[[activitypub:help.intro]]
', + '[[activitypub:help.fediverse]]
', + '[[activitypub:help.build]]
', + '[[activitypub:help.federating]]
', + '[[activitypub:help.next-generation]]
', + ]; + + trigger.addEventListener('click', () => { + bootbox.dialog({ + title: '[[activitypub:help.title]]', + message: content.join('\n'), + size: 'large', + }); + }); + } + + return World; +}); diff --git a/public/src/modules/api.js b/public/src/modules/api.js index fcee6b94b0c3..5cac8cf42d2d 100644 --- a/public/src/modules/api.js +++ b/public/src/modules/api.js @@ -62,6 +62,11 @@ async function xhr(options) { const res = await fetch(url, options); const { headers } = res; + + if (headers.get('x-redirect')) { + return xhr({ url: headers.get('x-redirect'), ...options }); + } + const contentType = headers.get('content-type'); const isJSON = contentType && contentType.startsWith('application/json'); diff --git a/public/src/modules/flags.js b/public/src/modules/flags.js index bff55bf8b592..5eae76d9bb22 100644 --- a/public/src/modules/flags.js +++ b/public/src/modules/flags.js @@ -8,6 +8,8 @@ define('flags', ['hooks', 'components', 'api', 'alerts'], function (hooks, compo let flagReason; Flag.showFlagModal = function (data) { + data.remote = URL.canParse(data.id) ? new URL(data.id).hostname : false; + app.parseAndTranslate('modals/flag', data, function (html) { flagModal = html; flagModal.on('hidden.bs.modal', function () { @@ -35,18 +37,21 @@ define('flags', ['hooks', 'components', 'api', 'alerts'], function (hooks, compo if (selected.attr('id') === 'flag-reason-other') { reason = flagReason.val(); } - createFlag(data.type, data.id, reason); + const notifyRemote = $('input[name="flag-notify-remote"]').is(':checked'); + createFlag(data.type, data.id, reason, notifyRemote); }); flagModal.on('click', '#flag-reason-other', function () { flagReason.focus(); }); + flagModal.modal('show'); hooks.fire('action:flag.showModal', { modalEl: flagModal, type: data.type, id: data.id, + remote: data.remote, }); flagModal.find('#flag-reason-custom').on('keyup blur change', checkFlagButtonEnable); @@ -62,11 +67,26 @@ define('flags', ['hooks', 'components', 'api', 'alerts'], function (hooks, compo }).catch(alerts.error); }; - function createFlag(type, id, reason) { + + Flag.rescind = function (flagId) { + api.del(`/flags/${flagId}/report`).then(() => { + alerts.success('[[flags:report-rescinded]]'); + hooks.fire('action:flag.rescinded', { flagId: flagId }); + }).catch(alerts.error); + }; + + Flag.purge = function (flagId) { + api.del(`/flags/${flagId}`).then(() => { + alerts.success('[[flags:purged]]'); + hooks.fire('action:flag.purged', { flagId: flagId }); + }).catch(alerts.error); + }; + + function createFlag(type, id, reason, notifyRemote = false) { if (!type || !id || !reason) { return; } - const data = { type: type, id: id, reason: reason }; + const data = { type: type, id: id, reason: reason, notifyRemote: notifyRemote }; api.post('/flags', data, function (err, flagId) { if (err) { return alerts.error(err); diff --git a/public/src/modules/helpers.common.js b/public/src/modules/helpers.common.js index 6c17927918b7..b426fdaf515a 100644 --- a/public/src/modules/helpers.common.js +++ b/public/src/modules/helpers.common.js @@ -27,6 +27,7 @@ module.exports = function (utils, Benchpress, relative_path) { increment, generateRepliedTo, generateWrote, + encodeURIComponent: _encodeURIComponent, isoTimeToLocaleString, shouldHideReplyContainer, humanReadableNumber, @@ -174,7 +175,7 @@ module.exports = function (utils, Benchpress, relative_path) { return ''; } - function spawnPrivilegeStates(member, privileges, types) { + function spawnPrivilegeStates(cid, member, privileges, types) { const states = []; for (const priv in privileges) { if (privileges.hasOwnProperty(priv)) { @@ -189,15 +190,20 @@ module.exports = function (utils, Benchpress, relative_path) { const guestDisabled = ['groups:moderate', 'groups:posts:upvote', 'groups:posts:downvote', 'groups:local:login', 'groups:group:create']; const spidersEnabled = ['groups:find', 'groups:read', 'groups:topics:read', 'groups:view:users', 'groups:view:tags', 'groups:view:groups']; const globalModDisabled = ['groups:moderate']; + let fediverseEnabled = ['groups:view:users', 'groups:find', 'groups:read', 'groups:topics:read', 'groups:topics:create', 'groups:topics:reply', 'groups:topics:tag', 'groups:posts:edit', 'groups:posts:history', 'groups:posts:delete', 'groups:posts:upvote', 'groups:posts:downvote', 'groups:topics:delete']; + if (cid === -1) { + fediverseEnabled = fediverseEnabled.slice(3); + } const disabled = (member === 'guests' && (guestDisabled.includes(priv.name) || priv.name.startsWith('groups:admin:'))) || (member === 'spiders' && !spidersEnabled.includes(priv.name)) || + (member === 'fediverse' && !fediverseEnabled.includes(priv.name)) || (member === 'Global Moderators' && globalModDisabled.includes(priv.name)); return `[[admin/manage/categories:federation.disabled]]
