@fedify/fedify 1.6.0-dev.814 → 1.6.0

package/esm/sig/key.js

@@ -1,253 +0,0 @@
-import * as dntShim from "../_dnt.shims.js";
-import { getLogger } from "@logtape/logtape";
-import { SpanKind, SpanStatusCode, trace, } from "@opentelemetry/api";
-import metadata from "../deno.js";
-import { getDocumentLoader, } from "../runtime/docloader.js";
-import { isActor } from "../vocab/actor.js";
-import { CryptographicKey, Object } from "../vocab/vocab.js";
-/**
- * Checks if the given key is valid and supported.  No-op if the key is valid,
- * otherwise throws an error.
- * @param key The key to check.
- * @param type Which type of key to check.  If not specified, the key can be
- *             either public or private.
- * @throws {TypeError} If the key is invalid or unsupported.
- */
-export function validateCryptoKey(key, type) {
-    if (type != null && key.type !== type) {
-        throw new TypeError(`The key is not a ${type} key.`);
-    }
-    if (!key.extractable) {
-        throw new TypeError("The key is not extractable.");
-    }
-    if (key.algorithm.name !== "RSASSA-PKCS1-v1_5" &&
-        key.algorithm.name !== "Ed25519") {
-        throw new TypeError("Currently only RSASSA-PKCS1-v1_5 and Ed25519 keys are supported.  " +
-            "More algorithms will be added in the future!");
-    }
-    if (key.algorithm.name === "RSASSA-PKCS1-v1_5") {
-        // @ts-ignore TS2304
-        const algorithm = key.algorithm;
-        if (algorithm.hash.name !== "SHA-256") {
-            throw new TypeError("For compatibility with the existing Fediverse software " +
-                "(e.g., Mastodon), hash algorithm for RSASSA-PKCS1-v1_5 keys " +
-                "must be SHA-256.");
-        }
-    }
-}
-/**
- * Generates a key pair which is appropriate for Fedify.
- * @param algorithm The algorithm to use.  Currently only RSASSA-PKCS1-v1_5 and
- *                  Ed25519 are supported.
- * @returns The generated key pair.
- * @throws {TypeError} If the algorithm is unsupported.
- */
-export function generateCryptoKeyPair(algorithm) {
-    if (algorithm == null) {
-        getLogger(["fedify", "sig", "key"]).warn("No algorithm specified.  Using RSASSA-PKCS1-v1_5 by default, but " +
-            "it is recommended to specify the algorithm explicitly as " +
-            "the parameter will be required in the future.");
-    }
-    if (algorithm == null || algorithm === "RSASSA-PKCS1-v1_5") {
-        return dntShim.crypto.subtle.generateKey({
-            name: "RSASSA-PKCS1-v1_5",
-            modulusLength: 4096,
-            publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
-            hash: "SHA-256",
-        }, true, ["sign", "verify"]);
-    }
-    else if (algorithm === "Ed25519") {
-        return dntShim.crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
-    }
-    throw new TypeError("Unsupported algorithm: " + algorithm);
-}
-/**
- * Exports a key in JWK format.
- * @param key The key to export.  Either public or private key.
- * @returns The exported key in JWK format.  The key is suitable for
- *          serialization and storage.
- * @throws {TypeError} If the key is invalid or unsupported.
- */
-export async function exportJwk(key) {
-    validateCryptoKey(key);
-    const jwk = await dntShim.crypto.subtle.exportKey("jwk", key);
-    if (jwk.crv === "Ed25519")
-        jwk.alg = "Ed25519";
-    return jwk;
-}
-/**
- * Imports a key from JWK format.
- * @param jwk The key in JWK format.
- * @param type Which type of key to import, either `"public"` or `"private"`.
- * @returns The imported key.
- * @throws {TypeError} If the key is invalid or unsupported.
