1
0
Fork 0
mirror of https://code.sup39.dev/repos/Wqawg synced 2024-12-29 01:14:51 +09:00
Commit graph

739 commits

Author SHA1 Message Date
fr33domlover
2eade80cfb Rewrite the localMessageCreate migration to insert real activities
A thing still missing there is that it sets empty audience for comments on
remote tickets, but that's fine because dev.angeley.es doesn't have such
comments in the database.
2019-05-25 12:44:09 +00:00
fr33domlover
e81eb80b8b Add field localMessageCreate, pointing to the OutboxItem that created it
I added a migration that creates an ugly fake OutboxItem for messages that
don't have one. I'll try to turn it into a real one. And then very possibly
remove the whole ugly migration, replacing it with addFielfRefRequiredEmpty,
which should work for empty instances.
2019-05-25 03:23:57 +00:00
fr33domlover
d77877eba5 In persistent models for migrations, suffix the names of uniques too 2019-05-25 03:20:01 +00:00
fr33domlover
5479c99e1c Serve trivial HTML (that just displays the JSON object) in getMessageR 2019-05-24 16:09:58 +00:00
fr33domlover
bd99729656 Loading settings was using deprecated functions, switch to new ones 2019-05-24 15:45:36 +00:00
fr33domlover
23e760e373 Build with LTS 13, GHC 8.6 2019-05-24 11:49:39 +00:00
fr33domlover
b64984495f Switch all HandlerT/WidgetT uses to HandlerFor/WidgetFor 2019-05-23 09:12:24 +00:00
fr33domlover
c531f41565 Implement basic notifications in DB and UI 2019-05-22 21:50:30 +00:00
fr33domlover
6d55b8c5d7 Display remote actor name in remote message view 2019-05-21 09:11:13 +00:00
fr33domlover
d1fea9eb51 Store names of remote actors in DB for display 2019-05-21 08:44:11 +00:00
fr33domlover
2573ff1d93 Parse and publish actor outboxes 2019-05-21 00:36:05 +00:00
fr33domlover
40d9a0990d Serve AS2 in getSharerInboxR 2019-05-21 00:14:49 +00:00
fr33domlover
7bcbe52274 Implement getOutboxR, both (trivial) HTML and AS2 2019-05-20 23:51:06 +00:00
fr33domlover
f07b56c259 Implement getOutboxItemR, serving AS2 and basic HTML 2019-05-18 10:09:47 +00:00
fr33domlover
6d304b9307 Smarter treatment of recipients that are collections
- Allow client to specify recipients that don't need to be delivered to
- When fetching recipient, recognize collections and don't try to deliver to
  them
- Remember collections in DB, and use that to skip HTTP delivery
2019-05-17 22:42:01 +00:00
fr33domlover
48882d65ad Allow AP C2S client to list recipients that aren't actors to deliver to 2019-05-17 10:47:53 +00:00
fr33domlover
07281f6900 Fix infinite loop in ActivityPub audience parsing 2019-05-16 21:22:45 +00:00
fr33domlover
b12ad49b62 Remove unused accidentally left line 2019-05-16 21:21:51 +00:00
fr33domlover
ebc3f016b6 In outbox POST handler logging, fix the display of OutboxItemId number 2019-05-12 20:24:33 +00:00
fr33domlover
d70d34bb6b Debug logs for periodic delivery 2019-05-11 22:26:06 +00:00
fr33domlover
48cfccd3d2 Use forkFinally in ResultShare to be sure we always catch exceptions & set MVar 2019-05-10 21:33:08 +00:00
fr33domlover
f88dcef0d7 Do some debug logging during delivery in outbox POST handler 2019-05-10 20:38:55 +00:00
fr33domlover
770983e829 In outbox POST handler, run async delivery using Worker instead of Handler
Worker is enough and seems much simpler. forkHandler does stuff with
forkResourceT and more stuff that I don't exactly understand and which may
involve more resource allocation. I guess forkWorker would generally be the
preferred approach, and there are bugs with delivery leading to sudden
CPU/memory peaks forcing me to kill the process. Maybe not related, just
mentioning it ^_^
2019-05-10 04:36:21 +00:00
fr33domlover
e29053145f Log errors for linked delivery from outbox, both in handler and periodic 2019-05-09 23:09:34 +00:00
fr33domlover
635952a797 When parsing a LocalURI, use a *valid* dummy host
The previous dummy host was "h", which doesn't contain periods, so the `FedURI`
parser rejects it.
2019-05-09 22:03:19 +00:00
fr33domlover
273fcf972f When delivering activities, sign the Digest header
Looks like I forgot to add it to the list of headers to sign
2019-05-09 21:26:33 +00:00
fr33domlover
ddb6bb0472 When publishing a comment via PublishR, don't specify 'published' time
The server expects not to see it, and wants to set it by itself
2019-05-07 03:12:47 +00:00
fr33domlover
0e4070db75 In ticket discussion, have links to the individual messages (MessageR route) 2019-05-07 02:54:45 +00:00
fr33domlover
9bc78bf303 When posting ticket comment in regular UI, don't specify published time
The outbox handler wants to set it, and it expects it not be set by the client.
2019-05-07 01:51:21 +00:00
fr33domlover
a6bfb0cf36 Show note about federation being disabled, and list other known instances 2019-05-05 22:00:26 +00:00
fr33domlover
6bba8ff47f Fix breadcrumb of TicketMessageR 2019-05-05 21:02:26 +00:00
fr33domlover
67a77b1897 In layout header, link to federation status info page 2019-05-05 11:36:10 +00:00
fr33domlover
8303baa69d Implement GETing the personal inbox 2019-05-05 10:20:55 +00:00
fr33domlover
f6eaca2fa8 When project receives remote ticket comment, add author to followers 2019-05-03 23:55:49 +00:00
fr33domlover
5770c62692 Plug the project inbox handler code into the actual POST handler function 2019-05-03 23:18:57 +00:00
fr33domlover
b0a26722d3 Do inbox forwarding in project inbox handler 2019-05-03 21:04:53 +00:00
fr33domlover
5d5c56695e Remember for deliveries in the DB, whether they should sign forwarding 2019-05-02 09:31:56 +00:00
fr33domlover
93cf861ed0 When delivering a comment on a remote ticket, enable inbox forwarding
In the new inbox forwarding scheme, we use an additional special HTTP signature
to indicate that we allow or expect forwarding, and to allow that forwarding to
later be verified. When delivering a comment on a remote ticket, we'd like the
project to do inbox forwarding. Based on the URI alone, it's impossible to tell
which recipient is the project, and I guess there are various tricks we could
use here, but for now a very simple solution is used: Enable forwarding for all
remote recipients whose host is the same as the ticket's host.
2019-05-02 02:06:47 +00:00
fr33domlover
3d9438714b In sharer inbox, accept forwarded activities, including ones of local users 2019-05-01 23:13:22 +00:00
fr33domlover
f789a773e4 Stop using YesodHttpSig, move code from Foundation to Federation 2019-04-29 07:39:20 +00:00
fr33domlover
951364036f Update activity POSTing code to use the new forwarding mechanism
It's not documented yet, but basically I replaced the custom input string with
an HTTPSig based one.
2019-04-28 10:18:50 +00:00
fr33domlover
1fcec035f0 Do some checks on the host in FedURI parsing
Until now, there were some simple host checks when verifying the HTTP sig,
meant to forbid hosts that are IP addresses, local hosts, and maybe other weird
cases. These checks moved to Network.FedURI, so now FedURIs in general aren't
allowed to have such hosts. The host type is still `Text` though, for now.
2019-04-28 09:47:32 +00:00
fr33domlover
342467297a Put inbox activity auth code in a dedicated function in Vervis.Federation 2019-04-26 21:41:01 +00:00
fr33domlover
9d5399d636 Give project actors signing keys, just like user actors, needed for forwarding
Since project actors are the ones sending inbox forwards, they need to announce
keys and allow their HTTP Signatures to be verified.
2019-04-26 13:04:00 +00:00
fr33domlover
811217fd17 Return keyid and digest after inbox verification, for use in forwarding 2019-04-26 04:15:07 +00:00
fr33domlover
f346da9106 New module Yesod.ActivityPub, use it in Vervis.Federation for delivery POSTing 2019-04-26 03:23:49 +00:00
fr33domlover
71d21ad459 In httpPostAP, support the new signature headers 2019-04-26 00:25:50 +00:00
fr33domlover
46fb4d1512 Add settings switch for activity debug reports 2019-04-25 22:46:27 +00:00
fr33domlover
d24710c46a When receiving activity to inbox, verify the body digest
This patch does a small simple change, however at the cost of the request body
not being available for display in the latest activity list, unless processing
succeeds. I'll fix this situation in a separate patch.
2019-04-25 18:05:02 +00:00
fr33domlover
57374ec816 When POSTing activities, set a Digest header using SHA-256 2019-04-25 15:49:15 +00:00
fr33domlover
825a91d185 Incomplete project inbox handler 2019-04-24 00:47:21 +00:00
fr33domlover
f462a67680 Implement sharer inbox handler
It runs checks against all the relevant tables, but ultimately just inserts the
activity into the recipient's inbox and nothing more, leaving the RemoteMessage
creation and inbox forwarding to the project inbox handler.
2019-04-23 02:57:53 +00:00
fr33domlover
e06f40b665 Switch from single inbox to individual inbox URIs; disable inbox post for now
Inbox post is disabled but in the next patches I'll code and integrate a fixed
complete one, hopefully finally getting ticket comment federation ready for
testing.

