v4: users sign in to one gerbeur instance with their account on another — topic instances, each with its own admins, domain and data, had no way to share accounts. Sign-in is federated over a subset of OpenID Connect, the authorization code flow with PKCE: each instance is an identity provider for its own users and a client for the others', and signs what it tells them with an Ed25519 key kept in federation_keys and published at /.well-known/jwks.json, beside its metadata at /.well-known/openid-configuration. Only sign-in is federated: an account from another instance is a local users row linked to (issuer, subject) in user_identities, with no password (password_hash ''), so sessions, roles, permissions, the socket and every foreign key work as before.
A remote user is name@host here, in users.username, in paths (/@alice@music.example) and in mentions, through one handle rule in shared/validation.ts that paths, MENTION_RE and Markdown all build on; Markdown undoes GFM's email autolink of a handle. Their name, email and avatar come from their home at each sign-in and by its signed events (federation_outbox, delivered by the federation job with backoff): a rename at home leaves the old handle an alias here, and a password change or a withdrawn grant ends their sessions here. Their password, email, avatar and name can't change here (assertLocalUser), nor can they sign in elsewhere from here. An admin keeps the trusted and blocked instances on /manage (federation:manage): a trusted instance's users sign in from a button on the login page, a blocked one's can't and are signed out at once, and any other's join with an invite from the register page. The /authorize page asks the user once per instance, and /settings lists the instances their account signs in to, each disconnectable; /login?next= brings a signed-out visitor back to /authorize. Emails stay unique among local accounts only, and migration 0024 adds the tables, makes that index partial and reserves authorize and federation as category slugs. remote/gerbeur-instance.ts is the only way to other instances: https and public addresses only, no redirects, no certificate fallback, unless GERBEUR_FEDERATION_ALLOW_PRIVATE lets two instances on one machine talk. 298 backend tests and 702 frontend tests pass, and deno check, deno fmt, deno lint, tsc, eslint, doc:lint and i18n:compile --strict are clean; checked end to end with two built instances on one machine: sign-in through the other's login and consent pages, consent skipped once granted and asked again after disconnecting, a rename and a password change at home reaching the other, and blocking; screenshots of the login, consent, profile, settings and manage pages at 1280 and 390px. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
khannurien
@@ -222,3 +222,13 @@ export const ALLOWED_ORIGINS: string[] = Array.from(
|
||||
...rawOrigins.split(",").map((o) => o.trim()).filter(Boolean),
|
||||
]),
|
||||
);
|
||||
|
||||
/**
|
||||
* Lets federated sign-in reach instances on private addresses, `localhost`
|
||||
* among them, and over plain http (`GERBEUR_FEDERATION_ALLOW_PRIVATE=1`), so
|
||||
* that two instances on one machine can trust each other in development.
|
||||
* Off, `remote/gerbeur-instance.ts` reaches only public https instances, since
|
||||
* an identity is only as safe as the connection it came over.
|
||||
*/
|
||||
export const FEDERATION_ALLOW_PRIVATE: boolean =
|
||||
Deno.env.get("GERBEUR_FEDERATION_ALLOW_PRIVATE")?.trim() === "1";
|
||||
|
||||
@@ -30,6 +30,7 @@ import { up as up0020DigestSchedule } from "./migrations/0020_digest_schedule.ts
|
||||
import { up as up0021PageUrls } from "./migrations/0021_page_urls.ts";
|
||||
import { up as up0022ReserveCommunity } from "./migrations/0022_reserve_community.ts";
|
||||
import { up as up0023MentionEveryone } from "./migrations/0023_mention_everyone.ts";
|
||||
import { up as up0024Federation } from "./migrations/0024_federation.ts";
|
||||
|
||||
interface Migration {
|
||||
name: string;
|
||||
@@ -72,6 +73,7 @@ const MIGRATIONS: Migration[] = [
|
||||
{ name: "0021_page_urls", up: up0021PageUrls },
|
||||
{ name: "0022_reserve_community", up: up0022ReserveCommunity },
|
||||
{ name: "0023_mention_everyone", up: up0023MentionEveryone },
|
||||
{ name: "0024_federation", up: up0024Federation },
|
||||
];
|
||||
|
||||
/**
|
||||
|
||||
105
api/db/migrations/0024_federation.ts
Normal file
105
api/db/migrations/0024_federation.ts
Normal file
@@ -0,0 +1,105 @@
|
||||
/**
|
||||
* Prepares federated sign-in, by which a user signs in here with their
|
||||
* account on another gerbeur instance, and the other way round. It adds the
|
||||
* instance's signing key, the link from a local account to the one it stands
|
||||
* for elsewhere, the instances an admin trusts or blocks, the state of the
|
||||
* sign-ins in progress on both sides, the grants users gave other instances,
|
||||
* and the events owed to them.
|
||||
*
|
||||
* `/authorize` and `/federation/callback` become pages, so their first
|
||||
* segments are reserved.
|
||||
*
|
||||
* An account from another instance has no password here: its `password_hash`
|
||||
* is `''`, which no password verifies. Emails stay unique among local accounts
|
||||
* only, since the same person may also have a local account, or come from two
|
||||
* instances, with one address.
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
|
||||
import type { DatabaseSync } from "node:sqlite";
|
||||
import { renameReservedCategories } from "../../lib/reserved-slugs.ts";
|
||||
|
||||
/**
|
||||
* Run once by `runMigrations`. Nothing exists to convert, since every account
|
||||
* so far is local, but `authorize` and `federation` become the pages of a
|
||||
* sign-in, so a category that had one as its slug is renamed.
|
||||
*/
|
||||
export function up(db: DatabaseSync): void {
|
||||
db.exec(`
|
||||
CREATE TABLE IF NOT EXISTS federation_keys (
|
||||
kid TEXT PRIMARY KEY,
|
||||
private_jwk TEXT NOT NULL,
|
||||
public_jwk TEXT NOT NULL,
|
||||
created_at TEXT NOT NULL
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS user_identities (
|
||||
user_id TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
|
||||
issuer TEXT NOT NULL,
|
||||
subject TEXT NOT NULL,
|
||||
picture TEXT,
|
||||
synced_at TEXT NOT NULL
|
||||
);
|
||||
CREATE UNIQUE INDEX IF NOT EXISTS idx_user_identities_subject
|
||||
ON user_identities(issuer, subject);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS federation_peers (
|
||||
issuer TEXT PRIMARY KEY,
|
||||
status TEXT NOT NULL,
|
||||
name TEXT,
|
||||
created_at TEXT NOT NULL
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS federation_logins (
|
||||
state TEXT PRIMARY KEY,
|
||||
issuer TEXT NOT NULL,
|
||||
code_verifier TEXT NOT NULL,
|
||||
nonce TEXT NOT NULL,
|
||||
invite_token TEXT,
|
||||
created_at TEXT NOT NULL
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS oauth_codes (
|
||||
code_hash TEXT PRIMARY KEY,
|
||||
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
||||
client_id TEXT NOT NULL,
|
||||
redirect_uri TEXT NOT NULL,
|
||||
code_challenge TEXT NOT NULL,
|
||||
nonce TEXT NOT NULL,
|
||||
expires_at TEXT NOT NULL
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS federation_grants (
|
||||
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
||||
client_id TEXT NOT NULL,
|
||||
client_name TEXT,
|
||||
granted_at TEXT NOT NULL,
|
||||
last_used_at TEXT NOT NULL,
|
||||
PRIMARY KEY (user_id, client_id)
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS federation_outbox (
|
||||
id TEXT PRIMARY KEY,
|
||||
client_id TEXT NOT NULL,
|
||||
event TEXT NOT NULL,
|
||||
attempts INTEGER NOT NULL DEFAULT 0,
|
||||
next_attempt_at TEXT NOT NULL,
|
||||
created_at TEXT NOT NULL
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS idx_federation_outbox_next
|
||||
ON federation_outbox(next_attempt_at);
|
||||
`);
|
||||
|
||||
const emailIndex = db.prepare(
|
||||
`SELECT sql FROM sqlite_master WHERE name = 'idx_users_email_lower';`,
|
||||
).get() as { sql: string } | undefined;
|
||||
if (!emailIndex?.sql.includes("WHERE")) {
|
||||
db.exec(`
|
||||
DROP INDEX IF EXISTS idx_users_email_lower;
|
||||
CREATE UNIQUE INDEX idx_users_email_lower ON users(lower(email))
|
||||
WHERE password_hash != '';
|
||||
`);
|
||||
}
|
||||
renameReservedCategories(db);
|
||||
}
|
||||
@@ -176,7 +176,10 @@ CREATE TABLE invites (
|
||||
CREATE INDEX idx_invites_inviter ON invites(inviter_id);
|
||||
CREATE INDEX idx_users_invited_by ON users(invited_by);
|
||||
CREATE UNIQUE INDEX idx_users_username_lower ON users(lower(username));
|
||||
CREATE UNIQUE INDEX idx_users_email_lower ON users(lower(email));
|
||||
-- An account from another instance has no password (''), and its email may
|
||||
-- also be a local account's.
|
||||
CREATE UNIQUE INDEX idx_users_email_lower ON users(lower(email))
|
||||
WHERE password_hash != '';
|
||||
|
||||
CREATE TABLE attachments (
|
||||
id TEXT PRIMARY KEY,
|
||||
@@ -270,3 +273,65 @@ CREATE TABLE chat_messages (
|
||||
);
|
||||
CREATE INDEX idx_chat_messages_created_id ON chat_messages(created_at, id);
|
||||
CREATE INDEX idx_chat_messages_user ON chat_messages(user_id);
|
||||
|
||||
CREATE TABLE federation_keys (
|
||||
kid TEXT PRIMARY KEY,
|
||||
private_jwk TEXT NOT NULL,
|
||||
public_jwk TEXT NOT NULL,
|
||||
created_at TEXT NOT NULL
|
||||
);
|
||||
|
||||
CREATE TABLE user_identities (
|
||||
user_id TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
|
||||
issuer TEXT NOT NULL,
|
||||
subject TEXT NOT NULL,
|
||||
picture TEXT,
|
||||
synced_at TEXT NOT NULL
|
||||
);
|
||||
CREATE UNIQUE INDEX idx_user_identities_subject
|
||||
ON user_identities(issuer, subject);
|
||||
|
||||
CREATE TABLE federation_peers (
|
||||
issuer TEXT PRIMARY KEY,
|
||||
status TEXT NOT NULL,
|
||||
name TEXT,
|
||||
created_at TEXT NOT NULL
|
||||
);
|
||||
|
||||
CREATE TABLE federation_logins (
|
||||
state TEXT PRIMARY KEY,
|
||||
issuer TEXT NOT NULL,
|
||||
code_verifier TEXT NOT NULL,
|
||||
nonce TEXT NOT NULL,
|
||||
invite_token TEXT,
|
||||
created_at TEXT NOT NULL
|
||||
);
|
||||
|
||||
CREATE TABLE oauth_codes (
|
||||
code_hash TEXT PRIMARY KEY,
|
||||
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
||||
client_id TEXT NOT NULL,
|
||||
redirect_uri TEXT NOT NULL,
|
||||
code_challenge TEXT NOT NULL,
|
||||
nonce TEXT NOT NULL,
|
||||
expires_at TEXT NOT NULL
|
||||
);
|
||||
|
||||
CREATE TABLE federation_grants (
|
||||
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
||||
client_id TEXT NOT NULL,
|
||||
client_name TEXT,
|
||||
granted_at TEXT NOT NULL,
|
||||
last_used_at TEXT NOT NULL,
|
||||
PRIMARY KEY (user_id, client_id)
|
||||
);
|
||||
|
||||
CREATE TABLE federation_outbox (
|
||||
id TEXT PRIMARY KEY,
|
||||
client_id TEXT NOT NULL,
|
||||
event TEXT NOT NULL,
|
||||
attempts INTEGER NOT NULL DEFAULT 0,
|
||||
next_attempt_at TEXT NOT NULL,
|
||||
created_at TEXT NOT NULL
|
||||
);
|
||||
CREATE INDEX idx_federation_outbox_next ON federation_outbox(next_attempt_at);
|
||||
|
||||
113
api/lib/jwt.ts
113
api/lib/jwt.ts
@@ -4,12 +4,27 @@
|
||||
* expiry are checked here: `lib/auth.ts` checks a session or media token
|
||||
* against its user.
|
||||
*
|
||||
* It also signs and verifies the tokens instances exchange for federated
|
||||
* sign-in (identity tokens and events), EdDSA with the instance's Ed25519 key,
|
||||
* whose public half other instances fetch: `instance-key-service.ts` keeps
|
||||
* the key, and the federation services pass it in.
|
||||
*
|
||||
* Importing this module throws when `GERBEUR_JWT_SECRET` is unset.
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
|
||||
import { jwtVerify, SignJWT } from "@panva/jose";
|
||||
import {
|
||||
createLocalJWKSet,
|
||||
exportJWK,
|
||||
generateKeyPair,
|
||||
importJWK,
|
||||
type JSONWebKeySet,
|
||||
type JWK,
|
||||
type JWTPayload,
|
||||
jwtVerify,
|
||||
SignJWT,
|
||||
} from "@panva/jose";
|
||||
|
||||
import {
|
||||
type AuthPayload,
|
||||
@@ -184,3 +199,99 @@ export async function verifyUnsubscribeToken(
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The algorithm of the tokens instances exchange: Ed25519 signatures, short
|
||||
* and fast, with no parameters to get wrong.
|
||||
*/
|
||||
const INSTANCE_ALG = "EdDSA";
|
||||
|
||||
/**
|
||||
* An instance's key, ready to sign, from {@link importInstanceKey}. Its
|
||||
* `kid` names the public half in the instance's JWKS.
|
||||
*/
|
||||
export interface InstanceSigningKey {
|
||||
kid: string;
|
||||
privateKey: CryptoKey;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns a new Ed25519 key pair as JWKs, with a random `kid`, for
|
||||
* `instance-key-service.ts` to store when the instance has none. The public
|
||||
* JWK carries the `kid`, `alg` and `use` a JWKS entry needs.
|
||||
*/
|
||||
export async function generateInstanceKey(): Promise<
|
||||
{ kid: string; privateJwk: JWK; publicJwk: JWK }
|
||||
> {
|
||||
const { privateKey, publicKey } = await generateKeyPair(INSTANCE_ALG, {
|
||||
crv: "Ed25519",
|
||||
extractable: true,
|
||||
});
|
||||
const kid = crypto.randomUUID();
|
||||
return {
|
||||
kid,
|
||||
privateJwk: await exportJWK(privateKey),
|
||||
publicJwk: {
|
||||
...await exportJWK(publicKey),
|
||||
kid,
|
||||
alg: INSTANCE_ALG,
|
||||
use: "sig",
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
/** Returns the stored private JWK `privateJwk` as a key to sign with. */
|
||||
export async function importInstanceKey(
|
||||
kid: string,
|
||||
privateJwk: JWK,
|
||||
): Promise<InstanceSigningKey> {
|
||||
const privateKey = await importJWK(privateJwk, INSTANCE_ALG);
|
||||
if (!(privateKey instanceof CryptoKey)) {
|
||||
throw new Error("The instance key is not an asymmetric key");
|
||||
}
|
||||
return { kid, privateKey };
|
||||
}
|
||||
|
||||
/**
|
||||
* Signs `payload` with the instance's key, from `issuer` (this instance) to
|
||||
* `audience` (the instance it is for), valid for `expiresIn`, with a random
|
||||
* `jti`. The identity tokens of `POST /api/oauth/tokens` and the events of
|
||||
* the outbox are signed with it.
|
||||
*/
|
||||
export async function signInstanceToken(
|
||||
payload: JWTPayload,
|
||||
key: InstanceSigningKey,
|
||||
claims: { issuer: string; audience: string; subject: string },
|
||||
expiresIn: string,
|
||||
): Promise<string> {
|
||||
return await new SignJWT(payload)
|
||||
.setProtectedHeader({ alg: INSTANCE_ALG, kid: key.kid })
|
||||
.setIssuer(claims.issuer)
|
||||
.setAudience(claims.audience)
|
||||
.setSubject(claims.subject)
|
||||
.setIssuedAt()
|
||||
.setJti(crypto.randomUUID())
|
||||
.setExpirationTime(expiresIn)
|
||||
.sign(key.privateKey);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the payload of `token` once its signature checks against `jwks`,
|
||||
* the keys of `issuer`, and it is addressed to `audience` and unexpired.
|
||||
*
|
||||
* @throws {Error} jose's error when it doesn't verify; its `code` is
|
||||
* `ERR_JWKS_NO_MATCHING_KEY` when no key of `jwks` has its `kid`, which
|
||||
* tells the caller to refetch the keys, the issuer having rotated them.
|
||||
*/
|
||||
export async function verifyInstanceToken(
|
||||
token: string,
|
||||
jwks: JSONWebKeySet,
|
||||
claims: { issuer: string; audience: string },
|
||||
): Promise<JWTPayload> {
|
||||
const { payload } = await jwtVerify(token, createLocalJWKSet(jwks), {
|
||||
issuer: claims.issuer,
|
||||
audience: claims.audience,
|
||||
algorithms: [INSTANCE_ALG],
|
||||
});
|
||||
return payload;
|
||||
}
|
||||
|
||||
@@ -32,6 +32,8 @@ export const RESERVED_SLUGS: readonly string[] = [
|
||||
"settings",
|
||||
"manage",
|
||||
"community",
|
||||
"authorize",
|
||||
"federation",
|
||||
"api",
|
||||
"ws",
|
||||
"assets",
|
||||
@@ -46,7 +48,8 @@ export function isReservedSlug(slug: string): boolean {
|
||||
/**
|
||||
* Renames each category whose slug is now reserved, such as `hot`, to the
|
||||
* first of `<slug>-2`, `<slug>-3`… that is free, and logs it. Migration 0021
|
||||
* runs it for v4's words, and 0022 for `community`.
|
||||
* runs it for v4's words, 0022 for `community`, and 0024 for `authorize` and
|
||||
* `federation`.
