natty
/
calckey
1
0
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

In private mode, block access to many public APIs

This commit is contained in:
nullobsi 2021-07-20 11:51:59 -07:00 committed by Kayden Tebau
parent 2bf2eac765
commit e7f20affc9
No known key found for this signature in database
GPG Key ID: 933A1F44222C2634
68 changed files with 98 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
packages/backend/src/server/api/call.ts
View File

@ -7,6 +7,8 @@ import { limiter } from './limiter.js';
import endpoints, { IEndpointMeta } from './endpoints.js';
import { ApiError } from './error.js';
import { apiLogger } from './logger.js';
import { AccessToken } from '@/models/entities/access-token.js';
import { fetchMeta } from '@/misc/fetch-meta.js';
const accessDenied = {
message: 'Access denied.',
@ -93,6 +95,17 @@ export default async (endpoint: string, user: CacheableLocalUser | null | undefi
});
}
// private mode
const meta = await fetchMeta();
if (meta.privateMode && ep.meta.requireCredentialPrivateMode && user == null) {
throw new ApiError({
message: 'Credential required.',
code: 'CREDENTIAL_REQUIRED',
id: '1384574d-a912-4b81-8601-c7b1c4085df1',
httpStatusCode: 401
});
}
// Cast non JSON input
if ((ep.meta.requireFile || ctx?.method === 'GET') && ep.params.properties) {
for (const k of Object.keys(ep.params.properties)) {

6
packages/backend/src/server/api/endpoints.ts
View File

@ -706,6 +706,12 @@ export interface IEndpointMeta {
*/
readonly secure?: boolean;
/**
* プライベートモードでなら、このエンドポイントにリクエストするときにユーザー情報が必要か否か
* 省略した場合は false として解釈されます
*/
readonly requireCredentialPrivateMode?: boolean;
/**
* エンドポイントの種類
* パーミッションの実現に利用されます。

1
packages/backend/src/server/api/endpoints/announcements.ts
View File

@ -6,6 +6,7 @@ export const meta = {
tags: ['meta'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/channels/featured.ts
View File

@ -5,6 +5,7 @@ export const meta = {
tags: ['channels'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/channels/show.ts
View File

@ -6,6 +6,7 @@ export const meta = {
tags: ['channels'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'object',

1
packages/backend/src/server/api/endpoints/channels/timeline.ts
View File

@ -8,6 +8,7 @@ export const meta = {
tags: ['notes', 'channels'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/charts/active-users.ts
View File

@ -4,6 +4,7 @@ import define from '../../define.js';
export const meta = {
tags: ['charts', 'users'],
requireCredentialPrivateMode: true,
res: getJsonSchema(activeUsersChart.schema),

1
packages/backend/src/server/api/endpoints/charts/ap-request.ts
View File

@ -4,6 +4,7 @@ import define from '../../define.js';
export const meta = {
tags: ['charts'],
requireCredentialPrivateMode: true,
res: getJsonSchema(apRequestChart.schema),

1
packages/backend/src/server/api/endpoints/charts/drive.ts
View File

@ -4,6 +4,7 @@ import define from '../../define.js';
export const meta = {
tags: ['charts', 'drive'],
requireCredentialPrivateMode: true,
res: getJsonSchema(driveChart.schema),

1
packages/backend/src/server/api/endpoints/charts/federation.ts
View File

@ -4,6 +4,7 @@ import define from '../../define.js';
export const meta = {
tags: ['charts'],
requireCredentialPrivateMode: true,
res: getJsonSchema(federationChart.schema),

1
packages/backend/src/server/api/endpoints/charts/hashtag.ts
View File

@ -4,6 +4,7 @@ import define from '../../define.js';
export const meta = {
tags: ['charts', 'hashtags'],
requireCredentialPrivateMode: true,
res: getJsonSchema(hashtagChart.schema),

1
packages/backend/src/server/api/endpoints/charts/instance.ts
View File

@ -4,6 +4,7 @@ import define from '../../define.js';
export const meta = {
tags: ['charts'],
requireCredentialPrivateMode: true,
res: getJsonSchema(instanceChart.schema),

1
packages/backend/src/server/api/endpoints/charts/notes.ts
View File

@ -4,6 +4,7 @@ import define from '../../define.js';
export const meta = {
tags: ['charts', 'notes'],
requireCredentialPrivateMode: true,
res: getJsonSchema(notesChart.schema),

1
packages/backend/src/server/api/endpoints/charts/user/drive.ts
View File

@ -4,6 +4,7 @@ import define from '../../../define.js';
export const meta = {
tags: ['charts', 'drive', 'users'],
requireCredentialPrivateMode: true,
res: getJsonSchema(perUserDriveChart.schema),

