From: Felix <me@nutomic.com>
Date: Thu, 14 May 2020 13:38:07 +0000 (+0200)
Subject: Use ActorType for sign/verify, instead of passing raw privatekey/actor_id
X-Git-Url: http://these/git/readmes/static/%7B%60/css/themes/%7Biframely.url%7D?a=commitdiff_plain;h=13ca47a3b46597936a17bc8e03e9038cfa611d92;p=lemmy.git

Use ActorType for sign/verify, instead of passing raw privatekey/actor_id
---

diff --git a/server/src/apub/activities.rs b/server/src/apub/activities.rs
index 6903d175..23ae9698 100644
--- a/server/src/apub/activities.rs
+++ b/server/src/apub/activities.rs
@@ -17,12 +17,7 @@ pub fn populate_object_props(
 }
 
 /// Send an activity to a list of recipients, using the correct headers etc.
-pub fn send_activity<A>(
-  activity: &A,
-  private_key: &str,
-  sender_id: &str,
-  to: Vec<String>,
-) -> Result<(), Error>
+pub fn send_activity<A>(activity: &A, actor: &dyn ActorType, to: Vec<String>) -> Result<(), Error>
 where
   A: Serialize + Debug,
 {
@@ -35,7 +30,7 @@ where
       continue;
     }
     let request = Request::post(t).header("Host", to_url.domain().unwrap());
-    let signature = sign(&request, private_key, sender_id)?;
+    let signature = sign(&request, actor)?;
     let res = request
       .header("Signature", signature)
       .header("Content-Type", "application/json")
diff --git a/server/src/apub/comment.rs b/server/src/apub/comment.rs
index 9160c7ef..d483a997 100644
--- a/server/src/apub/comment.rs
+++ b/server/src/apub/comment.rs
@@ -115,12 +115,7 @@ impl ApubObjectType for Comment {
 
     insert_activity(&conn, creator.id, &create, true)?;
 
-    send_activity(
-      &create,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&create, creator, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -144,12 +139,7 @@ impl ApubObjectType for Comment {
 
     insert_activity(&conn, creator.id, &update, true)?;
 
-    send_activity(
-      &update,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&update, creator, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -173,12 +163,7 @@ impl ApubObjectType for Comment {
 
     insert_activity(&conn, creator.id, &delete, true)?;
 
-    send_activity(
-      &delete,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&delete, creator, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -220,12 +205,7 @@ impl ApubObjectType for Comment {
 
     insert_activity(&conn, creator.id, &undo, true)?;
 
-    send_activity(
-      &undo,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&undo, creator, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -249,12 +229,7 @@ impl ApubObjectType for Comment {
 
     insert_activity(&conn, mod_.id, &remove, true)?;
 
-    send_activity(
-      &remove,
-      &mod_.private_key.as_ref().unwrap(),
-      &mod_.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&remove, mod_, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -295,12 +270,7 @@ impl ApubObjectType for Comment {
 
     insert_activity(&conn, mod_.id, &undo, true)?;
 
-    send_activity(
-      &undo,
-      &mod_.private_key.as_ref().unwrap(),
-      &mod_.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&undo, mod_, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 }
@@ -321,12 +291,7 @@ impl ApubLikeableType for Comment {
 
     insert_activity(&conn, creator.id, &like, true)?;
 
-    send_activity(
-      &like,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&like, creator, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -349,12 +314,7 @@ impl ApubLikeableType for Comment {
 
     insert_activity(&conn, creator.id, &dislike, true)?;
 
-    send_activity(
-      &dislike,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&dislike, creator, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -389,12 +349,7 @@ impl ApubLikeableType for Comment {
 
     insert_activity(&conn, creator.id, &undo, true)?;
 
-    send_activity(
-      &undo,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&undo, creator, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 }
diff --git a/server/src/apub/community.rs b/server/src/apub/community.rs
index 03be220d..f4e8848f 100644
--- a/server/src/apub/community.rs
+++ b/server/src/apub/community.rs
@@ -79,6 +79,9 @@ impl ActorType for Community {
   fn public_key(&self) -> String {
     self.public_key.to_owned().unwrap()
   }
+  fn private_key(&self) -> String {
+    self.private_key.to_owned().unwrap()
+  }
 
   /// As a local community, accept the follow request from a remote user.
   fn send_accept_follow(&self, follow: &Follow, conn: &PgConnection) -> Result<(), Error> {
@@ -102,12 +105,7 @@ impl ActorType for Community {
 
     insert_activity(&conn, self.creator_id, &accept, true)?;
 