- */
-export async function importJwk(jwk, type) {
-    let key;
-    if (jwk.kty === "RSA" && jwk.alg === "RS256") {
-        key = await dntShim.crypto.subtle.importKey("jwk", jwk, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, true, type === "public" ? ["verify"] : ["sign"]);
-    }
-    else if (jwk.kty === "OKP" && jwk.crv === "Ed25519") {
-        key = await dntShim.crypto.subtle.importKey("jwk", jwk, "Ed25519", true, type === "public" ? ["verify"] : ["sign"]);
-    }
-    else {
-        throw new TypeError("Unsupported JWK format.");
-    }
-    validateCryptoKey(key, type);
-    return key;
-}
-/**
- * Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL.
- * If the given URL contains an {@link Actor} object, it tries to find
- * the corresponding key in the `publicKey` or `assertionMethod` property.
- * @typeParam T The type of the key to fetch.  Either {@link CryptographicKey}
- *              or {@link Multikey}.
- * @param keyId The URL of the key.
- * @param cls The class of the key to fetch.  Either {@link CryptographicKey}
- *            or {@link Multikey}.
- * @param options Options for fetching the key.  See {@link FetchKeyOptions}.
- * @returns The fetched key or `null` if the key is not found.
- * @since 1.3.0
- */
-export function fetchKey(keyId, 
-// deno-lint-ignore no-explicit-any
-cls, options = {}) {
-    const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-    const tracer = tracerProvider.getTracer(metadata.name, metadata.version);
-    keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
-    return tracer.startActiveSpan("activitypub.fetch_key", {
-        kind: SpanKind.CLIENT,
-        attributes: {
-            "http.method": "GET",
-            "url.full": keyId.href,
-            "url.scheme": keyId.protocol.replace(/:$/, ""),
-            "url.domain": keyId.hostname,
-            "url.path": keyId.pathname,
-            "url.query": keyId.search.replace(/^\?/, ""),
-            "url.fragment": keyId.hash.replace(/^#/, ""),
-        },
-    }, async (span) => {
-        try {
-            const result = await fetchKeyInternal(keyId, cls, options);
-            span.setAttribute("activitypub.actor.key.cached", result.cached);
-            return result;
-        }
-        catch (e) {
-            span.setStatus({ code: SpanStatusCode.ERROR, message: String(e) });
-            throw e;
-        }
-        finally {
-            span.end();
-        }
-    });
-}
-async function fetchKeyInternal(keyId, 
-// deno-lint-ignore no-explicit-any
-cls, { documentLoader, contextLoader, keyCache, tracerProvider } = {}) {
-    const logger = getLogger(["fedify", "sig", "key"]);
-    const cacheKey = typeof keyId === "string" ? new URL(keyId) : keyId;
-    keyId = typeof keyId === "string" ? keyId : keyId.href;
-    if (keyCache != null) {
-        const cachedKey = await keyCache.get(cacheKey);
-        if (cachedKey instanceof cls && cachedKey.publicKey != null) {
-            logger.debug("Key {keyId} found in cache.", { keyId });
-            return {
-                key: cachedKey,
-                cached: true,
-            };
-        }
-        else if (cachedKey === null) {
-            logger.debug("Entry {keyId} found in cache, but it is unavailable.", { keyId });
-            return { key: null, cached: true };
-        }
-    }
-    logger.debug("Fetching key {keyId} to verify signature...", { keyId });
-    let document;
-    try {
-        const remoteDocument = await (documentLoader ?? getDocumentLoader())(keyId);
-        document = remoteDocument.document;
-    }
-    catch (_) {
-        logger.debug("Failed to fetch key {keyId}.", { keyId });
-        await keyCache?.set(cacheKey, null);
-        return { key: null, cached: false };
-    }
-    let object;
-    try {
-        object = await Object.fromJsonLd(document, {
-            documentLoader,
-            contextLoader,
-            tracerProvider,
-        });
-    }
-    catch (e) {
-        if (!(e instanceof TypeError))
-            throw e;
-        try {
-            object = await cls.fromJsonLd(document, {
-                documentLoader,
-                contextLoader,
-                tracerProvider,
-            });
-        }
-        catch (e) {
-            if (e instanceof TypeError) {
-                logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
-                await keyCache?.set(cacheKey, null);
-                return { key: null, cached: false };
-            }
-            throw e;
-        }
-    }
-    let key = null;
-    if (object instanceof cls)
-        key = object;
