1014 lines
31 KiB
Python
1014 lines
31 KiB
Python
import binascii
|
|
import hashlib
|
|
import json
|
|
import urllib
|
|
import os
|
|
import mimetypes
|
|
import logging
|
|
from functools import wraps
|
|
from datetime import datetime
|
|
|
|
import timeago
|
|
import bleach
|
|
import mf2py
|
|
import pymongo
|
|
import piexif
|
|
from bson.objectid import ObjectId
|
|
from flask import Flask
|
|
from flask import abort
|
|
from flask import request
|
|
from flask import redirect
|
|
from flask import Response
|
|
from flask import render_template
|
|
from flask import session
|
|
from flask import url_for
|
|
from html2text import html2text
|
|
from itsdangerous import JSONWebSignatureSerializer
|
|
from itsdangerous import BadSignature
|
|
from passlib.hash import bcrypt
|
|
from u2flib_server import u2f
|
|
from urllib.parse import urlparse, urlencode
|
|
from werkzeug.utils import secure_filename
|
|
|
|
import activitypub
|
|
import config
|
|
from activitypub import ActivityTypes
|
|
from activitypub import clean_activity
|
|
from activitypub import parse_markdown
|
|
from config import KEY
|
|
from config import DB
|
|
from config import ME
|
|
from config import ID
|
|
from config import DOMAIN
|
|
from config import USERNAME
|
|
from config import BASE_URL
|
|
from config import ACTOR_SERVICE
|
|
from config import OBJECT_SERVICE
|
|
from config import PASS
|
|
from config import HEADERS
|
|
from utils.httpsig import HTTPSigAuth, verify_request
|
|
from utils.key import get_secret_key
|
|
from utils.webfinger import get_remote_follow_template
|
|
from utils.webfinger import get_actor_url
|
|
|
|
|
|
app = Flask(__name__)
|
|
app.secret_key = get_secret_key('flask')
|
|
|
|
JWT_SECRET = get_secret_key('jwt')
|
|
JWT = JSONWebSignatureSerializer(JWT_SECRET)
|
|
|
|
with open('config/jwt_token', 'w+') as f:
|
|
f.write(JWT.dumps({'type': 'admin_token'}))
|
|
|
|
SIG_AUTH = HTTPSigAuth(ID+'#main-key', KEY.privkey)
|
|
|
|
|
|
def verify_pass(pwd):
|
|
return bcrypt.verify(pwd, PASS)
|
|
|
|
@app.context_processor
|
|
def inject_config():
|
|
return dict(config=config, logged_in=session.get('logged_in', False))
|
|
|
|
@app.after_request
|
|
def set_x_powered_by(response):
|
|
response.headers['X-Powered-By'] = 'microblog.pub'
|
|
return response
|
|
|
|
# HTML/templates helper
|
|
ALLOWED_TAGS = [
|
|
'a',
|
|
'abbr',
|
|
'acronym',
|
|
'b',
|
|
'blockquote',
|
|
'code',
|
|
'pre',
|
|
'em',
|
|
'i',
|
|
'li',
|
|
'ol',
|
|
'strong',
|
|
'ul',
|
|
'span',
|
|
'div',
|
|
'p',
|
|
'h1',
|
|
'h2',
|
|
'h3',
|
|
'h4',
|
|
'h5',
|
|
'h6',
|
|
]
|
|
|
|
|
|
def clean_html(html):
|
|
return bleach.clean(html, tags=ALLOWED_TAGS)
|
|
|
|
|
|
@app.template_filter()
|
|
def quote_plus(t):
|
|
return urllib.parse.quote_plus(t)
|
|
|
|
|
|
@app.template_filter()
|
|
def clean(html):
|
|
return clean_html(html)
|
|
|
|
|
|
@app.template_filter()
|
|
def html2plaintext(body):
|
|
return html2text(body)
|
|
|
|
|
|
@app.template_filter()
|
|
def domain(url):
|
|
return urlparse(url).netloc
|
|
|
|
|
|
@app.template_filter()
|
|
def get_actor(url):
|
|
if not url:
|
|
return None
|
|
print(f'GET_ACTOR {url}')
|
|
return ACTOR_SERVICE.get(url)
|
|
|
|
@app.template_filter()
|
|
def format_time(val):
|
|
if val:
|
|
return datetime.strftime(datetime.strptime(val, '%Y-%m-%dT%H:%M:%SZ'), '%B %d, %Y, %H:%M %p')
|
|
return val
|
|
|
|
|
|
@app.template_filter()
|
|
def format_timeago(val):