|
||||
*/
|
||||
export function renameReservedCategories(db: DatabaseSync): void {
|
||||
const rows = db.prepare(`SELECT id, slug FROM categories;`).all() as {
|
||||
|
||||
@@ -19,10 +19,12 @@ import communityRouter from "./routes/community.ts";
|
||||
import commentsRouter from "./routes/comments.ts";
|
||||
import dumpsRouter from "./routes/dumps.ts";
|
||||
import filesRouter from "./routes/files.ts";
|
||||
import federationRouter from "./routes/federation.ts";
|
||||
import followsRouter from "./routes/follows.ts";
|
||||
import invitesRouter from "./routes/invites.ts";
|
||||
import meRouter from "./routes/me.ts";
|
||||
import notificationsRouter from "./routes/notifications.ts";
|
||||
import oauthRouter from "./routes/oauth.ts";
|
||||
import passwordResetsRouter from "./routes/password-resets.ts";
|
||||
import playlistsRouter from "./routes/playlists.ts";
|
||||
import remoteRouter from "./routes/remote.ts";
|
||||
@@ -32,6 +34,7 @@ import thumbnailsRouter from "./routes/thumbnails.ts";
|
||||
import waveformsRouter from "./routes/waveforms.ts";
|
||||
import unsubscribeRouter from "./routes/unsubscribe.ts";
|
||||
import usersRouter from "./routes/users.ts";
|
||||
import wellKnownRouter from "./routes/well-known.ts";
|
||||
import wsRouter from "./routes/ws.ts";
|
||||
|
||||
import { ALLOWED_ORIGINS, LISTEN_HOST, PORT, PUBLIC_URL } from "./config.ts";
|
||||
@@ -43,6 +46,7 @@ import { rateLimitSweepJob } from "./lib/rate-limit.ts";
|
||||
import { digestJob } from "./services/digest-service.ts";
|
||||
import { communityJob } from "./services/community-service.ts";
|
||||
import { pingJob, typingExpiryJob } from "./services/ws-service.ts";
|
||||
import { outboxJob } from "./services/identity-provider-service.ts";
|
||||
|
||||
/**
|
||||
* The whole server, exported so the tests' helpers can send it requests
|
||||
@@ -87,6 +91,9 @@ for (
|
||||
invitesRouter,
|
||||
attachmentsRouter,
|
||||
remoteRouter,
|
||||
federationRouter,
|
||||
oauthRouter,
|
||||
wellKnownRouter,
|
||||
wsRouter,
|
||||
]
|
||||
) {
|
||||
@@ -114,6 +121,7 @@ if (import.meta.main) {
|
||||
pingJob,
|
||||
typingExpiryJob,
|
||||
rateLimitSweepJob,
|
||||
outboxJob,
|
||||
]);
|
||||
await app.listen({ hostname: LISTEN_HOST, port: PORT });
|
||||
}
|
||||
|
||||
@@ -19,8 +19,22 @@ import {
|
||||
* it carries the password hash.
|
||||
*/
|
||||
export interface User extends SelfUser {
|
||||
/** From `hashPassword`, as `hash.salt`. */
|
||||
passwordHash: string;
|
||||
/**
|
||||
* From `hashPassword`, as `hash.salt`, or null for an account from another
|
||||
* instance ({@link isRemoteUser}), which signs in there and never with a
|
||||
* password here. The row stores that as `''`.
|
||||
*/
|
||||
passwordHash: string | null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Checks whether `user`'s account lives on another instance, whose user signs
|
||||
* in here through federation (`federation-service.ts`). Their password,
|
||||
* email, avatar and name are that instance's to change, so the routes that
|
||||
* change them here refuse.
|
||||
*/
|
||||
export function isRemoteUser(user: User): boolean {
|
||||
return user.passwordHash === null;
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -49,6 +63,7 @@ export function toSelfUser({ passwordHash: _, ...user }: User): SelfUser {
|
||||
export interface UserRow {
|
||||
id: string;
|
||||
username: string;
|
||||
/** `''` for an account from another instance, which has no password. */
|
||||
password_hash: string;
|
||||
role: Role;
|
||||
created_at: string;
|
||||
@@ -97,7 +112,7 @@ export function userRowToApi(row: UserRow): User {
|
||||
return {
|
||||
id: row.id,
|
||||
username: row.username,
|
||||
passwordHash: row.password_hash,
|
||||
passwordHash: row.password_hash || null,
|
||||
role: row.role,
|
||||
createdAt: new Date(row.created_at),
|
||||
updatedAt: row.updated_at ? new Date(row.updated_at) : undefined,
|
||||
@@ -118,7 +133,7 @@ export function userApiToRow(user: User): UserRow {
|
||||
return {
|
||||
id: user.id,
|
||||
username: user.username,
|
||||
password_hash: user.passwordHash,
|
||||
password_hash: user.passwordHash ?? "",
|
||||
role: user.role,
|
||||
created_at: user.createdAt.toISOString(),
|
||||
updated_at: user.updatedAt?.toISOString() ?? null,
|
||||
|
||||
224
api/remote/gerbeur-instance.ts
Normal file
224
api/remote/gerbeur-instance.ts
Normal file
@@ -0,0 +1,224 @@
|
||||
/**
|
||||
* Talks to other gerbeur instances for federated sign-in: it reads their
|
||||
* metadata and public keys, trades a code for an identity token, delivers
|
||||
* events, and fetches a user's avatar. `federation-service.ts`,
|
||||
* `identity-provider-service.ts` and `federation-peer-service.ts` reach other
|
||||
* instances only through it.
|
||||
*
|
||||
* An identity is only as safe as the connection it came over, so unlike
|
||||
* `fetch.ts` it never falls back to skipping certificate checks, and follows
|
||||
* no redirect. It reaches only https instances on public addresses, unless
|
||||
* `GERBEUR_FEDERATION_ALLOW_PRIVATE` lets two instances on one machine talk.
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
|
||||
import type { JSONWebKeySet } from "@panva/jose";
|
||||
import {
|
||||
type InstanceMetadata,
|
||||
isInstanceMetadata,
|
||||
} from "../../shared/federation.ts";
|
||||
import {
|
||||
FEDERATION_ALLOW_PRIVATE,
|
||||
MAX_IMAGE_SIZE_BYTES,
|
||||
OG_SITE_NAME,
|
||||
} from "../config.ts";
|
||||
import { resolvePublicAddress } from "./public-address.ts";
|
||||
import { readBytesCapped, readTextCapped } from "./fetch.ts";
|
||||
import { TtlCache } from "../lib/ttl-cache.ts";
|
||||
|
||||
/** How long a request to another instance may take, body included. */
|
||||
const TIMEOUT_MS = 8000;
|
||||
|
||||
/** Caps a metadata document, a key set or a token response. */
|
||||
const MAX_JSON_BYTES = 64 * 1024;
|
||||
|
||||
const USER_AGENT = `gerbeur (${OG_SITE_NAME}; federation)`;
|
||||
|
||||
/**
|
||||
* Keeps each instance's metadata and keys for 10 minutes, so that a sign-in
|
||||
* or an event doesn't fetch them each time. A key set is refetched sooner
|
||||
* when a token names a key it lacks ({@link fetchKeys} with `fresh`).
|
||||
*/
|
||||
const metadataCache = new TtlCache<InstanceMetadata>(10 * 60_000, 500);
|
||||
const keysCache = new TtlCache<JSONWebKeySet>(10 * 60_000, 500);
|
||||
|
||||
/**
|
||||
* Checks that `url` may be reached: https on a public address, or anything
|
||||
* under `GERBEUR_FEDERATION_ALLOW_PRIVATE`.
|
||||
*
|
||||
* @throws {Error} When it may not.
|
||||
*/
|
||||
export async function assertReachable(url: URL): Promise<void> {
|
||||
if (FEDERATION_ALLOW_PRIVATE) {
|
||||
if (url.protocol !== "https:" && url.protocol !== "http:") {
|
||||
throw new Error(`Unsupported protocol ${url.protocol}`);
|
||||
}
|
||||
return;
|
||||
}
|
||||
if (url.protocol !== "https:") {
|
||||
throw new Error(`Refusing to reach ${url.origin} without https`);
|
||||
}
|
||||
await resolvePublicAddress(url);
|
||||
}
|
||||
|
||||
/**
|
||||
* Makes one request to another instance, after {@link assertReachable}, with
|
||||
* the deadline covering the body. The caller reads or cancels the body.
|
||||
*/
|
||||
async function request(url: string, init: RequestInit = {}): Promise<Response> {
|
||||
const target = new URL(url);
|
||||
await assertReachable(target);
|
||||
return await fetch(target, {
|
||||
...init,
|
||||
redirect: "error",
|
||||
signal: AbortSignal.timeout(TIMEOUT_MS),
|
||||
headers: {
|
||||
"User-Agent": USER_AGENT,
|
||||
"Accept": "application/json",
|
||||
...init.headers,
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the JSON body of `res`, up to {@link MAX_JSON_BYTES}.
|
||||
*
|
||||
* @throws {Error} When the status isn't a success or the body isn't JSON.
|
||||
*/
|
||||
async function readJson(res: Response, what: string): Promise<unknown> {
|
||||
if (!res.ok) {
|
||||
await res.body?.cancel();
|
||||
throw new Error(`${what} answered ${res.status}`);
|
||||
}
|
||||
return JSON.parse(await readTextCapped(res, MAX_JSON_BYTES));
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the metadata of the instance at `origin`, from its
|
||||
* `/.well-known/openid-configuration`, cached. It must name `origin` as its
|
||||
* issuer and speak this protocol's version.
|
||||
*
|
||||
* @throws {Error} When it can't be reached or isn't a gerbeur instance.
|
||||
*/
|
||||
export async function fetchMetadata(origin: string): Promise<InstanceMetadata> {
|
||||
const hit = metadataCache.get(origin);
|
||||
if (hit) return hit;
|
||||
const body = await readJson(
|
||||
await request(`${origin}/.well-known/openid-configuration`),
|
||||
origin,
|
||||
);
|
||||
if (!isInstanceMetadata(body)) {
|
||||
throw new Error(`${origin} is not a gerbeur instance this one can trust`);
|
||||
}
|
||||
if (body.issuer !== origin) {
|
||||
throw new Error(`${origin} names itself ${body.issuer}`);
|
||||
}
|
||||
return metadataCache.set(origin, body);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the public keys of the instance at `origin`, cached unless `fresh`
|
||||
* asks to refetch them.
|
||||
*
|
||||
* @throws {Error} When they can't be fetched.
|
||||
*/
|
||||
export async function fetchKeys(
|
||||
origin: string,
|
||||
fresh = false,
|
||||
): Promise<JSONWebKeySet> {
|
||||
const hit = fresh ? undefined : keysCache.get(origin);
|
||||
if (hit) return hit;
|
||||
const { jwks_uri } = await fetchMetadata(origin);
|
||||
const body = await readJson(await request(jwks_uri), `${origin}'s keys`);
|
||||
if (
|
||||
!body || typeof body !== "object" ||
|
||||
!Array.isArray((body as { keys?: unknown }).keys)
|
||||
) {
|
||||
throw new Error(`${origin}'s keys are not a key set`);
|
||||
}
|
||||
return keysCache.set(origin, body as JSONWebKeySet);
|
||||
}
|
||||
|
||||
/**
|
||||
* Trades `code` for an identity token at the token endpoint of the instance
|
||||
* at `origin`, and returns the token, unverified.
|
||||
*
|
||||
* @throws {Error} When the instance refuses or answers no token.
|
||||
*/
|
||||
export async function exchangeCode(
|
||||
origin: string,
|
||||
params: {
|
||||
code: string;
|
||||
clientId: string;
|
||||
redirectUri: string;
|
||||
codeVerifier: string;
|
||||
},
|
||||
): Promise<string> {
|
||||
const { token_endpoint } = await fetchMetadata(origin);
|
||||
const body = await readJson(
|
||||
await request(token_endpoint, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/x-www-form-urlencoded" },
|
||||
body: new URLSearchParams({
|
||||
grant_type: "authorization_code",
|
||||
code: params.code,
|
||||
client_id: params.clientId,
|
||||
redirect_uri: params.redirectUri,
|
||||
code_verifier: params.codeVerifier,
|
||||
}),
|
||||
}),
|
||||
`${origin}'s token endpoint`,
|
||||
);
|
||||
const idToken = (body as { id_token?: unknown } | null)?.id_token;
|
||||
if (typeof idToken !== "string") {
|
||||
throw new Error(`${origin} answered no identity token`);
|
||||
}
|
||||
return idToken;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sends the signed event `event` to the events endpoint of the instance at
|
||||
* `origin`, and returns whether it took it. A 4xx other than 429 means it never
|
||||
* will, which the caller treats as delivered.
|
||||
*
|
||||
* @throws {Error} When it can't be reached, or answers 429 or a 5xx.
|
||||
*/
|
||||
export async function postEvent(
|
||||
origin: string,
|
||||
event: string,
|
||||
): Promise<boolean> {
|
||||
const { gerbeur_events_endpoint } = await fetchMetadata(origin);
|
||||
const res = await request(gerbeur_events_endpoint, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ event }),
|
||||
});
|
||||
await res.body?.cancel();
|
||||
if (res.ok) return true;
|
||||
if (res.status === 429 || res.status >= 500) {
|
||||
throw new Error(`${origin}'s events endpoint answered ${res.status}`);
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the image at `url`, a user's avatar on their home instance, up to
|
||||
* the size an avatar may be.
|
||||
*
|
||||
* @throws {Error} When it can't be fetched.
|
||||
*/
|
||||
export async function fetchAvatar(url: string): Promise<Uint8Array> {
|
||||
const res = await request(url, { headers: { "Accept": "image/*" } });
|
||||
if (!res.ok) {
|
||||
await res.body?.cancel();
|
||||
throw new Error(`The avatar at ${url} answered ${res.status}`);
|
||||
}
|
||||
return await readBytesCapped(res, MAX_IMAGE_SIZE_BYTES + 1);
|
||||
}
|
||||
|
||||
/** Empties the caches, for the tests' reset between cases. */
|
||||
export function clearInstanceCaches(): void {
|
||||
metadataCache.clear();
|
||||
keysCache.clear();
|
||||
}
|
||||
@@ -5,7 +5,8 @@
|
||||
*
|
||||
* - `PUT /api/me/avatar` — signed in. Replaces the caller's avatar (multipart
|
||||
* `file`, at most 5 MB), sends `user_updated` to everyone, and answers the
|
||||
* caller's user.
|
||||
* caller's user. 400 for an account from another instance, whose avatar
|
||||
* comes from there. The instances the caller signed in to are told.
|
||||
* - `GET /api/users/:key/avatar` — public. Serves a user's avatar; 404 without
|
||||
* one.
|
||||
*
|
||||
@@ -15,23 +16,17 @@
|
||||
import { Router } from "@oak/oak";
|
||||
import { authMiddleware } from "../middleware/auth.ts";
|
||||
import {
|
||||
assertLocalUser,
|
||||
getUserById,
|
||||
resolveUserKey,
|
||||
updateUserAvatar,
|
||||
setUserAvatar,
|
||||
} from "../services/user-service.ts";
|
||||
import {
|
||||
broadcastUserUpdated,
|
||||
updateClientAvatar,
|
||||
} from "../services/ws-service.ts";
|
||||
import { type APIResponse } from "../../shared/api.ts";
|
||||
import { APIException } from "../lib/api-exception.ts";
|
||||
import type { SelfUser } from "../../shared/user.ts";
|
||||
import { toPublicUser, toSelfUser } from "../model/user.ts";
|
||||
import {
|
||||
replaceUploadedFile,
|
||||
serveUploadedFile,
|
||||
validateImageUpload,
|
||||
} from "../lib/upload.ts";
|
||||
import { toSelfUser } from "../model/user.ts";
|
||||
import { serveUploadedFile } from "../lib/upload.ts";
|
||||
import { notifyClients } from "../services/identity-provider-service.ts";
|
||||
import { AVATARS_DIR } from "../config.ts";
|
||||
|
||||
/**
|
||||
@@ -54,19 +49,12 @@ router.put("/api/me/avatar", authMiddleware, async (ctx) => {
|
||||
throw new APIException(400, "Missing file field");
|
||||
}
|
||||
|
||||
const data = new Uint8Array(await file.arrayBuffer());
|
||||
const mime = validateImageUpload(data);
|
||||
|
||||
// Written before the record announces it, or clients would fetch it too
|
||||
// early.
|
||||
await replaceUploadedFile(`${AVATARS_DIR}/${authPayload.userId}`, data);
|
||||
updateUserAvatar(authPayload.userId, mime);
|
||||
updateClientAvatar(authPayload.userId, mime);
|
||||
|
||||
const user = getUserById(authPayload.userId);
|
||||
// Presence alone would update only the online list; `user_updated` reaches
|
||||
// every avatar on screen, and its bumped `updatedAt` busts their cache.
|
||||
broadcastUserUpdated(toPublicUser(user));
|
||||
assertLocalUser(getUserById(authPayload.userId));
|
||||
const user = await setUserAvatar(
|
||||
authPayload.userId,
|
||||
new Uint8Array(await file.arrayBuffer()),
|
||||
);
|
||||
await notifyClients(user.id, { type: "update" });
|
||||
const responseBody: APIResponse<SelfUser> = {
|
||||
success: true,
|
||||
data: toSelfUser(user),
|
||||
|
||||
149
api/routes/federation.ts
Normal file
149
api/routes/federation.ts
Normal file
@@ -0,0 +1,149 @@
|
||||
/**
|
||||
* Lets users of other gerbeur instances sign in here with their account
|
||||
* there, as `federation-service.ts` describes, and lets admins pick the
|
||||
* instances to trust or block. The login and register pages start a sign-in,
|
||||
* the `/federation/callback` page finishes it, `/manage` edits the peers, and
|
||||
* the other instances' servers send their events.
|
||||
*
|
||||
* - `POST /api/federation/logins` — public. Starts a sign-in with an account
|
||||
* on another instance (`FederationLoginRequest`, with an invite unless it
|
||||
* is trusted), and answers its `/authorize` page to go to. Rate-limited per
|
||||
* instance.
|
||||
* - `POST /api/federation/sessions` — public. Finishes it
|
||||
* (`FederationSessionRequest`) and answers the user and their tokens, as a
|
||||
* sign-in does. Rate-limited per instance.
|
||||
* - `POST /api/federation/events` — public, server to server. Applies a
|
||||
* home instance's signed event about one of its users (`{ event }`).
|
||||
* - `GET /api/federation/peers` — optional sign-in. Answers the trusted
|
||||
* instances, or every listed one to `federation:manage`.
|
||||
* - `PUT /api/federation/peers` — permission `federation:manage`. Trusts or
|
||||
* blocks an instance (`SetPeerRequest`) and answers it; 502 when it
|
||||
* doesn't answer as a gerbeur.
|
||||
* - `DELETE /api/federation/peers/:host` — permission `federation:manage`.
|
||||
* Takes an instance off the lists.
