From e37f0d9dbabfe921c1a3b935c61584cd72d85674 Mon Sep 17 00:00:00 2001 From: silverpill Date: Thu, 18 Sep 2025 01:37:24 +0200 Subject: [PATCH] FEP-ae97: Update proposal (#682) - Added section describing Media API. - Specified status codes for error responses. - Updated security considerations. Reviewed-on: https://codeberg.org/fediverse/fep/pulls/682 Co-authored-by: silverpill Co-committed-by: silverpill --- fep/ae97/fep-ae97.md | 33 +++++++++++++++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-) diff --git a/fep/ae97/fep-ae97.md b/fep/ae97/fep-ae97.md index acd505e..616b3cf 100644 --- a/fep/ae97/fep-ae97.md +++ b/fep/ae97/fep-ae97.md @@ -44,7 +44,9 @@ Example: } ``` -The client MUST attach the RSA key to the actor object via `publicKey` property, and also add it to the `assertionMethod` array as described in [FEP-521a]. If the server's response contains other keys, they SHOULD be added to the `assertionMethod` array as well. +If the server can't register the actor, it MUST return a `400 Bad Request` status code. + +If the registration is successful, the client MUST attach the RSA key to the actor object via `publicKey` property, and also add it to the `assertionMethod` array as described in [FEP-521a]. If the server's response contains other keys, they SHOULD be added to the `assertionMethod` array as well. If the client uses [compatible identifiers][CompatibleIdentifiers], then key identifiers MUST be generated with the server's [origin][Origin]. @@ -58,15 +60,40 @@ If activity contains a wrapped object (as in `Create` and `Update` activities), The server MUST deliver activities to their indended audiences without altering them. When signing HTTP requests, the server uses the RSA key generated during the registration. +If the actor of the submitted activity is not registered, the server MUST return a `403 Forbidden` status code. + ## Receiving activities Client receives activities by polling the actor's inbox. Requests to inbox endpoint MUST have an [HTTP signature][HttpSig] created using the main actor key (the one generated by the client, not a server-generated key). +If the owner of the inbox is not registered, the server MUST return a `403 Forbidden` status code. + +## Uploading media + +To upload a media file, the client sends an HTTP POST request to the gateway endpoint at the `/.well-known/apgateway-media` path. The body of the request MUST be the media in the form of binary data. The request MUST contain a `Content-Type` header and MUST be signed with the main key of the actor. + +If the media is processed successfully, the server MUST return a response with a `201 Created` status code and a JSON object as the body. This JSON object MUST have a `url` property whose value is a [hashlink][Hashlinks] to the processed media file. + +Example: + +```json +{ + "type": "Document", + "url": "hl:zQmWvQxTqbG2Z9HPJgG57jjwR154cKhbtJenbyYTWkjgF3e" +} +``` + +The server MUST serve the processed media file at a `/.well-known/apgateway-media/{hashlink}` path. + +If the media type is not supported, the server MUST return a `400 Bad Request` status code. + +If the media is too large, the server MUST return a `413 Payload Too Large` status code. + ## Security considerations -If the server accepts portable objects with [compatible identifiers][CompatibleIdentifiers], it MUST ensure that all objects served by the gateway are valid and that registered actors are sufficiently isolated from each other. Specifically, the server MUST verify that actors and activities generated by the client do not violate the assumptions of the [origin-based security model][FEP-fe34]: +If the server accepts portable objects with [compatible identifiers][CompatibleIdentifiers], it MUST ensure that all objects served by the gateway are valid and that registered actors are sufficiently isolated from each other. Specifically, the server MUST verify that actors and activities generated by the client are permitted in the [origin-based security model][FEP-fe34]: - Objects MUST NOT represent any actions that actors are not authorized to perform. - Objects MUST NOT represent server-controlled public keys or verification methods. Such objects can be identifed using the algorithm from [FEP-2277]. @@ -89,6 +116,7 @@ Precautions need also be taken when objects with compatible IDs are delivered to - silverpill, [FEP-2277: ActivityPub core types][FEP-2277], 2025 - Dave Longley, Manu Sporny, Markus Sabadello, Drummond Reed, Orie Steele, Christopher Allen, [Controlled Identifiers v1.0][ControlledIdentifiers], 2025 - Ryan Barrett, nightpool, [ActivityPub and HTTP Signatures][HttpSig], 2024 +- M. Sporny, L. Rosenthol, [Cryptographic Hyperlinks][Hashlinks], 2021 [ActivityPub]: https://www.w3.org/TR/activitypub/ [RFC-2119]: https://tools.ietf.org/html/rfc2119.html @@ -102,6 +130,7 @@ Precautions need also be taken when objects with compatible IDs are delivered to [ControlledIdentifiers]: https://www.w3.org/TR/cid/ [CI-Multikey]: https://www.w3.org/TR/cid/#Multikey [HttpSig]: https://swicg.github.io/activitypub-http-signature/ +[Hashlinks]: https://datatracker.ietf.org/doc/html/draft-sporny-hashlink-07 ## Copyright