# activitypub/9.3.0/includes/rest/class-server.php

ActivityPub, version 9.3.0. 430 lines.

- Page: https://pluginprobe.com/plugins/activitypub/9.3.0/code/includes/rest/class-server.php
- Raw: https://pluginprobe.com/plugins/activitypub/9.3.0/raw/includes/rest/class-server.php
- Modified: 2026-09-02T10:52:54+00:00

Line numbers below start at 1. Link to a line or a range by appending a fragment to the
page URL, for example `https://pluginprobe.com/plugins/activitypub/9.3.0/code/includes/rest/class-server.php#L10-L20`.

```php
<?php
/**
 * Server REST-Class file.
 *
 * @package Activitypub
 */

namespace Activitypub\Rest;

use Activitypub\Signature;

use function Activitypub\maybe_set_no_store;
use function Activitypub\use_authorized_fetch;

/**
 * ActivityPub Server REST-Class.
 *
 * @author Django Doucet
 *
 * @see https://www.w3.org/TR/activitypub/#security-verification
 */
class Server {
	/**
	 * Initialize the class, registering WordPress hooks.
	 */
	public static function init() {
		\add_filter( 'rest_pre_dispatch', array( self::class, 'normalize_route' ), 1, 3 );
		\add_filter( 'rest_pre_dispatch', array( self::class, 'maybe_add_actor_from_signature' ), 10, 3 );
		\add_filter( 'rest_request_before_callbacks', array( self::class, 'validate_requests' ), 9, 3 );
		\add_filter( 'rest_request_parameter_order', array( self::class, 'request_parameter_order' ), 10, 2 );

		\add_filter( 'rest_post_dispatch', array( self::class, 'filter_output' ), 10, 3 );
		\add_filter( 'rest_post_dispatch', array( self::class, 'add_cache_headers' ), 10, 3 );
		\add_filter( 'rest_post_dispatch', array( self::class, 'add_cors_headers' ), 10, 3 );
		\add_filter( 'rest_allowed_cors_headers', array( self::class, 'allow_cors_headers' ), 10, 2 );
	}

	/**
	 * Normalize the route of an ActivityPub request before it is matched to a handler.
	 *
	 * WordPress matches registered routes with a case-insensitive pattern but leaves the route on the
	 * request spelled the way the caller sent it, so `/ActivityPub/1.0/Inbox` is dispatched to the same
	 * handler as `/activitypub/1.0/inbox` while reading differently to every route check downstream.
	 * Lowercasing it once here, before `WP_REST_Server::match_request_to_handler()` runs, keeps a
	 * case-varied request from being served while slipping past those checks. Every route this plugin
	 * registers is lowercase ASCII, so this is a no-op for the spelling a caller normally sends.
	 *
	 * Routes outside the ActivityPub namespace are left alone: their segments belong to other endpoints,
	 * which may well treat them as case-sensitive.
	 *
	 * The route is rewritten before it is matched, so a path segment captured by a route pattern is
	 * captured from the lowercased route. Every segment we capture today is either numeric or a
	 * lowercase name, but a route registered with a case-bearing segment would need a second look.
	 *
	 * @since 9.3.0
	 *
	 * @param mixed            $result  Response to replace the request with, or null to continue.
	 * @param \WP_REST_Server  $server  Server instance.
	 * @param \WP_REST_Request $request The request object.
	 *
	 * @return mixed The unmodified `$result`.
	 */
	public static function normalize_route( $result, $server, $request ) {
		// Respect an earlier short-circuit.
		if ( null !== $result ) {
			return $result;
		}

		$route = \strtolower( $request->get_route() );

		if ( \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE ) ) {
			$request->set_route( $route );
		}

		return $result;
	}

	/**
	 * Callback function to validate incoming ActivityPub requests
	 *
	 * @param \WP_REST_Response|\WP_HTTP_Response|\WP_Error|mixed $response Result to send to the client.
	 *                                                                      Usually a WP_REST_Response or WP_Error.
	 * @param array                                               $handler  Route handler used for the request.
	 * @param \WP_REST_Request                                    $request  Request used to generate the response.
