mirror of
https://github.com/misskey-dev/misskey
synced 2024-10-12 18:50:41 +02:00
perf(federation): Ed25519署名に対応する (#13464)
* 1. ed25519キーペアを発行・Personとして公開鍵を送受信 * validate additionalPublicKeys * getAuthUserFromApIdはmainを選ぶ * ✌️ * fix * signatureAlgorithm * set publicKeyCache lifetime * refresh * httpMessageSignatureAcceptable * ED25519_SIGNED_ALGORITHM * ED25519_PUBLIC_KEY_SIGNATURE_ALGORITHM * remove sign additionalPublicKeys signature requirements * httpMessageSignaturesSupported * httpMessageSignaturesImplementationLevel * httpMessageSignaturesImplementationLevel: '01' * perf(federation): Use hint for getAuthUserFromApId (#13470) * Hint for getAuthUserFromApId * とどのつまりこれでいいのか？ * use @misskey-dev/node-http-message-signatures * fix * signedPost, signedGet * ap-request.tsを復活させる * remove digest prerender * fix test? * fix test * add httpMessageSignaturesImplementationLevel to FederationInstance * ManyToOne * fetchPersonWithRenewal * exactKey * ✌️ * use const * use gen-key-pair fn. from '@misskey-dev/node-http-message-signatures' * update node-http-message-signatures * fix * @misskey-dev/node-http-message-signatures@0.0.0-alpha.11 * getAuthUserFromApIdでupdatePersonの頻度を増やす * cacheRaw.date * use requiredInputs https://github.com/misskey-dev/misskey/pull/13464#discussion_r1509964359 * update @misskey-dev/node-http-message-signatures * clean up * err msg * fix(backend): fetchInstanceMetadataのLockが永遠に解除されない問題を修正 Co-authored-by: まっちゃとーにゅ <17376330+u1-liquid@users.noreply.github.com> * fix httpMessageSignaturesImplementationLevel validation * fix test * fix * comment * comment * improve test * fix * use Promise.all in genRSAAndEd25519KeyPair * refreshAndprepareEd25519KeyPair * refreshAndfindKey * commetn * refactor public keys add * digestプリレンダを復活させる RFC実装時にどうするか考える * fix, async * fix * !== true * use save * Deliver update person when new key generated (not tested) https://github.com/misskey-dev/misskey/pull/13464#issuecomment-1977049061 * 循環参照で落ちるのを解消？ * fix? * Revert "fix?" This reverts commit0082f6f8e8. * a * logger * log * change logger * 秘密鍵の変更は、フラグではなく鍵を引き回すようにする * addAllKnowingSharedInboxRecipe * nanka meccha kaeta * delivre * キャッシュ有効チェックはロック取得前に行う * @misskey-dev/node-http-message-signatures@0.0.3 * PrivateKeyPem * getLocalUserPrivateKey * fix test * if * fix ap-request * update node-http-message-signatures * fix type error * update package * fix type * update package * retry no key * @misskey-dev/node-http-message-signatures@0.0.8 * fix type error * log keyid * logger * db-resolver * JSON.stringify * HTTP Signatureがなかったり使えなかったりしそうな場合にLD Signatureを活用するように * inbox-delayed use actor if no signature * ユーザーとキーの同一性チェックはhostの一致にする * log signature parse err * save array * とりあえずtryで囲っておく * fetchPersonWithRenewalでエラーが起きたら古いデータを返す * use transactionalEntityManager * fix spdx * @misskey-dev/node-http-message-signatures@0.0.10 * add comment * fix * publicKeyに配列が入ってもいいようにする https://github.com/misskey-dev/misskey/pull/13950 * define additionalPublicKeys * fix * merge fix * refreshAndprepareEd25519KeyPair → refreshAndPrepareEd25519KeyPair * remove gen-key-pair.ts * defaultMaxListeners = 512 * Revert "defaultMaxListeners = 512" This reverts commitf2c412c180. * genRSAAndEd25519KeyPairではキーを直列に生成する? * maxConcurrency: 8 * maxConcurrency: 16 * maxConcurrency: 8 * Revert "genRSAAndEd25519KeyPairではキーを直列に生成する?" This reverts commitd0aada55c1. * maxWorkers: '90%' * Revert "maxWorkers: '90%'" This reverts commit9e0a93f110. * e2e/timelines.tsで個々のテストに対するtimeoutを削除, maxConcurrency: 32 * better error handling of this.userPublickeysRepository.delete * better comment * set result to keypairEntityCache * deliverJobConcurrency: 16, deliverJobPerSec: 1024, inboxJobConcurrency: 4 * inboxJobPerSec: 64 * delete request.headers['host']; * fix * // node-fetch will generate this for us. if we keep 'Host', it won't change with redirects! * move delete host * modify comment * modify comment * fix correct → collect * refreshAndfindKey → refreshAndFindKey * modify comment * modify attachLdSignature * getApId, InboxProcessorService * TODO * [skip ci] add CHANGELOG --------- Co-authored-by: MeiMei <30769358+mei23@users.noreply.github.com> Co-authored-by: まっちゃとーにゅ <17376330+u1-liquid@users.noreply.github.com>
This commit is contained in:
tamaina
GitHub
parent
3331f3972a
commit
5f88d56d96
|
|
@ -164,12 +164,12 @@ id: 'aidx'
|
|||
#clusterLimit: 1
|
||||
|
||||
# Job concurrency per worker
|
||||
# deliverJobConcurrency: 128
|
||||
# inboxJobConcurrency: 16
|
||||
# deliverJobConcurrency: 16
|
||||
# inboxJobConcurrency: 4
|
||||
|
||||
# Job rate limiter
|
||||
# deliverJobPerSec: 128
|
||||
# inboxJobPerSec: 32
|
||||
# inboxJobPerSec: 64
|
||||
|
||||
# Job attempts
|
||||
# deliverJobMaxAttempts: 12
|
||||
|
|
|
|||
|
|
@ -230,15 +230,15 @@ id: 'aidx'
|
|||
#clusterLimit: 1
|
||||
|
||||
# Job concurrency per worker
|
||||
#deliverJobConcurrency: 128
|
||||
#inboxJobConcurrency: 16
|
||||
#deliverJobConcurrency: 16
|
||||
#inboxJobConcurrency: 4
|
||||
#relationshipJobConcurrency: 16
|
||||
# What's relationshipJob?:
|
||||
# Follow, unfollow, block and unblock(ings) while following-imports, etc. or account migrations.
|
||||
|
||||
# Job rate limiter
|
||||
#deliverJobPerSec: 128
|
||||
#inboxJobPerSec: 32
|
||||
#deliverJobPerSec: 1024
|
||||
#inboxJobPerSec: 64
|
||||
#relationshipJobPerSec: 64
|
||||
|
||||
# Job attempts
|
||||
|
|
|
|||
|
|
@ -157,12 +157,12 @@ id: 'aidx'
|
|||
#clusterLimit: 1
|
||||
|
||||
# Job concurrency per worker
|
||||
# deliverJobConcurrency: 128
|
||||
# inboxJobConcurrency: 16
|
||||
# deliverJobConcurrency: 16
|
||||
# inboxJobConcurrency: 4
|
||||
|
||||
# Job rate limiter
|
||||
# deliverJobPerSec: 128
|
||||
# inboxJobPerSec: 32
|
||||
# deliverJobPerSec: 1024
|
||||
# inboxJobPerSec: 64
|
||||
|
||||
# Job attempts
|
||||
# deliverJobMaxAttempts: 12
|
||||
|
|
|
|||
|
|
@ -7,6 +7,8 @@
|
|||
- Feat: 通報を受けた際、または解決した際に、予め登録した宛先に通知を飛ばせるように(mail or webhook) #13705
|
||||
- Feat: ユーザーのアイコン/バナーの変更可否をロールで設定可能に
|
||||
- 変更不可となっていても、設定済みのものを解除してデフォルト画像に戻すことは出来ます
|
||||
- Feat: 連合に使うHTTP SignaturesがEd25519鍵に対応するように #13464
|
||||
- Ed25519署名に対応するサーバーが増えると、deliverで要求されるサーバーリソースが削減されます
|
||||
- Fix: 配信停止したインスタンス一覧が見れなくなる問題を修正
|
||||
- Fix: Dockerコンテナの立ち上げ時に`pnpm`のインストールで固まることがある問題
|
||||
- Fix: デフォルトテーマに無効なテーマコードを入力するとUIが使用できなくなる問題を修正
|
||||
|
|
|
|||
|
|
@ -185,7 +185,7 @@ TODO
|
|||
## Environment Variable
|
||||
|
||||
- `MISSKEY_CONFIG_YML`: Specify the file path of config.yml instead of default.yml (e.g. `2nd.yml`).
