our checks for inbox&c hosts matching, may be too strict

we currently check that an actor's inbox, sharedInbox, &c are all hosted on the same domain name, and that this name matches the actor's

this may be too strict: there's no particular reason to have webfinger, actor's hostname, and collections all on the same hostname

for example, @bsky.brid.gy@bsky.brid.gy has inbox https://bsky.brid.gy/bsky.brid.gy/inbox but sharedInbox https://web.brid.gy/ap/sharedInbox

I feel like we really need to pull in the public suffix list and only check that the various collections are hosted under the same "authority" (i.e. at least one label below a public suffix)

Related: I'm not sure if we currently have any checks in place for the 'url' being on the same host as the actor and/or id, but if we do that needs to be removed. It's valid according to the specification. Christine Lemmer-Webber has been posting a lot on fedi about it recently, as it's a way you can have a "static" blog. See https://social.coop/@cwebber/113517115992533495

I don't think we can do that, unfortunately. It would open up a severe domain takeover vuln because of how we verify provenance.

Not even Mastodon allows that AFAIK

Supposedly it does - https://chitter.xyz/@archenoth/113517144670093057; https://maho.dev/2024/02/a-guide-to-implementing-activitypub-in-a-static-site-or-any-website-part-3/

World's scariest actor.

{
    "@context": "https://www.w3.org/ns/activitystreams",
    "id": "https://maho.dev/@blog",
    "type": "Person",
    "following": "https://hachyderm.io/users/mapache/following",
    "followers": "https://hachyderm.io/users/mapache/followers",
    "inbox": "https://activitypubdotnet.azurewebsites.net/api/Inbox",
    "outbox": "https://maho.dev/socialweb/outbox",
    "preferredUsername": "blog",
    "name": "Maho Pacheco - Blog",
    "summary": "Bite-sized pieces of Software Engineering from a Garbage Code Connoisseur",
    "url": "https://maho.dev/",
}

Sigh. That's a mess where do I even begin

yeah, even same-authority checks won't cover that lol

does it have no pubkey? 😕

added question label

removed question label

added possible bug label

mentioned in commit caae6c0b

mentioned in merge request !773 (merged)

I think this error might be related, I noticed a lot if not most posts from bridgy fed are missing in my timeline and in the logs I can see that it failed to create the posts because of a url uri mismatch, I can force load the posts into my instance by looking up the "https://bsky.brid.gy/convert/ap" link from the error message through the notes search, but thats not really practical

INFO 1	[remote ap]	Create: https://bsky.brid.gy/convert/ap/at://did:plc:qola2mahe25s4h6irbwp7yjc/app.bsky.feed.post/3lbtyo6nmwk23#bridgy-fed-create
ERR  1	[queue inbox]	failed(Error: note url <> uri host mismatch: https://fed.brid.gy/r/https://bsky.app/profile/did:plc:qola2mahe25s4h6irbwp7yjc/post/3lbtyo6nmwk23 <> https://bsky.brid.gy/convert/ap/at://did:plc:qola2mahe25s4h6irbwp7yjc/app.bsky.feed.post/3lbtyo6nmwk23) id=861860 attempts=1/8 age=15ms activity=https://bsky.brid.gy/convert/ap/at://did:plc:qola2mahe25s4h6irbwp7yjc/app.bsky.feed.post/3lbtyo6nmwk23#bridgy-fed-create {
  job: {
    name: undefined,
    info: 'id=861860 attempts=1/8 age=15ms',
    failedReason: 'note url <> uri host mismatch: https://fed.brid.gy/r/https://bsky.app/profile/did:plc:qola2mahe25s4h6irbwp7yjc/post/3lbtyo6nmwk23 <> https://bsky.brid.gy/convert/ap/at://did:plc:qola2mahe25s4h6irbwp7yjc/app.bsky.feed.post/3lbtyo6nmwk23',
    data: { activity: [Object], signature: [Object] }
  },
  e: {
    stack: 'Error: note url <> uri host mismatch: https://fed.brid.gy/r/https://bsky.app/profile/did:plc:qola2mahe25s4h6irbwp7yjc/post/3lbtyo6nmwk23 <> https://bsky.brid.gy/convert/ap/at://did:plc:qola2mahe25s4h6irbwp7yjc/app.bsky.feed.post/3lbtyo6nmwk23\n' +
      '    at ApNoteService.createNote (file:///sharkey/packages/backend/built/core/activitypub/models/ApNoteService.js:163:23)\n' +
      '    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n' +
      '    at async ApInboxService.createNote (file:///sharkey/packages/backend/built/core/activitypub/ApInboxService.js:406:13)\n' +
      '    at async ApInboxService.create (file:///sharkey/packages/backend/built/core/activitypub/ApInboxService.js:383:13)\n' +
      '    at async ApInboxService.performOneActivity (file:///sharkey/packages/backend/built/core/activitypub/ApInboxService.js:162:20)\n' +
      '    at async ApInboxService.performActivity (file:///sharkey/packages/backend/built/core/activitypub/ApInboxService.js:147:22)\n' +
      '    at async InboxProcessorService.process (file:///sharkey/packages/backend/built/queue/processors/InboxProcessorService.js:195:28)\n' +
      '    at async Worker.processJob (/sharkey/node_modules/.pnpm/bullmq@5.13.2/node_modules/bullmq/dist/cjs/classes/worker.js:455:28)\n' +
      '    at async Worker.retryIfFailed (/sharkey/node_modules/.pnpm/bullmq@5.13.2/node_modules/bullmq/dist/cjs/classes/worker.js:640:24)',
    message: 'note url <> uri host mismatch: https://fed.brid.gy/r/https://bsky.app/profile/did:plc:qola2mahe25s4h6irbwp7yjc/post/3lbtyo6nmwk23 <> https://bsky.brid.gy/convert/ap/at://did:plc:qola2mahe25s4h6irbwp7yjc/app.bsky.feed.post/3lbtyo6nmwk23',
    name: 'Error'
  }
}

mentioned in commit 387dc4bb

mentioned in commit ab996928

closed with commit 387dc4bb

mentioned in commit 9ac5f222

mentioned in commit 1e172eaa