I'm making this change because if an actor receives an activity due to being
addressed in bto, ot bcc, or being listed in some remote collection, the server
doesn't have a way to tell which actor(s) are the intended recipients, without
having an individual inbox URL for each actor. I could use a different hack for
this, but it wouldn't be compatible with other AP servers (unless the whole
fediverse agrees on a method).

I wasn't using sharedInbox anyway, and it's an optimization either way.
2019-04-21 10:58:57 +00:00
fr33domlover
f7f15e0f63 When sending ticket comment in regular Vervis UI, deliver it using ActivityPub 2019-04-20 21:34:45 +00:00
fr33domlover
4f5c6532ee Switch postOutboxR to the new handler 2019-04-19 03:14:12 +00:00
fr33domlover
fc2ace3370 Insert ticket commenter to ticket followers, and never deliver to themselves 2019-04-18 23:37:33 +00:00
fr33domlover
47a9e0b5a0 Group by sharer ID too, hopefully this time it's enough 2019-04-18 20:20:58 +00:00
fr33domlover
4386e0f8af If federation is disabled, don't run periodic delivery 2019-04-18 19:50:31 +00:00
fr33domlover
50f12f855d In ticket summary SQL query, group by ticket ID, not by discussion ID
Each ticket has a single discussion ID, and each ticket has a unique one, so,
given an inner join of tickets and discussions, I think there should be exactly
1 way select a (ticket, discussion) pair given any of these.

But for some reason, PostgreSQL started complaining. Not sure what changed.
Anyway, for now, I switched the groupBy from discussion.id to ticket.id, which
is essentially the same, but for some reason makes PostgreSQL happy. It can't
tell that given a discussion ID, there's exactly 1 way to choose the ticket. Or
something like that. I wonder if I messed up something in DB migrations.
2019-04-18 19:35:04 +00:00
fr33domlover
b8c669f6fc New outbox post: Raise error if federation disabled but remote recipients found 2019-04-18 11:43:33 +00:00
fr33domlover
f37b9b3f52 Run the delivery worker priodically, settings control how often to run 2019-04-18 10:38:01 +00:00
fr33domlover
c9c7da5902 More insertBy' usage, and remove withHostLock from new outbox post handler 2019-04-16 18:03:02 +00:00
fr33domlover
735a6a39cb Use insertBy' in instanceAndActor 2019-04-16 17:26:06 +00:00
fr33domlover
b0da8747a2 In ActorFetchShare, use insertBy' to allow non-shared insertions
Before this patch, the shared fetch used plain insert, because it relied on
being the only place in the codebase where new RemoteActors get inserted. I was
hoping for that to be the case, but while I tweak things and handle fetching
URIs that can be an actor or a public key (for which ActorFetchShare isn't
sufficient without some smart modification), I'd like concurrent insertions to
be safe, without getting in the way of ActorFetchShare.

