Files
laipower/wp-content/plugins/activitypub/includes/rest/class-outbox-controller.php

692 lines
21 KiB
PHP

<?php
/**
* Outbox Controller file.
*
* @package Activitypub
*/
namespace Activitypub\Rest;
use Activitypub\Activity\Activity;
use Activitypub\Activity\Base_Object;
use Activitypub\Collection\Actors;
use Activitypub\Collection\Outbox;
use function Activitypub\add_to_outbox;
use function Activitypub\extract_recipients_from_activity;
use function Activitypub\get_masked_wp_version;
use function Activitypub\get_object_id;
use function Activitypub\get_rest_url_by_path;
use function Activitypub\object_to_uri;
use function Activitypub\user_can_act_as_blog;
/**
* ActivityPub Outbox Controller.
*
* @author Matthias Pfefferle
*
* @see https://www.w3.org/TR/activitypub/#outbox
*/
class Outbox_Controller extends \WP_REST_Controller {
use Collection;
use Event_Stream;
use Language_Map;
use Verification;
/**
* Activity types accessible as individual outbox items via REST.
*
* @var string[]
*/
const PUBLIC_ACTIVITY_TYPES = array( 'Announce', 'Arrive', 'Create', 'Like', 'Update' );
/**
* The namespace of this controller's route.
*
* @var string
*/
protected $namespace = ACTIVITYPUB_REST_NAMESPACE;
/**
* The base of this controller's route.
*
* @var string
*/
protected $rest_base = '(?:users|actors)/(?P<user_id>[-]?\d+)/outbox';
/**
* Register routes.
*/
public function register_routes() {
\register_rest_route(
$this->namespace,
'/' . $this->rest_base,
array(
'args' => array(
'user_id' => array(
'description' => 'The ID of the user or actor.',
'type' => 'integer',
'validate_callback' => array( $this, 'validate_user_id' ),
),
),
array(
'methods' => \WP_REST_Server::READABLE,
'callback' => array( $this, 'get_items' ),
'permission_callback' => array( $this, 'verify_signature' ),
'args' => array(
'page' => array(
'description' => 'Current page of the collection.',
'type' => 'integer',
'minimum' => 1,
// No default so we can differentiate between Collection and CollectionPage requests.
),
'per_page' => array(
'description' => 'Maximum number of items to be returned in result set.',
'type' => 'integer',
'default' => 20,
'minimum' => 1,
'maximum' => 100,
),
),
),
array(
'methods' => \WP_REST_Server::CREATABLE,
'callback' => array( $this, 'create_item' ),
'permission_callback' => array( $this, 'verify_authentication' ),
),
'schema' => array( $this, 'get_item_schema' ),
)
);
\register_rest_route(
$this->namespace,
'/' . $this->rest_base . '/stream',
array(
'args' => array(
'user_id' => array(
'description' => 'The ID of the actor.',
'type' => 'integer',
'required' => true,
'validate_callback' => array( $this, 'validate_user_id' ),
),
),
array(
'methods' => \WP_REST_Server::READABLE,
'callback' => function ( $request ) {
$this->stream_collection( $request->get_param( 'user_id' ), 'outbox' );
},
'permission_callback' => array( $this, 'get_stream_permissions_check' ),
),
)
);
\add_filter( 'activitypub_rest_outbox_array', array( $this, 'overload_total_items' ), 10, 2 );
}
/**
* Validates the user_id parameter.
*
* @param mixed $user_id The user_id parameter.
* @return bool|\WP_Error True if the user_id is valid, WP_Error otherwise.
*/
public function validate_user_id( $user_id ) {
$user = Actors::get_by_id( $user_id );
if ( \is_wp_error( $user ) ) {
return $user;
}
return true;
}
/**
* Retrieves a collection of outbox items.
*
* @param \WP_REST_Request $request Full details about the request.
* @return \WP_REST_Response|\WP_Error Response object on success, or WP_Error object on failure.
