@fedify/fedify 1.6.0-dev.814 → 1.6.0

package/dist/runtime/multibase/multibase.test.js

@@ -0,0 +1,351 @@
+
+      import { Temporal } from "@js-temporal/polyfill";
+      import { URLPattern } from "urlpattern-polyfill";
+    
+import { decodeText, encodeText } from "./util.js";
+import { codes, names } from "./constants.js";
+import { decode, encode } from "./index.js";
+import { assertEquals } from "../../node_modules/.pnpm/@jsr_std__assert@0.226.0/node_modules/@jsr/std__assert/assert_equals.js";
+import { test } from "../../testing/mod.js";
+
+//#region runtime/multibase/multibase.test.ts
+test("multibase.encode and decode", async (t) => {
+	const testCases = [
+		[
+			"base16",
+			decodeText(Uint8Array.from([1])),
+			"f01"
+		],
+		[
+			"base16",
+			decodeText(Uint8Array.from([15])),
+			"f0f"
+		],
+		[
+			"base16",
+			"f",
+			"f66"
+		],
+		[
+			"base16",
+			"fo",
+			"f666f"
+		],
+		[
+			"base16",
+			"foo",
+			"f666f6f"
+		],
+		[
+			"base16",
+			"foob",
+			"f666f6f62"
+		],
+		[
+			"base16",
+			"fooba",
+			"f666f6f6261"
+		],
+		[
+			"base16",
+			"foobar",
+			"f666f6f626172"
+		],
+		[
+			"base32",
+			"yes mani !",
+			"bpfsxgidnmfxgsibb"
+		],
+		[
+			"base32",
+			"f",
+			"bmy"
+		],
+		[
+			"base32",
+			"fo",
+			"bmzxq"
+		],
+		[
+			"base32",
+			"foo",
+			"bmzxw6"
+		],
+		[
+			"base32",
+			"foob",
+			"bmzxw6yq"
+		],
+		[
+			"base32",
+			"fooba",
+			"bmzxw6ytb"
+		],
+		[
+			"base32",
+			"foobar",
+			"bmzxw6ytboi"
+		],
+		[
+			"base32pad",
+			"yes mani !",
+			"cpfsxgidnmfxgsibb"
+		],
+		[
+			"base32pad",
+			"f",
+			"cmy======"
+		],
+		[
+			"base32pad",
+			"fo",
+			"cmzxq===="
+		],
+		[
+			"base32pad",
+			"foo",
+			"cmzxw6==="
+		],
+		[
+			"base32pad",
+			"foob",
+			"cmzxw6yq="
+		],
+		[
+			"base32pad",
+			"fooba",
+			"cmzxw6ytb"
+		],
+		[
+			"base32pad",
+			"foobar",
+			"cmzxw6ytboi======"
+		],
+		[
+			"base32hex",
+			"yes mani !",
+			"vf5in683dc5n6i811"
+		],
+		[
+			"base32hex",
+			"f",
+			"vco"
+		],
+		[
+			"base32hex",
+			"fo",
+			"vcpng"
+		],
+		[
+			"base32hex",
+			"foo",
+			"vcpnmu"
+		],
+		[
+			"base32hex",
+			"foob",
+			"vcpnmuog"
+		],
+		[
+			"base32hex",
+			"fooba",
+			"vcpnmuoj1"
+		],
+		[
+			"base32hex",
+			"foobar",
+			"vcpnmuoj1e8"
+		],
+		[
+			"base32hexpad",
+			"yes mani !",
+			"tf5in683dc5n6i811"
+		],
+		[
+			"base32hexpad",
+			"f",
+			"tco======"
+		],
+		[
+			"base32hexpad",
+			"fo",
+			"tcpng===="
+		],
+		[
+			"base32hexpad",
+			"foo",
+			"tcpnmu==="
+		],
+		[
+			"base32hexpad",
+			"foob",
+			"tcpnmuog="
+		],
+		[
+			"base32hexpad",
+			"fooba",
+			"tcpnmuoj1"
+		],
+		[
+			"base32hexpad",