	 *
	 * @return mixed|\WP_Error The response, error, or modified response.
	 */
	public static function validate_requests( $response, $handler, $request ) {
		if ( 'HEAD' === $request->get_method() ) {
			return $response;
		}

		$route = $request->get_route();

		if (
			\is_wp_error( $response ) ||
			! \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE )
		) {
			return $response;
		}

		$params = $request->get_json_params();

		// Type is required for ActivityPub requests, so it fail later in the process.
		if ( ! isset( $params['type'] ) ) {
			return $response;
		}

		if (
			ACTIVITYPUB_DISABLE_INCOMING_INTERACTIONS &&
			\in_array( $params['type'], array( 'Create', 'Like', 'Announce' ), true )
		) {
			return new \WP_Error(
				'activitypub_server_does_not_accept_incoming_interactions',
				\__( 'This server does not accept incoming interactions.', 'activitypub' ),
				// We have to use a 2XX status code here, because otherwise the response will be
				// treated as an error and Mastodon might block this WordPress instance.
				array( 'status' => 202 )
			);
		}

		return $response;
	}

	/**
	 * Modify the parameter priority order for a REST API request.
	 *
	 * @param string[]         $order   Array of types to check, in order of priority.
	 * @param \WP_REST_Request $request The request object.
	 *
	 * @return string[] The modified order of types to check.
	 */
	public static function request_parameter_order( $order, $request ) {
		$route = $request->get_route();

		// Check if it is an activitypub request and exclude webfinger and nodeinfo endpoints.
		if ( ! \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE ) ) {
			return $order;
		}

		$method = $request->get_method();

		if ( \WP_REST_Server::CREATABLE !== $method ) {
			return $order;
		}

		return array(
			'JSON',
			'POST',
			'URL',
			'defaults',
		);
	}

	/**
	 * Backfill a missing `actor` on incoming FeatureRequest activities from the signature.
	 *
	 * Mastodon (FEP-7aa9) omits `actor` from the FeatureRequest body and conveys the
	 * requesting actor only through the HTTP signature keyId. Our inbox routes require
	 * `actor`, so such a request is rejected during parameter validation before it can
	 * reach the inbox or its handler, which is why no Accept is ever sent.
	 *
	 * Derive the actor from the keyId and add it as a request parameter. The actor is
	 * injected with `set_param()` rather than by rewriting the request body, so the raw
	 * body stays byte-identical and the signed `Digest` still verifies. Inbox POSTs read
	 * JSON parameters first (see `request_parameter_order()`), so the value is visible to
	 * both parameter validation and the handler via `get_json_params()`.
	 *
	 * Scoped to FeatureRequest, the only activity type known to address this way. Runs on
	 * `rest_pre_dispatch` because that is the only hook that fires before required-parameter
	 * validation. Signature verification still runs afterwards and remains authoritative:
	 * the injected actor is derived from the very keyId the signature is checked against, so
	 * it cannot be used to impersonate another actor.
	 *
	 * @since 9.0.0
	 *
	 * @param mixed            $result  Response to replace the request with, or null to continue.
	 * @param \WP_REST_Server  $server  Server instance.
	 * @param \WP_REST_Request $request The request object.
	 *
	 * @return mixed The unmodified `$result`.
	 */
	public static function maybe_add_actor_from_signature( $result, $server, $request ) {
		// Respect an earlier short-circuit.
		if ( null !== $result ) {
			return $result;
		}

		if ( \WP_REST_Server::CREATABLE !== $request->get_method() ) {
			return $result;
		}

		$route = $request->get_route();
		if (
			! \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE ) ||
			! \str_ends_with( $route, '/inbox' )
		) {
			return $result;
		}

		$json = $request->get_json_params();
		if ( ! \is_array( $json ) || 'FeatureRequest' !== ( $json['type'] ?? '' ) || ! empty( $json['actor'] ) ) {
			return $result;
		}

		$key_id = Signature::get_key_id( $request );
		if ( ! $key_id ) {
			return $result;
		}

		$request->set_param( 'actor', \strip_fragment_from_url( $key_id ) );

		return $result;
	}

	/**
	 * Filters the REST API response to properly handle the ActivityPub error formatting.