*/
public function get_items( $request ) {
$page = $request->get_param( 'page' ) ?? 1;
$user_id = $request->get_param( 'user_id' );
$user = Actors::get_by_id( $user_id );
/**
* Action triggered prior to the ActivityPub profile being created and sent to the client.
*
* @param \WP_REST_Request $request The request object.
*/
\do_action( 'activitypub_rest_outbox_pre', $request );
/**
* Filters the activity types included in the outbox collection.
*
* @param string[] $activity_types The activity types.
*/
$activity_types = \apply_filters( 'activitypub_outbox_activity_types', self::PUBLIC_ACTIVITY_TYPES );
$args = array(
'posts_per_page' => $request->get_param( 'per_page' ),
'author' => $user_id > 0 ? $user_id : null,
'paged' => $page,
'post_type' => Outbox::POST_TYPE,
'post_status' => 'any',
// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query
'meta_query' => array(
array(
'key' => '_activitypub_activity_actor',
'value' => Actors::get_type_by_id( $user_id ),
),
),
);
/*
* Whether the current user owns the outbox being queried. Owners see private
* and non-public activity types without the visibility filters below.
*
* For the blog actor (user_id = 0) the identity-equality check is wrong on
* two counts — `get_current_user_id()` returns 0 for anonymous visitors (so
* `0 === 0` would leak everything to the public), and AP-capable authors
* would otherwise pass the `current_user_can( 'activitypub' )` arm and read
* the blog's private Accepts. Delegate to the capability helper instead.
*/
if ( Actors::BLOG_USER_ID === (int) $user_id ) {
$is_outbox_owner = user_can_act_as_blog();
} else {
$is_outbox_owner = \is_user_logged_in() && (
\get_current_user_id() === (int) $user_id
|| \current_user_can( 'activitypub' )
);
}
if ( ! $is_outbox_owner ) {
$args['meta_query'][] = array(
'key' => '_activitypub_activity_type',
'value' => $activity_types,
'compare' => 'IN',
);
$args['meta_query'][] = array(
'relation' => 'OR',
array(
'key' => 'activitypub_content_visibility',
'compare' => 'NOT EXISTS',
),
array(
'key' => 'activitypub_content_visibility',
'value' => ACTIVITYPUB_CONTENT_VISIBILITY_PUBLIC,
),
);
}
/**
* Filters WP_Query arguments when querying Outbox items via the REST API.
*
* Enables adding extra arguments or setting defaults for an outbox collection request.
*
* @param array $args Array of arguments for WP_Query.
* @param \WP_REST_Request $request The REST API request.
*/
$args = \apply_filters( 'activitypub_rest_outbox_query', $args, $request );
$outbox_query = new \WP_Query();
$query_result = $outbox_query->query( $args );
$response = array(
'@context' => Base_Object::JSON_LD_CONTEXT,
'id' => get_rest_url_by_path( sprintf( 'actors/%d/outbox', $user_id ) ),
'generator' => 'https://wordpress.org/?v=' . get_masked_wp_version(),
'actor' => $user->get_id(),
'type' => 'OrderedCollection',
'totalItems' => (int) $outbox_query->found_posts,
'eventStream' => $this->get_stream_url( $user_id, 'outbox' ),
'orderedItems' => array(),
);
\update_postmeta_cache( \wp_list_pluck( $query_result, 'ID' ) );
foreach ( $query_result as $outbox_item ) {
if ( ! $outbox_item instanceof \WP_Post ) {
/**
* Action triggered when an outbox item is not a WP_Post.
*
* @param mixed $outbox_item The outbox item.
* @param array $args The arguments used to query the outbox.
* @param array $query_result The result of the query.
* @param \WP_REST_Request $request The request object.
*/
\do_action( 'activitypub_rest_outbox_item_error', $outbox_item, $args, $query_result, $request );
continue;
}
$item = $this->prepare_item_for_response( $outbox_item, $request );
if ( \is_wp_error( $item ) ) {
continue;
}
$response['orderedItems'][] = $item;
}
$response = $this->prepare_collection_response( $response, $request );
if ( \is_wp_error( $response ) ) {
return $response;
}
/**
* Filter the ActivityPub outbox array.