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
|
||||
import { Router } from "@oak/oak";
|
||||
import type { APIResponse } from "../../shared/api.ts";
|
||||
import {
|
||||
type FederationLoginResponse,
|
||||
type FederationPeer,
|
||||
parseInstance,
|
||||
} from "../../shared/federation.ts";
|
||||
import type { AuthResponse } from "../../shared/user.ts";
|
||||
import { APIException } from "../lib/api-exception.ts";
|
||||
import { parseOptionalAuth } from "../lib/auth.ts";
|
||||
import { issueTokens } from "../lib/jwt.ts";
|
||||
import { hasPermission } from "../../shared/permissions.ts";
|
||||
import { type RateLimit, takeToken } from "../lib/rate-limit.ts";
|
||||
import {
|
||||
type AuthContext,
|
||||
authMiddleware,
|
||||
requirePermission,
|
||||
} from "../middleware/auth.ts";
|
||||
import { toSelfUser } from "../model/user.ts";
|
||||
import {
|
||||
isFederationLoginRequest,
|
||||
isFederationSessionRequest,
|
||||
isSetPeerRequest,
|
||||
} from "../validators/federation.ts";
|
||||
import {
|
||||
completeLogin,
|
||||
receiveEvent,
|
||||
startLogin,
|
||||
} from "../services/federation-service.ts";
|
||||
import {
|
||||
listPeers,
|
||||
removePeer,
|
||||
setPeer,
|
||||
} from "../services/federation-peer-service.ts";
|
||||
import { getUserById } from "../services/user-service.ts";
|
||||
import { fieldOf } from "../validators/user.ts";
|
||||
|
||||
/**
|
||||
* Allows a burst of 30 sign-ins per instance, then one every 2 seconds, so
|
||||
* that nobody makes this instance hammer another.
|
||||
*/
|
||||
const LOGIN_LIMIT: RateLimit = { capacity: 30, refill: 1 / 2 };
|
||||
|
||||
/**
|
||||
* Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware.
|
||||
* An `APIException` thrown by a handler becomes the JSON error response there.
|
||||
*/
|
||||
const router: Router = new Router({ prefix: "/api/federation" });
|
||||
|
||||
router.post("/logins", async (ctx) => {
|
||||
const body: unknown = await ctx.request.body.json();
|
||||
if (!isFederationLoginRequest(body)) {
|
||||
throw new APIException(400, "Invalid request");
|
||||
}
|
||||
if (!takeToken(`federation:${parseInstance(body.instance)}`, LOGIN_LIMIT)) {
|
||||
throw new APIException(429, "Too many sign-ins — try again in a minute");
|
||||
}
|
||||
const responseBody: APIResponse<FederationLoginResponse> = {
|
||||
success: true,
|
||||
data: { authorizeUrl: await startLogin(body) },
|
||||
};
|
||||
ctx.response.body = responseBody;
|
||||
});
|
||||
|
||||
router.post("/sessions", async (ctx) => {
|
||||
const body: unknown = await ctx.request.body.json();
|
||||
if (!isFederationSessionRequest(body)) {
|
||||
throw new APIException(400, "Invalid request");
|
||||
}
|
||||
const user = await completeLogin(body);
|
||||
const responseBody: APIResponse<AuthResponse> = {
|
||||
success: true,
|
||||
data: { ...await issueTokens(user), user: toSelfUser(user) },
|
||||
};
|
||||
ctx.response.body = responseBody;
|
||||
});
|
||||
|
||||
router.post("/events", async (ctx) => {
|
||||
const event = fieldOf(await ctx.request.body.json(), "event");
|
||||
if (typeof event !== "string") throw new APIException(400, "Invalid event");
|
||||
await receiveEvent(event);
|
||||
ctx.response.status = 204;
|
||||
});
|
||||
|
||||
router.get("/peers", async (ctx) => {
|
||||
const userId = await parseOptionalAuth(ctx);
|
||||
const all = !!userId &&
|
||||
hasPermission(getUserById(userId).role, "federation:manage");
|
||||
const responseBody: APIResponse<FederationPeer[]> = {
|
||||
success: true,
|
||||
data: listPeers(!all),
|
||||
};
|
||||
ctx.response.body = responseBody;
|
||||
});
|
||||
|
||||
router.put(
|
||||
"/peers",
|
||||
authMiddleware,
|
||||
requirePermission("federation:manage"),
|
||||
async (ctx: AuthContext) => {
|
||||
const body: unknown = await ctx.request.body.json();
|
||||
if (!isSetPeerRequest(body)) throw new APIException(400, "Invalid request");
|
||||
const responseBody: APIResponse<FederationPeer> = {
|
||||
success: true,
|
||||
data: await setPeer(body.instance, body.status),
|
||||
};
|
||||
ctx.response.body = responseBody;
|
||||
},
|
||||
);
|
||||
|
||||
router.delete(
|
||||
"/peers/:host",
|
||||
authMiddleware,
|
||||
requirePermission("federation:manage"),
|
||||
(ctx: AuthContext<"/peers/:host">) => {
|
||||
removePeer(ctx.params.host);
|
||||
const responseBody: APIResponse<null> = { success: true, data: null };
|
||||
ctx.response.body = responseBody;
|
||||
},
|
||||
);
|
||||
|
||||
export default router;
|
||||
@@ -7,7 +7,8 @@
|
||||
*
|
||||
* - `GET /api/me` — signed in. Answers the caller's own user.
|
||||
* - `PATCH /api/me` — signed in. Changes the caller's description and email,
|
||||
* and answers their user. A username changes only by `user:manage`, through
|
||||
* and answers their user. The email of an account from another instance is
|
||||
* that instance's: 400. A username changes only by `user:manage`, through
|
||||
* `PATCH /api/users/:key/username`.
|
||||
* - `GET /api/me/media-token` — signed in. Answers a media token, for a
|
||||
* session that predates them.
|
||||
@@ -15,9 +16,17 @@
|
||||
* - `PATCH /api/me/settings` — signed in. Changes some of the caller's
|
||||
* settings, and answers them all.
|
||||
* - `PUT /api/me/password` — signed in, with the current password. Sets a new
|
||||
* one, ending every other session, and answers fresh tokens.
|
||||
* one, ending every other session, and answers fresh tokens. 400 for an
|
||||
* account from another instance, which has no password here.
|
||||
* - `GET /api/me/playlists?contains=:dumpId` — signed in. Answers each of the
|
||||
* caller's playlists and whether it holds the dump.
|
||||
* - `GET /api/me/grants` — signed in. Answers the other instances the caller
|
||||
* let their account sign in to.
|
||||
* - `DELETE /api/me/grants/:host` — signed in. Withdraws that grant, which
|
||||
* ends the caller's sessions there.
|
||||
*
|
||||
* A change to the caller's email or password is told to those instances
|
||||
* (`notifyClients`).
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
@@ -39,11 +48,21 @@ import { toPublicUser, toSelfUser } from "../model/user.ts";
|
||||
import { createMediaToken, issueTokens } from "../lib/jwt.ts";
|
||||
import { verifyPassword } from "../lib/password.ts";
|
||||
import { type AuthContext, authMiddleware } from "../middleware/auth.ts";
|
||||
import { getUserById, updateUser } from "../services/user-service.ts";
|
||||
import {
|
||||
assertLocalUser,
|
||||
getUserById,
|
||||
updateUser,
|
||||
} from "../services/user-service.ts";
|
||||
import { getSettings, updateSettings } from "../services/settings-service.ts";
|
||||
import { getPlaylistMembershipsForDump } from "../services/playlist-service.ts";
|
||||
import { broadcastUserUpdated } from "../services/ws-service.ts";
|
||||
import { VALIDATION } from "../../shared/validation.ts";
|
||||
import type { FederationGrant } from "../../shared/federation.ts";
|
||||
import {
|
||||
listGrants,
|
||||
notifyClients,
|
||||
revokeGrant,
|
||||
} from "../services/identity-provider-service.ts";
|
||||
|
||||
/**
|
||||
* Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware.
|
||||
@@ -65,6 +84,7 @@ router.patch("/", authMiddleware, async (ctx: AuthContext) => {
|
||||
throw new APIException(400, "Invalid request");
|
||||
}
|
||||
const userId = ctx.state.user.userId;
|
||||
if (body.email !== undefined) assertLocalUser(getUserById(userId));
|
||||
// Only these fields: a stolen token alone must not change the role or the
|
||||
// password, which needs the current one.
|
||||
const updated = await updateUser(userId, {
|
||||
@@ -72,6 +92,7 @@ router.patch("/", authMiddleware, async (ctx: AuthContext) => {
|
||||
email: body.email,
|
||||
});
|
||||
broadcastUserUpdated(toPublicUser(updated));
|
||||
if (body.email !== undefined) await notifyClients(userId, { type: "update" });
|
||||
const responseBody: APIResponse<SelfUser> = {
|
||||
success: true,
|
||||
data: toSelfUser(updated),
|
||||
@@ -127,7 +148,8 @@ router.put("/password", authMiddleware, async (ctx: AuthContext) => {
|
||||
}
|
||||
|
||||
const user = getUserById(ctx.state.user.userId);
|
||||
const valid = await verifyPassword(currentPassword, user.passwordHash);
|
||||
assertLocalUser(user);
|
||||
const valid = await verifyPassword(currentPassword, user.passwordHash ?? "");
|
||||
if (!valid) {
|
||||
throw new APIException(403, "Current password is incorrect");
|
||||
}
|
||||
@@ -137,6 +159,7 @@ router.put("/password", authMiddleware, async (ctx: AuthContext) => {
|
||||
const updated = await updateUser(ctx.state.user.userId, {
|
||||
password: newPassword,
|
||||
});
|
||||
await notifyClients(updated.id, { type: "revoke" });
|
||||
const responseBody: APIResponse<AuthTokens> = {
|
||||
success: true,
|
||||
data: await issueTokens(updated),
|
||||
@@ -154,4 +177,22 @@ router.get("/playlists", authMiddleware, (ctx: AuthContext) => {
|
||||
ctx.response.body = responseBody;
|
||||
});
|
||||
|
||||
router.get("/grants", authMiddleware, (ctx: AuthContext) => {
|
||||
const responseBody: APIResponse<FederationGrant[]> = {
|
||||
success: true,
|
||||
data: listGrants(ctx.state.user.userId),
|
||||
};
|
||||
ctx.response.body = responseBody;
|
||||
});
|
||||
|
||||
router.delete(
|
||||
"/grants/:host",
|
||||
authMiddleware,
|
||||
async (ctx: AuthContext<"/grants/:host">) => {
|
||||
await revokeGrant(ctx.state.user.userId, ctx.params.host);
|
||||
const responseBody: APIResponse<null> = { success: true, data: null };
|
||||
ctx.response.body = responseBody;
|
||||
},
|
||||
);
|
||||
|
||||
export default router;
|
||||
|
||||
78
api/routes/oauth.ts
Normal file
78
api/routes/oauth.ts
Normal file
@@ -0,0 +1,78 @@
|
||||
/**
|
||||
* Lets this instance's users sign in to other gerbeur instances with their
|
||||
* account here, as `identity-provider-service.ts` describes. The client's
|
||||
* `/authorize` page calls the first two; the other instance's server calls the
|
||||
* last.
|
||||
*
|
||||
* - `GET /api/oauth/clients?client_id=` — signed in. Answers the instance
|
||||
* asking to sign the caller in (`OAuthClient`), and whether they already
|
||||
* let it; 400 for an account from another instance, 403 when that instance
|
||||
* is blocked here, 502 when it doesn't answer as a gerbeur.
|
||||
* - `POST /api/oauth/codes` — signed in. Records the caller's consent to the
|
||||
* request (`AuthorizeRequest`) and answers where to send them, the
|
||||
* instance's callback page with a code.
|
||||
* - `POST /api/oauth/tokens` — public, form-encoded, server to server. Trades
|
||||
* a code and its PKCE verifier for an identity token (`id_token`), bare
|
||||
* JSON as OAuth has it; 400 when anything doesn't match. Rate-limited per
|
||||
* client.
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
|
||||
import { Router } from "@oak/oak";
|
||||
import type { APIResponse } from "../../shared/api.ts";
|
||||
import type {
|
||||
AuthorizeResponse,
|
||||
OAuthClient,
|
||||
} from "../../shared/federation.ts";
|
||||
import { APIException } from "../lib/api-exception.ts";
|
||||
import { type RateLimit, takeToken } from "../lib/rate-limit.ts";
|
||||
import { type AuthContext, authMiddleware } from "../middleware/auth.ts";
|
||||
import { isAuthorizeRequest } from "../validators/federation.ts";
|
||||
import {
|
||||
createAuthorizationCode,
|
||||
describeClient,
|
||||
exchangeCode,
|
||||
} from "../services/identity-provider-service.ts";
|
||||
|
||||
/** Allows a burst of 30 code trades per client instance, then one a second. */
|
||||
const TOKEN_LIMIT: RateLimit = { capacity: 30, refill: 1 };
|
||||
|
||||
/**
|
||||
* Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware.
|
||||
* An `APIException` thrown by a handler becomes the JSON error response there.
|
||||
*/
|
||||
const router: Router = new Router({ prefix: "/api/oauth" });
|
||||
|
||||
router.get("/clients", authMiddleware, async (ctx: AuthContext) => {
|
||||
const clientId = ctx.request.url.searchParams.get("client_id");
|
||||
if (!clientId) throw new APIException(400, "client_id is required");
|
||||
const responseBody: APIResponse<OAuthClient> = {
|
||||
success: true,
|
||||
data: await describeClient(ctx.state.user.userId, clientId),
|
||||
};
|
||||
ctx.response.body = responseBody;
|
||||
});
|
||||
|
||||
router.post("/codes", authMiddleware, async (ctx: AuthContext) => {
|
||||
const body: unknown = await ctx.request.body.json();
|
||||
if (!isAuthorizeRequest(body)) throw new APIException(400, "Invalid request");
|
||||
const responseBody: APIResponse<AuthorizeResponse> = {
|
||||
success: true,
|
||||
data: {
|
||||
redirectTo: await createAuthorizationCode(ctx.state.user.userId, body),
|
||||
},
|
||||
};
|
||||
ctx.response.body = responseBody;
|
||||
});
|
||||
|
||||
router.post("/tokens", async (ctx) => {
|
||||
const params = new URLSearchParams(await ctx.request.body.text());
|
||||
if (!takeToken(`oauth-token:${params.get("client_id")}`, TOKEN_LIMIT)) {
|
||||
throw new APIException(429, "Too many requests");
|
||||
}
|
||||
ctx.response.headers.set("Cache-Control", "no-store");
|
||||
ctx.response.body = await exchangeCode(params);
|
||||
});
|
||||
|
||||
export default router;
|
||||
@@ -31,7 +31,9 @@
|
||||
* - `PATCH /api/users/:key/role` — permission `user:manage`. Sets another
|
||||
* user's role.
|
||||
* - `PATCH /api/users/:key/username` — permission `user:manage`. Renames a
|
||||
* user, the caller included. It is the only way a name changes.
|
||||
* user, the caller included. It is the only way a local name changes; a
|
||||
* user from another instance is named there (400). The instances the user
|
||||
* signed in to are told.
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
@@ -64,6 +66,7 @@ import {
|
||||
import { parseOptionalAuth } from "../lib/auth.ts";
|
||||
import { parsePagination } from "../lib/pagination.ts";
|
||||
import {
|
||||
assertLocalUser,
|
||||
createUser,
|
||||
getInviteTree,
|
||||
renameUser,
|
||||
@@ -73,6 +76,7 @@ import {
|
||||
updateUser,
|
||||
} from "../services/user-service.ts";
|
||||
import { claimInvite, releaseInvite } from "../services/invite-service.ts";
|
||||
import { notifyClients } from "../services/identity-provider-service.ts";
|
||||
import {
|
||||
broadcastUserUpdated,
|
||||
updateClientUsername,
|
||||
@@ -293,9 +297,11 @@ router.patch(
|
||||
throw new APIException(400, "Invalid request");
|
||||
}
|
||||
const user = resolveUserKey(ctx.params.key);
|
||||
assertLocalUser(user);
|
||||
const publicUser = toPublicUser(renameUser(user.id, username));
|
||||
updateClientUsername(publicUser.id, publicUser.username);
|
||||
broadcastUserUpdated(publicUser);
|
||||
await notifyClients(publicUser.id, { type: "update" });
|
||||
const responseBody: APIResponse<PublicUser> = {
|
||||
success: true,
|
||||
data: publicUser,
|
||||
|
||||
36
api/routes/well-known.ts
Normal file
36
api/routes/well-known.ts
Normal file
@@ -0,0 +1,36 @@
|
||||
/**
|
||||
* Serves what other gerbeur instances read about this one before federated
|
||||
* sign-in, at the root paths OpenID Connect fixes, which are the one
|
||||
* exception to the API's `/api/` rule. `remote/gerbeur-instance.ts` reads
|
||||
* them on the other side.
|
||||
*
|
||||
* - `GET /.well-known/openid-configuration` — public. Answers the instance's
|
||||
* metadata (`InstanceMetadata`): its endpoints, its name and the protocol's
|
||||
* version. Bare JSON, not the API's envelope.
|
||||
* - `GET /.well-known/jwks.json` — public. Answers the public keys its tokens
|
||||
* are signed with. Bare JSON.
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
|
||||
import { Router } from "@oak/oak";
|
||||
import { getInstanceMetadata } from "../services/identity-provider-service.ts";
|
||||
import { getPublicKeys } from "../services/instance-key-service.ts";
|
||||
|
||||
/**
|
||||
* Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware.
|
||||
* An `APIException` thrown by a handler becomes the JSON error response there.
|
||||
*/
|
||||
const router: Router = new Router({ prefix: "/.well-known" });
|
||||
|
||||
router.get("/openid-configuration", (ctx) => {
|
||||
ctx.response.headers.set("Cache-Control", "public, max-age=600");
|
||||
ctx.response.body = getInstanceMetadata();
|
||||
});
|
||||
|
||||
router.get("/jwks.json", async (ctx) => {
|
||||
ctx.response.headers.set("Cache-Control", "public, max-age=600");
|
||||
ctx.response.body = await getPublicKeys();
|
||||
});
|
||||
|
||||
export default router;
|
||||
125
api/services/federation-peer-service.ts
Normal file
125
api/services/federation-peer-service.ts
Normal file
@@ -0,0 +1,125 @@
|
||||
/**
|
||||
* Keeps the instances an admin trusts or blocks for federated sign-in
|
||||
* (`federation_peers`). Users of a trusted instance sign in here directly,
|
||||
* those of a blocked one never do, and an instance on neither list is invite
|
||||
* only. `federation-service.ts` reads it at each sign-in, `/manage` edits it
|
||||
* through `routes/federation.ts`, and the login page offers the trusted ones.
