4 files changed, 71 insertions, 7 deletions

diff --git a/routes/auth.php b/routes/auth.php
index 2127a46..d64331e 100644
--- a/routes/auth.php
+++ b/routes/auth.php
@@ -2,7 +2,7 @@
 
 use Digitigrade\GlobalConfig;
 use Digitigrade\HttpResponseStatus\BadRequest;
-use Digitigrade\HttpResponseStatus\Forbidden;
+use Digitigrade\HttpResponseStatus\Unauthorized;
 use Digitigrade\Job\ExpireInboundAuthToken;
 use Digitigrade\Job\RequestOutboundAuthToken;
 use Digitigrade\Model\Instance;
@@ -19,8 +19,8 @@ Router::getInstance()->mount('/auth/main', function (array $args) {
             if (!isset($_GET['target'])) {
                 throw new BadRequest('you need to specify the `target` GET parameter');
             }
-            $domain = explode('/', $_GET['target'])[2];
-            $instance = Instance::findByDomain($domain);
+            $domain = hostname_from_uri($_GET['target']);
+            $instance = Instance::findByHostname($domain);
             if ($instance == null) {
                 throw new RuntimeException("i can't find your instance information, sorry");
             }
@@ -51,7 +51,7 @@ Router::getInstance()->mount('/auth/main', function (array $args) {
             }
             $instance = Instance::findByDialbackSecret($_GET['secret']);
             if ($instance == null) {
-                throw new Forbidden('the provided secret is invalid!');
+                throw new Unauthorized('the provided secret is invalid!');
             }
 
             $instance->auth->secret = null; // it's been used now
@@ -79,7 +79,7 @@ Router::getInstance()->mount('/auth/main', function (array $args) {
             }
             $instance = Instance::findByInboundAuthToken($_GET['token']);
             if ($instance == null) {
-                throw new Forbidden('the provided token is invalid!');
+                throw new Unauthorized('the provided token is invalid!');
             }
 
             $instance->auth->inboundToken = random_printable_bytes();
@@ -109,7 +109,7 @@ Router::getInstance()->mount('/auth/dialback', function (array $args) {
     if (!isset($_POST['origin'], $_POST['secret'])) {
         throw new BadRequest('send the `origin` and `secret` parameters as POST data please :3');
     }
-    $instance = Instance::findByDomain($_POST['origin']);
+    $instance = Instance::findByHostname($_POST['origin']);
     if ($instance == null) {
         throw new BadRequest("i can't seem to find your instance information!");
     }
diff --git a/routes/nodeinfo.php b/routes/nodeinfo.php
index 93f103c..92f1f7b 100644
--- a/routes/nodeinfo.php
+++ b/routes/nodeinfo.php
@@ -51,7 +51,10 @@ Router::getInstance()->mount('/.well-known/pawpub-instance', function (array $ar
         'softwareVersion' => '0.1.0',
         'softwareDescription' => 'An experimental PawPub server',
         'endpoints' => [
-
+            'auth' => path_to_uri('/auth/main'),
+            'subscribe' => path_to_uri('/subscribe'),
+            'unsubscribe' => path_to_uri('/unsubscribe'),
+            'push' => path_to_uri('/push')
         ]
     ]);
 });
\ No newline at end of file
diff --git a/routes/push.php b/routes/push.php
new file mode 100644
index 0000000..6712fb4
--- /dev/null
+++ b/routes/push.php
@@ -0,0 +1,50 @@
+<?php
+
+use Digitigrade\HttpResponseStatus\BadRequest;
+use Digitigrade\HttpResponseStatus\Forbidden;
+use Digitigrade\HttpResponseStatus\Unauthorized;
+use Digitigrade\Model\Actor;
+use Digitigrade\Model\Instance;
+use Digitigrade\Model\Note;
+use Digitigrade\Router;
+
+Router::getInstance()->mount('/push', function (array $args) {
+    // receive incoming pushes
+    $instance = Instance::findByRequestHeaders();
+    if ($instance == null) {
+        throw new Unauthorized('please identify yourself with a valid Authorization header!');
+    }
+    if (!$instance->auth->inboundPushEnabled) {
+        throw new Forbidden('you are not permitted to push as i have not subscribed to you');
+    }
+
+    $body = file_get_contents('php://input');
+    $obj = json_decode($body);
+    if ($obj === false) {
+        throw new BadRequest("request body doesn't look like valid json");
+    }
+    if (!isset($obj->type, $obj->self)) {
+        throw new BadRequest('the object needs to have `type` and `self` properties');
+    }
+    if (!str_starts_with($obj->self, 'https://')) {
+        throw new BadRequest('dodgy looking `self` uri!');
+    }
+    if (hostname_from_uri($obj->self) != $instance->domain) {
+        throw new Forbidden('you may not push objects belonging to a different instance');
+    }
+
+    switch ($obj->type) {
+        case 'actor':
+            Actor::importFromReceivedObject($obj);
+            break;
+        case 'note':
+            Note::importFromReceivedObject($obj);
+            break;
+        case 'interaction':
+        case 'extension':
+        case 'tombstone':
+            throw new \RuntimeException('object type not yet implemented :(');
+        default:
+            throw new BadRequest('invalid object type');
+    }
+});
\ No newline at end of file
diff --git a/routes/subscribe.php b/routes/subscribe.php
new file mode 100644
index 0000000..c18d484
--- /dev/null
+++ b/routes/subscribe.php
@@ -0,0 +1,11 @@
+<?php
+
+use Digitigrade\Router;
+
+Router::getInstance()->mount('/subscribe', function (array $args) {
+
+});
+
+Router::getInstance()->mount('/unsubscribe', function (array $args) {
+
+});
\ No newline at end of file