47f4e723e2
build(deps): bump wrapt from 1.14.1 to 1.15.0
...
Bumps [wrapt](https://github.com/GrahamDumpleton/wrapt ) from 1.14.1 to 1.15.0.
- [Release notes](https://github.com/GrahamDumpleton/wrapt/releases )
- [Changelog](https://github.com/GrahamDumpleton/wrapt/blob/develop/docs/changes.rst )
- [Commits](https://github.com/GrahamDumpleton/wrapt/compare/1.14.1...1.15.0 )
---
updated-dependencies:
- dependency-name: wrapt
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2023-02-27 04:59:52 -08:00
c38de255a4
build(deps): bump praw from 7.6.1 to 7.7.0
...
Bumps [praw](https://github.com/praw-dev/praw ) from 7.6.1 to 7.7.0.
- [Release notes](https://github.com/praw-dev/praw/releases )
- [Changelog](https://github.com/praw-dev/praw/blob/master/CHANGES.rst )
- [Commits](https://github.com/praw-dev/praw/compare/v7.6.1...v7.7.0 )
---
updated-dependencies:
- dependency-name: praw
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2023-02-27 04:59:26 -08:00
9d735399cb
circle config: switch to installing gcloud from static archive
...
temporarily, while GCP's apt repo's PGP key is 500ing
https://packages.cloud.google.com/apt/doc/apt-key.gpg
https://issuetracker.google.com/issues/160194366
https://app.circleci.com/pipelines/github/snarfed/bridgy-fed/837/workflows/47e2aeb4-bf9f-4260-83ea-92310120c5e8/jobs/1099
2023-02-26 21:52:38 -06:00
0235d31a1c
noop: activitypub.py: extract sig verif out into a new verify_signature() fn
2023-02-26 20:41:57 -06:00
116cd55ddb
finally start actually requiring HTTP Signatures
...
fixes #315
2023-02-26 07:34:15 -06:00
150f2ec5fe
webmention.py: noop refactoring, drop self.source_domain
2023-02-25 21:41:57 -06:00
aa483ded0b
Object.type and object_ids fixes to handle missing as1
...
fixes https://console.cloud.google.com/errors/detail/CJ-U7Zq_s4bxgwE;time=P30D?project=bridgy-federated
2023-02-24 21:59:12 -06:00
42c648284d
noop TODO comment
2023-02-24 11:51:24 -06:00
7bb9785327
fix log message for Object.as2 vs mf2 vs bluesky
2023-02-24 11:48:48 -06:00
76927ee487
Object.as1: temporarily demote assert to warning log
2023-02-24 10:02:06 -06:00
5463a74e7e
switch Object.as1 to custom ComputedJsonProperty
2023-02-24 08:25:18 -06:00
fd27dabe61
switch JSON properties to custom JSONProperty that works in web console UI
...
https://github.com/googleapis/python-ndb/issues/874#issuecomment-1442753255
2023-02-24 07:25:29 -06:00
91a60c7e67
switch Object.as1 to be a ComputedProperty
2023-02-23 21:17:26 -06:00
1f3bd41dc5
common.redirect_unwrap: stop following redirects when unwrapping actor URLs
2023-02-23 08:35:06 -06:00
74b3b3b689
refactoring, move Object creation out of common.send_webmentions
...
ugh this was painful
2023-02-23 07:44:54 -06:00
6500f71d3f
switch bluesky XRPCs to serve from datastore
...
fixes #421
2023-02-23 07:39:50 -06:00
3d3335e860
AP => webmention repost bug fix, merge follower and wm domains
2023-02-23 07:39:26 -06:00
c2fc13a10c
build(deps): bump grpcio from 1.51.1 to 1.51.3
...
Bumps [grpcio](https://github.com/grpc/grpc ) from 1.51.1 to 1.51.3.
- [Release notes](https://github.com/grpc/grpc/releases )
- [Changelog](https://github.com/grpc/grpc/blob/master/doc/grpc_release_schedule.md )
- [Commits](https://github.com/grpc/grpc/compare/v1.51.1...v1.51.3 )
---
updated-dependencies:
- dependency-name: grpcio
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2023-02-22 04:16:36 -08:00
4982906ed8
AP => webmention, reposts: handle loading original federated posts
...
bug fix for 72eb26e248
2023-02-21 21:57:38 -06:00
72eb26e248
AP => webmention, bug fix for sending webmentions for reposts
...
thanks to @tantek for reporting!
2023-02-21 21:19:56 -06:00
88db2afce3
follow/unfollow UI: store IndieAuth in session cookie
...
fixes #416
2023-02-17 16:12:25 -08:00
e31be9b955
webfinger: minor noop simplification
2023-02-16 20:29:41 -08:00
d1691b65c5
Object post put hook: don't add fragment ids to the common.get_object cache
2023-02-16 12:21:27 -08:00
c540a8bee8
add test that Object put hook clears common.get_object cache
2023-02-16 08:21:56 -08:00
65bbc6751e
HTTP Signature verification: bug fix, use actual HTTP method
2023-02-16 07:34:12 -08:00
8f03c0aad3
build(deps): bump flask from 2.2.2 to 2.2.3
...
Bumps [flask](https://github.com/pallets/flask ) from 2.2.2 to 2.2.3.
- [Release notes](https://github.com/pallets/flask/releases )
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst )
- [Commits](https://github.com/pallets/flask/compare/2.2.2...2.2.3 )
---
updated-dependencies:
- dependency-name: flask
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2023-02-16 05:00:34 -08:00
d505b3859a
HTTP Signature verification: fetch and use keyId from signature
...
