@fedify/fedify 1.6.0-dev.813 → 1.6.0-experiment.0

package/dist/sig/key.d.ts

@@ -0,0 +1,125 @@
+import { Temporal } from "@js-temporal/polyfill";
+import { URLPattern } from "urlpattern-polyfill";
+import { DocumentLoader } from "../runtime/docloader.js";
+import { CryptographicKey$1 as CryptographicKey, Multikey$1 as Multikey } from "../vocab/vocab.js";
+import { TracerProvider } from "@opentelemetry/api";
+
+//#region sig/key.d.ts
+/**
+* Generates a key pair which is appropriate for Fedify.
+* @param algorithm The algorithm to use.  Currently only RSASSA-PKCS1-v1_5 and
+*                  Ed25519 are supported.
+* @returns The generated key pair.
+* @throws {TypeError} If the algorithm is unsupported.
+*/
+
+/**
+ * Generates a key pair which is appropriate for Fedify.
+ * @param algorithm The algorithm to use.  Currently only RSASSA-PKCS1-v1_5 and
+ *                  Ed25519 are supported.
+ * @returns The generated key pair.
+ * @throws {TypeError} If the algorithm is unsupported.
+ */
+declare function generateCryptoKeyPair(algorithm?: "RSASSA-PKCS1-v1_5" | "Ed25519"): Promise<CryptoKeyPair>;
+/**
+ * Exports a key in JWK format.
+ * @param key The key to export.  Either public or private key.
+ * @returns The exported key in JWK format.  The key is suitable for
+ *          serialization and storage.
+ * @throws {TypeError} If the key is invalid or unsupported.
+ */
+declare function exportJwk(key: CryptoKey): Promise<JsonWebKey>;
+/**
+ * Imports a key from JWK format.
+ * @param jwk The key in JWK format.
+ * @param type Which type of key to import, either `"public"` or `"private"`.
+ * @returns The imported key.
+ * @throws {TypeError} If the key is invalid or unsupported.
+ */
+declare function importJwk(jwk: JsonWebKey, type: "public" | "private"): Promise<CryptoKey>;
+/**
+ * Options for {@link fetchKey}.
+ * @since 1.3.0
+ */
+interface FetchKeyOptions {
+  /**
+   * The document loader for loading remote JSON-LD documents.
+   */
+  documentLoader?: DocumentLoader;
+  /**
+   * The context loader for loading remote JSON-LD contexts.
+   */
+  contextLoader?: DocumentLoader;
+  /**
+   * The key cache to use for caching public keys.
+   * @since 0.12.0
+   */
+  keyCache?: KeyCache;
+  /**
+   * The OpenTelemetry tracer provider to use for tracing.  If omitted,
+   * the global tracer provider is used.
+   * @since 1.3.0
+   */
+  tracerProvider?: TracerProvider;
+}
+/**
+ * The result of {@link fetchKey}.
+ * @since 1.3.0
+ */
+interface FetchKeyResult<T extends CryptographicKey | Multikey> {
+  /**
+   * The fetched (or cached) key.
+   */
+  readonly key: T & {
+    publicKey: CryptoKey;
+  } | null;
+  /**
+   * Whether the key is fetched from the cache.
+   */
+  readonly cached: boolean;
+}
+/**
+ * Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL.
+ * If the given URL contains an {@link Actor} object, it tries to find
+ * the corresponding key in the `publicKey` or `assertionMethod` property.
+ * @typeParam T The type of the key to fetch.  Either {@link CryptographicKey}
+ *              or {@link Multikey}.
+ * @param keyId The URL of the key.
+ * @param cls The class of the key to fetch.  Either {@link CryptographicKey}
+ *            or {@link Multikey}.
+ * @param options Options for fetching the key.  See {@link FetchKeyOptions}.
+ * @returns The fetched key or `null` if the key is not found.
+ * @since 1.3.0
+ */
+declare function fetchKey<T extends CryptographicKey | Multikey>(keyId: URL | string, cls: (new (...args: any[]) => T) & {
+  fromJsonLd(jsonLd: unknown, options: {
+    documentLoader?: DocumentLoader;
+    contextLoader?: DocumentLoader;
+    tracerProvider?: TracerProvider;
+  }): Promise<T>;
+}, options?: FetchKeyOptions): Promise<FetchKeyResult<T>>;
+/**
+ * A cache for storing cryptographic keys.