|
|
if val:
|
|
try:
|
|
return timeago.format(datetime.strptime(val, '%Y-%m-%dT%H:%M:%SZ'), datetime.utcnow())
|
|
except:
|
|
return timeago.format(datetime.strptime(val, '%Y-%m-%dT%H:%M:%S.%fZ'), datetime.utcnow())
|
|
|
|
return val
|
|
|
|
def _is_img(filename):
|
|
filename = filename.lower()
|
|
if (filename.endswith('.png') or filename.endswith('.jpg') or filename.endswith('.jpeg') or
|
|
filename.endswith('.gif') or filename.endswith('.svg')):
|
|
return True
|
|
return False
|
|
|
|
@app.template_filter()
|
|
def not_only_imgs(attachment):
|
|
for a in attachment:
|
|
if not _is_img(a['url']):
|
|
return True
|
|
return False
|
|
|
|
@app.template_filter()
|
|
def is_img(filename):
|
|
return _is_img(filename)
|
|
|
|
|
|
def login_required(f):
|
|
@wraps(f)
|
|
def decorated_function(*args, **kwargs):
|
|
if not session.get('logged_in'):
|
|
return redirect(url_for('login', next=request.url))
|
|
return f(*args, **kwargs)
|
|
return decorated_function
|
|
|
|
|
|
def api_required(f):
|
|
@wraps(f)
|
|
def decorated_function(*args, **kwargs):
|
|
if session.get('logged_in'):
|
|
return f(*args, **kwargs)
|
|
|
|
# Token verification
|
|
token = request.headers.get('Authorization', '').replace('Bearer ', '')
|
|
if not token:
|
|
token = request.form.get('access_token', '')
|
|
|
|
try:
|
|
payload = JWT.loads(token)
|
|
# TODO(tsileo): log payload
|
|
except BadSignature:
|
|
abort(401)
|
|
return f(*args, **kwargs)
|
|
return decorated_function
|
|
|
|
|
|
def jsonify(**data):
|
|
if '@context' not in data:
|
|
data['@context'] = config.CTX_AS
|
|
return Response(
|
|
response=json.dumps(data),
|
|
headers={'Content-Type': 'application/json' if app.debug else 'application/activity+json'},
|
|
)
|
|
|
|
|
|
def is_api_request():
|
|
h = request.headers.get('Accept')
|
|
if h is None:
|
|
return False
|
|
h = h.split(',')[0]
|
|
if h in HEADERS or h == 'application/json':
|
|
return True
|
|
return False
|
|
|
|
# App routes
|
|
|
|
#######
|
|
# Login
|
|
|
|
@app.route('/logout')
|
|
@login_required
|
|
def logout():
|
|
session['logged_in'] = False
|
|
return redirect('/')
|
|
|
|
|
|
@app.route('/login', methods=['POST', 'GET'])
|
|
def login():
|
|
devices = [doc['device'] for doc in DB.u2f.find()]
|
|
u2f_enabled = True if devices else False
|
|
if request.method == 'POST':
|
|
pwd = request.form.get('pass')
|
|
if pwd and verify_pass(pwd):
|
|
if devices:
|
|
resp = json.loads(request.form.get('resp'))
|
|
print(resp)
|
|
try:
|
|
u2f.complete_authentication(session['challenge'], resp)
|
|
except ValueError as exc:
|
|
print('failed', exc)
|
|
abort(401)
|
|
return
|
|
finally:
|
|
session['challenge'] = None
|
|
|
|
session['logged_in'] = True
|
|
return redirect(request.args.get('redirect') or '/admin')
|
|
else:
|
|
abort(401)
|
|
|
|
payload = None
|
|
if devices:
|
|
payload = u2f.begin_authentication(ID, devices)
|
|
session['challenge'] = payload
|
|
|
|
return render_template(
|
|
'login.html',
|
|
u2f_enabled=u2f_enabled,
|
|
me=ME,
|
|
payload=payload,
|
|
)
|
|
|
|
|
|
@app.route('/remote_follow', methods=['GET', 'POST'])
|
|
@login_required
|
|
def remote_follow():
|
|
if request.method == 'GET':
|
|
return render_template('remote_follow.html')
|
|
|
|
return redirect(get_remote_follow_template('@'+request.form.get('profile')).format(uri=ID))
|
|
|
|
|
|
@app.route('/authorize_follow', methods=['GET', 'POST'])
|
|
@login_required
|
|