1
packages/backend/src/server/api/endpoints/charts/user/following.ts
View File

@ -4,6 +4,7 @@ import { perUserFollowingChart } from '@/services/chart/index.js';
export const meta = {
tags: ['charts', 'users', 'following'],
requireCredentialPrivateMode: true,
res: getJsonSchema(perUserFollowingChart.schema),

1
packages/backend/src/server/api/endpoints/charts/user/notes.ts
View File

@ -4,6 +4,7 @@ import define from '../../../define.js';
export const meta = {
tags: ['charts', 'users', 'notes'],
requireCredentialPrivateMode: true,
res: getJsonSchema(perUserNotesChart.schema),

1
packages/backend/src/server/api/endpoints/charts/user/reactions.ts
View File

@ -4,6 +4,7 @@ import define from '../../../define.js';
export const meta = {
tags: ['charts', 'users', 'reactions'],
requireCredentialPrivateMode: true,
res: getJsonSchema(perUserReactionsChart.schema),

1
packages/backend/src/server/api/endpoints/charts/users.ts
View File

@ -4,6 +4,7 @@ import define from '../../define.js';
export const meta = {
tags: ['charts', 'users'],
requireCredentialPrivateMode: true,
res: getJsonSchema(usersChart.schema),

1
packages/backend/src/server/api/endpoints/clips/notes.ts
View File

@ -10,6 +10,7 @@ export const meta = {
tags: ['account', 'notes', 'clips'],
requireCredential: false,
requireCredentialPrivateMode: true,
kind: 'read:account',

1
packages/backend/src/server/api/endpoints/clips/show.ts
View File

@ -6,6 +6,7 @@ export const meta = {
tags: ['clips', 'account'],
requireCredential: false,
requireCredentialPrivateMode: true,
kind: 'read:account',

1
packages/backend/src/server/api/endpoints/federation/followers.ts
View File

@ -6,6 +6,7 @@ export const meta = {
tags: ['federation'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/federation/following.ts
View File

@ -6,6 +6,7 @@ export const meta = {
tags: ['federation'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/federation/instances.ts
View File

@ -7,6 +7,7 @@ export const meta = {
tags: ['federation'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/federation/show-instance.ts
View File

@ -6,6 +6,7 @@ export const meta = {
tags: ['federation'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
oneOf: [{

1
packages/backend/src/server/api/endpoints/federation/users.ts
View File

@ -6,6 +6,7 @@ export const meta = {
tags: ['federation'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/gallery/featured.ts
View File

@ -5,6 +5,7 @@ export const meta = {
tags: ['gallery'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/gallery/popular.ts
View File

@ -5,6 +5,7 @@ export const meta = {
tags: ['gallery'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/gallery/posts.ts
View File

@ -4,6 +4,7 @@ import { GalleryPosts } from '@/models/index.js';
export const meta = {
tags: ['gallery'],
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/gallery/posts/show.ts
View File

@ -6,6 +6,7 @@ export const meta = {
tags: ['gallery'],
requireCredential: false,
requireCredentialPrivateMode: true,
errors: {
noSuchPost: {

1
packages/backend/src/server/api/endpoints/get-online-users-count.ts
View File

@ -7,6 +7,7 @@ export const meta = {
tags: ['meta'],
requireCredential: false,
requireCredentialPrivateMode: true,
} as const;
export const paramDef = {

1
packages/backend/src/server/api/endpoints/hashtags/list.ts
View File

@ -5,6 +5,7 @@ export const meta = {
tags: ['hashtags'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/hashtags/search.ts
View File

@ -5,6 +5,7 @@ export const meta = {
tags: ['hashtags'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/hashtags/show.ts
View File

@ -7,6 +7,7 @@ export const meta = {
tags: ['hashtags'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'object',

1
packages/backend/src/server/api/endpoints/hashtags/trend.ts
View File

@ -24,6 +24,7 @@ export const meta = {
tags: ['hashtags'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/hashtags/users.ts
View File

@ -4,6 +4,7 @@ import { normalizeForSearch } from '@/misc/normalize-for-search.js';
export const meta = {
requireCredential: false,
requireCredentialPrivateMode: true,
tags: ['hashtags', 'users'],

