← All changes | includes/rest/class-server.php +77 -112 8.2.1 → 5.7.0 View file →

		@@ -6,8 +6,15 @@
6	6	*/
7	7
8	8	namespace Activitypub\Rest;
9	9
	10	+use WP_Error;
	11	+use WP_REST_Server;
	12	+use WP_REST_Response;
	13	+use Activitypub\Signature;
	14	+
	15	+use function Activitypub\use_authorized_fetch;
	16	+
10	17	/**
11	18	* ActivityPub Server REST-Class.
12	19	*
13	20	* @author Django Doucet
		@@ -18,24 +25,85 @@
18	25	/**
19	26	* Initialize the class, registering WordPress hooks.
20	27	*/
21	28	public static function init() {
	29	+ self::add_hooks();
	30	+ }
	31	+
	32	+ /**
	33	+ * Add sever hooks.
	34	+ */
	35	+ public static function add_hooks() {
22	36	\add_filter( 'rest_request_before_callbacks', array( self::class, 'validate_requests' ), 9, 3 );
23	37	\add_filter( 'rest_request_parameter_order', array( self::class, 'request_parameter_order' ), 10, 2 );
	38	+ }
24	39
25		- \add_filter( 'rest_post_dispatch', array( self::class, 'filter_output' ), 10, 3 );
26		- \add_filter( 'rest_post_dispatch', array( self::class, 'add_cors_headers' ), 10, 3 );
	40	+ /**
	41	+ * Callback function to authorize an api request.
	42	+ *
	43	+ * The function is meant to be used as part of permission callbacks for rest api endpoints.
	44	+ *
	45	+ * It verifies the signature of POST, PUT, PATCH, and DELETE requests, as well as GET requests in secure mode.
	46	+ * You can use the filter 'activitypub_defer_signature_verification' to defer the signature verification.
	47	+ * HEAD requests are always bypassed.
	48	+ *
	49	+ * @see https://www.w3.org/wiki/SocialCG/ActivityPub/Primer/Authentication_Authorization#Authorized_fetch
	50	+ * @see https://swicg.github.io/activitypub-http-signature/#authorized-fetch
	51	+ *
	52	+ * @param \WP_REST_Request $request The request object.
	53	+ *
	54	+ * @return bool|\WP_Error True if the request is authorized, WP_Error if not.
	55	+ */
	56	+ public static function verify_signature( $request ) {
	57	+ if ( 'HEAD' === $request->get_method() ) {
	58	+ return true;
	59	+ }
	60	+
	61	+ /**
	62	+ * Filter to defer signature verification.
	63	+ *
	64	+ * Skip signature verification for debugging purposes or to reduce load for
	65	+ * certain Activity-Types, like "Delete".
	66	+ *
	67	+ * @param bool $defer Whether to defer signature verification.
	68	+ * @param \WP_REST_Request $request The request used to generate the response.
	69	+ *
	70	+ * @return bool Whether to defer signature verification.
	71	+ */
	72	+ $defer = \apply_filters( 'activitypub_defer_signature_verification', false, $request );
	73	+
	74	+ if ( $defer ) {
	75	+ return true;
	76	+ }
	77	+
	78	+ if (
	79	+ // POST-Requests always have to be signed.
	80	+ 'GET' !== $request->get_method() ||
	81	+ // GET-Requests only require a signature in secure mode.
	82	+ ( 'GET' === $request->get_method() && use_authorized_fetch() )
	83	+ ) {
	84	+ $verified_request = Signature::verify_http_signature( $request );
	85	+ if ( \is_wp_error( $verified_request ) ) {
	86	+ return new WP_Error(
	87	+ 'activitypub_signature_verification',
	88	+ $verified_request->get_error_message(),
	89	+ array( 'status' => 401 )
	90	+ );
	91	+ }
	92	+ }
	93	+
	94	+ return true;
27	95	}
28	96
29	97	/**
30	98	* Callback function to validate incoming ActivityPub requests
31	99	*
32		- * @param \WP_REST_Response|\WP_HTTP_Response|\WP_Error|mixed $response Result to send to the client.
33		- * Usually a WP_REST_Response or WP_Error.
34		- * @param array $handler Route handler used for the request.
35		- * @param \WP_REST_Request $request Request used to generate the response.
	100	+ * @param WP_REST_Response|\WP_HTTP_Response|WP_Error|mixed $response Result to send to the client.
	101	+ * Usually a WP_REST_Response or WP_Error.
	102	+ * @param array $handler Route handler used for the request.
	103	+ * @param \WP_REST_Request $request Request used to generate the response.
36	104	*
37		- * @return mixed|\WP_Error The response, error, or modified response.
	105	+ * @return mixed|WP_Error The response, error, or modified response.
