activitypub / includes / handler / class-collection-sync.php

class-collection-sync.php in ActivityPub trunk, at includes/handler/class-collection-sync.php

226 lines 6.7 KB

Raw Download Zip

1	<?php
2	/**
3	* Collection Sync file.
4	*
5	* @package Activitypub
6	*/
7
8	namespace Activitypub\Handler;
9
10	use Activitypub\Collection\Followers;
11	use Activitypub\Collection\Remote_Actors;
12	use Activitypub\Signature;
13
14	use function Activitypub\get_url_authority;
15
16	/**
17	* Collection Sync Handler.
18	*
19	* Handles the Collection-Synchronization header (FEP-8fcf) for various collection types.
20	*
21	* @see https://codeberg.org/fediverse/fep/src/branch/main/fep/8fcf/fep-8fcf.md
22	*/
23	class Collection_Sync {
24	/**
25	* Initialize the class, registering WordPress hooks.
26	*/
27	public static function init() {
28	\add_action( 'activitypub_inbox_create', array( self::class, 'handle_collection_synchronization' ), 10, 2 );
29
30	// The Collection-Synchronization header needs to be part of the signature, so it must be added before signing.
31	\add_filter( 'http_request_args', array( self::class, 'maybe_add_headers' ), -1, 2 );
32	}
33
34	/**
35	* Process Collection-Synchronization header if present (FEP-8fcf).
36	*
37	* This method handles the FEP-8fcf Collection Synchronization protocol for any collection type.
38	* It detects the collection type from the URL and delegates to the appropriate handler.
39	*
40	* @see https://codeberg.org/fediverse/fep/src/branch/main/fep/8fcf/fep-8fcf.md
41	*
42	* @param array $data The activity data.
43	* @param int\|int[] $user_ids The user ID(s).
44	*/
45	public static function handle_collection_synchronization( $data, $user_ids ) {
46	if ( empty( $_SERVER['HTTP_COLLECTION_SYNCHRONIZATION'] ) ) {
47	return;
48	}
49
50	// Check if sync-header is part of signature (required by FEP).
51	// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
52	$signature = \wp_unslash( $_SERVER['HTTP_SIGNATURE'] ?? $_SERVER['HTTP_AUTHORIZATION'] ?? '' );
53	if ( false === \stripos( $signature, 'collection-synchronization' ) ) {
54	return;
55	}
56
57	// phpcs:ignore WordPress.Security.ValidatedSanitizedInput
58	$sync_header = \wp_unslash( $_SERVER['HTTP_COLLECTION_SYNCHRONIZATION'] );
59
60	// Parse the header using the generic HTTP parser.
61	$params = Signature::parse_collection_sync_header( $sync_header );
62
63	if ( false === $params ) {
64	return;
65	}
66
67	// Check for followers collection.
68	$collection_type = null;
69	if ( \preg_match( '#/followers(?:/sync)?(?:\?\|$)#', $params['url'] ) ) {
70	$collection_type = 'followers';
71	}
72
73	if ( ! $collection_type ) {
74	// Unknown or unsupported collection type.
75	return;
76	}
77
78	// Get the actor URL for validation.
79	$actor_url = $data['actor'] ?? false;
80
81	if ( ! $actor_url ) {
82	return;
83	}
84
85	// Validate the header parameters.
86	if ( ! self::validate_header_params( $params, $actor_url ) ) {
87	return;
88	}
89
90	// Extract the user ID for cache key (collection sync is always for a single user).
91	$user_id = \is_array( $user_ids ) ? \reset( $user_ids ) : $user_ids;
92	$cache_key = 'activitypub_collection_sync_received_' . $user_id . '_' . \md5( $actor_url );
93	if ( false === \get_transient( $cache_key ) ) {
94	$frequency = self::get_frequency();
95	\set_transient( $cache_key, \time(), $frequency );
96	} else {
97	return;
98	}
99
100	/**
101	* Action triggered Collection Sync.
102	*
103	* This allows for async processing of the reconciliation.
104	*
105	* @param string $collection_type The collection type (e.g., 'followers', 'following', 'liked').
106	* @param int[] $user_ids The local user IDs.
