1/* snac - A simple, minimalistic ActivityPub instance */
  2/* copyright (c) 2022 - 2026 grunfink et al. / MIT license */
  3
  4#include "xs.h"
  5#include "xs_json.h"
  6#include "xs_curl.h"
  7#include "xs_mime.h"
  8#include "xs_http.h"
  9
 10#include "snac.h"
 11
 12int webfinger_request_signed(snac *snac, const char *qs, xs_str **actor, xs_str **user)
 13/* queries the webfinger for qs and fills the required fields */
 14{
 15    int status;
 16    xs *payload = NULL;
 17    int p_size = 0;
 18    xs *headers = xs_dict_new();
 19    xs *l = NULL;
 20    const char *host = NULL;
 21    xs *resource = NULL;
 22
 23    if (xs_startswith(qs, "https:/") || xs_startswith(qs, "http:/")) {
 24        /* actor query: pick the host */
 25        xs *s1 = xs_replace_n(qs, "http:/" "/", "", 1);
 26        xs *s = xs_replace_n(s1, "https:/" "/", "", 1);
 27
 28        l = xs_split_n(s, "/", 1);
 29
 30        host     = xs_list_get(l, 0);
 31        resource = xs_dup(qs);
 32    }
 33    else {
 34        /* it's a user */
 35        xs *s = xs_strip_chars_i(xs_dup(qs), "@.");
 36
 37        l = xs_split_n(s, "@", 1);
 38
 39        if (xs_list_len(l) == 2) {
 40            host     = xs_list_get(l, 1);
 41            resource = xs_fmt("acct:%s", s);
 42        }
 43    }
 44
 45    if (host == NULL || resource == NULL)
 46        return HTTP_STATUS_BAD_REQUEST;
 47
 48    headers = xs_dict_append(headers, "accept",     "application/json");
 49    headers = xs_dict_append(headers, "user-agent", USER_AGENT);
 50
 51    xs *obj = NULL;
 52
 53    xs *cached_qs = xs_fmt("webfinger:%s", qs);
 54
 55    /* is it cached? */
 56    if (valid_status(status = object_get(cached_qs, &obj))) {
 57        /* nothing more to do */
 58    }
 59    else
 60    /* is it a query about one of us? */
 61    if (strcmp(host, xs_dict_get(srv_config, "host")) == 0) {
 62        /* route internally */
 63        xs *req    = xs_dict_new();
 64        xs *q_vars = xs_dict_new();
 65        char *ctype;
 66
 67        q_vars = xs_dict_append(q_vars, "resource", resource);
 68        req    = xs_dict_append(req, "q_vars", q_vars);
 69
 70        status = webfinger_get_handler(req, "/.well-known/webfinger",
 71                                       &payload, &p_size, &ctype);
 72    }
 73    else {
 74        const char *proto = xs_dict_get_def(srv_config, "protocol", "https");
 75
 76        xs *url = xs_fmt("%s:/" "/%s/.well-known/webfinger?resource=%s", proto, host, resource);
 77
 78        if (snac == NULL)
 79            xs_free(xs_http_request("GET", url, headers, NULL, 0, &status, &payload, &p_size, 0));
 80        else
 81            xs_free(http_signed_request(snac, "GET", url, headers, NULL, 0, &status, &payload, &p_size, 0));
 82    }
 83
 84    if (obj == NULL && valid_status(status) && payload) {
 85        obj = xs_json_loads(payload);
 86
 87        if (obj)
 88            object_add(cached_qs, obj);
 89        else
 90            status = HTTP_STATUS_BAD_REQUEST;
 91    }
 92
 93    if (obj) {
 94        if (user != NULL) {
 95            const char *subject = xs_dict_get(obj, "subject");
 96
 97            if (subject && xs_startswith(subject, "acct:"))
 98                *user = xs_replace_n(subject, "acct:", "", 1);
 99            else {
100                /* subject not an 'acct:': try in the aliases
101                   (i.e. hubzilla does this) */
102                const xs_list *aliases = xs_dict_get(obj, "aliases");
103
104                if (xs_is_list(aliases)) {
105                    const char *v;
106
107                    xs_list_foreach(aliases, v) {
108                        if (xs_startswith(v, "acct:") && xs_endswith(v, host)) {
109                            *user = xs_replace_n(v, "acct:", "", 1);
110                            break;
111                        }
112                    }
113                }
114            }
115        }
116
117        if (actor != NULL) {
118            const xs_list *list = xs_dict_get(obj, "links");
119            int c = 0;
120            const char *v;
121
122            while (xs_list_next(list, &v, &c)) {
123                if (xs_type(v) == XSTYPE_DICT) {
124                    const char *type = xs_dict_get(v, "type");
125
126                    if (type && (strcmp(type, "application/activity+json") == 0 ||
127                                 strcmp(type, "application/ld+json; profile=\"https:/"
128                                    "/www.w3.org/ns/activitystreams\"") == 0)) {
129                        *actor = xs_dup(xs_dict_get(v, "href"));
130                        break;
131                    }
132                }
133            }
134        }
135    }
136
137    return status;
138}
139
140
141int webfinger_request(const char *qs, xs_str **actor, xs_str **user)
142/* queries the webfinger for qs and fills the required fields */
143{
144    return webfinger_request_signed(NULL, qs, actor, user);
145}
146
147
148int webfinger_request_fake(const char *qs, xs_str **actor, xs_str **user)
149/* queries the webfinger and, if it fails, a user is faked if possible */
150{
151    int status;
152
153    if (!valid_status(status = webfinger_request(qs, actor, user))) {
154        if (xs_startswith(qs, "https:/") || xs_startswith(qs, "http:/")) {
155            xs *l = xs_split(qs, "/");
156
157            if (xs_list_len(l) > 3) {
