Merge pull request #435 from dahlia/refactor/remove-quote-verification-workarounds

Verify quotes with Fedify 2.5 APIs

Author: dahlia

federation/inbox/dispatch.test.ts

@@ -29,6 +29,82 @@ import {
 } from "./dispatch.ts";
 
 describe("transactional inbox dispatch", () => {
+  it("rejects redirected quote authorization IDs before accepting or persisting them", async () => {
+    await withRollback(async (tx) => {
+      const author = await insertRemoteActor(tx, {
+        username: "redirectedquoteowner",
+        name: "Redirected Quote Owner",
+        host: "remote.example",
+      });
+      const target = await insertRemotePost(tx, {
+        actorId: author.id,
+        contentHtml: "<p>Redirect target</p>",
+      });
+      const quoter = await insertAccountWithActor(tx, {
+        username: "redirectedquoter",
+        name: "Redirected Quoter",
+        email: "redirectedquoter@example.com",
+      });
+      const { post: quote } = await insertNotePost(tx, {
+        account: quoter.account,
+        content: "Pending quote",
+        quotedPostId: target.id,
+      });
+      const requestIri = new URL("#quote-request/redirect", quote.iri).href;
+      await tx.insert(quoteRequestTable).values({
+        id: generateUuidV7(),
+        iri: requestIri,
+        quotePostId: quote.id,
+        quotedPostId: target.id,
+      });
+      const expectedId = "https://remote.example/authorizations/expected";
+      const fetchedId = "https://remote.example/authorizations/different";
+      const authorization = new QuoteAuthorization({
+        id: new URL(fetchedId),
+        attribution: new URL(author.iri),
+        interactingObject: new URL(quote.iri),
+        interactionTarget: new URL(target.iri),
+      });
+      const accept = new Accept({
+        id: new URL("https://remote.example/accept"),
+        actor: new URL(author.iri),
+        object: new URL(requestIri),
+        result: new URL(expectedId),
+      });
+      const fedCtx = {
+        ...createFedCtx(tx),
+        async documentLoader(url: string) {
+          if (url === requestIri) throw new Error("Use the stored request");
+          assert.equal(url, expectedId);
+          return {
+            contextUrl: null,
+            documentUrl: fetchedId,
+            document: await authorization.toJsonLd(),
+          };
+        },
+        async sendActivity() {
+          assert.fail("An invalid authorization must not publish an update");
+        },
+      } as unknown as InboxContext<ContextData>;
+      await onAccepted(fedCtx, accept);
+      // The real getter cached the fetched ID; verification used the signed one.
+      assert.equal(accept.resultId?.href, fetchedId);
+      const storedQuote = await tx.query.postTable.findFirst({
+        where: { id: quote.id },
+      });
+      assert.equal(storedQuote?.quoteAuthorizationIri, null);
+      const request = await tx.query.quoteRequestTable.findFirst({
+        where: { iri: requestIri },
+      });
+      assert.equal(request?.accepted, null);
+      assert.equal(
+        await tx.query.quoteAuthorizationTable.findFirst({
+          where: { iri: fetchedId },
+        }),
+        undefined,
+      );
+    });
+  });
   it("accepts Mastodon quote approvals with an unresolvable request fragment", async () => {
     await withRollback(async (tx) => {
       const remoteActor = await insertRemoteActor(tx, {

federation/inbox/dispatch.ts

@@ -24,7 +24,8 @@ export async function onAccepted(
   fedCtx: InboxContext<ContextData>,
   accept: Accept,
 ): Promise<void> {
-  if (accept.resultId == null) {
+  const resultId = accept.resultId;
+  if (resultId == null) {
     const handledByIri = await withInboxTransaction(
       fedCtx,
       async (txCtx) =>
@@ -58,7 +59,9 @@ export async function onAccepted(
   ]);
 
   const handled = await withInboxTransaction(fedCtx, async (txCtx) => {
-    if (await onQuoteRequestAccepted(txCtx, accept, { object, result })) {
+    if (
+      await onQuoteRequestAccepted(txCtx, accept, { object, result, resultId })
+    ) {
       return true;
     }
     return await onRelayFollowAccepted(txCtx, accept);

federation/inbox/quote.test.ts

@@ -1521,6 +1521,7 @@ test("unknown quote approvals honor the state read after locking", async () => {
     await onQuoteRequestAccepted(fedCtx, accept, {
       object: request,
       result: authorization,
+      resultId: new URL(authorizationIri),
     }),
     true,
   );

