Merge pull request #19 from aluitink/refactor/activitypub-client-factory

Refactor/activitypub client factory

Author: aluitink

src/Broca.ActivityPub.Client/Extensions/ServiceCollectionExtensions.cs

@@ -56,6 +56,9 @@ public static IServiceCollection AddActivityPubClient(
         services.TryAddScoped<ActivityPubClient>();
         services.TryAddScoped<IActivityPubClient>(sp => sp.GetRequiredService<ActivityPubClient>());
 
+        // Register the factory for creating per-actor clients
+        services.TryAddSingleton<IActivityPubClientFactory, ActivityPubClientFactory>();
+
         return services;
     }
 

src/Broca.ActivityPub.Client/Services/ActivityBuilder.cs

@@ -443,6 +443,13 @@ public INoteBuilder ToFollowers()
         return this;
     }
 
+    public INoteBuilder CcFollowers()
+    {
+        var followersUrl = $"{_actorId}/followers";
+        _cc.Add(new Link { Href = new Uri(followersUrl) });
+        return this;
+    }
+
     public INoteBuilder WithMention(string actorId, string name)
     {
         // Add to recipients

src/Broca.ActivityPub.Client/Services/ActivityPubClientFactory.cs

@@ -0,0 +1,47 @@
+using Broca.ActivityPub.Core.Interfaces;
+using Broca.ActivityPub.Core.Models;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+
+namespace Broca.ActivityPub.Client.Services;
+
+public class ActivityPubClientFactory : IActivityPubClientFactory
+{
+    private readonly IHttpClientFactory _httpClientFactory;
+    private readonly IWebFingerService _webFingerService;
+    private readonly HttpSignatureService _signatureService;
+    private readonly ILogger<ActivityPubClient> _clientLogger;
+
+    public ActivityPubClientFactory(
+        IHttpClientFactory httpClientFactory,
+        IWebFingerService webFingerService,
+        HttpSignatureService signatureService,
+        ILogger<ActivityPubClient> clientLogger)
+    {
+        _httpClientFactory = httpClientFactory;
+        _webFingerService = webFingerService;
+        _signatureService = signatureService;
+        _clientLogger = clientLogger;
+    }
+
+    public IActivityPubClient CreateAnonymous()
+        => new ActivityPubClient(
+            _httpClientFactory,
+            _webFingerService,
+            _signatureService,
+            Options.Create(new ActivityPubClientOptions()),
+            _clientLogger);
+
+    public IActivityPubClient CreateForActor(string actorId, string publicKeyId, string privateKeyPem)
+        => new ActivityPubClient(
+            _httpClientFactory,
+            _webFingerService,
+            _signatureService,
+            Options.Create(new ActivityPubClientOptions
+            {
+                ActorId = actorId,
+                PublicKeyId = publicKeyId,
+                PrivateKeyPem = privateKeyPem
+            }),
+            _clientLogger);
+}

src/Broca.ActivityPub.Components/PostComposer.razor

@@ -343,10 +343,10 @@
             switch (visibility)
             {
                 case "public":
-                    builder.ToPublic();
+                    builder.ToPublic().CcFollowers();
                     break;
                 case "unlisted":
-                    builder.ToPublic(); // Unlisted is still public but not in public timelines
+                    builder.CcFollowers();
                     break;
                 case "followers":
                     builder.ToFollowers();
@@ -370,6 +370,18 @@
             }
 
             var activity = builder.Build();
+            
+            // Debug: Log the activity before sending
+            var activityJson = System.Text.Json.JsonSerializer.Serialize(activity, new System.Text.Json.JsonSerializerOptions 
+            { 
+                WriteIndented = true,
+                DefaultIgnoreCondition = System.Text.Json.Serialization.JsonIgnoreCondition.WhenWritingNull
+            });
+            Console.WriteLine($"[PostComposer] Activity being sent:\n{activityJson}");
+            Console.WriteLine($"[PostComposer] Visibility: {visibility}");
+            Console.WriteLine($"[PostComposer] Activity.To count: {(activity.To?.Count() ?? 0)}");
+            Console.WriteLine($"[PostComposer] Activity.Cc count: {(activity.Cc?.Count() ?? 0)}");
+            
             await Client.PostToOutboxAsync(activity);
 
             successMessage = "Posted successfully!";

src/Broca.ActivityPub.Core/Interfaces/IActivityBuilder.cs

@@ -169,6 +169,11 @@ public interface INoteBuilder
     /// </summary>
     INoteBuilder ToFollowers();
 