|
||||
- `MISSKEY_WEBFINGER_USE_HTTP`: If it's set true, WebFinger requests will be http instead of https, useful for testing federation between servers in localhost. NEVER USE IN PRODUCTION.
|
||||
- `MISSKEY_USE_HTTP`: If it's set true, federation requests (like nodeinfo and webfinger) will be http instead of https, useful for testing federation between servers in localhost. NEVER USE IN PRODUCTION. (was `MISSKEY_WEBFINGER_USE_HTTP`)
|
||||
|
||||
## Continuous integration
|
||||
Misskey uses GitHub Actions for executing automated tests.
|
||||
|
|
|
|||
|
|
@ -178,12 +178,12 @@ id: "aidx"
|
|||
#clusterLimit: 1
|
||||
|
||||
# Job concurrency per worker
|
||||
# deliverJobConcurrency: 128
|
||||
# inboxJobConcurrency: 16
|
||||
# deliverJobConcurrency: 16
|
||||
# inboxJobConcurrency: 4
|
||||
|
||||
# Job rate limiter
|
||||
# deliverJobPerSec: 128
|
||||
# inboxJobPerSec: 32
|
||||
# deliverJobPerSec: 1024
|
||||
# inboxJobPerSec: 64
|
||||
|
||||
# Job attempts
|
||||
# deliverJobMaxAttempts: 12
|
||||
|
|
|
|||
39
packages/backend/migration/1708980134301-APMultipleKeys.js
Normal file
39
packages/backend/migration/1708980134301-APMultipleKeys.js
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
/*
|
||||
* SPDX-FileCopyrightText: syuilo and misskey-project
|
||||
* SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
export class APMultipleKeys1708980134301 {
|
||||
name = 'APMultipleKeys1708980134301'
|
||||
|
||||
async up(queryRunner) {
|
||||
await queryRunner.query(`DROP INDEX "public"."IDX_171e64971c780ebd23fae140bb"`);
|
||||
await queryRunner.query(`ALTER TABLE "user_keypair" ADD "ed25519PublicKey" character varying(128)`);
|
||||
await queryRunner.query(`ALTER TABLE "user_keypair" ADD "ed25519PrivateKey" character varying(128)`);
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" DROP CONSTRAINT "FK_10c146e4b39b443ede016f6736d"`);
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" DROP CONSTRAINT "PK_10c146e4b39b443ede016f6736d"`);
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" ADD CONSTRAINT "PK_0db6a5fdb992323449edc8ee421" PRIMARY KEY ("userId", "keyId")`);
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" DROP CONSTRAINT "PK_0db6a5fdb992323449edc8ee421"`);
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" ADD CONSTRAINT "PK_171e64971c780ebd23fae140bba" PRIMARY KEY ("keyId")`);
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" ADD CONSTRAINT "UQ_10c146e4b39b443ede016f6736d" UNIQUE ("userId")`);
|
||||
await queryRunner.query(`CREATE INDEX "IDX_10c146e4b39b443ede016f6736" ON "user_publickey" ("userId") `);
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" ADD CONSTRAINT "FK_10c146e4b39b443ede016f6736d" FOREIGN KEY ("userId") REFERENCES "user"("id") ON DELETE CASCADE ON UPDATE NO ACTION`);
|
||||
}
|
||||
|
||||
async down(queryRunner) {
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" DROP CONSTRAINT "FK_10c146e4b39b443ede016f6736d"`);
|
||||
await queryRunner.query(`DROP INDEX "public"."IDX_10c146e4b39b443ede016f6736"`);
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" DROP CONSTRAINT "UQ_10c146e4b39b443ede016f6736d"`);
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" DROP CONSTRAINT "PK_171e64971c780ebd23fae140bba"`);
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" ADD CONSTRAINT "PK_0db6a5fdb992323449edc8ee421" PRIMARY KEY ("userId", "keyId")`);
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" DROP CONSTRAINT "PK_0db6a5fdb992323449edc8ee421"`);
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" ADD CONSTRAINT "PK_10c146e4b39b443ede016f6736d" PRIMARY KEY ("userId")`);
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" ADD CONSTRAINT "FK_10c146e4b39b443ede016f6736d" FOREIGN KEY ("userId") REFERENCES "user"("id") ON DELETE CASCADE ON UPDATE NO ACTION`);
|
||||
await queryRunner.query(`ALTER TABLE "user_profile" ALTER COLUMN "followersVisibility" DROP DEFAULT`);
|
||||
await queryRunner.query(`ALTER TABLE "user_profile" ALTER COLUMN "followersVisibility" TYPE "public"."user_profile_followersVisibility_enum_old" USING "followersVisibility"::"text"::"public"."user_profile_followersVisibility_enum_old"`);
|
||||
await queryRunner.query(`ALTER TABLE "user_profile" ALTER COLUMN "followersVisibility" SET DEFAULT 'public'`);
|
||||
await queryRunner.query(`ALTER TABLE "user_keypair" DROP COLUMN "ed25519PrivateKey"`);
|
||||
await queryRunner.query(`ALTER TABLE "user_keypair" DROP COLUMN "ed25519PublicKey"`);
|
||||
await queryRunner.query(`CREATE UNIQUE INDEX "IDX_171e64971c780ebd23fae140bb" ON "user_publickey" ("keyId") `);
|
||||
}
|
||||
}
|
||||
16
packages/backend/migration/1709242519122-HttpSignImplLv.js
Normal file
16
packages/backend/migration/1709242519122-HttpSignImplLv.js
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
/*
|
||||
* SPDX-FileCopyrightText: syuilo and misskey-project
|
||||
* SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
export class HttpSignImplLv1709242519122 {
|
||||
name = 'HttpSignImplLv1709242519122'
|
||||
|
||||
async up(queryRunner) {
|
||||
await queryRunner.query(`ALTER TABLE "instance" ADD "httpMessageSignaturesImplementationLevel" character varying(16) NOT NULL DEFAULT '00'`);
|
||||
}
|
||||
|
||||
async down(queryRunner) {
|
||||
await queryRunner.query(`ALTER TABLE "instance" DROP COLUMN "httpMessageSignaturesImplementationLevel"`);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
/*
|
||||
* SPDX-FileCopyrightText: syuilo and misskey-project
|
||||
* SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
export class APMultipleKeys1709269211718 {
|
||||
name = 'APMultipleKeys1709269211718'
|
||||
|
||||
async up(queryRunner) {
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" DROP CONSTRAINT "UQ_10c146e4b39b443ede016f6736d"`);
|
||||
}
|
||||
|
||||
async down(queryRunner) {
|
||||
await queryRunner.query(`ALTER TABLE "user_publickey" ADD CONSTRAINT "UQ_10c146e4b39b443ede016f6736d" UNIQUE ("userId")`);
|
||||
}
|
||||
}
|
||||
|
|
@ -79,13 +79,13 @@
|
|||
"@fastify/multipart": "8.3.0",
|
||||
"@fastify/static": "7.0.4",
|
||||
"@fastify/view": "9.1.0",
|
||||
"@misskey-dev/node-http-message-signatures": "0.0.10",
|
||||
"@misskey-dev/sharp-read-bmp": "1.2.0",
|
||||
"@misskey-dev/summaly": "5.1.0",
|
||||
"@napi-rs/canvas": "^0.1.53",
|
||||
"@nestjs/common": "10.3.10",
|
||||
"@nestjs/core": "10.3.10",
|
||||
"@nestjs/testing": "10.3.10",
|
||||
"@peertube/http-signature": "1.7.0",
|
||||
"@sentry/node": "8.13.0",
|
||||
"@sentry/profiling-node": "8.13.0",
|
||||
"@simplewebauthn/server": "10.0.0",
|
||||
|
|
|
|||
82
packages/backend/src/@types/http-signature.d.ts
vendored
82
packages/backend/src/@types/http-signature.d.ts
vendored
|
|
@ -1,82 +0,0 @@
|
|||
/*
|
||||
* SPDX-FileCopyrightText: syuilo and misskey-project
|
||||
* SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
declare module '@peertube/http-signature' {
|
||||
import type { IncomingMessage, ClientRequest } from 'node:http';
|
||||
|
||||
interface ISignature {
|
||||
keyId: string;