+ * @since 0.12.0
+ */
+interface KeyCache {
+  /**
+   * Gets a key from the cache.
+   * @param keyId The key ID.
+   * @returns The key if found, `null` if the key is not available (e.g.,
+   *          fetching the key was tried but failed), or `undefined`
+   *          if the cache is not available.
+   */
+  get(keyId: URL): Promise<CryptographicKey | Multikey | null | undefined>;
+  /**
+   * Sets a key to the cache.
+   *
+   * Note that this caches unavailable keys (i.e., `null`) as well,
+   * and it is recommended to make unavailable keys expire after a short period.
+   * @param keyId The key ID.
+   * @param key The key to cache.  `null` means the key is not available
+   *            (e.g., fetching the key was tried but failed).
+   */
+  set(keyId: URL, key: CryptographicKey | Multikey | null): Promise<void>;
+} //#endregion
+export { FetchKeyOptions, FetchKeyResult, KeyCache, exportJwk as exportJwk$1, fetchKey as fetchKey$1, generateCryptoKeyPair as generateCryptoKeyPair$1, importJwk as importJwk$1 };

package/dist/sig/key.js

@@ -0,0 +1,257 @@
+
+      import { Temporal } from "@js-temporal/polyfill";
+      import { URLPattern } from "urlpattern-polyfill";
+    
+import { deno_default } from "../deno.js";
+import { getDocumentLoader } from "../runtime/docloader.js";
+import { CryptographicKey, Object as Object$1 } from "../vocab/vocab.js";
+import { isActor } from "../vocab/actor.js";
+import { getLogger } from "@logtape/logtape";
+import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
+
+//#region sig/key.ts
+/**
+* Checks if the given key is valid and supported.  No-op if the key is valid,
+* otherwise throws an error.
+* @param key The key to check.
+* @param type Which type of key to check.  If not specified, the key can be
+*             either public or private.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+function validateCryptoKey(key, type) {
+	if (type != null && key.type !== type) throw new TypeError(`The key is not a ${type} key.`);
+	if (!key.extractable) throw new TypeError("The key is not extractable.");
+	if (key.algorithm.name !== "RSASSA-PKCS1-v1_5" && key.algorithm.name !== "Ed25519") throw new TypeError("Currently only RSASSA-PKCS1-v1_5 and Ed25519 keys are supported.  More algorithms will be added in the future!");
+	if (key.algorithm.name === "RSASSA-PKCS1-v1_5") {
+		const algorithm = key.algorithm;
+		if (algorithm.hash.name !== "SHA-256") throw new TypeError("For compatibility with the existing Fediverse software (e.g., Mastodon), hash algorithm for RSASSA-PKCS1-v1_5 keys must be SHA-256.");
+	}
+}
+/**
+* Generates a key pair which is appropriate for Fedify.
+* @param algorithm The algorithm to use.  Currently only RSASSA-PKCS1-v1_5 and
+*                  Ed25519 are supported.
+* @returns The generated key pair.
+* @throws {TypeError} If the algorithm is unsupported.
+*/
+function generateCryptoKeyPair(algorithm) {
+	if (algorithm == null) getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]).warn("No algorithm specified.  Using RSASSA-PKCS1-v1_5 by default, but it is recommended to specify the algorithm explicitly as the parameter will be required in the future.");
+	if (algorithm == null || algorithm === "RSASSA-PKCS1-v1_5") return crypto.subtle.generateKey({
+		name: "RSASSA-PKCS1-v1_5",
+		modulusLength: 4096,
+		publicExponent: new Uint8Array([
+			1,
+			0,
+			1
+		]),
+		hash: "SHA-256"
+	}, true, ["sign", "verify"]);
+	else if (algorithm === "Ed25519") return crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
+	throw new TypeError("Unsupported algorithm: " + algorithm);
+}
+/**
+* Exports a key in JWK format.
+* @param key The key to export.  Either public or private key.