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
|
||||
import { APIException } from "../lib/api-exception.ts";
|
||||
import { db } from "../db/connection.ts";
|
||||
import { PUBLIC_URL } from "../config.ts";
|
||||
import {
|
||||
type FederationPeer,
|
||||
instanceHost,
|
||||
isPeerStatus,
|
||||
parseInstance,
|
||||
type PeerStatus,
|
||||
} from "../../shared/federation.ts";
|
||||
import { fetchMetadata } from "../remote/gerbeur-instance.ts";
|
||||
import { closeUserSockets } from "./ws-service.ts";
|
||||
|
||||
interface PeerRow {
|
||||
issuer: string;
|
||||
status: string;
|
||||
name: string | null;
|
||||
created_at: string;
|
||||
}
|
||||
|
||||
/** Converts a row to a {@link FederationPeer}. */
|
||||
function rowToPeer(row: PeerRow): FederationPeer {
|
||||
return {
|
||||
issuer: row.issuer,
|
||||
host: instanceHost(row.issuer),
|
||||
name: row.name,
|
||||
status: isPeerStatus(row.status) ? row.status : "blocked",
|
||||
createdAt: new Date(row.created_at),
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns what an admin decided about the instance at `issuer`, or null when
|
||||
* it is on neither list.
|
||||
*/
|
||||
export function getPeerStatus(issuer: string): PeerStatus | null {
|
||||
const row = db.prepare(
|
||||
`SELECT status FROM federation_peers WHERE issuer = ?;`,
|
||||
).get(issuer) as { status: string } | undefined;
|
||||
return row && isPeerStatus(row.status) ? row.status : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the instances on the lists, by name: every one for `/manage`, or
|
||||
* only the trusted ones, which the login page offers.
|
||||
*/
|
||||
export function listPeers(trustedOnly: boolean): FederationPeer[] {
|
||||
const rows = db.prepare(
|
||||
`SELECT issuer, status, name, created_at FROM federation_peers
|
||||
${trustedOnly ? "WHERE status = 'trusted'" : ""}
|
||||
ORDER BY lower(coalesce(name, issuer));`,
|
||||
).all() as unknown as PeerRow[];
|
||||
return rows.map(rowToPeer);
|
||||
}
|
||||
|
||||
/**
|
||||
* Puts the instance `instance` names on the list of `status`, for `/manage`,
|
||||
* and returns it. It must answer as a gerbeur instance, whose name is kept.
|
||||
* Blocking one ends the sessions of its users here at once: their tokens stop
|
||||
* counting by `getSessionState`, and this closes their sockets.
|
||||
*
|
||||
* @throws {APIException} 400 when `instance` names no instance, or this one,
|
||||
* 502 when it doesn't answer as a gerbeur instance.
|
||||
*/
|
||||
export async function setPeer(
|
||||
instance: string,
|
||||
status: PeerStatus,
|
||||
): Promise<FederationPeer> {
|
||||
const issuer = parseInstance(instance);
|
||||
if (!issuer) throw new APIException(400, "Not an instance's address");
|
||||
if (issuer === PUBLIC_URL) {
|
||||
throw new APIException(400, "That is this instance");
|
||||
}
|
||||
let name: string;
|
||||
try {
|
||||
name = (await fetchMetadata(issuer)).gerbeur_site_name;
|
||||
} catch (err) {
|
||||
console.error(`[federation] ${issuer} can't be added:`, err);
|
||||
throw new APIException(502, "That address doesn't answer as a gerbeur");
|
||||
}
|
||||
db.prepare(
|
||||
`INSERT INTO federation_peers (issuer, status, name, created_at)
|
||||
VALUES (?, ?, ?, ?)
|
||||
ON CONFLICT (issuer) DO UPDATE SET status = excluded.status, name = excluded.name;`,
|
||||
).run(issuer, status, name, new Date().toISOString());
|
||||
|
||||
if (status === "blocked") {
|
||||
const users = db.prepare(
|
||||
`SELECT user_id FROM user_identities WHERE issuer = ?;`,
|
||||
).all(issuer) as { user_id: string }[];
|
||||
for (const { user_id } of users) {
|
||||
closeUserSockets(user_id, "Instance blocked");
|
||||
}
|
||||
}
|
||||
|
||||
const row = db.prepare(
|
||||
`SELECT issuer, status, name, created_at FROM federation_peers WHERE issuer = ?;`,
|
||||
).get(issuer) as unknown as PeerRow;
|
||||
return rowToPeer(row);
|
||||
}
|
||||
|
||||
/**
|
||||
* Takes the instance whose host is `host` off the lists, for `/manage`: its
|
||||
* users are invite only again, and those already here may sign in again if it
|
||||
* was blocked.
|
||||
*
|
||||
* @throws {APIException} 404 when no listed instance has that host.
|
||||
*/
|
||||
export function removePeer(host: string): void {
|
||||
const peer = listPeers(false).find((p) => p.host === host.toLowerCase());
|
||||
if (!peer) throw new APIException(404, "Instance not found");
|
||||
db.prepare(`DELETE FROM federation_peers WHERE issuer = ?;`).run(
|
||||
peer.issuer,
|
||||
);
|
||||
}
|
||||
376
api/services/federation-service.ts
Normal file
376
api/services/federation-service.ts
Normal file
@@ -0,0 +1,376 @@
|
||||
/**
|
||||
* Plays the client in federated sign-in: it lets users of other gerbeur
|
||||
* instances sign in here with their account there, their home.
|
||||
*
|
||||
* 1. The login or register page names the user's home, and
|
||||
* {@link startLogin} answers the home's `/authorize` page with a request:
|
||||
* a random state, the hash of a PKCE verifier, and a nonce, kept in
|
||||
* `federation_logins` for 10 minutes.
|
||||
* 2. The home sends the user back to the `/federation/callback` page with a
|
||||
* code. {@link completeLogin} trades it for the home's identity token,
|
||||
* checks its signature against the home's keys, and finds or creates the
|
||||
* local account linked to it (`user_identities`), named `<name>@<host>`.
|
||||
* 3. The home's events ({@link receiveEvent}) keep the account's name, email
|
||||
* and avatar in step, and end its sessions when the home says so.
|
||||
*
|
||||
* Whether a user of another instance may join is the admin's call
|
||||
* (`federation-peer-service.ts`): from a trusted instance they may, from a
|
||||
* blocked one they may not, and from any other only with an invite, which the
|
||||
* register page carries. Once here, an account works like any other, but its
|
||||
* password, email, avatar and name are its home's (`assertLocalUser`).
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
|
||||
import { decodeJwt } from "@panva/jose";
|
||||
import { createHash, randomBytes } from "node:crypto";
|
||||
import { APIException } from "../lib/api-exception.ts";
|
||||
import { db, transaction } from "../db/connection.ts";
|
||||
import { verifyInstanceToken } from "../lib/jwt.ts";
|
||||
import {
|
||||
type FederationLoginRequest,
|
||||
type FederationSessionRequest,
|
||||
type IdentityClaims,
|
||||
instanceHost,
|
||||
isFederationEvent,
|
||||
isIdentityClaims,
|
||||
parseInstance,
|
||||
} from "../../shared/federation.ts";
|
||||
import { EMAIL_RE, USERNAME_RE } from "../../shared/validation.ts";
|
||||
import { toPublicUser, type User } from "../model/user.ts";
|
||||
import {
|
||||
exchangeCode,
|
||||
fetchAvatar,
|
||||
fetchKeys,
|
||||
fetchMetadata,
|
||||
} from "../remote/gerbeur-instance.ts";
|
||||
import { ISSUER, REDIRECT_URI } from "./identity-provider-service.ts";
|
||||
import { getPeerStatus } from "./federation-peer-service.ts";
|
||||
import {
|
||||
claimInvite,
|
||||
releaseInvite,
|
||||
validateInvite,
|
||||
} from "./invite-service.ts";
|
||||
import {
|
||||
createRemoteUser,
|
||||
getUserById,
|
||||
revokeSessions,
|
||||
sendWelcomeEmail,
|
||||
setUserAvatar,
|
||||
setUsername,
|
||||
updateUser,
|
||||
} from "./user-service.ts";
|
||||
import { broadcastUserUpdated, updateClientUsername } from "./ws-service.ts";
|
||||
|
||||
/** How long a sign-in may take, from the login page to the callback. */
|
||||
const LOGIN_TTL_MS = 10 * 60_000;
|
||||
|
||||
/**
|
||||
* Returns the origin of the instance `instance` names, checked as a home: not
|
||||
* this instance, nor a blocked one.
|
||||
*
|
||||
* @throws {APIException} 400 when it names no instance or this one, 403 when
|
||||
* it is blocked.
|
||||
*/
|
||||
function homeOf(instance: string): string {
|
||||
const issuer = parseInstance(instance);
|
||||
if (!issuer) throw new APIException(400, "Not an instance's address");
|
||||
if (issuer === ISSUER) throw new APIException(400, "That is this instance");
|
||||
if (getPeerStatus(issuer) === "blocked") {
|
||||
throw new APIException(403, "This instance is blocked here");
|
||||
}
|
||||
return issuer;
|
||||
}
|
||||
|
||||
/**
|
||||
* Starts a sign-in with an account on the instance `request.instance` names,
|
||||
* and returns its `/authorize` page with the request, for
|
||||
* `POST /api/federation/logins`. Unless that instance is trusted, or someone
|
||||
* here already comes from it, the request must carry a valid invite, which is
|
||||
* claimed only once the account is made; {@link completeLogin} makes no
|
||||
* account without one.
|
||||
*
|
||||
* @throws {APIException} 400 when the instance isn't one; 403 when it is
|
||||
* blocked, or neither trusted nor invited; 404 or 409 when the invite doesn't
|
||||
* work; 502 when it doesn't answer as a gerbeur.
|
||||
*/
|
||||
export async function startLogin(
|
||||
request: FederationLoginRequest,
|
||||
): Promise<string> {
|
||||
const issuer = homeOf(request.instance);
|
||||
if (request.inviteToken) {
|
||||
validateInvite(request.inviteToken);
|
||||
} else if (
|
||||
getPeerStatus(issuer) !== "trusted" &&
|
||||
// Someone who joined with an invite signs in again without one; whether
|
||||
// this user is one of them is only known once their home answers.
|
||||
!db.prepare(`SELECT 1 FROM user_identities WHERE issuer = ? LIMIT 1;`)
|
||||
.get(issuer)
|
||||
) {
|
||||
throw new APIException(
|
||||
403,
|
||||
"Users of this instance need an invite to join",
|
||||
);
|
||||
}
|
||||
|
||||
let authorizationEndpoint: string;
|
||||
try {
|
||||
authorizationEndpoint = (await fetchMetadata(issuer))
|
||||
.authorization_endpoint;
|
||||
} catch (err) {
|
||||
console.error(`[federation] ${issuer} unreachable:`, err);
|
||||
throw new APIException(502, "That instance doesn't answer as a gerbeur");
|
||||
}
|
||||
|
||||
const state = randomBytes(24).toString("base64url");
|
||||
const verifier = randomBytes(48).toString("base64url");
|
||||
const nonce = randomBytes(24).toString("base64url");
|
||||
const now = new Date();
|
||||
transaction(() => {
|
||||
db.prepare(`DELETE FROM federation_logins WHERE created_at < ?;`).run(
|
||||
new Date(now.getTime() - LOGIN_TTL_MS).toISOString(),
|
||||
);
|
||||
db.prepare(
|
||||
`INSERT INTO federation_logins (state, issuer, code_verifier, nonce, invite_token, created_at)
|
||||
VALUES (?, ?, ?, ?, ?, ?);`,
|
||||
).run(
|
||||
state,
|
||||
issuer,
|
||||
verifier,
|
||||
nonce,
|
||||
request.inviteToken ?? null,
|
||||
now.toISOString(),
|
||||
);
|
||||
});
|
||||
|
||||
const url = new URL(authorizationEndpoint);
|
||||
url.search = new URLSearchParams({
|
||||
response_type: "code",
|
||||
scope: "openid profile email",
|
||||
client_id: ISSUER,
|
||||
redirect_uri: REDIRECT_URI,
|
||||
state,
|
||||
code_challenge: createHash("sha256").update(verifier).digest("base64url"),
|
||||
code_challenge_method: "S256",
|
||||
nonce,
|
||||
}).toString();
|
||||
return url.href;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the payload of `token`, an identity token or an event from the
|
||||
* instance at `issuer`, once its signature checks against that instance's
|
||||
* keys and it is addressed to this one. The keys are refetched once when the
|
||||
* token names one they lack.
|
||||
*
|
||||
* @throws {APIException} 401 when it doesn't verify.
|
||||
*/
|
||||
async function verifyFrom(
|
||||
token: string,
|
||||
issuer: string,
|
||||
): Promise<Record<string, unknown>> {
|
||||
const claims = { issuer, audience: ISSUER };
|
||||
try {
|
||||
try {
|
||||
return await verifyInstanceToken(token, await fetchKeys(issuer), claims);
|
||||
} catch (err) {
|
||||
if ((err as { code?: string }).code !== "ERR_JWKS_NO_MATCHING_KEY") {
|
||||
throw err;
|
||||
}
|
||||
return await verifyInstanceToken(
|
||||
token,
|
||||
await fetchKeys(issuer, true),
|
||||
claims,
|
||||
);
|
||||
}
|
||||
} catch (err) {
|
||||
console.error(`[federation] a token from ${issuer} failed:`, err);
|
||||
throw new APIException(401, "Invalid token");
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns `claims` once checked: a name a local user could have, and an email.
|
||||
*
|
||||
* @throws {APIException} 502 when the home sent something else.
|
||||
*/
|
||||
function checkClaims(claims: unknown): IdentityClaims {
|
||||
if (
|
||||
!isIdentityClaims(claims) ||
|
||||
!USERNAME_RE.test(claims.preferred_username) ||
|
||||
!EMAIL_RE.test(claims.email)
|
||||
) {
|
||||
throw new APIException(502, "The instance sent an invalid identity");
|
||||
}
|
||||
return claims;
|
||||
}
|
||||
|
||||
/**
|
||||
* Finishes a sign-in begun by {@link startLogin}, for
|
||||
* `POST /api/federation/sessions`, and returns the account it signs in to:
|
||||
* the one linked to the identity, brought up to date, or a new one. A login
|
||||
* works once. A new account needs the home to be trusted, or the invite the
|
||||
* login was started with, claimed now.
|
||||
*
|
||||
* @throws {APIException} 400 when the login is unknown or expired; 401 when
|
||||
* the identity token doesn't verify; 403 when the account may not be created;
|
||||
* 409 when its handle is someone's; 502 when the home fails.
|
||||
*/
|
||||
export async function completeLogin(
|
||||
request: FederationSessionRequest,
|
||||
): Promise<User> {
|
||||
const login = db.prepare(
|
||||
`DELETE FROM federation_logins WHERE state = ?
|
||||
RETURNING issuer, code_verifier, nonce, invite_token, created_at;`,
|
||||
).get(request.state) as
|
||||
| {
|
||||
issuer: string;
|
||||
code_verifier: string;
|
||||
nonce: string;
|
||||
invite_token: string | null;
|
||||
created_at: string;
|
||||
}
|
||||
| undefined;
|
||||
if (
|
||||
!login ||
|
||||
Date.now() - new Date(login.created_at).getTime() > LOGIN_TTL_MS
|
||||
) {
|
||||
throw new APIException(400, "This sign-in has expired, start again");
|
||||
}
|
||||
const issuer = login.issuer;
|
||||
|
||||
let idToken: string;
|
||||
try {
|
||||
idToken = await exchangeCode(issuer, {
|
||||
code: request.code,
|
||||
clientId: ISSUER,
|
||||
redirectUri: REDIRECT_URI,
|
||||
codeVerifier: login.code_verifier,
|
||||
});
|
||||
} catch (err) {
|
||||
console.error(`[federation] ${issuer} refused a code:`, err);
|
||||
throw new APIException(502, "The instance refused the sign-in");
|
||||
}
|
||||
const payload = await verifyFrom(idToken, issuer);
|
||||
if (payload.nonce !== login.nonce || typeof payload.sub !== "string") {
|
||||
throw new APIException(401, "Invalid token");
|
||||
}
|
||||
const claims = checkClaims(payload);
|
||||
const subject = payload.sub;
|
||||
|
||||
const identity = db.prepare(
|
||||
`SELECT user_id FROM user_identities WHERE issuer = ? AND subject = ?;`,
|
||||
).get(issuer, subject) as { user_id: string } | undefined;
|
||||
if (getPeerStatus(issuer) === "blocked") {
|
||||
throw new APIException(403, "This instance is blocked here");
|
||||
}
|
||||
if (identity) {
|
||||
return await applyClaims(identity.user_id, issuer, claims);
|
||||
}
|
||||
|
||||
const trusted = getPeerStatus(issuer) === "trusted";
|
||||
if (!trusted && !login.invite_token) {
|
||||
throw new APIException(
|
||||
403,
|
||||
"Users of this instance need an invite to join",
|
||||
);
|
||||
}
|
||||
const inviterId = trusted ? null : claimInvite(login.invite_token!);
|
||||
let user: User;
|
||||
try {
|
||||
user = transaction(() => {
|
||||
const created = createRemoteUser({
|
||||
username: `${claims.preferred_username}@${instanceHost(issuer)}`,
|
||||
email: claims.email,
|
||||
}, inviterId);
|
||||
db.prepare(
|
||||
`INSERT INTO user_identities (user_id, issuer, subject, synced_at) VALUES (?, ?, ?, ?);`,
|
||||
).run(created.id, issuer, subject, new Date().toISOString());
|
||||
return created;
|
||||
});
|
||||
} catch (err) {
|
||||
if (!trusted) releaseInvite(login.invite_token!);
|
||||
throw err;
|
||||
}
|
||||
sendWelcomeEmail(user);
|
||||
return await applyClaims(user.id, issuer, claims);
|
||||
}
|
||||
|
||||
/**
|
||||
* Brings the account `userId`, from the instance at `issuer`, in step with
|
||||
* `claims` and returns it: a new name at home renames it, the old handle
|
||||
* staying its alias, and a new email or avatar replaces its own. A failed
|
||||
* avatar fetch is logged, and tried again at the next change or sign-in.
|
||||
*
|
||||
* @throws {APIException} 409 when the new handle is someone else's.
|
||||
*/
|
||||
async function applyClaims(
|
||||
userId: string,
|
||||
issuer: string,
|
||||
claims: IdentityClaims,
|
||||
): Promise<User> {
|
||||
let user = getUserById(userId);
|
||||
const handle = `${claims.preferred_username}@${instanceHost(issuer)}`;
|
||||
if (handle !== user.username) {
|
||||
user = setUsername(userId, handle);
|
||||
updateClientUsername(userId, handle);
|
||||
broadcastUserUpdated(toPublicUser(user));
|
||||
}
|
||||
if (claims.email !== user.email) {
|
||||
user = await updateUser(userId, { email: claims.email });
|
||||
}
|
||||
|
||||
const { picture } = db.prepare(
|
||||
`SELECT picture FROM user_identities WHERE user_id = ?;`,
|
||||
).get(userId) as { picture: string | null };
|
||||
let synced = claims.picture ?? null;
|
||||
if (claims.picture && claims.picture !== picture) {
|
||||
try {
|
||||
user = await setUserAvatar(userId, await fetchAvatar(claims.picture));
|
||||
} catch (err) {
|
||||
console.error(`[federation] ${handle}'s avatar failed:`, err);
|
||||
synced = picture;
|
||||
}
|
||||
}
|
||||
db.prepare(
|
||||
`UPDATE user_identities SET picture = ?, synced_at = ? WHERE user_id = ?;`,
|
||||
).run(synced, new Date().toISOString(), userId);
|
||||
return user;
|
||||
}
|
||||
|
||||
/**
|
||||
* Applies the signed event `token` from a user's home, for
|
||||
* `POST /api/federation/events`: `update` brings their account in step,
|
||||
* `revoke` ends their sessions here. Only an instance some account here comes
|
||||
* from may send one, about one of those accounts.
