@fedify/fedify 2.0.0-dev.1485 → 2.0.0-dev.149

package/dist/{vocab-Bg1J3mu4.js → vocab-Aig1Fmi8.js}

@@ -1,12 +1,12 @@
 
-      import { Temporal } from "@js-temporal/polyfill";
-      import { URLPattern } from "urlpattern-polyfill";
-    
-import { deno_default, getDocumentLoader } from "./docloader-BlVueewg.js";
-import { Object as Object$1, getTypeId } from "./actor-DXTdNCfp.js";
-import { lookupWebFinger } from "./lookup-BHYMosdS.js";
+          import { Temporal } from "@js-temporal/polyfill";
+          import { URLPattern } from "urlpattern-polyfill";
+        
+import { deno_default, lookupWebFinger } from "./lookup-BV72lfsA.js";
+import { Object as Object$1, getTypeId } from "./actor-U_BZZ2ps.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
+import { getDocumentLoader } from "@fedify/vocab-runtime";
 import { delay } from "es-toolkit";
 
 //#region src/vocab/handle.ts
@@ -136,9 +136,14 @@ async function lookupObject(identifier, options = {}) {
 				if (result.id != null) span.setAttribute("activitypub.object.id", result.id.href);
 				span.setAttribute("activitypub.object.type", getTypeId(result).href);
 				if (result.replyTargetIds.length > 0) span.setAttribute("activitypub.object.in_reply_to", result.replyTargetIds.map((id) => id.href));
+				span.addEvent("activitypub.object.fetched", {
+					"activitypub.object.type": getTypeId(result).href,
+					"activitypub.object.json": JSON.stringify(await result.toJsonLd(options))
+				});
 			}
 			return result;
 		} catch (error) {
+			span.recordException(error);
 			span.setStatus({
 				code: SpanStatusCode.ERROR,
 				message: String(error)
@@ -152,14 +157,13 @@ async function lookupObject(identifier, options = {}) {
 async function lookupObjectInternal(identifier, options = {}) {
 	const documentLoader = options.documentLoader ?? getDocumentLoader({ userAgent: options.userAgent });
 	if (typeof identifier === "string") identifier = toAcctUrl(identifier) ?? new URL(identifier);
-	let document = null;
+	let remoteDoc = null;
 	if (identifier.protocol === "http:" || identifier.protocol === "https:") try {
-		const remoteDoc = await documentLoader(identifier.href, { signal: options.signal });
-		document = remoteDoc.document;
+		remoteDoc = await documentLoader(identifier.href, { signal: options.signal });
 	} catch (error) {
 		logger.debug("Failed to fetch remote document:\n{error}", { error });
 	}
-	if (document == null) {
+	if (remoteDoc == null) {
 		const jrd = await lookupWebFinger(identifier, {
 			userAgent: options.userAgent,
 			tracerProvider: options.tracerProvider,
@@ -168,10 +172,9 @@ async function lookupObjectInternal(identifier, options = {}) {
 		});
 		if (jrd?.links == null) return null;
 		for (const l of jrd.links) {
-			if (l.type !== "application/activity+json" && !l.type?.match(/application\/ld\+json;\s*profile="https:\/\/www.w3.org\/ns\/activitystreams"/) || l.rel !== "self") continue;
+			if (l.type !== "application/activity+json" && !l.type?.match(/application\/ld\+json;\s*profile="https:\/\/www.w3.org\/ns\/activitystreams"/) || l.rel !== "self" || l.href == null) continue;
 			try {
-				const remoteDoc = await documentLoader(l.href, { signal: options.signal });
-				document = remoteDoc.document;
+				remoteDoc = await documentLoader(l.href, { signal: options.signal });
 				break;
 			} catch (error) {
 				logger.debug("Failed to fetch remote document:\n{error}", { error });
@@ -179,23 +182,34 @@ async function lookupObjectInternal(identifier, options = {}) {
 			}
 		}
 	}
-	if (document == null) return null;
+	if (remoteDoc == null) return null;
+	let object;
 	try {
-		return await Object$1.fromJsonLd(document, {
+		object = await Object$1.fromJsonLd(remoteDoc.document, {
 			documentLoader,
 			contextLoader: options.contextLoader,
-			tracerProvider: options.tracerProvider
+			tracerProvider: options.tracerProvider,
+			baseUrl: new URL(remoteDoc.documentUrl)
 		});
 	} catch (error) {
 		if (error instanceof TypeError) {
 			logger.debug("Failed to parse JSON-LD document: {error}\n{document}", {
-				error,
-				document
+				...remoteDoc,
+				error
 			});
 			return null;
 		}
 		throw error;
 	}
+	if (options.crossOrigin !== "trust" && object.id != null && object.id.origin !== new URL(remoteDoc.documentUrl).origin) {
+		if (options.crossOrigin === "throw") throw new Error(`The object's @id (${object.id.href}) has a different origin than the document URL (${remoteDoc.documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to "trust".`);
+		logger.warn("The object's @id ({objectId}) has a different origin than the document URL ({documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to \"trust\".", {
+			...remoteDoc,
+			objectId: object.id.href
+		});
+		return null;
+	}
+	return object;
 }
 /**
 * Traverses a collection, yielding each item in the collection.