+* @returns The exported key in JWK format.  The key is suitable for
+*          serialization and storage.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+async function exportJwk(key) {
+	validateCryptoKey(key);
+	const jwk = await crypto.subtle.exportKey("jwk", key);
+	if (jwk.crv === "Ed25519") jwk.alg = "Ed25519";
+	return jwk;
+}
+/**
+* Imports a key from JWK format.
+* @param jwk The key in JWK format.
+* @param type Which type of key to import, either `"public"` or `"private"`.
+* @returns The imported key.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+async function importJwk(jwk, type) {
+	let key;
+	if (jwk.kty === "RSA" && jwk.alg === "RS256") key = await crypto.subtle.importKey("jwk", jwk, {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, true, type === "public" ? ["verify"] : ["sign"]);
+	else if (jwk.kty === "OKP" && jwk.crv === "Ed25519") key = await crypto.subtle.importKey("jwk", jwk, "Ed25519", true, type === "public" ? ["verify"] : ["sign"]);
+	else throw new TypeError("Unsupported JWK format.");
+	validateCryptoKey(key, type);
+	return key;
+}
+/**
+* Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL.
+* If the given URL contains an {@link Actor} object, it tries to find
+* the corresponding key in the `publicKey` or `assertionMethod` property.
+* @typeParam T The type of the key to fetch.  Either {@link CryptographicKey}
+*              or {@link Multikey}.
+* @param keyId The URL of the key.
+* @param cls The class of the key to fetch.  Either {@link CryptographicKey}
+*            or {@link Multikey}.
+* @param options Options for fetching the key.  See {@link FetchKeyOptions}.
+* @returns The fetched key or `null` if the key is not found.
+* @since 1.3.0
+*/
+function fetchKey(keyId, cls, options = {}) {
+	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
+	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
+	keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
+	return tracer.startActiveSpan("activitypub.fetch_key", {
+		kind: SpanKind.CLIENT,
+		attributes: {
+			"http.method": "GET",
+			"url.full": keyId.href,
+			"url.scheme": keyId.protocol.replace(/:$/, ""),
+			"url.domain": keyId.hostname,
+			"url.path": keyId.pathname,
+			"url.query": keyId.search.replace(/^\?/, ""),
+			"url.fragment": keyId.hash.replace(/^#/, "")
+		}
+	}, async (span) => {
+		try {
+			const result = await fetchKeyInternal(keyId, cls, options);
+			span.setAttribute("activitypub.actor.key.cached", result.cached);
+			return result;
+		} catch (e) {
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(e)
+			});
+			throw e;
+		} finally {
+			span.end();
+		}
+	});
+}
+async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider } = {}) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const cacheKey = typeof keyId === "string" ? new URL(keyId) : keyId;
+	keyId = typeof keyId === "string" ? keyId : keyId.href;
+	if (keyCache != null) {
+		const cachedKey = await keyCache.get(cacheKey);
+		if (cachedKey instanceof cls && cachedKey.publicKey != null) {
+			logger.debug("Key {keyId} found in cache.", { keyId });
+			return {
+				key: cachedKey,
+				cached: true
+			};
+		} else if (cachedKey === null) {
+			logger.debug("Entry {keyId} found in cache, but it is unavailable.", { keyId });