def authorize_follow():
|
|
if request.method == 'GET':
|
|
return render_template('authorize_remote_follow.html', profile=request.args.get('profile'))
|
|
|
|
actor = get_actor_url(request.form.get('profile'))
|
|
if not actor:
|
|
abort(500)
|
|
if DB.following.find({'remote_actor': actor}).count() > 0:
|
|
return redirect('/following')
|
|
|
|
follow = activitypub.Follow(object=actor)
|
|
follow.post_to_outbox()
|
|
return redirect('/following')
|
|
|
|
|
|
@app.route('/u2f/register', methods=['GET', 'POST'])
|
|
@login_required
|
|
def u2f_register():
|
|
# TODO(tsileo): ensure no duplicates
|
|
if request.method == 'GET':
|
|
payload = u2f.begin_registration(ID)
|
|
session['challenge'] = payload
|
|
return render_template(
|
|
'u2f.html',
|
|
payload=payload,
|
|
)
|
|
else:
|
|
resp = json.loads(request.form.get('resp'))
|
|
device, device_cert = u2f.complete_registration(session['challenge'], resp)
|
|
session['challenge'] = None
|
|
DB.u2f.insert_one({'device': device, 'cert': device_cert})
|
|
return ''
|
|
|
|
#######
|
|
# Activity pub routes
|
|
|
|
@app.route('/')
|
|
def index():
|
|
print(request.headers.get('Accept'))
|
|
if is_api_request():
|
|
return jsonify(**ME)
|
|
|
|
# FIXME(tsileo): implements pagination, also for the followers/following page
|
|
limit = 50
|
|
q = {
|
|
'type': 'Create',
|
|
'activity.object.type': 'Note',
|
|
'meta.deleted': False,
|
|
}
|
|
c = request.args.get('cursor')
|
|
if c:
|
|
q['_id'] = {'$lt': ObjectId(c)}
|
|
|
|
outbox_data = list(DB.outbox.find({'$or': [q, {'type': 'Announce', 'meta.undo': False}]}, limit=limit).sort('_id', -1))
|
|
cursor = None
|
|
if outbox_data and len(outbox_data) == limit:
|
|
cursor = str(outbox_data[-1]['_id'])
|
|
|
|
for data in outbox_data:
|
|
if data['type'] == 'Announce':
|
|
print(data)
|
|
if data['activity']['object'].startswith('http'):
|
|
data['ref'] = {'activity': {'object': OBJECT_SERVICE.get(data['activity']['object'])}, 'meta': {}}
|
|
|
|
|
|
return render_template(
|
|
'index.html',
|
|
me=ME,
|
|
notes=DB.inbox.find({'type': 'Create', 'activity.object.type': 'Note', 'meta.deleted': False}).count(),
|
|
followers=DB.followers.count(),
|
|
following=DB.following.count(),
|
|
outbox_data=outbox_data,
|
|
cursor=cursor,
|
|
)
|
|
|
|
|
|
@app.route('/note/<note_id>')
|
|
def note_by_id(note_id):
|
|
data = DB.outbox.find_one({'id': note_id, 'meta.deleted': False})
|
|
if not data:
|
|
return Response(status=404)
|
|
|
|
replies = list(DB.inbox.find({
|
|
'type': 'Create',
|
|
'activity.object.inReplyTo': data['activity']['object']['id'],
|
|
'meta.deleted': False,
|
|
}))
|
|
|
|
# Check for "replies of replies"
|
|
others = []
|
|
for rep in replies:
|
|
for rep_reply in rep.get('meta', {}).get('replies', []):
|
|
others.append(rep_reply['id'])
|
|
|
|
if others:
|
|
# Fetch the latest versions of the "replies of replies"
|
|
replies2 = list(DB.inbox.find({
|
|
'activity.id': {'$in': others},
|
|
}))
|
|
|
|
replies.extend(replies2)
|
|
|
|
replies2 = list(DB.outbox.find({
|
|
'activity.id': {'$in': others},
|
|
}))
|
|
|
|
replies.extend(replies2)
|
|
|
|
|
|
# Re-sort everything
|
|
replies = sorted(replies, key=lambda o: o['activity']['object']['published'])
|
|
|
|
|
|
return render_template('note.html', me=ME, note=data, replies=replies)
|
|
|
|
|
|
@app.route('/.well-known/webfinger')
|
|
def webfinger():
|
|
"""Enable WebFinger support, required for Mastodon interopability."""
