@fedify/fedify 0.8.0-dev.152 → 0.8.0-dev.153

package/CHANGES.md

@@ -47,6 +47,7 @@ To be released.
     logger categories are used:
 
      -  `["fedify", "federation", "collection"]`
+     -  `["fedify", "httpsig", "verify"]`
      -  `["fedify", "runtime", "docloader"]`
 
 [@fedify/cli]: https://jsr.io/@fedify/cli

package/esm/federation/send.js

@@ -42,7 +42,13 @@ export async function sendActivity({ activity, privateKey, keyId, inbox, documen
     request = await sign(request, privateKey, keyId);
     const response = await fetch(request);
     if (!response.ok) {
-        const error = await response.text();
+        let error;
+        try {
+            error = await response.text();
+        }
+        catch (_) {
+            error = "";
+        }
         logger.error("Failed to send activity {activityId} to {inbox} ({status} " +
             "{statusText}):\n{error}", {
             activityId: activity.id?.href,

package/esm/httpsig/mod.js

@@ -5,6 +5,7 @@
  * @module
  */
 import * as dntShim from "../_dnt.shims.js";
+import { getLogger } from "@logtape/logtape";
 import { equals } from "../deps/jsr.io/@std/bytes/0.220.1/mod.js";
 import { decodeBase64, encodeBase64 } from "../deps/jsr.io/@std/encoding/0.220.1/base64.js";
 import { isActor } from "../vocab/actor.js";
@@ -73,16 +74,22 @@ const supportedHashAlgorithms = {
  *          could not be verified.
  */
 export async function verify(request, documentLoader, currentTime) {
+    const logger = getLogger(["fedify", "httpsig", "verify"]);
     request = request.clone();
     const dateHeader = request.headers.get("Date");
-    if (dateHeader == null)
+    if (dateHeader == null) {
+        logger.debug("Failed to verify; no Date header found.", { headers: Object.fromEntries(request.headers.entries()) });
         return null;
+    }
     const sigHeader = request.headers.get("Signature");
-    if (sigHeader == null)
+    if (sigHeader == null) {
+        logger.debug("Failed to verify; no Signature header found.", { headers: Object.fromEntries(request.headers.entries()) });
         return null;
+    }
     const digestHeader = request.headers.get("Digest");
     if (request.method !== "GET" && request.method !== "HEAD" &&
         digestHeader == null) {
+        logger.debug("Failed to verify; no Digest header found.", { headers: Object.fromEntries(request.headers.entries()) });
         return null;
     }
     let body = null;
@@ -96,30 +103,60 @@ export async function verify(request, documentLoader, currentTime) {
                 continue;
             const digest = decodeBase64(digestBase64);
             const expectedDigest = await dntShim.crypto.subtle.digest(supportedHashAlgorithms[algo], body);
-            if (!equals(digest, new Uint8Array(expectedDigest)))
+            if (!equals(digest, new Uint8Array(expectedDigest))) {
+                logger.debug("Failed to verify; digest mismatch ({algorithm}): " +
+                    "{digest} != {expectedDigest}.", {
+                    algorithm: algo,
+                    digest: digestBase64,
+                    expectedDigest: encodeBase64(expectedDigest),
+                });
                 return null;
+            }
             matched = true;
         }
-        if (!matched)
+        if (!matched) {
+            logger.debug("Failed to verify; no supported digest algorithm found.  " +
+                "Supported: {supportedAlgorithms}; found: {algorithms}.", {
+                supportedAlgorithms: Object.keys(supportedHashAlgorithms),
+                algorithms: digests.map(([algo]) => algo),
+            });
             return null;
+        }
     }
     const date = dntShim.Temporal.Instant.from(new Date(dateHeader).toISOString());
     const now = currentTime ?? dntShim.Temporal.Now.instant();
     if (dntShim.Temporal.Instant.compare(date, now.add({ seconds: 30 })) > 0) {
-        // Too far in the future
+        logger.debug("Failed to verify; Date is too far in the future.", { date: date.toString(), now: now.toString() });
         return null;
     }
     else if (dntShim.Temporal.Instant.compare(date, now.subtract({ seconds: 30 })) < 0) {
-        // Too far in the past
