Mastodonを読む/リモートフォローの流れ

  1
  2
  3
  4

-
|
|
|

  resources :accounts, path: 'users', only: [:show], param: :username do
 
    get :remote_follow,  to: 'remote_follow#new'
    post :remote_follow, to: 'remote_follow#create'

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22

-
|
|
-
|
|
|
-
|
|
!
|
|
|
|
|
|
!
|
|
|
!

  def create
    @remote_follow = RemoteFollow.new(resource_params)
 
    if @remote_follow.valid?
      resource          = Goldfinger.finger("acct:#{@remote_follow.acct}")
      redirect_url_link = resource&.link('http://ostatus.org/schema/1.0/subscribe')
 
      if redirect_url_link.nil? || redirect_url_link.template.nil?
        @remote_follow.errors.add(:acct, I18n.t('remote_follow.missing_resource'))
        render(:new) && return
      end
 
      session[:remote_follow] = @remote_follow.acct
 
      redirect_to Addressable::Template.new(redirect_url_link.template).expand(uri: @account.to_webfinger_s).to_s
    else
      render :new
    end
  rescue Goldfinger::Error
    @remote_follow.errors.add(:acct, I18n.t('remote_follow.missing_resource'))
    render :new
  end

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11

-
|
|
|
|
|
|
-
|
!
!

class RemoteFollow
  include ActiveModel::Validations
 
  attr_accessor :acct
 
  validates :acct, presence: true
 
  def initialize(attrs = {})
    @acct = attrs[:acct].strip unless attrs[:acct].nil?
  end
end

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31

-
|
!
 
-
-
|
|
|
!
!
 
-
|
!
 
-
|
!
 
-
|
!
 
-
|
!
 
-
|
!

  def show
    @account = located_account || render(:error)
  end
 
  def located_account
    if acct_param_is_url?
      account_from_remote_fetch
    else
      account_from_remote_follow
    end
  end
 
  def acct_param_is_url?
    parsed_uri.path && %w[http https].include?(parsed_uri.scheme)
  end
 
  def parsed_uri
    Addressable::URI.parse(acct_without_prefix).normalize
  end
 
  def acct_without_prefix
    acct_params.gsub(/\Aacct:/, '')
  end
 
  def acct_params
    params.fetch(:acct, '')
  end
 
  def account_from_remote_follow
    FollowRemoteAccountService.new.call(acct_without_prefix)
  end

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12

-
|
|
|
|
-
|
|
|
|
|
|

  # Find or create a local account for a remote user.
  # When creating, look up the user's webfinger and fetch all
  # important information from their feed
  # @param [String] uri User URI in the form of username@domain
  # @return [Account]
  def call(uri, redirected = nil)
    username, domain = uri.split('@')
 
    return Account.find_local(username) if TagManager.instance.local_domain?(domain)
 
    account = Account.find_remote(username, domain)
    return account unless account_needs_webfinger_update?(account)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31

 
 
 
 
 
 
 
 
 
-
!
 
-
|
|
!
 
 
 
 
-
|
|
|
|
|
|
|
|
|
!

    Rails.logger.debug "Looking up webfinger for #{uri}"
 
    data = Goldfinger.finger("acct:#{uri}")
 
    raise Goldfinger::Error, 'Missing resource links' if data.link('http://schemas.google.com/g/2010#updates-from').nil? || 
      data.link('salmon').nil? || 
      data.link('http://webfinger.net/rel/profile-page').nil? || 
      data.link('magic-public-key').nil?
 
    # Disallow account hijacking
    confirmed_username, confirmed_domain = data.subject.gsub(/\Aacct:/, '').split('@')
 
    unless confirmed_username.casecmp(username).zero? && confirmed_domain.casecmp(domain).zero?
      return call("#{confirmed_username}@#{confirmed_domain}", true) if redirected.nil?
      raise Goldfinger::Error, 'Requested and returned acct URI do not match'
    end
 
    return Account.find_local(confirmed_username) if TagManager.instance.local_domain?(confirmed_domain)
 
    confirmed_account = Account.find_remote(confirmed_username, confirmed_domain)
    if confirmed_account.nil?
      Rails.logger.debug "Creating new remote account for #{uri}"
 
      domain_block = DomainBlock.find_by(domain: domain)
      account = Account.new(username: confirmed_username, domain: confirmed_domain)
      account.suspended   = true if domain_block && domain_block.suspend?
      account.silenced    = true if domain_block && domain_block.silence?
      account.private_key = nil
    else
      account = confirmed_account
    end

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18

    account.last_webfingered_at = Time.now.utc
 
    account.remote_url  = data.link('http://schemas.google.com/g/2010#updates-from').href
    account.salmon_url  = data.link('salmon').href
    account.url         = data.link('http://webfinger.net/rel/profile-page').href
    account.public_key  = magic_key_to_pem(data.link('magic-public-key').href)
 
    body, xml = get_feed(account.remote_url)
    hubs      = get_hubs(xml)
 
    account.uri     = get_account_uri(xml)
    account.hub_url = hubs.first.attribute('href').value
 
    account.save!
    get_profile(body, account)
 
    account
  end

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17

-
|
|
-
|
|
|
!
|
|
!
 