+ [[admin/manage/categories:federation.disabled-cta]] ++ [[admin/manage/categories:handle.help]] +
+[[admin/settings/activitypub:intro-lead]]
+[[admin/settings/activitypub:intro-body]]
+ +@@ -131,14 +131,23 @@
- {available.text} {available.route}
- {{{ if available.core }}} [[admin/settings/navigation:core]] {{{ else }}} [[admin/settings/navigation:plugin]] {{{ end }}}
-
+ {available.text} +
+
+ {{{ if available.core }}}
+ [[admin/settings/navigation:core]]
+ {{{ else }}}
+ [[admin/settings/navigation:plugin]]
+ {{{ end }}}
+ {available.route}
+
Lorem ipsum dolor sit amet
consectetur adipiscing elit. Integer tincidunt metus scelerisque, dignissim risus a, fermentum leo. Pellentesque eleifend ullamcorper risus tempus vestibulum. Proin mollis ipsum et magna lobortis, at pretium enim pharetra. Ut vel ex metus. Mauris faucibus lectus et nulla iaculis, et pellentesque elit pellentesque. Aliquam rhoncus nec nulla eu lacinia. Maecenas cursus iaculis ligula, eu pharetra ex suscipit sit amet.
'; + const title = activitypub.helpers.generateTitle(source); + assert.strictEqual(title, 'Lorem ipsum dolor sit amet'); + }); + + it('should take the first line\'s text if no matched elements', () => { + const source = 'Lorem ipsum dolor sit amet\n\nconsectetur adipiscing elit. Integer tincidunt metus scelerisque, dignissim risus a, fermentum leo. Pellentesque eleifend ullamcorper risus tempus vestibulum. Proin mollis ipsum et magna lobortis, at pretium enim pharetra. Ut vel ex metus. Mauris faucibus lectus et nulla iaculis, et pellentesque elit pellentesque. Aliquam rhoncus nec nulla eu lacinia. Maecenas cursus iaculis ligula, eu pharetra ex suscipit sit amet.'; + const title = activitypub.helpers.generateTitle(source); + assert.strictEqual(title, 'Lorem ipsum dolor sit amet'); + }); + + it('should trim down the title if it is too long per settings', () => { + const value = meta.config.maximumTitleLength; + meta.config.maximumTitleLength = 10; + const source = '@@@@@@@@@@@@@@@@@@@@'; + const title = activitypub.helpers.generateTitle(source); + assert.strictEqual(title, '@@@@@@@...'); + meta.config.maximumTitleLength = value; + }); + + it('should take the first sentence of a matched element/line', () => { + const source = 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Etiam a ex pellentesque, fringilla lorem non, blandit est. Nulla facilisi. Curabitur cursus neque vel enim semper, id lacinia elit facilisis. Vestibulum turpis orci, efficitur ut semper eu, faucibus eu turpis. Praesent eu odio non libero gravida tempor. Ut porta pellentesque orci. In porta nunc eget tincidunt interdum. Curabitur vel dui nec libero tempus porttitor. Phasellus tincidunt, diam id viverra suscipit, est diam maximus purus, in vestibulum dui ligula vel libero. Sed tempus finibus ante, sit amet consequat magna facilisis eget. Proin ullamcorper, velit sit amet feugiat varius, massa sem aliquam dui, non aliquam augue velit vel est. Phasellus eu sapien in purus feugiat scelerisque congue id velit. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos.'; + const title = activitypub.helpers.generateTitle(source); + assert.strictEqual(title, 'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'); + }); + + it('should also consider other sentence ending symbols', () => { + const source = 'Lorem ipsum dolor sit amet, consectetur adipiscing elit? Etiam a ex pellentesque, fringilla lorem non, blandit est. Nulla facilisi. Curabitur cursus neque vel enim semper, id lacinia elit facilisis. Vestibulum turpis orci, efficitur ut semper eu, faucibus eu turpis. Praesent eu odio non libero gravida tempor. Ut porta pellentesque orci. In porta nunc eget tincidunt interdum. Curabitur vel dui nec libero tempus porttitor. Phasellus tincidunt, diam id viverra suscipit, est diam maximus purus, in vestibulum dui ligula vel libero. Sed tempus finibus ante, sit amet consequat magna facilisis eget. Proin ullamcorper, velit sit amet feugiat varius, massa sem aliquam dui, non aliquam augue velit vel est. Phasellus eu sapien in purus feugiat scelerisque congue id velit. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos.'; + const title = activitypub.helpers.generateTitle(source); + assert.strictEqual(title, 'Lorem ipsum dolor sit amet, consectetur adipiscing elit?'); + }); + }); + }); + + describe('ActivityPub screener middleware', () => { + let uid; + + beforeEach(async () => { + uid = await user.create({ username: slugify(utils.generateUUID().slice(0, 8)) }); + }); + + it('should return regular user profile html if federation is disabled', async () => { + delete meta.config.activitypubEnabled; + + const { response, body } = await request.get(`${nconf.get('url')}/uid/${uid}`, { + headers: { + Accept: 'text/html', + }, + }); + + assert(response); + assert.strictEqual(response.statusCode, 