+			"foobar",
+			"tcpnmuoj1e8======"
+		],
+		[
+			"base32z",
+			"yes mani !",
+			"hxf1zgedpcfzg1ebb"
+		],
+		[
+			"base58flickr",
+			"yes mani !",
+			"Z7Pznk19XTTzBtx"
+		],
+		[
+			"base58btc",
+			"yes mani !",
+			"z7paNL19xttacUY"
+		],
+		[
+			"base64",
+			"÷ïÿ",
+			"mw7fDr8O/"
+		],
+		[
+			"base64",
+			"f",
+			"mZg"
+		],
+		[
+			"base64",
+			"fo",
+			"mZm8"
+		],
+		[
+			"base64",
+			"foo",
+			"mZm9v"
+		],
+		[
+			"base64",
+			"foob",
+			"mZm9vYg"
+		],
+		[
+			"base64",
+			"fooba",
+			"mZm9vYmE"
+		],
+		[
+			"base64",
+			"foobar",
+			"mZm9vYmFy"
+		],
+		[
+			"base64",
+			"÷ïÿ🥰÷ïÿ😎🥶🤯",
+			"mw7fDr8O/8J+lsMO3w6/Dv/CfmI7wn6W28J+krw"
+		],
+		[
+			"base64pad",
+			"f",
+			"MZg=="
+		],
+		[
+			"base64pad",
+			"fo",
+			"MZm8="
+		],
+		[
+			"base64pad",
+			"foo",
+			"MZm9v"
+		],
+		[
+			"base64pad",
+			"foob",
+			"MZm9vYg=="
+		],
+		[
+			"base64pad",
+			"fooba",
+			"MZm9vYmE="
+		],
+		[
+			"base64pad",
+			"foobar",
+			"MZm9vYmFy"
+		],
+		[
+			"base64url",
+			"÷ïÿ",
+			"uw7fDr8O_"
+		],
+		[
+			"base64url",
+			"÷ïÿ🥰÷ïÿ😎🥶🤯",
+			"uw7fDr8O_8J-lsMO3w6_Dv_CfmI7wn6W28J-krw"
+		],
+		[
+			"base64urlpad",
+			"f",
+			"UZg=="
+		],
+		[
+			"base64urlpad",
+			"fo",
+			"UZm8="
+		],
+		[
+			"base64urlpad",
+			"foo",
+			"UZm9v"
+		],
+		[
+			"base64urlpad",
+			"foob",
+			"UZm9vYg=="
+		],
+		[
+			"base64urlpad",
+			"fooba",
+			"UZm9vYmE="
+		],
+		[
+			"base64urlpad",
+			"foobar",
+			"UZm9vYmFy"
+		],
+		[
+			"base64urlpad",
+			"÷ïÿ🥰÷ïÿ😎🥶🤯",
+			"Uw7fDr8O_8J-lsMO3w6_Dv_CfmI7wn6W28J-krw=="
+		]
+	];
+	for (const [name, input, expectedOutput] of testCases) await t.step(`Encoding/Decoding ${name} with ${input}`, () => {
+		const encoded = encode(name, encodeText(input));
+		assertEquals(decodeText(encoded), expectedOutput, `Encoding ${name} failed`);
+		const decoded = decode(expectedOutput);
+		assertEquals(decoded, encodeText(input), `Decoding ${name} failed`);
+		const decodedFromBuffer = decode(encodeText(expectedOutput));
+		assertEquals(decodedFromBuffer, encodeText(input), `Decoding buffer of ${name} failed`);
+	});
+	await t.step("should allow base32pad full alphabet", () => {
+		const encodedStr = "ctimaq4ygg2iegci7";
+		const decoded = decode(encodedStr);
+		const encoded = encode("c", decoded);
+		assertEquals(decode(encoded), decoded);
+	});
+});
+test("constants", async (t) => {
+	await t.step("constants indexed by name", () => {
+		const names$1 = names;
+		assertEquals(Object.keys(names$1).length, 23);
+	});
+	await t.step("constants indexed by code", () => {
+		const codes$1 = codes;
+		assertEquals(Object.keys(codes$1).length, 23);
+	});
+});
+
+//#endregion