-    send_activity(
-      &accept,
-      &self.private_key.to_owned().unwrap(),
-      &self.actor_id,
-      vec![to],
-    )?;
+    send_activity(&accept, self, vec![to])?;
     Ok(())
   }
 
@@ -128,12 +126,7 @@ impl ActorType for Community {
     // Note: For an accept, since it was automatic, no one pushed a button,
     // the community was the actor.
     // But for delete, the creator is the actor, and does the signing
-    send_activity(
-      &delete,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      self.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&delete, creator, self.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -166,12 +159,7 @@ impl ActorType for Community {
     // Note: For an accept, since it was automatic, no one pushed a button,
     // the community was the actor.
     // But for delete, the creator is the actor, and does the signing
-    send_activity(
-      &undo,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      self.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&undo, creator, self.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -192,12 +180,7 @@ impl ActorType for Community {
     // Note: For an accept, since it was automatic, no one pushed a button,
     // the community was the actor.
     // But for delete, the creator is the actor, and does the signing
-    send_activity(
-      &remove,
-      &mod_.private_key.as_ref().unwrap(),
-      &mod_.actor_id,
-      self.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&remove, mod_, self.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -229,12 +212,7 @@ impl ActorType for Community {
     // Note: For an accept, since it was automatic, no one pushed a button,
     // the community was the actor.
     // But for remove , the creator is the actor, and does the signing
-    send_activity(
-      &undo,
-      &mod_.private_key.as_ref().unwrap(),
-      &mod_.actor_id,
-      self.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&undo, mod_, self.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
diff --git a/server/src/apub/community_inbox.rs b/server/src/apub/community_inbox.rs
index eb52bbce..81cbee81 100644
--- a/server/src/apub/community_inbox.rs
+++ b/server/src/apub/community_inbox.rs
@@ -57,7 +57,7 @@ fn handle_follow(
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
   let community = Community::read_from_name(&conn, &community_name)?;
 
-  verify(&request, &user.public_key.unwrap())?;
+  verify(&request, &user)?;
 
   insert_activity(&conn, user.id, &follow, false)?;
 
@@ -106,7 +106,7 @@ fn handle_undo_follow(
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
   let community = Community::read_from_name(&conn, &community_name)?;
 
-  verify(&request, &user.public_key.unwrap())?;
+  verify(&request, &user)?;
 
   insert_activity(&conn, user.id, &follow, false)?;
 
diff --git a/server/src/apub/extensions/signatures.rs b/server/src/apub/extensions/signatures.rs
index d89e0dd3..e8630f21 100644
--- a/server/src/apub/extensions/signatures.rs
+++ b/server/src/apub/extensions/signatures.rs
@@ -1,5 +1,5 @@
+use crate::apub::ActorType;
 use activitystreams::ext::Extension;
-use activitystreams::Actor;
 use actix_web::HttpRequest;
 use failure::Error;
 use http::request::Builder;
@@ -33,9 +33,8 @@ pub fn generate_actor_keypair() -> Result<Keypair, Error> {
 }
 
 /// Signs request headers with the given keypair.
-/// TODO: would be nice to pass the sending actor in, instead of raw privatekey/id strings
-pub fn sign(request: &Builder, private_key: &str, sender_id: &str) -> Result<String, Error> {
-  let signing_key_id = format!("{}#main-key", sender_id);
+pub fn sign(request: &Builder, actor: &dyn ActorType) -> Result<String, Error> {
+  let signing_key_id = format!("{}#main-key", actor.actor_id());
 
   let headers = request
     .headers_ref()
@@ -58,7 +57,7 @@ pub fn sign(request: &Builder, private_key: &str, sender_id: &str) -> Result<Str
       headers,
     )
     .sign(signing_key_id, |signing_string| {
-      let private_key = PKey::private_key_from_pem(private_key.as_bytes())?;
+      let private_key = PKey::private_key_from_pem(actor.private_key().as_bytes())?;
       let mut signer = Signer::new(MessageDigest::sha256(), &private_key).unwrap();
       signer.update(signing_string.as_bytes()).unwrap();
       Ok(base64::encode(signer.sign_to_vec()?)) as Result<_, Error>
@@ -68,7 +67,7 @@ pub fn sign(request: &Builder, private_key: &str, sender_id: &str) -> Result<Str
   Ok(signature_header_value)
 }
 