200); + assert(body.startsWith('')); + + meta.config.activitypubEnabled = 1; + }); + + it('should return regular user profile html if Accept header is not ActivityPub-related', async () => { + const { response, body } = await request.get(`${nconf.get('url')}/uid/${uid}`, { + headers: { + Accept: 'text/html', + }, + }); + + assert(response); + assert.strictEqual(response.statusCode, 200); + assert(body.startsWith('')); + }); + + it('should return the ActivityPub Actor JSON-LD payload if the correct Accept header is provided', async () => { + const { response, body } = await request.get(`${nconf.get('url')}/uid/${uid}`, { + headers: { + Accept: 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', + }, + }); + + assert(response); + assert.strictEqual(response.statusCode, 200); + assert(body.hasOwnProperty('@context')); + assert(body['@context'].includes('https://www.w3.org/ns/activitystreams')); + }); + }); + + describe('User Actor endpoint', () => { + let uid; + let slug; + + beforeEach(async () => { + slug = slugify(utils.generateUUID().slice(0, 8)); + uid = await user.create({ username: slug }); + }); + + it('should return a valid ActivityPub Actor JSON-LD payload', async () => { + const { response, body } = await request.get(`${nconf.get('url')}/uid/${uid}`, { + headers: { + Accept: 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', + }, + }); + + assert(response); + assert.strictEqual(response.statusCode, 200); + assert(body.hasOwnProperty('@context')); + assert(body['@context'].includes('https://www.w3.org/ns/activitystreams')); + + ['id', 'url', 'followers', 'following', 'inbox', 'outbox'].forEach((prop) => { + assert(body.hasOwnProperty(prop)); + assert(body[prop]); + }); + + assert.strictEqual(body.id, `${nconf.get('url')}/uid/${uid}`); + assert.strictEqual(body.type, 'Person'); + }); + + it('should contain a `publicKey` property with a public key', async () => { + const { response, body } = await request.get(`${nconf.get('url')}/uid/${uid}`, { + headers: { + Accept: 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', + }, + }); + + assert(body.hasOwnProperty('publicKey')); + assert(['id', 'owner', 'publicKeyPem'].every(prop => body.publicKey.hasOwnProperty(prop))); + }); + }); + + describe('Instance Actor endpoint', () => { + let response; + let body; + + before(async () => { + ({ response, body } = await request.get(`${nconf.get('url')}/actor`, { + headers: { + Accept: 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', + }, + })); + }); + + it('should respond properly', async () => { + assert(response); + assert.strictEqual(response.statusCode, 200); + }); + + it('should return a valid ActivityPub Actor JSON-LD payload', async () => { + assert(body.hasOwnProperty('@context')); + assert(body['@context'].includes('https://www.w3.org/ns/activitystreams')); + + ['id', 'url', 'inbox', 'outbox', 'name', 'preferredUsername'].forEach((prop) => { + assert(body.hasOwnProperty(prop)); + assert(body[prop]); + }); + + assert.strictEqual(body.id, body.url); + assert.strictEqual(body.type, 'Application'); + assert.strictEqual(body.name, meta.config.site_title || 'NodeBB'); + assert.strictEqual(body.preferredUsername, nconf.get('url_parsed').hostname); + }); + + it('should contain a `publicKey` property with a public key', async () => { + assert(body.hasOwnProperty('publicKey')); + assert(['id', 'owner', 'publicKeyPem'].every(prop => body.publicKey.hasOwnProperty(prop))); + }); + + it('should also have a valid WebFinger response tied to `preferredUsername`', async () => { + const { response, body: body2 } = await request.get(`${nconf.get('url')}/.well-known/webfinger?resource=acct%3a${body.preferredUsername}@${nconf.get('url_parsed').host}`); + + assert.strictEqual(response.statusCode, 200); + assert(body2 && body2.aliases && body2.links); + assert(body2.aliases.includes(nconf.get('url'))); + assert(body2.links.some(item => item.rel === 'self' && item.type === 'application/activity+json' && item.href === `${nconf.get('url')}/actor`)); + }); + }); + + describe('Receipt of ActivityPub events to inboxes (federating IN)', () => { + describe('Create', () => { + describe('Note', () => { + const slug = utils.generateUUID(); + const id = `https://example.org/status/${slug}`; + const remoteNote = { + '@context': 'https://www.w3.org/ns/activitystreams', + id, + url: id, + type: 'Note', + to: ['https://www.w3.org/ns/activitystreams#Public'], + cc: ['https://example.org/user/foobar/followers'], + inReplyTo: null, + attributedTo: 'https://example.org/user/foobar', + name: 'Foo Bar', + content: 'Baz quux', + published: new Date().toISOString(), + source: { + content: '**Baz quux**', + mediaType: 'text/markdown', + }, + }; + const remoteUser = { + '@context': 'https://www.w3.org/ns/activitystreams', + id: 'https://example.org/user/foobar', + url: 'https://example.org/user/foobar', + + type: 'Person', + name: 'Foo Bar', + preferredUsername: 