#315
2023-02-15 20:10:17 -08:00
48a7720f88
common.get_object: normalize ids by removing fragments
...
this is still underspecified and a bit inconsistent across fediverse implementations:
https://socialhub.activitypub.rocks/t/problems-posting-to-mastodon-inbox/801/11
> The reason might also be that your IDs aren’t permanent, as in, they contain a #fragment. Posts and their corresponding Create activities are supposed to be resolvable — which means one should be able to send a GET request to the ID URL and get the object back. This can’t be done with an URL that contains a fragment as the fragment is not a part of the HTTP exchange, it’s processed on the client.
https://socialhub.activitypub.rocks/t/problems-posting-to-mastodon-inbox/801/23
> I ran into this object id #fragment problem as well. It seems because of some URL normalization, Mastodon will remove the fragment, and drop any additional posts with different fragments (because they become the same url).
https://socialhub.activitypub.rocks/t/s2s-create-activity/1647/5
https://github.com/mastodon/mastodon/issues/13879 (open!)
https://github.com/w3c/activitypub/issues/224
nothing in the http sig spec, example key ids aren't even URLs there:
https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-message-signatures-16
2023-02-15 20:00:12 -08:00
e1560587bf
AP: rearrange HTTP Signature logging
...
#315
2023-02-15 15:48:12 -08:00
a7e96f585c
HTTP sig verification test: switch from assertLogs to mock
...
assertLogs was great, but didn't work when logging was disabled, eg by oauth_dropins.webutil.tests.__init__.py for python -m unittest discover.
I tried hard to override that and make it work, example code below, but couldn't get it to work. assertLogs() evidently needs a real handler, eg not NullHandler, but the default stderr stream handler that basicConfig() adds obviously emits to stderr.
print('@', logging.getLogger().hasHandlers())
logging_handlers = list(logging.getLogger().handlers)
logging.getLogger().handlers = []
logging_suppressed = logging.getLogger().isEnabledFor(logging.INFO)
logging.disable(logging.NOTSET)
handler = logging.NullHandler()
logging.getLogger().addHandler(handler)
activitypub.logger.disable(logging.NOTSET)
logging.getLogger().handlers = logging_handlers
logging.getLogger().removeHandler(handler)
if not logging_suppressed:
logging.disable(logging.CRITICAL + 1)
2023-02-15 14:10:25 -08:00
e5d3f94b3e
AP signature verification: just log for now, don't fail
...
for #315
2023-02-15 14:10:25 -08:00
63d0e59c2c
AP: verify incoming signatures!
...
for #315
2023-02-15 14:10:25 -08:00
ebcc3a0584
build(deps): bump werkzeug from 2.2.2 to 2.2.3
...
Bumps [werkzeug](https://github.com/pallets/werkzeug ) from 2.2.2 to 2.2.3.
- [Release notes](https://github.com/pallets/werkzeug/releases )
- [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst )
- [Commits](https://github.com/pallets/werkzeug/compare/2.2.2...2.2.3 )
---
updated-dependencies:
- dependency-name: werkzeug
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2023-02-15 05:00:50 -08:00
482c9b2966
build(deps): bump soupsieve from 2.3.2.post1 to 2.4
...
Bumps [soupsieve](https://github.com/facelessuser/soupsieve ) from 2.3.2.post1 to 2.4.
- [Release notes](https://github.com/facelessuser/soupsieve/releases )
- [Commits](https://github.com/facelessuser/soupsieve/compare/2.3.2.post1...2.4 )
---
updated-dependencies:
- dependency-name: soupsieve
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2023-02-15 05:00:28 -08:00
e423bde6d0
unify logging for writing datastore entities into post put hook
...
and other logging tweaks
2023-02-14 15:38:42 -08:00
47b83c4e51
common.get_object: update existing object if available
2023-02-14 15:26:25 -08:00
f44aa3b39e
common.get_object: fall back to HTTP fetch if stored entity has no as2
...
also add more logging
2023-02-14 15:17:03 -08:00
588598c5ff
switch most uses of common.get_as2 to common.get_object
2023-02-14 14:56:27 -08:00
c2e6174330
add common.get_object()
2023-02-14 14:30:00 -08:00
a71cb31cff
deps: upgrade cachetools to 5.3.0
2023-02-14 13:59:41 -08:00
cc77f48b30
precompute "user not found" 404 page
...
...since we get a ton of requests for non-existing users from weird open redirect referrers: #422
2023-02-14 12:52:14 -08:00
c12bb6db6d
serve AS2 /[domain] actors from datastore instead of refetching h-card
...
for #392 . not pretty, but gets the job done. more code cleanup needed eventually.
2023-02-14 08:25:41 -08:00
d64e5e875e
test_webmention: drop unused atom test data
2023-02-14 07:40:37 -08:00
6446c8c421
convert Object.type and .object_ids to ComputedPropertys
...
https://googleapis.dev/python/python-ndb/latest/model.html#google.cloud.ndb.model.ComputedProperty
2023-02-13 21:43:49 -08:00
46ab1cfdf7
AP inbox: simplify already-seen-id handling
2023-02-13 19:10:01 -08:00
6f91a2538d
AP inbox delivery: drop same-domain targets from Objects
2023-02-13 11:28:02 -08:00
e39a92cee2
optimize AP inbox delivery by moving user load back further down
2023-02-13 11:25:33 -08:00
c305dcc8d5
AP inbox delivery: cache activity ids that we've already seen in memory
...
for #411
2023-02-12 22:17:04 -08:00
7a625c5a02
AP inbox delivery: short circuit out if we've already seen the activity id
...
for #411 . next is caching in memory.
2023-02-12 21:58:59 -08:00
f39c532ad3
add User.homepage, is_homepage()
2023-02-12 12:03:27 -08:00
dependabot[bot]