+    /// <summary>
+    /// Adds the actor's followers to the Cc field
+    /// </summary>
+    INoteBuilder CcFollowers();
+
     /// <summary>
     /// Adds a tag or mention
     /// </summary>

src/Broca.ActivityPub.Core/Interfaces/IActivityPubClientFactory.cs

@@ -0,0 +1,7 @@
+namespace Broca.ActivityPub.Core.Interfaces;
+
+public interface IActivityPubClientFactory
+{
+    IActivityPubClient CreateAnonymous();
+    IActivityPubClient CreateForActor(string actorId, string publicKeyId, string privateKeyPem);
+}

src/Broca.ActivityPub.Core/Interfaces/IHttpSignatureVerifier.cs

@@ -0,0 +1,13 @@
+namespace Broca.ActivityPub.Core.Interfaces;
+
+public interface IHttpSignatureVerifier
+{
+    Task<bool> VerifyAsync(
+        IDictionary<string, string> headers,
+        string publicKeyPem,
+        CancellationToken cancellationToken = default);
+
+    bool VerifyDigest(byte[] bodyBytes, string digestHeader);
+
+    string GetSignatureKeyId(string signatureHeader);
+}

src/Broca.ActivityPub.Server/Controllers/InboxController.cs

@@ -1,7 +1,4 @@
-using System.Net.Http.Headers;
-using System.Net.Http.Json;
 using System.Text.Json;
-using Broca.ActivityPub.Client.Services;
 using Broca.ActivityPub.Core.Interfaces;
 using Broca.ActivityPub.Core.Models;
 using Broca.ActivityPub.Server.Services;
@@ -21,10 +18,8 @@ public class InboxController : ActivityPubControllerBase
     private readonly IInboxHandler _inboxHandler;
     private readonly IActivityRepository _activityRepository;
     private readonly IActorRepository _actorRepository;
-    private readonly HttpSignatureService _signatureService;
-    private readonly IActivityPubClient _activityPubClient;
-    private readonly ISystemIdentityService _systemIdentityService;
-    private readonly IHttpClientFactory _httpClientFactory;
+    private readonly IHttpSignatureVerifier _signatureVerifier;
+    private readonly SignedClientProvider _signedClientProvider;
     private readonly AttachmentProcessingService _attachmentProcessingService;
     private readonly ObjectEnrichmentService _enrichmentService;
     private readonly IMemoryCache _cache;
@@ -37,10 +32,8 @@ public InboxController(
         IInboxHandler inboxHandler,
         IActivityRepository activityRepository,
         IActorRepository actorRepository,
-        HttpSignatureService signatureService,
-        IActivityPubClient activityPubClient,
-        ISystemIdentityService systemIdentityService,
-        IHttpClientFactory httpClientFactory,
+        IHttpSignatureVerifier signatureVerifier,
+        SignedClientProvider signedClientProvider,
         AttachmentProcessingService attachmentProcessingService,
         ObjectEnrichmentService enrichmentService,
         IMemoryCache cache,
@@ -50,10 +43,8 @@ public InboxController(
         _inboxHandler = inboxHandler;
         _activityRepository = activityRepository;
         _actorRepository = actorRepository;
-        _signatureService = signatureService;
-        _activityPubClient = activityPubClient;
-        _systemIdentityService = systemIdentityService;
-        _httpClientFactory = httpClientFactory;
+        _signatureVerifier = signatureVerifier;
+        _signedClientProvider = signedClientProvider;
         _attachmentProcessingService = attachmentProcessingService;
         _enrichmentService = enrichmentService;
         _cache = cache;
@@ -233,7 +224,6 @@ private async Task<bool> VerifySignatureAsync(string body, CancellationToken can
         _logger.LogDebug("Starting signature verification. Request headers: {Headers}", 
             string.Join(", ", Request.Headers.Keys));
 
-        // Get Signature header
         if (!Request.Headers.TryGetValue("Signature", out var signatureHeader) || string.IsNullOrEmpty(signatureHeader))
         {
             _logger.LogWarning("Signature header is missing from request");
@@ -242,20 +232,11 @@ private async Task<bool> VerifySignatureAsync(string body, CancellationToken can
 