+			return {
+				key: null,
+				cached: true
+			};
+		}
+	}
+	logger.debug("Fetching key {keyId} to verify signature...", { keyId });
+	let document;
+	try {
+		const remoteDocument = await (documentLoader ?? getDocumentLoader())(keyId);
+		document = remoteDocument.document;
+	} catch (_) {
+		logger.debug("Failed to fetch key {keyId}.", { keyId });
+		await keyCache?.set(cacheKey, null);
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		});
+	} catch (e) {
+		if (!(e instanceof TypeError)) throw e;
+		try {
+			object = await cls.fromJsonLd(document, {
+				documentLoader,
+				contextLoader,
+				tracerProvider
+			});
+		} catch (e$1) {
+			if (e$1 instanceof TypeError) {
+				logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+				await keyCache?.set(cacheKey, null);
+				return {
+					key: null,
+					cached: false
+				};
+			}
+			throw e$1;
+		}
+	}
+	let key = null;
+	if (object instanceof cls) key = object;
+	else if (isActor(object)) {
+		const keys = cls === CryptographicKey ? object.getPublicKeys({
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		}) : object.getAssertionMethods({
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		});
+		let length = 0;
+		let lastKey = null;
+		for await (const k of keys) {
+			length++;
+			lastKey = k;
+			if (k.id?.href === keyId) {
+				key = k;
+				break;
+			}
+		}
+		const keyIdUrl = new URL(keyId);
+		if (key == null && keyIdUrl.hash === "" && length === 1) key = lastKey;
+		if (key == null) {
+			logger.debug("Failed to verify; object {keyId} returned an {actorType}, but has no key matching {keyId}.", {
+				keyId,
+				actorType: object.constructor.name
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+	} else {
+		logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+		await keyCache?.set(cacheKey, null);
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	if (key.publicKey == null) {
+		logger.debug("Failed to verify; key {keyId} has no publicKeyPem field.", { keyId });
+		await keyCache?.set(cacheKey, null);
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	if (keyCache != null) {
+		await keyCache.set(cacheKey, key);
+		logger.debug("Key {keyId} cached.", { keyId });
+	}
+	return {
+		key,
+		cached: false
+	};
+}
+
+//#endregion
+export { exportJwk, fetchKey, generateCryptoKeyPair, importJwk, validateCryptoKey };

package/dist/sig/key.test.d.ts

@@ -0,0 +1,2 @@
+import { Temporal } from "@js-temporal/polyfill";
+import { URLPattern } from "urlpattern-polyfill";

package/dist/sig/key.test.js

@@ -0,0 +1,242 @@
+
+      import { Temporal } from "@js-temporal/polyfill";
+      import { URLPattern } from "urlpattern-polyfill";
+    
+import { CryptographicKey, Multikey } from "../vocab/vocab.js";
+import { exportJwk, fetchKey, generateCryptoKeyPair, importJwk, validateCryptoKey } from "./key.js";
+import { assertEquals } from "../node_modules/.pnpm/@jsr_std__assert@0.226.0/node_modules/@jsr/std__assert/assert_equals.js";
+import { test } from "../testing/mod.js";
+import { assertRejects } from "../node_modules/.pnpm/@jsr_std__assert@0.226.0/node_modules/@jsr/std__assert/assert_rejects.js";
+import { assertThrows } from "../node_modules/.pnpm/@jsr_std__assert@0.226.0/node_modules/@jsr/std__assert/assert_throws.js";