18
packages/backend/src/server/api/endpoints/meta.ts
View File

@ -336,7 +336,7 @@ export default define(meta, paramDef, async (ps, me) => {
expiresAt: MoreThan(new Date()),
},
});
// TODO: add secure mode, etc
const response: any = {
maintainerName: instance.maintainerName,
maintainerEmail: instance.maintainerEmail,
@ -350,6 +350,10 @@ export default define(meta, paramDef, async (ps, me) => {
tosUrl: instance.ToSUrl,
repositoryUrl: instance.repositoryUrl,
feedbackUrl: instance.feedbackUrl,
secureMode: instance.secureMode,
privateMode: instance.privateMode,
disableRegistration: instance.disableRegistration,
disableLocalTimeline: instance.disableLocalTimeline,
disableGlobalTimeline: instance.disableGlobalTimeline,
@ -369,10 +373,10 @@ export default define(meta, paramDef, async (ps, me) => {
backgroundImageUrl: instance.backgroundImageUrl,
logoImageUrl: instance.logoImageUrl,
maxNoteTextLength: MAX_NOTE_TEXT_LENGTH, // 後方互換性のため
emojis: await Emojis.packMany(emojis),
emojis: instance.privateMode && !me ? [] : await Emojis.packMany(emojis),
defaultLightTheme: instance.defaultLightTheme,
defaultDarkTheme: instance.defaultDarkTheme,
ads: ads.map(ad => ({
ads: instance.privateMode && !me ? [] : ads.map(ad => ({
id: ad.id,
url: ad.url,
place: ad.place,
@ -390,8 +394,8 @@ export default define(meta, paramDef, async (ps, me) => {
translatorAvailable: instance.deeplAuthKey != null,
...(ps.detail ? {
pinnedPages: instance.pinnedPages,
pinnedClipId: instance.pinnedClipId,
pinnedPages: instance.privateMode && !me ? [] : instance.pinnedPages,
pinnedClipId: instance.privateMode && !me ? [] : instance.pinnedClipId,
cacheRemoteFiles: instance.cacheRemoteFiles,
requireSetup: (await Users.countBy({
host: IsNull(),
@ -400,9 +404,11 @@ export default define(meta, paramDef, async (ps, me) => {
};
if (ps.detail) {
if (!instance.privateMode || me) {
const proxyAccount = instance.proxyAccountId ? await Users.pack(instance.proxyAccountId).catch(() => null) : null;
response.proxyAccountName = proxyAccount ? proxyAccount.username : null;
}
response.features = {
registration: !instance.disableRegistration,
localTimeLine: !instance.disableLocalTimeline,

1
packages/backend/src/server/api/endpoints/notes.ts
View File

@ -5,6 +5,7 @@ import { makePaginationQuery } from '../common/make-pagination-query.js';
export const meta = {
tags: ['notes'],
requireCredentialPrivateMode: true,
res: {
type: 'array',
optional: false, nullable: false,

3
packages/backend/src/server/api/endpoints/notes/children.ts
View File

@ -10,6 +10,7 @@ export const meta = {
tags: ['notes'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',
@ -20,7 +21,7 @@ export const meta = {
ref: 'Note',
},
},
} as const;
};
export const paramDef = {
type: 'object',

1
packages/backend/src/server/api/endpoints/notes/clips.ts
View File

@ -8,6 +8,7 @@ export const meta = {
tags: ['clips', 'notes'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/notes/conversation.ts
View File

@ -8,6 +8,7 @@ export const meta = {
tags: ['notes'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/notes/featured.ts
View File

@ -7,6 +7,7 @@ export const meta = {
tags: ['notes'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/notes/global-timeline.ts
View File

@ -12,6 +12,7 @@ import { generateBlockedUserQuery } from '../../common/generate-block-query.js';
export const meta = {
tags: ['notes'],
requireCredentialPrivateMode: true,
res: {
type: 'array',
optional: false, nullable: false,

1
packages/backend/src/server/api/endpoints/notes/local-timeline.ts
View File

@ -14,6 +14,7 @@ import { generateBlockedUserQuery } from '../../common/generate-block-query.js';
export const meta = {
tags: ['notes'],
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/notes/reactions.ts
View File

@ -8,6 +8,7 @@ export const meta = {
tags: ['notes', 'reactions'],
requireCredential: false,
requireCredentialPrivateMode: true,
allowGet: true,
cacheSec: 60,

1
packages/backend/src/server/api/endpoints/notes/renotes.ts
View File

@ -11,6 +11,7 @@ export const meta = {
tags: ['notes'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/notes/replies.ts
View File

@ -9,6 +9,7 @@ export const meta = {
tags: ['notes'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/notes/search-by-tag.ts
View File

@ -10,6 +10,7 @@ import { generateBlockedUserQuery } from '../../common/generate-block-query.js';
export const meta = {
tags: ['notes', 'hashtags'],
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/notes/search.ts
View File

@ -12,6 +12,7 @@ export const meta = {
tags: ['notes'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/notes/show.ts
View File

@ -7,6 +7,7 @@ export const meta = {
tags: ['notes'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'object',