|
|
resource = request.args.get('resource')
|
|
if resource not in ["acct:"+USERNAME+"@"+DOMAIN, ID]:
|
|
abort(404)
|
|
|
|
out = {
|
|
"subject": "acct:"+USERNAME+"@"+DOMAIN,
|
|
"aliases": [ID],
|
|
"links": [
|
|
{"rel": "http://webfinger.net/rel/profile-page", "type": "text/html", "href": BASE_URL},
|
|
{"rel": "self", "type": "application/activity+json", "href": ID},
|
|
{"rel":"http://ostatus.org/schema/1.0/subscribe","template": BASE_URL+"/authorize_follow?profile={uri}"},
|
|
],
|
|
}
|
|
|
|
return Response(
|
|
response=json.dumps(out),
|
|
headers={'Content-Type': 'application/jrd+json; charset=utf-8' if not app.debug else 'application/json'},
|
|
)
|
|
|
|
@app.route('/outbox', methods=['GET', 'POST'])
|
|
def outbox():
|
|
if request.method == 'GET':
|
|
if not is_api_request():
|
|
abort(404)
|
|
# TODO(tsileo): filter the outbox if not authenticated
|
|
# FIXME(tsileo): filter deleted, add query support for build_ordered_collection
|
|
q = {
|
|
'meta.deleted': False,
|
|
'type': {'$in': [ActivityTypes.CREATE.value, ActivityTypes.ANNOUNCE.value]},
|
|
}
|
|
return jsonify(**activitypub.build_ordered_collection(
|
|
DB.outbox,
|
|
q=q,
|
|
cursor=request.args.get('cursor'),
|
|
map_func=lambda doc: clean_activity(doc['activity']),
|
|
))
|
|
|
|
# Handle POST request
|
|
# FIXME(tsileo): check auth
|
|
data = request.get_json(force=True)
|
|
print(data)
|
|
activity = activitypub.parse_activity(data)
|
|
|
|
if activity.type_enum == ActivityTypes.NOTE:
|
|
activity = activity.build_create()
|
|
|
|
activity.post_to_outbox()
|
|
|
|
return Response(status=201, headers={'Location': activity.id})
|
|
|
|
|
|
@app.route('/outbox/<item_id>')
|
|
def outbox_detail(item_id):
|
|
doc = DB.outbox.find_one({'id': item_id, 'meta.deleted': False})
|
|
return jsonify(**clean_activity(doc['activity']))
|
|
|
|
|
|
@app.route('/outbox/<item_id>/activity')
|
|
def outbox_activity(item_id):
|
|
data = DB.outbox.find_one({'id': item_id, 'meta.deleted': False})
|
|
if not data:
|
|
abort(404)
|
|
obj = data['activity']
|
|
if obj['type'] != ActivityTypes.CREATE.value:
|
|
abort(404)
|
|
return jsonify(**clean_activity(obj['object']))
|
|
|
|
@app.route('/admin', methods=['GET'])
|
|
@login_required
|
|
def admin():
|
|
q = {
|
|
'meta.deleted': False,
|
|
'meta.undo': False,
|
|
'type': ActivityTypes.LIKE.value,
|
|
}
|
|
col_liked = DB.outbox.count(q)
|
|
|
|
return render_template(
|
|
'admin.html',
|
|
instances=list(DB.instances.find()),
|
|
inbox_size=DB.inbox.count(),
|
|
outbox_size=DB.outbox.count(),
|
|
object_cache_size=DB.objects_cache.count(),
|
|
actor_cache_size=DB.actors_cache.count(),
|
|
col_liked=col_liked,
|
|
col_followers=DB.followers.count(),
|
|
col_following=DB.following.count(),
|
|
)
|
|
|
|
|
|
@app.route('/new', methods=['GET', 'POST'])
|
|
@login_required
|
|
def new():
|
|
if request.method == 'POST':
|
|
reply = None
|
|
if request.form.get('reply'):
|
|
reply = activitypub.parse_activity(OBJECT_SERVICE.get(request.form.get('reply')))
|
|
source = request.form.get('content')
|
|
content, tags = parse_markdown(source)
|
|
to = request.form.get('to')
|
|
cc = [ID+'/followers']
|
|
if reply:
|
|
cc.append(reply.attributedTo)
|
|
for tag in tags:
|
|
if tag['type'] == 'Mention':
|
|
cc.append(tag['href'])
|
|
|
|
note = activitypub.Note(
|
|
cc=cc,
|
|
to=[to if to else config.AS_PUBLIC],
|
|
content=content, # TODO(tsileo): handle markdown
|
|
tag=tags,
|
|
source={'mediaType': 'text/markdown', 'content': source},
|
|
inReplyTo=reply.id,
|
|
)
|
|
create = note.build_create()