*
* @param array $response The ActivityPub outbox array.
* @param \WP_REST_Request $request The request object.
*/
$response = \apply_filters( 'activitypub_rest_outbox_array', $response, $request );
/**
* Action triggered after the ActivityPub profile has been created and sent to the client.
*
* @param \WP_REST_Request $request The request object.
*/
\do_action( 'activitypub_rest_outbox_post', $request );
$response = \rest_ensure_response( $response );
$response->header( 'Content-Type', 'application/activity+json; charset=' . \get_option( 'blog_charset' ) );
return $response;
}
/**
* Prepares the item for the REST response.
*
* @param mixed $item WordPress representation of the item.
* @param \WP_REST_Request $request Request object.
* @return array Response object on success, or WP_Error object on failure.
*/
public function prepare_item_for_response( $item, $request ) { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
$activity = Outbox::get_activity( $item->ID );
if ( \is_wp_error( $activity ) ) {
return $activity;
}
return $activity->to_array( false );
}
/**
* Retrieves the outbox schema, conforming to JSON Schema.
*
* @return array Collection schema data.
*/
public function get_item_schema() {
if ( $this->schema ) {
return $this->add_additional_fields_schema( $this->schema );
}
$item_schema = array(
'type' => 'object',
);
$schema = $this->get_collection_schema( $item_schema );
// Add outbox-specific properties.
$schema['title'] = 'outbox';
$schema['properties']['actor'] = array(
'description' => 'The actor who owns this outbox.',
'type' => 'string',
'format' => 'uri',
'required' => true,
);
$schema['properties']['generator'] = array(
'description' => 'The software used to generate the collection.',
'type' => 'string',
'format' => 'uri',
);
$this->schema = $schema;
return $this->add_additional_fields_schema( $this->schema );
}
/**
* Overload total items for public requests.
*
* For unauthenticated (public) requests, the `totalItems` property shows
* the overall number of federated posts and comments, which is what
* Mastodon expects for display purposes.
*
* For authenticated C2S requests, we skip this override so that totalItems
* accurately reflects the actual outbox collection size.
*
* @param array $response The response array.
* @param \WP_REST_Request $request The request object.
*
* @return array The modified response array.
*/
public function overload_total_items( $response, $request ) {
// For authenticated requests, return accurate totalItems matching orderedItems.
if ( \get_current_user_id() ) {
return $response;
}
$posts = new \WP_Query(
array(
'post_status' => 'publish',
'author' => $request->get_param( 'user_id' ),
// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query
'meta_query' => array(
array(
'key' => 'activitypub_status',
'compare' => 'EXISTS',
),
),
'fields' => 'ids',
'no_found_rows' => false,
'number' => 1,
)
);
$user_id = (int) $request->get_param( 'user_id' );
$comments = new \WP_Comment_Query(
array(
'status' => 'approve',
'user_id' => $user_id,
// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key
'meta_key' => 'activitypub_status',
'fields' => 'ids',
'no_found_rows' => false,
'number' => 1,
'author__not_in' => array( 0 ),
)
);
$response['totalItems'] = (int) $posts->found_posts + (int) $comments->found_comments;
return $response;
}
/**
* Create an item in the outbox.
*
* Fires handlers via filter to process the activity. Handlers are responsible
* for calling add_to_outbox() and returning the outbox_id.
*
* @param \WP_REST_Request $request Full details about the request.
* @return \WP_REST_Response|\WP_Error Response object on success, or WP_Error on failure.
*/
public function create_item( $request ) {
$user_id = $request->get_param( 'user_id' );
$user = Actors::get_by_id( $user_id );
if ( \is_wp_error( $user ) ) {
return $user;
}
$data = $request->get_json_params();
if ( empty( $data ) ) {
return new \WP_Error(
'activitypub_invalid_request',
\__( 'Request body must be a valid ActivityPub object or activity.', 'activitypub' ),
array( 'status' => 400 )
);
}
// Validate ownership - ensure submitted actor matches authenticated user.