federation/inbox/quote.ts

@@ -323,37 +323,28 @@ async function getValidQuoteRequestInstrument(
     instrument.id.origin !== request.actorId.origin
   )
     return;
-  // Preserve quoteUrl and multi-attribution compatibility while letting the
-  // helper validate the normalized request. The original object is persisted.
-  const matchingTarget = [instrument.quoteId, instrument.quoteUrl].find(
-    (id) => id?.href === request.objectId?.href,
-  );
-  const normalized = instrument.clone({
-    quote: matchingTarget ?? instrument.quoteId,
-    quoteUrl: matchingTarget ?? instrument.quoteUrl,
-    attributions: instrument.attributionIds.some(
-      (id) => id.href === request.actorId!.href,
-    )
-      ? [request.actorId]
-      : instrument.attributionIds,
-  });
   // The local target was resolved from the DB, including share wrappers;
-  // embed its requested ID so verification never fetches our own public URL.
+  // compare the instrument against the requested IRI, while authorizations
+  // continue to refer to the original post behind a share.
   const result = await quoteInteraction.verifyRequest(fedCtx, {
-    request: request.clone({
-      object: new Note({ id: request.objectId }),
-      instrument: normalized,
-    }),
+    request,
+    resolvedInteractionTarget: new Note({ id: request.objectId }),
+    resolvedInteractingObject: instrument,
+    quoteReference: "any",
+    attribution: "any",
+    missingAttribution: "reject",
   });
   return result.verified ? { instrument, instrumentIri } : undefined;
 }
 
 export async function onQuoteRequestAccepted(
   fedCtx: InboxContext<ContextData>,
   accept: Accept,
-  resolved?: Readonly<{ object: unknown; result: unknown }>,
+  resolved?: Readonly<{ object: unknown; result: unknown; resultId: URL }>,
 ): Promise<boolean> {
-  if (accept.actorId == null || accept.resultId == null) return false;
+  // Dereferencing result can replace the signed reference with a fetched ID.
+  const resultId = resolved?.resultId ?? accept.resultId;
+  if (accept.actorId == null || resultId == null) return false;
   let quoteRequestIri = accept.objectId?.href;
   if (quoteRequestIri != null) {
     quoteRequestIri = await resolveAcceptedQuoteRequestIri(
@@ -438,18 +429,26 @@ export async function onQuoteRequestAccepted(
   // Signed author approval permits authorization aliases on another origin.
   const validAuthorization =
     authorization instanceof QuoteAuthorization &&
-    authorization.id?.href === accept.resultId.href &&
-    authorization.interactingObjectId?.href === quote.iri &&
-    authorization.interactionTargetId?.href === quotedPost.iri &&
-    authorization.attributionId?.href === quotedPost.actor.iri;
+    (
+      await quoteInteraction.verifyAuthorization(fedCtx, {
+        authorization,
+        authorizationId: resultId,
+        interactingObject: new URL(quote.iri),
+        interactionTarget: new URL(quotedPost.iri),
+        attributedTo: new URL(quotedPost.actor.iri),
+        allowOffOrigin: true,
+        // The signed Accept's actor was checked against the target's owner.
+        verifyAuthenticity: () => true,
+      })
+    ).verified;
   if (!validAuthorization) {
     logger.warn("Ignoring invalid quote authorization: {iri}", {
-      iri: accept.resultId.href,
+      iri: resultId.href,
     });
     return true;
   }
   const accepted = new Date();
-  const resultIri = accept.resultId.href;
+  const resultIri = resultId.href;
   const shouldSendUpdate =
     quote.quoteAuthorizationIri !== resultIri ||
     quote.quotedPostId !== quotedPost.id;