+        logger.debug("Failed to verify; Date is too far in the past.", { date: date.toString(), now: now.toString() });
         return null;
     }
     const sigValues = Object.fromEntries(sigHeader.split(",").map((pair) => pair.match(/^\s*([A-Za-z]+)="([^"]*)"\s*$/)).filter((m) => m != null).map((m) => m.slice(1, 3)));
-    if (!("keyId" in sigValues && "headers" in sigValues &&
-        "signature" in sigValues)) {
+    if (!("keyId" in sigValues)) {
+        logger.debug("Failed to verify; no keyId field found in the Signature header.", { signature: sigHeader });
+        return null;
+    }
+    else if (!("headers" in sigValues)) {
+        logger.debug("Failed to verify; no headers field found in the Signature header.", { signature: sigHeader });
+        return null;
+    }
+    else if (!("signature" in sigValues)) {
+        logger.debug("Failed to verify; no signature field found in the Signature header.", { signature: sigHeader });
         return null;
     }
     const { keyId, headers, signature } = sigValues;
-    const { document } = await documentLoader(keyId);
+    logger.debug("Fetching key {keyId} to verify signature...", { keyId });
+    let document;
+    try {
+        const remoteDocument = await documentLoader(keyId);
+        document = remoteDocument.document;
+    }
+    catch (_) {
+        logger.debug("Failed to fetch key {keyId}.", { keyId });
+        return null;
+    }
     let object;
     try {
         object = await ASObject.fromJsonLd(document, { documentLoader });
@@ -131,8 +168,10 @@ export async function verify(request, documentLoader, currentTime) {
             object = await CryptographicKey.fromJsonLd(document, { documentLoader });
         }
         catch (e) {
-            if (e instanceof TypeError)
+            if (e instanceof TypeError) {
+                logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
                 return null;
+            }
             throw e;
         }
     }
@@ -146,19 +185,31 @@ export async function verify(request, documentLoader, currentTime) {
                 break;
             }
         }
-        if (key == null)
+        if (key == null) {
+            logger.debug("Failed to verify; object {keyId} returned an {actorType}, " +
+                "but has no key matching {keyId}.", { keyId, actorType: object.constructor.name });
             return null;
+        }
     }
-    else
+    else {
+        logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
         return null;
-    if (key.publicKey == null)
+    }
+    if (key.publicKey == null) {
+        logger.debug("Failed to verify; key {keyId} has no publicKeyPem field.", { keyId });
         return null;
+    }
     const headerNames = headers.split(/\s+/g);
     if (!headerNames.includes("(request-target)") || !headerNames.includes("date")) {
+        logger.debug("Failed to verify; required headers missing in the Signature header: " +
+            "{headers}.", { headers });
         return null;
     }
-    if (body != null && !headerNames.includes("digest"))
+    if (body != null && !headerNames.includes("digest")) {
+        logger.debug("Failed to verify; required headers missing in the Signature header: " +
+            "{headers}.", { headers });
         return null;
+    }
     const message = headerNames.map((name) => `${name}: ` +
         (name == "(request-target)"
             ? `${request.method.toLowerCase()} ${new URL(request.url).pathname}`
@@ -168,7 +219,13 @@ export async function verify(request, documentLoader, currentTime) {
     const sig = decodeBase64(signature);
     // TODO: support other than RSASSA-PKCS1-v1_5:
     const verified = await dntShim.crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message));
-    return verified ? key : null;
+    if (!verified) {
+        logger.debug("Failed to verify; signature {signature} is invalid.  " +
+            "Check if the key is correct or if the signed message is correct.  " +
+            "The message to sign is:\n{message}", { signature, message });
+        return null;
+    }
+    return key;
 }
 /**
  * Checks if the actor of the given activity owns the specified key.