         _logger.LogDebug("Signature header found: {SignatureHeader}", signatureHeader!);
 
-        // Parse the signature to see what headers it expects
-        var signatureParts = _signatureService.ParseSignatureParts(signatureHeader!);
-        if (signatureParts.TryGetValue("headers", out var headersInSignature))
-        {
-            _logger.LogInformation("Signature expects these headers to be signed: {SignedHeaders}", headersInSignature);
-        }
-        
-        // Extract keyId from signature
-        var keyId = _signatureService.GetSignatureKeyId(signatureHeader!);
+        var keyId = _signatureVerifier.GetSignatureKeyId(signatureHeader!);
         _logger.LogInformation("Extracted keyId from signature: {KeyId}", keyId);
 
         ValidateRequestClockSkew(Request);
 
-        // Fetch the actor's public key
         var publicKeyPem = await FetchActorPublicKeyAsync(keyId, cancellationToken);
 
         if (string.IsNullOrWhiteSpace(publicKeyPem))
@@ -266,62 +247,39 @@ private async Task<bool> VerifySignatureAsync(string body, CancellationToken can
 
         _logger.LogDebug("Successfully fetched public key for keyId: {KeyId}", keyId);
 
-        // Build headers dictionary for verification
         var headers = new Dictionary<string, string>();
-        
-        // Add the Signature header itself (required for verification)
         headers["signature"] = signatureHeader!;
-        
-        // Add (request-target) pseudo-header
-        var requestTarget = $"{Request.Method.ToLower()} {Request.Path}";
-        headers["(request-target)"] = requestTarget;
+        headers["(request-target)"] = $"{Request.Method.ToLower()} {Request.Path}";
 
-        // Add all headers from the request (lowercase keys)
-        // The verification service will use only the ones that are part of the signature
         foreach (var header in Request.Headers)
         {
             var headerName = header.Key.ToLower();
-            // Don't duplicate the signature header
             if (headerName != "signature")
-            {
                 headers[headerName] = header.Value.ToString();
-            }
         }
 
         _logger.LogDebug("Headers being verified: {Headers}", 
             string.Join(", ", headers.Select(h => $"\"{h.Key}\"")));
 
-        // Validate Digest header for POST requests (required per ActivityPub spec)
         if (Request.Method.Equals("POST", StringComparison.OrdinalIgnoreCase))
         {
             if (!Request.Headers.TryGetValue("Digest", out var digestHeader))
             {
                 _logger.LogWarning("POST request missing Digest header");
-                // Some implementations may not send Digest, log but don't fail
             }
             else
             {
-                // Verify the digest matches the body
                 var bodyBytes = System.Text.Encoding.UTF8.GetBytes(body);
-                var expectedDigest = _signatureService.ComputeContentDigestHash(bodyBytes);
-                var digestValue = digestHeader.ToString();
-                
-                if (digestValue.StartsWith("SHA-256="))
+                if (!_signatureVerifier.VerifyDigest(bodyBytes, digestHeader.ToString()))
                 {
-                    var providedDigest = digestValue.Substring(8);
-                    if (providedDigest != expectedDigest)
-                    {
-                        _logger.LogWarning("Digest header mismatch. Expected: {Expected}, Got: {Got}", 
-                            expectedDigest, providedDigest);
-                        throw new InvalidOperationException("Digest header does not match request body");
-                    }
+                    _logger.LogWarning("Digest header mismatch for inbox request to keyId: {KeyId}", keyId);
+                    throw new InvalidOperationException("Digest header does not match request body");
                 }
             }
         }
 