With this patch, it now uses insertBy', which doesn't mind concurrent
insertions.
2019-04-16 16:33:08 +00:00
fr33domlover
7c2fad7417 Implement fetchAPIDOrH using a dedicated error type 2019-04-16 16:10:17 +00:00
fr33domlover
25fcceabde postOutboxR: Use ResultShare for fetching recipient actor 2019-04-16 14:34:17 +00:00
fr33domlover
d5eefd1553 Implement outbox remote delivery, in handler and periodic, not used yet 2019-04-16 14:27:50 +00:00
fr33domlover
7946fe441d Add field errorSince to RemoteActor to track inbox POST unreachability 2019-04-12 01:09:45 +00:00
fr33domlover
3f9364e4aa Rename RemoteSharer entity to RemoteActor 2019-04-12 00:56:27 +00:00
fr33domlover
7621c0280a Rewrite ticketFollowers migration without insertKey, it causes problems 2019-04-11 16:43:46 +00:00
fr33domlover
9a306e762c Unfinished updated outbox handler 2019-04-11 13:44:44 +00:00
fr33domlover
7dda068ba3 Make the DB migrations not depend on current model 2019-04-11 13:26:57 +00:00
fr33domlover
1d854423cb Switch Audience from Vector to list and fix Public bug
* No good reason to use Vector, let's use list, it's just easier
* The Public URI recognizing code wasn't being used; now it is
2019-04-01 23:40:29 +00:00
fr33domlover
0c280c7af6 Add setting that says how much time to keep retrying activity delivery 2019-04-01 23:38:44 +00:00
fr33domlover
c2415301bc More type-safe handling of DB key Hashids 2019-03-29 03:25:32 +00:00
fr33domlover
228e954706 Create Note outbox handler, not in use yet
I wrote a function handleOutboxNote that's supposed to do the whole outbox POST
handler process. There's an outbox item table in the DB now, I adapted things
in various source files. Ticket comment federation work is still in progress.
2019-03-28 21:08:30 +00:00
fr33domlover
cdb1c8b121 Add settings option to disable federation 2019-03-25 00:17:24 +00:00
fr33domlover
e36d960d2b Rename handleActivity to handleInboxActivity 2019-03-23 15:45:44 +00:00
fr33domlover
85c6354291 Switch jsonb support from persistent-postgresql to a custom module
The custom module provides a parametric wrapper, allowing any specific
FromJSON/ToJSON instance to be used. It's a standalone module though, and not a
wrapper of persistent-postgresql, because persistent-postgresql uses aeson
Value and it prevents using toEncoding to get from the value directly to a
string.
2019-03-23 15:29:50 +00:00
fr33domlover
0032456925 Add noteAudience; record recipient of local remotely-targetted activities in DB 2019-03-23 02:57:34 +00:00
fr33domlover
58a56b6743 Make noteId optional, to support taking a Note in postOutboxR 2019-03-23 02:05:30 +00:00
fr33domlover
88d4c976ee Add route getMessageR, returns an Activity Note for any locally created Message 2019-03-22 20:46:42 +00:00
fr33domlover
6c186355f3 Change some top-level routes' breadcrumbs to be under HomeR 2019-03-22 05:17:58 +00:00
fr33domlover
c27636a438 Add route /publish for sending activities, getOutboxR now free to return outbox 2019-03-22 05:17:54 +00:00
fr33domlover
d40e1b8891 In outbox post form, provide parent and context, and default to ticket comment 2019-03-21 23:56:47 +00:00
fr33domlover
ad3a20d783 Receive remote comments on local ticket discussion 2019-03-21 22:57:15 +00:00
fr33domlover
72f96a0dff When verifying HTTPsig, return iid&rsid and remove duplicate shared usage check
* Adapt DB related code to return the InstanceId and RemoteSharerId
* Previously, when fetching a known shared key, we were running a DB
  check/update for the shared usage record. I noticed - and hopefully I
  correctly noticed - that this check already runs when we discover the keyId
  points to a shared key we already know. So, after successful sig
  verification, there's no need to run the check again. So I removed it.
2019-03-21 21:38:59 +00:00
fr33domlover
061c84349d Recognize the 3 variants of the Public collection URI when parsing audience 2019-03-21 19:13:36 +00:00
fr33domlover
77324442fc Fetch local messages by LocalMessageId, not by MessageId 2019-03-21 19:06:52 +00:00
fr33domlover
68b0ae7829 When receiving HTTP signed request, check the keyId host for weird cases
- Exclude hosts without periods, so things like localhost and IPv6 are rejected
- Exclude hosts without letters, so things like IPv4 are rejected
- Exclude the instance's own host, just in case somehow some fake activity
  slips in and gets approved, maybe even accidentally when delivered by another
  server
2019-03-20 12:27:40 +00:00
fr33domlover
747bbd5f0c Publish actor documents for projects, and add some new properties to Actor 2019-03-20 12:01:10 +00:00
fr33domlover
ade1157a04 Add a custom ActivityPub actor type: Project 2019-03-20 10:36:00 +00:00
fr33domlover
3f2a178830 New module Yesod.FedURI: Render routes into FedURI and LocalURI 2019-03-20 10:08:36 +00:00
fr33domlover
6f3df6d569 Allow actors not to list any public keys at all 2019-03-20 09:31:08 +00:00
fr33domlover
716487f2b8 In ticket comment tree, support mixing local and remote (federated) comments 2019-03-20 08:07:37 +00:00
fr33domlover
e0de4cdcc7 Remove Discussion's nextMessage field, it's not being used anymore 2019-03-18 20:18:25 +00:00
fr33domlover
4b351ef62e Automatically set approot to https://HOST and require Host header to match 2019-03-16 17:15:31 +00:00
fr33domlover
a9eaf35d5e When verifying HTTP sig, require ActivityPub-Actor to be signed only if present 2019-03-16 15:48:25 +00:00
fr33domlover
475e398d6d Switch ticket comment IDs to use Hashids-of-MessageId instead of custom number 2019-03-15 16:36:02 +00:00
fr33domlover
9e881554ea Make frg:isShared key property optional, it was accidentally required 2019-03-15 16:33:10 +00:00
fr33domlover
0e0afa78f9 Parse/encoding audience targetting activity fields 2019-03-14 02:30:36 +00:00
fr33domlover
24c091a248 Add activity types Follow, Accept, Reject 2019-03-13 23:37:58 +00:00
fr33domlover
f6cbc1eb8a Use file based switches to relax keyfile loading rules 2019-03-11 02:01:41 +00:00
fr33domlover
2a39378468 HTTP Signature verification: RSA-SHA256 and PEM/ASN1 support
Before, things worked like this:

* Only signatures of Ed25519 keys could be verified
* Key encoding placed the plain binary Ed25519 key in the PEM, instead of the
  key's ASN1 encoding

With this patch it now works like this:

* Ed25519 signatures are supported as before
* RSA keys are now supported too, assuming RSA-SHA256 signatures
* Both Ed25519 and RSA keys are encoded and decoded using actual PEM with ASN1
2019-03-10 23:15:42 +00:00
fr33domlover
ef57f29a54 Adapt Activity/Create/Note to new ActivityPub typeclass and add safety checks 2019-03-10 06:42:03 +00:00
fr33domlover
61d1aa6720 Define HMAC based access token and switch CapSignKey from Ed25519 to HMAC 2019-03-09 21:21:36 +00:00
fr33domlover
fdbe46741b When POSTing an activity, protect remote actor DB insertion with withHostLock 2019-03-09 17:12:43 +00:00
fr33domlover
e341f62587 Fix typo in comment 2019-03-09 15:44:31 +00:00
fr33domlover
468202cf45 Fix instance mutex deadlock, accidentally initialized the MVar empty 2019-03-09 15:43:30 +00:00
fr33domlover
37216d9045 Move remote actor DB code from Foundation to separate module 2019-03-09 15:40:02 +00:00
fr33domlover
b0e33af4d8 Fix typo in actor key route 2019-03-06 01:49:55 +00:00
fr33domlover
043022d117 When verifying HTTP sig, make Ed25519 verification failure message clearer 2019-03-06 01:31:30 +00:00
fr33domlover
c26289cf42 Don't check CSRF token in InboxR, POSTs there freely come from other servers 2019-03-05 09:00:22 +00:00
fr33domlover
6e721797e9 Catch sig generation error when sending signed HTTP POST 2019-03-05 08:26:41 +00:00
fr33domlover
97594dc945 Fix default actor URI in OutboxR form, from /p to /s 2019-03-04 20:12:19 +00:00
fr33domlover
378ca1b3d4 Fix bug in FedURI parsing 2019-03-04 20:11:58 +00:00
fr33domlover
bb662e798f Display clearer error message when GETing recipient actor fails 2019-03-04 15:47:22 +00:00
fr33domlover
78b5bad2c4 Support bypassing email verification of new users 2019-03-04 14:51:51 +00:00
fr33domlover
c41f1183e0 Display instance host at the top of all pages 2019-03-04 09:06:23 +00:00
fr33domlover
ad034dbacc Make the registration switch work again 2019-03-04 08:14:36 +00:00
fr33domlover
6bbba4ce5c Use MVars to protect concurrenct access to instance/actor/key DB records 2019-03-02 19:13:51 +00:00
fr33domlover
f09bdd4141 Add key storage mode that replaces old keys instead of rejecting new ones 2019-02-26 14:00:22 +00:00
fr33domlover
2e705b6868 Make key storage limits configurable instead of hardcoding to 2 2019-02-24 01:35:07 +00:00
fr33domlover
17524b6ee1 Remove hardcoded-to-2 limit on length of an actor's list of public keys 2019-02-24 01:21:42 +00:00
fr33domlover
0912b8e291 Use the DB for checking key usage by actors
* When we refetch a personal key, we never need to separately fetch the actor
* When we refetch a shared key, check usage in DB and insert usage to DB
2019-02-23 17:17:52 +00:00
fr33domlover
b53a7b4f48 Refactor actor key fetching code a bit 2019-02-22 08:30:43 +00:00
fr33domlover
1affe269bb Refactor HTTP sig verification DB update code 2019-02-22 07:20:19 +00:00
fr33domlover
d3e14b3edf Add LocalURI type for recording shared URI host 2019-02-21 23:59:53 +00:00
fr33domlover
aefb2aaee7 Add InstanceURI datatype 2019-02-20 07:40:25 +00:00
fr33domlover
4053f2f2b4 Record usage of instance keys in the DB
When we verify an HTTP signature,

* If we know the key, check in the DB whether we know the actor lists it. If it
  doesn't, and there's room left for keys, HTTP GET the actor and update the DB
  accordingly.
* If we know the key but had to update it, do the same, check usage in DB and
  update DB if needed
* If we don't know the key, record usage in DB

However,

* If we're GETing a key and discovering it's a shared key, we GET the actor to
  verify it lists the key. When we don't know the key at all yet, that's fine
  (can be further optimized but it's marginal), but if it's a key we do know,
  it means we already know the actor and for now it's enough for us to rely
  only on the DB to test usage.
2019-02-19 10:54:55 +00:00
fr33domlover
312ccf6979 When verifying HTTP sig with known shared key, verify actor lists the key
Previously, when verifying an HTTP signature and we fetched the key and
discovered it's shared, we'd fetch the actor and make sure it lists the key URI
in the `publicKey` field. But if we already knew the key, had it cached in our
DB, we wouldn't check the actor at all, despite not knowing whether it lists
the key.

