去中心化笔记与 ActivityPub 联邦协议

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "id": "https://example.com/users/alice",
  "type": "Person",
  "preferredUsername": "alice",
  "name": "Alice Chen",
  "summary": "Go 开发者，微型博客爱好者",
  "url": "https://example.com/@alice",
  "inbox": "https://example.com/users/alice/inbox",
  "outbox": "https://example.com/users/alice/outbox",
  "followers": "https://example.com/users/alice/followers",
  "following": "https://example.com/users/alice/following",
  "publicKey": {
    "id": "https://example.com/users/alice#main-key",
    "owner": "https://example.com/users/alice",
    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...\n-----END PUBLIC KEY-----"
  }
}

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "id": "https://example.com/activities/123",
  "type": "Create",
  "actor": "https://example.com/users/alice",
  "published": "2024-09-22T10:00:00Z",
  "to": ["https://www.w3.org/ns/activitystreams#Public"],
  "object": {
    "id": "https://example.com/posts/456",
    "type": "Note",
    "attributedTo": "https://example.com/users/alice",
    "content": "<p>这是一篇联邦网络的短文！</p>",
    "published": "2024-09-22T10:00:00Z",
    "to": ["https://www.w3.org/ns/activitystreams#Public"],
    "cc": ["https://example.com/users/alice/followers"]
  }
}

package fed

import (
	"encoding/json"
	"fmt"
	"net/http"
	
	"github.com/gin-gonic/gin"
)

// ActorHandler 处理 ActivityPub Actor 相关请求
func (s *FederationServer) ActorHandler(c *gin.Context) {
	username := c.Param("username")
	
	user, err := s.userService.GetByUsername(c.Request.Context(), username)
	if err != nil {
		c.AbortWithStatus(404)
		return
	}
	
	actor := map[string]interface{}{
		"@context": [
			"https://www.w3.org/ns/activitystreams",
			"https://w3id.org/security/v1",
		],
		"id":                fmt.Sprintf("%s/users/%s", s.baseURL, username),
		"type":              "Person",
		"preferredUsername": user.Username,
		"name":              user.DisplayName,
		"summary":           user.Bio,
		"url":               fmt.Sprintf("%s/@%s", s.baseURL, username),
		"inbox":             fmt.Sprintf("%s/users/%s/inbox", s.baseURL, username),
		"outbox":            fmt.Sprintf("%s/users/%s/outbox", s.baseURL, username),
		"followers":         fmt.Sprintf("%s/users/%s/followers", s.baseURL, username),
		"following":         fmt.Sprintf("%s/users/%s/following", s.baseURL, username),
		"publicKey": map[string]string{
			"id":           fmt.Sprintf("%s/users/%s#main-key", s.baseURL, username),
			"owner":        fmt.Sprintf("%s/users/%s", s.baseURL, username),
			"publicKeyPem": user.PublicKeyPEM,
		},
	}
	
	c.Header("Content-Type", "application/activity+json")
	c.JSON(200, actor)
}

// InboxHandler 处理接收到的联邦消息
func (s *FederationServer) InboxHandler(c *gin.Context) {
	username := c.Param("username")
	
	// 1. 验证 HTTP 签名
	if err := s.verifySignature(c.Request); err != nil {
		c.AbortWithStatusJSON(401, gin.H{"error": "invalid signature"})
		return
	}
	
	// 2. 解析 Activity
	var activity Activity
	if err := c.ShouldBindJSON(&activity); err != nil {
		c.AbortWithStatusJSON(400, gin.H{"error": "invalid activity"})
		return
	}
	
	// 3. 根据 Activity 类型分发处理
	switch activity.Type {
	case "Create":
		s.handleCreateActivity(c.Request.Context(), username, activity)
	case "Follow":
		s.handleFollowActivity(c.Request.Context(), username, activity)
	case "Like", "Announce":
		s.handleInteractionActivity(c.Request.Context(), username, activity)
	case "Delete":
		s.handleDeleteActivity(c.Request.Context(), username, activity)
	case "Undo":
		s.handleUndoActivity(c.Request.Context(), username, activity)
	default:
		// 未知类型，记录日志但返回成功
		fmt.Printf("unknown activity type: %s\n", activity.Type)
	}
	
	c.Status(202)  // ActivityPub 推荐返回 202 Accepted
}

func (s *FederationServer) handleCreateActivity(ctx context.Context, username string, activity Activity) {
	// 获取创建的对象
	obj, err := s.resolveObject(ctx, activity.Object)
	if err != nil {
		fmt.Printf("resolve object failed: %v\n", err)
		return
	}
	
	// 保存远程帖子到本地数据库
	remotePost := &domain.RemotePost{
		ID:           obj.ID,
		ActorID:      activity.Actor,
		Type:         obj.Type,
		Content:      obj.Content,
		PublishedAt:  obj.Published,
		To:           obj.To,
		CC:           obj.CC,
		FetchedAt:    time.Now().UTC(),
	}
	
	if err := s.postService.SaveRemotePost(ctx, remotePost); err != nil {
		fmt.Printf("save remote post failed: %v\n", err)
	}
}

func (s *FederationServer) handleFollowActivity(ctx context.Context, username string, activity Activity) {
	// 有人关注了本实例的用户
	followerID := activity.Actor
	followingUser, err := s.userService.GetByUsername(ctx, username)
	if err != nil {
		return
	}
	
	// 保存关注关系
	if err := s.userService.AddFollower(ctx, followingUser.ID, followerID); err != nil {
		fmt.Printf("add follower failed: %v\n", err)
		return
	}
	