'foobar', + publicKey: { + id: 'https://example.org/user/foobar#key', + owner: 'https://example.org/user/foobar', + publicKeyPem: 'publickey', + }, + }; + + let topic; + + before(async () => { + const controllers = require('../src/controllers'); + + activitypub._cache.set(`0;${id}`, remoteNote); + activitypub._cache.set(`0;https://example.org/user/foobar`, remoteUser); + await db.sortedSetAdd(`followersRemote:${remoteUser.id}`, Date.now(), 1); // fake a follow + await controllers.activitypub.postInbox({ + body: { + type: 'Create', + actor: 'https://example.org/user/foobar', + object: remoteNote, + }, + }, { sendStatus: () => {} }); + }); + + it('should create a new topic if Note is at root-level or its parent has not been seen before', async () => { + const saved = await db.getObject(`post:${id}`); + + assert(saved); + assert(saved.tid); + + topic = await topics.getTopicData(saved.tid); + assert(topic); + assert.strictEqual(saved.uid, 'https://example.org/user/foobar'); + assert.strictEqual(saved.content, 'Baz quux'); + }); + + it('should properly save the topic title in the topic hash', async () => { + assert.strictEqual(topic.title, 'Foo Bar'); + }); + + it('should properly save the mainPid in the topic hash', async () => { + assert.strictEqual(topic.mainPid, id); + }); + + // todo: test topic replies, too + }); + }); + }); + + describe('Serving of local assets to remote clients (mocking)', () => { + describe('Note', () => { + let cid; + let uid; + + before(async () => { + ({ cid } = await categories.create({ name: utils.generateUUID().slice(0, 8) })); + const slug = slugify(utils.generateUUID().slice(0, 8)); + uid = await user.create({ username: slug }); + }); + + describe('Existing and resolvable', () => { + let body; + let response; + let postData; + + before(async () => { + ({ postData } = await topics.post({ + uid, + cid, + title: 'Lorem "Lipsum" Ipsum', + content: 'Lorem ipsum dolor sit amet', + })); + + ({ body, response } = await request.get(`${nconf.get('url')}/post/${postData.pid}`, { + headers: { + Accept: 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', + }, + })); + }); + + it('should return a 404 on a non-existant post', async () => { + const { response } = await request.get(`${nconf.get('url')}/post/${parseInt(postData.pid, 10) + 1}`, { + headers: { + Accept: 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', + }, + }); + + assert.strictEqual(response.statusCode, 404); + }); + + it('should return a 200 response on an existing post', () => { + assert.strictEqual(response.statusCode, 200); + }); + + it('should return the expected Content-Type header', () => { + assert.strictEqual(response.headers['content-type'], 'application/activity+json; charset=utf-8'); + }); + + it('Topic title (`name`) should not be escaped', () => { + assert.strictEqual(body.name, 'Lorem "Lipsum" Ipsum'); + }); + }); + + describe('Soft deleted', () => { + let body; + let response; + let postData; + + before(async () => { + ({ postData } = await topics.post({ + uid, + cid, + title: utils.generateUUID(), + content: utils.generateUUID(), + })); + + await posts.delete(postData.pid, uid); + + ({ body, response } = await request.get(`${nconf.get('url')}/post/${postData.pid}`, { + headers: { + Accept: 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', + }, + })); + }); + + it('should return a 200 response on an existing post', () => { + assert.strictEqual(response.statusCode, 200); + }); + + it('should return a Tombstone object', () => { + assert.strictEqual(body.type, 'Tombstone'); + }); + + it('should still retain the existing id and former type', () => { + assert.strictEqual(body.id, `${nconf.get('url')}/post/${postData.pid}`); + assert.strictEqual(body.formerType, 'Note'); + }); + + it('should still contain contextual information (context, audience, attributedTo)', () => { + assert(['context', 'audience', 'attributedTo'].every(prop => body.hasOwnProperty(prop) && body[prop])); + }); + }); + }); + }); + + describe('Actor asserton', () => { + describe('happy path', () => { + let uid; + let actorUri; + + before(async () => { + uid = utils.generateUUID().slice(0, 8); + actorUri = `https://example.org/user/${uid}`; + activitypub._cache.set(`0;${actorUri}`, { + '@context': 'https://www.w3.org/ns/activitystreams', + id: actorUri, + url: actorUri, + + type: 'Person', + name: 'example', + preferredUsername: 'example', + + publicKey: { + id: `${actorUri}#key`, + owner: actorUri, + publicKeyPem: 'somekey', + }, + }); + }); + + it('should return true if successfully asserted', async () => { + const result = await activitypub.actors.assert([actorUri]); + assert(result); + }); + + it('should contain a representation of that remote user in the database', async () => { + const exists = await db.exists(`userRemote:${actorUri}`); + assert(exists); + + const userData = await