package/dist/runtime/multibase/rfc4648.js

@@ -0,0 +1,61 @@
+
+      import { Temporal } from "@js-temporal/polyfill";
+      import { URLPattern } from "urlpattern-polyfill";
+    
+//#region runtime/multibase/rfc4648.ts
+const decode = (string, alphabet, bitsPerChar) => {
+	const codes = {};
+	for (let i = 0; i < alphabet.length; ++i) codes[alphabet[i]] = i;
+	let end = string.length;
+	while (string[end - 1] === "=") --end;
+	const out = new Uint8Array(end * bitsPerChar / 8 | 0);
+	let bits = 0;
+	let buffer = 0;
+	let written = 0;
+	for (let i = 0; i < end; ++i) {
+		const value = codes[string[i]];
+		if (value === void 0) throw new SyntaxError("Invalid character " + string[i]);
+		buffer = buffer << bitsPerChar | value;
+		bits += bitsPerChar;
+		if (bits >= 8) {
+			bits -= 8;
+			out[written++] = 255 & buffer >> bits;
+		}
+	}
+	if (bits >= bitsPerChar || 255 & buffer << 8 - bits) throw new SyntaxError("Unexpected end of data");
+	return out;
+};
+const encode = (data, alphabet, bitsPerChar) => {
+	const pad = alphabet[alphabet.length - 1] === "=";
+	const mask = (1 << bitsPerChar) - 1;
+	let out = "";
+	let bits = 0;
+	let buffer = 0;
+	for (let i = 0; i < data.length; ++i) {
+		buffer = buffer << 8 | data[i];
+		bits += 8;
+		while (bits > bitsPerChar) {
+			bits -= bitsPerChar;
+			out += alphabet[mask & buffer >> bits];
+		}
+	}
+	if (bits) out += alphabet[mask & buffer << bitsPerChar - bits];
+	if (pad) while (out.length * bitsPerChar & 7) out += "=";
+	return out;
+};
+/**
+* RFC4648 Factory
+*/
+const rfc4648 = (bitsPerChar) => (alphabet) => {
+	return {
+		encode(input) {
+			return encode(input, alphabet, bitsPerChar);
+		},
+		decode(input) {
+			return decode(input, alphabet, bitsPerChar);
+		}
+	};
+};
+
+//#endregion
+export { rfc4648 };

package/dist/runtime/multibase/util.js

@@ -0,0 +1,21 @@
+
+      import { Temporal } from "@js-temporal/polyfill";
+      import { URLPattern } from "urlpattern-polyfill";
+    
+//#region runtime/multibase/util.ts
+const textDecoder = new TextDecoder();
+const decodeText = (bytes) => textDecoder.decode(bytes);
+const textEncoder = new TextEncoder();
+const encodeText = (text) => textEncoder.encode(text);
+function concat(arrs, length) {
+	const output = new Uint8Array(length);
+	let offset = 0;
+	for (const arr of arrs) {
+		output.set(arr, offset);
+		offset += arr.length;
+	}
+	return output;
+}
+
+//#endregion
+export { concat, decodeText, encodeText };

package/dist/runtime/url.js

@@ -0,0 +1,67 @@
+
+      import { Temporal } from "@js-temporal/polyfill";
+      import { URLPattern } from "urlpattern-polyfill";
+    
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+
+//#region runtime/url.ts
+var UrlError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "UrlError";
+	}
+};
+/**
+* Validates a URL to prevent SSRF attacks.
+*/
+async function validatePublicUrl(url) {
+	const parsed = new URL(url);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
+	let hostname = parsed.hostname;
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.substring(1, hostname.length - 2);
+	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	if ("Deno" in globalThis && !isIP(hostname)) {
+		const netPermission = await Deno.permissions.query({ name: "net" });
+		if (netPermission.state !== "granted") return;
+	}
+	if ("Bun" in globalThis) {
+		if (hostname === "example.com" || hostname.endsWith(".example.com")) return;
+		else if (hostname === "fedify-test.internal") throw new UrlError("Invalid or private address: fedify-test.internal");
+	}
+	let addresses;
+	try {
+		addresses = await lookup(hostname, { all: true });
+	} catch {
+		addresses = [];
+	}
+	for (const { address, family } of addresses) if (family === 4 && !isValidPublicIPv4Address(address) || family === 6 && !isValidPublicIPv6Address(address) || family < 4 || family === 5 || family > 6) throw new UrlError(`Invalid or private address: ${address}`);
+}
+function isValidPublicIPv4Address(address) {
+	const parts = address.split(".");
+	const first = parseInt(parts[0]);
+	if (first === 0 || first === 10 || first === 127) return false;
+	const second = parseInt(parts[1]);
+	if (first === 169 && second === 254) return false;
+	if (first === 172 && second >= 16 && second <= 31) return false;
+	if (first === 192 && second === 168) return false;
+	return true;
+}
+function isValidPublicIPv6Address(address) {
+	address = expandIPv6Address(address);
+	if (address.at(4) !== ":") return false;
+	const firstWord = parseInt(address.substring(0, 4), 16);
+	return !(firstWord >= 64512 && firstWord <= 65023 || firstWord >= 65152 && firstWord <= 65215 || firstWord === 0 || firstWord >= 65280);
+}
+function expandIPv6Address(address) {
+	address = address.toLowerCase();
+	if (address === "::") return "0000:0000:0000:0000:0000:0000:0000:0000";
+	if (address.startsWith("::")) address = "0000" + address;
+	if (address.endsWith("::")) address = address + "0000";
+	address = address.replace("::", ":0000".repeat(8 - (address.match(/:/g) || []).length) + ":");
+	const parts = address.split(":");
+	return parts.map((part) => part.padStart(4, "0")).join(":");
+}
+
+//#endregion
+export { UrlError, expandIPv6Address, isValidPublicIPv4Address, isValidPublicIPv6Address, validatePublicUrl };