+import { mockDocumentLoader } from "../testing/docloader.js";
+import { ed25519Multikey, rsaPrivateKey2, rsaPublicKey1, rsaPublicKey2, rsaPublicKey3 } from "../testing/keys.js";
+
+//#region sig/key.test.ts
+test("validateCryptoKey()", async () => {
+	const pkcs1v15 = await crypto.subtle.generateKey({
+		name: "RSASSA-PKCS1-v1_5",
+		modulusLength: 2048,
+		publicExponent: new Uint8Array([
+			1,
+			0,
+			1
+		]),
+		hash: "SHA-256"
+	}, true, ["sign", "verify"]);
+	validateCryptoKey(pkcs1v15.privateKey, "private");
+	validateCryptoKey(pkcs1v15.privateKey);
+	validateCryptoKey(pkcs1v15.publicKey, "public");
+	validateCryptoKey(pkcs1v15.publicKey);
+	const ed25519 = await crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
+	validateCryptoKey(ed25519.privateKey, "private");
+	validateCryptoKey(ed25519.privateKey);
+	validateCryptoKey(ed25519.publicKey, "public");
+	validateCryptoKey(ed25519.publicKey);
+	assertThrows(() => validateCryptoKey(pkcs1v15.privateKey, "public"), TypeError, "The key is not a public key.");
+	assertThrows(() => validateCryptoKey(pkcs1v15.publicKey, "private"), TypeError, "The key is not a private key.");
+	assertThrows(() => validateCryptoKey(ed25519.privateKey, "public"), TypeError, "The key is not a public key.");
+	assertThrows(() => validateCryptoKey(ed25519.publicKey, "private"), TypeError, "The key is not a private key.");
+	const ecdsa = await crypto.subtle.generateKey({
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, true, ["sign", "verify"]);
+	assertThrows(() => validateCryptoKey(ecdsa.publicKey), TypeError, "only RSASSA-PKCS1-v1_5 and Ed25519");
+	const pkcs1v15Sha512 = await crypto.subtle.generateKey({
+		name: "RSASSA-PKCS1-v1_5",
+		modulusLength: 2048,
+		publicExponent: new Uint8Array([
+			1,
+			0,
+			1
+		]),
+		hash: "SHA-512"
+	}, true, ["sign", "verify"]);
+	assertThrows(() => validateCryptoKey(pkcs1v15Sha512.privateKey), TypeError, "hash algorithm for RSASSA-PKCS1-v1_5 keys must be SHA-256");
+});
+test("generateCryptoKeyPair()", async () => {
+	const rsaKeyPair = await generateCryptoKeyPair();
+	assertEquals(rsaKeyPair.privateKey.algorithm, {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: { name: "SHA-256" },
+		modulusLength: 4096,
+		publicExponent: new Uint8Array([
+			1,
+			0,
+			1
+		])
+	});
+	validateCryptoKey(rsaKeyPair.privateKey, "private");
+	validateCryptoKey(rsaKeyPair.publicKey, "public");
+	const rsaKeyPair2 = await generateCryptoKeyPair("RSASSA-PKCS1-v1_5");
+	assertEquals(rsaKeyPair2.privateKey.algorithm, {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: { name: "SHA-256" },
+		modulusLength: 4096,
+		publicExponent: new Uint8Array([
+			1,
+			0,
+			1
+		])
+	});
+	validateCryptoKey(rsaKeyPair2.privateKey, "private");
+	validateCryptoKey(rsaKeyPair2.publicKey, "public");
+	const ed25519KeyPair = await generateCryptoKeyPair("Ed25519");
+	assertEquals(ed25519KeyPair.privateKey.algorithm, { name: "Ed25519" });
+	validateCryptoKey(ed25519KeyPair.privateKey, "private");
+	validateCryptoKey(ed25519KeyPair.publicKey, "public");
+});
+const rsaPublicJwk = {
+	alg: "RS256",
+	kty: "RSA",
+	e: "AQAB",