user.getUserData(actorUri); + assert(userData); + assert.strictEqual(userData.uid, actorUri); + }); + + it('should save the actor\'s publicly accessible URL in the hash as well', async () => { + const url = await user.getUserField(actorUri, 'url'); + assert.strictEqual(url, actorUri); + }); + }); + + describe('edge case: loopback handles and uris', () => { + let uid; + const userslug = utils.generateUUID().slice(0, 8); + before(async () => { + uid = await user.create({ username: userslug }); + }); + + it('should return true but not actually assert the handle into the database', async () => { + const handle = `${userslug}@${nconf.get('url_parsed').host}`; + const result = await activitypub.actors.assert([handle]); + assert(result); + + const handleExists = await db.isObjectField('handle:uid', handle); + assert.strictEqual(handleExists, false); + + const userRemoteHashExists = await db.exists(`userRemote:${nconf.get('url')}/uid/${uid}`); + assert.strictEqual(userRemoteHashExists, false); + }); + + it('should return true but not actually assert the uri into the database', async () => { + const uri = `${nconf.get('url')}/uid/${uid}`; + const result = await activitypub.actors.assert([uri]); + assert(result); + + const userRemoteHashExists = await db.exists(`userRemote:${uri}`); + assert.strictEqual(userRemoteHashExists, false); + }); + }); + }); + + describe('ActivityPub', async () => { + let files; + + before(async () => { + files = await file.walk(path.resolve(__dirname, './activitypub')); + }); + + it('subfolder tests', () => { + files.forEach((filePath) => { + require(filePath); + }); + }); + }); +}); diff --git a/test/activitypub/analytics.js b/test/activitypub/analytics.js new file mode 100644 index 000000000000..6d68b6f165bf --- /dev/null +++ b/test/activitypub/analytics.js @@ -0,0 +1,154 @@ +'use strict'; + +const nconf = require('nconf'); +const assert = require('assert'); + +const db = require('../../src/database'); +const controllers = require('../../src/controllers'); +const middleware = require('../../src/middleware'); +const activitypub = require('../../src/activitypub'); +const utils = require('../../src/utils'); +const user = require('../../src/user'); +const categories = require('../../src/categories'); +const topics = require('../../src/topics'); +const analytics = require('../../src/analytics'); +const api = require('../../src/api'); + +describe('Analytics', () => { + let cid; + let uid; + let postData; + + before(async () => { + nconf.set('runJobs', 1); + ({ cid } = await categories.create({ name: utils.generateUUID().slice(0, 8) })); + const remoteUser = { + '@context': 'https://www.w3.org/ns/activitystreams', + id: 'https://example.org/user/foobar', + url: 'https://example.org/user/foobar', + + type: 'Person', + name: 'Foo Bar', + preferredUsername: 'foobar', + publicKey: { + id: 'https://example.org/user/foobar#key', + owner: 'https://example.org/user/foobar', + publicKeyPem: 'publickey', + }, + }; + activitypub._cache.set(`0;https://example.org/user/foobar`, remoteUser); + }); + + after(async () => { + nconf.set('runJobs', undefined); + }); + + beforeEach(async () => { + uid = await user.create({ username: utils.generateUUID().slice(0, 8) }); + ({ postData } = await topics.post({ + uid, + cid, + title: utils.generateUUID(), + content: utils.generateUUID(), + })); + }); + + it('should record the incoming activity if successfully processed', async () => { + const id = `https://example.org/activity/${utils.generateUUID()}`; + await controllers.activitypub.postInbox({ + body: { + id, + type: 'Like', + actor: 'https://example.org/user/foobar', + object: { + type: 'Note', + id: `${nconf.get('url')}/post/${postData.pid}`, + }, + }, + }, { sendStatus: () => {} }); + const processed = await db.isSortedSetMember('activities:datetime', id); + + assert(processed); + }); + + it('should not process the activity if received again', async () => { + // Specifically, the controller would update the score, but the request should be caught in middlewares and ignored + const id = `https://example.org/activity/${utils.generateUUID()}`; + await controllers.activitypub.postInbox({ + body: { + id, + type: 'Like', + actor: 'https://example.org/user/foobar', + object: { + type: 'Note', + id: `${nconf.get('url')}/post/${postData.pid}`, + }, + }, + }, { sendStatus: () => {} }); + + await middleware.activitypub.validate({ + body: { + id, + type: 'Like', + actor: 'https://example.org/user/foobar', + object: { + type: 'Note', + id: `${nconf.get('url')}/post/${postData.pid}`, + }, + }, + }, { + sendStatus: (statusCode) => { + assert.strictEqual(statusCode, 200); + }, + }); + }); + + it('should increment the last seen time of that domain', async () => { + const id = `https://example.org/activity/${utils.generateUUID()}`; + const before = await db.sortedSetScore('domains:lastSeen', 'example.org'); + await controllers.activitypub.postInbox({ + body: { + id, + type: 'Like', + actor: 