With this patch, we now always GET the actor when the key is shared,
determining the actor URI from the `ActivityPub-Actor` request header, and we
verify that the actor lists the key URI. We do that regardless of whether or
not we have the key in the DB, although these two cases and handled in
different parts of the code right now (for a new key, it's in Web.ActivityPub
fetchKey; for a known key, it's in Vervis.Foundation httpVerifySig).
2019-02-18 09:20:13 +00:00
fr33domlover
9b8cae79e0 Remove old commented out line of code 2019-02-18 09:18:50 +00:00
fr33domlover
69e807214d Even if we have the specified keyid in the DB, check AP actor header if present
Previously, when verifying an HTTP signature and we find out we have the
provided keyid in the DB, and this key is a personal key, we would just grab
the key owner from the DB and ignore the ActivityPub-Actor header.

This patch adds a check: If we find the key in the DB and it's a personal key,
do grab the owner from that DB row, but also check the actor header: If it's
provided, it has to be identical to the key owner ID URI.
2019-02-17 00:32:38 +00:00
fr33domlover
fa5c509a25 When we fetch a stand-alone personal key, make sure AP-Actor matches key owner
If the key we fetched is a shared key, the only way to determine the actor to
which the signature applies is to read the HTTP header ActivityPub-Actor. But
if it's a personal key, we can detect the actor by checking the key's owner
field. Still, if that actor header is provided, we now compare it to the key
owner and make sure they're identical.

When fetching a key that is embedded in the actor document, we were already
comparing the actor ID with the actor header, so that part didn't require
changes.
2019-02-17 00:14:05 +00:00
fr33domlover
bf56ebf158 Make the verification key update logic clearer 2019-02-16 21:47:58 +00:00
fr33domlover
9e0314fa09 Store remote actors' inbox URIs in DB, avoiding some actor fetch
When a local user wants to publish an activity, we were always GETing the
recipient actor, so that we could determine their inbox and POST the activity
to it. But now, instead, whenever we GET an actor (whether it's for the key sig
verification or for determining inbox URI), we keep their inbox URI in the
database, and we don't need to GET it again next time.
2019-02-14 23:27:40 +00:00
fr33domlover
128f1297ec In postInboxR, use the Activity type, so we only accept Create Note for now 2019-02-14 22:29:59 +00:00
fr33domlover
fb396bb984 Define breadcrumbs for shared actor key routes 2019-02-14 22:17:04 +00:00
fr33domlover
e6b7a5297a Fix error in key expiration check caused by a typo 2019-02-14 22:16:15 +00:00
fr33domlover
e8ba301c6a Switch actor ID URIs to be /s/ACTOR instead of /p and /g
See Vervis ticket #60.
2019-02-14 22:13:58 +00:00
fr33domlover
754709833a When a client posts to their outbox, allow only Create Note, not near-any JSON 2019-02-12 11:53:24 +00:00
fr33domlover
c2bf470fb6 Generate and keep permanent salt for generating hashids for URIs 2019-02-08 21:54:22 +00:00
fr33domlover
9536d870e5 Add utility for loading permanent key files, and use it for ocap signing key 2019-02-08 03:13:56 +00:00
fr33domlover
8ac559d064 New datatype FedURI for @id URIs
Using a dedicated type allows to record in the type the guarantees that we
provide, such as scheme being HTTPS and authority being present. Allows to
replace ugly `fromJust` and such with direct field access.
2019-02-07 23:08:28 +00:00
fr33domlover
e325175a9c Publish 2 rotating instance-scope keys instead of the one-implicitly-shared-key
Before, there was a single key used as a personal key for all actors. Now,
things work like this:

- There are 2 keys, each time one is rotated, this way the old key remains
  valid and we can freely rotate without a risk of race conditions on other
  servers and end up with our posts being rejected
- The keys are explicitly instance-scope keys, all actors refer to them
- We add the ActivityPub-Actor header to all activity POSTs we send, to declare
  for which specific actor our signature applies. Activities and otherwise
  different payloads may have varying ways to specify attribution; using this
  header will be a standard uniform way to specify the actor, regardless of
  payload format. Of course, servers should make sure the actual activity is
  attributed to the same actor we specified in the header. (This is important
  with instance-scope keys; for personal keys it's not critical)
2019-02-07 10:34:33 +00:00
fr33domlover
8166d5b5eb Support for instance-scope keys when verifying HTTP signature 2019-02-06 02:48:23 +00:00
fr33domlover
400245cf34 Accept HTTP signatures made with shared instance-scope actor keys 2019-02-05 13:02:15 +00:00
fr33domlover
e8a5ef4e86 Replace unused symbol name with underscore 2019-02-05 12:56:06 +00:00
fr33domlover
d4c7fa5809 When parsing ID URIs in AP JSON, make sure their authority part is non-empty 2019-02-05 12:54:55 +00:00
fr33domlover
c2c4e24497 Support actor key expiration
Allow keys to specify expiration time using w3c security vocabulary. If a key
has expired, we treat it like sig validation failure and re-fetch the key from
the other server. And we never accept a sig, even a valid sig, if the key has
expired.

Since servers keep actors and keys in the DB, expiration can be a nice way to
ask that keys aren't used more than we want them to. The security vocab spec
also recommends to set expiration time on keys, so it's nice to support this
feature.
2019-02-05 04:05:44 +00:00
fr33domlover
37b3416a41 Support remote actors specifying 2 keys, and DB storage of these keys
It's now possible for activities we be attributed to actors that have more than
one key. We allow up to 2 keys. We also store in the DB. Scaling to support any
number of keys is trivial, but I'm limiting to 2 to avoid potential trouble and
because 2 is the actual number we need.

