implement simple push (receive only for now)

2 files changed, 39 insertions, 2 deletions

diff --git a/routes/nodeinfo.php b/routes/nodeinfo.php
index 2fef63b..1b2b537 100644
--- a/routes/nodeinfo.php
+++ b/routes/nodeinfo.php
@@ -58,7 +58,8 @@ Router::getInstance()->mount('/.well-known/pawpub-instance', function (array $ar
             'auth' => path_to_uri('/auth/main'),
             'subscribe' => path_to_uri('/subscribe'),
             'unsubscribe' => path_to_uri('/unsubscribe'),
-            'push' => path_to_uri('/push')
+            'push' => path_to_uri('/push'),
+            'simplePush' => path_to_uri('/push/simple')
         ]
     ]);
 });
\ No newline at end of file
diff --git a/routes/push.php b/routes/push.php
index f8771f2..d74d973 100644
--- a/routes/push.php
+++ b/routes/push.php
@@ -19,7 +19,7 @@ Router::getInstance()->mount('/push', function (array $args) {
 
     $body = file_get_contents('php://input');
     $obj = json_decode($body);
-    if ($obj === false) {
+    if ($obj === null) {
         throw new BadRequest("request body doesn't look like valid json");
     }
     if (!isset($obj->type, $obj->self)) {
@@ -36,4 +36,40 @@ Router::getInstance()->mount('/push', function (array $args) {
     }
 
     (new ProcessIncomingPush($obj))->submit();
+});
+
+Router::getInstance()->mount('/push/simple', function (array $args) {
+    // receive incoming simple pushes
+    $uri = file_get_contents('php://input');
+    if (!str_starts_with($uri, 'https://')) {
+        throw new BadRequest('dodgy looking uri!');
+    }
+
+    $result = send_request_authenticated($uri);
+    if (!str_contains($result->headers[0], '200')) {
+        throw new BadRequest('unable to fetch that uri!');
+    }
+    $obj = json_decode($result->body);
+
+    if ($obj === null) {
+        throw new BadRequest("fetched content doesn't look like valid json");
+    }
+    if (!isset($obj->type, $obj->self)) {
+        throw new BadRequest('the object needs to have `type` and `self` properties');
+    }
+    if ($obj->self != $uri) {
+        throw new BadRequest('fetched object has a different uri from the one you gave me');
+    }
+    if (!in_array($obj->type, ['actor', 'note', 'interaction', 'extension', 'tombstone'])) {
+        throw new BadRequest('invalid object type!');
+    }
+
+    // only add ratelimiting delay after having validated it, to mitigate the
+    // possibility of denial-of-service attacks (still possible though)
+    // FIXME: use a proper rate limit system
+    sleep(5);
+    // and only add the job if the client actually waited for the delay time
+    if (!connection_aborted()) {
+        (new ProcessIncomingPush($obj))->submit();
+    }
 });
\ No newline at end of file