mirrors/fep
1
0
Fork 0
mirror of https://codeberg.org/fediverse/fep.git synced 2026-08-05 03:35:52 +00:00
Code Packages Wiki Activity

FEP-ae97: Update proposal (#682)

Browse Source 
- Added section describing Media API.
- Specified status codes for error responses.
- Updated security considerations.

Reviewed-on: https://codeberg.org/fediverse/fep/pulls/682
Co-authored-by: silverpill <silverpill@firemail.cc>
Co-committed-by: silverpill <silverpill@firemail.cc>
This commit is contained in:
silverpill
2025-09-18 01:37:24 +02:00
committed by silverpill
parent 4848054aa1
commit e37f0d9dba
1 changed files with 31 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fep/ae97/fep-ae97.md
+31 -2
View File
@@ -44,7 +44,9 @@ Example:
}
```
The client MUST attach the RSA key to the actor object via `publicKey` property, and also add it to the `assertionMethod` array as described in [FEP-521a]. If the server's response contains other keys, they SHOULD be added to the `assertionMethod` array as well.
If the server can't register the actor, it MUST return a `400 Bad Request` status code.
If the registration is successful, the client MUST attach the RSA key to the actor object via `publicKey` property, and also add it to the `assertionMethod` array as described in [FEP-521a]. If the server's response contains other keys, they SHOULD be added to the `assertionMethod` array as well.
If the client uses [compatible identifiers][CompatibleIdentifiers], then key identifiers MUST be generated with the server's [origin][Origin].
@@ -58,15 +60,40 @@ If activity contains a wrapped object (as in `Create` and `Update` activities),
The server MUST deliver activities to their indended audiences without altering them. When signing HTTP requests, the server uses the RSA key generated during the registration.
If the actor of the submitted activity is not registered, the server MUST return a `403 Forbidden` status code.
## Receiving activities
Client receives activities by polling the actor's inbox.
Requests to inbox endpoint MUST have an [HTTP signature][HttpSig] created using the main actor key (the one generated by the client, not a server-generated key).
If the owner of the inbox is not registered, the server MUST return a `403 Forbidden` status code.
## Uploading media
To upload a media file, the client sends an HTTP POST request to the gateway endpoint at the `/.well-known/apgateway-media` path. The body of the request MUST be the media in the form of binary data. The request MUST contain a `Content-Type` header and MUST be signed with the main key of the actor.
If the media is processed successfully, the server MUST return a response with a `201 Created` status code and a JSON object as the body. This JSON object MUST have a `url` property whose value is a [hashlink][Hashlinks] to the processed media file.
Example:
```json
{
"type": "Document",
"url": "hl:zQmWvQxTqbG2Z9HPJgG57jjwR154cKhbtJenbyYTWkjgF3e"
}
```
The server MUST serve the processed media file at a `/.well-known/apgateway-media/{hashlink}` path.
If the media type is not supported, the server MUST return a `400 Bad Request` status code.
If the media is too large, the server MUST return a `413 Payload Too Large` status code.
## Security considerations
If the server accepts portable objects with [compatible identifiers][CompatibleIdentifiers], it MUST ensure that all objects served by the gateway are valid and that registered actors are sufficiently isolated from each other. Specifically, the server MUST verify that actors and activities generated by the client do not violate the assumptions of the [origin-based security model][FEP-fe34]:
If the server accepts portable objects with [compatible identifiers][CompatibleIdentifiers], it MUST ensure that all objects served by the gateway are valid and that registered actors are sufficiently isolated from each other. Specifically, the server MUST verify that actors and activities generated by the client are permitted in the [origin-based security model][FEP-fe34]:
- Objects MUST NOT represent any actions that actors are not authorized to perform.
- Objects MUST NOT represent server-controlled public keys or verification methods. Such objects can be identifed using the algorithm from [FEP-2277].
@@ -89,6 +116,7 @@ Precautions need also be taken when objects with compatible IDs are delivered to
- silverpill, [FEP-2277: ActivityPub core types][FEP-2277], 2025
- Dave Longley, Manu Sporny, Markus Sabadello, Drummond Reed, Orie Steele, Christopher Allen, [Controlled Identifiers v1.0][ControlledIdentifiers], 2025
- Ryan Barrett, nightpool, [ActivityPub and HTTP Signatures][HttpSig], 2024
- M. Sporny, L. Rosenthol, [Cryptographic Hyperlinks][Hashlinks], 2021
[ActivityPub]: https://www.w3.org/TR/activitypub/
[RFC-2119]: https://tools.ietf.org/html/rfc2119.html
@@ -102,6 +130,7 @@ Precautions need also be taken when objects with compatible IDs are delivered to
[ControlledIdentifiers]: https://www.w3.org/TR/cid/
[CI-Multikey]: https://www.w3.org/TR/cid/#Multikey
[HttpSig]: https://swicg.github.io/activitypub-http-signature/
[Hashlinks]: https://datatracker.ietf.org/doc/html/draft-sporny-hashlink-07
## Copyright