$ownership_validation = $this->validate_ownership( $data, $user );
if ( \is_wp_error( $ownership_validation ) ) {
return $ownership_validation;
}
// Determine if this is an Activity or a bare Object.
$type = $data['type'] ?? '';
$is_activity = in_array( $type, Activity::TYPES, true );
// If it's a bare object, wrap it in a Create activity.
if ( ! $is_activity ) {
$data = $this->wrap_in_create( $data, $user );
}
// Resolve language maps (summaryMap, contentMap, nameMap) to plain strings.
$data = $this->localize_language_maps( $data );
// Default to public addressing if client omits recipients.
$data = $this->ensure_addressing( $data, $user );
// Determine visibility from addressing.
$visibility = $this->determine_visibility( $data );
$type = \strtolower( $data['type'] ?? 'create' );
// Validate type against known activity types to prevent hook name pollution.
$allowed_types = \array_map( 'strtolower', Activity::TYPES );
if ( ! \in_array( $type, $allowed_types, true ) ) {
$type = 'create';
}
/**
* Filters the activity to add to outbox.
*
* Handlers can process the activity and return:
* - WP_Post: A WordPress post was created (scheduler adds to outbox)
* - int: An outbox post ID (activity already added to outbox)
* - WP_Error: Stop processing and return error
* - false: Stop processing (activity not allowed)
* - array: Modified activity data (fallback to default handling)
* - Other: No handler processed the activity (fallback to default)
*
* @param array $data The activity data.
* @param int $user_id The user ID.
* @param string $visibility Content visibility.
*/
$result = \apply_filters( 'activitypub_outbox_' . $type, $data, $user_id, $visibility );
if ( \is_wp_error( $result ) ) {
return $result;
}
// Handler returned false to signal "not allowed" or "stop processing".
if ( false === $result ) {
return new \WP_Error(
'activitypub_activity_not_allowed',
\__( 'This activity type is not allowed.', 'activitypub' ),
array( 'status' => 403 )
);
}
$object_id = get_object_id( $result );
if ( $object_id ) {
// Handler returned a WP_Post or WP_Comment; look up its outbox entry.
$activity_type = \ucfirst( $data['type'] ?? 'Create' );
$outbox_item = Outbox::get_by_object_id( $object_id, $activity_type );
} elseif ( \is_int( $result ) && $result > 0 ) {
// Handler returned an outbox post ID directly.
$outbox_item = \get_post( $result );
} else {
// Default handling for raw activities.
$data = \is_array( $result ) ? $result : $data;
$data = $this->ensure_object_id( $data, $user );
$outbox_item = \get_post( add_to_outbox( $data, null, $user_id, $visibility ) );
}
if ( ! $outbox_item ) {
return new \WP_Error(
'activitypub_outbox_error',
\__( 'Failed to add activity to outbox.', 'activitypub' ),
array( 'status' => 500 )
);
}
// Get the stored activity.
$activity = Outbox::get_activity( $outbox_item );
if ( \is_wp_error( $activity ) ) {
return $activity;
}
$result = $activity->to_array( false );
// Return 201 Created with Location header.
$response = new \WP_REST_Response( $result, 201 );
$response->header( 'Location', $result['id'] ?? $outbox_item->guid );
$response->header( 'Content-Type', 'application/activity+json; charset=' . \get_option( 'blog_charset' ) );
return $response;
}
/**
* Wrap a bare object in a Create activity.
*
* @param array $object_data The object data.
* @param mixed $user The user/actor.
* @return array The wrapped Create activity.
*/
private function wrap_in_create( $object_data, $user ) {
// Copy addressing from object to activity.
$addressing = array();
foreach ( array( 'to', 'bto', 'cc', 'bcc', 'audience' ) as $field ) {
if ( ! empty( $object_data[ $field ] ) ) {
$addressing[ $field ] = $object_data[ $field ];
}
}
return array_merge(
array(
'@context' => Base_Object::JSON_LD_CONTEXT,
'type' => 'Create',
'actor' => $user->get_id(),
'object' => $object_data,
),
$addressing
);
}
/**
* Validate that activity actor matches the authenticated user.