158                srv_debug(1, xs_fmt("webfinger error querying %s %d -- faking it", qs, status));
159
160                /* i'll end up in hell for this */
161                *user = xs_fmt("%s@%s", xs_list_get(l, -1), xs_list_get(l, 2));
162                status = HTTP_STATUS_RESET_CONTENT;
163
164            }
165        }
166    }
167
168    return status;
169}
170
171
172int webfinger_get_handler(const xs_dict *req, const char *q_path,
173                           xs_val **body, int *b_size, char **ctype)
174/* serves webfinger queries */
175{
176    int status;
177
178    (void)b_size;
179
180    if (strcmp(q_path, "/.well-known/webfinger") != 0)
181        return 0;
182
183    const char *q_vars   = xs_dict_get(req, "q_vars");
184    const char *resource = xs_dict_get(q_vars, "resource");
185
186    if (resource == NULL)
187        return HTTP_STATUS_BAD_REQUEST;
188
189    snac snac;
190    int found = 0;
191
192    if (xs_startswith(resource, "https:/") || xs_startswith(resource, "http:/")) {
193        /* actor search: find a user with this actor */
194        xs *l = xs_split(resource, "/");
195        const char *uid = xs_list_get(l, -1);
196
197        if (uid)
198            found = user_open(&snac, uid);
199    }
200    else
201    {
202        xs *an = xs_fmt("%s", resource);
203        xs *l = NULL;
204
205        if (xs_startswith(resource, "acct:")) {
206            /* it's an account name */
207            an = xs_replace_n(resource, "acct:", "", 1);
208        }
209
210        /* strip a possible leading @ */
211        if (xs_startswith(an, "@"))
212            an = xs_crop_i(an, 1, 0);
213
214        l = xs_split_n(an, "@", 1);
215
216        if (xs_list_len(l) == 2) {
217            const char *uid  = xs_list_get(l, 0);
218            const char *host = xs_list_get(l, 1);
219
220            if (strcmp(host, xs_dict_get(srv_config, "host")) == 0)
221                found = user_open(&snac, uid);
222        }
223    }
224
225    if (found) {
226        /* build the object */
227        xs *acct;
228        xs *aaj     = xs_dict_new();
229        xs *prof    = xs_dict_new();
230        xs *links   = xs_list_new();
231        xs *aliases = xs_list_new();
232        xs *obj     = xs_dict_new();
233
234        acct = xs_fmt("acct:%s@%s",
235            xs_dict_get(snac.config, "uid"), xs_dict_get(srv_config, "host"));
236
237        aaj = xs_dict_append(aaj, "rel",  "self");
238        aaj = xs_dict_append(aaj, "type", "application/activity+json");
239        aaj = xs_dict_append(aaj, "href", snac.actor);
240
241        links = xs_list_append(links, aaj);
242
243        /* duplicate with the ld+json type */
244        aaj = xs_dict_set(aaj, "type", "application/ld+json; profile=\"https:/"
245                                    "/www.w3.org/ns/activitystreams\"");
246
247        links = xs_list_append(links, aaj);
248
249        prof = xs_dict_append(prof, "rel", "http://webfinger.net/rel/profile-page");
250        prof = xs_dict_append(prof, "type", "text/html");
251        prof = xs_dict_append(prof, "href", snac.actor);
252
253        links = xs_list_append(links, prof);
254
255        const char *avatar = xs_dict_get(snac.config, "avatar");
256        if (!xs_is_null(avatar) && *avatar) {
257            xs *d = xs_dict_new();
258
259            d = xs_dict_append(d, "rel",  "http:/" "/webfinger.net/rel/avatar");
260            d = xs_dict_append(d, "type", xs_mime_by_ext(avatar));
261            d = xs_dict_append(d, "href", avatar);
262
263            links = xs_list_append(links, d);
264        }
265
266        {
267            xs *d = xs_dict_new();
268            xs *t = xs_fmt("https:/""/%s/authorize_interaction?uri={uri}", xs_dict_get(srv_config, "host"));
269
270            d = xs_dict_set(d, "rel", "http://ostatus.org/schema/1.0/subscribe");
271            d = xs_dict_set(d, "template", t);
272
273            links = xs_list_append(links, d);
274        }
275
276        {
277            xs *d = xs_dict_new();
278            xs *t = xs_fmt("https:/""/%s/share?text={content}", xs_dict_get(srv_config, "host"));
279
280            d = xs_dict_set(d, "rel", "https://w3id.org/fep/3b86/Create");
281            d = xs_dict_set(d, "template", t);
282
283            links = xs_list_append(links, d);
284        }
285
286        {
287            xs *d = xs_dict_new();
288            xs *t = xs_fmt("https:/""/%s/authorize_interaction?uri={object}", xs_dict_get(srv_config, "host"));
289
290            d = xs_dict_set(d, "rel", "https://w3id.org/fep/3b86/Object");
291            d = xs_dict_set(d, "template", t);
292
293            links = xs_list_append(links, d);
294        }
295
296        aliases = xs_list_append(aliases, snac.actor);
297        aliases = xs_list_append(aliases, snac.actor_alt);
298
299        obj = xs_dict_append(obj, "aliases", aliases);
300
301        obj = xs_dict_append(obj, "subject", acct);
302        obj = xs_dict_append(obj, "links",   links);
303
304        xs_str *j = xs_json_dumps(obj, 4);
305
306        user_free(&snac);
307
308        status = HTTP_STATUS_OK;
309        *body  = j;
310        *ctype = "application/jrd+json";
311    }
312    else
313        status = HTTP_STATUS_NOT_FOUND;
314
315    srv_debug(1, xs_fmt("webfinger_get_handler resource=%s %d", resource, status));
316
317    return status;
318}