|
|
print(create.to_dict())
|
|
create.post_to_outbox()
|
|
|
|
reply_id = None
|
|
content = ''
|
|
if request.args.get('reply'):
|
|
reply = activitypub.parse_activity(OBJECT_SERVICE.get(request.args.get('reply')))
|
|
reply_id = reply.id
|
|
actor = reply.get_actor()
|
|
domain = urlparse(actor.id).netloc
|
|
content = f'@{actor.preferredUsername}@{domain} '
|
|
|
|
return render_template('new.html', reply=reply_id, content=content)
|
|
|
|
|
|
@app.route('/notifications')
|
|
@login_required
|
|
def notifications():
|
|
# FIXME(tsileo): implements pagination, also for the followers/following page
|
|
limit = 50
|
|
q = {
|
|
'type': 'Create',
|
|
'activity.object.tag.type': 'Mention',
|
|
'activity.object.tag.name': f'@{USERNAME}@{DOMAIN}',
|
|
'meta.deleted': False,
|
|
}
|
|
# TODO(tsileo): also include replies via regex on Create replyTo
|
|
q = {'$or': [q, {'type': 'Follow'}, {'type': 'Accept'}, {'type': 'Undo', 'activity.object.type': 'Follow'},
|
|
{'type': 'Announce', 'activity.object': {'$regex': f'^{BASE_URL}'}},
|
|
{'type': 'Create', 'activity.object.inReplyTo': {'$regex': f'^{BASE_URL}'}},
|
|
]}
|
|
print(q)
|
|
c = request.args.get('cursor')
|
|
if c:
|
|
q['_id'] = {'$lt': ObjectId(c)}
|
|
|
|
outbox_data = list(DB.inbox.find(q, limit=limit).sort('_id', -1))
|
|
cursor = None
|
|
if outbox_data and len(outbox_data) == limit:
|
|
cursor = str(outbox_data[-1]['_id'])
|
|
|
|
# TODO(tsileo): fix the annonce handling, copy it from /stream
|
|
#for data in outbox_data:
|
|
# if data['type'] == 'Announce':
|
|
# print(data)
|
|
# if data['activity']['object'].startswith('http') and data['activity']['object'] in objcache:
|
|
# data['ref'] = {'activity': {'object': objcache[data['activity']['object']]}, 'meta': {}}
|
|
# out.append(data)
|
|
# else:
|
|
# out.append(data)
|
|
|
|
return render_template(
|
|
'stream.html',
|
|
inbox_data=outbox_data,
|
|
cursor=cursor,
|
|
)
|
|
|
|
@app.route('/ui/boost')
|
|
@login_required
|
|
def ui_boost():
|
|
oid = request.args.get('id')
|
|
obj = activitypub.parse_activity(OBJECT_SERVICE.get(oid))
|
|
announce = obj.build_announce()
|
|
announce.post_to_outbox()
|
|
return redirect(request.args.get('redirect'))
|
|
|
|
@app.route('/ui/like')
|
|
@login_required
|
|
def ui_like():
|
|
oid = request.args.get('id')
|
|
obj = activitypub.parse_activity(OBJECT_SERVICE.get(oid))
|
|
like = obj.build_like()
|
|
like.post_to_outbox()
|
|
return redirect(request.args.get('redirect'))
|
|
|
|
@app.route('/ui/undo')
|
|
@login_required
|
|
def ui_undo():
|
|
oid = request.args.get('id')
|
|
doc =DB.outbox.find_one({'id': oid})
|
|
if doc:
|
|
obj = activitypub.parse_activity(doc.get('activity'))
|
|
undo = obj.build_undo()
|
|
undo.post_to_outbox()
|
|
return redirect(request.args.get('redirect'))
|
|
|
|
@app.route('/stream')
|
|
@login_required
|
|
def stream():
|
|
# FIXME(tsileo): implements pagination, also for the followers/following page
|
|
limit = 100
|
|
q = {
|
|
'type': 'Create',
|
|
'activity.object.type': 'Note',
|
|
'activity.object.inReplyTo': None,
|
|
'meta.deleted': False,
|
|
}
|
|
c = request.args.get('cursor')
|
|
if c:
|
|
q['_id'] = {'$lt': ObjectId(c)}
|
|
|
|
outbox_data = list(DB.inbox.find(
|
|
{
|
|
'$or': [
|
|
q,
|
|
{
|
|
'type': 'Announce',
|
|
},
|
|
]
|
|
}, limit=limit).sort('activity.published', -1))
|
|
cursor = None
|
|
if outbox_data and len(outbox_data) == limit:
|
|
cursor = str(outbox_data[-1]['_id'])
|
|
|
|
out = []
|
|
objcache = {}
|
|
cached = list(DB.objects_cache.find({'meta.part_of_stream': True}, limit=limit*3).sort('meta.announce_published', -1))