-    else if (isActor(object)) {
-        // @ts-ignore: cls is either CryptographicKey or Multikey
-        const keys = cls === CryptographicKey
-            ? object.getPublicKeys({ documentLoader, contextLoader, tracerProvider })
-            : object.getAssertionMethods({
-                documentLoader,
-                contextLoader,
-                tracerProvider,
-            });
-        let length = 0;
-        let lastKey = null;
-        for await (const k of keys) {
-            length++;
-            lastKey = k;
-            if (k.id?.href === keyId) {
-                key = k;
-                break;
-            }
-        }
-        const keyIdUrl = new URL(keyId);
-        if (key == null && keyIdUrl.hash === "" && length === 1) {
-            key = lastKey;
-        }
-        if (key == null) {
-            logger.debug("Failed to verify; object {keyId} returned an {actorType}, " +
-                "but has no key matching {keyId}.", { keyId, actorType: object.constructor.name });
-            await keyCache?.set(cacheKey, null);
-            return { key: null, cached: false };
-        }
-    }
-    else {
-        logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
-        await keyCache?.set(cacheKey, null);
-        return { key: null, cached: false };
-    }
-    if (key.publicKey == null) {
-        logger.debug("Failed to verify; key {keyId} has no publicKeyPem field.", { keyId });
-        await keyCache?.set(cacheKey, null);
-        return { key: null, cached: false };
-    }
-    if (keyCache != null) {
-        await keyCache.set(cacheKey, key);
-        logger.debug("Key {keyId} cached.", { keyId });
-    }
-    return {
-        key: key,
-        cached: false,
-    };
-}

package/esm/sig/ld.js

@@ -1,288 +0,0 @@
-import * as dntShim from "../_dnt.shims.js";
-import { getLogger } from "@logtape/logtape";
-import { SpanStatusCode, trace } from "@opentelemetry/api";
-import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
-import { encodeHex } from "byte-encodings/hex";
-// @ts-ignore TS7016
-import jsonld from "jsonld";
-import metadata from "../deno.js";
-import { getDocumentLoader, } from "../runtime/docloader.js";
-import { getTypeId } from "../vocab/type.js";
-import { Activity, CryptographicKey, Object } from "../vocab/vocab.js";
-import { fetchKey, validateCryptoKey } from "./key.js";
-const logger = getLogger(["fedify", "sig", "ld"]);
-/**
- * Attaches a LD signature to the given JSON-LD document.
- * @param jsonLd The JSON-LD document to attach the signature to.  It is not
- *               modified.
- * @param signature The signature to attach.
- * @returns The JSON-LD document with the attached signature.
- * @throws {TypeError} If the input document is not a valid JSON-LD document.
- * @since 1.0.0
- */
-export function attachSignature(jsonLd, signature) {
-    if (typeof jsonLd !== "object" || jsonLd == null) {
-        throw new TypeError("Failed to attach signature; invalid JSON-LD document.");
-    }
-    return { ...jsonLd, signature };
-}
-/**
- * Creates a LD signature for the given JSON-LD document.
- * @param jsonLd The JSON-LD document to sign.
- * @param privateKey The private key to sign the document.
- * @param keyId The ID of the public key that corresponds to the private key.
- * @param options Additional options for creating the signature.
- *                See also {@link CreateSignatureOptions}.
- * @return The created signature.
- * @throws {TypeError} If the private key is invalid or unsupported.
- * @since 1.0.0
- */
-export async function createSignature(jsonLd, privateKey, keyId, { contextLoader, created } = {}) {
-    validateCryptoKey(privateKey, "private");
-    if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") {
-        throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
-    }
-    const options = {
-        "@context": "https://w3id.org/identity/v1",
-        creator: keyId.href,
-        created: created?.toString() ?? new Date().toISOString(),
-    };
-    const optionsHash = await hashJsonLd(options, contextLoader);
-    const docHash = await hashJsonLd(jsonLd, contextLoader);
-    const message = optionsHash + docHash;
-    const encoder = new TextEncoder();
-    const messageBytes = encoder.encode(message);
-    const signature = await dntShim.crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, messageBytes);
-    return {
-        ...options,
-        type: "RsaSignature2017",
-        signatureValue: encodeBase64(signature),
-    };
-}
-/**
- * Signs the given JSON-LD document with the private key and returns the signed
- * JSON-LD document.