 
 
-
|
!

  def create
    @account = follow_attempt.try(:target_account)
 
    if @account.nil?
      render :error
    else
      redirect_to web_url("accounts/#{@account.id}")
    end
  rescue ActiveRecord::RecordNotFound, Mastodon::NotPermittedError
    render :error
  end
 
  private
 
  def follow_attempt
    FollowService.new.call(current_account, acct_without_prefix)
  end

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18

-
|
|
-
|
|
-
|
|
|
|
|
-
|
|
|
!
!

class FollowService < BaseService
  include StreamEntryRenderer
 
  # Follow a remote user, notify remote user about the follow
  # @param [Account] source_account From which to follow
  # @param [String] uri User URI to follow in the form of username@domain
  def call(source_account, uri)
    target_account = FollowRemoteAccountService.new.call(uri)
 
    raise ActiveRecord::RecordNotFound if target_account.nil? || target_account.id == source_account.id || target_account.suspended?
    raise Mastodon::NotPermittedError  if target_account.blocking?(source_account) || source_account.blocking?(target_account)
 
    if target_account.locked?
      request_follow(source_account, target_account)
    else
      direct_follow(source_account, target_account)
    end
  end

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15

-
|
|
-
|
|
|
|
|
!
|
|
|
|
!

  def direct_follow(source_account, target_account)
    follow = source_account.follow!(target_account)
 
    if target_account.local?
      NotifyService.new.call(target_account, follow)
    else
      Pubsubhubbub::SubscribeWorker.perform_async(target_account.id) unless target_account.subscribed?
      NotificationWorker.perform_async(build_follow_xml(follow), source_account.id, target_account.id)
      AfterRemoteFollowWorker.perform_async(follow.id)
    end
 
    MergeWorker.perform_async(target_account.id, source_account.id)
 
    follow
  end

  1
  2
  3
  4
  5
  6
  7
  8
  9

-
|
|
|
|
-
|
!
!

class NotificationWorker
  include Sidekiq::Worker
 
  sidekiq_options queue: 'push', retry: 5
 
  def perform(xml, source_account_id, target_account_id)
    SendInteractionService.new.call(xml, Account.find(source_account_id), Account.find(target_account_id))
  end
end

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16

-
-
|
|
|
-
|
|
!
|
|
|
-
|
!
!

class SendInteractionService < BaseService
  # Send an Atom representation of an interaction to a remote Salmon endpoint
  # @param [String] Entry XML
  # @param [Account] source_account
  # @param [Account] target_account
  def call(xml, source_account, target_account)
    envelope = salmon.pack(xml, source_account.keypair)
    salmon.post(target_account.salmon_url, envelope)
  end
 
  private
 
  def salmon
    @salmon ||= OStatus2::Salmon.new
  end
end

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14

-
|
|
|
-
|
|
-
|
|
|
|
!
!

class Api::SalmonController < ApiController
  before_action :set_account
  respond_to :txt
 
  def update
    payload = request.body.read
 
    if !payload.nil? && verify?(payload)
      SalmonWorker.perform_async(@account.id, payload.force_encoding('UTF-8'))
      head 201
    else
      head 202
    end
  end

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11

-
|
|
|
|
-
|
|
|
!
!

class SalmonWorker
  include Sidekiq::Worker
 
  sidekiq_options backtrace: true
 
  def perform(account_id, body)
    ProcessInteractionService.new.call(body, Account.find(account_id))
  rescue Nokogiri::XML::XPath::SyntaxError, ActiveRecord::RecordNotFound
    true
  end
end

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22

-
|
|
-
|
|
-
|
|
|
|
|
|
|
|
|
-
|
|
|
|
|

class ProcessInteractionService < BaseService
  include AuthorExtractor
 
  # Record locally the remote interaction with our user
  # @param [String] envelope Salmon envelope
  # @param [Account] target_account Account the Salmon was addressed to
  def call(envelope, target_account)
    body = salmon.unpack(envelope)
 
    xml = Nokogiri::XML(body)
    xml.encoding = 'utf-8'
 
    account = author_from_xml(xml.at_xpath('/xmlns:entry', xmlns: TagManager::XMLNS))
 
    return if account.nil? || account.suspended?
 
    if salmon.verify(envelope, account.keypair)
      RemoteProfileUpdateWorker.perform_async(account.id, body.force_encoding('UTF-8'), true)
 
      case verb(xml)
      when :follow
        follow!(account, target_account) unless target_account.locked? || target_account.blocking?(account)