activitypub / includes / rest / class-server.php

class-server.php in ActivityPub 1.0.8, at includes/rest/class-server.php

109 lines 3.1 KB

Raw Download Zip

1	<?php
2	namespace Activitypub\Rest;
3
4	use stdClass;
5	use WP_REST_Response;
6	use Activitypub\Signature;
7	use Activitypub\Model\Application_User;
8
9	/**
10	* ActivityPub Server REST-Class
11	*
12	* @author Django Doucet
13	*
14	* @see https://www.w3.org/TR/activitypub/#security-verification
15	*/
16	class Server {
17	/**
18	* Initialize the class, registering WordPress hooks
19	*/
20	public static function init() {
21	self::register_routes();
22
23	\add_filter( 'rest_request_before_callbacks', array( self::class, 'authorize_activitypub_requests' ), 10, 3 );
24	}
25
26	/**
27	* Register routes
28	*/
29	public static function register_routes() {
30	\register_rest_route(
31	ACTIVITYPUB_REST_NAMESPACE,
32	'/application',
33	array(
34	array(
35	'methods' => \WP_REST_Server::READABLE,
36	'callback' => array( self::class, 'application_actor' ),
37	'permission_callback' => '__return_true',
38	),
39	)
40	);
41	}
42
43	/**
44	* Render Application actor profile
45	*
46	* @return WP_REST_Response The JSON profile of the Application Actor.
47	*/
48	public static function application_actor() {
49	$user = new Application_User();
50
51	$user->set_context(
52	\Activitypub\Activity\Activity::CONTEXT
53	);
54
55	$json = $user->to_array();
56
57	$rest_response = new WP_REST_Response( $json, 200 );
58	$rest_response->header( 'Content-Type', 'application/activity+json; charset=' . get_option( 'blog_charset' ) );
59
60	return $rest_response;
61	}
62
63	/**
64	* Callback function to authorize each api requests
65	*
66	* @see WP_REST_Request
67	*
68	* @param WP_REST_Response\|WP_HTTP_Response\|WP_Error\|mixed $response Result to send to the client.
69	* Usually a WP_REST_Response or WP_Error.
70	* @param array $handler Route handler used for the request.
71	* @param WP_REST_Request $request Request used to generate the response.
72	*
73	* @return mixed\|WP_Error The response, error, or modified response.
74	*/
75	public static function authorize_activitypub_requests( $response, $handler, $request ) {
76	if ( 'HEAD' === $request->get_method() ) {
77	return $response;
78	}
79
80	$route = $request->get_route();
81
82	// check if it is an activitypub request and exclude webfinger and nodeinfo endpoints
83	if (
84	! \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE ) \|\|
85	\str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'webfinger' ) \|\|
86	\str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'nodeinfo' )
87	) {
88	return $response;
89	}
90
91	// POST-Requets are always signed
92	if ( 'GET' !== $request->get_method() ) {
93	$verified_request = Signature::verify_http_signature( $request );
94	if ( \is_wp_error( $verified_request ) ) {
95	return $verified_request;
96	}
97	} elseif ( 'GET' === $request->get_method() ) { // GET-Requests are only signed in secure mode
98	if ( ACTIVITYPUB_AUTHORIZED_FETCH ) {
99	$verified_request = Signature::verify_http_signature( $request );
100	if ( \is_wp_error( $verified_request ) ) {
101	return $verified_request;
102	}
103	}
104	}
105
106	return $response;
107	}
108	}
109