|
||||
algorithm: string;
|
||||
headers: string[];
|
||||
signature: string;
|
||||
}
|
||||
|
||||
interface IOptions {
|
||||
headers?: string[];
|
||||
algorithm?: string;
|
||||
strict?: boolean;
|
||||
authorizationHeaderName?: string;
|
||||
}
|
||||
|
||||
interface IParseRequestOptions extends IOptions {
|
||||
clockSkew?: number;
|
||||
}
|
||||
|
||||
interface IParsedSignature {
|
||||
scheme: string;
|
||||
params: ISignature;
|
||||
signingString: string;
|
||||
algorithm: string;
|
||||
keyId: string;
|
||||
}
|
||||
|
||||
type RequestSignerConstructorOptions =
|
||||
IRequestSignerConstructorOptionsFromProperties |
|
||||
IRequestSignerConstructorOptionsFromFunction;
|
||||
|
||||
interface IRequestSignerConstructorOptionsFromProperties {
|
||||
keyId: string;
|
||||
key: string | Buffer;
|
||||
algorithm?: string;
|
||||
}
|
||||
|
||||
interface IRequestSignerConstructorOptionsFromFunction {
|
||||
sign?: (data: string, cb: (err: any, sig: ISignature) => void) => void;
|
||||
}
|
||||
|
||||
class RequestSigner {
|
||||
constructor(options: RequestSignerConstructorOptions);
|
||||
|
||||
public writeHeader(header: string, value: string): string;
|
||||
|
||||
public writeDateHeader(): string;
|
||||
|
||||
public writeTarget(method: string, path: string): void;
|
||||
|
||||
public sign(cb: (err: any, authz: string) => void): void;
|
||||
}
|
||||
|
||||
interface ISignRequestOptions extends IOptions {
|
||||
keyId: string;
|
||||
key: string;
|
||||
httpVersion?: string;
|
||||
}
|
||||
|
||||
export function parse(request: IncomingMessage, options?: IParseRequestOptions): IParsedSignature;
|
||||
export function parseRequest(request: IncomingMessage, options?: IParseRequestOptions): IParsedSignature;
|
||||
|
||||
export function sign(request: ClientRequest, options: ISignRequestOptions): boolean;
|
||||
export function signRequest(request: ClientRequest, options: ISignRequestOptions): boolean;
|
||||
export function createSigner(): RequestSigner;
|
||||
export function isSigner(obj: any): obj is RequestSigner;
|
||||
|
||||
export function sshKeyToPEM(key: string): string;
|
||||
export function sshKeyFingerprint(key: string): string;
|
||||
export function pemToRsaSSHKey(pem: string, comment: string): string;
|
||||
|
||||
export function verify(parsedSignature: IParsedSignature, pubkey: string | Buffer): boolean;
|
||||
export function verifySignature(parsedSignature: IParsedSignature, pubkey: string | Buffer): boolean;
|
||||
export function verifyHMAC(parsedSignature: IParsedSignature, secret: string): boolean;
|
||||
}
|
||||
|
|
@ -9,6 +9,11 @@ export const MAX_NOTE_TEXT_LENGTH = 3000;
|
|||
export const USER_ONLINE_THRESHOLD = 1000 * 60 * 10; // 10min
|
||||
export const USER_ACTIVE_THRESHOLD = 1000 * 60 * 60 * 24 * 3; // 3days
|
||||
|
||||
export const REMOTE_USER_CACHE_TTL = 1000 * 60 * 60 * 3; // 3hours
|
||||
export const REMOTE_USER_MOVE_COOLDOWN = 1000 * 60 * 60 * 24 * 14; // 14days
|
||||
|
||||
export const REMOTE_SERVER_CACHE_TTL = 1000 * 60 * 60 * 3; // 3hours
|
||||
|
||||
//#region hard limits
|
||||
// If you change DB_* values, you must also change the DB schema.
|
||||
|
||||
|
|
|
|||
|
|
@ -3,7 +3,8 @@
|
|||
* SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
import { Inject, Injectable } from '@nestjs/common';
|
||||
import { Inject, Injectable, OnModuleInit } from '@nestjs/common';
|
||||
import { ModuleRef } from '@nestjs/core';
|
||||
import { DI } from '@/di-symbols.js';
|
||||
import type { UsersRepository } from '@/models/_.js';
|
||||
import type { MiUser } from '@/models/User.js';
|
||||
|
|
@ -12,30 +13,44 @@ import { RelayService } from '@/core/RelayService.js';
|
|||
import { ApDeliverManagerService } from '@/core/activitypub/ApDeliverManagerService.js';
|
||||
import { UserEntityService } from '@/core/entities/UserEntityService.js';
|
||||
import { bindThis } from '@/decorators.js';
|
||||
import type { PrivateKeyWithPem } from '@misskey-dev/node-http-message-signatures';
|
||||
|
||||
@Injectable()
|
||||
export class AccountUpdateService {
|
||||
export class AccountUpdateService implements OnModuleInit {
|
||||
private apDeliverManagerService: ApDeliverManagerService;
|
||||
constructor(
|
||||
private moduleRef: ModuleRef,
|
||||
|
||||
@Inject(DI.usersRepository)
|
||||
private usersRepository: UsersRepository,
|
||||
|
||||
private userEntityService: UserEntityService,
|
||||
private apRendererService: ApRendererService,
|
||||
private apDeliverManagerService: ApDeliverManagerService,
|
||||
private relayService: RelayService,
|
||||
) {
|
||||
}
|
||||
|
||||
async onModuleInit() {
|
||||
this.apDeliverManagerService = this.moduleRef.get(ApDeliverManagerService.name);
|
||||
}
|
||||
|
||||
@bindThis
|
||||
public async publishToFollowers(userId: MiUser['id']) {
|
||||
/**
|
||||
* Deliver account update to followers
|
||||
* @param userId user id
|
||||
* @param deliverKey optional. Private key to sign the deliver.
|
||||
*/
|
||||
public async publishToFollowers(userId: MiUser['id'], deliverKey?: PrivateKeyWithPem) {
|
||||
const user = await this.usersRepository.findOneBy({ id: userId });
|
||||
if (user == null) throw new Error('user not found');
|
||||
|
||||
// フォロワーがリモートユーザーかつ投稿者がローカルユーザーならUpdateを配信
|
||||
if (this.userEntityService.isLocalUser(user)) {
|
||||
const content = this.apRendererService.addContext(this.apRendererService.renderUpdate(await this.apRendererService.renderPerson(user), user));
|
||||
this.apDeliverManagerService.deliverToFollowers(user, content);
|
||||
this.relayService.deliverToRelays(user, content);
|
||||
await Promise.allSettled([
|
||||
this.apDeliverManagerService.deliverToFollowers(user, content, deliverKey),
|
||||
this.relayService.deliverToRelays(user, content, deliverKey),
|
||||
]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@ import { randomUUID } from 'node:crypto';
|
|||
import { Inject, Injectable } from '@nestjs/common';
|
||||
import bcrypt from 'bcryptjs';
|
||||
import { IsNull, DataSource } from 'typeorm';
|
||||
import { genRsaKeyPair } from '@/misc/gen-key-pair.js';
|
||||
import { genRSAAndEd25519KeyPair } from '@/misc/gen-key-pair.js';
|
||||
import { MiUser } from '@/models/User.js';
|
||||
import { MiUserProfile } from '@/models/UserProfile.js';
|
||||
import { IdService } from '@/core/IdService.js';
|
||||
|
|
@ -38,7 +38,7 @@ export class CreateSystemUserService {
|
|||
// Generate secret
|
||||
const secret = generateNativeUserToken();
|
||||
|
||||
const keyPair = await genRsaKeyPair();
|
||||
const keyPair = await genRSAAndEd25519KeyPair();
|
||||
|
||||
let account!: MiUser;
|
||||
|
||||
|
|
@ -64,9 +64,8 @@ export class CreateSystemUserService {
|
|||
}).then(x => transactionalEntityManager.findOneByOrFail(MiUser, x.identifiers[0]));
|
||||
|
||||
await transactionalEntityManager.insert(MiUserKeypair, {
|
||||
publicKey: keyPair.publicKey,
|
||||
privateKey: keyPair.privateKey,
|
||||
userId: account.id,
|
||||
...keyPair,
|
||||
});
|
||||
|
||||