package/dist/runtime/url.test.d.ts

@@ -0,0 +1,2 @@
+import { Temporal } from "@js-temporal/polyfill";
+import { URLPattern } from "urlpattern-polyfill";

package/dist/runtime/url.test.js

@@ -0,0 +1,43 @@
+
+      import { Temporal } from "@js-temporal/polyfill";
+      import { URLPattern } from "urlpattern-polyfill";
+    
+import { UrlError, expandIPv6Address, isValidPublicIPv4Address, isValidPublicIPv6Address, validatePublicUrl } from "./url.js";
+import { assert } from "../node_modules/.pnpm/@jsr_std__assert@0.226.0/node_modules/@jsr/std__assert/assert.js";
+import { assertEquals } from "../node_modules/.pnpm/@jsr_std__assert@0.226.0/node_modules/@jsr/std__assert/assert_equals.js";
+import { test } from "../testing/mod.js";
+import { assertFalse } from "../node_modules/.pnpm/@jsr_std__assert@0.226.0/node_modules/@jsr/std__assert/assert_false.js";
+import { assertRejects } from "../node_modules/.pnpm/@jsr_std__assert@0.226.0/node_modules/@jsr/std__assert/assert_rejects.js";
+
+//#region runtime/url.test.ts
+test("validatePublicUrl()", async () => {
+	await assertRejects(() => validatePublicUrl("ftp://localhost"), UrlError);
+	await assertRejects(() => validatePublicUrl("data:text/plain;base64,SGVsbG8sIFdvcmxkIQ=="), UrlError);
+	await assertRejects(() => validatePublicUrl("https://localhost"), UrlError);
+	await assertRejects(() => validatePublicUrl("https://127.0.0.1"), UrlError);
+	await assertRejects(() => validatePublicUrl("https://[::1]"), UrlError);
+});
+test("isValidPublicIPv4Address()", () => {
+	assert(isValidPublicIPv4Address("8.8.8.8"));
+	assertFalse(isValidPublicIPv4Address("192.168.1.1"));
+	assertFalse(isValidPublicIPv4Address("127.0.0.1"));
+	assertFalse(isValidPublicIPv4Address("10.0.0.1"));
+	assertFalse(isValidPublicIPv4Address("127.16.0.1"));
+	assertFalse(isValidPublicIPv4Address("169.254.0.1"));
+});
+test("isValidPublicIPv6Address()", () => {
+	assert(isValidPublicIPv6Address("2001:db8::1"));
+	assertFalse(isValidPublicIPv6Address("::1"));
+	assertFalse(isValidPublicIPv6Address("fc00::1"));
+	assertFalse(isValidPublicIPv6Address("fe80::1"));
+	assertFalse(isValidPublicIPv6Address("ff00::1"));
+	assertFalse(isValidPublicIPv6Address("::"));
+});
+test("expandIPv6Address()", () => {
+	assertEquals(expandIPv6Address("::"), "0000:0000:0000:0000:0000:0000:0000:0000");
+	assertEquals(expandIPv6Address("::1"), "0000:0000:0000:0000:0000:0000:0000:0001");
+	assertEquals(expandIPv6Address("2001:db8::"), "2001:0db8:0000:0000:0000:0000:0000:0000");
+	assertEquals(expandIPv6Address("2001:db8::1"), "2001:0db8:0000:0000:0000:0000:0000:0001");
+});
+
+//#endregion

