1/* snac - A simple, minimalistic ActivityPub instance */
  2/* copyright (c) 2022 - 2025 grunfink et al. / MIT license */
  3
  4#include "xs.h"
  5#include "xs_json.h"
  6#include "xs_curl.h"
  7#include "xs_mime.h"
  8
  9#include "snac.h"
 10
 11int webfinger_request_signed(snac *snac, const char *qs, xs_str **actor, xs_str **user)
 12/* queries the webfinger for qs and fills the required fields */
 13{
 14    int status;
 15    xs *payload = NULL;
 16    int p_size = 0;
 17    xs *headers = xs_dict_new();
 18    xs *l = NULL;
 19    const char *host = NULL;
 20    xs *resource = NULL;
 21
 22    if (xs_startswith(qs, "https:/") || xs_startswith(qs, "http:/")) {
 23        /* actor query: pick the host */
 24        xs *s1 = xs_replace_n(qs, "http:/" "/", "", 1);
 25        xs *s = xs_replace_n(s1, "https:/" "/", "", 1);
 26
 27        l = xs_split_n(s, "/", 1);
 28
 29        host     = xs_list_get(l, 0);
 30        resource = xs_dup(qs);
 31    }
 32    else {
 33        /* it's a user */
 34        xs *s = xs_strip_chars_i(xs_dup(qs), "@.");
 35
 36        l = xs_split_n(s, "@", 1);
 37
 38        if (xs_list_len(l) == 2) {
 39            host     = xs_list_get(l, 1);
 40            resource = xs_fmt("acct:%s", s);
 41        }
 42    }
 43
 44    if (host == NULL || resource == NULL)
 45        return HTTP_STATUS_BAD_REQUEST;
 46
 47    headers = xs_dict_append(headers, "accept",     "application/json");
 48    headers = xs_dict_append(headers, "user-agent", USER_AGENT);
 49
 50    xs *obj = NULL;
 51
 52    xs *cached_qs = xs_fmt("webfinger:%s", qs);
 53
 54    /* is it cached? */
 55    if (valid_status(status = object_get(cached_qs, &obj))) {
 56        /* nothing more to do */
 57    }
 58    else
 59    /* is it a query about one of us? */
 60    if (strcmp(host, xs_dict_get(srv_config, "host")) == 0) {
 61        /* route internally */
 62        xs *req    = xs_dict_new();
 63        xs *q_vars = xs_dict_new();
 64        char *ctype;
 65
 66        q_vars = xs_dict_append(q_vars, "resource", resource);
 67        req    = xs_dict_append(req, "q_vars", q_vars);
 68
 69        status = webfinger_get_handler(req, "/.well-known/webfinger",
 70                                       &payload, &p_size, &ctype);
 71    }
 72    else {
 73        const char *proto = xs_dict_get_def(srv_config, "protocol", "https");
 74
 75        xs *url = xs_fmt("%s:/" "/%s/.well-known/webfinger?resource=%s", proto, host, resource);
 76
 77        if (snac == NULL)
 78            xs_http_request("GET", url, headers, NULL, 0, &status, &payload, &p_size, 0);
 79        else
 80            http_signed_request(snac, "GET", url, headers, NULL, 0, &status, &payload, &p_size, 0);
 81    }
 82
 83    if (obj == NULL && valid_status(status) && payload) {
 84        obj = xs_json_loads(payload);
 85
 86        if (obj)
 87            object_add(cached_qs, obj);
 88        else
 89            status = HTTP_STATUS_BAD_REQUEST;
 90    }
 91
 92    if (obj) {
 93        if (user != NULL) {
 94            const char *subject = xs_dict_get(obj, "subject");
 95
 96            if (subject)
 97                *user = xs_replace_n(subject, "acct:", "", 1);
 98        }
 99
100        if (actor != NULL) {
101            const xs_list *list = xs_dict_get(obj, "links");
102            int c = 0;
103            const char *v;
104
105            while (xs_list_next(list, &v, &c)) {
106                if (xs_type(v) == XSTYPE_DICT) {
107                    const char *type = xs_dict_get(v, "type");
108
109                    if (type && (strcmp(type, "application/activity+json") == 0 ||
110                                 strcmp(type, "application/ld+json; profile=\"https:/"
111                                    "/www.w3.org/ns/activitystreams\"") == 0)) {
112                        *actor = xs_dup(xs_dict_get(v, "href"));
113                        break;
114                    }
115                }
116            }
117        }
118    }
119
120    return status;
121}
122
123
124int webfinger_request(const char *qs, xs_str **actor, xs_str **user)
125/* queries the webfinger for qs and fills the required fields */
126{
127    return webfinger_request_signed(NULL, qs, actor, user);
128}
129
130
131int webfinger_request_fake(const char *qs, xs_str **actor, xs_str **user)