await transactionalEntityManager.insert(MiUserProfile, {
|
||||
|
|
|
|||
|
|
@ -15,6 +15,7 @@ import { LoggerService } from '@/core/LoggerService.js';
|
|||
import { HttpRequestService } from '@/core/HttpRequestService.js';
|
||||
import { bindThis } from '@/decorators.js';
|
||||
import { FederatedInstanceService } from '@/core/FederatedInstanceService.js';
|
||||
import { REMOTE_SERVER_CACHE_TTL } from '@/const.js';
|
||||
import type { DOMWindow } from 'jsdom';
|
||||
|
||||
type NodeInfo = {
|
||||
|
|
@ -24,6 +25,7 @@ type NodeInfo = {
|
|||
version?: unknown;
|
||||
};
|
||||
metadata?: {
|
||||
httpMessageSignaturesImplementationLevel?: unknown,
|
||||
name?: unknown;
|
||||
nodeName?: unknown;
|
||||
nodeDescription?: unknown;
|
||||
|
|
@ -39,6 +41,7 @@ type NodeInfo = {
|
|||
@Injectable()
|
||||
export class FetchInstanceMetadataService {
|
||||
private logger: Logger;
|
||||
private httpColon = 'https://';
|
||||
|
||||
constructor(
|
||||
private httpRequestService: HttpRequestService,
|
||||
|
|
@ -48,6 +51,7 @@ export class FetchInstanceMetadataService {
|
|||
private redisClient: Redis.Redis,
|
||||
) {
|
||||
this.logger = this.loggerService.getLogger('metadata', 'cyan');
|
||||
this.httpColon = process.env.MISSKEY_USE_HTTP?.toLowerCase() === 'true' ? 'http://' : 'https://';
|
||||
}
|
||||
|
||||
@bindThis
|
||||
|
|
@ -59,7 +63,7 @@ export class FetchInstanceMetadataService {
|
|||
return await this.redisClient.set(
|
||||
`fetchInstanceMetadata:mutex:v2:${host}`, '1',
|
||||
'EX', 30, // 30秒したら自動でロック解除 https://github.com/misskey-dev/misskey/issues/13506#issuecomment-1975375395
|
||||
'GET' // 古い値を返す（なかったらnull）
|
||||
'GET', // 古い値を返す（なかったらnull）
|
||||
);
|
||||
}
|
||||
|
||||
|
|
@ -73,23 +77,24 @@ export class FetchInstanceMetadataService {
|
|||
public async fetchInstanceMetadata(instance: MiInstance, force = false): Promise<void> {
|
||||
const host = instance.host;
|
||||
|
||||
// finallyでunlockされてしまうのでtry内でロックチェックをしない
|
||||
// （returnであってもfinallyは実行される）
|
||||
if (!force && await this.tryLock(host) === '1') {
|
||||
// 1が返ってきていたらロックされているという意味なので、何もしない
|
||||
return;
|
||||
if (!force) {
|
||||
// キャッシュ有効チェックはロック取得前に行う
|
||||
const _instance = await this.federatedInstanceService.fetch(host);
|
||||
const now = Date.now();
|
||||
if (_instance && _instance.infoUpdatedAt != null && (now - _instance.infoUpdatedAt.getTime() < REMOTE_SERVER_CACHE_TTL)) {
|
||||
this.logger.debug(`Skip because updated recently ${_instance.infoUpdatedAt.toJSON()}`);
|
||||
return;
|
||||
}
|
||||
|
||||
// finallyでunlockされてしまうのでtry内でロックチェックをしない
|
||||
// （returnであってもfinallyは実行される）
|
||||
if (await this.tryLock(host) === '1') {
|
||||
// 1が返ってきていたら他にロックされているという意味なので、何もしない
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
try {
|
||||
if (!force) {
|
||||
const _instance = await this.federatedInstanceService.fetch(host);
|
||||
const now = Date.now();
|
||||
if (_instance && _instance.infoUpdatedAt && (now - _instance.infoUpdatedAt.getTime() < 1000 * 60 * 60 * 24)) {
|
||||
// unlock at the finally caluse
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
this.logger.info(`Fetching metadata of ${instance.host} ...`);
|
||||
|
||||
const [info, dom, manifest] = await Promise.all([
|
||||
|
|
@ -118,6 +123,14 @@ export class FetchInstanceMetadataService {
|
|||
updates.openRegistrations = info.openRegistrations;
|
||||
updates.maintainerName = info.metadata ? info.metadata.maintainer ? (info.metadata.maintainer.name ?? null) : null : null;
|
||||
updates.maintainerEmail = info.metadata ? info.metadata.maintainer ? (info.metadata.maintainer.email ?? null) : null : null;
|
||||
if (info.metadata && info.metadata.httpMessageSignaturesImplementationLevel && (
|
||||
info.metadata.httpMessageSignaturesImplementationLevel === '01' ||
|
||||
info.metadata.httpMessageSignaturesImplementationLevel === '11'
|
||||
)) {
|
||||
updates.httpMessageSignaturesImplementationLevel = info.metadata.httpMessageSignaturesImplementationLevel;
|
||||
} else {
|
||||
updates.httpMessageSignaturesImplementationLevel = '00';
|
||||
}
|
||||
}
|
||||
|
||||
if (name) updates.name = name;
|
||||
|
|
@ -129,6 +142,12 @@ export class FetchInstanceMetadataService {
|
|||
await this.federatedInstanceService.update(instance.id, updates);
|
||||
|
||||
this.logger.succ(`Successfuly updated metadata of ${instance.host}`);
|
||||
this.logger.debug('Updated metadata:', {
|
||||
info: !!info,
|
||||
dom: !!dom,
|
||||
manifest: !!manifest,
|
||||
updates,
|
||||
});
|
||||
} catch (e) {
|
||||
this.logger.error(`Failed to update metadata of ${instance.host}: ${e}`);
|
||||
} finally {
|
||||
|
|
@ -141,7 +160,7 @@ export class FetchInstanceMetadataService {
|
|||
this.logger.info(`Fetching nodeinfo of ${instance.host} ...`);
|
||||
|
||||
try {
|
||||
const wellknown = await this.httpRequestService.getJson('https://' + instance.host + '/.well-known/nodeinfo')
|
||||
const wellknown = await this.httpRequestService.getJson(this.httpColon + instance.host + '/.well-known/nodeinfo')
|
||||
.catch(err => {
|
||||
if (err.statusCode === 404) {
|
||||
throw new Error('No nodeinfo provided');
|
||||
|
|
@ -184,7 +203,7 @@ export class FetchInstanceMetadataService {
|
|||
private async fetchDom(instance: MiInstance): Promise<DOMWindow['document']> {
|
||||
this.logger.info(`Fetching HTML of ${instance.host} ...`);
|
||||
|
||||
const url = 'https://' + instance.host;
|
||||
const url = this.httpColon + instance.host;
|
||||
|
||||
const html = await this.httpRequestService.getHtml(url);
|
||||
|
||||
|
|
@ -196,7 +215,7 @@ export class FetchInstanceMetadataService {
|
|||
|
||||
@bindThis
|
||||
private async fetchManifest(instance: MiInstance): Promise<Record<string, unknown> | null> {
|
||||
const url = 'https://' + instance.host;
|
||||
const url = this.httpColon + instance.host;
|
||||
|
||||
const manifestUrl = url + '/manifest.json';
|
||||
|
||||
|
|
@ -207,7 +226,7 @@ export class FetchInstanceMetadataService {
|
|||
|
||||
@bindThis
|
||||
private async fetchFaviconUrl(instance: MiInstance, doc: DOMWindow['document'] | null): Promise<string | null> {
|
||||
const url = 'https://' + instance.host;
|
||||
const url = this.httpColon + instance.host;
|
||||
|
||||
if (doc) {
|
||||
// https://github.com/misskey-dev/misskey/pull/8220#issuecomment-1025104043
|
||||
|
|
@ -234,12 +253,12 @@ export class FetchInstanceMetadataService {
|
|||
@bindThis
|
||||
private async fetchIconUrl(instance: MiInstance, doc: DOMWindow['document'] | null, manifest: Record<string, any> | null): Promise<string | null> {
|
||||
if (manifest && manifest.icons && manifest.icons.length > 0 && manifest.icons[0].src) {
|
||||
const url = 'https://' + instance.host;
|
||||
const url = this.httpColon + instance.host;
|
||||
return (new URL(manifest.icons[0].src, url)).href;
|
||||
}
|
||||
|
||||
if (doc) {
|
||||
const url = 'https://' + instance.host;
|
||||
const url = this.httpColon + instance.host;
|
||||
|
||||
// https://github.com/misskey-dev/misskey/pull/8220#issuecomment-1025104043
