mirrors/barkey
1
0
Fork 0
mirror of https://codeberg.org/yeentown/barkey.git synced 2025-10-31 05:24:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request 'Update stable with new changes' (#24) from dev into stable

Browse source 
Reviewed-on: https://codeberg.org/yeentown/barkey/pulls/24
This commit is contained in:
zima 2024-12-06 19:15:16 +00:00
commit 9a0d37ebad
265 changed files with 3327 additions and 161 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
package.json
View file

@ -1,6 +1,6 @@
{
"name": "sharkey",
"version": "2024.9.2",
"version": "2024.9.4",
"codename": "shonk",
"repository": {
"type": "git",

22
packages/backend/src/core/DownloadService.ts
View file

@ -6,7 +6,6 @@
import * as fs from 'node:fs';
import * as stream from 'node:stream/promises';
import { Inject, Injectable } from '@nestjs/common';
import ipaddr from 'ipaddr.js';
import chalk from 'chalk';
import got, * as Got from 'got';
import { parse } from 'content-disposition';
@ -70,13 +69,6 @@ export class DownloadService {
},
enableUnixSockets: false,
}).on('response', (res: Got.Response) => {
if ((process.env.NODE_ENV === 'production' || process.env.NODE_ENV === 'test') && !this.config.proxy && res.ip) {
if (this.isPrivateIp(res.ip)) {
this.logger.warn(`Blocked address: ${res.ip}`);
req.destroy();
}
}
const contentLength = res.headers['content-length'];
if (contentLength != null) {
const size = Number(contentLength);
@ -139,18 +131,4 @@ export class DownloadService {
cleanup();
}
}
@bindThis
private isPrivateIp(ip: string): boolean {
const parsedIp = ipaddr.parse(ip);
for (const net of this.config.allowedPrivateNetworks ?? []) {
const cidr = ipaddr.parseCIDR(net);
if (cidr[0].kind() === parsedIp.kind() && parsedIp.match(ipaddr.parseCIDR(net))) {
return false;
}
}
return parsedIp.range() !== 'unicast';
}
}

1
packages/backend/src/core/EmailService.ts
View file

@ -312,6 +312,7 @@ export class EmailService {
Accept: 'application/json',
Authorization: truemailAuthKey,
},
isLocalAddressAllowed: true,
});
const json = (await res.json()) as {

136
packages/backend/src/core/HttpRequestService.ts
View file

@ -6,6 +6,7 @@
import * as http from 'node:http';
import * as https from 'node:https';
import * as net from 'node:net';
import ipaddr from 'ipaddr.js';
import CacheableLookup from 'cacheable-lookup';
import fetch from 'node-fetch';
import { HttpProxyAgent, HttpsProxyAgent } from 'hpagent';
@ -25,8 +26,102 @@ export type HttpRequestSendOptions = {
validators?: ((res: Response) => void)[];
};
declare module 'node:http' {
interface Agent {
createConnection(options: net.NetConnectOpts, callback?: (err: unknown, stream: net.Socket) => void): net.Socket;
}
}
class HttpRequestServiceAgent extends http.Agent {
constructor(
private config: Config,
options?: http.AgentOptions,
) {
super(options);
}
@bindThis
public createConnection(options: net.NetConnectOpts, callback?: (err: unknown, stream: net.Socket) => void): net.Socket {
const socket = super.createConnection(options, callback)
.on('connect', () => {
const address = socket.remoteAddress;
if (process.env.NODE_ENV === 'production') {
if (address && ipaddr.isValid(address)) {
if (this.isPrivateIp(address)) {
socket.destroy(new Error(`Blocked address: ${address}`));
}
}
}
});
return socket;
}
@bindThis
private isPrivateIp(ip: string): boolean {
const parsedIp = ipaddr.parse(ip);
for (const net of this.config.allowedPrivateNetworks ?? []) {
const cidr = ipaddr.parseCIDR(net);
if (cidr[0].kind() === parsedIp.kind() && parsedIp.match(ipaddr.parseCIDR(net))) {
return false;
}
}
return parsedIp.range() !== 'unicast';
}
}
class HttpsRequestServiceAgent extends https.Agent {
constructor(
private config: Config,
options?: https.AgentOptions,
) {
super(options);
}
@bindThis
public createConnection(options: net.NetConnectOpts, callback?: (err: unknown, stream: net.Socket) => void): net.Socket {
const socket = super.createConnection(options, callback)
.on('connect', () => {
const address = socket.remoteAddress;
if (process.env.NODE_ENV === 'production') {
if (address && ipaddr.isValid(address)) {
if (this.isPrivateIp(address)) {
socket.destroy(new Error(`Blocked address: ${address}`));
}
}
}
});
return socket;
}
@bindThis
private isPrivateIp(ip: string): boolean {
const parsedIp = ipaddr.parse(ip);
for (const net of this.config.allowedPrivateNetworks ?? []) {
const cidr = ipaddr.parseCIDR(net);
if (cidr[0].kind() === parsedIp.kind() && parsedIp.match(ipaddr.parseCIDR(net))) {
return false;
}
}
return parsedIp.range() !== 'unicast';
}
}
@Injectable()
export class HttpRequestService {
/**
* Get http non-proxy agent (without local address filtering)
*/
private httpNative: http.Agent;
/**
* Get https non-proxy agent (without local address filtering)
*/
private httpsNative: https.Agent;
/**
* Get http non-proxy agent
*/
@ -57,19 +152,20 @@ export class HttpRequestService {
lookup: false, // nativeのdns.lookupにfallbackしない
});
this.http = new http.Agent({
const agentOption = {
keepAlive: true,
keepAliveMsecs: 30 * 1000,
lookup: cache.lookup as unknown as net.LookupFunction,
localAddress: config.outgoingAddress,
});
};
this.https = new https.Agent({
keepAlive: true,
keepAliveMsecs: 30 * 1000,
lookup: cache.lookup as unknown as net.LookupFunction,
localAddress: config.outgoingAddress,
});
this.httpNative = new http.Agent(agentOption);
this.httpsNative = new https.Agent(agentOption);
this.http = new HttpRequestServiceAgent(config, agentOption);
this.https = new HttpsRequestServiceAgent(config, agentOption);
const maxSockets = Math.max(256, config.deliverJobConcurrency ?? 128);
@ -104,16 +200,22 @@ export class HttpRequestService {
* @param bypassProxy Allways bypass proxy
*/
@bindThis
public getAgentByUrl(url: URL, bypassProxy = false): http.Agent | https.Agent {
public getAgentByUrl(url: URL, bypassProxy = false, isLocalAddressAllowed = false): http.Agent | https.Agent {
if (bypassProxy || (this.config.proxyBypassHosts ?? []).includes(url.hostname)) {
if (isLocalAddressAllowed) {
return url.protocol === 'http:' ? this.httpNative : this.httpsNative;
}
return url.protocol === 'http:' ? this.http : this.https;
} else {
if (isLocalAddressAllowed && (!this.config.proxy)) {
return url.protocol === 'http:' ? this.httpNative : this.httpsNative;
}
return url.protocol === 'http:' ? this.httpAgent : this.httpsAgent;
}
}
@bindThis
public async getActivityJson(url: string): Promise<IObject> {
public async getActivityJson(url: string, isLocalAddressAllowed = false): Promise<IObject> {
const res = await this.send(url, {
method: 'GET',
headers: {
@ -121,6 +223,7 @@ export class HttpRequestService {
},
timeout: 5000,
size: 1024 * 256,
isLocalAddressAllowed: isLocalAddressAllowed,
}, {
throwErrorWhenResponseNotOk: true,
validators: [validateContentTypeSetAsActivityPub],
@ -129,13 +232,13 @@ export class HttpRequestService {
const finalUrl = res.url; // redirects may have been involved
const activity = await res.json() as IObject;
assertActivityMatchesUrls(activity, [url, finalUrl]);
assertActivityMatchesUrls(activity, [finalUrl]);
return activity;
}
@bindThis
public async getJson<T = unknown>(url: string, accept = 'application/json, */*', headers?: Record<string, string>): Promise<T> {
public async getJson<T = unknown>(url: string, accept = 'application/json, */*', headers?: Record<string, string>, isLocalAddressAllowed = false): Promise<T> {
const res = await this.send(url, {
method: 'GET',
headers: Object.assign({
@ -143,19 +246,21 @@ export class HttpRequestService {
}, headers ?? {}),
timeout: 5000,
size: 1024 * 256,
isLocalAddressAllowed: isLocalAddressAllowed,
});
return await res.json() as T;
}
@bindThis
public async getHtml(url: string, accept = 'text/html, */*', headers?: Record<string, string>): Promise<string> {
public async getHtml(url: string, accept = 'text/html, */*', headers?: Record<string, string>, isLocalAddressAllowed = false): Promise<string> {
const res = await this.send(url, {
method: 'GET',
headers: Object.assign({
Accept: accept,
}, headers ?? {}),
timeout: 5000,
isLocalAddressAllowed: isLocalAddressAllowed,
});
return await res.text();
@ -170,6 +275,7 @@ export class HttpRequestService {
headers?: Record<string, string>,
timeout?: number,
size?: number,
isLocalAddressAllowed?: boolean,
} = {},
extra: HttpRequestSendOptions = {
throwErrorWhenResponseNotOk: true,
@ -183,6 +289,8 @@ export class HttpRequestService {
controller.abort();
}, timeout);
const isLocalAddressAllowed = args.isLocalAddressAllowed ?? false;
const res = await fetch(url, {
method: args.method ?? 'GET',
headers: {
@ -191,7 +299,7 @@ export class HttpRequestService {
},
body: args.body,
size: args.size ?? 10 * 1024 * 1024,
agent: (url) => this.getAgentByUrl(url),
agent: (url) => this.getAgentByUrl(url, false, isLocalAddressAllowed),
signal: controller.signal,
});