132/* queries the webfinger and, if it fails, a user is faked if possible */
133{
134    int status;
135
136    if (!valid_status(status = webfinger_request(qs, actor, user))) {
137        if (xs_startswith(qs, "https:/") || xs_startswith(qs, "http:/")) {
138            xs *l = xs_split(qs, "/");
139
140            if (xs_list_len(l) > 3) {
141                srv_debug(1, xs_fmt("webfinger error querying %s %d -- faking it", qs, status));
142
143                /* i'll end up in hell for this */
144                *user = xs_fmt("%s@%s", xs_list_get(l, -1), xs_list_get(l, 2));
145                status = HTTP_STATUS_RESET_CONTENT;
146
147            }
148        }
149    }
150
151    return status;
152}
153
154
155int webfinger_get_handler(xs_dict *req, const char *q_path,
156                           xs_val **body, int *b_size, char **ctype)
157/* serves webfinger queries */
158{
159    int status;
160
161    (void)b_size;
162
163    if (strcmp(q_path, "/.well-known/webfinger") != 0)
164        return 0;
165
166    const char *q_vars   = xs_dict_get(req, "q_vars");
167    const char *resource = xs_dict_get(q_vars, "resource");
168
169    if (resource == NULL)
170        return HTTP_STATUS_BAD_REQUEST;
171
172    snac snac;
173    int found = 0;
174
175    if (xs_startswith(resource, "https:/") || xs_startswith(resource, "http:/")) {
176        /* actor search: find a user with this actor */
177        xs *l = xs_split(resource, "/");
178        const char *uid = xs_list_get(l, -1);
179
180        if (uid)
181            found = user_open(&snac, uid);
182    }
183    else
184    if (xs_startswith(resource, "acct:")) {
185        /* it's an account name */
186        xs *an = xs_replace_n(resource, "acct:", "", 1);
187        xs *l = NULL;
188
189        /* strip a possible leading @ */
190        if (xs_startswith(an, "@"))
191            an = xs_crop_i(an, 1, 0);
192
193        l = xs_split_n(an, "@", 1);
194
195        if (xs_list_len(l) == 2) {
196            const char *uid  = xs_list_get(l, 0);
197            const char *host = xs_list_get(l, 1);
198
199            if (strcmp(host, xs_dict_get(srv_config, "host")) == 0)
200                found = user_open(&snac, uid);
201        }
202    }
203
204    if (found) {
205        /* build the object */
206        xs *acct;
207        xs *aaj   = xs_dict_new();
208        xs *prof  = xs_dict_new();
209        xs *links = xs_list_new();
210        xs *obj   = xs_dict_new();
211
212        acct = xs_fmt("acct:%s@%s",
213            xs_dict_get(snac.config, "uid"), xs_dict_get(srv_config, "host"));
214
215        aaj = xs_dict_append(aaj, "rel",  "self");
216        aaj = xs_dict_append(aaj, "type", "application/activity+json");
217        aaj = xs_dict_append(aaj, "href", snac.actor);
218
219        links = xs_list_append(links, aaj);
220
221        /* duplicate with the ld+json type */
222        aaj = xs_dict_set(aaj, "type", "application/ld+json; profile=\"https:/"
223                                    "/www.w3.org/ns/activitystreams\"");
224
225        links = xs_list_append(links, aaj);
226
227        prof = xs_dict_append(prof, "rel", "http://webfinger.net/rel/profile-page");
228        prof = xs_dict_append(prof, "type", "text/html");
229        prof = xs_dict_append(prof, "href", snac.actor);
230
231        links = xs_list_append(links, prof);
232
233        const char *avatar = xs_dict_get(snac.config, "avatar");
234        if (!xs_is_null(avatar) && *avatar) {
235            xs *d = xs_dict_new();
236
237            d = xs_dict_append(d, "rel",  "http:/" "/webfinger.net/rel/avatar");
238            d = xs_dict_append(d, "type", xs_mime_by_ext(avatar));
239            d = xs_dict_append(d, "href", avatar);
240
241            links = xs_list_append(links, d);
242        }
243
244        obj = xs_dict_append(obj, "subject", acct);
245        obj = xs_dict_append(obj, "links",   links);
246
247        xs_str *j = xs_json_dumps(obj, 4);
248
249        user_free(&snac);
250
251        status = HTTP_STATUS_OK;
252        *body  = j;
253        *ctype = "application/jrd+json";
254    }
255    else
256        status = HTTP_STATUS_NOT_FOUND;
257
258    srv_debug(1, xs_fmt("webfinger_get_handler resource=%s %d", resource, status));
259
260    return status;
261}