|
|
for c in cached:
|
|
objcache[c['object_id']] = c['cached_object']
|
|
for data in outbox_data:
|
|
if data['type'] == 'Announce':
|
|
if data['activity']['object'].startswith('http') and data['activity']['object'] in objcache:
|
|
data['ref'] = {'activity': {'object': objcache[data['activity']['object']]}, 'meta': {}}
|
|
out.append(data)
|
|
else:
|
|
print('OMG', data)
|
|
else:
|
|
out.append(data)
|
|
return render_template(
|
|
'stream.html',
|
|
inbox_data=out,
|
|
cursor=cursor,
|
|
)
|
|
|
|
|
|
@app.route('/inbox', methods=['GET', 'POST'])
|
|
def inbox():
|
|
if request.method == 'GET':
|
|
if not is_api_request():
|
|
abort(404)
|
|
# TODO(tsileo): handle auth and only return 404 if unauthenticated
|
|
# abort(404)
|
|
return jsonify(**activitypub.build_ordered_collection(
|
|
DB.inbox,
|
|
q={'meta.deleted': False},
|
|
cursor=request.args.get('cursor'),
|
|
map_func=lambda doc: doc['activity'],
|
|
))
|
|
data = request.get_json(force=True)
|
|
# FIXME(tsileo): ensure verify_request() == True
|
|
print(data)
|
|
try:
|
|
print(verify_request(ACTOR_SERVICE))
|
|
except Exception:
|
|
print('failed to verify request')
|
|
|
|
activity = activitypub.parse_activity(data)
|
|
print(activity)
|
|
activity.process_from_inbox()
|
|
|
|
return Response(
|
|
status=201,
|
|
)
|
|
|
|
|
|
@app.route('/api/upload', methods=['POST'])
|
|
@api_required
|
|
def api_upload():
|
|
file = request.files['file']
|
|
rfilename = secure_filename(file.filename)
|
|
prefix = hashlib.sha256(os.urandom(32)).hexdigest()[:6]
|
|
mtype = mimetypes.guess_type(rfilename)[0]
|
|
filename = f'{prefix}_{rfilename}'
|
|
file.save(os.path.join('static', 'media', filename))
|
|
|
|
# Remove EXIF metadata
|
|
if filename.lower().endswith('.jpg') or filename.lower().endswith('.jpeg'):
|
|
piexif.remove(os.path.join('static', 'media', filename))
|
|
|
|
print('upload OK')
|
|
print(filename)
|
|
attachment = [
|
|
{'mediaType': mtype,
|
|
'name': rfilename,
|
|
'type': 'Document',
|
|
'url': BASE_URL + f'/static/media/{filename}'
|
|
},
|
|
]
|
|
print(attachment)
|
|
content = request.args.get('content')
|
|
to = request.args.get('to')
|
|
note = activitypub.Note(
|
|
cc=[ID+'/followers'],
|
|
to=[to if to else config.AS_PUBLIC],
|
|
content=content, # TODO(tsileo): handle markdown
|
|
attachment=attachment,
|
|
)
|
|
print('post_note_init')
|
|
print(note)
|
|
create = note.build_create()
|
|
print(create)
|
|
print(create.to_dict())
|
|
create.post_to_outbox()
|
|
print('posted')
|
|
|
|
return Response(
|
|
status=201,
|
|
response='OK',
|
|
)
|
|
|
|
|
|
@app.route('/api/new_note')
|
|
@api_required
|
|
def api_new_note():
|
|
source = request.args.get('content')
|
|
content, tags = parse_markdown(source)
|
|
to = request.args.get('to')
|
|
cc = [ID+'/followers']
|
|
for tag in tags:
|
|
if tag['type'] == 'Mention':
|
|
cc.append(tag['href'])
|
|
|
|
note = activitypub.Note(
|
|
cc=cc,
|
|
to=[to if to else config.AS_PUBLIC],
|
|
content=content, # TODO(tsileo): handle markdown
|
|
tag=tags,
|
|
source={'mediaType': 'text/markdown', 'content': source},
|
|
)
|
|
create = note.build_create()
|
|
create.post_to_outbox()
|
|
return Response(
|
|
status=201,
|
|
response='OK',
|
|
)
|
|
|
|
@app.route('/api/stream')
|
|
def api_stream():
|
|
return Response(
|
|
response=json.dumps(activitypub.build_inbox_json_feed('/api/stream', request.args.get('cursor'))),
|
|
headers={'Content-Type': 'application/json'},
|
|
)
|
|
|
|
@app.route('/api/follow')
|
|
@api_required
