diff --git a/AUTHORS b/AUTHORS new file mode 100644 --- /dev/null +++ b/AUTHORS @@ -0,0 +1,1 @@ +fr33domlover diff --git a/COPYING b/COPYING new file mode 100644 --- /dev/null +++ b/COPYING @@ -0,0 +1,121 @@ +Creative Commons Legal Code + +CC0 1.0 Universal + + CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE + LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN + ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS + INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES + REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS + PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM + THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED + HEREUNDER. + +Statement of Purpose + +The laws of most jurisdictions throughout the world automatically confer +exclusive Copyright and Related Rights (defined below) upon the creator +and subsequent owner(s) (each and all, an "owner") of an original work of +authorship and/or a database (each, a "Work"). + +Certain owners wish to permanently relinquish those rights to a Work for +the purpose of contributing to a commons of creative, cultural and +scientific works ("Commons") that the public can reliably and without fear +of later claims of infringement build upon, modify, incorporate in other +works, reuse and redistribute as freely as possible in any form whatsoever +and for any purposes, including without limitation commercial purposes. +These owners may contribute to the Commons to promote the ideal of a free +culture and the further production of creative, cultural and scientific +works, or to gain reputation or greater distribution for their Work in +part through the use and efforts of others. + +For these and/or other purposes and motivations, and without any +expectation of additional consideration or compensation, the person +associating CC0 with a Work (the "Affirmer"), to the extent that he or she +is an owner of Copyright and Related Rights in the Work, voluntarily +elects to apply CC0 to the Work and publicly distribute the Work under its +terms, with knowledge of his or her Copyright and Related Rights in the +Work and the meaning and intended legal effect of CC0 on those rights. + +1. Copyright and Related Rights. A Work made available under CC0 may be +protected by copyright and related or neighboring rights ("Copyright and +Related Rights"). Copyright and Related Rights include, but are not +limited to, the following: + + i. the right to reproduce, adapt, distribute, perform, display, + communicate, and translate a Work; + ii. moral rights retained by the original author(s) and/or performer(s); +iii. publicity and privacy rights pertaining to a person's image or + likeness depicted in a Work; + iv. rights protecting against unfair competition in regards to a Work, + subject to the limitations in paragraph 4(a), below; + v. rights protecting the extraction, dissemination, use and reuse of data + in a Work; + vi. database rights (such as those arising under Directive 96/9/EC of the + European Parliament and of the Council of 11 March 1996 on the legal + protection of databases, and under any national implementation + thereof, including any amended or successor version of such + directive); and +vii. other similar, equivalent or corresponding rights throughout the + world based on applicable law or treaty, and any national + implementations thereof. + +2. Waiver. To the greatest extent permitted by, but not in contravention +of, applicable law, Affirmer hereby overtly, fully, permanently, +irrevocably and unconditionally waives, abandons, and surrenders all of +Affirmer's Copyright and Related Rights and associated claims and causes +of action, whether now known or unknown (including existing as well as +future claims and causes of action), in the Work (i) in all territories +worldwide, (ii) for the maximum duration provided by applicable law or +treaty (including future time extensions), (iii) in any current or future +medium and for any number of copies, and (iv) for any purpose whatsoever, +including without limitation commercial, advertising or promotional +purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each +member of the public at large and to the detriment of Affirmer's heirs and +successors, fully intending that such Waiver shall not be subject to +revocation, rescission, cancellation, termination, or any other legal or +equitable action to disrupt the quiet enjoyment of the Work by the public +as contemplated by Affirmer's express Statement of Purpose. + +3. Public License Fallback. Should any part of the Waiver for any reason +be judged legally invalid or ineffective under applicable law, then the +Waiver shall be preserved to the maximum extent permitted taking into +account Affirmer's express Statement of Purpose. In addition, to the +extent the Waiver is so judged Affirmer hereby grants to each affected +person a royalty-free, non transferable, non sublicensable, non exclusive, +irrevocable and unconditional license to exercise Affirmer's Copyright and +Related Rights in the Work (i) in all territories worldwide, (ii) for the +maximum duration provided by applicable law or treaty (including future +time extensions), (iii) in any current or future medium and for any number +of copies, and (iv) for any purpose whatsoever, including without +limitation commercial, advertising or promotional purposes (the +"License"). The License shall be deemed effective as of the date CC0 was +applied by Affirmer to the Work. Should any part of the License for any +reason be judged legally invalid or ineffective under applicable law, such +partial invalidity or ineffectiveness shall not invalidate the remainder +of the License, and in such case Affirmer hereby affirms that he or she +will not (i) exercise any of his or her remaining Copyright and Related +Rights in the Work or (ii) assert any associated claims and causes of +action with respect to the Work, in either case contrary to Affirmer's +express Statement of Purpose. + +4. Limitations and Disclaimers. + + a. No trademark or patent rights held by Affirmer are waived, abandoned, + surrendered, licensed or otherwise affected by this document. + b. Affirmer offers the Work as-is and makes no representations or + warranties of any kind concerning the Work, express, implied, + statutory or otherwise, including without limitation warranties of + title, merchantability, fitness for a particular purpose, non + infringement, or the absence of latent or other defects, accuracy, or + the present or absence of errors, whether or not discoverable, all to + the greatest extent permissible under applicable law. + c. Affirmer disclaims responsibility for clearing rights of other persons + that may apply to the Work or any use thereof, including without + limitation any person's Copyright and Related Rights in the Work. + Further, Affirmer disclaims responsibility for obtaining any necessary + consents, permissions or other rights required for any use of the + Work. + d. Affirmer understands and acknowledges that Creative Commons is not a + party to this document and has no duty or obligation with respect to + this CC0 or use of the Work. diff --git a/ChangeLog b/ChangeLog new file mode 100644 --- /dev/null +++ b/ChangeLog @@ -0,0 +1,17 @@ +The changes are recorded by the version control system, Darcs. To see a log +quickly from the terminal, run: + + $ darcs changes --repo http://darcs.rel4tion.org/repos/libravatar + +There is also a web interface at which, among other +things, can display the history log. + +To see the log in a local clone, first get a copy of the repository if you +haven't yet: + + $ darcs get http://darcs.rel4tion.org/repos/libravatar + +Then move into the newly created directory and run darcs: + + $ cd libravatar + $ darcs changes diff --git a/INSTALL b/INSTALL new file mode 100644 --- /dev/null +++ b/INSTALL @@ -0,0 +1,13 @@ +Install from Hackage: + + $ cabal install libravatar + +Install from unpacked release tarball or source repo: + + $ cd libravatar + $ cabal install + +Just play with it without installing: + + $ cabal build + $ cabal repl diff --git a/NEWS b/NEWS new file mode 100644 --- /dev/null +++ b/NEWS @@ -0,0 +1,23 @@ +This file lists the user-visible interesting changes between releases. For a +full list of changes to the source, see the ChangeLog. + + + +libravatar 0.1.0.0 -- 2015-07-12 +================================ + +General, build and documentation changes: + +* (This is the first release, so everything is new) + +New APIs, features and enhancements: + +* (This is the first release, so everything is a new