+	n: "oRmBtnxbdFutoRd1GLGwwGTrsqlRRWUe11hHQaoRLGf5LwQ0tIc6I9q-dynliw-2kxYsLn9SH2je6HcTYOolgW7F_cOWXZQN04b-OiYcU1ConAhLjmn4k1uKawJ614y0ScPNd8PQ-CljsnlPxbq9ofaCMe2BV3B6y09aCuGFJ0nxn1_ubjmIBIWWFTAznoz1J9BhJDGyt3IO3ABy3f9zDVlR32L_n5VIkXnxkjUKdzMAOzYb62kuKOp1iznRTPrV71SNtivJMwSh_LVgBrmZjtIn_oim-KyX_fdLU3tQ7VClyqmJzyAjccOH6Qj6nFTPh-vX07gqN8IlLT2uye4waw",
+	key_ops: ["verify"],
+	ext: true
+};
+const rsaPrivateJwk = {
+	alg: "RS256",
+	kty: "RSA",
+	d: "f-Pa2L7Sb4YUSa1wlSEC-0li35uQ3DFRkY0QTG2xYnpMFGoXWTV9D1epGrqU8pePzias_mCvFiZPx2Y4aRiYm68P2Mu7hCBz9XfWPN1iYTXIFM51BOLVpk3mjdsTICkgOusJI0m9jDR3ZAjwLj14K6qhYvd0VbECmoItLjQoW64Sc9iDgD3CvGoTqv71oTfW70cy-Ve1xQ9CThAmMOTKe6rYCUTA8tMZcPszifZ4iOasOjgvRxyel86LqGNtyslY8k86gQlMtFpR3VeZV_8otAWZn0mDc4vVU8HUO-DzYiIFdAcVxfPJh6tx7snCTsdzze_98OEAK4EWYBn7vsGFeQ",
+	dp: "lrXReSkZQXSmSxQ1TimV5kMt96gSu4_r-OGIabVmoG5irhjMyN08Jjc3qK9oZS3uNM-LxAOg4OdzefjsF9IMfZJl6wuLd85g_l4BHSaEk5zC8l3QugX1IU9XZ7wDxXUrutMoNtZXDtdbveAMtHNZlIu-qmEBDWzkqJiz2WpW-AE",
+	dq: "TCLoYcX0ywuNA9DSU6v94KmBh1e_IELEFVbJb5vvLKlAK-ycMK0rfzC1co9Hhkski1LskTnxnoqwZ5oF-7X10eZvy3Te_FHSl0IsTar8ST2-MRtGh2UjTdvP_nnygj4GcXvKfngjPEfthDzVfVMeR38oDhDxMFD5AaY_v9aMH_U",
+	e: "AQAB",
+	n: "oRmBtnxbdFutoRd1GLGwwGTrsqlRRWUe11hHQaoRLGf5LwQ0tIc6I9q-dynliw-2kxYsLn9SH2je6HcTYOolgW7F_cOWXZQN04b-OiYcU1ConAhLjmn4k1uKawJ614y0ScPNd8PQ-CljsnlPxbq9ofaCMe2BV3B6y09aCuGFJ0nxn1_ubjmIBIWWFTAznoz1J9BhJDGyt3IO3ABy3f9zDVlR32L_n5VIkXnxkjUKdzMAOzYb62kuKOp1iznRTPrV71SNtivJMwSh_LVgBrmZjtIn_oim-KyX_fdLU3tQ7VClyqmJzyAjccOH6Qj6nFTPh-vX07gqN8IlLT2uye4waw",
+	p: "xuDd7tE_47NWwvDTpB403X13EPA3768MlNpl_v_BGiuP-1uvWUnsOVZB0F3HXSVg1sBVNtec46v7OU0P693gvYUhouTmSQpayY_VFqMklprWgs7cfneqbeDzv3C4Fw5waY-vjoINDsE1jYELUnl5cVjXXyxuGFG-IaLJKmHmHX0",
+	q: "z17X2t9zO6WcMp6W04gXdKmniJlxekOrOmWnrX9AwaM8NYCLN3y23r59nqNP9aUAWG1eoGFmav2rYQitWhz_VsEu2pQUsfsYKZYHchu5p_jCYwuM3rIg7aCbhtGv_tBoWAf1NvKMhtp2es0ZaHZCzKDGSOkIYDOB-ZDmNigWigc",
+	qi: "KC6gWhVM_x7iQgl-gEoSh_iM1Jf314ZLJKAAz1DsTHMi5yuCkCMmmY7h6jlkAJVngK3KIf5LPoAeUoGJ26E1kocbRU_nZBftMDVXHCYICz8qMQXR5euN_5SeJnu_VWXH-CY83MKhPYAorWSZ1-G9gh-C16LlRMzJwoE6h5QNeNo",
+	key_ops: ["sign"],
+	ext: true
+};
+test("exportJwk()", async () => {
+	assertEquals(await exportJwk(rsaPrivateKey2), rsaPrivateJwk);
+	assertEquals(await exportJwk(rsaPublicKey2.publicKey), rsaPublicJwk);
+});
+test("importJwk()", async () => {
+	assertEquals(await importJwk(rsaPrivateJwk, "private"), rsaPrivateKey2);
+	assertEquals(await importJwk(rsaPublicJwk, "public"), rsaPublicKey2.publicKey);
+	assertRejects(() => importJwk(rsaPublicJwk, "private"));
+	assertRejects(() => importJwk(rsaPrivateJwk, "public"));
+});
+test("fetchKey()", async () => {
+	const cache = {};
+	const options = {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader,
+		keyCache: {
+			get(keyId) {
+				return Promise.resolve(cache[keyId.href]);
+			},
+			set(keyId, key) {
+				cache[keyId.href] = key;
+				return Promise.resolve();
+			}
+		}
+	};
+	assertEquals(await fetchKey("https://example.com/nothing", CryptographicKey, options), {
+		key: null,
+		cached: false
+	});
+	assertEquals(cache, { "https://example.com/nothing": null });
+	assertEquals(await fetchKey("https://example.com/nothing", CryptographicKey, options), {
+		key: null,
+		cached: true
+	});
+	assertEquals(cache, { "https://example.com/nothing": null });
+	assertEquals(await fetchKey("https://example.com/object", CryptographicKey, options), {
+		key: null,
+		cached: false
+	});