|
|
def api_follow():
|
|
actor = request.args.get('actor')
|
|
if DB.following.find({'remote_actor': actor}).count() > 0:
|
|
return Response(status=201)
|
|
|
|
follow = activitypub.Follow(object=actor)
|
|
follow.post_to_outbox()
|
|
return Response(
|
|
status=201,
|
|
)
|
|
|
|
|
|
@app.route('/followers')
|
|
def followers():
|
|
if is_api_request():
|
|
return jsonify(
|
|
**activitypub.build_ordered_collection(
|
|
DB.followers,
|
|
cursor=request.args.get('cursor'),
|
|
map_func=lambda doc: doc['remote_actor'],
|
|
)
|
|
)
|
|
|
|
followers = [ACTOR_SERVICE.get(doc['remote_actor']) for doc in DB.followers.find(limit=50)]
|
|
return render_template(
|
|
'followers.html',
|
|
me=ME,
|
|
notes=DB.inbox.find({'object.object.type': 'Note'}).count(),
|
|
followers=DB.followers.count(),
|
|
following=DB.following.count(),
|
|
followers_data=followers,
|
|
)
|
|
|
|
|
|
@app.route('/following')
|
|
def following():
|
|
if is_api_request():
|
|
return jsonify(
|
|
**activitypub.build_ordered_collection(
|
|
DB.following,
|
|
cursor=request.args.get('cursor'),
|
|
map_func=lambda doc: doc['remote_actor'],
|
|
),
|
|
)
|
|
|
|
following = [ACTOR_SERVICE.get(doc['remote_actor']) for doc in DB.following.find(limit=50)]
|
|
return render_template(
|
|
'following.html',
|
|
me=ME,
|
|
notes=DB.inbox.find({'object.object.type': 'Note'}).count(),
|
|
followers=DB.followers.count(),
|
|
following=DB.following.count(),
|
|
following_data=following,
|
|
)
|
|
|
|
|
|
@app.route('/tags/<tag>')
|
|
def tags(tag):
|
|
if not DB.outbox.count({'activity.object.tag.type': 'Hashtag', 'activity.object.tag.name': '#'+tag}):
|
|
abort(404)
|
|
if not is_api_request():
|
|
return render_template(
|
|
'tags.html',
|
|
tag=tag,
|
|
outbox_data=DB.outbox.find({'type': 'Create', 'activity.object.type': 'Note', 'meta.deleted': False,
|
|
'activity.object.tag.type': 'Hashtag',
|
|
'activity.object.tag.name': '#'+tag}),
|
|
)
|
|
q = {
|
|
'meta.deleted': False,
|
|
'meta.undo': False,
|
|
'type': ActivityTypes.CREATE.value,
|
|
'activity.object.tag.type': 'Hashtag',
|
|
'activity.object.tag.name': '#'+tag,
|
|
}
|
|
return jsonify(**activitypub.build_ordered_collection(
|
|
DB.outbox,
|
|
q=q,
|
|
cursor=request.args.get('cursor'),
|
|
map_func=lambda doc: doc['activity']['object']['id'],
|
|
col_name=f'tags/{tag}',
|
|
))
|
|
|
|
|
|
@app.route('/liked')
|
|
def liked():
|
|
if not is_api_request():
|
|
abort(404)
|
|
q = {
|
|
'meta.deleted': False,
|
|
'meta.undo': False,
|
|
'type': ActivityTypes.LIKE.value,
|
|
}
|
|
return jsonify(**activitypub.build_ordered_collection(
|
|
DB.outbox,
|
|
q=q,
|
|
cursor=request.args.get('cursor'),
|
|
map_func=lambda doc: doc['activity']['object'],
|
|
col_name='liked',
|
|
))
|
|
|
|
#######
|
|
# IndieAuth
|
|
|
|
|
|
def build_auth_resp(payload):
|
|
if request.headers.get('Accept') == 'application/json':
|
|
return Response(
|
|
status=200,
|
|
headers={'Content-Type': 'application/json'},
|
|
response=json.dumps(payload),
|
|
)
|
|
return Response(
|
|
status=200,
|
|
headers={'Content-Type': 'application/x-www-form-urlencoded'},
|
|
response=urlencode(payload),
|
|
)
|
|
|
|
|
|
def _get_prop(props, name, default=None):
|
|
if name in props:
|
|
items = props.get(name)
|
|
if isinstance(items, list):
|
|
return items[0]
|
|
return items
|
|
return default
|
|
|
|
def get_client_id_data(url):
|
|
data = mf2py.parse(url=url)
|
|
for item in data['items']:
|
|
if 'h-x-app' in item['type'] or 'h-app' in item['type']:
|
|
props = item.get('properties', {})
|
|
print(props)
|
|
