upd: refetch user keys on signature failure

Reference: https://github.com/misskey-dev/misskey/pull/12051

1 files changed, 14 insertions, 2 deletions

diff --git a/packages/backend/src/queue/processors/InboxProcessorService.ts b/packages/backend/src/queue/processors/InboxProcessorService.ts
index 89d4ea503e..f51c9f140d 100644
--- a/packages/backend/src/queue/processors/InboxProcessorService.ts
+++ b/packages/backend/src/queue/processors/InboxProcessorService.ts
@@ -104,12 +104,24 @@ export class InboxProcessorService {
 		}
 
 		// HTTP-Signatureの検証
-		const httpSignatureValidated = httpSignature.verifySignature(signature, authUser.key.keyPem);
+		let httpSignatureValidated = httpSignature.verifySignature(signature, authUser.key.keyPem);
 
 		// また、signatureのsignerは、activity.actorと一致する必要がある
 		if (!httpSignatureValidated || authUser.user.uri !== activity.actor) {
+			let renewKeyFailed = false;
+			
+			if (!httpSignatureValidated) {
+				authUser.key = await this.apDbResolverService.refetchPublicKeyForApId(authUser.user);
+
+				if (authUser.key != null) {
+					httpSignatureValidated = httpSignature.verifySignature(signature, authUser.key.keyPem);
+				} else {
+					renewKeyFailed = true;
+				}
+			}
+
 			// 一致しなくても、でもLD-Signatureがありそうならそっちも見る
-			if (activity.signature) {
+			if (activity.signature && renewKeyFailed) {
 				if (activity.signature.type !== 'RsaSignature2017') {
 					throw new Bull.UnrecoverableError(`skip: unsupported LD-signature type ${activity.signature.type}`);
 				}