107	* @param string $actor_url The remote actor URL.
108	* @param array $params The parsed Collection-Synchronization header parameters.
109	*/
110	\do_action( 'activitypub_collection_sync', $collection_type, (array) $user_ids, $actor_url, $params );
111	}
112
113	/**
114	* Add Collection-Synchronization header to `Create` activities (FEP-8fcf).
115	*
116	* This method adds the Collection-Synchronization header to outgoing `Create` activities.
117	*
118	* @see https://codeberg.org/fediverse/fep/src/branch/main/fep/8fcf/fep-8fcf.md
119	*
120	* @param array $args The HTTP request arguments.
121	* @param string $url The request URL.
122	*
123	* @return array Modified HTTP request arguments.
124	*/
125	public static function maybe_add_headers( $args, $url ) {
126	if ( empty( $args['body'] ) ) {
127	return $args;
128	}
129
130	if ( ! \is_array( $args['body'] ) ) {
131	$body = \json_decode( $args['body'], true );
132	if ( null === $body ) {
133	return $args;
134	}
135	} else {
136	$body = $args['body'];
137	}
138
139	if ( ! isset( $body['type'] ) \|\| 'Create' !== $body['type'] ) {
140	return $args;
141	}
142
143	// Only send header if we haven't sent one to this authority in the last day.
144	$inbox_authority = get_url_authority( $url );
145	$user_id = $args['user_id'] ?? false;
146
147	if ( false === $user_id \|\| ! $inbox_authority ) {
148	return $args;
149	}
150
151	// Check if we've already sent a sync header to this authority today.
152	$transient_key = 'activitypub_collection_sync_sent_' . $user_id . '_' . \md5( $inbox_authority );
153	if ( false !== \get_transient( $transient_key ) ) {
154	return $args;
155	}
156
157	$sync_header = Followers::generate_sync_header( $user_id, $inbox_authority );
158	if ( $sync_header ) {
159	$args['headers']['Collection-Synchronization'] = $sync_header;
160
161	$frequency = self::get_frequency();
162	\set_transient( $transient_key, \time(), $frequency );
163	}
164
165	return $args;
166	}
167
168	/**
169	* Validate Collection-Synchronization header parameters.
170	*
171	* @param array $params Parsed header parameters.
172	* @param string $actor_url The actor URL that sent the activity.
173	*
174	* @return bool True if valid, false otherwise.
175	*/
176	public static function validate_header_params( $params, $actor_url ) {
177	if ( empty( $params['collectionId'] ) \|\| empty( $params['url'] ) ) {
178	return false;
179	}
180
181	$post = Remote_Actors::fetch_by_uri( $actor_url );
182
183	if ( \is_wp_error( $post ) ) {
184	return false;
185	}
186
187	$actor = Remote_Actors::get_actor( $post );
188
189	if ( \is_wp_error( $actor ) ) {
190	return false;
191	}
192
193	$expected_collection = $actor->get_followers();
194
195	if ( \is_wp_error( $expected_collection ) ) {
196	return false;
197	}
198
199	if ( \trailingslashit( $params['collectionId'] ) !== \trailingslashit( $expected_collection ) ) {
200	return false;
201	}
202
203	// Build authorities for comparison.
204	$collection_authority = get_url_authority( $params['collectionId'] );
205	$url_authority = get_url_authority( $params['url'] );
206
207	return $collection_authority === $url_authority;
208	}
209
210	/**
211	* Get the frequency for Collection-Synchronization headers.
212	*
213	* @return int Frequency in seconds.
214	*/
215	private static function get_frequency() {
216	/**
217	* Filter the frequency of Collection-Synchronization headers sent to a given authority.
218	*
219	* @param int $frequency The frequency in seconds. Default is one week.
220	* @param int $user_id The local user ID.
221	* @param string $inbox_authority The inbox authority.
222	*/
223	return \apply_filters( 'activitypub_collection_sync_frequency', WEEK_IN_SECONDS );
224	}
225	}
226