'https://example.org/user/foobar', + object: { + type: 'Note', + id: `${nconf.get('url')}/post/${postData.pid}`, + }, + }, + }, { sendStatus: () => {} }); + + const after = await db.sortedSetScore('domains:lastSeen', 'example.org'); + + assert(before && after); + assert(before < after); + }); + + it('should increment various metrics', async () => { + let counters; + ({ counters } = analytics.peek()); + const before = { ...counters }; + + const id = `https://example.org/activity/${utils.generateUUID()}`; + await controllers.activitypub.postInbox({ + body: { + id, + type: 'Like', + actor: 'https://example.org/user/foobar', + object: { + type: 'Note', + id: `${nconf.get('url')}/post/${postData.pid}`, + }, + }, + }, { sendStatus: () => {} }); + + ({ counters } = analytics.peek()); + const after = { ...counters }; + + const metrics = ['activities', 'activities:byType:Like', 'activities:byHost:example.org']; + metrics.forEach((metric) => { + assert(before[metric] && after[metric]); + assert(before[metric] < after[metric]); + }); + }); +}); diff --git a/test/activitypub/notes.js b/test/activitypub/notes.js new file mode 100644 index 000000000000..90b95a9aa9c4 --- /dev/null +++ b/test/activitypub/notes.js @@ -0,0 +1,107 @@ +'use strict'; + +const assert = require('assert'); + +const db = require('../../src/database'); +const user = require('../../src/user'); +const categories = require('../../src/categories'); +const topics = require('../../src/topics'); +const activitypub = require('../../src/activitypub'); +const utils = require('../../src/utils'); + +describe('Notes', () => { + describe('Inbox Synchronization', () => { + let cid; + let uid; + let topicData; + + before(async () => { + ({ cid } = await categories.create({ name: utils.generateUUID().slice(0, 8) })); + }); + + beforeEach(async () => { + uid = await user.create({ username: utils.generateUUID().slice(0, 10) }); + ({ topicData } = await topics.post({ + cid, + uid, + title: utils.generateUUID(), + content: utils.generateUUID(), + })); + }); + + it('should add a topic to a user\'s inbox if user is a recipient in OP', async () => { + await db.setAdd(`post:${topicData.mainPid}:recipients`, [uid]); + await activitypub.notes.syncUserInboxes(topicData.tid); + const inboxed = await db.isSortedSetMember(`uid:${uid}:inbox`, topicData.tid); + + assert.strictEqual(inboxed, true); + }); + + it('should add a topic to a user\'s inbox if a user is a recipient in a reply', async () => { + const uid = await user.create({ username: utils.generateUUID().slice(0, 10) }); + const { pid } = await topics.reply({ + tid: topicData.tid, + uid, + content: utils.generateUUID(), + }); + await db.setAdd(`post:${pid}:recipients`, [uid]); + await activitypub.notes.syncUserInboxes(topicData.tid); + const inboxed = await db.isSortedSetMember(`uid:${uid}:inbox`, topicData.tid); + + assert.strictEqual(inboxed, true); + }); + + it('should maintain a list of recipients at the topic level', async () => { + await db.setAdd(`post:${topicData.mainPid}:recipients`, [uid]); + await activitypub.notes.syncUserInboxes(topicData.tid); + const [isRecipient, count] = await Promise.all([ + db.isSetMember(`tid:${topicData.tid}:recipients`, uid), + db.setCount(`tid:${topicData.tid}:recipients`), + ]); + + assert(isRecipient); + assert.strictEqual(count, 1); + }); + + it('should add topic to a user\'s inbox if it is explicitly passed in as an argument', async () => { + await activitypub.notes.syncUserInboxes(topicData.tid, uid); + const inboxed = await db.isSortedSetMember(`uid:${uid}:inbox`, topicData.tid); + + assert.strictEqual(inboxed, true); + }); + }); + + describe('Deletion', () => { + let cid; + let uid; + let topicData; + + before(async () => { + ({ cid } = await categories.create({ name: utils.generateUUID().slice(0, 8) })); + }); + + beforeEach(async () => { + uid = await user.create({ username: utils.generateUUID().slice(0, 10) }); + ({ topicData } = await topics.post({ + cid, + uid, + title: utils.generateUUID(), + content: utils.generateUUID(), + })); + }); + + it('should clean up recipient sets for the post', async () => { + const { pid } = await topics.reply({ + pid: `https://example.org/${utils.generateUUID().slice(0, 8)}`, + tid: topicData.tid, + uid, + content: utils.generateUUID(), + }); + await db.setAdd(`post:${pid}:recipients`, [uid]); + await activitypub.notes.delete([pid]); + + const inboxed = await db.isSetMember(`post:${pid}:recipients`, uid); + assert(!inboxed); + }); + }); +}); diff --git a/test/activitypub/signatures.js b/test/activitypub/signatures.js new file mode 100644 index 000000000000..c05b24140b84 --- /dev/null +++ b/test/activitypub/signatures.js @@ -0,0 +1,143 @@ +'use strict'; + +const assert = require('assert'); +const nconf = require('nconf'); +const { createHash } = require('crypto'); + +const user = require('../../src/user'); +const utils = require('../../src/utils'); +const