By having 2 keys, and replacing only one of them in each rotation, we avoid
race conditions. With 1 key, the following can happen:

1. We send an activity to another server
2. We rotate our key
3. The server reaches the activity in its processing queue, tries to verify our
   request signature, but fails because it can't fetch the key. It's the old
   key and we discarded it already, replaced it with the new one

When we use 2 keys, the previous key remains available and other servers have
time to finish processing our requests signed with that key. We can safely
rotate, without worrying about whether the user sent anything right before the
rotation time.

Caveat: With this feature, we allow OTHER servers to rotate freely. It's safe
because it's optional, but it's just Vervis right now. Once Vervis itself
starts using 2 keys, it will be able to rotate freely without race condition
risk, but probably Mastodon etc. won't accept its signatures because of the use
of 2 keys and because they're server-scope keys.

Maybe I can get these features adopted by the fediverse?
2019-02-04 19:38:50 +00:00
fr33domlover
02da508ed0 Allow actor publicKey to be a URI, and require the URI to match the Sig keyId 2019-02-04 10:07:25 +00:00
fr33domlover
c336d56036 Allow actor public key to be in a separate document 2019-02-03 23:39:56 +00:00
fr33domlover
8db38c087f Allow other servers to do blind key rotation by re-fetching if sig is invalid 2019-02-03 15:05:28 +00:00
fr33domlover
b0b2aa83c5 Store remote actor keys in the DB, reuse them instead of GETing every time 2019-02-03 13:58:14 +00:00
fr33domlover
21c8df1251 Actor public key specifies whether it's shared
Shared key means the key is used for multiple actors. I'm not sure explicitly
specifying this will be necessary, but I prefer to have it in place to help
with debugging in case something unexpected comes from other servers, or my
format overlaps with stuff used in other software and encodes a different
meaning.

Each public key can specify whether it's shared or personal, and this patch
checks for that when verifying a request signature. It rejects shared keys,
accepting valid sigs only from personal keys.

Very soon I'll add shared key support.
2019-02-03 11:12:18 +00:00
fr33domlover
991296faa1 Move some JSON/AP codec utils to new Data.Aeson.Local module 2019-02-03 11:01:36 +00:00
fr33domlover
e6f987817e Fix: HTTP signature wasn't being sent in AP POSTs 2019-02-03 10:59:35 +00:00
fr33domlover
cd8ed9ef89 Hold a persistent server key for ocap signatures 2019-01-30 03:12:42 +00:00
fr33domlover
c0965a4c47 Default roles for repos and turn user/anon collab tables into proj/repo fields
* Repo collab now supports basic default roles developer/user/guest like
  project collab does
* User/Anon collab for repos and projects are now stored as fields instead of
  in dedicated tables, there was never a need for dedicated tables but I didn't
  see that before
* Repo push op is now part of `ProjectOperation`
* `RepoRole` and related code has been entirely removed, only project roles
  remain and they're used for both repos and projects
* This is the first not-totally-trivial DB migration in Vervis, it's automatic
  but please be careful and report errors
2019-01-29 22:24:32 +00:00
fr33domlover
5cba838917 Enable basic default project roles
* When adding collaborators, you don't need a custom role. If you don't choose
  one, a basic default "developer" role will be used
* If you don't assign a `ProjectCollabUser` role, a default "user" role is
  assumed for logged in users, otherwise a "guest" role
* The "guest" role currently has no access at all
* Theoretically there may also be a "maintainer" role allowing project
  sharers/maintainers to give maintainer-level access to more people, but right
  now maintainer role would be the same as developer so I haven't added it yet
2019-01-28 14:43:07 +00:00
fr33domlover
577df6ddcf Add "about" field to person table, display in person page 2019-01-26 23:39:13 +00:00
fr33domlover
e9ac361f27 Uncomment new person form, it's not being used 2019-01-26 23:38:43 +00:00
fr33domlover
20c0e40638 Determine operation access in Vervis.Access, reuse it everywhere it's needed 2019-01-26 22:22:49 +00:00
fr33domlover
250701712a Move most of the DB graph modules to a separate persistent-graph library 2019-01-26 22:20:19 +00:00
fr33domlover
da6d8c008e Rename project field in Project Role assignment tables, it had the wrong name 2019-01-26 12:56:15 +00:00
fr33domlover
4875f0b9f7 Make login status display consider unverified login 2019-01-21 22:51:19 +00:00
fr33domlover
04e26a911d In httpGetAP, if we got an unexpected Content-Type, specify it in error message 2019-01-21 22:24:09 +00:00
fr33domlover
1f47ca39eb Federation test outbox page with form for entering JSON 2019-01-21 15:54:57 +00:00
fr33domlover
2cc621e3a5 Public ActivityPub actor in PersonR
It already had one, but it didn't have a public key and it was using the old
mess of the Vervis.ActivityStreams module, which I'll possibly remove soon.
It's hopefully more elegant now.
2019-01-19 05:56:58 +00:00
fr33domlover
2a4dc345f4 Back to using the (updated) YesodHttpSig class 2019-01-19 04:21:56 +00:00
fr33domlover
393cce0ede When GETing the keyId, set Accept header to JSON-LD/AS2 2019-01-19 02:57:58 +00:00
fr33domlover
93def0dfc8 When doing httpJSON to GET keyId, use appHttpManager, not the silly global one 2019-01-19 02:33:20 +00:00
fr33domlover
28439b0236 Add InboxR to breadcrumbs instance, I always forget and it causes errors 2019-01-19 02:20:49 +00:00
fr33domlover
e4153fc909 Ugh I forgot *again* to commit a new source file, the actual InboxR handler 2019-01-19 01:56:50 +00:00
fr33domlover
df01560ea6 ActivityPub inbox test page
This patch includes some ugliness and commented out code. Sorry for that. I'll
clean it up soon.