	// 发送 Accept Activity 响应
	accept := Activity{
		Context: "https://www.w3.org/ns/activitystreams",
		ID:      fmt.Sprintf("%s/accepts/%s", s.baseURL, generateID()),
		Type:    "Accept",
		Actor:   fmt.Sprintf("%s/users/%s", s.baseURL, username),
		Object:  activity.ID,
	}
	
	// 异步发送回对方的 inbox
	go s.deliverActivity(followerID, accept)
}

package crypto

import (
	"crypto"
	"crypto/rand"
	"crypto/rsa"
	"crypto/sha256"
	"crypto/x509"
	"encoding/base64"
	"encoding/pem"
	"fmt"
	"net/http"
	"strings"
	"time"
)

type HTTPSigner struct {
	privateKey *rsa.PrivateKey
	publicKey  *rsa.PublicKey
	keyID      string
}

func NewHTTPSigner(privateKeyPEM, keyID string) (*HTTPSigner, error) {
	block, _ := pem.Decode([]byte(privateKeyPEM))
	if block == nil {
		return nil, fmt.Errorf("failed to decode PEM block")
	}
	
	privateKey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
	if err != nil {
		// 尝试 PKCS8
		key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
		if err != nil {
			return nil, err
		}
		privateKey = key.(*rsa.PrivateKey)
	}
	
	return &HTTPSigner{
		privateKey: privateKey,
		publicKey:  &privateKey.PublicKey,
		keyID:      keyID,
	}, nil
}

func (s *HTTPSigner) Sign(req *http.Request, body []byte) error {
	// 计算 Digest
	digest := sha256.Sum256(body)
	digestB64 := base64.StdEncoding.EncodeToString(digest[:])
	req.Header.Set("Digest", fmt.Sprintf("SHA-256=%s", digestB64))
	
	// 生成签名字符串
	signingParts := []string{
		fmt.Sprintf("(request-target): %s %s", strings.ToLower(req.Method), req.URL.RequestURI()),
		fmt.Sprintf("host: %s", req.Host),
		fmt.Sprintf("date: %s", req.Header.Get("Date")),
		fmt.Sprintf("digest: %s", req.Header.Get("Digest")),
	}
	signingString := strings.Join(signingParts, "\n")
	
	// RSA 签名
	hash := sha256.Sum256([]byte(signingString))
	signature, err := rsa.SignPKCS1v15(rand.Reader, s.privateKey, crypto.SHA256, hash[:])
	if err != nil {
		return err
	}
	
	// 编码签名头
	sigHeader := fmt.Sprintf(
		`keyId="%s",algorithm="rsa-sha256",headers="(request-target) host date digest",signature="%s"`,
		s.keyID,
		base64.StdEncoding.EncodeToString(signature),
	)
	req.Header.Set("Signature", sigHeader)
	
	return nil
}

func VerifySignature(req *http.Request, publicKeyPEM string) error {
	// 解析公钥
	block, _ := pem.Decode([]byte(publicKeyPEM))
	if block == nil {
		return fmt.Errorf("failed to decode public key PEM")
	}
	
	publicKey, err := x509.ParsePKIXPublicKey(block.Bytes)
	if err != nil {
		return err
	}
	rsaPublicKey := publicKey.(*rsa.PublicKey)
	
	// 解析 Signature 头
	sigHeader := req.Header.Get("Signature")
	// ... 解析 keyId, algorithm, headers, signature
	
	// 重构签名字符串
	// ... 根据 headers 列表重构
	
	// 验证签名
	// ...
	
	return nil
}

func (s *FederationServer) WebFingerHandler(c *gin.Context) {
	resource := c.Query("resource")
	
	// 解析 acct:username@domain
	var username string
	fmt.Sscanf(resource, "acct:%s", &username)
	username = strings.Split(username, "@")[0]
	
	c.JSON(200, map[string]interface{}{
		"subject": resource,
		"aliases": []string{
			fmt.Sprintf("%s/@%s", s.baseURL, username),
			fmt.Sprintf("%s/users/%s", s.baseURL, username),
		},
		"links": []map[string]string{
			{
				"rel":  "self",
				"type": "application/activity+json",
				"href": fmt.Sprintf("%s/users/%s", s.baseURL, username),
			},
			{
				"rel":  "http://webfinger.net/rel/profile-page",
				"type": "text/html",
				"href": fmt.Sprintf("%s/@%s", s.baseURL, username),
			},
		},
	})
}

func (s *FederationServer) resolveObject(ctx context.Context, objectID string) (*Object, error) {
	// 1. 检查本地缓存
	if cached := s.cache.GetObject(objectID); cached != nil {
		return cached, nil
	}
	
	// 2. 发送签名的 GET 请求
	req, _ := http.NewRequestWithContext(ctx, "GET", objectID, nil)
	req.Header.Set("Accept", "application/activity+json")
	
	if err := s.signer.Sign(req, nil); err != nil {
		return nil, err
	}
	
	resp, err := s.httpClient.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()
	
	if resp.StatusCode != 200 {
		return nil, fmt.Errorf("remote returned %d", resp.StatusCode)
	}
	
	var obj Object
	if err := json.NewDecoder(resp.Body).Decode(&obj); err != nil {
		return nil, err
	}
	
	// 3. 缓存结果
	s.cache.SetObject(objectID, &obj, 5*time.Minute)
	
	return &obj, nil
}