federation/interaction-controls.test.ts

@@ -154,6 +154,7 @@ test("quote handler verifies compatible instruments without fetching local targe
     "wrong target",
     "wrong author",
     "cross-origin instrument",
+    "missing author",
   ]) {
     const requester = {
       id: "requester",
@@ -231,9 +232,11 @@ test("quote handler verifies compatible instruments without fetching local targe
           : "https://remote.example/quote",
       ),
       attributions:
-        variant === "multiple authors"
-          ? [other, new URL(requester.iri)]
-          : [variant === "wrong author" ? other : new URL(requester.iri)],
+        variant === "missing author"
+          ? []
+          : variant === "multiple authors"
+            ? [other, new URL(requester.iri)]
+            : [variant === "wrong author" ? other : new URL(requester.iri)],
       quote:
         variant === "quoteUrl"
           ? null
@@ -254,18 +257,40 @@ test("quote handler verifies compatible instruments without fetching local targe
         },
       });
     }
+    const request = new QuoteRequest({
+      id: new URL("https://remote.example/request"),
+      actor: new URL(requester.iri),
+      object: new URL(target.iri),
+      instrument:
+        variant === "redirected instrument"
+          ? new URL("https://remote.example/alias")
+          : instrument,
+    });
     await onQuoteRequested(
       raw as unknown as InboxContext<ContextData>,
-      new QuoteRequest({
-        id: new URL("https://remote.example/request"),
-        actor: new URL(requester.iri),
-        object: new URL(target.iri),
-        instrument:
-          variant === "redirected instrument"
-            ? new URL("https://remote.example/alias")
-            : instrument,
-      }),
+      request,
+    );
+    assert.equal(request.id?.href, "https://remote.example/request");
+    assert.equal(request.actorId?.href, requester.iri);
+    assert.equal(request.objectId?.href, target.iri);
+    assert.equal(
+      instrument.quoteUrl?.href,
+      variant === "wrong target" ? other.href : target.iri,
     );
+    assert.equal(
+      instrument.quoteId?.href,
+      variant === "quoteUrl"
+        ? undefined
+        : variant === "conflicting quote" || variant === "wrong target"
+          ? other.href
+          : target.iri,
+    );
+    if (variant === "multiple authors") {
+      assert.deepEqual(
+        instrument.attributionIds.map((id) => id.href),
+        [other.href, requester.iri],
+      );
+    }
     const allowed = [
       "quoteUrl",
       "conflicting quote",
@@ -284,3 +309,103 @@ test("quote handler verifies compatible instruments without fetching local targe
     }
   }
 });
+
+test("stored authorization helper requires DB evidence and exact bindings for aliases", async () => {
+  const ctx = createContext();
+  const id = new URL("https://alias.example/authorization");
+  const author = new URL("https://author.example/actor");
+  const quote = new URL("https://quoter.example/quote");
+  const target = new URL("https://author.example/post");
+  const other = new URL("https://other.example/object");
+  for (const variant of [
+    "valid",
+    "no evidence",
+    "idless",
+    "wrong ID",
+    "wrong quote",
+    "wrong target",
+    "wrong author",
+  ]) {
+    const authorization = new QuoteAuthorization({
+      id: variant === "idless" ? null : variant === "wrong ID" ? other : id,
+      attribution: variant === "wrong author" ? other : author,
+      interactingObject: variant === "wrong quote" ? other : quote,
+      interactionTarget: variant === "wrong target" ? other : target,
+    });
+    assert.equal(
+      await federationServices.verifyStoredQuoteAuthorization(
+        ctx,
+        authorization,
+        {
+          authorizationId: id,
+          interactingObject: quote,
+          interactionTarget: target,
+          attributedTo: author,
+          authentic: variant !== "no evidence",
+        },
+      ),
+      variant === "valid",
+      variant,
+    );
+  }
+});
+
+test("authorization verification separates document/context loaders with a default context fallback", async () => {
+  const ctx = createContext();
+  const id = new URL("https://author.example/authorization");
+  const author = new URL("https://author.example/actor");
+  const quote = new URL("https://quoter.example/quote");
+  const target = new URL("https://author.example/post");
+  const authorization = new QuoteAuthorization({
+    id,
+    attribution: author,
+    interactingObject: quote,
+    interactionTarget: target,
+  });
+  const document = await authorization.toJsonLd();
+  assert.ok(
+    document != null && typeof document === "object" && "@context" in document,
+  );
+  for (const separate of [false, true]) {
+    const contextUrl = "https://contexts.example/custom";
+    const contexts: string[] = [];
+    const documents: string[] = [];
+    assert.equal(
+      await federationServices.verifyQuoteAuthorization(
+        ctx,
+        id,
+        quote,
+        target,
+        author,
+        async (url) => {
+          documents.push(url);
+          assert.equal(url, id.href);
+          return {
+            document: separate
+              ? { ...document, "@context": contextUrl }
+              : document,
+            documentUrl: url,
+            contextUrl: null,
+          };
+        },
+        separate
+          ? async (url) => {
+              contexts.push(url);
+              if (url === contextUrl) {
+                return {
+                  document: { "@context": document["@context"] },
+                  documentUrl: url,
+                  contextUrl: null,
+                };
+              }
+              return ctx.contextLoader(url);
+            }
+          : undefined,
+      ),
+      true,
+    );
+    assert.deepEqual(documents, [id.href]);
+    if (separate) assert.ok(contexts.includes(contextUrl));
+    else assert.deepEqual(contexts, []);
+  }
+});

federation/services.ts

@@ -47,10 +47,21 @@ export const federationServices: FederationServices<ApplicationContext> = {
         interactingObject,
         interactionTarget,
         attributedTo,
-        documentLoader: (url) =>
-          url === authorization.href
-            ? documentLoader(url)
-            : (contextLoader ?? getDocumentLoader())(url),
+        documentLoader,
+        contextLoader: contextLoader ?? getDocumentLoader(),
+      })
+    ).verified,
+  verifyStoredQuoteAuthorization: async (context, authorization, options) =>
+    (
+      await quoteInteraction.verifyAuthorization(getFedifyContext(context), {
+        authorization,
+        authorizationId: options.authorizationId,
+        interactingObject: options.interactingObject,
+        interactionTarget: options.interactionTarget,
+        attributedTo: options.attributedTo,
+        // Stored, unrevoked grants authenticate aliases independently of origin.
+        allowOffOrigin: true,
+        verifyAuthenticity: () => options.authentic,
       })
     ).verified,
   subscribeTagsPubHashtag: (context, tag) =>