2
packages/backend/src/core/RemoteUserResolveService.ts
View file

@ -56,7 +56,7 @@ export class RemoteUserResolveService {
host = this.utilityService.toPuny(host);
if (this.config.host === host) {
if (host === this.utilityService.toPuny(this.config.host)) {
this.logger.info(`return local user: ${usernameLower}`);
return await this.usersRepository.findOneBy({ usernameLower, host: IsNull() }).then(u => {
if (u == null) {

5
packages/backend/src/core/UtilityService.ts
View file

@ -34,6 +34,11 @@ export class UtilityService {
return this.toPuny(this.config.host) === this.toPuny(host);
}
@bindThis
public isUriLocal(uri: string): boolean {
return this.punyHost(uri) === this.toPuny(this.config.host);
}
@bindThis
public isBlockedHost(blockedHosts: string[], host: string | null): boolean {
if (host == null) return false;

6
packages/backend/src/core/activitypub/ApDbResolverService.ts
View file

@ -10,6 +10,7 @@ import type { Config } from '@/config.js';
import { MemoryKVCache } from '@/misc/cache.js';
import type { MiUserPublickey } from '@/models/UserPublickey.js';
import { CacheService } from '@/core/CacheService.js';
import { UtilityService } from '@/core/UtilityService.js';
import type { MiNote } from '@/models/Note.js';
import { bindThis } from '@/decorators.js';
import type { MiLocalUser, MiRemoteUser } from '@/models/User.js';
@ -55,6 +56,7 @@ export class ApDbResolverService implements OnApplicationShutdown {
private cacheService: CacheService,
private apPersonService: ApPersonService,
private apLoggerService: ApLoggerService,
private utilityService: UtilityService,
) {
this.publicKeyCache = new MemoryKVCache<MiUserPublickey | null>(1000 * 60 * 60 * 12); // 12h
this.publicKeyByUserIdCache = new MemoryKVCache<MiUserPublickey | null>(1000 * 60 * 60 * 12); // 12h
@ -65,7 +67,9 @@ export class ApDbResolverService implements OnApplicationShutdown {
const separator = '/';
const uri = new URL(getApId(value));
if (uri.origin !== this.config.url) return { local: false, uri: uri.href };
if (this.utilityService.toPuny(uri.host) !== this.utilityService.toPuny(this.config.host)) {
return { local: false, uri: uri.href };
}
const [, type, id, ...rest] = uri.pathname.split(separator);
return {