|
||||
const links = Array.from(doc.getElementsByTagName('link')).reverse();
|
||||
|
|
|
|||
|
|
@ -245,6 +245,7 @@ export interface InternalEventTypes {
|
|||
unmute: { muterId: MiUser['id']; muteeId: MiUser['id']; };
|
||||
userListMemberAdded: { userListId: MiUserList['id']; memberId: MiUser['id']; };
|
||||
userListMemberRemoved: { userListId: MiUserList['id']; memberId: MiUser['id']; };
|
||||
userKeypairUpdated: { userId: MiUser['id']; };
|
||||
}
|
||||
|
||||
// name/messages(spec) pairs dictionary
|
||||
|
|
|
|||
|
|
@ -70,7 +70,7 @@ export class HttpRequestService {
|
|||
localAddress: config.outgoingAddress,
|
||||
});
|
||||
|
||||
const maxSockets = Math.max(256, config.deliverJobConcurrency ?? 128);
|
||||
const maxSockets = Math.max(256, config.deliverJobConcurrency ?? 16);
|
||||
|
||||
this.httpAgent = config.proxy
|
||||
? new HttpProxyAgent({
|
||||
|
|
|
|||
|
|
@ -13,7 +13,6 @@ import type { Config } from '@/config.js';
|
|||
import { DI } from '@/di-symbols.js';
|
||||
import { bindThis } from '@/decorators.js';
|
||||
import type { Antenna } from '@/server/api/endpoints/i/import-antennas.js';
|
||||
import { ApRequestCreator } from '@/core/activitypub/ApRequestService.js';
|
||||
import type {
|
||||
DbJobData,
|
||||
DeliverJobData,
|
||||
|
|
@ -33,7 +32,7 @@ import type {
|
|||
UserWebhookDeliverQueue,
|
||||
SystemWebhookDeliverQueue,
|
||||
} from './QueueModule.js';
|
||||
import type httpSignature from '@peertube/http-signature';
|
||||
import { genRFC3230DigestHeader, type PrivateKeyWithPem, type ParsedSignature } from '@misskey-dev/node-http-message-signatures';
|
||||
import type * as Bull from 'bullmq';
|
||||
|
||||
@Injectable()
|
||||
|
|
@ -90,21 +89,21 @@ export class QueueService {
|
|||
}
|
||||
|
||||
@bindThis
|
||||
public deliver(user: ThinUser, content: IActivity | null, to: string | null, isSharedInbox: boolean) {
|
||||
public async deliver(user: ThinUser, content: IActivity | null, to: string | null, isSharedInbox: boolean, privateKey?: PrivateKeyWithPem) {
|
||||
if (content == null) return null;
|
||||
if (to == null) return null;
|
||||
|
||||
const contentBody = JSON.stringify(content);
|
||||
const digest = ApRequestCreator.createDigest(contentBody);
|
||||
|
||||
const data: DeliverJobData = {
|
||||
user: {
|
||||
id: user.id,
|
||||
},
|
||||
content: contentBody,
|
||||
digest,
|
||||
digest: await genRFC3230DigestHeader(contentBody, 'SHA-256'),
|
||||
to,
|
||||
isSharedInbox,
|
||||
privateKey: privateKey && { keyId: privateKey.keyId, privateKeyPem: privateKey.privateKeyPem },
|
||||
};
|
||||
|
||||
return this.deliverQueue.add(to, data, {
|
||||
|
|
@ -122,13 +121,13 @@ export class QueueService {
|
|||
* @param user `{ id: string; }` この関数ではThinUserに変換しないので前もって変換してください
|
||||
* @param content IActivity | null
|
||||
* @param inboxes `Map<string, boolean>` / key: to (inbox url), value: isSharedInbox (whether it is sharedInbox)
|
||||
* @param forceMainKey boolean | undefined, force to use main (rsa) key
|
||||
* @returns void
|
||||
*/
|
||||
@bindThis
|
||||
public async deliverMany(user: ThinUser, content: IActivity | null, inboxes: Map<string, boolean>) {
|
||||
public async deliverMany(user: ThinUser, content: IActivity | null, inboxes: Map<string, boolean>, privateKey?: PrivateKeyWithPem) {
|
||||
if (content == null) return null;
|
||||
const contentBody = JSON.stringify(content);
|
||||
const digest = ApRequestCreator.createDigest(contentBody);
|
||||
|
||||
const opts = {
|
||||
attempts: this.config.deliverJobMaxAttempts ?? 12,
|
||||
|
|
@ -144,9 +143,9 @@ export class QueueService {
|
|||
data: {
|
||||
user,
|
||||
content: contentBody,
|
||||
digest,
|
||||
to: d[0],
|
||||
isSharedInbox: d[1],
|
||||
privateKey: privateKey && { keyId: privateKey.keyId, privateKeyPem: privateKey.privateKeyPem },
|
||||
} as DeliverJobData,
|
||||
opts,
|
||||
})));
|
||||
|
|
@ -155,7 +154,7 @@ export class QueueService {
|
|||
}
|
||||
|
||||
@bindThis
|
||||
public inbox(activity: IActivity, signature: httpSignature.IParsedSignature) {
|
||||
public inbox(activity: IActivity, signature: ParsedSignature | null) {
|
||||
const data = {
|
||||
activity: activity,
|
||||
signature,
|
||||
|
|
|
|||
|
|
@ -16,6 +16,8 @@ import { ApRendererService } from '@/core/activitypub/ApRendererService.js';
|
|||
import { DI } from '@/di-symbols.js';
|
||||
import { deepClone } from '@/misc/clone.js';
|
||||
import { bindThis } from '@/decorators.js';
|
||||
import { UserKeypairService } from './UserKeypairService.js';
|
||||
import type { PrivateKeyWithPem } from '@misskey-dev/node-http-message-signatures';
|
||||
|
||||
const ACTOR_USERNAME = 'relay.actor' as const;
|
||||
|
||||
|
|
@ -34,6 +36,7 @@ export class RelayService {
|
|||
private queueService: QueueService,
|
||||
private createSystemUserService: CreateSystemUserService,
|
||||
private apRendererService: ApRendererService,
|
||||
private userKeypairService: UserKeypairService,
|
||||
) {
|
||||
this.relaysCache = new MemorySingleCache<MiRelay[]>(1000 * 60 * 10);
|
||||
}
|
||||
|
|
@ -111,7 +114,7 @@ export class RelayService {
|
|||
}
|
||||
|
||||
@bindThis
|
||||
public async deliverToRelays(user: { id: MiUser['id']; host: null; }, activity: any): Promise<void> {
|
||||
public async deliverToRelays(user: { id: MiUser['id']; host: null; }, activity: any, privateKey?: PrivateKeyWithPem): Promise<void> {
|
||||
if (activity == null) return;
|
||||
|
||||
const relays = await this.relaysCache.fetch(() => this.relaysRepository.findBy({
|
||||
|
|
@ -121,11 +124,9 @@ export class RelayService {
|
|||
|
||||
const copy = deepClone(activity);
|
||||
if (!copy.to) copy.to = ['https://www.w3.org/ns/activitystreams#Public'];
|
||||
privateKey = privateKey ?? await this.userKeypairService.getLocalUserPrivateKeyPem(user.id);
|
||||
const signed = await this.apRendererService.attachLdSignature(copy, privateKey);
|
||||
|
||||
const signed = await this.apRendererService.attachLdSignature(copy, user);
|
||||
|
||||
for (const relay of relays) {
|
||||
this.queueService.deliver(user, signed, relay.inbox, false);
|
||||
}
|
||||
this.queueService.deliverMany(user, signed, new Map(relays.map(({ inbox }) => [inbox, false])), privateKey);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,7 +3,6 @@
|
|||
* SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
import { generateKeyPair } from 'node:crypto';
|
||||
import { Inject, Injectable } from '@nestjs/common';
|
||||
import bcrypt from 'bcryptjs';
|
||||
import { DataSource, IsNull } from 'typeorm';
|
||||
|
|
@ -21,6 +20,7 @@ import { bindThis } from '@/decorators.js';
|
|||
import UsersChart from '@/core/chart/charts/users.js';
|
||||
import { UtilityService } from '@/core/UtilityService.js';
|
||||
import { MetaService } from '@/core/MetaService.js';
|
||||
import { genRSAAndEd25519KeyPair } from '@/misc/gen-key-pair.js';
|
||||
|
||||
@Injectable()
|
||||
export class SignupService {
|
||||
|
|
@ -93,22 +93,7 @@ export class SignupService {
|
