routes/push.php


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

<?php

use Digitigrade\HttpResponseStatus\BadRequest;
use Digitigrade\HttpResponseStatus\Forbidden;
use Digitigrade\HttpResponseStatus\Unauthorized;
use Digitigrade\Job\ProcessIncomingPush;
use Digitigrade\Model\Instance;
use Digitigrade\Router;

Router::getInstance()->mount('/push', function (array $args) {
    // receive incoming pushes
    $instance = Instance::findByRequestHeaders();
    if ($instance == null) {
        throw new Unauthorized('please identify yourself with a valid Authorization header!');
    }
    if (!$instance->auth->inboundPushEnabled) {
        throw new Forbidden('you are not permitted to push as i have not subscribed to you');
    }

    $body = file_get_contents('php://input');
    $obj = json_decode($body);
    if ($obj === false) {
        throw new BadRequest("request body doesn't look like valid json");
    }
    if (!isset($obj->type, $obj->self)) {
        throw new BadRequest('the object needs to have `type` and `self` properties');
    }
    if (!str_starts_with($obj->self, 'https://')) {
        throw new BadRequest('dodgy looking `self` uri!');
    }
    if (hostname_from_uri($obj->self) != $instance->domain) {
        throw new Forbidden('you may not push objects belonging to a different instance');
    }
    if (!in_array($obj->type, ['actor', 'note', 'interaction', 'extension', 'tombstone'])) {
        throw new BadRequest('invalid object type!');
    }

    (new ProcessIncomingPush($obj))->submit();
});