package/dist/sig/http.d.ts

@@ -0,0 +1,143 @@
+import { Temporal } from "@js-temporal/polyfill";
+import { URLPattern } from "urlpattern-polyfill";
+import { DocumentLoader } from "../runtime/docloader.js";
+import { CryptographicKey$1 as CryptographicKey } from "../vocab/vocab.js";
+import { KeyCache } from "./key.js";
+import { TracerProvider } from "@opentelemetry/api";
+
+//#region sig/http.d.ts
+/**
+* The standard to use for signing and verifying HTTP signatures.
+* @since 1.6.0
+*/
+/**
+ * The standard to use for signing and verifying HTTP signatures.
+ * @since 1.6.0
+ */
+type HttpMessageSignaturesSpec =
+/**
+ * The Signing HTTP Messages (draft-cavage-http-signatures-12) specification,
+ * which is widely adopted and used in the fediverse (as of May 2025).
+ */
+"draft-cavage-http-signatures-12"
+/**
+ * The HTTP Message Signatures (RFC 9421) specification, which is the
+ * finalized standard but not widely adopted yet (as of May 2025).
+ */ | "rfc9421";
+/**
+ * Options for {@link signRequest}.
+ * @since 1.3.0
+ */
+interface SignRequestOptions {
+  /**
+   * The HTTP message signatures specification to use for signing.
+   * @default `"draft-cavage-http-signatures-12"`
+   * @since 1.6.0
+   */
+  spec?: HttpMessageSignaturesSpec;
+  /**
+   * The current time.  If not specified, the current time is used.  This is
+   * useful for testing.
+   * @since 1.6.0
+   */
+  currentTime?: Temporal.Instant;
+  /**
+   * The OpenTelemetry tracer provider.  If omitted, the global tracer provider
+   * is used.
+   */
+  tracerProvider?: TracerProvider;
+}
+/**
+ * Signs a request using the given private key.
+ * @param request The request to sign.
+ * @param privateKey The private key to use for signing.
+ * @param keyId The key ID to use for the signature.  It will be used by the
+ *              verifier.
+ * @returns The signed request.
+ * @throws {TypeError} If the private key is invalid or unsupported.
+ */
+declare function signRequest(request: Request, privateKey: CryptoKey, keyId: URL, options?: SignRequestOptions): Promise<Request>;
+/**
+ * Options for {@link verifyRequest}.
+ */
+interface VerifyRequestOptions {
+  /**
+   * The document loader to use for fetching the public key.
+   */
+  documentLoader?: DocumentLoader;
+  /**
+   * The context loader to use for JSON-LD context retrieval.
+   */
+  contextLoader?: DocumentLoader;
+  /**
+   * The time window to allow for the request date.  The actual time window is
+   * twice the value of this option, with the current time as the center.
+   * Or if it is `false`, no time check is performed.
+   *
+   * An hour by default.
+   */
+  timeWindow?: Temporal.Duration | Temporal.DurationLike | false;
+  /**
+   * The current time.  If not specified, the current time is used.  This is
+   * useful for testing.
+   */
+  currentTime?: Temporal.Instant;
+  /**
+   * The key cache to use for caching public keys.
+   * @since 0.12.0
+   */
+  keyCache?: KeyCache;
+  /**
+   * The HTTP message signatures specification to use for verifying.
+   * @default `"draft-cavage-http-signatures-12"`
+   * @since 1.6.0
+   */
+  spec?: HttpMessageSignaturesSpec;
+  /**
+   * The OpenTelemetry tracer provider.  If omitted, the global tracer provider
+   * is used.
+   * @since 1.3.0
+   */
+  tracerProvider?: TracerProvider;
+}
+/**
+ * Verifies the signature of a request.
+ *
+ * Note that this function consumes the request body, so it should not be used
+ * if the request body is already consumed.  Consuming the request body after
+ * calling this function is okay, since this function clones the request
+ * under the hood.
+ *
+ * @param request The request to verify.
+ * @param options Options for verifying the request.
+ * @returns The public key of the verified signature, or `null` if the signature
+ *          could not be verified.
+ */
+declare function verifyRequest(request: Request, options?: VerifyRequestOptions): Promise<CryptographicKey | null>;
+/**
+ * A spec determiner for HTTP Message Signatures.
+ * It determines the spec to use for signing requests.
+ * It is used for double-knocking
+ * (see <https://swicg.github.io/activitypub-http-signature/#how-to-upgrade-supported-versions>).
+ * @since 1.6.0
+ */
+interface HttpMessageSignaturesSpecDeterminer {
+  /**
+   * Determines the spec to use for signing requests.
+   * @param origin The origin of the URL to make the request to.
+   * @returns The spec to use for signing requests.
+   */
+  determineSpec(origin: string): HttpMessageSignaturesSpec | Promise<HttpMessageSignaturesSpec>;
+  /**
+   * Remembers the successfully used spec for the given origin.
+   * @param origin The origin of the URL that was requested.
+   * @param spec The spec to remember.
+   */
+  rememberSpec(origin: string, spec: HttpMessageSignaturesSpec): void | Promise<void>;
+} //#endregion
+
+/**
+ * The options for double-knock requests.
+ * @since 1.6.0
+ */
+export { HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, SignRequestOptions, VerifyRequestOptions, signRequest as signRequest$1, verifyRequest as verifyRequest$1 };