97
packages/backend/src/core/activitypub/ApInboxService.ts
View file

@ -93,15 +93,26 @@ export class ApInboxService {
}
@bindThis
public async performActivity(actor: MiRemoteUser, activity: IObject): Promise<string | void> {
public async performActivity(actor: MiRemoteUser, activity: IObject, resolver?: Resolver): Promise<string | void> {
let result = undefined as string | void;
if (isCollectionOrOrderedCollection(activity)) {
const results = [] as [string, string | void][];
const resolver = this.apResolverService.createResolver();
for (const item of toArray(isCollection(activity) ? activity.items : activity.orderedItems)) {
// eslint-disable-next-line no-param-reassign
resolver ??= this.apResolverService.createResolver();
const items = toArray(isCollection(activity) ? activity.items : activity.orderedItems);
if (items.length >= resolver.getRecursionLimit()) {
throw new Error(`skipping activity: collection would surpass recursion limit: ${this.utilityService.extractDbHost(actor.uri)}`);
}
for (const item of items) {
const act = await resolver.resolve(item);
if (act.id == null || this.utilityService.extractDbHost(act.id) !== this.utilityService.extractDbHost(actor.uri)) {
this.logger.debug('skipping activity: activity id is null or mismatching');
continue;
}
try {
results.push([getApId(item), await this.performOneActivity(actor, act)]);
results.push([getApId(item), await this.performOneActivity(actor, act, resolver)]);
} catch (err) {
if (err instanceof Error || typeof err === 'string') {
this.logger.error(err);
@ -116,7 +127,7 @@ export class ApInboxService {
result = results.map(([id, reason]) => `${id}: ${reason}`).join('\n');
}
} else {
result = await this.performOneActivity(actor, activity);
result = await this.performOneActivity(actor, activity, resolver);
}
// ついでにリモートユーザーの情報が古かったら更新しておく
@ -131,37 +142,37 @@ export class ApInboxService {
}
@bindThis
public async performOneActivity(actor: MiRemoteUser, activity: IObject): Promise<string | void> {
public async performOneActivity(actor: MiRemoteUser, activity: IObject, resolver?: Resolver): Promise<string | void> {
if (actor.isSuspended) return;
if (isCreate(activity)) {
return await this.create(actor, activity);
return await this.create(actor, activity, resolver);
} else if (isDelete(activity)) {
return await this.delete(actor, activity);
} else if (isUpdate(activity)) {
return await this.update(actor, activity);
return await this.update(actor, activity, resolver);
} else if (isFollow(activity)) {
return await this.follow(actor, activity);
} else if (isAccept(activity)) {
return await this.accept(actor, activity);
return await this.accept(actor, activity, resolver);
} else if (isReject(activity)) {
return await this.reject(actor, activity);
return await this.reject(actor, activity, resolver);
} else if (isAdd(activity)) {
return await this.add(actor, activity);
return await this.add(actor, activity, resolver);
} else if (isRemove(activity)) {
return await this.remove(actor, activity);
return await this.remove(actor, activity, resolver);
} else if (isAnnounce(activity)) {
return await this.announce(actor, activity);
return await this.announce(actor, activity, resolver);
} else if (isLike(activity)) {
return await this.like(actor, activity);
} else if (isUndo(activity)) {
return await this.undo(actor, activity);
return await this.undo(actor, activity, resolver);
} else if (isBlock(activity)) {
return await this.block(actor, activity);
} else if (isFlag(activity)) {
return await this.flag(actor, activity);
} else if (isMove(activity)) {
return await this.move(actor, activity);
return await this.move(actor, activity, resolver);
} else {
return `unrecognized activity type: ${activity.type}`;
}
@ -203,12 +214,13 @@ export class ApInboxService {
}
@bindThis
private async accept(actor: MiRemoteUser, activity: IAccept): Promise<string> {
private async accept(actor: MiRemoteUser, activity: IAccept, resolver?: Resolver): Promise<string> {
const uri = activity.id ?? activity;
this.logger.info(`Accept: ${uri}`);
const resolver = this.apResolverService.createResolver();
// eslint-disable-next-line no-param-reassign
resolver ??= this.apResolverService.createResolver();
const object = await resolver.resolve(activity.object).catch(err => {
this.logger.error(`Resolution failed: ${err}`);
@ -245,7 +257,7 @@ export class ApInboxService {
}
@bindThis
private async add(actor: MiRemoteUser, activity: IAdd): Promise<string | void> {
private async add(actor: MiRemoteUser, activity: IAdd, resolver?: Resolver): Promise<string | void> {
if (actor.uri !== activity.actor) {
return 'invalid actor';
}
@ -256,7 +268,7 @@ export class ApInboxService {
if (activity.target === actor.featured) {
const object = fromTuple(activity.object);
const note = await this.apNoteService.resolveNote(object);
const note = await this.apNoteService.resolveNote(object, { resolver });
if (note == null) return 'note not found';
await this.notePiningService.addPinned(actor, note.id);
return;
@ -266,12 +278,13 @@ export class ApInboxService {
}
@bindThis
private async announce(actor: MiRemoteUser, activity: IAnnounce): Promise<string | void> {
private async announce(actor: MiRemoteUser, activity: IAnnounce, resolver?: Resolver): Promise<string | void> {
const uri = getApId(activity);
this.logger.info(`Announce: ${uri}`);
const resolver = this.apResolverService.createResolver();
// eslint-disable-next-line no-param-reassign
resolver ??= this.apResolverService.createResolver();
const activityObject = fromTuple(activity.object);
if (!activityObject) return 'skip: activity has no object property';
@ -289,7 +302,7 @@ export class ApInboxService {
}
@bindThis
private async announceNote(actor: MiRemoteUser, activity: IAnnounce, target: IPost): Promise<string | void> {
private async announceNote(actor: MiRemoteUser, activity: IAnnounce, target: IPost, resolver?: Resolver): Promise<string | void> {
const uri = getApId(activity);
if (actor.isSuspended) {
@ -311,7 +324,7 @@ export class ApInboxService {
// Announce対象をresolve
let renote;
try {
renote = await this.apNoteService.resolveNote(target);
renote = await this.apNoteService.resolveNote(target, { resolver });
if (renote == null) return 'announce target is null';
} catch (err) {
// 対象が4xxならスキップ
@ -330,7 +343,7 @@ export class ApInboxService {
this.logger.info(`Creating the (Re)Note: ${uri}`);
const activityAudience = await this.apAudienceService.parseAudience(actor, activity.to, activity.cc);
const activityAudience = await this.apAudienceService.parseAudience(actor, activity.to, activity.cc, resolver);
const createdAt = activity.published ? new Date(activity.published) : null;
if (createdAt && createdAt < this.idService.parse(renote.id).date) {
@ -368,7 +381,7 @@ export class ApInboxService {
}
@bindThis
private async create(actor: MiRemoteUser, activity: ICreate): Promise<string | void> {
private async create(actor: MiRemoteUser, activity: ICreate, resolver?: Resolver): Promise<string | void> {
const uri = getApId(activity);
this.logger.info(`Create: ${uri}`);
@ -394,7 +407,8 @@ export class ApInboxService {
activityObject.attributedTo = activity.actor;
}
const resolver = this.apResolverService.createResolver();
// eslint-disable-next-line no-param-reassign
resolver ??= this.apResolverService.createResolver();
const object = await resolver.resolve(activityObject).catch(e => {
this.logger.error(`Resolution failed: ${e}`);
@ -421,6 +435,8 @@ export class ApInboxService {
if (this.utilityService.extractDbHost(actor.uri) !== this.utilityService.extractDbHost(note.id)) {
return 'skip: host in actor.uri !== note.id';
}
} else {
return 'skip: note.id is not a string';
}
}
@ -430,7 +446,7 @@ export class ApInboxService {
const exist = await this.apNoteService.fetchNote(note);
if (exist) return 'skip: note exists';
await this.apNoteService.createNote(note, resolver, silent);
await this.apNoteService.createNote(note, actor, resolver, silent);
return 'ok';
} catch (err) {
if (err instanceof StatusError && !err.isRetryable) {
@ -568,12 +584,13 @@ export class ApInboxService {
}
@bindThis
private async reject(actor: MiRemoteUser, activity: IReject): Promise<string> {
private async reject(actor: MiRemoteUser, activity: IReject, resolver?: Resolver): Promise<string> {
const uri = activity.id ?? activity;
this.logger.info(`Reject: ${uri}`);
const resolver = this.apResolverService.createResolver();
// eslint-disable-next-line no-param-reassign
resolver ??= this.apResolverService.createResolver();
const object = await resolver.resolve(activity.object).catch(e => {
this.logger.error(`Resolution failed: ${e}`);
@ -610,7 +627,7 @@ export class ApInboxService {
}
@bindThis
private async remove(actor: MiRemoteUser, activity: IRemove): Promise<string | void> {
private async remove(actor: MiRemoteUser, activity: IRemove, resolver?: Resolver): Promise<string | void> {
if (actor.uri !== activity.actor) {
return 'invalid actor';
}
@ -621,7 +638,7 @@ export class ApInboxService {
if (activity.target === actor.featured) {
const activityObject = fromTuple(activity.object);
const note = await this.apNoteService.resolveNote(activityObject);
const note = await this.apNoteService.resolveNote(activityObject, { resolver });
if (note == null) return 'note not found';
await this.notePiningService.removePinned(actor, note.id);
return;
@ -631,7 +648,7 @@ export class ApInboxService {
}
@bindThis
private async undo(actor: MiRemoteUser, activity: IUndo): Promise<string> {
private async undo(actor: MiRemoteUser, activity: IUndo, resolver?: Resolver): Promise<string> {
if (actor.uri !== activity.actor) {
return 'invalid actor';
}
@ -640,7 +657,8 @@ export class ApInboxService {
this.logger.info(`Undo: ${uri}`);
const resolver = this.apResolverService.createResolver();
// eslint-disable-next-line no-param-reassign
resolver ??= this.apResolverService.createResolver();
const object = await resolver.resolve(activity.object).catch(e => {
this.logger.error(`Resolution failed: ${e}`);
@ -764,14 +782,15 @@ export class ApInboxService {
}
@bindThis
private async update(actor: MiRemoteUser, activity: IUpdate): Promise<string> {
private async update(actor: MiRemoteUser, activity: IUpdate, resolver?: Resolver): Promise<string> {
if (actor.uri !== activity.actor) {
return 'skip: invalid actor';
}
this.logger.debug('Update');
const resolver = this.apResolverService.createResolver();
// eslint-disable-next-line no-param-reassign
resolver ??= this.apResolverService.createResolver();
const object = await resolver.resolve(activity.object).catch(e => {
this.logger.error(`Resolution failed: ${e}`);
@ -782,10 +801,10 @@ export class ApInboxService {
await this.apPersonService.updatePerson(actor.uri, resolver, object);
return 'ok: Person updated';
} else if (getApType(object) === 'Question') {
await this.apQuestionService.updateQuestion(object, resolver).catch(err => console.error(err));
await this.apQuestionService.updateQuestion(object, actor, resolver).catch(err => console.error(err));
return 'ok: Question updated';
} else if (getApType(object) === 'Note') {
await this.apNoteService.updateNote(object, resolver).catch(err => console.error(err));
await this.apNoteService.updateNote(object, actor, resolver).catch(err => console.error(err));
return 'ok: Note updated';
} else {
return `skip: Unknown type: ${getApType(object)}`;
@ -793,11 +812,11 @@ export class ApInboxService {
}
@bindThis
private async move(actor: MiRemoteUser, activity: IMove): Promise<string> {
private async move(actor: MiRemoteUser, activity: IMove, resolver?: Resolver): Promise<string> {
// fetch the new and old accounts
const targetUri = getApHrefNullable(activity.target);
if (!targetUri) return 'skip: invalid activity target';
return await this.apPersonService.updatePerson(actor.uri) ?? 'skip: nothing to do';
return await this.apPersonService.updatePerson(actor.uri, resolver) ?? 'skip: nothing to do';
}
}

8
packages/backend/src/core/activitypub/ApRequestService.ts
View file

@ -18,6 +18,7 @@ import type Logger from '@/logger.js';
import type { IObject } from './type.js';
import { validateContentTypeSetAsActivityPub } from '@/core/activitypub/misc/validator.js';
import { assertActivityMatchesUrls } from '@/core/activitypub/misc/check-against-url.js';
import { UtilityService } from "@/core/UtilityService.js";
type Request = {
url: string;
@ -147,6 +148,7 @@ export class ApRequestService {
private userKeypairService: UserKeypairService,
private httpRequestService: HttpRequestService,
private loggerService: LoggerService,
private utilityService: UtilityService,
) {
// eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
this.logger = this.loggerService?.getLogger('ap-request'); // なぜか TypeError: Cannot read properties of undefined (reading 'getLogger') と言われる
@ -241,7 +243,9 @@ export class ApRequestService {
if (alternate) {
const href = alternate.getAttribute('href');
if (href) {
return await this.signedGet(href, user, false);
if (this.utilityService.punyHost(url) === this.utilityService.punyHost(href)) {
return await this.signedGet(href, user, false);
}
}
}
} catch (e) {
@ -257,7 +261,7 @@ export class ApRequestService {
const finalUrl = res.url; // redirects may have been involved
const activity = await res.json() as IObject;
assertActivityMatchesUrls(activity, [url, finalUrl]);
assertActivityMatchesUrls(activity, [finalUrl]);
return activity;
}

13
packages/backend/src/core/activitypub/ApResolverService.ts
View file

@ -42,7 +42,7 @@ export class Resolver {
private apRendererService: ApRendererService,
private apDbResolverService: ApDbResolverService,
private loggerService: LoggerService,
private recursionLimit = 100,
private recursionLimit = 256,
) {
this.history = new Set();
this.logger = this.loggerService.getLogger('ap-resolve');
@ -53,6 +53,11 @@ export class Resolver {
return Array.from(this.history);
}
@bindThis
public getRecursionLimit(): number {
return this.recursionLimit;
}
@bindThis
public async resolveCollection(value: string | IObject): Promise<ICollection | IOrderedCollection> {
const collection = typeof value === 'string'
@ -121,7 +126,11 @@ export class Resolver {
// `object.id` or `object.url` matches the URL used to fetch the
// object after redirects; here we double-check that no redirects
// bounced between hosts
if (object.id && (this.utilityService.punyHost(object.id) !== this.utilityService.punyHost(value))) {
if (object.id == null) {
throw new Error('invalid AP object: missing id');
}
if (this.utilityService.punyHost(object.id) !== this.utilityService.punyHost(value)) {
throw new Error(`invalid AP object ${value}: id ${object.id} has different host`);
}