	 *
	 * @see https://codeberg.org/fediverse/fep/src/branch/main/fep/c180/fep-c180.md
	 *
	 * @param \WP_HTTP_Response $response Result to send to the client. Usually a `WP_REST_Response`.
	 * @param \WP_REST_Server   $server   Server instance.
	 * @param \WP_REST_Request  $request  Request used to generate the response.
	 *
	 * @return \WP_HTTP_Response The filtered response.
	 */
	public static function filter_output( $response, $server, $request ) {
		$route = $request->get_route();

		// Check if it is an activitypub request and exclude webfinger and nodeinfo endpoints.
		if ( ! \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE ) ) {
			return $response;
		}

		// Exclude OAuth endpoints - they have their own error format per RFC 6749.
		if ( \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE . '/oauth' ) ) {
			return $response;
		}

		// Only alter responses that return an error status code.
		if ( $response->get_status() < 400 ) {
			return $response;
		}

		$data = $response->get_data();

		// Ensure that `$data` was already converted to a response.
		if ( \is_wp_error( $data ) ) {
			$response = \rest_convert_error_to_response( $data );
			$data     = $response->get_data();
		}

		$error = array(
			'type'     => 'about:blank',
			'title'    => $data['code'] ?? '',
			'detail'   => $data['message'] ?? '',
			'status'   => $response->get_status(),

			/*
			 * Provides the unstructured error data.
			 *
			 * @see https://nodeinfo.diaspora.software/schema.html#metadata.
			 */
			'metadata' => $data,
		);

		$response->set_data( $error );

		return $response;
	}

	/**
	 * Add cache headers to ActivityPub responses.
	 *
	 * Responses on these routes are not the same for every caller: Authorized Fetch
	 * varies them by signing key, and the ActivityPub API varies them by access token.
	 * Shared caches are told to key on those headers, and a response produced for a
	 * caller that presented credentials is marked as belonging to that caller alone.
	 *
	 * @since 9.2.0
	 *
	 * @param \WP_REST_Response $response Result to send to the client.
	 * @param \WP_REST_Server   $server   Server instance.
	 * @param \WP_REST_Request  $request  Request used to generate the response.
	 *
	 * @return \WP_REST_Response The response object.
	 */
	public static function add_cache_headers( $response, $server, $request ) {
		if ( ! \str_starts_with( $request->get_route(), '/' . ACTIVITYPUB_REST_NAMESPACE ) ) {
			return $response;
		}

		/*
		 * A request authenticated by WP session can get a personalized response even on a route whose
		 * permission callback is `__return_true`: `/interactions` redirects by the current user, and
		 * verify_owner() surfaces private items in otherwise public collections. The session cookie is
		 * not part of Vary, so mark any logged-in response private before the public shortcut below.
		 */
		if ( \is_user_logged_in() ) {
			maybe_set_no_store( $response );

			return $response;
		}

		/*
		 * A route that authorizes every caller identically (permission_callback `__return_true`) returns
		 * a public response, even under Authorized Fetch, where Mastodon still signs its GETs. Leave it
		 * without caller-varying cache directives so public collections such as thread replies and
		 * context stay cacheable at the edge. Routes that gate on the caller fall through below.
		 */
		$attributes = $request->get_attributes();
		if ( isset( $attributes['permission_callback'] ) && '__return_true' === $attributes['permission_callback'] ) {
			return $response;
		}

		$authorized_fetch = use_authorized_fetch();

		/*
		 * Authorization always affects the response: the ActivityPub API varies it by access token.
		 * The HTTP-signature headers only affect it under Authorized Fetch; with it off the response
		 * is identical for every caller, and Mastodon sends a fresh Signature-Input on each GET, so
		 * varying on them would mint a unique cache variant per request and defeat shared caching.
		 */
		$vary = array( 'Authorization' );

		if ( $authorized_fetch ) {
			$vary[] = 'Signature';
			$vary[] = 'Signature-Input';
		}

		// Appended, so the CORS handler's own `Vary: Origin` survives.
