devsyncwrld/backspace
1
0
Fork 0
Code Issues Pull Requests Actions 26 Packages Projects Releases Wiki Activity

feat(federation): switch relay+sync handlers to verifyPeerSignature (FED-011)

Browse Source
This commit is contained in:
Jannis Braun
2026-03-31 20:43:41 +02:00
parent dcf0bc1857
commit 2ceea5e474
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/server/src/routes/federation.ts
+3 -3
View File
@@ -2,7 +2,7 @@ import type { FastifyInstance } from 'fastify';
import { randomBytes } from 'node:crypto'; import { randomBytes } from 'node:crypto';
import { eq, and, or, isNull, inArray, sql } from 'drizzle-orm'; import { eq, and, or, isNull, inArray, sql } from 'drizzle-orm';
import { authenticate, requireAdmin } from '../utils/auth.js'; import { authenticate, requireAdmin } from '../utils/auth.js';
import { generateHmacSecret, getOurOrigin, parseFederationHeaders, verifySignature } from '../utils/federationAuth.js'; import { generateHmacSecret, getOurOrigin, parseFederationHeaders, verifySignature, verifyPeerSignature } from '../utils/federationAuth.js';
import { generateSnowflake } from '../utils/snowflake.js'; import { generateSnowflake } from '../utils/snowflake.js';
import { getDb, getRawDb, schema } from '../db/index.js'; import { getDb, getRawDb, schema } from '../db/index.js';
import { config } from '../config.js'; import { config } from '../config.js';
@@ -461,7 +461,7 @@ export async function federationRoutes(app: FastifyInstance): Promise<void> {
// Serialize body back to JSON for HMAC verification (we control both sides) // Serialize body back to JSON for HMAC verification (we control both sides)
const bodyString = JSON.stringify(request.body); const bodyString = JSON.stringify(request.body);
if (!verifySignature(bodyString, fedHeaders.signature, peer.hmacSecret, fedHeaders.timestamp, fedHeaders.nonce)) { if (!verifyPeerSignature(bodyString, fedHeaders.signature, fedHeaders.timestamp, fedHeaders.nonce, peer)) {
return reply.code(401).send({ error: 'Invalid signature', statusCode: 401 }); return reply.code(401).send({ error: 'Invalid signature', statusCode: 401 });
} }
@@ -550,7 +550,7 @@ export async function federationRoutes(app: FastifyInstance): Promise<void> {
} }
const bodyString = JSON.stringify(request.body); const bodyString = JSON.stringify(request.body);
if (!verifySignature(bodyString, fedHeaders.signature, peer.hmacSecret, fedHeaders.timestamp, fedHeaders.nonce)) { if (!verifyPeerSignature(bodyString, fedHeaders.signature, fedHeaders.timestamp, fedHeaders.nonce, peer)) {
return reply.code(401).send({ error: 'Invalid signature', statusCode: 401 }); return reply.code(401).send({ error: 'Invalid signature', statusCode: 401 });
} }