package/esm/runtime/docloader.js

@@ -48,7 +48,7 @@ async function getRemoteDocument(url, response) {
         });
         throw new FetchError(documentUrl, `HTTP ${response.status}: ${documentUrl}`);
     }
-    logger.error("Fetched document: {status} {url} {headers}", {
+    logger.debug("Fetched document: {status} {url} {headers}", {
         status: response.status,
         url: documentUrl,
         headers: Object.fromEntries(response.headers.entries()),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "0.8.0-dev.152+7dc1eb38",
+  "version": "0.8.0-dev.153+42a8bd70",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",

package/types/federation/send.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"send.d.ts","sourceRoot":"","sources":["../../src/federation/send.ts"],"names":[],"mappings":";;AAAA,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAG5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,UAAU,EAAE,SAAS,EAAE,CAAC;IAExB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE,wBAAwB,GAC1D,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAY7B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,QAAQ,EAAE,QAAQ,CAAC;IAEnB;;OAEG;IACH,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC;IAE9B;;OAEG;IACH,KAAK,EAAE,GAAG,CAAC;IAEX;;OAEG;IACH,KAAK,EAAE,GAAG,CAAC;IAEX;;OAEG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,EACE,QAAQ,EACR,UAAU,EACV,KAAK,EACL,KAAK,EACL,cAAc,EACd,OAAO,GACR,EAAE,sBAAsB,GACxB,OAAO,CAAC,IAAI,CAAC,CAmCf"}
+{"version":3,"file":"send.d.ts","sourceRoot":"","sources":["../../src/federation/send.ts"],"names":[],"mappings":";;AAAA,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAG5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,UAAU,EAAE,SAAS,EAAE,CAAC;IAExB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE,wBAAwB,GAC1D,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAY7B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,QAAQ,EAAE,QAAQ,CAAC;IAEnB;;OAEG;IACH,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC;IAE9B;;OAEG;IACH,KAAK,EAAE,GAAG,CAAC;IAEX;;OAEG;IACH,KAAK,EAAE,GAAG,CAAC;IAEX;;OAEG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,EACE,QAAQ,EACR,UAAU,EACV,KAAK,EACL,KAAK,EACL,cAAc,EACd,OAAO,GACR,EAAE,sBAAsB,GACxB,OAAO,CAAC,IAAI,CAAC,CAwCf"}

package/types/httpsig/mod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../src/httpsig/mod.ts"],"names":[],"mappings":";;AAAA;;;;;GAKG;AACH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAI5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,KAAK,KAAK,EAAW,MAAM,mBAAmB,CAAC;AACxD,OAAO,EACL,KAAK,QAAQ,EACb,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEvE;;;;;;;;GAQG;AACH,wBAAsB,IAAI,CACxB,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,OAAO,CAAC,SAAS,EAC7B,KAAK,EAAE,GAAG,GACT,OAAO,CAAC,OAAO,CAAC,CAuClB;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,MAAM,CAC1B,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,cAAc,EAC9B,WAAW,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,GACrC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAyGlC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,gBAAgB,EACrB,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,GAAG,GAAG,gBAAgB,EAC7B,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAwCvB"}
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../src/httpsig/mod.ts"],"names":[],"mappings":";;AAAA;;;;;GAKG;AACH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAK5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,KAAK,KAAK,EAAW,MAAM,mBAAmB,CAAC;AACxD,OAAO,EACL,KAAK,QAAQ,EACb,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEvE;;;;;;;;GAQG;AACH,wBAAsB,IAAI,CACxB,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,OAAO,CAAC,SAAS,EAC7B,KAAK,EAAE,GAAG,GACT,OAAO,CAAC,OAAO,CAAC,CAuClB;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,MAAM,CAC1B,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,cAAc,EAC9B,WAAW,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,GACrC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAwNlC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,gBAAgB,EACrB,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,GAAG,GAAG,gBAAgB,EAC7B,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAwCvB"}