db = require('../../src/database'); +const activitypub = require('../../src/activitypub'); + +describe('http signature signing and verification', () => { + describe('.sign()', () => { + let uid; + + before(async () => { + uid = await user.create({ username: utils.generateUUID().slice(0, 10) }); + }); + + it('should create a key-pair for a user if the user does not have one already', async () => { + const endpoint = `${nconf.get('url')}/uid/${uid}/inbox`; + const keyData = await activitypub.getPrivateKey('uid', uid); + await activitypub.sign(keyData, endpoint); + const { publicKey, privateKey } = await db.getObject(`uid:${uid}:keys`); + + assert(publicKey); + assert(privateKey); + }); + + it('should return an object with date, a null digest, and signature, if no payload is passed in', async () => { + const endpoint = `${nconf.get('url')}/uid/${uid}/inbox`; + const keyData = await activitypub.getPrivateKey('uid', uid); + const { date, digest, signature } = await activitypub.sign(keyData, endpoint); + const dateObj = new Date(date); + + assert(signature); + assert(dateObj); + assert.strictEqual(digest, null); + }); + + it('should also return a digest hash if payload is passed in', async () => { + const endpoint = `${nconf.get('url')}/uid/${uid}/inbox`; + const payload = { foo: 'bar' }; + const keyData = await activitypub.getPrivateKey('uid', uid); + const { digest } = await activitypub.sign(keyData, endpoint, payload); + const hash = createHash('sha256'); + hash.update(JSON.stringify(payload)); + const checksum = hash.digest('base64'); + + assert(digest); + assert.strictEqual(digest, `SHA-256=${checksum}`); + }); + + it('should create a key for NodeBB itself if a uid of 0 is passed in', async () => { + const endpoint = `${nconf.get('url')}/uid/${uid}/inbox`; + const keyData = await activitypub.getPrivateKey('uid', 0); + await activitypub.sign(keyData, endpoint); + const { publicKey, privateKey } = await db.getObject(`uid:0:keys`); + + assert(publicKey); + assert(privateKey); + }); + + it('should return headers with an appropriate key id uri', async () => { + const endpoint = `${nconf.get('url')}/uid/${uid}/inbox`; + const keyData = await activitypub.getPrivateKey('uid', uid); + const { signature } = await activitypub.sign(keyData, endpoint); + const [keyId] = signature.split(','); + + assert(signature); + assert.strictEqual(keyId, `keyId="${nconf.get('url')}/uid/${uid}#key"`); + }); + + it('should return the instance key id when uid is 0', async () => { + const endpoint = `${nconf.get('url')}/uid/${uid}/inbox`; + const keyData = await activitypub.getPrivateKey('uid', 0); + const { signature } = await activitypub.sign(keyData, endpoint); + const [keyId] = signature.split(','); + + assert(signature); + assert.strictEqual(keyId, `keyId="${nconf.get('url')}/actor#key"`); + }); + }); + + describe('.verify()', () => { + let uid; + let username; + const baseUrl = nconf.get('relative_path'); + const mockReqBase = { + method: 'GET', + // path: ... + baseUrl, + headers: { + // host: ... + // date: ... + // signature: ... + // digest: ... + }, + }; + + before(async () => { + username = utils.generateUUID().slice(0, 10); + uid = await user.create({ username }); + }); + + it('should return true when the proper signature and relevant headers are passed in', async () => { + const endpoint = `${nconf.get('url')}/user/${username}/inbox`; + const path = `/user/${username}/inbox`; + const keyData = await activitypub.getPrivateKey('uid', uid); + const signature = await activitypub.sign(keyData, endpoint); + const { host } = nconf.get('url_parsed'); + const req = { + ...mockReqBase, + ...{ + path, + headers: { ...signature, host }, + }, + }; + + const verified = await activitypub.verify(req); + assert.strictEqual(verified, true); + }); + + it('should return true when a digest is also passed in', async () => { + const endpoint = `${nconf.get('url')}/user/${username}/inbox`; + const path = `/user/${username}/inbox`; + const keyData = await activitypub.getPrivateKey('uid', uid); + const signature = await activitypub.sign(keyData, endpoint, { foo: 'bar' }); + const { host } = nconf.get('url_parsed'); + const req = { + ...mockReqBase, + ...