101
packages/backend/src/core/activitypub/models/ApNoteService.ts
View file

@ -6,7 +6,7 @@
import { forwardRef, Inject, Injectable } from '@nestjs/common';
import { In } from 'typeorm';
import { DI } from '@/di-symbols.js';
import type { PollsRepository, EmojisRepository, NotesRepository, MiMeta } from '@/models/_.js';
import type { UsersRepository, PollsRepository, EmojisRepository, NotesRepository, MiMeta } from '@/models/_.js';
import type { Config } from '@/config.js';
import type { MiRemoteUser } from '@/models/User.js';
import type { MiNote } from '@/models/Note.js';
@ -49,6 +49,9 @@ export class ApNoteService {
@Inject(DI.meta)
private meta: MiMeta,
@Inject(DI.usersRepository)
private usersRepository: UsersRepository,
@Inject(DI.pollsRepository)
private pollsRepository: PollsRepository,
@ -82,7 +85,13 @@ export class ApNoteService {
}
@bindThis
public validateNote(object: IObject, uri: string): Error | null {
public validateNote(
object: IObject,
uri: string,
actor?: MiRemoteUser,
user?: MiRemoteUser,
note?: MiNote,
): Error | null {
const expectHost = this.utilityService.extractDbHost(uri);
const apType = getApType(object);
@ -99,10 +108,27 @@ export class ApNoteService {
return new IdentifiableError('d450b8a9-48e4-4dab-ae36-f4db763fda7c', `invalid Note: attributedTo has different host. expected: ${expectHost}, actual: ${actualHost}`);
}
if (actor) {
const attribution = (object.attributedTo) ? getOneApId(object.attributedTo) : actor.uri;
if (attribution !== actor.uri) {
return new IdentifiableError('d450b8a9-48e4-4dab-ae36-f4db763fda7c', `invalid Note: attribution does not match the actor that send it. attribution: ${attribution}, actor: ${actor.uri}`);
}
if (user && attribution !== user.uri) {
return new IdentifiableError('d450b8a9-48e4-4dab-ae36-f4db763fda7c', `invalid Note: updated attribution does not match original attribution. updated attribution: ${user.uri}, original attribution: ${attribution}`);
}
}
if (object.published && !this.idService.isSafeT(new Date(object.published).valueOf())) {
return new IdentifiableError('d450b8a9-48e4-4dab-ae36-f4db763fda7c', 'invalid Note: published timestamp is malformed');
}
if (note) {
const url = (object.url) ? getOneApId(object.url) : note.url;
if (url && url !== note.url) {
return new IdentifiableError('d450b8a9-48e4-4dab-ae36-f4db763fda7c', `invalid Note: updated url does not match original url. updated url: ${url}, original url: ${note.url}`);
}
}
return null;
}
@ -120,14 +146,14 @@ export class ApNoteService {
* Noteを作成します。
*/
@bindThis
public async createNote(value: string | IObject, resolver?: Resolver, silent = false): Promise<MiNote | null> {
public async createNote(value: string | IObject, actor?: MiRemoteUser, resolver?: Resolver, silent = false): Promise<MiNote | null> {
// eslint-disable-next-line no-param-reassign
if (resolver == null) resolver = this.apResolverService.createResolver();
const object = await resolver.resolve(value);
const entryUri = getApId(value);
const err = this.validateNote(object, entryUri);
const err = this.validateNote(object, entryUri, actor);
if (err) {
this.logger.error(err.message, {
resolver: { history: resolver.getHistory() },
@ -141,14 +167,24 @@ export class ApNoteService {
this.logger.debug(`Note fetched: ${JSON.stringify(note, null, 2)}`);
if (note.id && !checkHttps(note.id)) {
if (note.id == null) {
throw new Error('Refusing to create note without id');
}
if (!checkHttps(note.id)) {
throw new Error('unexpected schema of note.id: ' + note.id);
}
const url = getOneApHrefNullable(note.url);
if (url && !checkHttps(url)) {
throw new Error('unexpected schema of note url: ' + url);
if (url != null) {
if (!checkHttps(url)) {
throw new Error('unexpected schema of note url: ' + url);
}
if (this.utilityService.punyHost(url) !== this.utilityService.punyHost(note.id)) {
throw new Error(`note url <> uri host mismatch: ${url} <> ${note.id}`);
}
}
this.logger.info(`Creating the Note: ${note.id}`);
@ -161,8 +197,9 @@ export class ApNoteService {
const uri = getOneApId(note.attributedTo);
// ローカルで投稿者を検索し、もし凍結されていたらスキップ
const cachedActor = await this.apPersonService.fetchPerson(uri) as MiRemoteUser;
if (cachedActor && cachedActor.isSuspended) {
// eslint-disable-next-line no-param-reassign
actor ??= await this.apPersonService.fetchPerson(uri) as MiRemoteUser | undefined;
if (actor && actor.isSuspended) {
throw new IdentifiableError('85ab9bd7-3a41-4530-959d-f07073900109', 'actor has been suspended');
}
@ -194,7 +231,8 @@ export class ApNoteService {
}
//#endregion
const actor = cachedActor ?? await this.apPersonService.resolvePerson(uri, resolver) as MiRemoteUser;
// eslint-disable-next-line no-param-reassign
actor ??= await this.apPersonService.resolvePerson(uri, resolver) as MiRemoteUser;
// 解決した投稿者が凍結されていたらスキップ
if (actor.isSuspended) {
@ -335,7 +373,7 @@ export class ApNoteService {
* Noteを作成します。
*/
@bindThis
public async updateNote(value: string | IObject, resolver?: Resolver, silent = false): Promise<MiNote | null> {
public async updateNote(value: string | IObject, actor?: MiRemoteUser, resolver?: Resolver, silent = false): Promise<MiNote | null> {
const noteUri = typeof value === 'string' ? value : value.id;
if (noteUri == null) throw new Error('uri is null');
@ -346,6 +384,9 @@ export class ApNoteService {
const UpdatedNote = await this.notesRepository.findOneBy({ uri: noteUri });
if (UpdatedNote == null) throw new Error('Note is not registered');
const user = await this.usersRepository.findOneBy({ id: UpdatedNote.userId }) as MiRemoteUser | null;
if (user == null) throw new Error('Note is not registered');
// eslint-disable-next-line no-param-reassign
if (resolver == null) resolver = this.apResolverService.createResolver();
@ -362,11 +403,19 @@ export class ApNoteService {
throw err;
}
// `validateNote` checks that the actor and user are one and the same
// eslint-disable-next-line no-param-reassign
actor ??= user;
const note = object as IPost;
this.logger.debug(`Note fetched: ${JSON.stringify(note, null, 2)}`);
if (note.id && !checkHttps(note.id)) {
if (note.id == null) {
throw new Error('Refusing to update note without id');
}
if (!checkHttps(note.id)) {
throw new Error('unexpected schema of note.id: ' + note.id);
}
@ -376,18 +425,19 @@ export class ApNoteService {
throw new Error('unexpected schema of note url: ' + url);
}
this.logger.info(`Creating the Note: ${note.id}`);
if (url != null) {
if (!checkHttps(url)) {
throw new Error('unexpected schema of note url: ' + url);
}
// 投稿者をフェッチ
if (note.attributedTo == null) {
throw new Error('invalid note.attributedTo: ' + note.attributedTo);
if (this.utilityService.punyHost(url) !== this.utilityService.punyHost(note.id)) {
throw new Error(`note url <> id host mismatch: ${url} <> ${note.id}`);
}
}
const uri = getOneApId(note.attributedTo);
this.logger.info(`Creating the Note: ${note.id}`);
// ローカルで投稿者を検索し、もし凍結されていたらスキップ
const cachedActor = await this.apPersonService.fetchPerson(uri) as MiRemoteUser;
if (cachedActor && cachedActor.isSuspended) {
if (actor.isSuspended) {
throw new IdentifiableError('85ab9bd7-3a41-4530-959d-f07073900109', 'actor has been suspended');
}
@ -419,13 +469,6 @@ export class ApNoteService {
}
//#endregion
const actor = cachedActor ?? await this.apPersonService.resolvePerson(uri, resolver) as MiRemoteUser;
// 投稿者が凍結されていたらスキップ
if (actor.isSuspended) {
throw new IdentifiableError('85ab9bd7-3a41-4530-959d-f07073900109', 'actor has been suspended');
}
const noteAudience = await this.apAudienceService.parseAudience(actor, note.to, note.cc, resolver);
let visibility = noteAudience.visibility;
const visibleUsers = noteAudience.visibleUsers;
@ -578,7 +621,7 @@ export class ApNoteService {
if (exist) return exist;
//#endregion
if (uri.startsWith(this.config.url)) {
if (this.utilityService.isUriLocal(uri)) {
throw new StatusError('cannot resolve local note', 400, 'cannot resolve local note');
}
@ -586,7 +629,7 @@ export class ApNoteService {
// ここでuriの代わりに添付されてきたNote Objectが指定されていると、サーバーフェッチを経ずにノートが生成されるが
// 添付されてきたNote Objectは偽装されている可能性があるため、常にuriを指定してサーバーフェッチを行う。
const createFrom = options.sentFrom?.origin === new URL(uri).origin ? value : uri;
return await this.createNote(createFrom, options.resolver, true);
return await this.createNote(createFrom, undefined, options.resolver, true);
} finally {
unlock();
}