Basically there's a TVar holding a Vector of at most 10 AP activities. You can
freely POST stuff to /inbox, and then GET /inbox and see what you posted, or an
error description saying why your activity was rejected.
2019-01-19 01:44:21 +00:00
fr33domlover
499e26db48 Periodically rotated AP actor key for signing ActivityPub requests
The actor key will be used for all actors on the server. It's held in a `TVar`
so that it can always be safely updated and safely retrieved (technically there
is a single writer so IORef and MVar could work, but they require extra care
while TVar is by design suited for this sort of thing).
2019-01-14 22:08:44 +00:00
fr33domlover
adaa920aa4 Launch service thread with a function that re-throws if they fail
In Haskell by default if a thread has an exception, the main thread isn't
notified at all. This patch changes service thread launching to re-throw their
exceptions in the main thread, so that their failure is noticed.
2019-01-14 22:03:49 +00:00
fr33domlover
5862b03019 Remove HTTP connection manager, it's not being used
I suppose there's no performance difference in using one, but it requires
`http-conduit` as a build dependency, so potentially we may be reducing build
time by removing unnecessary deps.
2019-01-14 02:30:39 +00:00
fr33domlover
0e2001af0f Palette: Make the dark blue lighter, it's too dark against the #111 background 2019-01-03 10:18:09 +00:00
fr33domlover
632bfe1979 In repo change feed, entry ID is now the URL of patch page 2018-12-12 08:37:01 +00:00
fr33domlover
4bd33b59e5 Remove GitOld module, it's not in use anymore 2018-12-12 07:59:19 +00:00
fr33domlover
33338a73cc Upgrade to GHC 8.4 and LTS 12 2018-12-05 03:41:19 +00:00
fr33domlover
9bc5d411c8 Change color scheme to something hopefully not controversial 2018-07-12 09:25:04 +00:00
fr33domlover
cf3f8fb8f6 Add CSRF token to all buttons through a new buttonW widget 2018-07-11 08:15:19 +00:00
fr33domlover
01163dfe9a Darcs patch parser: Make sure we read the whole patch successfully 2018-07-10 16:00:01 +00:00
fr33domlover
edaf141359 Fix Darcs patch author parsing 2018-07-10 15:26:16 +00:00
fr33domlover
a50de1fe88 Darcs patch view, supporting only text file edit hunks so far 2018-07-10 14:02:30 +00:00
fr33domlover
13bd369de3 Darcs patch reader: Join adjacent remove-add sequences like in the Git module 2018-07-09 19:12:11 +00:00
fr33domlover
16c71b666f Data.List.Local: Generalize input list to be any Foldable 2018-07-08 21:57:08 +00:00
fr33domlover
c8146bbff4 Data.List.Local: Comment out the unused groupByFst 2018-07-08 21:56:08 +00:00
fr33domlover
7782e83419 Initial implementation of Darcs patch reader 2018-07-08 14:45:35 +00:00
fr33domlover
c8b085fbc8 Plan for parsing Darcs patch for patch view 2018-07-07 16:05:10 +00:00
fr33domlover
a1d0b8402e Disable CSRF token check for HTTP git pull
Git pull uses a POST request, which is treated as a write request and the CSRF
token is checked. However, no modification to the server is made by git pulls,
as far as I know (actually I'm not sure why it uses a POST). The entire
response is handled by the git command, and the client side is usually the git
command running in the terminal, there's no session and no cookies (as far as I
know). So I'm just disabling CSRF token checking for this route.
2018-07-01 15:04:33 +00:00
fr33domlover
c420b8d8ea Make the cookie encryption key and timeout configurable in settings file 2018-07-01 08:15:23 +00:00
fr33domlover
870123bfcc Enable CSRF middleware, hopefully this time it works 2018-07-01 04:51:43 +00:00
fr33domlover
9ed1f4c99d Fix: Sharer and repo in SSH address path weren't being lowercased in SSH server
The sharer and repo were being taken and used as is to check push permissions,
which is how it's supposed to be, *but* they were also being used as is to
build the repo path! So sharer and repo names that aren't all lowercase were
getting "No such repository" errors when trying to push.

I changed `RepoSpec` to hold `ShrIdent` and `RpIdent` instead of plain `Text`,
to avoid confusions like that and be clear and explicit about the
representation, and failures to find a repo after verifying it against the DB
are now logged as errors to help with debugging.