- * @param jsonLd The JSON-LD document to sign.
- * @param privateKey The private key to sign the document.
- * @param keyId The key ID to use in the signature.  It will be used by the
- *              verifier to fetch the corresponding public key.
- * @param options Additional options for signing the document.
- *                See also {@link SignJsonLdOptions}.
- * @returns The signed JSON-LD document.
- * @throws {TypeError} If the private key is invalid or unsupported.
- * @since 1.0.0
- */
-export async function signJsonLd(jsonLd, privateKey, keyId, options) {
-    const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-    const tracer = tracerProvider.getTracer(metadata.name, metadata.version);
-    return await tracer.startActiveSpan("ld_signatures.sign", {
-        attributes: { "ld_signatures.key_id": keyId.href },
-    }, async (span) => {
-        try {
-            const signature = await createSignature(jsonLd, privateKey, keyId, options);
-            if (span.isRecording()) {
-                span.setAttribute("ld_signatures.type", signature.type);
-                span.setAttribute("ld_signatures.signature", encodeHex(decodeBase64(signature.signatureValue)));
-            }
-            return attachSignature(jsonLd, signature);
-        }
-        catch (error) {
-            span.setStatus({
-                code: SpanStatusCode.ERROR,
-                message: String(error),
-            });
-            throw error;
-        }
-        finally {
-            span.end();
-        }
-    });
-}
-/**
- * Checks if the given JSON-LD document has a Linked Data Signature.
- * @param jsonLd The JSON-LD document to check.
- * @returns `true` if the document has a signature; `false` otherwise.
- * @since 1.0.0
- */
-export function hasSignature(jsonLd) {
-    if (typeof jsonLd !== "object" || jsonLd == null)
-        return false;
-    if ("signature" in jsonLd) {
-        const signature = jsonLd.signature;
-        if (typeof signature !== "object" || signature == null)
-            return false;
-        return "type" in signature && signature.type === "RsaSignature2017" &&
-            "creator" in signature && typeof signature.creator === "string" &&
-            "created" in signature && typeof signature.created === "string" &&
-            "signatureValue" in signature &&
-            typeof signature.signatureValue === "string";
-    }
-    return false;
-}
-/**
- * Detaches Linked Data Signatures from the given JSON-LD document.
- * @param jsonLd The JSON-LD document to modify.
- * @returns The modified JSON-LD document.  If the input document does not
- *          contain a signature, the original document is returned.
- * @since 1.0.0
- */
-export function detachSignature(jsonLd) {
-    if (typeof jsonLd !== "object" || jsonLd == null)
-        return jsonLd;
-    const doc = { ...jsonLd };
-    delete doc.signature;
-    return doc;
-}
-/**
- * Verifies Linked Data Signatures of the given JSON-LD document.
- * @param jsonLd The JSON-LD document to verify.
- * @param options Options for verifying the signature.
- * @returns The public key that signed the document or `null` if the signature
- *          is invalid or the key is not found.