|||
}
|
||||
}
|
||||
|
||||
const keyPair = await new Promise<string[]>((res, rej) =>
|
||||
generateKeyPair('rsa', {
|
||||
modulusLength: 2048,
|
||||
publicKeyEncoding: {
|
||||
type: 'spki',
|
||||
format: 'pem',
|
||||
},
|
||||
privateKeyEncoding: {
|
||||
type: 'pkcs8',
|
||||
format: 'pem',
|
||||
cipher: undefined,
|
||||
passphrase: undefined,
|
||||
},
|
||||
}, (err, publicKey, privateKey) =>
|
||||
err ? rej(err) : res([publicKey, privateKey]),
|
||||
));
|
||||
const keyPair = await genRSAAndEd25519KeyPair();
|
||||
|
||||
let account!: MiUser;
|
||||
|
||||
|
|
@ -131,9 +116,8 @@ export class SignupService {
|
|||
}));
|
||||
|
||||
await transactionalEntityManager.save(new MiUserKeypair({
|
||||
publicKey: keyPair[0],
|
||||
privateKey: keyPair[1],
|
||||
userId: account.id,
|
||||
...keyPair,
|
||||
}));
|
||||
|
||||
await transactionalEntityManager.save(new MiUserProfile({
|
||||
|
|
|
|||
|
|
@ -5,41 +5,184 @@
|
|||
|
||||
import { Inject, Injectable, OnApplicationShutdown } from '@nestjs/common';
|
||||
import * as Redis from 'ioredis';
|
||||
import { genEd25519KeyPair, importPrivateKey, PrivateKey, PrivateKeyWithPem } from '@misskey-dev/node-http-message-signatures';
|
||||
import type { MiUser } from '@/models/User.js';
|
||||
import type { UserKeypairsRepository } from '@/models/_.js';
|
||||
import { RedisKVCache } from '@/misc/cache.js';
|
||||
import { RedisKVCache, MemoryKVCache } from '@/misc/cache.js';
|
||||
import type { MiUserKeypair } from '@/models/UserKeypair.js';
|
||||
import { DI } from '@/di-symbols.js';
|
||||
import { bindThis } from '@/decorators.js';
|
||||
import { GlobalEventService, GlobalEvents } from '@/core/GlobalEventService.js';
|
||||
import { UserEntityService } from '@/core/entities/UserEntityService.js';
|
||||
import type { webcrypto } from 'node:crypto';
|
||||
|
||||
@Injectable()
|
||||
export class UserKeypairService implements OnApplicationShutdown {
|
||||
private cache: RedisKVCache<MiUserKeypair>;
|
||||
private keypairEntityCache: RedisKVCache<MiUserKeypair>;
|
||||
private privateKeyObjectCache: MemoryKVCache<webcrypto.CryptoKey>;
|
||||
|
||||
constructor(
|
||||
@Inject(DI.redis)
|
||||
private redisClient: Redis.Redis,
|
||||
|
||||
@Inject(DI.redisForSub)
|
||||
private redisForSub: Redis.Redis,
|
||||
@Inject(DI.userKeypairsRepository)
|
||||
private userKeypairsRepository: UserKeypairsRepository,
|
||||
|
||||
private globalEventService: GlobalEventService,
|
||||
private userEntityService: UserEntityService,
|
||||
) {
|
||||
this.cache = new RedisKVCache<MiUserKeypair>(this.redisClient, 'userKeypair', {
|
||||
this.keypairEntityCache = new RedisKVCache<MiUserKeypair>(this.redisClient, 'userKeypair', {
|
||||
lifetime: 1000 * 60 * 60 * 24, // 24h
|
||||
memoryCacheLifetime: Infinity,
|
||||
fetcher: (key) => this.userKeypairsRepository.findOneByOrFail({ userId: key }),
|
||||
toRedisConverter: (value) => JSON.stringify(value),
|
||||
fromRedisConverter: (value) => JSON.parse(value),
|
||||
});
|
||||
this.privateKeyObjectCache = new MemoryKVCache<webcrypto.CryptoKey>(1000 * 60 * 60 * 1);
|
||||
|
||||
this.redisForSub.on('message', this.onMessage);
|
||||
}
|
||||
|
||||
@bindThis
|
||||
public async getUserKeypair(userId: MiUser['id']): Promise<MiUserKeypair> {
|
||||
return await this.cache.fetch(userId);
|
||||
return await this.keypairEntityCache.fetch(userId);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get private key [Only PrivateKeyWithPem for queue data etc.]
|
||||
* @param userIdOrHint user id or MiUserKeypair
|
||||
* @param preferType
|
||||
* If ed25519-like(`ed25519`, `01`, `11`) is specified, ed25519 keypair will be returned if exists.
|
||||
* Otherwise, main keypair will be returned.
|
||||
* @returns
|
||||
*/
|
||||
@bindThis
|
||||
public async getLocalUserPrivateKeyPem(
|
||||
userIdOrHint: MiUser['id'] | MiUserKeypair,
|
||||
preferType?: string,
|
||||
): Promise<PrivateKeyWithPem> {
|
||||
const keypair = typeof userIdOrHint === 'string' ? await this.getUserKeypair(userIdOrHint) : userIdOrHint;
|
||||
if (
|
||||
preferType && ['01', '11', 'ed25519'].includes(preferType.toLowerCase()) &&
|
||||
keypair.ed25519PublicKey != null && keypair.ed25519PrivateKey != null
|
||||
) {
|
||||
return {
|
||||
keyId: `${this.userEntityService.genLocalUserUri(keypair.userId)}#ed25519-key`,
|
||||
privateKeyPem: keypair.ed25519PrivateKey,
|
||||
};
|
||||
}
|
||||
return {
|
||||
keyId: `${this.userEntityService.genLocalUserUri(keypair.userId)}#main-key`,
|
||||
privateKeyPem: keypair.privateKey,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Get private key [Only PrivateKey for ap request]
|
||||
* Using cache due to performance reasons of `crypto.subtle.importKey`
|
||||
* @param userIdOrHint user id, MiUserKeypair, or PrivateKeyWithPem
|
||||
* @param preferType
|
||||
* If ed25519-like(`ed25519`, `01`, `11`) is specified, ed25519 keypair will be returned if exists.
|
||||
* Otherwise, main keypair will be returned. (ignored if userIdOrHint is PrivateKeyWithPem)
|
||||
* @returns
|
||||
*/
|
||||
@bindThis
|
||||
public async getLocalUserPrivateKey(
|
||||
userIdOrHint: MiUser['id'] | MiUserKeypair | PrivateKeyWithPem,
|
||||
preferType?: string,
|
||||
): Promise<PrivateKey> {
|
||||
if (typeof userIdOrHint === 'object' && 'privateKeyPem' in userIdOrHint) {
|
||||
// userIdOrHint is PrivateKeyWithPem
|
||||
return {
|
||||
keyId: userIdOrHint.keyId,
|
||||
privateKey: await this.privateKeyObjectCache.fetch(userIdOrHint.keyId, async () => {
|
||||
return await importPrivateKey(userIdOrHint.privateKeyPem);
|
||||
}),
|
||||
};
|
||||
}
|
||||
|
||||
const userId = typeof userIdOrHint === 'string' ? userIdOrHint : userIdOrHint.userId;
|
||||
const getKeypair = () => typeof userIdOrHint === 'string' ? this.getUserKeypair(userId) : userIdOrHint;
|
||||
|
||||
if (preferType && ['01', '11', 'ed25519'].includes(preferType.toLowerCase())) {
|
||||
const keyId = `${this.userEntityService.genLocalUserUri(userId)}#ed25519-key`;
|
||||
const fetched = await this.privateKeyObjectCache.fetchMaybe(keyId, async () => {
|
||||
const keypair = await getKeypair();
|
||||
if (keypair.ed25519PublicKey != null && keypair.ed25519PrivateKey != null) {
|
||||
return await importPrivateKey(keypair.ed25519PrivateKey);
|
||||
}
|
||||
return;
|
||||
});
|
||||
if (fetched) {
|
||||
return {
|
||||
keyId,
|
||||
privateKey: fetched,
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
const keyId = `${this.userEntityService.genLocalUserUri(userId)}#main-key`;
|
||||
return {
|
||||
keyId,
|
||||
privateKey: await this.privateKeyObjectCache.fetch(keyId, async () => {
|
||||
const keypair = await getKeypair();
|
||||
return await importPrivateKey(keypair.privateKey);
|
||||
}),
|
||||
};
|
||||
}
|
||||
|
||||
@bindThis
|
||||
public async refresh(userId: MiUser['id']): Promise<void> {
|
||||
return await this.keypairEntityCache.refresh(userId);
|
||||
}
|
||||
|
||||
/**
|
||||
* If DB has ed25519 keypair, refresh cache and return it.
