A remote actor is believed only from its own origin
S1 and S2 of the roadmap. RemoteActorService: - FetchObject accepts a document only when its id is the address it was served from; a same-origin document naming another address is asked for at that address once (how GoToSocial serves its key URIs), anything else is dropped; - GetActorByKeyId accepts a key only when the actor lists it, its owner is the actor and it lives on the actor's origin, whether the keyId points at the actor or at a key document; - a refetch for a key or an actor happens at most once per five minutes, so a bad signature cannot make us hammer a host; - the cache row is written by one atomic upsert on ActorURI; - every fetch is signed by the instance actor, never by the persona that happened to receive the activity. The inbox refuses an activity whose id is not on its actor's origin, and an Undo of someone else's activity; a Create's object, an Update and a Delete must be on the actor's origin too, and a cross-origin object is refetched from its own origin before it is trusted. Tests: a fake peer on two origins serves forged actors, foreign-owned keys, cross-origin key documents, aliases and a GoToSocial-style key address (integration, PRIVAPUB_TEST_MONGOD=1). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB
This commit is contained in:
thepraandClaude Opus 5.5 committed
1 parent
ccc3597699
commit
a060204dd6
9 files changed
+593
-81
No files matched your search
@@ -0,0 +1,244 @@
|
||||
using Microsoft.Extensions.Caching.Memory;
|
||||
|
||||
using PrivaPub.Federation.Actors;
|
||||
using PrivaPub.Models;
|
||||
using PrivaPub.StaticServices;
|
||||
using PrivaPub.Tests.Support;
|
||||
|
||||
using System.Text.Json;
|
||||
using System.Text.Json.Nodes;
|
||||
|
||||
namespace PrivaPub.Tests.Federation
|
||||
{
|
||||
[Trait("Category", "Integration")]
|
||||
public sealed class RemoteActorServiceTests : IAsyncLifetime
|
||||
{
|
||||
Peer _peer;
|
||||
RemoteActorService _service;
|
||||
|
||||
public async ValueTask InitializeAsync()
|
||||
{
|
||||
Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
|
||||
_peer = await Peer.Start();
|
||||
var cache = new MemoryCache(new MemoryCacheOptions());
|
||||
var local = new LocalActorService(new DbEntities(),
|
||||
new StaticOptions<AppConfiguration>(new AppConfiguration { BackendBaseAddress = "https://privapub.test" }));
|
||||
_service = new RemoteActorService(Peer.Http(cache), local, cache, new DbEntities());
|
||||
}
|
||||
|
||||
public async ValueTask DisposeAsync()
|
||||
{
|
||||
if (_peer != default)
|
||||
await _peer.DisposeAsync();
|
||||
}
|
||||
|
||||
static string Actor(string id, string keyId = default, string owner = default, string pem = default, string type = "Person") =>
|
||||
new JsonObject
|
||||
{
|
||||
["id"] = id,
|
||||
["type"] = type,
|
||||
["preferredUsername"] = id[(id.LastIndexOf('/') + 1)..],
|
||||
["inbox"] = id + "/inbox",
|
||||
["publicKey"] = new JsonObject
|
||||
{
|
||||
["id"] = keyId ?? id + "#main-key",
|
||||
["owner"] = owner ?? id,
|
||||
["publicKeyPem"] = pem ?? Keys.NewKeyPair().PublicKeyPem
|
||||
}
|
||||
}.ToJsonString();
|
||||
|
||||
string Unique(string name) => $"/users/{name}{Guid.NewGuid():N}";
|
||||
|
||||
[Fact]
|
||||
public async Task Accepts_an_actor_whose_document_names_its_own_address()
|
||||
{
|
||||
var path = Unique("alice");
|
||||
_peer.Serve(path, Actor("{A}" + path));
|
||||
|
||||
var actor = await _service.GetActorByKeyId($"{_peer.A}{path}#main-key", refresh: false, TestContext.Current.CancellationToken);
|
||||
|
||||
Assert.NotNull(actor);
|
||||
Assert.Equal(_peer.A + path, actor.ActorURI);
|
||||
Assert.Equal($"{_peer.A}{path}#main-key", actor.PublicKeyId);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Refuses_a_document_that_claims_another_origin()
|
||||
{
|