-pub fn verify(request: &HttpRequest, public_key: &str) -> Result<(), Error> {
+pub fn verify(request: &HttpRequest, actor: &dyn ActorType) -> Result<(), Error> {
   let headers = request
     .headers()
     .iter()
@@ -86,9 +85,10 @@ pub fn verify(request: &HttpRequest, public_key: &str) -> Result<(), Error> {
     .verify(|signature, signing_string| -> Result<bool, Error> {
       debug!(
         "Verifying with key {}, message {}",
-        &public_key, &signing_string
+        &actor.public_key(),
+        &signing_string
       );
-      let public_key = PKey::public_key_from_pem(public_key.as_bytes())?;
+      let public_key = PKey::public_key_from_pem(actor.public_key().as_bytes())?;
       let mut verifier = Verifier::new(MessageDigest::sha256(), &public_key).unwrap();
       verifier.update(&signing_string.as_bytes()).unwrap();
       Ok(verifier.verify(&base64::decode(signature)?)?)
@@ -130,4 +130,4 @@ impl PublicKey {
   }
 }
 
-impl<T> Extension<T> for PublicKeyExtension where T: Actor {}
+impl<T> Extension<T> for PublicKeyExtension where T: activitystreams::Actor {}
diff --git a/server/src/apub/mod.rs b/server/src/apub/mod.rs
index 53e33655..6ff6a0f8 100644
--- a/server/src/apub/mod.rs
+++ b/server/src/apub/mod.rs
@@ -226,6 +226,7 @@ pub trait ActorType {
   fn actor_id(&self) -> String;
 
   fn public_key(&self) -> String;
+  fn private_key(&self) -> String;
 
   // These two have default impls, since currently a community can't follow anything,
   // and a user can't be followed (yet)
diff --git a/server/src/apub/post.rs b/server/src/apub/post.rs
index 7ec9cd5a..b2374ffd 100644
--- a/server/src/apub/post.rs
+++ b/server/src/apub/post.rs
@@ -134,12 +134,7 @@ impl ApubObjectType for Post {
 
     insert_activity(&conn, creator.id, &create, true)?;
 
-    send_activity(
-      &create,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&create, creator, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -162,12 +157,7 @@ impl ApubObjectType for Post {
 
     insert_activity(&conn, creator.id, &update, true)?;
 
-    send_activity(
-      &update,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&update, creator, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -191,12 +181,7 @@ impl ApubObjectType for Post {
     insert_activity(&conn, self.creator_id, &delete, true)?;
 
     let community = Community::read(conn, self.community_id)?;
-    send_activity(
-      &delete,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&delete, creator, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -236,12 +221,7 @@ impl ApubObjectType for Post {
     insert_activity(&conn, self.creator_id, &undo, true)?;
 
     let community = Community::read(conn, self.community_id)?;
-    send_activity(
-      &undo,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&undo, creator, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -265,12 +245,7 @@ impl ApubObjectType for Post {
     insert_activity(&conn, mod_.id, &remove, true)?;
 
     let community = Community::read(conn, self.community_id)?;
-    send_activity(
-      &remove,
-      &mod_.private_key.as_ref().unwrap(),
-      &mod_.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&remove, mod_, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
   fn send_undo_remove(&self, mod_: &User_, conn: &PgConnection) -> Result<(), Error> {
@@ -308,12 +283,7 @@ impl ApubObjectType for Post {
     insert_activity(&conn, mod_.id, &undo, true)?;
 
     let community = Community::read(conn, self.community_id)?;
-    send_activity(
-      &undo,
-      &mod_.private_key.as_ref().unwrap(),
-      &mod_.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&undo, mod_, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 }
@@ -333,12 +303,7 @@ impl ApubLikeableType for Post {
 
     insert_activity(&conn, creator.id, &like, true)?;
 
-    send_activity(
-      &like,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&like, creator, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -360,12 +325,7 @@ impl ApubLikeableType for Post {
 
     insert_activity(&conn, creator.id, &dislike, true)?;
 
-    send_activity(
-      &dislike,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&dislike, creator, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 
@@ -399,12 +359,7 @@ impl ApubLikeableType for Post {
 
     insert_activity(&conn, creator.id, &undo, true)?;
 
-    send_activity(
-      &undo,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      community.get_follower_inboxes(&conn)?,
-    )?;
+    send_activity(&undo, creator, community.get_follower_inboxes(&conn)?)?;
     Ok(())
   }
 }
diff --git a/server/src/apub/private_message.rs b/server/src/apub/private_message.rs
index 4e111b8f..3fff75dc 100644
--- a/server/src/apub/private_message.rs
+++ b/server/src/apub/private_message.rs
@@ -87,12 +87,7 @@ impl ApubObjectType for PrivateMessage {
 
     insert_activity(&conn, creator.id, &create, true)?;
 