{ + method: 'POST', + path, + headers: { ...signature, host }, + }, + }; + + const verified = await activitypub.verify(req); + assert.strictEqual(verified, true); + }); + }); +}); diff --git a/test/activitypub/webfinger.js b/test/activitypub/webfinger.js new file mode 100644 index 000000000000..9e503ebfc304 --- /dev/null +++ b/test/activitypub/webfinger.js @@ -0,0 +1,63 @@ +'use strict'; + +const assert = require('assert'); +const nconf = require('nconf'); + +const request = require('../../src/request'); +const utils = require('../../src/utils'); +const user = require('../../src/user'); +const slugify = require('../../src/slugify'); +const privileges = require('../../src/privileges'); + +describe('WebFinger endpoint', () => { + let uid; + let slug; + const { host } = nconf.get('url_parsed'); + + beforeEach(async () => { + slug = slugify(utils.generateUUID().slice(0, 8)); + uid = await user.create({ username: slug }); + }); + + it('should return a 404 Not Found if no user exists by that username', async () => { + const { response } = await request.get(`${nconf.get('url')}/.well-known/webfinger?resource=acct%3afoobar%40${host}`); + + assert(response); + assert.strictEqual(response.statusCode, 404); + }); + + it('should return a 400 Bad Request if the request is malformed', async () => { + const { response } = await request.get(`${nconf.get('url')}/.well-known/webfinger?resource=acct%3afoobar`); + + assert(response); + assert.strictEqual(response.statusCode, 400); + }); + + it('should return 403 Forbidden if the calling user is not allowed to view the user list/profiles', async () => { + await privileges.global.rescind(['groups:view:users'], 'guests'); + const { response } = await request.get(`${nconf.get('url')}/.well-known/webfinger?resource=acct%3a${slug}%40${host}`); + + assert(response); + assert.strictEqual(response.statusCode, 400); + await privileges.global.give(['groups:view:users'], 'guests'); + }); + + it('should return a valid WebFinger response otherwise', async () => { + const { response, body } = await request.get(`${nconf.get('url')}/.well-known/webfinger?resource=acct%3a${slug}%40${host}`); + + assert(response); + assert.strictEqual(response.statusCode, 200); + + ['subject', 'aliases', 'links'].forEach((prop) => { + assert(body.hasOwnProperty(prop)); + assert(body[prop]); + }); + + assert.strictEqual(body.subject, `acct:${slug}@${host}`); + + assert(Array.isArray(body.aliases)); + assert([`${nconf.get('url')}/uid/${uid}`, `${nconf.get('url')}/user/${slug}`].every(url => body.aliases.includes(url))); + + assert(Array.isArray(body.links)); + }); +}); diff --git a/test/api.js b/test/api.js index 47961742ff3b..857a5f879961 100644 --- a/test/api.js +++ b/test/api.js @@ -241,6 +241,7 @@ describe('API', async () => { meta.config.allowTopicsThumbnail = 1; meta.config.termsOfUse = 'I, for one, welcome our new test-driven overlords'; meta.config.chatMessageDelay = 0; + meta.config.activitypubEnabled = 1; // Create a category const testCategory = await categories.create({ name: 'test' }); diff --git a/test/controllers.js b/test/controllers.js index 418420303f81..951a2e9616f3 100644 --- a/test/controllers.js +++ b/test/controllers.js @@ -1865,6 +1865,49 @@ describe('Controllers', () => { } }); + describe('.well-known', () => { + describe('webfinger', () => { + let uid; + let username; + + before(async () => { + username = utils.generateUUID().slice(0, 10); + uid = await user.create({ username }); + }); + + it('should error if resource parameter is missing', async () => { + const { response } = await request.get(`${nconf.get('url')}/.well-known/webfinger`); + assert.strictEqual(response.statusCode, 400); + }); + + it('should error if resource parameter is malformed', async () => { + const { response } = await request.get(`${nconf.get('url')}/.well-known/webfinger?resource=foobar`); + assert.strictEqual(response.statusCode, 400); + }); + + it('should deny access if view:users privilege is not enabled for guests', async () => { + await privileges.global.rescind(['groups:view:users'], 'guests'); + + const { response } = await request.get(`${nconf.get('url')}/.well-known/webfinger?resource=acct:${username}@${nconf.get('url_parsed').host}`); + assert.strictEqual(response.statusCode, 400); + + await privileges.global.give(['groups:view:users'], 'guests'); + }); + + it('should respond appropriately if the user requested does not exist locally', async () => { + const { response } = await request.get(`${nconf.get('url')}/.well-known/webfinger?resource=acct:foobar@${nconf.get('url_parsed').host}`); + assert.strictEqual(response.statusCode, 404); + }); + + it('should return a valid webfinger response if the user exists', async () => { + const { response, body } = await request.get(`${nconf.get('url')}/.well-known/webfinger?resource=acct:${username}@${nconf.get('url_parsed').host}`); + assert.strictEqual(response.statusCode, 200); + assert(['subject', 'aliases', 'links'].every(prop => body.hasOwnProperty(prop))); + assert(body.subject, `acct:${username}@${nconf.get('url_parsed').host}`); + }); + }); + }); + after((done) => { const analytics = require('../src/analytics'); analytics.writeData(done); diff --git a/test/template-helpers.js b/test/template-helpers.js index 00ae777f8295..f01bdd642c9a 100644 --- a/test/template-helpers.js +++ b/test/template-helpers.js @@ -151,7 +151,7 @@ describe('helpers', () => { find: 'viewing', read: 'viewing', }; - const html = helpers.spawnPrivilegeStates('guests', privs, types); + const html = helpers.spawnPrivilegeStates(1, 'guests', privs, types); assert.equal(html, `