+	assertEquals(cache, {
+		"https://example.com/nothing": null,
+		"https://example.com/object": null
+	});
+	assertEquals(await fetchKey("https://example.com/key", CryptographicKey, options), {
+		key: rsaPublicKey1,
+		cached: false
+	});
+	assertEquals(cache, {
+		"https://example.com/nothing": null,
+		"https://example.com/object": null,
+		"https://example.com/key": rsaPublicKey1
+	});
+	assertEquals(await fetchKey("https://example.com/key", CryptographicKey, options), {
+		key: rsaPublicKey1,
+		cached: true
+	});
+	assertEquals(cache, {
+		"https://example.com/nothing": null,
+		"https://example.com/object": null,
+		"https://example.com/key": rsaPublicKey1
+	});
+	assertEquals(await fetchKey("https://example.com/person#no-key", CryptographicKey, options), {
+		key: null,
+		cached: false
+	});
+	assertEquals(cache, {
+		"https://example.com/nothing": null,
+		"https://example.com/object": null,
+		"https://example.com/key": rsaPublicKey1,
+		"https://example.com/person#no-key": null
+	});
+	assertEquals(await fetchKey("https://example.com/person2#key3", CryptographicKey, options), {
+		key: rsaPublicKey3,
+		cached: false
+	});
+	assertEquals(cache, {
+		"https://example.com/nothing": null,
+		"https://example.com/object": null,
+		"https://example.com/key": rsaPublicKey1,
+		"https://example.com/person#no-key": null,
+		"https://example.com/person2#key3": rsaPublicKey3
+	});
+	assertEquals(await fetchKey("https://example.com/person2#key3", CryptographicKey, options), {
+		key: rsaPublicKey3,
+		cached: true
+	});
+	assertEquals(cache, {
+		"https://example.com/nothing": null,
+		"https://example.com/object": null,
+		"https://example.com/key": rsaPublicKey1,
+		"https://example.com/person#no-key": null,
+		"https://example.com/person2#key3": rsaPublicKey3
+	});
+	assertEquals(await fetchKey("https://example.com/person2#key4", Multikey, options), {
+		key: ed25519Multikey,
+		cached: false
+	});
+	assertEquals(cache, {
+		"https://example.com/nothing": null,
+		"https://example.com/object": null,
+		"https://example.com/key": rsaPublicKey1,
+		"https://example.com/person#no-key": null,
+		"https://example.com/person2#key3": rsaPublicKey3,
+		"https://example.com/person2#key4": ed25519Multikey
+	});
+	assertEquals(await fetchKey("https://example.com/person2#key4", Multikey, options), {
+		key: ed25519Multikey,
+		cached: true
+	});
+	assertEquals(await fetchKey("https://example.com/key", CryptographicKey, {
+		...options,
+		keyCache: void 0
+	}), {
+		key: rsaPublicKey1,
+		cached: false
+	});
+	assertEquals(await fetchKey("https://example.com/users/handle", CryptographicKey, options), {
+		key: new CryptographicKey({
+			id: new URL("https://example.com/users/handle#main-key"),
+			publicKey: await importJwk({
+				kty: "RSA",
+				alg: "RS256",
+				n: "oRmBtnxbdFutoRd1GLGwwGTrsqlRRWUe11hHQaoRLGf5LwQ0tIc6I9q-dynliw-2kxYsLn9SH2je6HcTYOolgW7F_cOWXZQN04b-OiYcU1ConAhLjmn4k1uKawJ614y0ScPNd8PQ-CljsnlPxbq9ofaCMe2BV3B6y09aCuGFJ0nxn1_ubjmIBIWWFTAznoz1J9BhJDGyt3IO3ABy3f9zDVlR32L_n5VIkXnxkjUKdzMAOzYb62kuKOp1iznRTPrV71SNtivJMwSh_LVgBrmZjtIn_oim-KyX_fdLU3tQ7VClyqmJzyAjccOH6Qj6nFTPh-vX07gqN8IlLT2uye4waw",
+				e: "AQAB",
+				key_ops: ["verify"],
+				ext: true
+			}, "public")
+		}),
+		cached: false
+	});
+});
+
+//#endregion