-    send_activity(
-      &create,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      vec![to],
-    )?;
+    send_activity(&create, creator, vec![to])?;
     Ok(())
   }
 
@@ -116,12 +111,7 @@ impl ApubObjectType for PrivateMessage {
 
     insert_activity(&conn, creator.id, &update, true)?;
 
-    send_activity(
-      &update,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      vec![to],
-    )?;
+    send_activity(&update, creator, vec![to])?;
     Ok(())
   }
 
@@ -144,12 +134,7 @@ impl ApubObjectType for PrivateMessage {
 
     insert_activity(&conn, creator.id, &delete, true)?;
 
-    send_activity(
-      &delete,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      vec![to],
-    )?;
+    send_activity(&delete, creator, vec![to])?;
     Ok(())
   }
 
@@ -187,12 +172,7 @@ impl ApubObjectType for PrivateMessage {
 
     insert_activity(&conn, creator.id, &undo, true)?;
 
-    send_activity(
-      &undo,
-      &creator.private_key.as_ref().unwrap(),
-      &creator.actor_id,
-      vec![to],
-    )?;
+    send_activity(&undo, creator, vec![to])?;
     Ok(())
   }
 
diff --git a/server/src/apub/shared_inbox.rs b/server/src/apub/shared_inbox.rs
index d7021a6f..6bbe9725 100644
--- a/server/src/apub/shared_inbox.rs
+++ b/server/src/apub/shared_inbox.rs
@@ -119,7 +119,7 @@ fn receive_create_post(
     .to_string();
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &create, false)?;
 
@@ -161,7 +161,7 @@ fn receive_create_comment(
     .to_string();
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &create, false)?;
 
@@ -208,7 +208,7 @@ fn receive_update_post(
     .to_string();
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &update, false)?;
 
@@ -247,7 +247,7 @@ fn receive_like_post(
   let user_uri = like.like_props.get_actor_xsd_any_uri().unwrap().to_string();
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &like, false)?;
 
@@ -297,7 +297,7 @@ fn receive_dislike_post(
     .to_string();
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &dislike, false)?;
 
@@ -347,7 +347,7 @@ fn receive_update_comment(
     .to_string();
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &update, false)?;
 
@@ -391,7 +391,7 @@ fn receive_like_comment(
   let user_uri = like.like_props.get_actor_xsd_any_uri().unwrap().to_string();
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &like, false)?;
 
@@ -446,7 +446,7 @@ fn receive_dislike_comment(
     .to_string();
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &dislike, false)?;
 
@@ -501,7 +501,7 @@ fn receive_delete_community(
     .into_concrete::<GroupExt>()?;
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &delete, false)?;
 
@@ -563,7 +563,7 @@ fn receive_remove_community(
     .into_concrete::<GroupExt>()?;
 
   let mod_ = get_or_fetch_and_upsert_remote_user(&mod_uri, &conn)?;
-  verify(request, &mod_.public_key.unwrap())?;
+  verify(request, &mod_)?;
 
   insert_activity(&conn, mod_.id, &remove, false)?;
 
@@ -625,7 +625,7 @@ fn receive_delete_post(
     .into_concrete::<PageExt>()?;
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &delete, false)?;
 
@@ -689,7 +689,7 @@ fn receive_remove_post(
     .into_concrete::<PageExt>()?;
 
   let mod_ = get_or_fetch_and_upsert_remote_user(&mod_uri, &conn)?;
-  verify(request, &mod_.public_key.unwrap())?;
+  verify(request, &mod_)?;
 
   insert_activity(&conn, mod_.id, &remove, false)?;
 
@@ -753,7 +753,7 @@ fn receive_delete_comment(
     .into_concrete::<Note>()?;
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &delete, false)?;
 
@@ -814,7 +814,7 @@ fn receive_remove_comment(
     .into_concrete::<Note>()?;
 
   let mod_ = get_or_fetch_and_upsert_remote_user(&mod_uri, &conn)?;
-  verify(request, &mod_.public_key.unwrap())?;
+  verify(request, &mod_)?;
 
   insert_activity(&conn, mod_.id, &remove, false)?;
 
@@ -935,7 +935,7 @@ fn receive_undo_delete_comment(
     .into_concrete::<Note>()?;
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &delete, false)?;
 