|
||||
*
|
||||
* @throws {APIException} 400 when it isn't an event of a known instance about
|
||||
* one of its users; 401 when it doesn't verify.
|
||||
*/
|
||||
export async function receiveEvent(token: string): Promise<void> {
|
||||
let issuer: unknown;
|
||||
try {
|
||||
issuer = decodeJwt(token).iss;
|
||||
} catch {
|
||||
throw new APIException(400, "Invalid event");
|
||||
}
|
||||
if (
|
||||
typeof issuer !== "string" ||
|
||||
!db.prepare(`SELECT 1 FROM user_identities WHERE issuer = ? LIMIT 1;`)
|
||||
.get(issuer)
|
||||
) {
|
||||
throw new APIException(400, "Unknown instance");
|
||||
}
|
||||
const payload = await verifyFrom(token, issuer);
|
||||
const identity = db.prepare(
|
||||
`SELECT user_id FROM user_identities WHERE issuer = ? AND subject = ?;`,
|
||||
).get(issuer, String(payload.sub)) as { user_id: string } | undefined;
|
||||
if (!identity || !isFederationEvent(payload)) {
|
||||
throw new APIException(400, "Invalid event");
|
||||
}
|
||||
if (payload.type === "revoke") {
|
||||
revokeSessions(identity.user_id, new Date(), "Signed out by home");
|
||||
} else {
|
||||
await applyClaims(identity.user_id, issuer, checkClaims(payload.claims));
|
||||
}
|
||||
}
|
||||
438
api/services/identity-provider-service.ts
Normal file
438
api/services/identity-provider-service.ts
Normal file
@@ -0,0 +1,438 @@
|
||||
/**
|
||||
* Plays the home instance in federated sign-in: it lets this instance's users
|
||||
* sign in to other gerbeur instances with their account here.
|
||||
*
|
||||
* The flow is OpenID Connect's authorization code with PKCE, in three steps.
|
||||
*
|
||||
* 1. Another instance, the client, sends the user to the `/authorize` page
|
||||
* with a request. The page shows who asks ({@link describeClient}) and,
|
||||
* once the user consents, gets a code ({@link createAuthorizationCode}),
|
||||
* which it carries back to the client's callback page.
|
||||
* 2. The client trades the code for an identity token, server to server
|
||||
* ({@link exchangeCode}): this user's name, email and avatar, signed with
|
||||
* the instance key.
|
||||
* 3. While the user's grant lasts, the client hears of their changes: a new
|
||||
* name, email or avatar, and the end of their sessions after a password
|
||||
* change. {@link notifyClients} queues the signed events in
|
||||
* `federation_outbox`, and {@link outboxJob} delivers them.
|
||||
*
|
||||
* Only a local account signs in elsewhere: a user who came from another
|
||||
* instance signs in from there. `routes/oauth.ts`, `routes/well-known.ts` and
|
||||
* the routes that change a user call it.
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
|
||||
import { createHash, randomBytes } from "node:crypto";
|
||||
import { APIException } from "../lib/api-exception.ts";
|
||||
import { db, transaction } from "../db/connection.ts";
|
||||
import { FRONTEND_URL, OG_SITE_NAME, PUBLIC_URL } from "../config.ts";
|
||||
import { signInstanceToken } from "../lib/jwt.ts";
|
||||
import type { Job } from "../lib/scheduler.ts";
|
||||
import {
|
||||
type AuthorizeRequest,
|
||||
FEDERATION_VERSION,
|
||||
type FederationEvent,
|
||||
type FederationGrant,
|
||||
type IdentityClaims,
|
||||
instanceHost,
|
||||
type InstanceMetadata,
|
||||
type OAuthClient,
|
||||
parseInstance,
|
||||
} from "../../shared/federation.ts";
|
||||
import { fetchMetadata, postEvent } from "../remote/gerbeur-instance.ts";
|
||||
import { isRemoteUser, type User } from "../model/user.ts";
|
||||
import { getSigningKey } from "./instance-key-service.ts";
|
||||
import { getUserById } from "./user-service.ts";
|
||||
import { getPeerStatus } from "./federation-peer-service.ts";
|
||||
|
||||
/**
|
||||
* The instance's name in every token it signs and every token addressed to
|
||||
* it: its public URL, which must be an origin for other instances to find
|
||||
* its metadata.
|
||||
*/
|
||||
export const ISSUER: string = PUBLIC_URL;
|
||||
|
||||
/**
|
||||
* The client's page a home instance sends the user back to, on the frontend.
|
||||
* Its metadata announces it, and a home accepts no other.
|
||||
*/
|
||||
export const REDIRECT_URI = `${FRONTEND_URL}/federation/callback`;
|
||||
|
||||
/** How long a code may wait to be traded, from the consent. */
|
||||
const CODE_TTL_MS = 60_000;
|
||||
|
||||
/**
|
||||
* How long an identity token is valid: enough to cross from one server to the
|
||||
* other, never enough to be replayed later.
|
||||
*/
|
||||
const ID_TOKEN_TTL = "5m";
|
||||
|
||||
/**
|
||||
* How long an event is valid, and so how long the outbox keeps trying to
|
||||
* deliver it before giving up.
|
||||
*/
|
||||
const EVENT_TTL_MS = 3 * 86_400_000;
|
||||
|
||||
/** The longest wait between two tries of an event. */
|
||||
const MAX_RETRY_MS = 6 * 3_600_000;
|
||||
|
||||
/**
|
||||
* Returns the instance's metadata, served at
|
||||
* `/.well-known/openid-configuration`.
|
||||
*/
|
||||
export function getInstanceMetadata(): InstanceMetadata {
|
||||
return {
|
||||
issuer: ISSUER,
|
||||
authorization_endpoint: `${FRONTEND_URL}/authorize`,
|
||||
token_endpoint: `${PUBLIC_URL}/api/oauth/tokens`,
|
||||
jwks_uri: `${PUBLIC_URL}/.well-known/jwks.json`,
|
||||
response_types_supported: ["code"],
|
||||
grant_types_supported: ["authorization_code"],
|
||||
subject_types_supported: ["public"],
|
||||
id_token_signing_alg_values_supported: ["EdDSA"],
|
||||
code_challenge_methods_supported: ["S256"],
|
||||
scopes_supported: ["openid", "profile", "email"],
|
||||
gerbeur_federation: FEDERATION_VERSION,
|
||||
gerbeur_site_name: OG_SITE_NAME,
|
||||
gerbeur_redirect_uri: REDIRECT_URI,
|
||||
gerbeur_events_endpoint: `${PUBLIC_URL}/api/federation/events`,
|
||||
};
|
||||
}
|
||||
|
||||
/** Returns the SHA-256 of `value`, as base64url. */
|
||||
function sha256(value: string): string {
|
||||
return createHash("sha256").update(value).digest("base64url");
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns what this instance tells another of `user`: their name, email and
|
||||
* avatar, whose URL changes with each new one.
|
||||
*/
|
||||
export function identityClaims(user: User): IdentityClaims {
|
||||
return {
|
||||
preferred_username: user.username,
|
||||
email: user.email,
|
||||
...(user.avatarMime && {
|
||||
picture: `${PUBLIC_URL}/api/users/${user.id}/avatar?v=${
|
||||
user.updatedAt?.getTime() ?? 0
|
||||
}`,
|
||||
}),
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the client `clientId` names, checked: an instance other than this
|
||||
* one, not blocked here, answering as a gerbeur. `user` must have a local
|
||||
* account, which alone may sign in elsewhere.
|
||||
*
|
||||
* @throws {APIException} 400 when `clientId` isn't an instance's address, is
|
||||
* this instance, or `user` comes from another instance; 403 when the client
|
||||
* is blocked here; 502 when it doesn't answer as a gerbeur.
|
||||
*/
|
||||
async function checkClient(
|
||||
user: User,
|
||||
clientId: string,
|
||||
): Promise<{ clientId: string; metadata: InstanceMetadata }> {
|
||||
if (isRemoteUser(user)) {
|
||||
throw new APIException(
|
||||
400,
|
||||
"This account signs in from the instance it comes from",
|
||||
);
|
||||
}
|
||||
if (parseInstance(clientId) !== clientId || clientId === ISSUER) {
|
||||
throw new APIException(400, "Invalid client");
|
||||
}
|
||||
if (getPeerStatus(clientId) === "blocked") {
|
||||
throw new APIException(403, "This instance is blocked here");
|
||||
}
|
||||
try {
|
||||
return { clientId, metadata: await fetchMetadata(clientId) };
|
||||
} catch (err) {
|
||||
console.error(`[federation] client ${clientId} unreachable:`, err);
|
||||
throw new APIException(502, "That instance doesn't answer as a gerbeur");
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the instance `clientId` names, for the `/authorize` page's question
|
||||
* to user `userId`, and whether they already let it sign them in.
|
||||
*
|
||||
* @throws {APIException} As {@link checkClient}.
|
||||
*/
|
||||
export async function describeClient(
|
||||
userId: string,
|
||||
clientId: string,
|
||||
): Promise<OAuthClient> {
|
||||
const { metadata } = await checkClient(getUserById(userId), clientId);
|
||||
const granted = !!db.prepare(
|
||||
`SELECT 1 FROM federation_grants WHERE user_id = ? AND client_id = ?;`,
|
||||
).get(userId, clientId);
|
||||
return {
|
||||
clientId,
|
||||
host: instanceHost(clientId),
|
||||
name: metadata.gerbeur_site_name,
|
||||
granted,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Records user `userId`'s consent to sign in to the client of `request`, and
|
||||
* returns where to send them: the client's callback page with a code, which
|
||||
* the client trades within a minute ({@link exchangeCode}). The grant lasts
|
||||
* until they withdraw it, so the page asks no more.
|
||||
*
|
||||
* @throws {APIException} 400 when the request is malformed or its
|
||||
* `redirectUri` isn't the client's own; otherwise as {@link checkClient}.
|
||||
*/
|
||||
export async function createAuthorizationCode(
|
||||
userId: string,
|
||||
request: AuthorizeRequest,
|
||||
): Promise<string> {
|
||||
const user = getUserById(userId);
|
||||
const { clientId, metadata } = await checkClient(user, request.clientId);
|
||||
if (request.redirectUri !== metadata.gerbeur_redirect_uri) {
|
||||
throw new APIException(400, "Invalid redirect URI");
|
||||
}
|
||||
if (
|
||||
request.codeChallengeMethod !== "S256" ||
|
||||
!/^[A-Za-z0-9_-]{43}$/.test(request.codeChallenge) ||
|
||||
!request.state || request.state.length > 512 ||
|
||||
!request.nonce || request.nonce.length > 512
|
||||
) {
|
||||
throw new APIException(400, "Invalid request");
|
||||
}
|
||||
|
||||
const code = randomBytes(32).toString("base64url");
|
||||
const now = new Date();
|
||||
transaction(() => {
|
||||
db.prepare(`DELETE FROM oauth_codes WHERE expires_at < ?;`).run(
|
||||
now.toISOString(),
|
||||
);
|
||||
db.prepare(
|
||||
`INSERT INTO oauth_codes (code_hash, user_id, client_id, redirect_uri, code_challenge, nonce, expires_at)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?);`,
|
||||
).run(
|
||||
sha256(code),
|
||||
userId,
|
||||
clientId,
|
||||
request.redirectUri,
|
||||
request.codeChallenge,
|
||||
request.nonce,
|
||||
new Date(now.getTime() + CODE_TTL_MS).toISOString(),
|
||||
);
|
||||
db.prepare(
|
||||
`INSERT INTO federation_grants (user_id, client_id, client_name, granted_at, last_used_at)
|
||||
VALUES (?, ?, ?, ?, ?)
|
||||
ON CONFLICT (user_id, client_id) DO UPDATE SET client_name = excluded.client_name;`,
|
||||
).run(
|
||||
userId,
|
||||
clientId,
|
||||
metadata.gerbeur_site_name,
|
||||
now.toISOString(),
|
||||
now.toISOString(),
|
||||
);
|
||||
});
|
||||
|
||||
const redirect = new URL(request.redirectUri);
|
||||
redirect.searchParams.set("code", code);
|
||||
redirect.searchParams.set("state", request.state);
|
||||
// RFC 9207: tells the client which instance answered, against mix-ups.
|
||||
redirect.searchParams.set("iss", ISSUER);
|
||||
return redirect.href;
|
||||
}
|
||||
|
||||
/**
|
||||
* Trades a code for an identity token, for `POST /api/oauth/tokens`, which
|
||||
* the client calls server to server with the form `params`. A code works once,
|
||||
* within a minute, for the client and redirect it was made for, and with the
|
||||
* verifier whose hash the request carried (PKCE). The token, signed with the
|
||||
* instance key and addressed to the client, carries {@link identityClaims}
|
||||
* and the request's nonce.
|
||||
*
|
||||
* @throws {APIException} 400 when anything doesn't match.
|
||||
*/
|
||||
export async function exchangeCode(
|
||||
params: URLSearchParams,
|
||||
): Promise<{ id_token: string; token_type: string }> {
|
||||
const code = params.get("code");
|
||||
const clientId = params.get("client_id");
|
||||
const verifier = params.get("code_verifier");
|
||||
if (
|
||||
params.get("grant_type") !== "authorization_code" || !code || !clientId ||
|
||||
!verifier || !/^[A-Za-z0-9._~-]{43,128}$/.test(verifier)
|
||||
) {
|
||||
throw new APIException(400, "invalid_request");
|
||||
}
|
||||
|
||||
// Taken in the same statement that finds it, so it can't be traded twice.
|
||||
const row = db.prepare(
|
||||
`DELETE FROM oauth_codes WHERE code_hash = ?
|
||||
RETURNING user_id, client_id, redirect_uri, code_challenge, nonce, expires_at;`,
|
||||
).get(sha256(code)) as
|
||||
| {
|
||||
user_id: string;
|
||||
client_id: string;
|
||||
redirect_uri: string;
|
||||
code_challenge: string;
|
||||
nonce: string;
|
||||
expires_at: string;
|
||||
}
|
||||
| undefined;
|
||||
if (
|
||||
!row || row.expires_at < new Date().toISOString() ||
|
||||
row.client_id !== clientId ||
|
||||
row.redirect_uri !== params.get("redirect_uri") ||
|
||||
row.code_challenge !== sha256(verifier)
|
||||
) {
|
||||
throw new APIException(400, "invalid_grant");
|
||||
}
|
||||
|
||||
const user = getUserById(row.user_id);
|
||||
if (isRemoteUser(user)) throw new APIException(400, "invalid_grant");
|
||||
db.prepare(
|
||||
`UPDATE federation_grants SET last_used_at = ? WHERE user_id = ? AND client_id = ?;`,
|
||||
).run(new Date().toISOString(), user.id, clientId);
|
||||
|
||||
const idToken = await signInstanceToken(
|
||||
{ ...identityClaims(user), nonce: row.nonce },
|
||||
await getSigningKey(),
|
||||
{ issuer: ISSUER, audience: clientId, subject: user.id },
|
||||
ID_TOKEN_TTL,
|
||||
);
|
||||
return { id_token: idToken, token_type: "Bearer" };
|
||||
}
|
||||
|
||||
interface GrantRow {
|
||||
client_id: string;
|
||||
client_name: string | null;
|
||||
granted_at: string;
|
||||
last_used_at: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the instances user `userId` let their account sign in to, the most
|
||||
* recently used first, for the settings page.
|
||||
*/
|
||||
export function listGrants(userId: string): FederationGrant[] {
|
||||
const rows = db.prepare(
|
||||
`SELECT client_id, client_name, granted_at, last_used_at FROM federation_grants
|
||||
WHERE user_id = ? ORDER BY last_used_at DESC;`,
|
||||
).all(userId) as unknown as GrantRow[];
|
||||
return rows.map((r) => ({
|
||||
clientId: r.client_id,
|
||||
host: instanceHost(r.client_id),
|
||||
name: r.client_name,
|
||||
grantedAt: new Date(r.granted_at),
|
||||
lastUsedAt: new Date(r.last_used_at),
|
||||
}));
|
||||
}
|
||||
|
||||
/**
|
||||
* Withdraws user `userId`'s grant to the instance whose host is `host`: it
|
||||
* stops answering for them there, and is told to end their sessions.
|
||||
*
|
||||
* @throws {APIException} 404 when they gave that instance no grant.
|
||||
*/
|
||||
export async function revokeGrant(userId: string, host: string): Promise<void> {
|
||||
const grant = listGrants(userId).find((g) => g.host === host.toLowerCase());
|
||||
if (!grant) throw new APIException(404, "Grant not found");
|
||||
await notifyClients(userId, { type: "revoke" }, [grant.clientId]);
|
||||
db.prepare(
|
||||
`DELETE FROM federation_grants WHERE user_id = ? AND client_id = ?;`,
|
||||
).run(userId, grant.clientId);
|
||||
}
|
||||
|
||||
/**
|
||||
* Tells each instance user `userId` signed in to of `event`, or only those of
|
||||
* `clientIds`: `update` when their name, email or avatar changed, `revoke`
|
||||
* when their sessions there must end. The routes that change a user call it,
|
||||
* and for an `update`, `event` may be just the type: the claims are read now.
|
||||
* The events are queued in the outbox and their delivery starts at once.
|
||||
*/
|
||||
export async function notifyClients(
|
||||
userId: string,
|
||||
event: FederationEvent | { type: "update" },
|
||||
clientIds?: string[],
|
||||
): Promise<void> {
|
||||
const clients = clientIds ?? listGrants(userId).map((g) => g.clientId);
|
||||
if (clients.length === 0) return;
|
||||
const payload: FederationEvent = event.type === "update"
|
||||
? { type: "update", claims: identityClaims(getUserById(userId)) }
|
||||
: event;
|
||||
|
||||
const key = await getSigningKey();
|
||||
const now = new Date();
|
||||
for (const clientId of clients) {
|
||||
const token = await signInstanceToken(
|
||||
{ ...payload },
|
||||
key,
|
||||
{ issuer: ISSUER, audience: clientId, subject: userId },
|
||||
`${EVENT_TTL_MS / 1000}s`,
|
||||
);
|
||||
db.prepare(
|
||||
`INSERT INTO federation_outbox (id, client_id, event, next_attempt_at, created_at)
|
||||
VALUES (?, ?, ?, ?, ?);`,
|
||||
).run(
|
||||
crypto.randomUUID(),
|
||||
clientId,
|
||||
token,
|
||||
now.toISOString(),
|
||||
now.toISOString(),
|
||||
);
|
||||
}
|
||||
deliverOutbox().catch((err) =>
|
||||
console.error("[federation] delivery failed:", err)
|
||||
);
|
||||
}
|
||||
|
||||
/** Set while {@link deliverOutbox} runs, so that two runs don't overlap. */
|
||||
let delivering = false;
|
||||
|
||||
/**
|
||||
* Sends each due event of the outbox to its instance. One it took, or refused
|
||||
* for good, leaves the outbox; one that failed waits twice as long as the time
|
||||
* before, up to 6 hours, until it expires after 3 days.