||||
var victim = Unique("bob");
|
||||
var mallory = Unique("mallory");
|
||||
_peer.Serve(mallory, Actor("{B}" + victim));
|
||||
|
||||
var actor = await _service.GetActor(_peer.A + mallory, refresh: false, TestContext.Current.CancellationToken);
|
||||
var byKey = await _service.GetActorByKeyId($"{_peer.B}{victim}#main-key", refresh: false, TestContext.Current.CancellationToken);
|
||||
|
||||
Assert.Null(actor);
|
||||
Assert.Null(byKey);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Refuses_a_key_owned_by_someone_else()
|
||||
{
|
||||
var eve = Unique("eve");
|
||||
_peer.Serve(eve, Actor("{A}" + eve, owner: "{A}/users/alice"));
|
||||
|
||||
Assert.Null(await _service.GetActorByKeyId($"{_peer.A}{eve}#main-key", refresh: false, TestContext.Current.CancellationToken));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Refuses_a_key_document_whose_owner_is_on_another_origin()
|
||||
{
|
||||
var alice = Unique("alice");
|
||||
var key = $"/keys/{Guid.NewGuid():N}";
|
||||
_peer.Serve(alice, Actor("{B}" + alice));
|
||||
_peer.Serve(key, new JsonObject { ["id"] = "{A}" + key, ["owner"] = "{B}" + alice, ["publicKeyPem"] = Keys.NewKeyPair().PublicKeyPem }.ToJsonString());
|
||||
|
||||
Assert.Null(await _service.GetActorByKeyId(_peer.A + key, refresh: false, TestContext.Current.CancellationToken));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Refuses_a_key_the_actor_does_not_list()
|
||||
{
|
||||
var alice = Unique("alice");
|
||||
_peer.Serve(alice, Actor("{A}" + alice));
|
||||
|
||||
Assert.Null(await _service.GetActorByKeyId($"{_peer.A}{alice}#other-key", refresh: false, TestContext.Current.CancellationToken));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Follows_a_same_origin_alias_to_the_actor_it_names()
|
||||
{
|
||||
var alice = Unique("alice");
|
||||
var alias = $"/@alias{Guid.NewGuid():N}";
|
||||
_peer.Serve(alice, Actor("{A}" + alice));
|
||||
_peer.Serve(alias, Actor("{A}" + alice));
|
||||
|
||||
var actor = await _service.GetActor(_peer.A + alias, refresh: false, TestContext.Current.CancellationToken);
|
||||
|
||||
Assert.NotNull(actor);
|
||||
Assert.Equal(_peer.A + alice, actor.ActorURI);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Resolves_a_gotosocial_style_key_address()
|
||||
{
|
||||
var gts = Unique("gts");
|
||||
var keyPath = gts + "/main-key";
|
||||
var pem = Keys.NewKeyPair().PublicKeyPem;
|
||||
_peer.Serve(gts, Actor("{A}" + gts, keyId: "{A}" + keyPath, pem: pem));
|
||||
_peer.Serve(keyPath, Actor("{A}" + gts, keyId: "{A}" + keyPath, pem: pem));
|
||||
|
||||
var actor = await _service.GetActorByKeyId(_peer.A + keyPath, refresh: false, TestContext.Current.CancellationToken);
|
||||
|
||||
Assert.NotNull(actor);
|
||||
Assert.Equal(_peer.A + gts, actor.ActorURI);
|
||||
Assert.Equal(pem, actor.PublicKey);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task A_rotated_key_replaces_the_stored_one_but_only_once_per_interval()
|
||||
{
|
||||
var alice = Unique("alice");
|
||||
var keyId = $"{_peer.A}{alice}#main-key";
|
||||
var first = Keys.NewKeyPair().PublicKeyPem;
|
||||
var second = Keys.NewKeyPair().PublicKeyPem;
|
||||
var third = Keys.NewKeyPair().PublicKeyPem;
|
||||
_peer.Serve(alice, Actor("{A}" + alice, pem: first));
|
||||
var token = TestContext.Current.CancellationToken;
|
||||
|
||||
Assert.Equal(first, (await _service.GetActorByKeyId(keyId, refresh: false, token)).PublicKey);
|
||||
_peer.Serve(alice, Actor("{A}" + alice, pem: second));
|
||||
Assert.Equal(first, (await _service.GetActorByKeyId(keyId, refresh: true, token)).PublicKey);
|
||||
|
||||
var fresh = new RemoteActorService(Peer.Http(), new LocalActorService(new DbEntities(),
|
||||
new StaticOptions<AppConfiguration>(new AppConfiguration { BackendBaseAddress = "https://privapub.test" })),
|
||||
new MemoryCache(new MemoryCacheOptions()), new DbEntities());