return dict(
|
|
logo=_get_prop(props, 'logo'),
|
|
name=_get_prop(props, 'name'),
|
|
url=_get_prop(props, 'url'),
|
|
)
|
|
return dict(
|
|
logo=None,
|
|
name=url,
|
|
url=url,
|
|
)
|
|
|
|
|
|
@app.route('/indieauth/flow', methods=['POST'])
|
|
@login_required
|
|
def indieauth_flow():
|
|
auth = dict(
|
|
scope=' '.join(request.form.getlist('scopes')),
|
|
me=request.form.get('me'),
|
|
client_id=request.form.get('client_id'),
|
|
state=request.form.get('state'),
|
|
redirect_uri=request.form.get('redirect_uri'),
|
|
response_type=request.form.get('response_type'),
|
|
)
|
|
|
|
code = binascii.hexlify(os.urandom(8)).decode('utf-8')
|
|
auth.update(
|
|
code=code,
|
|
verified=False,
|
|
)
|
|
print(auth)
|
|
if not auth['redirect_uri']:
|
|
abort(500)
|
|
|
|
DB.indieauth.insert_one(auth)
|
|
|
|
# FIXME(tsileo): fetch client ID and validate redirect_uri
|
|
red = f'{auth["redirect_uri"]}?code={code}&state={auth["state"]}&me={auth["me"]}'
|
|
return redirect(red)
|
|
|
|
|
|
@app.route('/indieauth', methods=['GET', 'POST'])
|
|
def indieauth_endpoint():
|
|
session['logged_in'] = True
|
|
if request.method == 'GET':
|
|
if not session.get('logged_in'):
|
|
return redirect(url_for('login', next=request.url))
|
|
|
|
me = request.args.get('me')
|
|
# FIXME(tsileo): ensure me == ID
|
|
client_id = request.args.get('client_id')
|
|
redirect_uri = request.args.get('redirect_uri')
|
|
state = request.args.get('state', '')
|
|
response_type = request.args.get('response_type', 'id')
|
|
scope = request.args.get('scope', '').split()
|
|
|
|
print('STATE', state)
|
|
return render_template(
|
|
'indieauth_flow.html',
|
|
client=get_client_id_data(client_id),
|
|
scopes=scope,
|
|
redirect_uri=redirect_uri,
|
|
state=state,
|
|
response_type=response_type,
|
|
client_id=client_id,
|
|
me=me,
|
|
)
|
|
|
|
# Auth verification via POST
|
|
code = request.form.get('code')
|
|
redirect_uri = request.form.get('redirect_uri')
|
|
client_id = request.form.get('client_id')
|
|
|
|
auth = DB.indieauth.find_one_and_update(
|
|
{'code': code, 'redirect_uri': redirect_uri, 'client_id': client_id}, #}, # , 'verified': False},
|
|
{'$set': {'verified': True}},
|
|
sort=[('_id', pymongo.DESCENDING)],
|
|
)
|
|
print(auth)
|
|
print(code, redirect_uri, client_id)
|
|
|
|
if not auth:
|
|
abort(403)
|
|
return
|
|
|
|
me = auth['me']
|
|
state = auth['state']
|
|
scope = ' '.join(auth['scope'])
|
|
print('STATE', state)
|
|
return build_auth_resp({'me': me, 'state': state, 'scope': scope})
|
|
|
|
|
|
@app.route('/token', methods=['GET', 'POST'])
|
|
def token_endpoint():
|
|
if request.method == 'POST':
|
|
code = request.form.get('code')
|
|
me = request.form.get('me')
|
|
redirect_uri = request.form.get('redirect_uri')
|
|
client_id = request.form.get('client_id')
|
|
|
|
auth = DB.indieauth.find_one({'code': code, 'me': me, 'redirect_uri': redirect_uri, 'client_id': client_id})
|
|
if not auth:
|
|
abort(403)
|
|
scope = ' '.join(auth['scope'])
|
|
payload = dict(me=me, client_id=client_id, scope=scope, ts=datetime.now().timestamp())
|
|
token = JWT.dumps(payload).decode('utf-8')
|
|
|
|
return build_auth_resp({'me': me, 'scope': scope, 'access_token': token})
|
|
|
|
# Token verification
|
|
token = request.headers.get('Authorization').replace('Bearer ', '')
|
|
try:
|
|
payload = JWT.loads(token)
|
|
except BadSignature:
|
|
abort(403)
|
|
|
|
# TODO(tsileo): handle expiration
|
|
|
|
return build_auth_resp({
|
|
'me': payload['me'],
|
|
'scope': payload['scope'],
|
|
'client_id': payload['client_id'],
|
|
})
|