|
||||
*/
|
||||
export async function deliverOutbox(): Promise<void> {
|
||||
if (delivering) return;
|
||||
delivering = true;
|
||||
try {
|
||||
const now = new Date();
|
||||
db.prepare(`DELETE FROM federation_outbox WHERE created_at < ?;`).run(
|
||||
new Date(now.getTime() - EVENT_TTL_MS).toISOString(),
|
||||
);
|
||||
const due = db.prepare(
|
||||
`SELECT id, client_id, event, attempts FROM federation_outbox
|
||||
WHERE next_attempt_at <= ? ORDER BY created_at LIMIT 100;`,
|
||||
).all(now.toISOString()) as {
|
||||
id: string;
|
||||
client_id: string;
|
||||
event: string;
|
||||
attempts: number;
|
||||
}[];
|
||||
for (const row of due) {
|
||||
try {
|
||||
if (!await postEvent(row.client_id, row.event)) {
|
||||
console.error(`[federation] ${row.client_id} refused an event`);
|
||||
}
|
||||
db.prepare(`DELETE FROM federation_outbox WHERE id = ?;`).run(row.id);
|
||||
} catch (err) {
|
||||
const wait = Math.min(60_000 * 2 ** row.attempts, MAX_RETRY_MS);
|
||||
db.prepare(
|
||||
`UPDATE federation_outbox SET attempts = attempts + 1, next_attempt_at = ? WHERE id = ?;`,
|
||||
).run(new Date(Date.now() + wait).toISOString(), row.id);
|
||||
console.error(`[federation] ${row.client_id} unreachable:`, err);
|
||||
}
|
||||
}
|
||||
} finally {
|
||||
delivering = false;
|
||||
}
|
||||
}
|
||||
|
||||
/** Retries the outbox's failed events every minute. */
|
||||
export const outboxJob: Job = {
|
||||
name: "federation",
|
||||
everyMs: 60_000,
|
||||
run: deliverOutbox,
|
||||
};
|
||||
73
api/services/instance-key-service.ts
Normal file
73
api/services/instance-key-service.ts
Normal file
@@ -0,0 +1,73 @@
|
||||
/**
|
||||
* Keeps the instance's Ed25519 key, which signs what it tells other instances
|
||||
* in federated sign-in: the identity tokens of `identity-provider-service.ts`
|
||||
* and the events of its outbox. The key is made the first time it's needed
|
||||
* and stored in `federation_keys`, so it survives restarts; other instances
|
||||
* fetch its public half from `GET /.well-known/jwks.json`.
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
|
||||
import type { JSONWebKeySet, JWK } from "@panva/jose";
|
||||
import { db } from "../db/connection.ts";
|
||||
import {
|
||||
generateInstanceKey,
|
||||
importInstanceKey,
|
||||
type InstanceSigningKey,
|
||||
} from "../lib/jwt.ts";
|
||||
|
||||
/**
|
||||
* Holds the key once loaded. It is a promise so that two first requests in a
|
||||
* row don't each make a key.
|
||||
*/
|
||||
let current: Promise<InstanceSigningKey> | null = null;
|
||||
|
||||
/**
|
||||
* Returns the key the instance signs with now: the newest stored, or a new
|
||||
* one, stored, when there is none.
|
||||
*/
|
||||
export function getSigningKey(): Promise<InstanceSigningKey> {
|
||||
current ??= loadOrCreate().catch((err) => {
|
||||
current = null;
|
||||
throw err;
|
||||
});
|
||||
return current;
|
||||
}
|
||||
|
||||
/** Reads the newest stored key, or makes and stores the first one. */
|
||||
async function loadOrCreate(): Promise<InstanceSigningKey> {
|
||||
const row = db.prepare(
|
||||
`SELECT kid, private_jwk FROM federation_keys ORDER BY created_at DESC LIMIT 1;`,
|
||||
).get() as { kid: string; private_jwk: string } | undefined;
|
||||
if (row) {
|
||||
return await importInstanceKey(row.kid, JSON.parse(row.private_jwk));
|
||||
}
|
||||
const { kid, privateJwk, publicJwk } = await generateInstanceKey();
|
||||
db.prepare(
|
||||
`INSERT INTO federation_keys (kid, private_jwk, public_jwk, created_at) VALUES (?, ?, ?, ?);`,
|
||||
).run(
|
||||
kid,
|
||||
JSON.stringify(privateJwk),
|
||||
JSON.stringify(publicJwk),
|
||||
new Date().toISOString(),
|
||||
);
|
||||
return await importInstanceKey(kid, privateJwk);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the public halves of every stored key, for
|
||||
* `GET /.well-known/jwks.json`. It makes the first key when there is none, so
|
||||
* that the set is never empty.
|
||||
*/
|
||||
export async function getPublicKeys(): Promise<JSONWebKeySet> {
|
||||
await getSigningKey();
|
||||
const rows = db.prepare(
|
||||
`SELECT public_jwk FROM federation_keys ORDER BY created_at DESC;`,
|
||||
).all() as { public_jwk: string }[];
|
||||
return { keys: rows.map((r) => JSON.parse(r.public_jwk) as JWK) };
|
||||
}
|
||||
|
||||
/** Forgets the loaded key, for the tests, which wipe the table between cases. */
|
||||
export function resetSigningKey(): void {
|
||||
current = null;
|
||||
}
|
||||
@@ -17,6 +17,7 @@ import type {
|
||||
UserSuggestion,
|
||||
} from "../../shared/user.ts";
|
||||
import {
|
||||
isRemoteUser,
|
||||
isUserRow,
|
||||
toPublicUser,
|
||||
type User,
|
||||
@@ -24,7 +25,13 @@ import {
|
||||
userRowToApi,
|
||||
} from "../model/user.ts";
|
||||
import { db, transaction } from "../db/connection.ts";
|
||||
import { closeUserSockets } from "./ws-service.ts";
|
||||
import {
|
||||
broadcastUserUpdated,
|
||||
closeUserSockets,
|
||||
updateClientAvatar,
|
||||
} from "./ws-service.ts";
|
||||
import { replaceUploadedFile, validateImageUpload } from "../lib/upload.ts";
|
||||
import { AVATARS_DIR } from "../config.ts";
|
||||
|
||||
import { hashPassword } from "../lib/password.ts";
|
||||
import { linkAttachments } from "./attachment-service.ts";
|
||||
@@ -116,6 +123,39 @@ export async function createUser(
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates the account of a user from another instance, named `username`
|
||||
* (their handle here, `name@host`), with no password, for
|
||||
* `federation-service.ts`, which links it to their identity there in the same
|
||||
* transaction. `inviterId` is whoever invited them, or null when their
|
||||
* instance is trusted.
|
||||
*
|
||||
* @throws {APIException} 409 when the handle is or was someone else's.
|
||||
*/
|
||||
export function createRemoteUser(
|
||||
request: { username: string; email: string },
|
||||
inviterId: string | null,
|
||||
): User {
|
||||
const userId = crypto.randomUUID();
|
||||
const createdAt = new Date();
|
||||
assertUsernameAvailable(request.username);
|
||||
try {
|
||||
db.prepare(
|
||||
`INSERT INTO users (id, username, password_hash, role, created_at, invited_by, email)
|
||||
VALUES (?, ?, '', 'user', ?, ?, ?);`,
|
||||
).run(
|
||||
userId,
|
||||
request.username,
|
||||
createdAt.toISOString(),
|
||||
inviterId,
|
||||
request.email,
|
||||
);
|
||||
} catch (err) {
|
||||
throw uniqueViolationToConflict(err);
|
||||
}
|
||||
return getUserById(userId);
|
||||
}
|
||||
|
||||
/**
|
||||
* Emails `user` the welcome message, if email is configured. The register
|
||||
* route calls it once the account exists, and doesn't wait: a slow or failing
|
||||
@@ -146,18 +186,28 @@ export function getUserById(userId: string): User {
|
||||
|
||||
/**
|
||||
* Returns the user's live role and their last password change, before which
|
||||
* their tokens don't count, or undefined when the user is gone. `lib/auth.ts`
|
||||
* checks every session and media token against it.
|
||||
* their tokens don't count, or undefined when the user is gone, or comes from
|
||||
* an instance an admin blocked. `lib/auth.ts` checks every session and media
|
||||
* token against it.
|
||||
*/
|
||||
export function getSessionState(
|
||||
userId: string,
|
||||
): { role: Role; tokensValidAfter: string | null } | undefined {
|
||||
const row = db.prepare(
|
||||
`SELECT role, tokens_valid_after FROM users WHERE id = ?;`,
|
||||
`SELECT u.role, u.tokens_valid_after, p.status AS peer_status
|
||||
FROM users u
|
||||
LEFT JOIN user_identities ui ON ui.user_id = u.id
|
||||
LEFT JOIN federation_peers p ON p.issuer = ui.issuer
|
||||
WHERE u.id = ?;`,
|
||||
).get(userId) as
|
||||
| { role: Role; tokens_valid_after: string | null }
|
||||
| {
|
||||
role: Role;
|
||||
tokens_valid_after: string | null;
|
||||
peer_status: string | null;
|
||||
}
|
||||
| undefined;
|
||||
return row && {
|
||||
if (!row || row.peer_status === "blocked") return undefined;
|
||||
return {
|
||||
role: row.role,
|
||||
tokensValidAfter: row.tokens_valid_after,
|
||||
};
|
||||
@@ -225,6 +275,19 @@ export function renameUser(userId: string, username: string): User {
|
||||
`Username must be ${VALIDATION.USERNAME_MIN}–${VALIDATION.USERNAME_MAX} characters and contain only letters, numbers, or underscores`,
|
||||
);
|
||||
}
|
||||
return setUsername(userId, username);
|
||||
}
|
||||
|
||||
/**
|
||||
* Names user `userId` `username`, keeping the old name as their alias as
|
||||
* {@link renameUser} describes, and returns them. The caller has checked the
|
||||
* name: {@link renameUser} checks a local one, and `federation-service.ts`
|
||||
* the handle of a user renamed on their home instance.
|
||||
*
|
||||
* @throws {APIException} 404 when there is no such user, 409 when the name is
|
||||
* or was someone else's.
|
||||
*/
|
||||
export function setUsername(userId: string, username: string): User {
|
||||
const user = getUserById(userId);
|
||||
if (username === user.username) return user;
|
||||
|
||||
@@ -246,13 +309,29 @@ export function renameUser(userId: string, username: string): User {
|
||||
}
|
||||
|
||||
/**
|
||||
* Throws a 409 when an account other than `exceptUserId` has `email`, in any
|
||||
* case. Password resets are looked up by email, so an address must belong to
|
||||
* one account only.
|
||||
* Throws a 400 when `user`'s account lives on another instance
|
||||
* ({@link isRemoteUser}), whose password, email, avatar and name are that
|
||||
* instance's to change. The routes that change them call it first.
|
||||
*/
|
||||
export function assertLocalUser(user: User): void {
|
||||
if (isRemoteUser(user)) {
|
||||
throw new APIException(
|
||||
400,
|
||||
"This account is managed on the instance it comes from",
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Throws a 409 when a local account other than `exceptUserId` has `email`, in
|
||||
* any case. Password resets are looked up by email, so an address must belong
|
||||
* to one local account only; an account from another instance may share it,
|
||||
* as the same person may have both.
|
||||
*/
|
||||
function assertEmailAvailable(email: string, exceptUserId?: string): void {
|
||||
const row = db.prepare(
|
||||
`SELECT id FROM users WHERE lower(email) = lower(?) AND id != ?;`,
|
||||
`SELECT id FROM users
|
||||
WHERE lower(email) = lower(?) AND id != ? AND password_hash != '';`,
|
||||
).get(email, exceptUserId ?? "");
|
||||
if (row) {
|
||||
throw new APIException(409, "Email already in use");
|
||||
@@ -271,12 +350,13 @@ function uniqueViolationToConflict(err: unknown): unknown {
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the user whose email is `email`, in any case, or null, for
|
||||
* `requestPasswordReset`.
|
||||
* Returns the local user whose email is `email`, in any case, or null, for
|
||||
* `requestPasswordReset`. An account from another instance has no password
|
||||
* here to reset.
|
||||
*/
|
||||
export function getUserByEmail(email: string): User | null {
|
||||
const userRow = db.prepare(
|
||||
`${USER_SELECT} WHERE lower(u.email) = lower(?)`,
|
||||
`${USER_SELECT} WHERE lower(u.email) = lower(?) AND u.password_hash != ''`,
|
||||
).get(email);
|
||||
|
||||
if (!userRow || !isUserRow(userRow)) return null;
|
||||
@@ -385,13 +465,7 @@ export async function updateUser(
|
||||
throw new APIException(404, "User not found");
|
||||
}
|
||||
|
||||
if (password) {
|
||||
db.prepare(`UPDATE users SET tokens_valid_after = ? WHERE id = ?;`).run(
|
||||
now.toISOString(),
|
||||
userId,
|
||||
);
|
||||
closeUserSockets(userId, "Password changed");
|
||||
}
|
||||
if (password) revokeSessions(userId, now, "Password changed");
|
||||
|
||||
if (updatedUser.description) {
|
||||
linkAttachments(updatedUser.description, "user", userId);
|
||||
@@ -400,14 +474,54 @@ export async function updateUser(
|
||||
return updatedUser;
|
||||
}
|
||||
|
||||
/**
|
||||
* Ends every session of user `userId` opened before `at`, closing their
|
||||
* sockets with `reason`: their tokens stop counting
|
||||
* (`users.tokens_valid_after`, which `getSessionState` reads). A password
|
||||
* change calls it, and so does the sign-out of a user from another instance,
|
||||
* when that instance says so or an admin blocks it.
|
||||
*/
|
||||
export function revokeSessions(userId: string, at: Date, reason: string): void {
|
||||
db.prepare(`UPDATE users SET tokens_valid_after = ? WHERE id = ?;`).run(
|
||||
at.toISOString(),
|
||||
userId,
|
||||
);
|
||||
closeUserSockets(userId, reason);
|
||||
}
|
||||
|
||||
/**
|
||||
* Makes the image `data` user `userId`'s avatar and returns them, for an
|
||||
* upload (`PUT /api/me/avatar`) and for the avatar a user from another
|
||||
* instance has there (`federation-service.ts`). Presence alone would update
|
||||
* only the online list, so it also sends `user_updated`, which reaches every
|
||||
* avatar on screen, its bumped `updatedAt` busting their cache.
|
||||
*
|
||||
* @throws {APIException} 400 when `data` isn't an image an avatar may be, 404
|
||||
* when there is no such user.
|
||||
*/
|
||||
export async function setUserAvatar(
|
||||
userId: string,
|
||||
data: Uint8Array,
|
||||
): Promise<User> {
|
||||
const mime = validateImageUpload(data);
|
||||
// Written before the record announces it, or clients would fetch it too
|
||||
// early.
|
||||
await replaceUploadedFile(`${AVATARS_DIR}/${userId}`, data);
|
||||
updateUserAvatar(userId, mime);
|
||||
updateClientAvatar(userId, mime);
|
||||
const user = getUserById(userId);
|
||||
broadcastUserUpdated(toPublicUser(user));
|
||||
return user;
|
||||
}
|
||||
|
||||
/**
|
||||
* Records that user `userId` now has an avatar of type `mime`, once
|
||||
* `PUT /api/me/avatar` has written the file. It bumps `updated_at`, which
|
||||
* {@link setUserAvatar} has written the file. It bumps `updated_at`, which
|
||||
* the client uses to reload the image.
|
||||
*
|
||||
* @throws {APIException} 404 when there is no such user.
|
||||
*/
|
||||
export function updateUserAvatar(userId: string, mime: string): void {
|
||||
function updateUserAvatar(userId: string, mime: string): void {
|
||||
const result = db.prepare(
|
||||
`UPDATE users SET avatar_mime = ?, updated_at = ? WHERE id = ?`,
|
||||
).run(mime, new Date().toISOString(), userId);
|
||||
|
||||
@@ -28,14 +28,14 @@ Deno.test("runMigrations: a fresh database is left as schema.sql made it", () =>
|
||||
.get() as {
|
||||
n: number;
|
||||
};
|
||||
assertEquals(applied.n, 23);
|
||||
assertEquals(applied.n, 24);
|
||||
// Running again applies nothing.
|
||||
runMigrations(db);
|
||||
assertEquals(
|
||||
(db.prepare(`SELECT COUNT(*) as n FROM schema_migrations;`).get() as {
|
||||
n: number;
|
||||
}).n,
|
||||
23,
|
||||
24,
|
||||
);
|
||||
db.close();
|
||||
});
|
||||
|
||||
43
api/test/db/migrations/0024_federation.test.ts
Normal file
43
api/test/db/migrations/0024_federation.test.ts
Normal file
@@ -0,0 +1,43 @@
|
||||
import "../../setup.ts";
|
||||
import { assertEquals, assertThrows } from "@std/assert";
|
||||
import { DatabaseSync } from "node:sqlite";
|
||||
import { up as up0024 } from "../../../db/migrations/0024_federation.ts";
|
||||
|
||||
Deno.test("migration 0024 adds federation and frees remote accounts' emails", () => {
|
||||
const db = new DatabaseSync(":memory:");
|
||||
db.exec(`
|
||||
CREATE TABLE users (id TEXT PRIMARY KEY, username TEXT, password_hash TEXT, email TEXT);
|
||||
CREATE UNIQUE INDEX idx_users_email_lower ON users(lower(email));
|
||||
CREATE TABLE categories (id TEXT PRIMARY KEY, slug TEXT);
|
||||
INSERT INTO users VALUES ('a', 'ann', 'h.s', 'a@x.test');
|
||||
INSERT INTO categories VALUES ('c', 'authorize'), ('d', 'music');
|
||||
`);
|
||||
up0024(db);
|
||||
up0024(db); // idempotent
|
||||
|
||||
// Two accounts without a password may share an address with a local one.
