mastodon

Commit Graph

Author	SHA1	Message	Date
Akihiko Odaki	63f0979799	Validate id of ActivityPub representations (#5114 ) Additionally, ActivityPub::FetchRemoteStatusService no longer parses activities. OStatus::Activity::Creation no longer delegates to ActivityPub because the provided ActivityPub representations are not signed while OStatus representations are.	7 years ago
Eugen Rochko	76f360c625	If HTTP signature is wrong and webfinger cache is stale, retry with resolve (#5129 ) If the signature could not be verified and the webfinger of the account was last retrieved longer than the cache period, try re-resolving the account and then attempting to verify the signature again	7 years ago
unarist	1eab53ee10	Fix an error when actor json couldn't be fetched in ResolveRemoteAccountService (#4979 ) * Fix an error when actor json couldn't be fetched in ResolveRemoteAccountService * Add specs	7 years ago
ThibG	af00220d79	Fix refollowing (#4931 ) * Make RefollowWorker ActivityPub-only to avoid potential identifier mismatches * Don't call RefollowWorker on new accounts	8 years ago
ThibG	f29918e707	[WiP] Whenever a remote keypair changes, unfollow them and re-subscribe to … (#4907 ) * Whenever a remote keypair changes, unfollow them and re-subscribe to them In Mastodon (it could be different for other OStatus or AP-enabled software), a keypair change is indicative of whole user (or instance) data loss. In this situation, the “new” user might be different, and almost certainly has an empty followers list. In this case, Mastodon instances will disagree on follower lists, leading to unreliable delivery and “shadow followers”, that is users believed by a remote instance to be followers, without the affected user knowing. Drawbacks of this change are: 1. If an user legitimately changes public key for some reason without losing data (not possible in Mastodon at the moment), they will have their remote followers unsubscribed/re-subscribed needlessly. 2. Depending of the number of remote followers, this may generate quite some traffic. 3. If the user change is an attempt at usurpation, the remote followers will unknowingly follow the usurper. Note that this is not a change of behavior, Mastodon already behaves like that, although delivery might be unreliable, and the usurper would not have known the former user's followers. * Rename ResubscribeWorker to RefollowWorker * Process followers in batches	8 years ago
Eugen Rochko	26d26644ac	Require "inbox" to be set on actor to be ActivityPub-ready (#4595 )	8 years ago
Eugen Rochko	dd7ef0dc41	Add ActivityPub inbox (#4216 ) * Add ActivityPub inbox * Handle ActivityPub deletes * Handle ActivityPub creates * Handle ActivityPub announces * Stubs for handling all activities that need to be handled * Add ActivityPub actor resolving * Handle conversation URI passing in ActivityPub * Handle content language in ActivityPub * Send accept header when fetching actor, handle JSON parse errors * Test for ActivityPub::FetchRemoteAccountService * Handle public key and icon/image when embedded/as array/as resolvable URI * Implement ActivityPub::FetchRemoteStatusService * Add stubs for more interactions * Undo activities implemented * Handle out of order activities * Hook up ActivityPub to ResolveRemoteAccountService, handle Update Account activities * Add fragment IDs to all transient activity serializers * Add tests and fixes * Add stubs for missing tests * Add more tests * Add more tests	8 years ago
Eugen Rochko	1fcdaafa6f	Fix webfinger retries (#4275 ) * Do not raise unretryable exceptions in ResolveRemoteAccountService * Removed fatal exceptions from ResolveRemoteAccountService Exceptions that cannot be retried should not be raised. New exception class for those that can be retried (Mastodon::UnexpectedResponseError)	8 years ago
Eugen Rochko	8400bee3b1	Refactor ResolveRemoteAccountService (#4258 ) * Refactor ResolveRemoteAccountService * Remove trailing whitespace * Use redis locks around critical ResolveRemoteAccountService code * Add test for race condition of lock	8 years ago
Eugen Rochko	1618b68bfa	HTTP signatures (#4146 ) * Add Request class with HTTP signature generator Spec: https://tools.ietf.org/html/draft-cavage-http-signatures-06 * Add HTTP signature verification concern * Add test for SignatureVerification concern * Add basic test for Request class * Make PuSH subscribe/unsubscribe requests use new Request class Accidentally fix lease_seconds not being set and sent properly, and change the new minimum subscription duration to 1 day * Make all PuSH workers use new Request class * Make Salmon sender use new Request class * Make FetchLinkService use new Request class * Make FetchAtomService use the new Request class * Make Remotable use the new Request class * Make ResolveRemoteAccountService use the new Request class * Add more tests * Allow +-30 seconds window for signed request to remain valid * Disable time window validation for signed requests, restore 7 days as PuSH subscription duration (which was previous default due to a bug)	8 years ago
Eugen Rochko	f3be605286	Rename FollowRemoteAccountService to ResolveRemoteAccountService (#3847 ) Rename Activitypub to ActivityPub	8 years ago

11 Commits (402da46ff611b1a23af07ef0109147d62bf3b9ff)