58
packages/backend/src/core/activitypub/models/ApPersonService.ts
View file

@ -154,11 +154,24 @@ export class ApPersonService implements OnModuleInit {
throw new Error('invalid Actor: inbox has different host');
}
const sharedInboxObject = x.sharedInbox ?? (x.endpoints ? x.endpoints.sharedInbox : undefined);
if (sharedInboxObject != null) {
const sharedInbox = getApId(sharedInboxObject);
if (!(typeof sharedInbox === 'string' && sharedInbox.length > 0 && this.utilityService.punyHost(sharedInbox) === expectHost)) {
throw new Error('invalid Actor: wrong shared inbox');
}
}
for (const collection of ['outbox', 'followers', 'following'] as (keyof IActor)[]) {
const collectionUri = (x as IActor)[collection];
if (typeof collectionUri === 'string' && collectionUri.length > 0) {
if (this.utilityService.punyHost(collectionUri) !== expectHost) {
throw new Error(`invalid Actor: ${collection} has different host`);
const xCollection = (x as IActor)[collection];
if (xCollection != null) {
const collectionUri = getApId(xCollection);
if (typeof collectionUri === 'string' && collectionUri.length > 0) {
if (this.utilityService.punyHost(collectionUri) !== expectHost) {
throw new Error(`invalid Actor: ${collection} has different host`);
}
} else if (collectionUri != null) {
throw new Error(`invalid Actor: wrong ${collection}`);
}
}
}
@ -286,7 +299,8 @@ export class ApPersonService implements OnModuleInit {
public async createPerson(uri: string, resolver?: Resolver): Promise<MiRemoteUser> {
if (typeof uri !== 'string') throw new Error('uri is not string');
if (uri.startsWith(this.config.url)) {
const host = this.utilityService.punyHost(uri);
if (host === this.utilityService.toPuny(this.config.host)) {
throw new StatusError('cannot resolve local user', 400, 'cannot resolve local user');
}
@ -300,8 +314,6 @@ export class ApPersonService implements OnModuleInit {
this.logger.info(`Creating the Person: ${person.id}`);
const host = this.utilityService.punyHost(object.id);
const fields = this.analyzeAttachments(person.attachment ?? []);
const tags = extractApHashtags(person.tag).map(normalizeForSearch).splice(0, 32);
@ -327,8 +339,18 @@ export class ApPersonService implements OnModuleInit {
const url = getOneApHrefNullable(person.url);
if (url && !checkHttps(url)) {
throw new Error('unexpected schema of person url: ' + url);
if (person.id == null) {
throw new Error('Refusing to create person without id');
}
if (url != null) {
if (!checkHttps(url)) {
throw new Error('unexpected schema of person url: ' + url);
}
if (this.utilityService.punyHost(url) !== this.utilityService.punyHost(person.id)) {
throw new Error(`person url <> uri host mismatch: ${url} <> ${person.id}`);
}
}
// Create user
@ -480,7 +502,7 @@ export class ApPersonService implements OnModuleInit {
if (typeof uri !== 'string') throw new Error('uri is not string');
// URIがこのサーバーを指しているならスキップ
if (uri.startsWith(`${this.config.url}/`)) return;
if (this.utilityService.isUriLocal(uri)) return;
//#region このサーバーに既に登録されているか
const exist = await this.fetchPerson(uri) as MiRemoteUser | null;
@ -529,8 +551,18 @@ export class ApPersonService implements OnModuleInit {
const url = getOneApHrefNullable(person.url);
if (url && !checkHttps(url)) {
throw new Error('unexpected schema of person url: ' + url);
if (person.id == null) {
throw new Error('Refusing to update person without id');
}
if (url != null) {
if (!checkHttps(url)) {
throw new Error('unexpected schema of person url: ' + url);
}
if (this.utilityService.punyHost(url) !== this.utilityService.punyHost(person.id)) {
throw new Error(`person url <> uri host mismatch: ${url} <> ${person.id}`);
}
}
const updates = {
@ -747,7 +779,7 @@ export class ApPersonService implements OnModuleInit {
await this.updatePerson(src.movedToUri, undefined, undefined, [...movePreventUris, src.uri]);
dst = await this.fetchPerson(src.movedToUri) ?? dst;
} else {
if (src.movedToUri.startsWith(`${this.config.url}/`)) {
if (this.utilityService.isUriLocal(src.movedToUri)) {
// ローカルユーザーっぽいのにfetchPersonで見つからないということはmovedToUriが間違っている
return 'failed: movedTo is local but not found';
}

33
packages/backend/src/core/activitypub/models/ApQuestionService.ts
View file

@ -5,16 +5,18 @@
import { Inject, Injectable } from '@nestjs/common';
import { DI } from '@/di-symbols.js';
import type { NotesRepository, PollsRepository } from '@/models/_.js';
import type { UsersRepository, NotesRepository, PollsRepository } from '@/models/_.js';
import type { Config } from '@/config.js';
import type { IPoll } from '@/models/Poll.js';
import type { MiRemoteUser } from '@/models/User.js';
import type Logger from '@/logger.js';
import { bindThis } from '@/decorators.js';
import { isQuestion } from '../type.js';
import { UtilityService } from '@/core/UtilityService.js';
import { getOneApId, isQuestion } from '../type.js';
import { ApLoggerService } from '../ApLoggerService.js';
import { ApResolverService } from '../ApResolverService.js';
import type { Resolver } from '../ApResolverService.js';
import type { IObject, IQuestion } from '../type.js';
import type { IObject } from '../type.js';
@Injectable()
export class ApQuestionService {
@ -24,6 +26,9 @@ export class ApQuestionService {
@Inject(DI.config)
private config: Config,
@Inject(DI.usersRepository)
private usersRepository: UsersRepository,
@Inject(DI.notesRepository)
private notesRepository: NotesRepository,
@ -32,6 +37,7 @@ export class ApQuestionService {
private apResolverService: ApResolverService,
private apLoggerService: ApLoggerService,
private utilityService: UtilityService,
) {
this.logger = this.apLoggerService.logger;
}
@ -65,12 +71,12 @@ export class ApQuestionService {
* @returns true if updated
*/
@bindThis
public async updateQuestion(value: string | IObject, resolver?: Resolver): Promise<boolean> {
public async updateQuestion(value: string | IObject, actor?: MiRemoteUser, resolver?: Resolver): Promise<boolean> {
const uri = typeof value === 'string' ? value : value.id;
if (uri == null) throw new Error('uri is null');
// URIがこのサーバーを指しているならスキップ
if (uri.startsWith(this.config.url + '/')) throw new Error('uri points local');
if (this.utilityService.isUriLocal(uri)) throw new Error('uri points local');
//#region このサーバーに既に登録されているか
const note = await this.notesRepository.findOneBy({ uri });
@ -78,15 +84,26 @@ export class ApQuestionService {
const poll = await this.pollsRepository.findOneBy({ noteId: note.id });
if (poll == null) throw new Error('Question is not registered');
const user = await this.usersRepository.findOneBy({ id: poll.userId });
if (user == null) throw new Error('Question is not registered');
//#endregion
// resolve new Question object
// eslint-disable-next-line no-param-reassign
if (resolver == null) resolver = this.apResolverService.createResolver();
const question = await resolver.resolve(value) as IQuestion;
const question = await resolver.resolve(value);
this.logger.debug(`fetched question: ${JSON.stringify(question, null, 2)}`);
if (question.type !== 'Question') throw new Error('object is not a Question');
if (!isQuestion(question)) throw new Error('object is not a Question');
const attribution = (question.attributedTo) ? getOneApId(question.attributedTo) : user.uri;
const attributionMatchesExisting = attribution === user.uri;
const actorMatchesAttribution = (actor) ? attribution === actor.uri : true;
if (!attributionMatchesExisting || !actorMatchesAttribution) {
throw new Error('Refusing to ingest update for poll by different user');
}
const apChoices = question.oneOf ?? question.anyOf;
if (apChoices == null) throw new Error('invalid apChoices: ' + apChoices);
@ -96,7 +113,7 @@ export class ApQuestionService {
for (const choice of poll.choices) {
const oldCount = poll.votes[poll.choices.indexOf(choice)];
const newCount = apChoices.filter(ap => ap.name === choice).at(0)?.replies?.totalItems;
if (newCount == null) throw new Error('invalid newCount: ' + newCount);
if (newCount == null || !(Number.isInteger(newCount) && newCount >= 0)) throw new Error('invalid newCount: ' + newCount);
if (oldCount <= newCount) {
changed = true;