- * @since 1.0.0
- */
-export async function verifySignature(jsonLd, options = {}) {
-    if (!hasSignature(jsonLd))
-        return null;
-    const sig = jsonLd.signature;
-    let signature;
-    try {
-        signature = decodeBase64(sig.signatureValue);
-    }
-    catch (error) {
-        logger.debug("Failed to verify; invalid base64 signatureValue: {signatureValue}", { ...sig, error });
-        return null;
-    }
-    const { key, cached } = await fetchKey(new URL(sig.creator), CryptographicKey, options);
-    if (key == null)
-        return null;
-    const sigOpts = {
-        ...sig,
-        "@context": "https://w3id.org/identity/v1",
-    };
-    delete sigOpts.type;
-    delete sigOpts.id;
-    delete sigOpts.signatureValue;
-    let sigOptsHash;
-    try {
-        sigOptsHash = await hashJsonLd(sigOpts, options.contextLoader);
-    }
-    catch (error) {
-        logger.warn("Failed to verify; failed to hash the signature options: {signatureOptions}\n{error}", { signatureOptions: sigOpts, error });
-        return null;
-    }
-    const document = { ...jsonLd };
-    delete document.signature;
-    let docHash;
-    try {
-        docHash = await hashJsonLd(document, options.contextLoader);
-    }
-    catch (error) {
-        logger.warn("Failed to verify; failed to hash the document: {document}\n{error}", { document, error });
-        return null;
-    }
-    const encoder = new TextEncoder();
-    const message = sigOptsHash + docHash;
-    const messageBytes = encoder.encode(message);
-    const verified = await dntShim.crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature, messageBytes);
-    if (verified)
-        return key;
-    if (cached) {
-        logger.debug("Failed to verify with the cached key {keyId}; " +
-            "signature {signatureValue} is invalid.  " +
-            "Retrying with the freshly fetched key...", { keyId: sig.creator, ...sig });
-        const { key } = await fetchKey(new URL(sig.creator), CryptographicKey, {
-            ...options,
-            keyCache: {
-                get: () => Promise.resolve(undefined),
-                set: async (keyId, key) => await options.keyCache?.set(keyId, key),
-            },
-        });
-        if (key == null)
-            return null;
-        const verified = await dntShim.crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature, messageBytes);
-        return verified ? key : null;
-    }
-    logger.debug("Failed to verify with the fetched key {keyId}; " +
-        "signature {signatureValue} is invalid.  " +
-        "Check if the key is correct or if the signed message is correct.  " +
-        "The message to sign is:\n{message}", { keyId: sig.creator, ...sig, message });
-    return null;
-}
-/**
- * Verify the authenticity of the given JSON-LD document using Linked Data
- * Signatures.  If the document is signed, this function verifies the signature
- * and checks if the document is attributed to the owner of the public key.
- * If the document is not signed, this function returns `false`.
- * @param jsonLd The JSON-LD document to verify.
- * @param options Options for verifying the document.
- * @returns `true` if the document is authentic; `false` otherwise.
- */
-export async function verifyJsonLd(jsonLd, options = {}) {
-    const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-    const tracer = tracerProvider.getTracer(metadata.name, metadata.version);
-    return await tracer.startActiveSpan("ld_signatures.verify", async (span) => {
-        try {
-            const object = await Object.fromJsonLd(jsonLd, options);
-            if (object.id != null) {
-                span.setAttribute("activitypub.object.id", object.id.href);
-            }
-            span.setAttribute("activitypub.object.type", getTypeId(object).href);
-            if (typeof jsonLd === "object" && jsonLd != null &&
-                "signature" in jsonLd && typeof jsonLd.signature === "object" &&
-                jsonLd.signature != null) {
-                if ("creator" in jsonLd.signature &&
-                    typeof jsonLd.signature.creator === "string") {
-                    span.setAttribute("ld_signatures.key_id", jsonLd.signature.creator);
-                }
-                if ("signatureValue" in jsonLd.signature &&
-                    typeof jsonLd.signature.signatureValue === "string") {
-                    span.setAttribute("ld_signatures.signature", jsonLd.signature.signatureValue);
-                }
-                if ("type" in jsonLd.signature &&
-                    typeof jsonLd.signature.type === "string") {
-                    span.setAttribute("ld_signatures.type", jsonLd.signature.type);
-                }
-            }
-            const attributions = new Set(object.attributionIds.map((uri) => uri.href));
-            if (object instanceof Activity) {
-                for (const uri of object.actorIds)
-                    attributions.add(uri.href);
-            }
-            const key = await verifySignature(jsonLd, options);
-            if (key == null)
-                return false;
-            if (key.ownerId == null) {
-                logger.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
-                return false;
-            }
-            attributions.delete(key.ownerId.href);
-            if (attributions.size > 0) {
-                logger.debug("Some attributions are not authenticated by the Linked Data " +
-                    "Signatures: {attributions}.", { attributions: [...attributions] });
-                return false;
-            }
-            return true;
-        }
-        catch (error) {
-            span.setStatus({
-                code: SpanStatusCode.ERROR,
-                message: String(error),
-            });
-            throw error;
-        }
-        finally {
-            span.end();
-        }
-    });
-}
-async function hashJsonLd(jsonLd, contextLoader) {
-    const canon = await jsonld.canonize(jsonLd, {
-        format: "application/n-quads",
-        documentLoader: contextLoader ?? getDocumentLoader(),
-    });
-    const encoder = new TextEncoder();
-    const hash = await dntShim.crypto.subtle.digest("SHA-256", encoder.encode(canon));
-    return encodeHex(hash);
-}
-// cSpell: ignore URGNA2012

package/esm/sig/mod.js

@@ -1,11 +0,0 @@
-/**
- * HTTP Signatures implementation.