I hope this fixes the problem.
2018-06-18 08:30:57 +00:00
fr33domlover
6088b1e117 Display tickets in list view the same as in tree view 2018-06-17 10:29:51 +00:00
fr33domlover
ef21175ec2 Allow loading the SVG font from deployment data path 2018-05-26 10:27:05 +00:00
fr33domlover
0b2090f048 Fix issue: Ticket table was displaying project sharer instead of ticket author 2018-05-26 08:02:07 +00:00
fr33domlover
5c12e7c34f Add project role op for opening tickets, require it for opening a ticket
Before that only the project's sharer was authorized to open a ticket. Now
everyone can, once given a role with the op.
2018-05-26 06:59:54 +00:00
fr33domlover
ca1e83f504 Apply basic style to make commit diffs look a bit less very ugly 2018-05-24 22:42:01 +00:00
fr33domlover
0895fbf911 Minimal diff context line number is 1, not 0, latter caused vector slice error 2018-05-24 22:20:52 +00:00
fr33domlover
7d237b7540 Adapt to darcs-lights and changes in darcs-rev 2018-05-24 21:45:01 +00:00
fr33domlover
400ddf6089 Forgot breadcrumb for RepoPatchR 2018-05-24 21:44:13 +00:00
fr33domlover
b398f05ecc Ignore line numbers when computing diff 2018-05-21 20:54:05 +00:00
fr33domlover
9f77ea69cb Display commit diff for Git repos 2018-05-21 20:32:34 +00:00
fr33domlover
dbec638415 Generate commit diff data for git repos 2018-05-19 16:10:03 +00:00
fr33domlover
5e2ac28c30 Forgot to record new files! 2018-05-18 19:44:14 +00:00
fr33domlover
6d97636b0f Commit info display, no diff diplay yet 2018-05-17 23:33:37 +00:00
fr33domlover
ce89bded73 Add a commit view route, nothing displayed yet 2018-05-17 15:46:57 +00:00
fr33domlover
8eca3fa647 Upgrade to GHC 8 and LTS 10.10 2018-05-16 00:02:54 +00:00
fr33domlover
47b0cdfc2f Implement forgotten loadUserByEmailAddress (thanks ultrason) 2018-05-15 23:54:12 +00:00
fr33domlover
d49b5d678c Allow login using email address 2018-04-11 11:09:42 +00:00
fr33domlover
c172784d61 Display last change for Darcs repos in homepage 2018-04-09 22:00:01 +00:00
fr33domlover
c768659f57 Fix typo in message text 2018-04-09 00:38:40 +00:00
fr33domlover
3cc2810d4e Fix DB migrations and use the validating addEntities 2018-04-05 00:04:39 +00:00
fr33domlover
28f6cbaf5a Fix accidental infinite loop in error message formatting 2018-04-05 00:03:27 +00:00
fr33domlover
ec28256de5 Adapt to switch to typed default/fill values in persistent-migration 2018-04-03 01:20:24 +00:00
fr33domlover
7c2faa7faa Email tokens expire within 1 day 2018-04-01 03:02:35 +00:00
fr33domlover
282ed32fe6 Upgrade to latest yesod-auth-account 2018-04-01 01:29:50 +00:00
fr33domlover
c2785c8e47 Oops forgot to commit a source file 2018-04-01 00:59:13 +00:00
fr33domlover
bfa6436bb3 Atom and RSS feeds for repo history 2018-03-31 22:04:33 +00:00
fr33domlover
c5a50c336e Adapt to persistent-migration changes
We have gained:

* Haskell-side validation of schema changes before their execution
* Report of results of migration process
* Handling of old deployments

However:

* The validation code hasn't been tested yet at all
* Most of the migration list hasn't been applied at all yet
* Adding lists of entities from a model file is NOT VALIDATED!!! It's totally
  possible to implement, just need to catch all the small details right
2018-03-31 19:22:37 +00:00
fr33domlover
bec9290783 Complete DB migration list, allowing to upgrade 2016-08-04 running instance
Until now the list of DB migration actions was incomplete, containing only
changes made since I added the migration system itself. It now contains the
2016-08-04 model, and then every change made since then.

IMPORTANT: The 2016-08-04 instance doesn't have a schema version entity at all,
so it is assigned version 0, while the actual version of its schema is 1. I'm
going to patch persistent-migration to allow it to be 1, making the migration
path smooth.
2018-03-27 14:28:56 +00:00
fr33domlover
f149da8ec6 getPersonR respond with minimal ActivityPub actor 2018-03-25 19:26:30 +00:00
fr33domlover
abfb77479f Move DarcsRev and code we're sharing with it into a separate library 2018-03-20 23:45:09 +00:00
fr33domlover
ff5bb97383 Move Yesod.Mail.Send to a new dedicated separate library 2018-03-20 16:01:33 +00:00
fr33domlover
865d81c235 Resend POST and verify GET require unverified login 2018-03-18 00:13:22 +00:00
fr33domlover
baeef7873e Unverified login and dedicated route for verification email resend form 2018-03-17 22:59:40 +00:00
fr33domlover
f196bf38d6 Unverified variants of setCreds and clearCreds 2018-03-17 22:16:02 +00:00
fr33domlover
139cc996d6 Write unverified login user functions 2018-03-17 17:30:46 +00:00
fr33domlover
d026cf0656 Treat email address as EmailAddress instead of Text including in the mailer 2018-03-06 02:26:27 +00:00
fr33domlover
33af9fb289 Use HTTPS for avatar URL if approot in settings is https:// 2018-03-06 00:55:52 +00:00
fr33domlover
3398b56931 Switch to yesod-auth-account and make the mail code independent of Vervis 2018-03-03 21:33:59 +00:00
fr33domlover
fb47407f2b Adapt to changes in persistent-migration 2018-02-27 03:03:24 +00:00
fr33domlover
829fd72fef Use my new persistent-migration library, to which I moved the related modules 2018-02-26 14:23:02 +00:00
fr33domlover
3b4bd2a5e8 I made upgrades to the DB migration system in Funbot, apply them here too 2018-02-25 11:14:07 +00:00
fr33domlover
b8681e2681 Change breadcrumb separator from "::" to Unicode arrow "→" 2018-02-25 09:55:55 +00:00
fr33domlover
c2d1bb444b Add email sending capability to Vervis 2018-02-25 09:28:55 +00:00
fr33domlover
fc556e0eb3 Workflow scope field, minimal support 2016-09-01 17:40:02 +00:00
fr33domlover
6b4ecb99c7 Migration: Repsert, not update, otherwise schema version never saved 2016-09-01 17:38:44 +00:00
fr33domlover
cd1f7af46e Migration: Safe IsString instances for Field, Entity, Unique 2016-09-01 17:37:20 +00:00
fr33domlover
e027789fbd Migration: When escaping names, forgot to surround then with "s 2016-09-01 17:36:39 +00:00
fr33domlover
bff41673c4 Migration: Specify default value when adding non-null column 2016-09-01 16:30:39 +00:00
fr33domlover
7218262223 Don't update DB schema version if equal to app's version 2016-08-31 17:12:20 +00:00
fr33domlover
dc74456a6a Use the new migration system in place of persistent's one 2016-08-31 16:51:02 +00:00
fr33domlover
2640ecb8d1 Schema backend becomes associated datatype 2016-08-29 13:19:57 +00:00
fr33domlover
400c29289d Persistent schema backend, and PostgreSQL impl 2016-08-20 17:41:16 +00:00
fr33domlover
5909424644 Custom ticket field relevance filter by ticket status 2016-08-11 09:27:30 +00:00