26
packages/backend/src/core/entities/NoteEntityService.ts
View file

@ -17,6 +17,7 @@ import { DebounceLoader } from '@/misc/loader.js';
import { IdService } from '@/core/IdService.js';
import { ReactionsBufferingService } from '@/core/ReactionsBufferingService.js';
import type { OnModuleInit } from '@nestjs/common';
import type { CacheService } from '../CacheService.js';
import type { CustomEmojiService } from '../CustomEmojiService.js';
import type { ReactionService } from '../ReactionService.js';
import type { UserEntityService } from './UserEntityService.js';
@ -27,6 +28,7 @@ import type { Config } from '@/config.js';
export class NoteEntityService implements OnModuleInit {
private userEntityService: UserEntityService;
private driveFileEntityService: DriveFileEntityService;
private cacheService: CacheService;
private customEmojiService: CustomEmojiService;
private reactionService: ReactionService;
private reactionsBufferingService: ReactionsBufferingService;
@ -75,6 +77,7 @@ export class NoteEntityService implements OnModuleInit {
onModuleInit() {
this.userEntityService = this.moduleRef.get('UserEntityService');
this.driveFileEntityService = this.moduleRef.get('DriveFileEntityService');
this.cacheService = this.moduleRef.get('CacheService');
this.customEmojiService = this.moduleRef.get('CustomEmojiService');
this.reactionService = this.moduleRef.get('ReactionService');
this.reactionsBufferingService = this.moduleRef.get('ReactionsBufferingService');
@ -142,6 +145,12 @@ export class NoteEntityService implements OnModuleInit {
}
}
if (!hide && meId && packedNote.userId !== meId) {
const isBlocked = (await this.cacheService.userBlockedCache.fetch(meId)).has(packedNote.userId);
if (isBlocked) hide = true;
}
if (hide) {
packedNote.visibleUserIds = undefined;
packedNote.fileIds = [];
@ -149,6 +158,12 @@ export class NoteEntityService implements OnModuleInit {
packedNote.text = null;
packedNote.poll = undefined;
packedNote.cw = null;
packedNote.repliesCount = 0;
packedNote.reactionAcceptance = null;
packedNote.reactionAndUserPairCache = undefined;
packedNote.reactionCount = 0;
packedNote.reactionEmojis = {};
packedNote.reactions = {};
packedNote.isHidden = true;
}
}
@ -262,7 +277,8 @@ export class NoteEntityService implements OnModuleInit {
return true;
} else {
// フォロワーかどうか
const [following, user] = await Promise.all([
const [blocked, following, user] = await Promise.all([
this.cacheService.userBlockingCache.fetch(meId).then((ids) => ids.has(note.userId)),
this.followingsRepository.count({
where: {
followeeId: note.userId,
@ -273,6 +289,8 @@ export class NoteEntityService implements OnModuleInit {
this.usersRepository.findOneByOrFail({ id: meId }),
]);
if (blocked) return false;
/* If we know the following, everyhting is fine.
But if we do not know the following, it might be that both the
@ -284,6 +302,12 @@ export class NoteEntityService implements OnModuleInit {
}
}
if (meId != null) {
const isBlocked = (await this.cacheService.userBlockedCache.fetch(meId)).has(note.userId);
if (isBlocked) return false;
}
return true;
}

2
packages/backend/src/queue/processors/InboxProcessorService.ts
View file

@ -192,6 +192,8 @@ export class InboxProcessorService implements OnApplicationShutdown {
if (signerHost !== activityIdHost) {
throw new Bull.UnrecoverableError(`skip: signerHost(${signerHost}) !== activity.id host(${activityIdHost}`);
}
} else {
throw new Bull.UnrecoverableError('skip: activity id is not a string');
}
// Update stats

4
packages/backend/src/server/ActivityPubServerService.ts
View file

@ -152,7 +152,7 @@ export class ActivityPubServerService {
let signature;
try {
signature = httpSignature.parseRequest(request.raw, { 'headers': [] });
signature = httpSignature.parseRequest(request.raw, { 'headers': ['(request-target)', 'host', 'date'], authorizationHeaderName: 'signature' });
} catch (e) {
// not signed, or malformed signature: refuse
this.authlogger.warn(`${request.id} ${request.url} not signed, or malformed signature: refuse`);
@ -229,7 +229,7 @@ export class ActivityPubServerService {
let signature;
try {
signature = httpSignature.parseRequest(request.raw, { 'headers': [] });
signature = httpSignature.parseRequest(request.raw, { 'headers': ['(request-target)', 'digest', 'host', 'date'], authorizationHeaderName: 'signature' });
} catch (e) {
reply.code(401);
return;

38
packages/backend/src/server/FileServerService.ts
View file

@ -31,6 +31,7 @@ import { handleRequestRedirectToOmitSearch } from '@/misc/fastify-hook-handlers.
import { RateLimiterService } from '@/server/api/RateLimiterService.js';
import { getIpHash } from '@/misc/get-ip-hash.js';
import { AuthenticateService } from '@/server/api/AuthenticateService.js';
import type { IEndpointMeta } from '@/server/api/endpoints.js';
import type { FastifyInstance, FastifyRequest, FastifyReply, FastifyPluginOptions } from 'fastify';
import type Limiter from 'ratelimiter';
@ -82,7 +83,7 @@ export class FileServerService {
});
fastify.get<{ Params: { key: string; } }>('/files/:key', async (request, reply) => {
if (!await this.checkRateLimit(request, reply, `/files/${request.params.key}`)) return;
if (!await this.checkRateLimit(request, reply, '/files/', request.params.key)) return;
return await this.sendDriveFile(request, reply)
.catch(err => this.errorHandler(request, reply, err));
@ -109,7 +110,7 @@ export class FileServerService {
keyUrl.username = '';
keyUrl.password = '';
if (!await this.checkRateLimit(request, reply, `/proxy/${keyUrl}`)) return;
if (!await this.checkRateLimit(request, reply, '/proxy/', keyUrl.href)) return;
return await this.proxyHandler(request, reply)
.catch(err => this.errorHandler(request, reply, err));
@ -603,7 +604,8 @@ export class FileServerService {
Params?: Record<string, unknown> | unknown,
}>,
reply: FastifyReply,
rateLimitKey: string,
group: string,
resource: string,
): Promise<boolean> {
const body = request.method === 'GET'
? request.query
@ -622,32 +624,48 @@ export class FileServerService {
const [user] = await this.authenticateService.authenticate(token);
const actor = user?.id ?? getIpHash(request.ip);
// Call both limits: the per-resource limit and the shared cross-resource limit
return await this.checkResourceLimit(reply, actor, group, resource) && await this.checkSharedLimit(reply, actor, group);
}
private async checkResourceLimit(reply: FastifyReply, actor: string, group: string, resource: string): Promise<boolean> {
const limit = {
// Group by resource
key: rateLimitKey,
key: `${group}${resource}`,
// Maximum of 10 requests / 10 minutes
max: 10,
duration: 1000 * 60 * 10,
// Minimum of 250 ms between each request
minInterval: 250,
};
// Rate limit proxy requests
return await this.checkLimit(reply, actor, limit);
}
private async checkSharedLimit(reply: FastifyReply, actor: string, group: string): Promise<boolean> {
const limit = {
key: group,
// Maximum of 3600 requests per hour, which is an average of 1 per second.
max: 3600,
duration: 1000 * 60 * 60,
};
return await this.checkLimit(reply, actor, limit);
}
private async checkLimit(reply: FastifyReply, actor: string, limit: IEndpointMeta['limit'] & { key: NonNullable<string> }): Promise<boolean> {
try {
await this.rateLimiterService.limit(limit, actor);
return true;
} catch (err) {
// errはLimiter.LimiterInfoであることが期待される
reply.code(429);
if (hasRateLimitInfo(err)) {
const cooldownInSeconds = Math.ceil((err.info.resetMs - Date.now()) / 1000);
// もしかするとマイナスになる可能性がなくはないのでマイナスだったら0にしておく
reply.header('Retry-After', Math.max(cooldownInSeconds, 0).toString(10));
}
reply.code(429);
reply.send({
message: 'Rate limit exceeded. Please try again later.',
code: 'RATE_LIMIT_EXCEEDED',