1
packages/backend/src/server/api/endpoints/notes/translate.ts
View File

@ -12,6 +12,7 @@ export const meta = {
tags: ['notes'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'object',

1
packages/backend/src/server/api/endpoints/pages/featured.ts
View File

@ -5,6 +5,7 @@ export const meta = {
tags: ['pages'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/pages/show.ts
View File

@ -8,6 +8,7 @@ export const meta = {
tags: ['pages'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'object',

1
packages/backend/src/server/api/endpoints/pinned-users.ts
View File

@ -9,6 +9,7 @@ export const meta = {
tags: ['users'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/server-info.ts
View File

@ -4,6 +4,7 @@ import define from '../define.js';
export const meta = {
requireCredential: false,
requireCredentialPrivateMode: true,
tags: ['meta'],
} as const;

1
packages/backend/src/server/api/endpoints/stats.ts
View File

@ -5,6 +5,7 @@ import { IsNull } from 'typeorm';
export const meta = {
requireCredential: false,
requireCredentialPrivateMode: true,
tags: ['meta'],

1
packages/backend/src/server/api/endpoints/users.ts
View File

@ -7,6 +7,7 @@ export const meta = {
tags: ['users'],
requireCredential: false,
requireCredentialPrivateMode: true,
res: {
type: 'array',

1
packages/backend/src/server/api/endpoints/users/clips.ts
View File

@ -4,6 +4,7 @@ import { makePaginationQuery } from '../../common/make-pagination-query.js';
export const meta = {
tags: ['users', 'clips'],
requireCredentialPrivateMode: true,
description: 'Show all clips this user owns.',

1
packages/backend/src/server/api/endpoints/users/followers.ts
View File

@ -9,6 +9,7 @@ export const meta = {
tags: ['users'],
requireCredential: false,
requireCredentialPrivateMode: true,
description: 'Show everyone that follows this user.',

1
packages/backend/src/server/api/endpoints/users/following.ts
View File

@ -9,6 +9,7 @@ export const meta = {
tags: ['users'],
requireCredential: false,
requireCredentialPrivateMode: true,
description: 'Show everyone that this user is following.',

1
packages/backend/src/server/api/endpoints/users/gallery/posts.ts
View File

@ -4,6 +4,7 @@ import { makePaginationQuery } from '../../../common/make-pagination-query.js';
export const meta = {
tags: ['users', 'gallery'],
requireCredentialPrivateMode: true,
description: 'Show all gallery posts by the given user.',

1
packages/backend/src/server/api/endpoints/users/get-frequently-replied-users.ts
View File

@ -9,6 +9,7 @@ export const meta = {
tags: ['users'],
requireCredential: false,
requireCredentialPrivateMode: true,
description: 'Get a list of other users that the specified user frequently replies to.',

1
packages/backend/src/server/api/endpoints/users/notes.ts
View File

@ -11,6 +11,7 @@ import { generateBlockedUserQuery } from '../../common/generate-block-query.js';
export const meta = {
tags: ['users', 'notes'],
requireCredentialPrivateMode: true,
description: 'Show all notes that this user created.',
res: {

1
packages/backend/src/server/api/endpoints/users/pages.ts
View File

@ -4,6 +4,7 @@ import { makePaginationQuery } from '../../common/make-pagination-query.js';
export const meta = {
tags: ['users', 'pages'],
requireCredentialPrivateMode: true,
description: 'Show all pages this user created.',

1
packages/backend/src/server/api/endpoints/users/reactions.ts
View File

@ -8,6 +8,7 @@ export const meta = {
tags: ['users', 'reactions'],
requireCredential: false,
requireCredentialPrivateMode: true,
description: 'Show all reactions this user made.',

1
packages/backend/src/server/api/endpoints/users/search-by-username-and-host.ts
View File

@ -8,6 +8,7 @@ export const meta = {
tags: ['users'],
requireCredential: false,
requireCredentialPrivateMode: true,
description: 'Search for a user by username and/or host.',

1
packages/backend/src/server/api/endpoints/users/search.ts
View File

@ -7,6 +7,7 @@ export const meta = {
tags: ['users'],
requireCredential: false,
requireCredentialPrivateMode: true,
description: 'Search for users.',

1
packages/backend/src/server/api/endpoints/users/show.ts
View File

@ -10,6 +10,7 @@ export const meta = {
tags: ['users'],
requireCredential: false,
requireCredentialPrivateMode: true,
description: 'Show the properties of a user.',

1
packages/backend/src/server/api/endpoints/users/stats.ts
View File

@ -7,6 +7,7 @@ export const meta = {
tags: ['users'],
requireCredential: false,
requireCredentialPrivateMode: true,
description: 'Show statistics about a user.',