You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
66 lines
1.9 KiB
66 lines
1.9 KiB
# frozen_string_literal: true |
|
|
|
class Api::Fasp::BaseController < ApplicationController |
|
class Error < ::StandardError; end |
|
|
|
DIGEST_PATTERN = /sha-256=:(.*?):/ |
|
KEYID_PATTERN = /keyid="(.*?)"/ |
|
|
|
attr_reader :current_provider |
|
|
|
skip_forgery_protection |
|
|
|
before_action :check_fasp_enabled |
|
before_action :require_authentication |
|
after_action :sign_response |
|
|
|
private |
|
|
|
def require_authentication |
|
validate_content_digest! |
|
validate_signature! |
|
rescue Error, Linzer::Error, ActiveRecord::RecordNotFound => e |
|
logger.debug("FASP Authentication error: #{e}") |
|
authentication_error |
|
end |
|
|
|
def authentication_error |
|
respond_to do |format| |
|
format.json { head 401 } |
|
end |
|
end |
|
|
|
def validate_content_digest! |
|
content_digest_header = request.headers['content-digest'] |
|
raise Error, 'content-digest missing' if content_digest_header.blank? |
|
|
|
digest_received = content_digest_header.match(DIGEST_PATTERN)[1] |
|
|
|
digest_computed = OpenSSL::Digest.base64digest('sha256', request.body&.string || '') |
|
|
|
raise Error, 'content-digest does not match' if digest_received != digest_computed |
|
end |
|
|
|
def validate_signature! |
|
raise Error, 'signature-input is missing' if request.headers['signature-input'].blank? |
|
|
|
provider = nil |
|
|
|
Linzer.verify!(request.rack_request, no_older_than: 5.minutes) do |keyid| |
|
provider = Fasp::Provider.confirmed.find(keyid) |
|
Linzer.new_ed25519_public_key(provider.provider_public_key_pem, keyid) |
|
end |
|
|
|
@current_provider = provider |
|
end |
|
|
|
def sign_response |
|
response.headers['content-digest'] = "sha-256=:#{OpenSSL::Digest.base64digest('sha256', response.body || '')}:" |
|
key = Linzer.new_ed25519_key(current_provider.server_private_key_pem) |
|
Linzer.sign!(response, key:, components: %w(@status content-digest)) |
|
end |
|
|
|
def check_fasp_enabled |
|
raise ActionController::RoutingError unless Mastodon::Feature.fasp_enabled? |
|
end |
|
end
|
|
|