12
packages/backend/src/server/api/ApiCallService.ts
View file

@ -311,7 +311,15 @@ export class ApiCallService implements OnApplicationShutdown {
throw new ApiError(accessDenied);
}
if (ep.meta.limit) {
// For endpoints without a limit, the default is 10 calls per second
const endpointLimit: IEndpointMeta['limit'] = ep.meta.limit ?? {
duration: 1000,
max: 10,
};
// We don't need this check, but removing it would cause a big merge conflict.
// eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
if (endpointLimit) {
// koa will automatically load the `X-Forwarded-For` header if `proxy: true` is configured in the app.
let limitActor: string;
if (user) {
@ -320,7 +328,7 @@ export class ApiCallService implements OnApplicationShutdown {
limitActor = getIpHash(request.ip);
}
const limit = Object.assign({}, ep.meta.limit);
const limit = Object.assign({}, endpointLimit);
if (limit.key == null) {
(limit as any).key = ep.name;

2
packages/backend/src/server/api/endpoints/admin/update-meta.ts
View file

@ -709,7 +709,7 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
}
if (Array.isArray(ps.federationHosts)) {
set.blockedHosts = ps.federationHosts.filter(Boolean).map(x => x.toLowerCase());
set.federationHosts = ps.federationHosts.filter(Boolean).map(x => x.toLowerCase());
}
const before = await this.metaService.fetch(true);

6
packages/backend/src/server/api/endpoints/announcements.ts
View file

@ -25,6 +25,12 @@ export const meta = {
ref: 'Announcement',
},
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/announcements/show.ts
View file

@ -27,6 +27,12 @@ export const meta = {
id: 'b57b5e1d-4f49-404a-9edb-46b00268f121',
},
},
// 5 calls per second
limit: {
duration: 1000,
max: 5,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/antennas/create.ts
View file

@ -47,6 +47,12 @@ export const meta = {
optional: false, nullable: false,
ref: 'Antenna',
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/antennas/delete.ts
View file

@ -24,6 +24,12 @@ export const meta = {
id: 'b34dcf9d-348f-44bb-99d0-6c9314cfe2df',
},
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/antennas/list.ts
View file

@ -25,6 +25,12 @@ export const meta = {
ref: 'Antenna',
},
},
// 3 calls per second
limit: {
duration: 1000,
max: 3,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/antennas/notes.ts
View file

@ -41,6 +41,12 @@ export const meta = {
ref: 'Note',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/antennas/show.ts
View file

@ -30,6 +30,12 @@ export const meta = {
optional: false, nullable: false,
ref: 'Antenna',
},
// 3 calls per second
limit: {
duration: 1000,
max: 3,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/antennas/update.ts
View file

@ -45,6 +45,12 @@ export const meta = {
optional: false, nullable: false,
ref: 'Antenna',
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

1
packages/backend/src/server/api/endpoints/ap/get.ts
View file

@ -11,6 +11,7 @@ import { ApResolverService } from '@/core/activitypub/ApResolverService.js';
export const meta = {
tags: ['federation'],
requireAdmin: true,
requireCredential: true,
kind: 'read:federation',

2
packages/backend/src/server/api/endpoints/ap/show.ts
View file

@ -140,7 +140,7 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
return await this.mergePack(
me,
isActor(object) ? await this.apPersonService.createPerson(getApId(object)) : null,
isPost(object) ? await this.apNoteService.createNote(getApId(object), undefined, true) : null,
isPost(object) ? await this.apNoteService.createNote(getApId(object), undefined, undefined, true) : null,
);
}

6
packages/backend/src/server/api/endpoints/app/create.ts
View file

@ -22,6 +22,12 @@ export const meta = {
optional: false, nullable: false,
ref: 'App',
},
// 3 calls per second
limit: {
duration: 1000,
max: 3,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/app/show.ts
View file

@ -26,6 +26,12 @@ export const meta = {
optional: false, nullable: false,
ref: 'App',
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/auth/accept.ts
View file

@ -26,6 +26,12 @@ export const meta = {
id: '9c72d8de-391a-43c1-9d06-08d29efde8df',
},
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/auth/session/generate.ts
View file

@ -40,6 +40,12 @@ export const meta = {
id: '92f93e63-428e-4f2f-a5a4-39e1407fe998',
},
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/auth/session/show.ts
View file

@ -43,6 +43,12 @@ export const meta = {
},
},
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/auth/session/userkey.ts
View file

@ -51,6 +51,12 @@ export const meta = {
id: '8c8a4145-02cc-4cca-8e66-29ba60445a8e',
},
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/blocking/list.ts
View file

@ -26,6 +26,12 @@ export const meta = {
ref: 'Blocking',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/bubble-game/ranking.ts
View file

@ -40,6 +40,12 @@ export const meta = {
},
},
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/channels/favorite.ts
View file

@ -26,6 +26,12 @@ export const meta = {
id: '4938f5f3-6167-4c04-9149-6607b7542861',
},
},
// 3 calls per second
limit: {
duration: 1000,
max: 3,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/channels/featured.ts
View file

@ -23,6 +23,12 @@ export const meta = {
ref: 'Channel',
},
},
// 3 calls per second
limit: {
duration: 1000,
max: 3,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/channels/follow.ts
View file

@ -26,6 +26,12 @@ export const meta = {
id: 'c0031718-d573-4e85-928e-10039f1fbb68',
},
},
// 3 calls per second
limit: {
duration: 1000,
max: 3,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/channels/followed.ts
View file

@ -26,6 +26,12 @@ export const meta = {
ref: 'Channel',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/channels/my-favorites.ts
View file

@ -25,6 +25,12 @@ export const meta = {
ref: 'Channel',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/channels/owned.ts
View file

@ -26,6 +26,12 @@ export const meta = {
ref: 'Channel',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/channels/search.ts
View file

@ -26,6 +26,12 @@ export const meta = {
ref: 'Channel',
},
},
// 3 calls per second
limit: {
duration: 1000,
max: 3,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/channels/show.ts
View file

@ -28,6 +28,12 @@ export const meta = {
id: '6f6c314b-7486-4897-8966-c04a66a02923',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/channels/timeline.ts
View file

@ -38,6 +38,12 @@ export const meta = {
id: '4d0eeeba-a02c-4c3c-9966-ef60d38d2e7f',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/channels/unfavorite.ts
View file

@ -25,6 +25,12 @@ export const meta = {
id: '353c68dd-131a-476c-aa99-88a345e83668',
},
},
// 3 calls per second
limit: {
duration: 1000,
max: 3,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/channels/unfollow.ts
View file

@ -26,6 +26,12 @@ export const meta = {
id: '19959ee9-0153-4c51-bbd9-a98c49dc59d6',
},
},
// 3 calls per second
limit: {
duration: 1000,
max: 3,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/channels/update.ts
View file

@ -10,6 +10,7 @@ import { ChannelEntityService } from '@/core/entities/ChannelEntityService.js';
import { DI } from '@/di-symbols.js';
import { RoleService } from '@/core/RoleService.js';
import { ApiError } from '../../error.js';
import ms from 'ms';
export const meta = {
tags: ['channels'],
@ -43,6 +44,11 @@ export const meta = {
id: 'e86c14a4-0da2-4032-8df3-e737a04c7f3b',
},
},
limit: {
duration: ms('1hour'),
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/charts/active-users.ts
View file

@ -16,6 +16,12 @@ export const meta = {
allowGet: true,
cacheSec: 60 * 60,
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/charts/ap-request.ts
View file

@ -16,6 +16,12 @@ export const meta = {
allowGet: true,
cacheSec: 60 * 60,
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/charts/drive.ts
View file

@ -16,6 +16,12 @@ export const meta = {
allowGet: true,
cacheSec: 60 * 60,
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/charts/federation.ts
View file

@ -16,6 +16,12 @@ export const meta = {
allowGet: true,
cacheSec: 60 * 60,
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/charts/instance.ts
View file

@ -16,6 +16,12 @@ export const meta = {
allowGet: true,
cacheSec: 60 * 60,
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/charts/notes.ts
View file

@ -16,6 +16,12 @@ export const meta = {
allowGet: true,
cacheSec: 60 * 60,
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/charts/user/drive.ts
View file

@ -16,6 +16,12 @@ export const meta = {
allowGet: true,
cacheSec: 60 * 60,
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/charts/user/following.ts
View file

@ -16,6 +16,12 @@ export const meta = {
allowGet: true,
cacheSec: 60 * 60,
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/charts/user/notes.ts
View file

@ -16,6 +16,12 @@ export const meta = {
allowGet: true,
cacheSec: 60 * 60,
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/charts/user/pv.ts
View file