|
||||
db.exec(`
|
||||
INSERT INTO users VALUES ('b', 'ann@one.test', '', 'a@x.test');
|
||||
INSERT INTO users VALUES ('c', 'ann@two.test', '', 'A@x.test');
|
||||
`);
|
||||
assertThrows(() =>
|
||||
db.exec(`INSERT INTO users VALUES ('d', 'dup', 'h.s', 'a@X.test');`)
|
||||
);
|
||||
const slugs = db.prepare(`SELECT slug FROM categories ORDER BY id;`)
|
||||
.all() as { slug: string }[];
|
||||
assertEquals(slugs.map((r) => r.slug), ["authorize-2", "music"]);
|
||||
for (
|
||||
const table of [
|
||||
"federation_keys",
|
||||
"user_identities",
|
||||
"federation_peers",
|
||||
"federation_logins",
|
||||
"oauth_codes",
|
||||
"federation_grants",
|
||||
"federation_outbox",
|
||||
]
|
||||
) {
|
||||
db.prepare(`SELECT COUNT(*) FROM ${table};`).get();
|
||||
}
|
||||
db.close();
|
||||
});
|
||||
@@ -4,7 +4,13 @@ import { TEST_DIR } from "./setup.ts";
|
||||
import { stub } from "@std/testing/mock";
|
||||
import { app } from "../main.ts";
|
||||
import { db } from "../db/connection.ts";
|
||||
import { createJWT, createMediaToken } from "../lib/jwt.ts";
|
||||
import {
|
||||
createJWT,
|
||||
createMediaToken,
|
||||
generateInstanceKey,
|
||||
importInstanceKey,
|
||||
signInstanceToken,
|
||||
} from "../lib/jwt.ts";
|
||||
import { hashPassword } from "../lib/password.ts";
|
||||
import { uniqueSlug } from "../lib/slugify.ts";
|
||||
import { slugify } from "../../shared/slug.ts";
|
||||
@@ -12,6 +18,7 @@ import { dumpPath, playlistPath } from "../../shared/paths.ts";
|
||||
import { canonicalizeUrl } from "../lib/canonical-url.ts";
|
||||
import { clearRichContentCache } from "../services/rich-content-service.ts";
|
||||
import { clearImageCache } from "../remote/image-proxy.ts";
|
||||
import { clearInstanceCaches } from "../remote/gerbeur-instance.ts";
|
||||
import {
|
||||
type OutgoingEmail,
|
||||
setEmailTransport,
|
||||
@@ -24,6 +31,12 @@ export { app, db, TEST_DIR };
|
||||
// ── Database ─────────────────────────────────────────────────────────────────
|
||||
|
||||
const TABLES = [
|
||||
"user_identities",
|
||||
"federation_peers",
|
||||
"federation_logins",
|
||||
"oauth_codes",
|
||||
"federation_grants",
|
||||
"federation_outbox",
|
||||
"dump_backlinks",
|
||||
"dump_categories",
|
||||
"playlist_dumps",
|
||||
@@ -393,6 +406,7 @@ export function stubNetwork(
|
||||
// A new network: metadata cached from the last one no longer describes it.
|
||||
clearRichContentCache();
|
||||
clearImageCache();
|
||||
clearInstanceCaches();
|
||||
const fetchStub = stub(
|
||||
globalThis,
|
||||
"fetch",
|
||||
@@ -419,6 +433,137 @@ export function stubNetwork(
|
||||
};
|
||||
}
|
||||
|
||||
// ── Federation ───────────────────────────────────────────────────────────────
|
||||
|
||||
/** A user of a {@link FakeInstance}, as its identity tokens describe them. */
|
||||
export interface FakeIdentity {
|
||||
sub: string;
|
||||
preferred_username: string;
|
||||
email: string;
|
||||
picture?: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Another gerbeur instance at `origin`, answering through {@link stubNetwork}
|
||||
* (`stubNetwork((url, init) => fake.handle(url, init) ?? ...)`): its metadata,
|
||||
* its keys, a token endpoint that trades the codes the test `issue`s, an
|
||||
* events endpoint recording what it receives, and avatars.
|
||||
*/
|
||||
export interface FakeInstance {
|
||||
origin: string;
|
||||
/**
|
||||
* Makes a code for `identity`, answering the authorize URL `authorizeUrl`
|
||||
* (this instance's request) as the home would after consent.
|
||||
*/
|
||||
issue(authorizeUrl: string, identity: FakeIdentity): string;
|
||||
/** Signs an event about `sub` for this instance, as its outbox would. */
|
||||
event(sub: string, payload: Record<string, unknown>): Promise<string>;
|
||||
/** The events posted to it, as their JWTs. */
|
||||
received: string[];
|
||||
/** Answers a request to it, or null when `url` isn't on it. */
|
||||
handle(url: URL, init?: RequestInit): Promise<Response> | null;
|
||||
}
|
||||
|
||||
/** Makes a {@link FakeInstance} at `origin` with a fresh key. */
|
||||
export async function fakeInstance(origin: string): Promise<FakeInstance> {
|
||||
const { kid, privateJwk, publicJwk } = await generateInstanceKey();
|
||||
const key = await importInstanceKey(kid, privateJwk);
|
||||
const codes = new Map<
|
||||
string,
|
||||
{ identity: FakeIdentity; nonce: string; challenge: string; client: string }
|
||||
>();
|
||||
const received: string[] = [];
|
||||
const json = (body: unknown, status = 200) =>
|
||||
new Response(JSON.stringify(body), {
|
||||
status,
|
||||
headers: { "content-type": "application/json" },
|
||||
});
|
||||
const handle = async (url: URL, init?: RequestInit): Promise<Response> => {
|
||||
switch (url.pathname) {
|
||||
case "/.well-known/openid-configuration":
|
||||
return json({
|
||||
issuer: origin,
|
||||
authorization_endpoint: `${origin}/authorize`,
|
||||
token_endpoint: `${origin}/api/oauth/tokens`,
|
||||
jwks_uri: `${origin}/.well-known/jwks.json`,
|
||||
response_types_supported: ["code"],
|
||||
grant_types_supported: ["authorization_code"],
|
||||
subject_types_supported: ["public"],
|
||||
id_token_signing_alg_values_supported: ["EdDSA"],
|
||||
code_challenge_methods_supported: ["S256"],
|
||||
scopes_supported: ["openid", "profile", "email"],
|
||||
gerbeur_federation: 1,
|
||||
gerbeur_site_name: `Fake ${new URL(origin).host}`,
|
||||
gerbeur_redirect_uri: `${origin}/federation/callback`,
|
||||
gerbeur_events_endpoint: `${origin}/api/federation/events`,
|
||||
});
|
||||
case "/.well-known/jwks.json":
|
||||
return json({ keys: [publicJwk] });
|
||||
case "/api/oauth/tokens": {
|
||||
const form = new URLSearchParams(String(init?.body));
|
||||
const entry = codes.get(form.get("code") ?? "");
|
||||
codes.delete(form.get("code") ?? "");
|
||||
const verifier = form.get("code_verifier") ?? "";
|
||||
const hash = new Uint8Array(
|
||||
await crypto.subtle.digest(
|
||||
"SHA-256",
|
||||
new TextEncoder().encode(verifier),
|
||||
),
|
||||
);
|
||||
const challenge = btoa(String.fromCharCode(...hash))
|
||||
.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
|
||||
if (
|
||||
!entry || entry.challenge !== challenge ||
|
||||
entry.client !== form.get("client_id")
|
||||
) {
|
||||
return json({ error: "invalid_grant" }, 400);
|
||||
}
|
||||
const { sub, ...claims } = entry.identity;
|
||||
return json({
|
||||
id_token: await signInstanceToken(
|
||||
{ ...claims, nonce: entry.nonce },
|
||||
key,
|
||||
{ issuer: origin, audience: entry.client, subject: sub },
|
||||
"5m",
|
||||
),
|
||||
});
|
||||
}
|
||||
case "/api/federation/events":
|
||||
received.push(JSON.parse(String(init?.body)).event);
|
||||
return new Response(null, { status: 204 });
|
||||
default:
|
||||
if (url.pathname.endsWith("/avatar")) {
|
||||
return new Response(PNG, {
|
||||
headers: { "content-type": "image/png" },
|
||||
});
|
||||
}
|
||||
return json({ error: "not found" }, 404);
|
||||
}
|
||||
};
|
||||
return {
|
||||
origin,
|
||||
received,
|
||||
issue(authorizeUrl, identity) {
|
||||
const q = new URL(authorizeUrl).searchParams;
|
||||
const code = crypto.randomUUID();
|
||||
codes.set(code, {
|
||||
identity,
|
||||
nonce: q.get("nonce") ?? "",
|
||||
challenge: q.get("code_challenge") ?? "",
|
||||
client: q.get("client_id") ?? "",
|
||||
});
|
||||
return code;
|
||||
},
|
||||
event: (sub, payload) =>
|
||||
signInstanceToken(payload, key, {
|
||||
issuer: origin,
|
||||
audience: BASE_URL,
|
||||
subject: sub,
|
||||
}, "1h"),
|
||||
handle: (url, init) => url.origin === origin ? handle(url, init) : null,
|
||||
};
|
||||
}
|
||||
|
||||
// ── Email ────────────────────────────────────────────────────────────────────
|
||||
|
||||
/**
|
||||
|
||||
326
api/test/services/federation-service.test.ts
Normal file
326
api/test/services/federation-service.test.ts
Normal file
@@ -0,0 +1,326 @@
|
||||
import {
|
||||
createUser,
|
||||
db,
|
||||
del,
|
||||
type FakeInstance,
|
||||
fakeInstance,
|
||||
formWithFile,
|
||||
get,
|
||||
patch,
|
||||
PNG,
|
||||
post,
|
||||
put,
|
||||
stubNetwork,
|
||||
test,
|
||||
} from "../helpers.ts";
|
||||
import { assert, assertEquals, assertMatch } from "@std/assert";
|
||||
import type {
|
||||
FederationLoginResponse,
|
||||
FederationPeer,
|
||||
} from "../../../shared/federation.ts";
|
||||
import type { AuthResponse, SelfUser } from "../../../shared/user.ts";
|
||||
|
||||
const HOME = "https://home.test";
|
||||
|
||||
/** Puts `fake` behind the network, every other host answering 404. */
|
||||
function network(...fakes: FakeInstance[]) {
|
||||
return stubNetwork((url, init) => {
|
||||
for (const fake of fakes) {
|
||||
const res = fake.handle(url, init);
|
||||
if (res) return res;
|
||||
}
|
||||
return new Response("", { status: 404 });
|
||||
});
|
||||
}
|
||||
|
||||
async function trust(issuer: string, status = "trusted") {
|
||||
const admin = await createUser({ role: "admin" });
|
||||
return await put<FederationPeer>("/api/federation/peers", {
|
||||
auth: admin.auth,
|
||||
json: { instance: issuer, status },
|
||||
});
|
||||
}
|
||||
|
||||
/** Signs in through `home` as `identity`, as the pages would. */
|
||||
async function signIn(
|
||||
home: FakeInstance,
|
||||
identity: {
|
||||
sub: string;
|
||||
preferred_username: string;
|
||||
email: string;
|
||||
picture?: string;
|
||||
},
|
||||
inviteToken?: string,
|
||||
) {
|
||||
const start = await post<FederationLoginResponse>("/api/federation/logins", {
|
||||
json: { instance: new URL(home.origin).host, inviteToken },
|
||||
});
|
||||
if (start.status !== 200) return start;
|
||||
const authorizeUrl = start.data.authorizeUrl;
|
||||
const code = home.issue(authorizeUrl, identity);
|
||||
return await post<AuthResponse>("/api/federation/sessions", {
|
||||
json: { code, state: new URL(authorizeUrl).searchParams.get("state") },
|
||||
});
|
||||
}
|
||||
|
||||
const ALICE = {
|
||||
sub: "alice-id",
|
||||
preferred_username: "alice",
|
||||
email: "alice@home.example",
|
||||
picture: `${HOME}/api/users/alice-id/avatar?v=1`,
|
||||
};
|
||||
|
||||
test("federation: a trusted instance's user signs in as name@host, once made", async () => {
|
||||
const home = await fakeInstance(HOME);
|
||||
using net = network(home);
|
||||
assertEquals((await trust("home.test")).data.name, "Fake home.test");
|
||||
|
||||
const start = await post<FederationLoginResponse>("/api/federation/logins", {
|
||||
json: { instance: "home.test" },
|
||||
});
|
||||
const url = new URL(start.data.authorizeUrl);
|
||||
assertEquals(url.origin + url.pathname, `${HOME}/authorize`);
|
||||
assertEquals(url.searchParams.get("client_id"), "http://gerbeur.test");
|
||||
assertEquals(
|
||||
url.searchParams.get("redirect_uri"),
|
||||
"http://gerbeur.test/federation/callback",
|
||||
);
|
||||
assertEquals(url.searchParams.get("code_challenge_method"), "S256");
|
||||
|
||||
const first = await signIn(home, ALICE);
|
||||
const { user, token } = first.data as AuthResponse;
|
||||
assertEquals(user.username, "alice@home.test");
|
||||
assertEquals(user.email, "alice@home.example");
|
||||
assertEquals(user.role, "user");
|
||||
assertEquals(user.avatarMime, "image/png");
|
||||
assert(net.calls.some((u) => u.pathname === "/api/users/alice-id/avatar"));
|
||||
|
||||
const me = await get<SelfUser>("/api/me", {
|
||||
auth: { Authorization: `Bearer ${token}` },
|
||||
});
|
||||
assertEquals(me.data.id, user.id);
|
||||
|
||||
// The same identity signs in to the same account.
|
||||
const again = await signIn(home, ALICE);
|
||||
assertEquals((again.data as AuthResponse).user.id, user.id);
|
||||
|
||||
// It has no password here.
|
||||
const login = await post("/api/sessions", {
|
||||
json: { username: "alice@home.test", password: "" },
|
||||
});
|
||||
assertEquals(login.status, 401);
|
||||
assertEquals(
|
||||
(await get<SelfUser>("/api/users/@alice@home.test")).data.id,
|
||||
user.id,
|
||||
);
|
||||
// The client encodes the handle's `@`.
|
||||
assertEquals(
|
||||
(await get<SelfUser>("/api/users/@alice%40home.test")).data.id,
|
||||
user.id,
|
||||
);
|
||||
});
|
||||
|
||||
test("federation: a login works once, with the code the home made for it", async () => {
|
||||
const home = await fakeInstance(HOME);
|
||||
using _net = network(home);
|
||||
await trust(HOME);
|
||||
const start = await post<FederationLoginResponse>("/api/federation/logins", {
|
||||
json: { instance: HOME },
|
||||
});
|
||||
const state = new URL(start.data.authorizeUrl).searchParams.get("state");
|
||||
const wrong = await post("/api/federation/sessions", {
|
||||
json: { code: "made-up", state },
|
||||
});
|
||||
assertEquals(wrong.status, 502);
|
||||
// The failed try used the login up.
|
||||
const code = home.issue(start.data.authorizeUrl, ALICE);
|
||||
const replay = await post("/api/federation/sessions", {
|
||||
json: { code, state },
|
||||
});
|
||||
assertEquals(replay.status, 400);
|
||||
});
|
||||
|
||||
test("federation: an instance on neither list needs an invite, claimed on joining", async () => {
|
||||
const home = await fakeInstance(HOME);
|
||||
using _net = network(home);
|
||||
const refused = await signIn(home, ALICE);
|
||||
assertEquals(refused.status, 403);
|
||||
|
||||
const inviter = await createUser();
|
||||
const { token } = (await post<{ token: string }>("/api/invites", {
|
||||
auth: inviter.auth,
|
||||
})).data;
|
||||
const joined = await signIn(home, ALICE, token);
|
||||
const { user } = joined.data as AuthResponse;
|
||||
assertEquals(user.username, "alice@home.test");
|
||||
const row = db.prepare(`SELECT invited_by FROM users WHERE id = ?;`).get(
|
||||
user.id,
|
||||
) as { invited_by: string };
|
||||
assertEquals(row.invited_by, inviter.id);
|
||||
assertEquals((await get(`/api/invites/${token}`)).status, 404);
|
||||
|
||||
// Once here, no invite is needed; another user of that instance still
|
||||
// needs one.
|
||||
assertEquals((await signIn(home, ALICE)).status, 200);
|
||||
const bob = { ...ALICE, sub: "bob-id", preferred_username: "bob" };
|
||||
assertEquals((await signIn(home, bob)).status, 403);
|
||||
});
|
||||
|
||||
test("federation: blocking an instance refuses its users and ends their sessions", async () => {
|
||||
const home = await fakeInstance(HOME);
|
||||
using _net = network(home);
|
||||
await trust(HOME);
|
||||
const { token } = (await signIn(home, ALICE)).data as AuthResponse;
|
||||
const auth = { Authorization: `Bearer ${token}` };
|
||||
assertEquals((await get("/api/me", { auth })).status, 200);
|
||||
|
||||
await trust(HOME, "blocked");
|
||||
assertEquals((await get("/api/me", { auth })).status, 401);
|
||||
assertEquals((await signIn(home, ALICE)).status, 403);
|
||||
|
||||
const admin = await createUser({ role: "admin" });
|
||||
const peers = await get<FederationPeer[]>("/api/federation/peers", {
|
||||
auth: admin.auth,
|
||||
});
|
||||
assertEquals(peers.data.map((p) => p.status), ["blocked"]);
|
||||
assertEquals((await get<FederationPeer[]>("/api/federation/peers")).data, []);
|
||||
assertEquals(
|
||||
(await del("/api/federation/peers/home.test", { auth: admin.auth }))
|
||||
.status,
|
||||
200,
|
||||
);
|
||||
assertEquals((await get("/api/me", { auth })).status, 200);
|
||||
});
|
||||
|
||||
test("federation: only admins edit the peers, which must answer as gerbeurs", async () => {
|
||||
const home = await fakeInstance(HOME);
|
||||
using _net = network(home);
|
||||
const user = await createUser();
|
||||
const admin = await createUser({ role: "admin" });
|
||||
assertEquals(
|
||||
(await put("/api/federation/peers", {
|
||||
auth: user.auth,
|
||||
json: { instance: HOME, status: "trusted" },
|
||||
})).status,
|
||||
403,
|
||||
);
|
||||
for (const instance of ["elsewhere.test", "https://home.test/path"]) {
|
||||
const res = await put("/api/federation/peers", {
|
||||
auth: admin.auth,
|
||||
json: { instance, status: "trusted" },
|
||||
});
|
||||
assert(res.status >= 400, instance);
|
||||
}
|
||||
assertEquals(
|
||||
(await put("/api/federation/peers", {
|
||||
auth: admin.auth,
|
||||
json: { instance: "http://gerbeur.test", status: "trusted" },
|
||||
})).status,
|
||||
400,
|
||||
);
|
||||
});
|
||||
|
||||
test("federation: the home's events rename, update and sign out its users", async () => {
|
||||
const home = await fakeInstance(HOME);
|
||||
const other = await fakeInstance("https://other.test");
|
||||
using _net = network(home, other);
|
||||
await trust(HOME);
|
||||
const { user, token } = (await signIn(home, ALICE)).data as AuthResponse;
|
||||
const auth = { Authorization: `Bearer ${token}` };
|
||||
|
||||
const update = await home.event(ALICE.sub, {
|
||||
type: "update",
|
||||
claims: { ...ALICE, preferred_username: "alicia", email: "a@new.example" },
|
||||
});
|
||||
assertEquals(
|
||||
(await post("/api/federation/events", { json: { event: update } }))
|
||||
.status,
|
||||
204,
|
||||
);
|
||||
const renamed = await get<SelfUser>("/api/me", { auth });
|
||||
assertEquals(renamed.data.username, "alicia@home.test");
|
||||
assertEquals(renamed.data.email, "a@new.example");
|
||||
// The old handle still leads to them.
