |
| 76 |
public static function authorize_activitypub_requests( $response, $handler, $request ) { |
| 77 |
$route = $request->get_route(); |
| 78 |
|
| 79 |
// check if it is an activitypub request and exclude webfinger and nodeinfo endpoints |
| 80 |
if ( |
| 81 |
! \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE ) || |
| 82 |
\str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'webfinger' ) || |
| 83 |
\str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'nodeinfo' ) |
| 84 |
) { |
| 85 |
return $response; |
| 86 |
} |
| 87 |
|
| 88 |
// POST-Requets are always signed |
| 89 |
if ( 'post' === \strtolower( $request->get_method() ) ) { |
| 90 |
$verified_request = Signature::verify_http_signature( $request ); |
| 91 |
if ( \is_wp_error( $verified_request ) ) { |
| 92 |
return $verified_request; |
| 93 |
} |
| 94 |
} elseif ( 'get' === \strtolower( $request->get_method() ) ) { // GET-Requests are only signed in secure mode |
| 95 |
if ( ACTIVITYPUB_AUTHORIZED_FETCH ) { |
| 96 |
$verified_request = Signature::verify_http_signature( $request ); |
| 97 |
if ( \is_wp_error( $verified_request ) ) { |
| 98 |
return $verified_request; |
| 99 |
} |
| 100 |
} |
| 101 |
} |
| 102 |
|
| 103 |
return $response; |
| 104 |
} |
| 105 |
} |
| 106 |
|