feature) + +Bug fixes: + +* (This is just the first release) + +Dependency changes: + +* (This is the first release) diff --git a/README b/README new file mode 100644 --- /dev/null +++ b/README @@ -0,0 +1,12 @@ +See the .cabal file for more info and link to project website the version +control. + +The official download location is Hackage. + +This library is free software, and is committed to software freedom. It is +released to the public domain using the CC0 Public Domain Dedication. For the +boring "legal" details see the file 'COPYING'. + +See the file 'INSTALL' for hints on installation. The file 'ChangeLog' explains +how to see the history log of the changes done in the code. 'NEWS' provides a +friendly overview of the changes for each release. diff --git a/Setup.hs b/Setup.hs new file mode 100644 --- /dev/null +++ b/Setup.hs @@ -0,0 +1,2 @@ +import Distribution.Simple +main = defaultMain diff --git a/libravatar.cabal b/libravatar.cabal new file mode 100644 --- /dev/null +++ b/libravatar.cabal @@ -0,0 +1,37 @@ +name: libravatar +version: 0.1.0.0 +synopsis: Use Libravatar, the decentralized avatar delivery service +description: This package is a Haskell library for + . +homepage: http://rel4tion.org/projects/libravatar/ +bug-reports: http://rel4tion.org/projects/libravatar/tickets/ +license: PublicDomain +license-file: COPYING +author: fr33domlover +maintainer: fr33domlover@riseup.net +copyright: ♡ Copying is an act of love. Please copy, reuse and share. +category: Network, Web +build-type: Simple +extra-source-files: AUTHORS ChangeLog COPYING INSTALL NEWS README +cabal-version: >=1.10 + +source-repository head + type: darcs + location: http://darcs.rel4tion.org/repos/libravatar/ + +library + exposed-modules: Network.Libravatar + -- other-modules: + -- other-extensions: + build-depends: base >=4.7 && <5 + , bytestring + , crypto-api >=0.13.2 + , dns >=2 + , network-uri >=2.6 + , pureMD5 >=2.1.2 + , random >=1.1 + , SHA >=1.6.4 + , url >=2.1.3 + , utf8-string >=1 + hs-source-dirs: src + default-language: Haskell2010 diff --git a/src/Network/Libravatar.hs b/src/Network/Libravatar.hs new file mode 100644 --- /dev/null +++ b/src/Network/Libravatar.hs @@ -0,0 +1,184 @@ +{- This file is part of libravatar for Haskell. + - + - Written in 2015 by fr33domlover . + - + - ♡ Copying is an act of love. Please copy, reuse and share. + - + - The author(s) have dedicated all copyright and related and neighboring + - rights to this software to the public domain worldwide. This software is + - distributed without any warranty. + - + - You should have received a copy of the CC0 Public Domain Dedication along + - with this software. If not, see + - . + -} + +module Network.Libravatar + ( avatarUrl + ) +where + +import Crypto.Classes (hash') +import qualified Data.ByteString.Char8 as BC +import Data.ByteString.UTF8 as BU (fromString) +import Data.ByteString.Lazy.UTF8 as BLU (fromString) +import Data.Char (toLower) +import Data.Digest.Pure.MD5 (MD5Digest) +import Data.Digest.Pure.SHA (sha256) +import Data.List (partition) +import Data.Maybe (catMaybes, fromMaybe) +import Network.DNS.Lookup +import Network.DNS.Resolver +import Network.DNS.Types (DNSError, Domain) +import Network.URI +import Network.URL +import System.Random (randomRIO) + +defaultHost = Host (HTTP False) "cdn.libravatar.org" Nothing +defaultHostSecure = Host (HTTP True) "seccdn.libravatar.org" Nothing +serviceBase = "_avatars._tcp" +serviceBaseSecure = "_avatars-sec._tcp" +minAvatarSize = 1 +maxAvatarSize = 512 + +-- Hash emails with MD5, I think it's faster than SHA256 +hashMail :: String -> String +hashMail = + let h :: String -> MD5Digest + h = hash' . BU.fromString + in show . h + +-- OpenIDs must be hashed with SHA256 +hashOpenid :: String -> String +hashOpenid = show . sha256 . BLU.fromString + +-- From email or openid, generate avatar hash and get the relevant domain +parseUserAddress :: Either String String -> Maybe (String, String) +parseUserAddress (Left email) = + let lowEmail = map toLower email + d = dropWhile (/= '@') lowEmail + domain = if null d then d else tail d + hash = hashMail lowEmail + in Just (hash, domain) +parseUserAddress (Right openid) = do + uri <- parseAbsoluteURI openid + auth <- uriAuthority uri + let lower = map toLower + authl = auth { uriRegName = lower $ uriRegName auth } + openidl = uri + { uriScheme = lower $ uriScheme uri + , uriAuthority = Just authl + } + return (hashOpenid $ uriToString id openidl "", uriRegName authl) + +-- Determine URL query parameters +buildParams :: Maybe String -> Maybe Int -> [(String, String)] +buildParams def size = + let defParam = def >>= return . (,) "d" + size' = size >>= return . max minAvatarSize . min maxAvatarSize + sizeParam = size' >>= return . (,) "s" . show + in catMaybes [defParam, sizeParam] + +-- Get the DNS service to query for a given domain and scheme +serviceName :: String -> Bool -> Domain +serviceName domain https = + BC.pack $ + if https + then serviceBaseSecure ++ '.' : domain + else serviceBase ++ '.' : domain + +-- Get a random list item, with distribution based on weights. Weights must be +-- non-negative. Any negative weights will just be treated as zero weights. +weightedRandom :: (a -> Int) -> [a] -> IO a +weightedRandom getw l = + let wlist = map getw l + wlist' = map (\ w -> if w < 0 then 0 else w) wlist + totalw = sum wlist' + l' = zip l wlist' + f r w [] = error "weightedRandom: got an empty list" + f r w (i:is) = + let w' = w + snd i + in if w' >= r + then fst i + else f r w' is + in randomRIO (0, totalw) >>= \ r -> return $ f r 0 l' + +-- Ensure we are getting a (mostly) valid hostname and port number from the DNS +-- resolver +targetSane :: Domain -> Int -> Bool +targetSane target port = + not (BC.null target) && BC.any ok_host target && 1 <= port && port <= 65535 + +-- Get the right (target, port) pair from a list of SRV records +srvHostname :: [(Int, Int, Int, Domain)] -> IO (Maybe (Domain, Int)) +srvHostname [] = return Nothing +srvHostname [(_, _, port, target)] = return $ Just (target, port) +srvHostname records = + let priority (p, _, _, _) = p + weight (_, w, _, _) = w + -- Determine the highest priority the records contain + topPrio = maximum $ map priority records + -- Collect top priority records, zero-weight ones first + l = filter ((== topPrio) . priority) records + (wz, wnz) = partition ((<= 0) . weight) l + topRecords = wz ++ wnz + in case topRecords of + [(_, _, port, target)] -> return $ Just (target, port) + l -> + weightedRandom weight l >>= + \ (_, _, port, target) -> return $ Just (target, port) + +-- Pick the right server and return its normalized hostname, i.e. only include +-- the port number if it's necessary +normalizedTarget :: [(Int, Int, Int, Domain)] + -> Bool + -> IO (Maybe Host) +normalizedTarget records https = do + tp <- srvHostname records + let sane = maybe False (uncurry targetSane) tp + -- If sane, the target contains only ASCII, so byte-based unpack works + return $ case (tp, sane) of + (Just (target, port), True) -> + let target' = BC.unpack target + port' = + if https && port /= 443 || not https && port /= 80 + then Just $ fromIntegral port + else Nothing + in Just $ Host (HTTP https) target' port' + _ -> Nothing + +-- Get avatar server from SRV record +lookupAvatarServer :: String + -> Bool + -> IO (Either DNSError (Maybe Host)) +lookupAvatarServer domain https = do + let service = serviceName domain https + rs <- makeResolvSeed defaultResolvConf + result <- withResolver rs $ \ resolver -> lookupSRV resolver service + case result of + Left e -> return $ Left e + Right records -> normalizedTarget records https >>= return . Right + +-- Assemble the final avatar URL based on the provided components +composeAvatarUrl :: Maybe Host -> String -> [(String, String)] -> Bool -> URL +composeAvatarUrl server hash params https = + let server' = + fromMaybe (if https then defaultHostSecure else defaultHost) server + in URL (Absolute server') ("avatar/" ++ hash) params + +-- | Return a URL to the avatar image. +avatarUrl :: Either String String -- ^ Email or OpenID + -> Bool -- ^ Whether to use HTTPS + -> Maybe String -- ^ Default picture URL if avatar not found + -> Maybe Int -- ^ Image size in pixels, default is 80 + -> IO (Maybe String) +avatarUrl address https def size = + let (hash, domain) = fromMaybe ("", "") $ parseUserAddress address + params = buildParams def size + in if null domain + then return Nothing + else do + result <- lookupAvatarServer domain https + let server = either (const Nothing) id result + url = composeAvatarUrl server hash params https + return $ Just $ exportURL url