fix: Sign get actor, fix executeRelayActivity

Author: yukimochi

api/decode.go

@@ -23,7 +23,10 @@ func decodeActivity(request *http.Request) (*models.Activity, *models.Actor, []b
 		return nil, nil, nil, err
 	}
 	KeyID := verifier.KeyId()
-	keyOwnerActor, err := models.NewActivityPubActorFromRemoteActor(KeyID, fmt.Sprintf("%s (golang net/http; Activity-Relay %s; %s)", GlobalConfig.ServerServiceName(), version, GlobalConfig.ServerHostname().Host), ActorCache)
+	relayKeyID := RelayActor.PublicKey.ID
+	relayPrivateKey := GlobalConfig.ActorKey()
+	uaString := fmt.Sprintf("%s (golang net/http; Activity-Relay %s; %s)", GlobalConfig.ServerServiceName(), version, GlobalConfig.ServerHostname().Host)
+	keyOwnerActor, err := models.NewActivityPubActorFromRemoteActor(KeyID, uaString, ActorCache, relayKeyID, relayPrivateKey)
 	if err != nil {
 		return nil, nil, nil, err
 	}
@@ -56,7 +59,7 @@ func decodeActivity(request *http.Request) (*models.Activity, *models.Actor, []b
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	remoteActor, err := models.NewActivityPubActorFromRemoteActor(activity.Actor, fmt.Sprintf("%s (golang net/http; Activity-Relay %s; %s)", GlobalConfig.ServerServiceName(), version, GlobalConfig.ServerHostname().Host), ActorCache)
+	remoteActor, err := models.NewActivityPubActorFromRemoteActor(activity.Actor, uaString, ActorCache, relayKeyID, relayPrivateKey)
 	if err != nil {
 		return nil, nil, nil, err
 	}
@@ -69,7 +72,7 @@ func fetchOriginalActivityFromURL(url string) (*models.Activity, *models.Actor,
 	if err != nil {
 		return nil, nil, err
 	}
-	remoteActor, err := models.NewActivityPubActorFromRemoteActor(remoteActivity.Actor, fmt.Sprintf("%s (golang net/http; Activity-Relay %s; %s)", GlobalConfig.ServerServiceName(), version, GlobalConfig.ServerHostname().Host), ActorCache)
+	remoteActor, err := models.NewActivityPubActorFromRemoteActor(remoteActivity.Actor, fmt.Sprintf("%s (golang net/http; Activity-Relay %s; %s)", GlobalConfig.ServerServiceName(), version, GlobalConfig.ServerHostname().Host), ActorCache, RelayActor.PublicKey.ID, GlobalConfig.ActorKey())
 	if err != nil {
 		return &remoteActivity, nil, err
 	}

api/resolver.go

@@ -331,7 +331,7 @@ func executeRejectRequest(activity *models.Activity, actor *models.Actor, err er
 
 func executeRelayActivity(activity *models.Activity, actor *models.Actor, body []byte) error {
 	actorID, _ := url.Parse(actor.ID)
-	if !isActorSubscribed(actorID) {
+	if !isActorSubscribersOrFollowers(actorID) {
 		err := errors.New("to use the relay service, please follow in advance")
 		return err
 	}

models/models.go

@@ -1,17 +1,35 @@
 package models
 
 import (
+	"crypto/rsa"
 	"encoding/json"
 	"errors"
 	"io"
 	"net/http"
 	"net/url"
 	"time"
 
+	"github.com/go-fed/httpsig"
 	"github.com/google/uuid"
 	"github.com/patrickmn/go-cache"
 )
 
+func signGETRequest(req *http.Request, keyID string, privateKey *rsa.PrivateKey) error {
+	req.Header.Set("Host", req.URL.Host)
+	req.Header.Set("Date", time.Now().UTC().Format("Mon, 02 Jan 2006 15:04:05")+" GMT")
+	signer, _, err := httpsig.NewSigner(
+		[]httpsig.Algorithm{httpsig.RSA_SHA256},
+		httpsig.DigestSha256,
+		[]string{httpsig.RequestTarget, "Host", "Date"},
+		httpsig.Signature,
+		60*60,
+	)
+	if err != nil {
+		return err
+	}
+	return signer.SignRequest(privateKey, keyID, req, nil)
+}
+
 // PublicKey : Activity Certificate.
 type PublicKey struct {
 	ID           string `json:"id,omitempty"`
@@ -85,7 +103,10 @@ func NewActivityPubActorFromRelayConfig(globalConfig *RelayConfig) Actor {
 }
 
 // NewActivityPubActorFromRemoteActor : Retrieve Actor from remote instance.
-func NewActivityPubActorFromRemoteActor(url string, uaString string, cache *cache.Cache) (Actor, error) {
+// When keyID and privateKey are provided, the GET request is signed with
+// HTTP Signature so that instances requiring authenticated fetch (e.g.
+// GoToSocial) respond with 200 instead of 401.
+func NewActivityPubActorFromRemoteActor(url string, uaString string, cache *cache.Cache, keyID string, privateKey *rsa.PrivateKey) (Actor, error) {
 	var actor = new(Actor)
 	var err error
 	cacheData, found := cache.Get(url)
@@ -100,6 +121,11 @@ func NewActivityPubActorFromRemoteActor(url string, uaString string, cache *cach
 	req, _ := http.NewRequest("GET", url, nil)
 	req.Header.Set("Accept", "application/activity+json")
 	req.Header.Set("User-Agent", uaString)
+	if privateKey != nil && keyID != "" {
+		if err := signGETRequest(req, keyID, privateKey); err != nil {
+			return *actor, err
+		}
+	}
 	client := new(http.Client)
 	resp, err := client.Do(req)
 	if err != nil {