Retrieve signing user from database instead of expecting it to materialize from thin air

plume-models/src/instance.rs

@@ -56,7 +56,6 @@ impl Instance {
             .clone()
             .ok_or(Error::NotFound)
     }
-
     pub fn get_local_uncached(conn: &Connection) -> Result<Instance> {
         instances::table
             .filter(instances::local.eq(true))

plume-models/src/schema.rs

@@ -29,7 +29,6 @@ table! {
         is_owner -> Bool,
     }
 }
-
 table! {
     blogs (id) {
         id -> Int4,

plume-models/src/users.rs

@@ -211,6 +211,13 @@ impl User {
         }
     }
 
+    pub fn find_first_local(conn: &Connection) -> Result<User> {
+        users::table
+            .filter(users::instance_id.eq(Instance::get_local()?.id))
+            .first(&*conn)
+            .map_err(|_| Error::NotFound)
+    }
+
     fn fetch_from_webfinger(c: &PlumeRocket, acct: &str) -> Result<User> {
         let link = resolve(acct.to_owned(), true)?
             .links
@@ -229,12 +236,9 @@ impl User {
             .ok_or(Error::Webfinger)
     }
 
-    fn fetch(url: &str) -> Result<CustomPerson> {
-        let mut res = ClientBuilder::new()
-            .connect_timeout(Some(std::time::Duration::from_secs(5)))
-            .build()?
-            .get(url)
-            .header(
+    fn fetch(url: &str, lu: User) -> Result<CustomPerson> {
+        let mut headers = plume_common::activity_pub::request::headers();
+        headers.insert(
             ACCEPT,
             HeaderValue::from_str(
                 &ap_accept_header()
@@ -242,8 +246,18 @@ impl User {
                     .collect::<Vec<_>>()
                     .join(", "),
             )?,
+        );
+        let mut res = ClientBuilder::new()
+            .connect_timeout(Some(std::time::Duration::from_secs(5)))
+            .build()?
+            .get(url)
+            .headers(headers.clone())
+            .header(
+                "Signature",
+                plume_common::activity_pub::request::signature(&lu, &headers).expect(""),
             )
             .send()?;
+
         let text = &res.text()?;
         // without this workaround, publicKey is not correctly deserialized
         let ap_sign = serde_json::from_str::<ApSignature>(text)?;
@@ -253,11 +267,12 @@ impl User {
     }
 
     pub fn fetch_from_url(c: &PlumeRocket, url: &str) -> Result<User> {
-        User::fetch(url).and_then(|json| User::from_activity(c, json))
+        User::fetch(url, User::find_first_local(&*c.conn)?)
+            .and_then(|json| User::from_activity(c, json))
     }
 
     pub fn refetch(&self, conn: &Connection) -> Result<()> {
-        User::fetch(&self.ap_url.clone()).and_then(|json| {
+        User::fetch(&self.ap_url.clone(), User::find_first_local(conn)?).and_then(|json| {
             let avatar = Media::save_remote(
                 conn,
                 json.object