|
||||
Assert.Equal(second, (await fresh.GetActorByKeyId(keyId, refresh: true, token)).PublicKey);
|
||||
_peer.Serve(alice, Actor("{A}" + alice, pem: third));
|
||||
Assert.Equal(second, (await fresh.GetActorByKeyId(keyId, refresh: true, token)).PublicKey);
|
||||
Assert.Single(await new DbEntities().ForeignAvatars.Match(a => a.ActorURI == _peer.A + alice).ExecuteAsync(token));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Signs_every_fetch()
|
||||
{
|
||||
var alice = Unique("alice");
|
||||
_peer.Serve(alice, Actor("{A}" + alice));
|
||||
|
||||
await _service.GetActor(_peer.A + alice, refresh: false, TestContext.Current.CancellationToken);
|
||||
|
||||
var request = Assert.Single(_peer.Requests, r => r.Path == alice);
|
||||
Assert.Contains("keyId=\"https://privapub.test/peasants/privapub#main-key\"", request.Signature);
|
||||
}
|
||||
}
|
||||
|
||||
public class ActorDocumentTests
|
||||
{
|
||||
[Fact]
|
||||
public void Reads_a_mastodon_actor()
|
||||
{
|
||||
var document = ActorDocument.Parse(JsonDocument.Parse("""
|
||||
{
|
||||
"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
|
||||
"id": "https://mastodon.example/users/alice",
|
||||
"type": "Person",
|
||||
"preferredUsername": "alice",
|
||||
"name": "Alice",
|
||||
"inbox": "https://mastodon.example/users/alice/inbox",
|
||||
"outbox": "https://mastodon.example/users/alice/outbox",
|
||||
"url": "https://mastodon.example/@alice",
|
||||
"discoverable": false,
|
||||
"endpoints": { "sharedInbox": "https://mastodon.example/inbox" },
|
||||
"icon": { "type": "Image", "url": "https://files.mastodon.example/a.png" },
|
||||
"publicKey": {
|
||||
"id": "https://mastodon.example/users/alice#main-key",
|
||||
"owner": "https://mastodon.example/users/alice",
|
||||
"publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMIIB\n-----END PUBLIC KEY-----\n"
|
||||
}
|
||||
}
|
||||
""").RootElement);
|
||||
|
||||
Assert.Equal("alice", document.PreferredUsername);
|
||||
Assert.Equal("https://mastodon.example/inbox", document.SharedInbox);
|
||||
Assert.Equal("https://files.mastodon.example/a.png", document.Icon);
|
||||
Assert.False(document.Discoverable);
|
||||
Assert.NotNull(document.Key("https://mastodon.example/users/alice#main-key"));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Keeps_only_keys_owned_by_the_actor_on_its_origin()
|
||||
{
|
||||
var document = ActorDocument.Parse(JsonDocument.Parse("""
|
||||
{
|
||||
"id": "https://a.example/users/alice",
|
||||
"type": "Person",
|
||||
"publicKey": [
|
||||
{ "id": "https://a.example/users/alice#main-key", "owner": "https://a.example/users/alice", "publicKeyPem": "x" },
|
||||
{ "id": "https://b.example/keys/1", "owner": "https://a.example/users/alice", "publicKeyPem": "y" },
|
||||
{ "id": "https://a.example/users/alice#other", "owner": "https://a.example/users/bob", "publicKeyPem": "z" },
|
||||
{ "id": "https://a.example/users/alice#unowned", "publicKeyPem": "w" }
|
||||
]
|
||||
}
|
||||
""").RootElement);
|
||||
|
||||
Assert.Equal("https://a.example/users/alice#main-key", Assert.Single(document.Keys).Id);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Refuses_an_inbox_on_another_origin()
|
||||
{
|
||||
var document = ActorDocument.Parse(JsonDocument.Parse("""
|
||||
{ "id": "https://a.example/users/alice", "type": "Person", "inbox": "https://b.example/inbox" }
|
||||
""").RootElement);
|
||||
|
||||
Assert.Null(document.Inbox);
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("Note")]
|
||||
[InlineData("Tombstone")]
|
||||
[InlineData("Collection")]
|
||||
public void Refuses_non_actor_types(string type) =>
|
||||
Assert.Null(ActorDocument.Parse(JsonDocument.Parse($$"""{ "id": "https://a.example/x", "type": "{{type}}" }""").RootElement));
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user