-        // Verify the signature
-        _logger.LogDebug("Calling HttpSignatureService.VerifyHttpSignatureAsync with {HeaderCount} headers", headers.Count);
-        var result = await _signatureService.VerifyHttpSignatureAsync(headers, publicKeyPem, cancellationToken);
+        _logger.LogDebug("Calling IHttpSignatureVerifier.VerifyAsync with {HeaderCount} headers", headers.Count);
+        var result = await _signatureVerifier.VerifyAsync(headers, publicKeyPem, cancellationToken);
         _logger.LogDebug("Signature verification result: {Result}", result);
         return result;
     }
@@ -422,21 +380,8 @@ private async Task<bool> VerifySignatureAsync(string body, CancellationToken can
     {
         try
         {
-            var systemActor = await _systemIdentityService.GetSystemActorAsync(cancellationToken);
-            var privateKey = await _systemIdentityService.GetSystemPrivateKeyAsync(cancellationToken);
-            var publicKeyId = $"{systemActor.Id}#main-key";
-
-            using var httpClient = _httpClientFactory.CreateClient("ActivityPub");
-            using var response = await _signatureService.SendSignedGetAsync(
-                httpClient, new Uri(actorUrl), publicKeyId, privateKey, cancellationToken);
-
-            if (!response.IsSuccessStatusCode)
-            {
-                _logger.LogWarning("Signed GET for actor {ActorUrl} failed with status {StatusCode}", actorUrl, response.StatusCode);
-                return null;
-            }
-
-            return await response.Content.ReadFromJsonAsync<Actor>(_jsonOptions, cancellationToken);
+            var client = await _signedClientProvider.CreateForSystemActorAsync(cancellationToken);
+            return await client.GetActorAsync(new Uri(actorUrl), cancellationToken);
         }
         catch (Exception ex)
         {

src/Broca.ActivityPub.Server/Controllers/OutboxController.cs

@@ -1,5 +1,4 @@
 using System.Text.Json;
-using Broca.ActivityPub.Client.Services;
 using Broca.ActivityPub.Core.Interfaces;
 using Broca.ActivityPub.Core.Models;
 using Broca.ActivityPub.Server.Services;
@@ -20,7 +19,7 @@ public class OutboxController : ActivityPubControllerBase
     private readonly OutboxProcessor _outboxProcessor;
     private readonly AttachmentProcessingService _attachmentProcessingService;
     private readonly ObjectEnrichmentService _enrichmentService;
-    private readonly HttpSignatureService _signatureService;
+    private readonly IHttpSignatureVerifier _signatureVerifier;
     private readonly IMemoryCache _cache;
     private readonly ActivityPubServerOptions _options;
     private readonly ILogger<OutboxController> _logger;
@@ -33,7 +32,7 @@ public OutboxController(
         OutboxProcessor outboxProcessor,
         AttachmentProcessingService attachmentProcessingService,
         ObjectEnrichmentService enrichmentService,
-        HttpSignatureService signatureService,
+        IHttpSignatureVerifier signatureVerifier,
         IMemoryCache cache,
         IOptions<ActivityPubServerOptions> options,
         ILogger<OutboxController> logger)
@@ -43,7 +42,7 @@ public OutboxController(
         _outboxProcessor = outboxProcessor;
         _attachmentProcessingService = attachmentProcessingService;
         _enrichmentService = enrichmentService;
-        _signatureService = signatureService;
+        _signatureVerifier = signatureVerifier;
         _cache = cache;
         _options = options.Value;
         _logger = logger;
@@ -190,7 +189,7 @@ public async Task<IActionResult> Post(string username)
         if (!Request.Headers.TryGetValue("Signature", out var signatureHeader) || string.IsNullOrEmpty(signatureHeader))
             return Unauthorized(new { error = "Signature header is missing" });
 
-        var keyId = _signatureService.GetSignatureKeyId(signatureHeader!);
+        var keyId = _signatureVerifier.GetSignatureKeyId(signatureHeader!);
 
         ValidateRequestClockSkew(Request);
 
@@ -215,13 +214,11 @@ public async Task<IActionResult> Post(string username)
             && Request.Headers.TryGetValue("Digest", out var digestHeader))
         {
             var bodyBytes = System.Text.Encoding.UTF8.GetBytes(body);
-            var expectedDigest = _signatureService.ComputeContentDigestHash(bodyBytes);
-            var digestValue = digestHeader.ToString();
-            if (digestValue.StartsWith("SHA-256=") && digestValue.Substring(8) != expectedDigest)
+            if (!_signatureVerifier.VerifyDigest(bodyBytes, digestHeader.ToString()))
                 throw new InvalidOperationException("Digest header does not match request body");
         }
 
-        var isValid = await _signatureService.VerifyHttpSignatureAsync(headers, publicKeyPem, cancellationToken);
+        var isValid = await _signatureVerifier.VerifyAsync(headers, publicKeyPem, cancellationToken);
         if (!isValid)
             return Unauthorized(new { error = "Invalid signature" });