webfinger: 404 requests for web users with unknown username

ie username doesn't match domain or mf2 custom username

fixes #1025

tests/test_webfinger.py

@@ -168,7 +168,7 @@ class WebfingerTest(TestCase):
         })
 
     def test_webfinger(self):
-        for resource in ('user.com@user.com', 'acct:user.com@user.com', 'xyz@user.com',
+        for resource in ('user.com@user.com', 'acct:user.com@user.com',
                          'user.com', 'http://user.com/', 'https://user.com/',
                          'http://localhost/user.com'):
             with self.subTest(resource=resource):
@@ -308,6 +308,20 @@ class WebfingerTest(TestCase):
         got = self.client.get(f'/.well-known/webfinger?resource=acct:user.com@user.com')
         self.assertEqual(404, got.status_code)
 
+    def test_user_not_custom_username(self):
+        for base_url in (None, 'https://web.brid.gy/', 'https://fed.brid.gy/'):
+            with self.subTest(base_url=base_url):
+                got = self.client.get(
+                    f'/.well-known/webfinger?resource=acct:foo@user.com',
+                    base_url=base_url)
+                self.assertEqual(404, got.status_code)
+
+    def test_missing_user_web_subdomain(self):
+        self.user.direct = False
+        self.user.put()
+        got = self.client.get(f'/.well-known/webfinger?resource=acct:foo@bar.com')
+        self.assertEqual(404, got.status_code)
+
     def test_protocol_not_enabled(self):
         self.make_user('eefake:user', cls=ExplicitEnableFake)
         got = self.client.get(f'/.well-known/webfinger?resource=acct:eefake:user@eefake.brid.gy')

webfinger.py

@@ -59,13 +59,14 @@ class Webfinger(flask_util.XrdOrJrd):
         allow_indirect = False
         cls = None
         try:
-            user, id = util.parse_acct_uri(resource)
+            username, server = util.parse_acct_uri(resource)
+            id = server
             cls = Protocol.for_bridgy_subdomain(id, fed='web')
             if cls:
-                id = user
+                id = username
                 allow_indirect = True
         except ValueError:
-            id = urlparse(resource).netloc or resource
+            id = username = server = urlparse(resource).netloc or resource
 
         if id == PRIMARY_DOMAIN or id in PROTOCOL_DOMAINS:
             cls = Web
@@ -98,7 +99,9 @@ class Webfinger(flask_util.XrdOrJrd):
             if user and not user.direct:
                 error(f"{user.key} hasn't signed up yet", status=404)
 
-        if not user or not user.is_enabled(activitypub.ActivityPub):
+        if (not user
+                or not user.is_enabled(activitypub.ActivityPub)
+                or (cls == Web and username not in (user.key.id(), user.username()))):
             error(f'No {cls.LABEL} user found for {id}', status=404)
 
         ap_handle = user.handle_as('activitypub')