38	106	*/
39	107	public static function validate_requests( $response, $handler, $request ) {
40	108	if ( 'HEAD' === $request->get_method() ) {
41	109	return $response;
		@@ -60,9 +128,9 @@
60	128	if (
61	129	ACTIVITYPUB_DISABLE_INCOMING_INTERACTIONS &&
62	130	in_array( $params['type'], array( 'Create', 'Like', 'Announce' ), true )
63	131	) {
64		- return new \WP_Error(
	132	+ return new WP_Error(
65	133	'activitypub_server_does_not_accept_incoming_interactions',
66	134	\__( 'This server does not accept incoming interactions.', 'activitypub' ),
67	135	// We have to use a 2XX status code here, because otherwise the response will be
68	136	// treated as an error and Mastodon might block this WordPress instance.
		@@ -90,9 +158,9 @@
90	158	}
91	159
92	160	$method = $request->get_method();
93	161
94		- if ( \WP_REST_Server::CREATABLE !== $method ) {
	162	+ if ( WP_REST_Server::CREATABLE !== $method ) {
95	163	return $order;
96	164	}
97	165
98	166	return array(
		@@ -100,109 +168,6 @@
100	168	'POST',
101	169	'URL',
102	170	'defaults',
103	171	);
104		- }
105		-
106		- /**
107		- * Filters the REST API response to properly handle the ActivityPub error formatting.
108		- *
109		- * @see https://codeberg.org/fediverse/fep/src/branch/main/fep/c180/fep-c180.md
110		- *
111		- * @param \WP_HTTP_Response $response Result to send to the client. Usually a `WP_REST_Response`.
112		- * @param \WP_REST_Server $server Server instance.
113		- * @param \WP_REST_Request $request Request used to generate the response.
114		- *
115		- * @return \WP_HTTP_Response The filtered response.
116		- */
117		- public static function filter_output( $response, $server, $request ) {
118		- $route = $request->get_route();
119		-
120		- // Check if it is an activitypub request and exclude webfinger and nodeinfo endpoints.
121		- if ( ! \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE ) ) {
122		- return $response;
123		- }
124		-
125		- // Exclude OAuth endpoints - they have their own error format per RFC 6749.
126		- if ( \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE . '/oauth' ) ) {
127		- return $response;
128		- }
129		-
130		- // Only alter responses that return an error status code.
131		- if ( $response->get_status() < 400 ) {
132		- return $response;
133		- }
134		-
135		- $data = $response->get_data();
136		-
137		- // Ensure that `$data` was already converted to a response.
138		- if ( \is_wp_error( $data ) ) {
139		- $response = \rest_convert_error_to_response( $data );
140		- $data = $response->get_data();
141		- }
142		-
143		- $error = array(
144		- 'type' => 'about:blank',
145		- 'title' => $data['code'] ?? '',
146		- 'detail' => $data['message'] ?? '',
147		- 'status' => $response->get_status(),
148		-
149		- /*
150		- * Provides the unstructured error data.
151		- *
152		- * @see https://nodeinfo.diaspora.software/schema.html#metadata.
153		- */
154		- 'metadata' => $data,
155		- );
156		-
157		- $response->set_data( $error );
158		-
159		- return $response;
160		- }
161		-
162		- /**
163		- * Add CORS headers to ActivityPub REST responses.
164		- *
165		- * @param \WP_REST_Response $response The REST response.
166		- * @param \WP_REST_Server $server The REST server instance.
167		- * @param \WP_REST_Request $request The request object.
168		- *
169		- * @return \WP_REST_Response The modified response.
170		- */
171		- public static function add_cors_headers( $response, $server, $request ) {
172		- $route = $request->get_route();
173		- $namespace = '/' . ACTIVITYPUB_REST_NAMESPACE;
174		-
175		- // Only add CORS to ActivityPub endpoints, except the interactive OAuth authorize endpoint.
176		- if ( ! \str_starts_with( $route, $namespace ) || \str_starts_with( $route, $namespace . '/oauth/authorize' ) ) {
177		- return $response;
178		- }
179		-
180		- /*
181		- * ActivityPub data is meant to be publicly readable by federation peers
182		- * and browser-side clients. We do not enable credentialed cross-origin
183		- * access: cookie auth would still be rejected by WordPress core's
184		- * REST nonce check, and OAuth Bearer tokens travel in the
185		- * Authorization header — which is permitted via Allow-Headers and
186		- * does not require Allow-Credentials.
187		- */
188		- $response->header( 'Access-Control-Allow-Origin', '*' );
189		- $response->header( 'Access-Control-Allow-Methods', 'GET, POST, OPTIONS' );
190		- $response->header( 'Access-Control-Allow-Headers', 'Accept, Content-Type, Authorization, Last-Event-ID' );
191		-
192		- return $response;
193		- }
194		-
195		- /**
196		- * Send CORS headers directly via header().
197		- *
198		- * Use this for endpoints that bypass the REST response flow
199		- * (e.g. SSE streams that call exit() instead of returning a WP_REST_Response).
200		- *
201		- * @since 8.1.0
202		- */
203		- public static function send_cors_headers() {
204		- \header( 'Access-Control-Allow-Origin: *' );
205		- \header( 'Access-Control-Allow-Methods: GET, POST, OPTIONS' );
206		- \header( 'Access-Control-Allow-Headers: Accept, Content-Type, Authorization, Last-Event-ID' );
207	172	}
208	173	}