|
||||
* If not, create, save and return ed25519 keypair.
|
||||
* @param userId user id
|
||||
* @returns MiUserKeypair if keypair is created, void if keypair is already exists
|
||||
*/
|
||||
@bindThis
|
||||
public async refreshAndPrepareEd25519KeyPair(userId: MiUser['id']): Promise<MiUserKeypair | void> {
|
||||
await this.refresh(userId);
|
||||
const keypair = await this.keypairEntityCache.fetch(userId);
|
||||
if (keypair.ed25519PublicKey != null) {
|
||||
return;
|
||||
}
|
||||
|
||||
const ed25519 = await genEd25519KeyPair();
|
||||
await this.userKeypairsRepository.update({ userId }, {
|
||||
ed25519PublicKey: ed25519.publicKey,
|
||||
ed25519PrivateKey: ed25519.privateKey,
|
||||
});
|
||||
this.globalEventService.publishInternalEvent('userKeypairUpdated', { userId });
|
||||
const result = {
|
||||
...keypair,
|
||||
ed25519PublicKey: ed25519.publicKey,
|
||||
ed25519PrivateKey: ed25519.privateKey,
|
||||
};
|
||||
this.keypairEntityCache.set(userId, result);
|
||||
return result;
|
||||
}
|
||||
|
||||
@bindThis
|
||||
private async onMessage(_: string, data: string): Promise<void> {
|
||||
const obj = JSON.parse(data);
|
||||
|
||||
if (obj.channel === 'internal') {
|
||||
const { type, body } = obj.message as GlobalEvents['internal']['payload'];
|
||||
switch (type) {
|
||||
case 'userKeypairUpdated': {
|
||||
this.refresh(body.userId);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@bindThis
|
||||
public dispose(): void {
|
||||
this.cache.dispose();
|
||||
this.keypairEntityCache.dispose();
|
||||
}
|
||||
|
||||
@bindThis
|
||||
|
|
|
|||
|
|
@ -3,27 +3,23 @@
|
|||
* SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
import { Inject, Injectable } from '@nestjs/common';
|
||||
import { Not, IsNull } from 'typeorm';
|
||||
import type { FollowingsRepository } from '@/models/_.js';
|
||||
import { Injectable } from '@nestjs/common';
|
||||
import type { MiUser } from '@/models/User.js';
|
||||
import { QueueService } from '@/core/QueueService.js';
|
||||
import { GlobalEventService } from '@/core/GlobalEventService.js';
|
||||
import { DI } from '@/di-symbols.js';
|
||||
import { ApRendererService } from '@/core/activitypub/ApRendererService.js';
|
||||
import { UserEntityService } from '@/core/entities/UserEntityService.js';
|
||||
import { bindThis } from '@/decorators.js';
|
||||
import { UserKeypairService } from './UserKeypairService.js';
|
||||
import { ApDeliverManagerService } from './activitypub/ApDeliverManagerService.js';
|
||||
|
||||
@Injectable()
|
||||
export class UserSuspendService {
|
||||
constructor(
|
||||
@Inject(DI.followingsRepository)
|
||||
private followingsRepository: FollowingsRepository,
|
||||
|
||||
private userEntityService: UserEntityService,
|
||||
private queueService: QueueService,
|
||||
private globalEventService: GlobalEventService,
|
||||
private apRendererService: ApRendererService,
|
||||
private userKeypairService: UserKeypairService,
|
||||
private apDeliverManagerService: ApDeliverManagerService,
|
||||
) {
|
||||
}
|
||||
|
||||
|
|
@ -32,28 +28,12 @@ export class UserSuspendService {
|
|||
this.globalEventService.publishInternalEvent('userChangeSuspendedState', { id: user.id, isSuspended: true });
|
||||
|
||||
if (this.userEntityService.isLocalUser(user)) {
|
||||
// 知り得る全SharedInboxにDelete配信
|
||||
const content = this.apRendererService.addContext(this.apRendererService.renderDelete(this.userEntityService.genLocalUserUri(user.id), user));
|
||||
|
||||
const queue: string[] = [];
|
||||
|
||||
const followings = await this.followingsRepository.find({
|
||||
where: [
|
||||
{ followerSharedInbox: Not(IsNull()) },
|
||||
{ followeeSharedInbox: Not(IsNull()) },
|
||||
],
|
||||
select: ['followerSharedInbox', 'followeeSharedInbox'],
|
||||
});
|
||||
|
||||
const inboxes = followings.map(x => x.followerSharedInbox ?? x.followeeSharedInbox);
|
||||
|
||||
for (const inbox of inboxes) {
|
||||
if (inbox != null && !queue.includes(inbox)) queue.push(inbox);
|
||||
}
|
||||
|
||||
for (const inbox of queue) {
|
||||
this.queueService.deliver(user, content, inbox, true);
|
||||
}
|
||||
const manager = this.apDeliverManagerService.createDeliverManager(user, content);
|
||||
manager.addAllKnowingSharedInboxRecipe();
|
||||
// process deliver時にはキーペアが消去されているはずなので、ここで挿入する
|
||||
const privateKey = await this.userKeypairService.getLocalUserPrivateKeyPem(user.id, 'main');
|
||||
manager.execute({ privateKey });
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -62,28 +42,12 @@ export class UserSuspendService {
|
|||
this.globalEventService.publishInternalEvent('userChangeSuspendedState', { id: user.id, isSuspended: false });
|
||||
|
||||
if (this.userEntityService.isLocalUser(user)) {
|
||||
// 知り得る全SharedInboxにUndo Delete配信
|
||||
const content = this.apRendererService.addContext(this.apRendererService.renderUndo(this.apRendererService.renderDelete(this.userEntityService.genLocalUserUri(user.id), user), user));
|
||||
|
||||
const queue: string[] = [];
|
||||
|
||||
const followings = await this.followingsRepository.find({
|
||||
where: [
|
||||
{ followerSharedInbox: Not(IsNull()) },
|
||||
{ followeeSharedInbox: Not(IsNull()) },
|
||||
],
|
||||
select: ['followerSharedInbox', 'followeeSharedInbox'],
|
||||
});
|
||||
|
||||
const inboxes = followings.map(x => x.followerSharedInbox ?? x.followeeSharedInbox);
|
||||
|
||||
for (const inbox of inboxes) {
|
||||
if (inbox != null && !queue.includes(inbox)) queue.push(inbox);
|
||||
}
|
||||
|
||||
for (const inbox of queue) {
|
||||
this.queueService.deliver(user as any, content, inbox, true);
|
||||
}
|
||||
const manager = this.apDeliverManagerService.createDeliverManager(user, content);
|
||||
manager.addAllKnowingSharedInboxRecipe();
|
||||
// process deliver時にはキーペアが消去されているはずなので、ここで挿入する
|
||||
const privateKey = await this.userKeypairService.getLocalUserPrivateKeyPem(user.id, 'main');
|
||||
manager.execute({ privateKey });
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -46,7 +46,7 @@ export class WebfingerService {
|
|||
const m = query.match(mRegex);
|
||||
if (m) {
|
||||
const hostname = m[2];
|
||||
const useHttp = process.env.MISSKEY_WEBFINGER_USE_HTTP && process.env.MISSKEY_WEBFINGER_USE_HTTP.toLowerCase() === 'true';
|
||||
const useHttp = process.env.MISSKEY_USE_HTTP && process.env.MISSKEY_USE_HTTP.toLowerCase() === 'true';
|
||||
return `http${useHttp ? '' : 's'}://${hostname}/.well-known/webfinger?${urlQuery({ resource: `acct:${query}` })}`;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
|
||||
import { Inject, Injectable, OnApplicationShutdown } from '@nestjs/common';
|
||||
import { DI } from '@/di-symbols.js';
|
||||
import type { NotesRepository, UserPublickeysRepository, UsersRepository } from '@/models/_.js';
|
||||
import type { MiUser, NotesRepository, UserPublickeysRepository, UsersRepository } from '@/models/_.js';
|
||||
import type { Config } from '@/config.js';
|
||||
import { MemoryKVCache } from '@/misc/cache.js';
|
||||