		$response->header( 'Vary', \implode( ', ', $vary ), false );

		/*
		 * Only mark a credentialed response private when Authorized Fetch actually varies it. With
		 * Authorized Fetch off, a signed request gets the same public response as everyone else
		 * (Mastodon signs its GETs by default), so `no-store` would needlessly drop it from every
		 * CDN. The `Vary: Authorization` above still keeps a token-credentialed response from being reused.
		 */
		if ( $authorized_fetch ) {
			$credentials = array( 'authorization', 'signature', 'signature-input' );

			foreach ( $credentials as $header ) {
				if ( $request->get_header( $header ) ) {
					maybe_set_no_store( $response );
					break;
				}
			}
		}

		return $response;
	}

	/**
	 * Add CORS headers to ActivityPub REST responses.
	 *
	 * @param \WP_REST_Response $response The REST response.
	 * @param \WP_REST_Server   $server   The REST server instance.
	 * @param \WP_REST_Request  $request  The request object.
	 *
	 * @return \WP_REST_Response The modified response.
	 */
	public static function add_cors_headers( $response, $server, $request ) {
		$route     = $request->get_route();
		$namespace = '/' . ACTIVITYPUB_REST_NAMESPACE;

		// Only add CORS to ActivityPub endpoints, except the interactive OAuth authorize endpoint.
		if ( ! \str_starts_with( $route, $namespace ) || \str_starts_with( $route, $namespace . '/oauth/authorize' ) ) {
			return $response;
		}

		/*
		 * ActivityPub data is meant to be publicly readable by federation peers
		 * and browser-side clients. We do not enable credentialed cross-origin
		 * access: cookie auth would still be rejected by WordPress core's
		 * REST nonce check, and OAuth Bearer tokens travel in the
		 * Authorization header — which is permitted via Allow-Headers and
		 * does not require Allow-Credentials.
		 *
		 * Allow-Headers is contributed by core (which already lists `X-WP-Nonce`,
		 * `Authorization`, `Content-Type`, `Content-Disposition`, and `Content-MD5`)
		 * and extended for ActivityPub via the `rest_allowed_cors_headers` filter
		 * in self::allow_cors_headers().
		 */
		$response->header( 'Access-Control-Allow-Origin', '*' );
		$response->header( 'Access-Control-Allow-Methods', 'GET, POST, OPTIONS' );

		return $response;
	}

	/**
	 * Extend the CORS Allow-Headers list for ActivityPub REST endpoints.
	 *
	 * Adds the headers ActivityPub clients need on top of WordPress core's
	 * defaults: `Accept` for content negotiation and `Last-Event-ID` for
	 * Server-Sent Events resume.
	 *
	 * @since 8.3.0
	 *
	 * @param string[]         $allow_headers Headers core currently permits in CORS requests.
	 * @param \WP_REST_Request $request       The current REST request.
	 *
	 * @return string[] The (possibly extended) list of allowed headers.
	 */
	public static function allow_cors_headers( $allow_headers, $request ) {
		$route     = $request->get_route();
		$namespace = '/' . ACTIVITYPUB_REST_NAMESPACE;

		if ( ! \str_starts_with( $route, $namespace ) || \str_starts_with( $route, $namespace . '/oauth/authorize' ) ) {
			return $allow_headers;
		}

		return \array_values( \array_unique( \array_merge( (array) $allow_headers, array( 'Accept', 'Last-Event-ID' ) ) ) );
	}

	/**
	 * Send CORS headers directly via header().
	 *
	 * Use this for endpoints that bypass the REST response flow
	 * (e.g. SSE streams that call exit() instead of returning a WP_REST_Response).
	 *
	 * @since 8.1.0
	 */
	public static function send_cors_headers() {
		\header( 'Access-Control-Allow-Origin: *' );
		\header( 'Access-Control-Allow-Methods: GET, POST, OPTIONS' );
		\header( 'Access-Control-Allow-Headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type, Accept, Last-Event-ID' );
	}
}

```