activitypub / includes / rest / class-server.php

class-server.php in ActivityPub 2.0.1, at includes/rest/class-server.php

133 lines 3.8 KB

Raw Download Zip

1	<?php
2	namespace Activitypub\Rest;
3
4	use stdClass;
5	use WP_Error;
6	use WP_REST_Response;
7	use Activitypub\Signature;
8	use Activitypub\Model\Application_User;
9
10	/**
11	* ActivityPub Server REST-Class
12	*
13	* @author Django Doucet
14	*
15	* @see https://www.w3.org/TR/activitypub/#security-verification
16	*/
17	class Server {
18	/**
19	* Initialize the class, registering WordPress hooks
20	*/
21	public static function init() {
22	self::register_routes();
23
24	\add_filter( 'rest_request_before_callbacks', array( self::class, 'authorize_activitypub_requests' ), 10, 3 );
25	}
26
27	/**
28	* Register routes
29	*/
30	public static function register_routes() {
31	\register_rest_route(
32	ACTIVITYPUB_REST_NAMESPACE,
33	'/application',
34	array(
35	array(
36	'methods' => \WP_REST_Server::READABLE,
37	'callback' => array( self::class, 'application_actor' ),
38	'permission_callback' => '__return_true',
39	),
40	)
41	);
42	}
43
44	/**
45	* Render Application actor profile
46	*
47	* @return WP_REST_Response The JSON profile of the Application Actor.
48	*/
49	public static function application_actor() {
50	$user = new Application_User();
51
52	$user->set_context(
53	\Activitypub\Activity\Activity::CONTEXT
54	);
55
56	$json = $user->to_array();
57
58	$rest_response = new WP_REST_Response( $json, 200 );
59	$rest_response->header( 'Content-Type', 'application/activity+json; charset=' . get_option( 'blog_charset' ) );
60
61	return $rest_response;
62	}
63
64	/**
65	* Callback function to authorize each api requests
66	*
67	* @see WP_REST_Request
68	*
69	* @param WP_REST_Response\|WP_HTTP_Response\|WP_Error\|mixed $response Result to send to the client.
70	* Usually a WP_REST_Response or WP_Error.
71	* @param array $handler Route handler used for the request.
72	* @param WP_REST_Request $request Request used to generate the response.
73	*
74	* @return mixed\|WP_Error The response, error, or modified response.
75	*/
76	public static function authorize_activitypub_requests( $response, $handler, $request ) {
77	if ( 'HEAD' === $request->get_method() ) {
78	return $response;
79	}
80
81	$route = $request->get_route();
82
83	// check if it is an activitypub request and exclude webfinger and nodeinfo endpoints
84	if (
85	! \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE ) \|\|
86	\str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'webfinger' ) \|\|
87	\str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'nodeinfo' )
88	) {
89	return $response;
90	}
91
92	/**
93	* Filter to defer signature verification
94	*
95	* Skip signature verification for debugging purposes or to reduce load for
96	* certain Activity-Types, like "Delete".
97	*
98	* @param bool $defer Whether to defer signature verification.
99	* @param WP_REST_Request $request The request used to generate the response.
100	*
101	* @return bool Whether to defer signature verification.
102	*/
103	$defer = \apply_filters( 'activitypub_defer_signature_verification', false, $request );
104
105	if ( $defer ) {
106	return $response;
107	}
108
109	// POST-Requets are always signed
110	if ( 'GET' !== $request->get_method() ) {
111	$verified_request = Signature::verify_http_signature( $request );
112	if ( \is_wp_error( $verified_request ) ) {
113	return new WP_Error(
114	'activitypub_signature_verification',
115	$verified_request->get_error_message(),
116	array( 'status' => 401 )
117	);
118	}
119	} elseif ( 'GET' === $request->get_method() && ACTIVITYPUB_AUTHORIZED_FETCH ) { // GET-Requests are only signed in secure mode
120	$verified_request = Signature::verify_http_signature( $request );
121	if ( \is_wp_error( $verified_request ) ) {
122	return new WP_Error(
123	'activitypub_signature_verification',
124	$verified_request->get_error_message(),
125	array( 'status' => 401 )
126	);
127	}
128	}
129
130	return $response;
131	}
132	}
133