|
||||
assertEquals(
|
||||
(await get<SelfUser>("/api/users/@alice@home.test")).data.id,
|
||||
user.id,
|
||||
);
|
||||
|
||||
// Another instance can't speak for this one's users.
|
||||
const forged = await other.event(ALICE.sub, { type: "revoke" });
|
||||
assertEquals(
|
||||
(await post("/api/federation/events", { json: { event: forged } }))
|
||||
.status,
|
||||
400,
|
||||
);
|
||||
|
||||
// Revoking a little later than the token was issued, as it would be.
|
||||
await new Promise((r) => setTimeout(r, 1100));
|
||||
const revoke = await home.event(ALICE.sub, { type: "revoke" });
|
||||
assertEquals(
|
||||
(await post("/api/federation/events", { json: { event: revoke } }))
|
||||
.status,
|
||||
204,
|
||||
);
|
||||
assertEquals((await get("/api/me", { auth })).status, 401);
|
||||
});
|
||||
|
||||
test("federation: an account from another instance changes its password, email, avatar and name there", async () => {
|
||||
const home = await fakeInstance(HOME);
|
||||
using _net = network(home);
|
||||
await trust(HOME);
|
||||
const { user, token } = (await signIn(home, ALICE)).data as AuthResponse;
|
||||
const auth = { Authorization: `Bearer ${token}` };
|
||||
const admin = await createUser({ role: "admin" });
|
||||
|
||||
assertEquals(
|
||||
(await put("/api/me/password", {
|
||||
auth,
|
||||
json: { currentPassword: "", newPassword: "long-enough" },
|
||||
})).status,
|
||||
400,
|
||||
);
|
||||
assertEquals(
|
||||
(await patch("/api/me", { auth, json: { email: "x@example.test" } }))
|
||||
.status,
|
||||
400,
|
||||
);
|
||||
assertEquals(
|
||||
(await patch<SelfUser>("/api/me", { auth, json: { description: "hi" } }))
|
||||
.data.description,
|
||||
"hi",
|
||||
);
|
||||
assertEquals(
|
||||
(await put("/api/me/avatar", { auth, form: formWithFile(PNG) })).status,
|
||||
400,
|
||||
);
|
||||
assertEquals(
|
||||
(await patch(`/api/users/${user.id}/username`, {
|
||||
auth: admin.auth,
|
||||
json: { username: "bob" },
|
||||
})).status,
|
||||
400,
|
||||
);
|
||||
});
|
||||
|
||||
test("federation: an email may be both a local account's and a remote one's", async () => {
|
||||
const home = await fakeInstance(HOME);
|
||||
using _net = network(home);
|
||||
await trust(HOME);
|
||||
const local = await createUser({ email: ALICE.email });
|
||||
const res = await signIn(home, ALICE);
|
||||
assertMatch((res.data as AuthResponse).user.username, /@home\.test$/);
|
||||
// A reset by that address reaches the local account only.
|
||||
const row = db.prepare(
|
||||
`SELECT COUNT(*) AS n FROM users WHERE lower(email) = lower(?);`,
|
||||
).get(ALICE.email) as { n: number };
|
||||
assertEquals(row.n, 2);
|
||||
assertEquals(
|
||||
(await post("/api/password-resets", { json: { email: ALICE.email } }))
|
||||
.status,
|
||||
200,
|
||||
);
|
||||
const tokens = db.prepare(`SELECT user_id FROM password_reset_tokens;`)
|
||||
.all() as { user_id: string }[];
|
||||
assert(tokens.every((t) => t.user_id === local.id));
|
||||
});
|
||||
268
api/test/services/identity-provider-service.test.ts
Normal file
268
api/test/services/identity-provider-service.test.ts
Normal file
@@ -0,0 +1,268 @@
|
||||
import {
|
||||
app,
|
||||
BASE_URL,
|
||||
createUser,
|
||||
db,
|
||||
del,
|
||||
type FakeInstance,
|
||||
fakeInstance,
|
||||
get,
|
||||
patch,
|
||||
post,
|
||||
put,
|
||||
stubNetwork,
|
||||
test,
|
||||
} from "../helpers.ts";
|
||||
import { assert, assertEquals } from "@std/assert";
|
||||
import { createHash } from "node:crypto";
|
||||
import { decodeJwt, type JSONWebKeySet } from "@panva/jose";
|
||||
import { verifyInstanceToken } from "../../lib/jwt.ts";
|
||||
import type {
|
||||
AuthorizeResponse,
|
||||
FederationGrant,
|
||||
InstanceMetadata,
|
||||
OAuthClient,
|
||||
} from "../../../shared/federation.ts";
|
||||
|
||||
const CLIENT = "https://client.test";
|
||||
const CALLBACK = `${CLIENT}/federation/callback`;
|
||||
|
||||
function network(fake: FakeInstance, events?: () => Response) {
|
||||
return stubNetwork((url, init) => {
|
||||
if (events && url.pathname === "/api/federation/events") return events();
|
||||
return fake.handle(url, init) ?? new Response("", { status: 404 });
|
||||
});
|
||||
}
|
||||
|
||||
/** A PKCE pair: the verifier, and the challenge the request carries. */
|
||||
function pkce() {
|
||||
const verifier = crypto.randomUUID() + crypto.randomUUID();
|
||||
return {
|
||||
verifier,
|
||||
challenge: createHash("sha256").update(verifier).digest("base64url"),
|
||||
};
|
||||
}
|
||||
|
||||
function authorize(
|
||||
auth: { Authorization: string },
|
||||
challenge: string,
|
||||
overrides: Record<string, string> = {},
|
||||
) {
|
||||
return post<AuthorizeResponse>("/api/oauth/codes", {
|
||||
auth,
|
||||
json: {
|
||||
clientId: CLIENT,
|
||||
redirectUri: CALLBACK,
|
||||
state: "the-state",
|
||||
codeChallenge: challenge,
|
||||
codeChallengeMethod: "S256",
|
||||
nonce: "the-nonce",
|
||||
...overrides,
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
/** Trades `code` at the token endpoint, as the client's server would. */
|
||||
async function trade(code: string, verifier: string, client = CLIENT) {
|
||||
const res = await app.handle(
|
||||
new Request(`${BASE_URL}/api/oauth/tokens`, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/x-www-form-urlencoded" },
|
||||
body: new URLSearchParams({
|
||||
grant_type: "authorization_code",
|
||||
code,
|
||||
client_id: client,
|
||||
redirect_uri: CALLBACK,
|
||||
code_verifier: verifier,
|
||||
}),
|
||||
}),
|
||||
);
|
||||
return { status: res!.status, body: await res!.json() };
|
||||
}
|
||||
|
||||
async function until(check: () => boolean) {
|
||||
for (let i = 0; i < 50 && !check(); i++) {
|
||||
await new Promise((r) => setTimeout(r, 10));
|
||||
}
|
||||
}
|
||||
|
||||
test("identity provider: metadata and keys are served at the well-known paths", async () => {
|
||||
const meta = await get("/.well-known/openid-configuration");
|
||||
const body = JSON.parse(
|
||||
new TextDecoder().decode(meta.bytes),
|
||||
) as InstanceMetadata;
|
||||
assertEquals(body.issuer, BASE_URL);
|
||||
assertEquals(body.authorization_endpoint, `${BASE_URL}/authorize`);
|
||||
assertEquals(body.gerbeur_redirect_uri, `${BASE_URL}/federation/callback`);
|
||||
assertEquals(body.gerbeur_federation, 1);
|
||||
const jwks = await get("/.well-known/jwks.json");
|
||||
const keys = JSON.parse(new TextDecoder().decode(jwks.bytes)).keys;
|
||||
assertEquals(keys[0].crv, "Ed25519");
|
||||
assertEquals(keys[0].d, undefined);
|
||||
});
|
||||
|
||||
test("identity provider: a consenting user's code trades once for their identity", async () => {
|
||||
const fake = await fakeInstance(CLIENT);
|
||||
using _net = network(fake);
|
||||
const user = await createUser({ username: "carol" });
|
||||
|
||||
const client = await get<OAuthClient>(
|
||||
`/api/oauth/clients?client_id=${encodeURIComponent(CLIENT)}`,
|
||||
{ auth: user.auth },
|
||||
);
|
||||
assertEquals(client.data, {
|
||||
clientId: CLIENT,
|
||||
host: "client.test",
|
||||
name: "Fake client.test",
|
||||
granted: false,
|
||||
});
|
||||
|
||||
const { verifier, challenge } = pkce();
|
||||
const redirect = new URL(
|
||||
(await authorize(user.auth, challenge)).data
|
||||
.redirectTo,
|
||||
);
|
||||
assertEquals(redirect.origin + redirect.pathname, CALLBACK);
|
||||
assertEquals(redirect.searchParams.get("state"), "the-state");
|
||||
assertEquals(redirect.searchParams.get("iss"), BASE_URL);
|
||||
const code = redirect.searchParams.get("code")!;
|
||||
|
||||
assertEquals((await trade(code, pkce().verifier)).status, 400);
|
||||
// A failed trade used the code up too.
|
||||
assertEquals((await trade(code, verifier)).status, 400);
|
||||
|
||||
const { challenge: c2, verifier: v2 } = pkce();
|
||||
const code2 = new URL((await authorize(user.auth, c2)).data.redirectTo)
|
||||
.searchParams.get("code")!;
|
||||
assertEquals((await trade(code2, v2, "https://elsewhere.test")).status, 400);
|
||||
const { challenge: c3, verifier: v3 } = pkce();
|
||||
const code3 = new URL((await authorize(user.auth, c3)).data.redirectTo)
|
||||
.searchParams.get("code")!;
|
||||
const traded = await trade(code3, v3);
|
||||
assertEquals(traded.status, 200);
|
||||
|
||||
const keys = JSON.parse(
|
||||
new TextDecoder().decode((await get("/.well-known/jwks.json")).bytes),
|
||||
) as JSONWebKeySet;
|
||||
const claims = await verifyInstanceToken(traded.body.id_token, keys, {
|
||||
issuer: BASE_URL,
|
||||
audience: CLIENT,
|
||||
});
|
||||
assertEquals(claims.sub, user.id);
|
||||
assertEquals(claims.preferred_username, "carol");
|
||||
assertEquals(claims.email, user.email);
|
||||
assertEquals(claims.nonce, "the-nonce");
|
||||
|
||||
const again = await get<OAuthClient>(
|
||||
`/api/oauth/clients?client_id=${encodeURIComponent(CLIENT)}`,
|
||||
{ auth: user.auth },
|
||||
);
|
||||
assertEquals(again.data.granted, true);
|
||||
const grants = await get<FederationGrant[]>("/api/me/grants", {
|
||||
auth: user.auth,
|
||||
});
|
||||
assertEquals(grants.data.map((g) => g.host), ["client.test"]);
|
||||
});
|
||||
|
||||
test("identity provider: codes are only for a known client's own callback", async () => {
|
||||
const fake = await fakeInstance(CLIENT);
|
||||
using _net = network(fake);
|
||||
const user = await createUser();
|
||||
const admin = await createUser({ role: "admin" });
|
||||
const { challenge } = pkce();
|
||||
assertEquals(
|
||||
(await authorize(user.auth, challenge, {
|
||||
redirectUri: "https://evil.test/cb",
|
||||
})).status,
|
||||
400,
|
||||
);
|
||||
assertEquals(
|
||||
(await authorize(user.auth, challenge, { clientId: BASE_URL })).status,
|
||||
400,
|
||||
);
|
||||
assertEquals(
|
||||
(await authorize(user.auth, challenge, { codeChallengeMethod: "plain" }))
|
||||
.status,
|
||||
400,
|
||||
);
|
||||
assertEquals(
|
||||
(await authorize(user.auth, challenge, {
|
||||
clientId: "https://nowhere.test",
|
||||
})).status,
|
||||
502,
|
||||
);
|
||||
await put("/api/federation/peers", {
|
||||
auth: admin.auth,
|
||||
json: { instance: CLIENT, status: "blocked" },
|
||||
});
|
||||
assertEquals((await authorize(user.auth, challenge)).status, 403);
|
||||
});
|
||||
|
||||
test("identity provider: an account from another instance doesn't sign in elsewhere from here", async () => {
|
||||
const fake = await fakeInstance(CLIENT);
|
||||
using _net = network(fake);
|
||||
const user = await createUser();
|
||||
db.prepare(`UPDATE users SET password_hash = '' WHERE id = ?;`).run(user.id);
|
||||
assertEquals((await authorize(user.auth, pkce().challenge)).status, 400);
|
||||
});
|
||||
|
||||
test("identity provider: the instances a user signed in to hear of their changes", async () => {
|
||||
const fake = await fakeInstance(CLIENT);
|
||||
using _net = network(fake);
|
||||
const user = await createUser({ username: "dave" });
|
||||
const admin = await createUser({ role: "admin" });
|
||||
await authorize(user.auth, pkce().challenge);
|
||||
|
||||
await patch(`/api/users/${user.id}/username`, {
|
||||
auth: admin.auth,
|
||||
json: { username: "david" },
|
||||
});
|
||||
await until(() => fake.received.length === 1);
|
||||
const update = decodeJwt(fake.received[0]);
|
||||
assertEquals(update.type, "update");
|
||||
assertEquals(update.sub, user.id);
|
||||
assertEquals(update.aud, CLIENT);
|
||||
assertEquals(
|
||||
(update.claims as { preferred_username: string }).preferred_username,
|
||||
"david",
|
||||
);
|
||||
|
||||
await put("/api/me/password", {
|
||||
auth: user.auth,
|
||||
json: { currentPassword: "correct-horse", newPassword: "new-password" },
|
||||
});
|
||||
await until(() => fake.received.length === 2);
|
||||
assertEquals(decodeJwt(fake.received[1]).type, "revoke");
|
||||
|
||||
const token = (await post<{ token: string }>("/api/sessions", {
|
||||
json: { username: "david", password: "new-password" },
|
||||
})).data.token;
|
||||
const auth = { Authorization: `Bearer ${token}` };
|
||||
assertEquals(
|
||||
(await del("/api/me/grants/client.test", { auth })).status,
|
||||
200,
|
||||
);
|
||||
await until(() => fake.received.length === 3);
|
||||
assertEquals(decodeJwt(fake.received[2]).type, "revoke");
|
||||
assertEquals(
|
||||
(await get<FederationGrant[]>("/api/me/grants", { auth })).data,
|
||||
[],
|
||||
);
|
||||
});
|
||||
|
||||
test("identity provider: an event an instance fails to take waits in the outbox", async () => {
|
||||
const fake = await fakeInstance(CLIENT);
|
||||
using _net = network(fake, () => new Response("", { status: 503 }));
|
||||
const user = await createUser();
|
||||
await authorize(user.auth, pkce().challenge);
|
||||
await patch("/api/me", { auth: user.auth, json: { email: "e@new.test" } });
|
||||
let row: { attempts: number } | undefined;
|
||||
await until(() => {
|
||||
row = db.prepare(`SELECT attempts FROM federation_outbox;`).get() as
|
||||
| { attempts: number }
|
||||
| undefined;
|
||||
return (row?.attempts ?? 0) > 0;
|
||||
});
|
||||
assert(row);
|
||||
assertEquals(row.attempts, 1);
|
||||
});
|
||||
56
api/validators/federation.ts
Normal file
56
api/validators/federation.ts
Normal file
@@ -0,0 +1,56 @@
|
||||
/**
|
||||
* Checks the JSON bodies that the federation routes (`routes/federation.ts`,
|
||||
* `routes/oauth.ts`) receive before they read them. They check the shapes
|
||||
* only: whether an instance answers, or a code or an invite works, is the
|
||||
* services' check.
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
|
||||
import {
|
||||
type AuthorizeRequest,
|
||||
type FederationLoginRequest,
|
||||
type FederationSessionRequest,
|
||||
isPeerStatus,
|
||||
type SetPeerRequest,
|
||||
} from "../../shared/federation.ts";
|
||||
|
||||
/** Returns whether `obj` is an object whose `keys` are all strings. */
|
||||
function hasStrings(obj: unknown, keys: string[]): boolean {
|
||||
return !!obj && typeof obj === "object" &&
|
||||
keys.every((k) => typeof (obj as Record<string, unknown>)[k] === "string");
|
||||
}
|
||||
|
||||
/** Checks whether `obj` is a {@link FederationLoginRequest}. */
|
||||
export function isFederationLoginRequest(
|
||||
obj: unknown,
|
||||
): obj is FederationLoginRequest {
|
||||
if (!hasStrings(obj, ["instance"])) return false;
|
||||
const invite = (obj as Record<string, unknown>).inviteToken;
|
||||
return invite === undefined || typeof invite === "string";
|
||||
}
|
||||
|
||||
/** Checks whether `obj` is a {@link FederationSessionRequest}. */
|
||||
export function isFederationSessionRequest(
|
||||
obj: unknown,
|
||||
): obj is FederationSessionRequest {
|
||||
return hasStrings(obj, ["code", "state"]);
|
||||
}
|
||||
|
||||
/** Checks whether `obj` is an {@link AuthorizeRequest}. */
|
||||
export function isAuthorizeRequest(obj: unknown): obj is AuthorizeRequest {
|
||||
return hasStrings(obj, [
|
||||
"clientId",
|
||||
"redirectUri",
|
||||
"state",
|
||||
"codeChallenge",
|
||||
"codeChallengeMethod",
|
||||
"nonce",
|
||||
]);
|
||||
}
|
||||
|
||||
/** Checks whether `obj` is a {@link SetPeerRequest}. */
|
||||
export function isSetPeerRequest(obj: unknown): obj is SetPeerRequest {
|
||||
return hasStrings(obj, ["instance"]) &&
|
||||
isPeerStatus((obj as Record<string, unknown>).status);
|
||||
}
|
||||
Reference in New Issue
Block a user