Warp/server/internal/federationapi/keys.go

package federationapi

import (
	"context"
	"encoding/json"
	"net/http"

	"github.com/dariuszjaniak/warp/server/internal/federation"
	"github.com/dariuszjaniak/warp/server/internal/httputil"
	"github.com/dariuszjaniak/warp/server/internal/matrix/id"
)

// The end-to-end encryption endpoints other servers call: the keys of this
// server's users, their one-time keys, and their whole device lists.

// KeyService answers other servers' questions about this server's users'
// keys, and takes in their news about their own users'. *keyserver.API
// satisfies it.
type KeyService interface {
	QueryLocalKeys(ctx context.Context, req federation.UserKeysQueryRequest) (federation.UserKeysQueryResponse, error)
	ClaimLocalKeys(ctx context.Context, want map[string]map[string]string) (map[string]map[string]map[string]json.RawMessage, error)
	UserDevices(ctx context.Context, userID string) (federation.UserDevicesResponse, error)
	RemoteDeviceListUpdate(ctx context.Context, update federation.DeviceListUpdateContent) error
	RemoteSigningKeyUpdate(ctx context.Context, update federation.SigningKeyUpdateContent) error
}

// registerKeyRoutes adds the key endpoints, if there is a keyserver.
func (s *Server) registerKeyRoutes(authed func(string, authedHandler)) {
	if s.keyService == nil {
		return
	}
	const v1 = "/_matrix/federation/v1"
	authed("POST "+v1+"/user/keys/query", s.handleUserKeysQuery)
	authed("POST "+v1+"/user/keys/claim", s.handleUserKeysClaim)
	authed("GET "+v1+"/user/devices/{userID}", s.handleUserDevices)
}

func (s *Server) handleUserKeysQuery(w http.ResponseWriter, r *http.Request, _ string, body []byte) error {
	var req federation.UserKeysQueryRequest
	if err := decode(body, &req); err != nil {
		return err
	}
	resp, err := s.keyService.QueryLocalKeys(r.Context(), req)
	if err != nil {
		return err
	}
	httputil.WriteJSON(w, http.StatusOK, resp)
	return nil
}

func (s *Server) handleUserKeysClaim(w http.ResponseWriter, r *http.Request, _ string, body []byte) error {
	var req federation.UserKeysClaimRequest
	if err := decode(body, &req); err != nil {
		return err
	}
	claimed, err := s.keyService.ClaimLocalKeys(r.Context(), req.OneTimeKeys)
	if err != nil {
		return err
	}
	httputil.WriteJSON(w, http.StatusOK, federation.UserKeysClaimResponse{OneTimeKeys: claimed})
	return nil
}

func (s *Server) handleUserDevices(w http.ResponseWriter, r *http.Request, _ string, _ []byte) error {
	userID := r.PathValue("userID")
	server, err := id.ServerNameOf(userID)
	if err != nil {
		return httputil.InvalidParam("%s is not a user ID", userID)
	}
	if server != s.serverName {
		return httputil.NotFound("%s is not a user of this server", userID)
	}
	resp, err := s.keyService.UserDevices(r.Context(), userID)
	if err != nil {
		return err
	}
	httputil.WriteJSON(w, http.StatusOK, resp)
	return nil
}

// receiveKeyEDU takes in an m.device_list_update or m.signing_key_update:
// a user of the sending server changed their keys. The keyserver brings
// its cached copy of them up to date and tells the local clients that
// care. An update about a user of another server is dropped — a server
// speaks for its own users only.
func (s *Server) receiveKeyEDU(ctx context.Context, origin string, edu federation.EDU) {
	if s.keyService == nil {
		return
	}
	var err error
	switch edu.Type {
	case federation.EDUDeviceListUp:
		var c federation.DeviceListUpdateContent
		if json.Unmarshal(edu.Content, &c) != nil || !sameServer(c.UserID, origin) {
			return
		}
		err = s.keyService.RemoteDeviceListUpdate(ctx, c)
	case federation.EDUSigningKeys:
		var c federation.SigningKeyUpdateContent
		if json.Unmarshal(edu.Content, &c) != nil || !sameServer(c.UserID, origin) {
			return
		}
		err = s.keyService.RemoteSigningKeyUpdate(ctx, c)
	default:
		return
	}
	if err != nil {
		s.log.Debug("ignored a key update EDU", "origin", origin, "type", edu.Type, "error", err)
	}
}