@@ -996,7 +996,7 @@ fn receive_undo_remove_comment(
     .into_concrete::<Note>()?;
 
   let mod_ = get_or_fetch_and_upsert_remote_user(&mod_uri, &conn)?;
-  verify(request, &mod_.public_key.unwrap())?;
+  verify(request, &mod_)?;
 
   insert_activity(&conn, mod_.id, &remove, false)?;
 
@@ -1057,7 +1057,7 @@ fn receive_undo_delete_post(
     .into_concrete::<PageExt>()?;
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &delete, false)?;
 
@@ -1121,7 +1121,7 @@ fn receive_undo_remove_post(
     .into_concrete::<PageExt>()?;
 
   let mod_ = get_or_fetch_and_upsert_remote_user(&mod_uri, &conn)?;
-  verify(request, &mod_.public_key.unwrap())?;
+  verify(request, &mod_)?;
 
   insert_activity(&conn, mod_.id, &remove, false)?;
 
@@ -1185,7 +1185,7 @@ fn receive_undo_delete_community(
     .into_concrete::<GroupExt>()?;
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &delete, false)?;
 
@@ -1247,7 +1247,7 @@ fn receive_undo_remove_community(
     .into_concrete::<GroupExt>()?;
 
   let mod_ = get_or_fetch_and_upsert_remote_user(&mod_uri, &conn)?;
-  verify(request, &mod_.public_key.unwrap())?;
+  verify(request, &mod_)?;
 
   insert_activity(&conn, mod_.id, &remove, false)?;
 
@@ -1334,7 +1334,7 @@ fn receive_undo_like_comment(
   let user_uri = like.like_props.get_actor_xsd_any_uri().unwrap().to_string();
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &like, false)?;
 
@@ -1384,7 +1384,7 @@ fn receive_undo_like_post(
   let user_uri = like.like_props.get_actor_xsd_any_uri().unwrap().to_string();
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &like, false)?;
 
diff --git a/server/src/apub/user.rs b/server/src/apub/user.rs
index 6c45fe1e..61661de4 100644
--- a/server/src/apub/user.rs
+++ b/server/src/apub/user.rs
@@ -57,6 +57,10 @@ impl ActorType for User_ {
     self.public_key.to_owned().unwrap()
   }
 
+  fn private_key(&self) -> String {
+    self.private_key.to_owned().unwrap()
+  }
+
   /// As a given local user, send out a follow request to a remote community.
   fn send_follow(&self, follow_actor_id: &str, conn: &PgConnection) -> Result<(), Error> {
     let mut follow = Follow::new();
@@ -75,12 +79,7 @@ impl ActorType for User_ {
 
     insert_activity(&conn, self.id, &follow, true)?;
 
-    send_activity(
-      &follow,
-      &self.private_key.as_ref().unwrap(),
-      &follow_actor_id,
-      vec![to],
-    )?;
+    send_activity(&follow, self, vec![to])?;
     Ok(())
   }
 
@@ -116,12 +115,7 @@ impl ActorType for User_ {
 
     insert_activity(&conn, self.id, &undo, true)?;
 
-    send_activity(
-      &undo,
-      &self.private_key.as_ref().unwrap(),
-      &follow_actor_id,
-      vec![to],
-    )?;
+    send_activity(&undo, self, vec![to])?;
     Ok(())
   }
 
diff --git a/server/src/apub/user_inbox.rs b/server/src/apub/user_inbox.rs
index 2705f017..3035deba 100644
--- a/server/src/apub/user_inbox.rs
+++ b/server/src/apub/user_inbox.rs
@@ -55,7 +55,7 @@ fn receive_accept(
     .to_string();
 
   let community = get_or_fetch_and_upsert_remote_community(&community_uri, conn)?;
-  verify(request, &community.public_key.unwrap())?;
+  verify(request, &community)?;
 
   let user = User_::read_from_name(&conn, username)?;
 
@@ -95,7 +95,7 @@ fn receive_create_private_message(
     .to_string();
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &create, false)?;
 
@@ -139,7 +139,7 @@ fn receive_update_private_message(
     .to_string();
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &update, false)?;
 
@@ -184,7 +184,7 @@ fn receive_delete_private_message(
     .to_string();
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &delete, false)?;
 
@@ -248,7 +248,7 @@ fn receive_undo_delete_private_message(
     .to_string();
 
   let user = get_or_fetch_and_upsert_remote_user(&user_uri, &conn)?;
-  verify(request, &user.public_key.unwrap())?;
+  verify(request, &user)?;
 
   insert_activity(&conn, user.id, &delete, false)?;