activitypub / includes / rest / class-server.php

class-server.php in ActivityPub 1.1.0, at includes/rest/class-server.php

110 lines 3.3 KB

Raw Download Zip

1	<?php
2	namespace Activitypub\Rest;
3
4	use stdClass;
5	use WP_Error;
6	use WP_REST_Response;
7	use Activitypub\Signature;
8	use Activitypub\Model\Application_User;
9
10	/**
11	* ActivityPub Server REST-Class
12	*
13	* @author Django Doucet
14	*
15	* @see https://www.w3.org/TR/activitypub/#security-verification
16	*/
17	class Server {
18	/**
19	* Initialize the class, registering WordPress hooks
20	*/
21	public static function init() {
22	self::register_routes();
23
24	\add_filter( 'rest_request_before_callbacks', array( self::class, 'authorize_activitypub_requests' ), 10, 3 );
25	}
26
27	/**
28	* Register routes
29	*/
30	public static function register_routes() {
31	\register_rest_route(
32	ACTIVITYPUB_REST_NAMESPACE,
33	'/application',
34	array(
35	array(
36	'methods' => \WP_REST_Server::READABLE,
37	'callback' => array( self::class, 'application_actor' ),
38	'permission_callback' => '__return_true',
39	),
40	)
41	);
42	}
43
44	/**
45	* Render Application actor profile
46	*
47	* @return WP_REST_Response The JSON profile of the Application Actor.
48	*/
49	public static function application_actor() {
50	$user = new Application_User();
51
52	$user->set_context(
53	\Activitypub\Activity\Activity::CONTEXT
54	);
55
56	$json = $user->to_array();
57
58	$rest_response = new WP_REST_Response( $json, 200 );
59	$rest_response->header( 'Content-Type', 'application/activity+json; charset=' . get_option( 'blog_charset' ) );
60
61	return $rest_response;
62	}
63
64	/**
65	* Callback function to authorize each api requests
66	*
67	* @see WP_REST_Request
68	*
69	* @param WP_REST_Response\|WP_HTTP_Response\|WP_Error\|mixed $response Result to send to the client.
70	* Usually a WP_REST_Response or WP_Error.
71	* @param array $handler Route handler used for the request.
72	* @param WP_REST_Request $request Request used to generate the response.
73	*
74	* @return mixed\|WP_Error The response, error, or modified response.
75	*/
76	public static function authorize_activitypub_requests( $response, $handler, $request ) {
77	if ( 'HEAD' === $request->get_method() ) {
78	return $response;
79	}
80
81	$route = $request->get_route();
82
83	// check if it is an activitypub request and exclude webfinger and nodeinfo endpoints
84	if (
85	! \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE ) \|\|
86	\str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'webfinger' ) \|\|
87	\str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'nodeinfo' )
88	) {
89	return $response;
90	}
91
92	// POST-Requets are always signed
93	if ( 'GET' !== $request->get_method() ) {
94	$verified_request = Signature::verify_http_signature( $request );
95	if ( \is_wp_error( $verified_request ) ) {
96	return new WP_Error( 'activitypub_signature_verification', $verified_request->get_error_message(), array( 'status' => 401 ) );
97	}
98	} elseif ( 'GET' === $request->get_method() ) { // GET-Requests are only signed in secure mode
99	if ( ACTIVITYPUB_AUTHORIZED_FETCH ) {
100	$verified_request = Signature::verify_http_signature( $request );
101	if ( \is_wp_error( $verified_request ) ) {
102	return new WP_Error( 'activitypub_signature_verification', $verified_request->get_error_message(), array( 'status' => 401 ) );
103	}
104	}
105	}
106
107	return $response;
108	}
109	}
110