@ -16,6 +16,12 @@ export const meta = {
allowGet: true,
cacheSec: 60 * 60,
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/charts/user/reactions.ts
View file

@ -16,6 +16,12 @@ export const meta = {
allowGet: true,
cacheSec: 60 * 60,
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/charts/users.ts
View file

@ -16,6 +16,12 @@ export const meta = {
allowGet: true,
cacheSec: 60 * 60,
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

3
packages/backend/src/server/api/endpoints/clips/add-note.ts
View file

@ -18,9 +18,10 @@ export const meta = {
kind: 'write:account',
// 60 calls per hour
limit: {
duration: ms('1hour'),
max: 20,
max: 60,
},
errors: {

6
packages/backend/src/server/api/endpoints/clips/create.ts
View file

@ -32,6 +32,12 @@ export const meta = {
id: '920f7c2d-6208-4b76-8082-e632020f5883',
},
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/clips/delete.ts
View file

@ -22,6 +22,12 @@ export const meta = {
id: '70ca08ba-6865-4630-b6fb-8494759aa754',
},
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/clips/favorite.ts
View file

@ -32,6 +32,12 @@ export const meta = {
id: '92658936-c625-4273-8326-2d790129256e',
},
},
// 3 calls per second
limit: {
duration: 1000,
max: 3,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/clips/list.ts
View file

@ -25,6 +25,12 @@ export const meta = {
ref: 'Clip',
},
},
// 3 calls per second
limit: {
duration: 1000,
max: 3,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/clips/my-favorites.ts
View file

@ -25,6 +25,12 @@ export const meta = {
ref: 'Clip',
},
},
// 3 calls per second
limit: {
duration: 1000,
max: 3,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/clips/notes.ts
View file

@ -35,6 +35,12 @@ export const meta = {
ref: 'Note',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/clips/remove-note.ts
View file

@ -30,6 +30,12 @@ export const meta = {
id: 'aff017de-190e-434b-893e-33a9ff5049d8',
},
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/clips/show.ts
View file

@ -30,6 +30,12 @@ export const meta = {
optional: false, nullable: false,
ref: 'Clip',
},
// 3 calls per second
limit: {
duration: 1000,
max: 3,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/clips/unfavorite.ts
View file

@ -31,6 +31,12 @@ export const meta = {
id: '90c3a9e8-b321-4dae-bf57-2bf79bbcc187',
},
},
// 3 calls per second
limit: {
duration: 1000,
max: 3,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/clips/update.ts
View file

@ -31,6 +31,12 @@ export const meta = {
optional: false, nullable: false,
ref: 'Clip',
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/drive.ts
View file

@ -29,6 +29,12 @@ export const meta = {
},
},
},
// 3 calls per second
limit: {
duration: 1000,
max: 3,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/drive/files.ts
View file

@ -28,6 +28,12 @@ export const meta = {
ref: 'DriveFile',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/drive/files/attached-notes.ts
View file

@ -38,6 +38,12 @@ export const meta = {
id: 'c118ece3-2e4b-4296-99d1-51756e32d232',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/drive/files/check-existence.ts
View file

@ -21,6 +21,12 @@ export const meta = {
type: 'boolean',
optional: false, nullable: false,
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

7
packages/backend/src/server/api/endpoints/drive/files/delete.ts
View file

@ -11,6 +11,7 @@ import { GlobalEventService } from '@/core/GlobalEventService.js';
import { DI } from '@/di-symbols.js';
import { RoleService } from '@/core/RoleService.js';
import { ApiError } from '../../../error.js';
import ms from 'ms';
export const meta = {
tags: ['drive'],
@ -34,6 +35,12 @@ export const meta = {
id: '5eb8d909-2540-4970-90b8-dd6f86088121',
},
},
// 100 calls per minute
limit: {
duration: 1000 * 60,
max: 100,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/drive/files/find-by-hash.ts
View file

@ -27,6 +27,12 @@ export const meta = {
ref: 'DriveFile',
},
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/drive/files/find.ts
View file

@ -28,6 +28,12 @@ export const meta = {
ref: 'DriveFile',
},
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/drive/files/show.ts
View file

@ -40,6 +40,12 @@ export const meta = {
id: '25b73c73-68b1-41d0-bad1-381cfdf6579f',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

7
packages/backend/src/server/api/endpoints/drive/files/update.ts
View file

@ -11,6 +11,7 @@ import { RoleService } from '@/core/RoleService.js';
import { DriveService } from '@/core/DriveService.js';
import type { Config } from '@/config.js';
import { ApiError } from '../../../error.js';
import ms from 'ms';
export const meta = {
tags: ['drive'],
@ -63,6 +64,12 @@ export const meta = {
optional: false, nullable: false,
ref: 'DriveFile',
},
// 100 calls per minute
limit: {
duration: 1000 * 60,
max: 100,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/drive/folders.ts
View file

@ -27,6 +27,12 @@ export const meta = {
ref: 'DriveFolder',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

7
packages/backend/src/server/api/endpoints/drive/folders/delete.ts
View file

@ -9,6 +9,7 @@ import type { DriveFoldersRepository, DriveFilesRepository } from '@/models/_.js
import { GlobalEventService } from '@/core/GlobalEventService.js';
import { DI } from '@/di-symbols.js';
import { ApiError } from '../../../error.js';
import ms from 'ms';
export const meta = {
tags: ['drive'],
@ -30,6 +31,12 @@ export const meta = {
id: 'b0fc8a17-963c-405d-bfbc-859a487295e1',
},
},
// 100 calls per minute
limit: {
duration: 1000 * 60,
max: 100,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/drive/folders/find.ts
View file

@ -26,6 +26,12 @@ export const meta = {
ref: 'DriveFolder',
},
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/drive/folders/show.ts
View file

@ -30,6 +30,12 @@ export const meta = {
id: 'd74ab9eb-bb09-4bba-bf24-fb58f761e1e9',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

7
packages/backend/src/server/api/endpoints/drive/folders/update.ts
View file

@ -10,6 +10,7 @@ import { DriveFolderEntityService } from '@/core/entities/DriveFolderEntityServi
import { GlobalEventService } from '@/core/GlobalEventService.js';
import { DI } from '@/di-symbols.js';
import { ApiError } from '../../../error.js';
import ms from 'ms';
export const meta = {
tags: ['drive'],
@ -43,6 +44,12 @@ export const meta = {
optional: false, nullable: false,
ref: 'DriveFolder',
},
// 100 calls per minute
limit: {
duration: 1000 * 60,
max: 100,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/drive/stream.ts
View file

@ -26,6 +26,12 @@ export const meta = {
ref: 'DriveFile',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/email-address/available.ts
View file

@ -26,6 +26,12 @@ export const meta = {
},
},
},
// 5 calls per second
limit: {
duration: 1000,
max: 5,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/emoji.ts
View file

@ -22,6 +22,12 @@ export const meta = {
optional: false, nullable: false,
ref: 'EmojiDetailed',
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/emojis.ts
View file

@ -32,6 +32,12 @@ export const meta = {
},
},
},
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/endpoint.ts
View file

@ -28,6 +28,12 @@ export const meta = {
},
},
},
// 5 calls per second
limit: {
duration: 1000,
max: 5,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/endpoints.ts
View file

@ -26,6 +26,12 @@ export const meta = {
'...',
],
},
// 5 calls per second
limit: {
duration: 1000,
max: 5,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/federation/followers.ts
View file

@ -22,6 +22,12 @@ export const meta = {
ref: 'Following',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/federation/following.ts
View file

@ -22,6 +22,12 @@ export const meta = {
ref: 'Following',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/federation/instances.ts
View file

@ -27,6 +27,12 @@ export const meta = {
ref: 'FederationInstance',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/federation/show-instance.ts
View file

@ -20,6 +20,12 @@ export const meta = {
optional: false, nullable: true,
ref: 'FederationInstance',
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/federation/stats.ts
View file

@ -50,6 +50,12 @@ export const meta = {
otherFollowingCount: { type: 'number' },
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/federation/update-remote-user.ts
View file

@ -12,6 +12,12 @@ export const meta = {
tags: ['federation'],
requireCredential: false,
// 2 calls per second
limit: {
duration: 1000,
max: 2,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/federation/users.ts
View file

@ -24,6 +24,12 @@ export const meta = {
ref: 'UserDetailedNotMe',
},
},
// 10 calls per 5 seconds
limit: {
duration: 1000 * 5,
max: 10,
},
} as const;
export const paramDef = {

6
packages/backend/src/server/api/endpoints/fetch-rss.ts
View file

@ -203,6 +203,12 @@ export const meta = {
},
},
},
// 20 calls per 10 seconds
limit: {
duration: 1000 * 10,
max: 20,
},
} as const;
export const paramDef = {

Some files were not shown because too many files have changed in this diff Show more