activitypub / includes / rest / class-server.php

class-server.php in ActivityPub 2.6.0, at includes/rest/class-server.php

128 lines 3.8 KB

Raw Download Zip

1	<?php
2	namespace Activitypub\Rest;
3
4	use stdClass;
5	use WP_Error;
6	use WP_REST_Response;
7	use Activitypub\Signature;
8	use Activitypub\Model\Application;
9
10	/**
11	* ActivityPub Server REST-Class
12	*
13	* @author Django Doucet
14	*
15	* @see https://www.w3.org/TR/activitypub/#security-verification
16	*/
17	class Server {
18	/**
19	* Initialize the class, registering WordPress hooks
20	*/
21	public static function init() {
22	self::register_routes();
23
24	\add_filter( 'rest_request_before_callbacks', array( self::class, 'authorize_activitypub_requests' ), 10, 3 );
25	}
26
27	/**
28	* Register routes
29	*/
30	public static function register_routes() {
31	\register_rest_route(
32	ACTIVITYPUB_REST_NAMESPACE,
33	'/application',
34	array(
35	array(
36	'methods' => \WP_REST_Server::READABLE,
37	'callback' => array( self::class, 'application_actor' ),
38	'permission_callback' => '__return_true',
39	),
40	)
41	);
42	}
43
44	/**
45	* Render Application actor profile
46	*
47	* @return WP_REST_Response The JSON profile of the Application Actor.
48	*/
49	public static function application_actor() {
50	$user = new Application();
51
52	$json = $user->to_array();
53
54	$rest_response = new WP_REST_Response( $json, 200 );
55	$rest_response->header( 'Content-Type', 'application/activity+json; charset=' . get_option( 'blog_charset' ) );
56
57	return $rest_response;
58	}
59
60	/**
61	* Callback function to authorize each api requests
62	*
63	* @see WP_REST_Request
64	*
65	* @see https://www.w3.org/wiki/SocialCG/ActivityPub/Primer/Authentication_Authorization#Authorized_fetch
66	* @see https://swicg.github.io/activitypub-http-signature/#authorized-fetch
67	*
68	* @param WP_REST_Response\|WP_HTTP_Response\|WP_Error\|mixed $response Result to send to the client.
69	* Usually a WP_REST_Response or WP_Error.
70	* @param array $handler Route handler used for the request.
71	* @param WP_REST_Request $request Request used to generate the response.
72	*
73	* @return mixed\|WP_Error The response, error, or modified response.
74	*/
75	public static function authorize_activitypub_requests( $response, $handler, $request ) {
76	if ( 'HEAD' === $request->get_method() ) {
77	return $response;
78	}
79
80	$route = $request->get_route();
81
82	// check if it is an activitypub request and exclude webfinger and nodeinfo endpoints
83	if (
84	! \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE ) \|\|
85	\str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'webfinger' ) \|\|
86	\str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'nodeinfo' ) \|\|
87	\str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'application' )
88	) {
89	return $response;
90	}
91
92	/**
93	* Filter to defer signature verification
94	*
95	* Skip signature verification for debugging purposes or to reduce load for
96	* certain Activity-Types, like "Delete".
97	*
98	* @param bool $defer Whether to defer signature verification.
99	* @param WP_REST_Request $request The request used to generate the response.
100	*
101	* @return bool Whether to defer signature verification.
102	*/
103	$defer = \apply_filters( 'activitypub_defer_signature_verification', false, $request );
104
105	if ( $defer ) {
106	return $response;
107	}
108
109	if (
110	// POST-Requests are always signed
111	'GET' !== $request->get_method() \|\|
112	// GET-Requests only require a signature in secure mode
113	( 'GET' === $request->get_method() && ACTIVITYPUB_AUTHORIZED_FETCH )
114	) {
115	$verified_request = Signature::verify_http_signature( $request );
116	if ( \is_wp_error( $verified_request ) ) {
117	return new WP_Error(
118	'activitypub_signature_verification',
119	$verified_request->get_error_message(),
120	array( 'status' => 401 )
121	);
122	}
123	}
124
125	return $response;
126	}
127	}
128