natty
/
misskey-awawa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #1358 from akihikodaki/inbox 

Make inbox signature verification compatible with Mastodon
This commit is contained in:
syuilo 2018-04-02 00:37:41 +09:00 committed by GitHub
parent 2cf5a40649 111e5d569c
commit d166dbd01e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/server/activitypub/inbox.ts
View File

@ -11,16 +11,32 @@ app.use(bodyParser.json());
app.post('/@:user/inbox', async (req, res) => { app.post('/@:user/inbox', async (req, res) => {
let parsed; let parsed;
req.headers.authorization = 'Signature ' + req.headers.signature;
try { try {
parsed = parseRequest(req); parsed = parseRequest(req);
} catch (exception) { } catch (exception) {
return res.sendStatus(401); return res.sendStatus(401);
} }
const user = await User.findOne({ const keyIdLower = parsed.keyId.toLowerCase();
host: { $ne: null }, let query;
'account.publicKey.id': parsed.keyId
}); if (keyIdLower.startsWith('acct:')) {
const { username, host } = parseAcct(keyIdLower.slice('acct:'.length));
if (host === null) {
return res.sendStatus(401);
}
query = { usernameLower: username, hostLower: host };
} else {
query = {
host: { $ne: null },
'account.publicKey.id': parsed.keyId
};
}
const user = await User.findOne(query);
if (user === null) { if (user === null) {
return res.sendStatus(401); return res.sendStatus(401);