- *
- * @module
- */
-import "../_dnt.polyfills.js";
-export { signRequest, verifyRequest, } from "./http.js";
-export { exportJwk, fetchKey, generateCryptoKeyPair, importJwk, } from "./key.js";
-export { attachSignature, createSignature, detachSignature, signJsonLd, verifyJsonLd, verifySignature, } from "./ld.js";
-export { doesActorOwnKey, getKeyOwner, } from "./owner.js";
-export * from "./proof.js";

package/esm/sig/owner.js

@@ -1,103 +0,0 @@
-import { trace } from "@opentelemetry/api";
-import { getDocumentLoader, } from "../runtime/docloader.js";
-import { isActor } from "../vocab/actor.js";
-import { CryptographicKey, Object as ASObject, } from "../vocab/vocab.js";
-export { exportJwk, generateCryptoKeyPair, importJwk } from "./key.js";
-/**
- * Checks if the actor of the given activity owns the specified key.
- * @param activity The activity to check.
- * @param key The public key to check.
- * @param options Options for checking the key ownership.
- * @returns Whether the actor is the owner of the key.
- */
-export async function doesActorOwnKey(activity, key, options) {
-    if (key.ownerId != null) {
-        return key.ownerId.href === activity.actorId?.href;
-    }
-    const actor = await activity.getActor(options);
-    if (actor == null || !isActor(actor))
-        return false;
-    for (const publicKeyId of actor.publicKeyIds) {
-        if (key.id != null && publicKeyId.href === key.id.href)
-            return true;
-    }
-    return false;
-}
-/**
- * Gets the actor that owns the specified key.  Returns `null` if the key has no
- * known owner.
- *
- * @param keyId The ID of the key to check, or the key itself.
- * @param options Options for getting the key owner.
- * @returns The actor that owns the key, or `null` if the key has no known
- *          owner.
- * @since 0.7.0
- */
-export async function getKeyOwner(keyId, options) {
-    const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-    const documentLoader = options.documentLoader ?? getDocumentLoader();
-    const contextLoader = options.contextLoader ?? getDocumentLoader();
-    let object;
-    if (keyId instanceof CryptographicKey) {
-        object = keyId;
-        if (object.id == null)
-            return null;
-        keyId = object.id;
-    }
-    else {
-        let keyDoc;
-        try {
-            const { document } = await documentLoader(keyId.href);
-            keyDoc = document;
-        }
-        catch (_) {
-            return null;
-        }
-        try {
-            object = await ASObject.fromJsonLd(keyDoc, {
-                documentLoader,
-                contextLoader,
-                tracerProvider,
-            });
-        }
-        catch (e) {
-            if (!(e instanceof TypeError))
-                throw e;
-            try {
-                object = await CryptographicKey.fromJsonLd(keyDoc, {
-                    documentLoader,
-                    contextLoader,
-                    tracerProvider,
-                });
-            }
-            catch (e) {
-                if (e instanceof TypeError)
-                    return null;
-                throw e;
-            }
-        }
-    }
-    let owner = null;
-    if (object instanceof CryptographicKey) {
-        if (object.ownerId == null)
-            return null;
-        owner = await object.getOwner({
-            documentLoader,
-            contextLoader,
-            tracerProvider,
-        });
-    }
-    else if (isActor(object)) {
-        owner = object;
-    }
-    else {
-        return null;
-    }
-    if (owner == null)
-        return null;
-    for (const kid of owner.publicKeyIds) {
-        if (kid.href === keyId.href)
-            return owner;
-    }
-    return null;
-}