import type { MiUserPublickey } from '@/models/UserPublickey.js';
|
||||
|
|
@ -13,9 +13,12 @@ import { CacheService } from '@/core/CacheService.js';
|
|||
import type { MiNote } from '@/models/Note.js';
|
||||
import { bindThis } from '@/decorators.js';
|
||||
import { MiLocalUser, MiRemoteUser } from '@/models/User.js';
|
||||
import Logger from '@/logger.js';
|
||||
import { getApId } from './type.js';
|
||||
import { ApPersonService } from './models/ApPersonService.js';
|
||||
import { ApLoggerService } from './ApLoggerService.js';
|
||||
import type { IObject } from './type.js';
|
||||
import { UtilityService } from '../UtilityService.js';
|
||||
|
||||
export type UriParseResult = {
|
||||
/** wether the URI was generated by us */
|
||||
|
|
@ -35,8 +38,8 @@ export type UriParseResult = {
|
|||
|
||||
@Injectable()
|
||||
export class ApDbResolverService implements OnApplicationShutdown {
|
||||
private publicKeyCache: MemoryKVCache<MiUserPublickey | null>;
|
||||
private publicKeyByUserIdCache: MemoryKVCache<MiUserPublickey | null>;
|
||||
private publicKeyByUserIdCache: MemoryKVCache<MiUserPublickey[] | null>;
|
||||
private logger: Logger;
|
||||
|
||||
constructor(
|
||||
@Inject(DI.config)
|
||||
|
|
@ -53,9 +56,17 @@ export class ApDbResolverService implements OnApplicationShutdown {
|
|||
|
||||
private cacheService: CacheService,
|
||||
private apPersonService: ApPersonService,
|
||||
private apLoggerService: ApLoggerService,
|
||||
private utilityService: UtilityService,
|
||||
) {
|
||||
this.publicKeyCache = new MemoryKVCache<MiUserPublickey | null>(Infinity);
|
||||
this.publicKeyByUserIdCache = new MemoryKVCache<MiUserPublickey | null>(Infinity);
|
||||
this.publicKeyByUserIdCache = new MemoryKVCache<MiUserPublickey[] | null>(Infinity);
|
||||
this.logger = this.apLoggerService.logger.createSubLogger('db-resolver');
|
||||
}
|
||||
|
||||
private punyHost(url: string): string {
|
||||
const urlObj = new URL(url);
|
||||
const host = `${this.utilityService.toPuny(urlObj.hostname)}${urlObj.port.length > 0 ? ':' + urlObj.port : ''}`;
|
||||
return host;
|
||||
}
|
||||
|
||||
@bindThis
|
||||
|
|
@ -116,62 +127,141 @@ export class ApDbResolverService implements OnApplicationShutdown {
|
|||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* AP KeyId => Misskey User and Key
|
||||
*/
|
||||
@bindThis
|
||||
public async getAuthUserFromKeyId(keyId: string): Promise<{
|
||||
user: MiRemoteUser;
|
||||
key: MiUserPublickey;
|
||||
} | null> {
|
||||
const key = await this.publicKeyCache.fetch(keyId, async () => {
|
||||
const key = await this.userPublickeysRepository.findOneBy({
|
||||
keyId,
|
||||
});
|
||||
|
||||
if (key == null) return null;
|
||||
|
||||
return key;
|
||||
}, key => key != null);
|
||||
|
||||
if (key == null) return null;
|
||||
|
||||
const user = await this.cacheService.findUserById(key.userId).catch(() => null) as MiRemoteUser | null;
|
||||
if (user == null) return null;
|
||||
if (user.isDeleted) return null;
|
||||
|
||||
return {
|
||||
user,
|
||||
key,
|
||||
};
|
||||
private async refreshAndFindKey(userId: MiUser['id'], keyId: string): Promise<MiUserPublickey | null> {
|
||||
this.refreshCacheByUserId(userId);
|
||||
const keys = await this.getPublicKeyByUserId(userId);
|
||||
if (keys == null || !Array.isArray(keys) || keys.length === 0) {
|
||||
this.logger.warn(`No key found (refreshAndFindKey) userId=${userId} keyId=${keyId} keys=${JSON.stringify(keys)}`);
|
||||
return null;
|
||||
}
|
||||
const exactKey = keys.find(x => x.keyId === keyId);
|
||||
if (exactKey) return exactKey;
|
||||
this.logger.warn(`No exact key found (refreshAndFindKey) userId=${userId} keyId=${keyId} keys=${JSON.stringify(keys)}`);
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* AP Actor id => Misskey User and Key
|
||||
* @param uri AP Actor id
|
||||
* @param keyId Key id to find. If not specified, main key will be selected.
|
||||
* @returns
|
||||
* 1. `null` if the user and key host do not match
|
||||
* 2. `{ user: null, key: null }` if the user is not found
|
||||
* 3. `{ user: MiRemoteUser, key: null }` if key is not found
|
||||
* 4. `{ user: MiRemoteUser, key: MiUserPublickey }` if both are found
|
||||
*/
|
||||
@bindThis
|
||||
public async getAuthUserFromApId(uri: string): Promise<{
|
||||
public async getAuthUserFromApId(uri: string, keyId?: string): Promise<{
|
||||
user: MiRemoteUser;
|
||||
key: MiUserPublickey | null;
|
||||
} | null> {
|
||||
const user = await this.apPersonService.resolvePerson(uri) as MiRemoteUser;
|
||||
if (user.isDeleted) return null;
|
||||
} | {
|
||||
user: null;
|
||||
key: null;
|
||||
} |
|
||||
null> {
|
||||
if (keyId) {
|
||||
if (this.punyHost(uri) !== this.punyHost(keyId)) {
|
||||
/**
|
||||
* keyIdはURL形式かつkeyIdのホストはuriのホストと一致するはず
|
||||
* （ApPersonService.validateActorに由来）
|
||||
*
|
||||
* ただ、Mastodonはリプライ関連で他人のトゥートをHTTP Signature署名して送ってくることがある
|
||||
* そのような署名は有効性に疑問があるので無視することにする
|
||||
* ここではuriとkeyIdのホストが一致しない場合は無視する
|
||||
* ハッシュをなくしたkeyIdとuriの同一性を比べてみてもいいが、`uri#*-key`というkeyIdを設定するのが
|
||||
* 決まりごとというわけでもないため幅を持たせることにする
|
||||
*
|
||||
*
|
||||
* The keyId should be in URL format and its host should match the host of the uri
|
||||
* (derived from ApPersonService.validateActor)
|
||||
*
|
||||
* However, Mastodon sometimes sends toots from other users with HTTP Signature signing for reply-related purposes
|
||||
* Such signatures are of questionable validity, so we choose to ignore them
|
||||
* Here, we ignore cases where the hosts of uri and keyId do not match
|
||||
* We could also compare the equality of keyId without the hash and uri, but since setting a keyId like `uri#*-key`
|
||||
* is not a strict rule, we decide to allow for some flexibility
|
||||
*/
|
||||
this.logger.warn(`actor uri and keyId are not matched uri=${uri} keyId=${keyId}`);
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
const key = await this.publicKeyByUserIdCache.fetch(
|
||||
user.id,
|
||||
() => this.userPublickeysRepository.findOneBy({ userId: user.id }),
|
||||
const user = await this.apPersonService.resolvePerson(uri, undefined, true) as MiRemoteUser;
|
||||
if (user.isDeleted) return { user: null, key: null };
|
||||
|
||||
const keys = await this.getPublicKeyByUserId(user.id);
|
||||
|
||||
if (keys == null || !Array.isArray(keys) || keys.length === 0) {
|
||||
this.logger.warn(`No key found uri=${uri} userId=${user.id} keys=${JSON.stringify(keys)}`);
|
||||
return { user, key: null };
|
||||
}
|
||||
|
||||
if (!keyId) {
|
||||
// Choose the main-like
|
||||
const mainKey = keys.find(x => {
|
||||
try {
|
||||
const url = new URL(x.keyId);
|
||||
const path = url.pathname.split('/').pop()?.toLowerCase();
|
||||
if (url.hash) {
|
||||
if (url.hash.toLowerCase().includes('main')) {
|
||||
return true;
|
||||
}
|
||||
} else if (path?.includes('main') || path === 'publickey') {
|
||||
return true;
|
||||
}
|
||||
} catch { /* noop */ }
|
||||
|
||||
return false;
|
||||
});
|
||||
return { user, key: mainKey ?? keys[0] };
|
||||
}
|
||||