ActivityPub: Digest header is mandatory now for POST requests

1 files changed, 19 insertions, 6 deletions

diff --git a/src/test/java/com/juick/server/tests/ServerTests.java b/src/test/java/com/juick/server/tests/ServerTests.java
index 320ba6fd..925d42f6 100644
--- a/src/test/java/com/juick/server/tests/ServerTests.java
+++ b/src/test/java/com/juick/server/tests/ServerTests.java
@@ -104,6 +104,7 @@ import org.springframework.web.client.ResourceAccessException;
 import org.springframework.web.client.RestTemplate;
 import org.springframework.web.util.UriComponents;
 import org.springframework.web.util.UriComponentsBuilder;
+import org.tomitribe.auth.signatures.Base64;
 import org.w3c.dom.*;
 import org.xml.sax.SAXException;
 import rocks.xmpp.addr.Jid;
@@ -1889,7 +1890,7 @@ public class ServerTests {
     }
 
     @Test
-    public void signingSpec() throws IOException {
+    public void signingSpec() throws IOException, NoSuchAlgorithmException {
         Person from = (Person) signatureManager.getContext(URI.create("http://localhost:8080/u/freefd")).get();
         Person to = (Person) signatureManager.getContext(URI.create("http://localhost:8080/u/ugnich")).get();
         Follow follow = new Follow();
@@ -1910,7 +1911,7 @@ public class ServerTests {
         Person ugnichPerson = profileController.getUser("ugnich");
         now = Instant.now();
         requestDate = DateFormattersHolder.getHttpDateFormatter().format(now);
-        String signatureString = signatureManager.addSignature(ugnichPerson, testHost, "GET", meUri, requestDate);
+        String signatureString = signatureManager.addSignature(ugnichPerson, testHost, "GET", meUri, requestDate, StringUtils.EMPTY);
         MvcResult me = mockMvc.perform(get("/api/me")
                 .header("Host", testHost)
                 .header("Date", requestDate)
@@ -1924,24 +1925,28 @@ public class ServerTests {
         URI testuserUri = URI.create("https://example.com/u/testuser");
         URI testuserkeyUri = URI.create("https://example.com/u/testuser#main-key");
         MockRestServiceServer restServiceServer = MockRestServiceServer.createServer(apClient);
-        restServiceServer.expect(times(3), requestTo(testuserUri))
+        restServiceServer.expect(times(4), requestTo(testuserUri))
                 .andRespond(withSuccess(testuserResponseString, MediaType.APPLICATION_JSON));
-        restServiceServer.expect(times(3), requestTo(testuserkeyUri))
+        restServiceServer.expect(times(4), requestTo(testuserkeyUri))
                 .andRespond(withSuccess(testuserResponseString, MediaType.APPLICATION_JSON));
         Person testuser = (Person) signatureManager.getContext(testuserUri).get();
         assertThat(testuser.getPublicKey().getPublicKeyPem(), is(testKeystoreManager.getPublicKeyPem()));
         Instant now2 = Instant.now();
         String testRequestDate = DateFormattersHolder.getHttpDateFormatter().format(now2);
         String inboxUri = "/api/inbox";
+        var payload = IOUtils.toByteArray(testfollowRequest.getInputStream());
+        final byte[] digest = MessageDigest.getInstance("SHA-256").digest(payload); // (1)
+        final String digestHeader = "SHA-256=" + new String(Base64.encodeBase64(digest));
         String testSignatureString =
                 signatureManager.addSignature(testuser, testHost, "POST",
-                        inboxUri, testRequestDate, testKeystoreManager);
+                        inboxUri, testRequestDate, digestHeader, testKeystoreManager);
         mockMvc.perform(post(inboxUri)
                 .header("Host", testHost)
                 .header("Date", testRequestDate)
+                .header("Digest", digestHeader)
                 .header("Signature", testSignatureString)
                 .contentType(Context.LD_JSON_MEDIA_TYPE)
-                .content(IOUtils.toByteArray(testfollowRequest.getInputStream())))
+                .content(payload))
                 .andExpect(status().isAccepted());
         mockMvc.perform(post(inboxUri)
                 .header("Host", "wronghost")
@@ -1950,6 +1955,14 @@ public class ServerTests {
                 .contentType(Context.LD_JSON_MEDIA_TYPE)
                 .content(IOUtils.toByteArray(testfollowRequest.getInputStream())))
                 .andExpect(status().isUnauthorized());
+        // digest required but not present
+        mockMvc.perform(post(inboxUri)
+                .header("Host", testHost)
+                .header("Date", testRequestDate)
+                .header("Signature", testSignatureString)
+                .contentType(Context.LD_JSON_MEDIA_TYPE)
+                .content(payload))
+                .andExpect(status().isUnauthorized());
         apClient.setRequestFactory(originalRequestFactory);
     }