*
* Ensures clients cannot submit activities with mismatched actor data.
*
* @param array $data The activity or object data.
* @param \Activitypub\Model\User|null $user The authenticated user.
* @return true|\WP_Error True if valid, WP_Error otherwise.
*/
private function validate_ownership( $data, $user ) {
if ( ! $user ) {
return new \WP_Error(
'activitypub_invalid_user',
\__( 'Invalid user.', 'activitypub' ),
array( 'status' => 400 )
);
}
$user_actor_id = $user->get_id();
// Check activity actor if present.
if ( ! empty( $data['actor'] ) ) {
$actor_id = object_to_uri( $data['actor'] );
if ( $actor_id && $actor_id !== $user_actor_id ) {
return new \WP_Error(
'activitypub_actor_mismatch',
\__( 'Activity actor does not match authenticated user.', 'activitypub' ),
array( 'status' => 403 )
);
}
}
// Check object.attributedTo if present.
$object = $data['object'] ?? $data;
if ( is_array( $object ) && ! empty( $object['attributedTo'] ) ) {
$attributed_to = object_to_uri( $object['attributedTo'] );
if ( $attributed_to && $attributed_to !== $user_actor_id ) {
return new \WP_Error(
'activitypub_attribution_mismatch',
\__( 'Object attributedTo does not match authenticated user.', 'activitypub' ),
array( 'status' => 403 )
);
}
}
return true;
}
/**
* Add default public addressing when the client omits recipients.
*
* Per the ActivityPub spec, the server adds addressing when the client
* does not provide it. Defaults to public with followers in cc.
*
* @since 8.1.0
*
* @param array $data The activity data.
* @param \Activitypub\Activity\Actor $user The authenticated user.
* @return array The activity data with addressing ensured.
*/
private function ensure_addressing( $data, $user ) {
$recipients = extract_recipients_from_activity( $data );
if ( ! empty( $recipients ) ) {
return $data;
}
$data['to'] = array( 'https://www.w3.org/ns/activitystreams#Public' );
$data['cc'] = array( $user->get_followers() );
return $data;
}
/**
* Determine content visibility from activity addressing.
*
* @param array $activity The activity data.
* @return string Visibility constant.
*/
private function determine_visibility( $activity ) {
$public = 'https://www.w3.org/ns/activitystreams#Public';
$to = (array) ( $activity['to'] ?? array() );
$cc = (array) ( $activity['cc'] ?? array() );
// Check if public.
if ( in_array( $public, $to, true ) ) {
return ACTIVITYPUB_CONTENT_VISIBILITY_PUBLIC;
}
// Check if unlisted (public in cc).
if ( in_array( $public, $cc, true ) ) {
return ACTIVITYPUB_CONTENT_VISIBILITY_QUIET_PUBLIC;
}
// Private (no public addressing).
return ACTIVITYPUB_CONTENT_VISIBILITY_PRIVATE;
}
/**
* Ensure the activity object has required fields.
*
* For C2S activities, clients may not provide all required fields.
* The server should fill in attributedTo and published, but object IDs
* should only be set by handlers that create WordPress content.
*
* @param array $data The activity data.
* @param \Activitypub\Model\User|null $user The authenticated user.
* @return array The activity data with required fields ensured.
*/
private function ensure_object_id( $data, $user ) {
// Check if there's an embedded object that needs fields.
if ( ! isset( $data['object'] ) || ! is_array( $data['object'] ) ) {
return $data;
}
$object = &$data['object'];
// Set attributedTo if missing.
if ( empty( $object['attributedTo'] ) && $user ) {
$object['attributedTo'] = $user->get_id();
}
// Set published if missing.
if ( empty( $object['published'] ) ) {
$object['published'] = \gmdate( 'Y-m-d\TH:i:s\Z' );
}
return $data;
}
}