@fedify/fedify 2.0.0-pr.412.1559 → 2.0.0-pr.412.1794

package/dist/{runtime/authdocloader.test.js → utils/docloader.test.js}

@@ -3,25 +3,24 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { UrlError } from "../type-SK-d7Tbw.js";
+import "../lookup-DQRtjvb1.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
-import "../lookup-Bn_HEC_d.js";
-import "../actor-Cc6B76eG.js";
-import "../key-CzLv1phF.js";
-import { verifyRequest } from "../http-CcdM1brU.js";
-import { getAuthenticatedDocumentLoader } from "../authdocloader-CLgDGafZ.js";
-import { mockDocumentLoader, test } from "../testing-Z2omCvKy.js";
-import "../std__assert-X-_kMxKM.js";
-import { assertRejects } from "../assert_rejects-DiIiJbZn.js";
-import "../assert_is_error-BPGph1Jx.js";
-import "../assert_not_equals-f3m3epl3.js";
-import "../assert_throws-BOO88avQ.js";
-import { rsaPrivateKey2 } from "../keys-zZwiKkfx.js";
-import { esm_default } from "../esm-CHdxdkuH.js";
+import "../actor-BXHc5r-q.js";
+import "../key-CxdLUFS6.js";
+import { verifyRequest } from "../http-D2kIm9la.js";
+import { getAuthenticatedDocumentLoader } from "../docloader-CrbAy9Oc.js";
+import { mockDocumentLoader, test } from "../testing-g4UC4liW.js";
+import "../std__assert-DWivtrGR.js";
+import { assertRejects } from "../assert_rejects-Ce45JcFg.js";
+import "../assert_throws-BNXdRGWP.js";
+import "../assert_not_equals-C80BG-_5.js";
+import { rsaPrivateKey2 } from "../keys-DMHs8XNn.js";
+import { esm_default } from "../esm-C-Qa1zEM.js";
+import { UrlError } from "@fedify/vocab-runtime";
 
-//#region src/runtime/authdocloader.test.ts
+//#region src/utils/docloader.test.ts
 test("getAuthenticatedDocumentLoader()", async (t) => {
 	esm_default.spyGlobal();
 	esm_default.get("begin:https://example.com/object", async (cl) => {

package/dist/utils/kv-cache.test.js

@@ -0,0 +1,209 @@
+
+      import { Temporal } from "@js-temporal/polyfill";
+      import { URLPattern } from "urlpattern-polyfill";
+      globalThis.addEventListener = () => {};
+    
+import "../lookup-DQRtjvb1.js";
+import { MockKvStore, kvCache } from "../kv-cache-DN9pfMBe.js";
+import { mockDocumentLoader, test } from "../testing-g4UC4liW.js";
+import { preloadedContexts } from "@fedify/vocab-runtime";
+import { deepStrictEqual, throws } from "node:assert";
+
+//#region src/utils/kv-cache.test.ts
+test("kvCache()", async (t) => {
+	const kv = new MockKvStore();
+	await t.step("cached", async () => {
+		const loader = kvCache({
+			kv,
+			loader: mockDocumentLoader,
+			rules: [
+				["https://example.org/", Temporal.Duration.from({ days: 1 })],
+				[new URL("https://example.net/"), Temporal.Duration.from({ days: 1 })],
+				[new URLPattern("https://example.com/*"), Temporal.Duration.from({ days: 30 })]
+			],
+			prefix: ["_test", "cached"]
+		});
+		const result = await loader("https://example.com/object");
+		deepStrictEqual(result, {
+			contextUrl: null,
+			documentUrl: "https://example.com/object",
+			document: {
+				"@context": "https://www.w3.org/ns/activitystreams",
+				id: "https://example.com/object",
+				name: "Fetched object",
+				type: "Object"
+			}
+		});
+		const cache = await kv.get([
+			"_test",
+			"cached",
+			"https://example.com/object"
+		]);
+		deepStrictEqual(cache, result);
+		await kv.set([
+			"_test",
+			"cached",
+			"https://example.org/"
+		], {
+			contextUrl: null,
+			documentUrl: "https://example.org/",
+			document: { "id": "https://example.org/" }
+		});
+		const result2 = await loader("https://example.org/");
+		deepStrictEqual(result2, {
+			contextUrl: null,
+			documentUrl: "https://example.org/",
+			document: { "id": "https://example.org/" }
+		});
+		await kv.set([
+			"_test",
+			"cached",
+			"https://example.net/"
+		], {
+			contextUrl: null,
+			documentUrl: "https://example.net/",
+			document: { "id": "https://example.net/" }
+		});
+		const result3 = await loader("https://example.net/");
+		deepStrictEqual(result3, {
+			contextUrl: null,
+			documentUrl: "https://example.net/",
+			document: { "id": "https://example.net/" }
+		});
+	});
+	await t.step("not cached", async () => {
+		const loader = kvCache({
+			kv,
+			loader: mockDocumentLoader,
+			rules: [],
+			prefix: ["_test", "not cached"]
+		});
+		const result = await loader("https://example.com/object");
+		deepStrictEqual(result, {
+			contextUrl: null,
+			documentUrl: "https://example.com/object",
+			document: {
+				"@context": "https://www.w3.org/ns/activitystreams",
+				id: "https://example.com/object",
+				name: "Fetched object",
+				type: "Object"
+			}
+		});
+		const cache = await kv.get([
+			"test2",
+			"not cached",
+			"https://example.com/object"
+		]);
+		deepStrictEqual(cache, void 0);
+	});
+	await t.step("maximum cache duration", () => {
+		throws(() => kvCache({
+			kv,
+			loader: mockDocumentLoader,
+			rules: [["https://example.com/", Temporal.Duration.from({
+				days: 30,
+				seconds: 1
+			})]]
+		}), TypeError, "The maximum cache duration is 30 days");
+		throws(() => kvCache({
+			kv,
+			loader: mockDocumentLoader,
+			rules: [[new URLPattern("https://example.com/*"), Temporal.Duration.from({
+				days: 30,
+				seconds: 1
+			})]]
+		}), TypeError, "The maximum cache duration is 30 days");
+	});
+	await t.step("on kv store exception", async () => {
+		class KvStoreThrowsException {
+			get(_key) {
+				throw new Error("Failed to get key");
+			}
+			set(_key, _value, _options) {
+				throw new Error("Failed to set key");
+			}
+			delete(_key) {
+				throw new Error("Failed to delete key");
+			}
+		}
+		const loader = kvCache({
+			kv: new KvStoreThrowsException(),
+			loader: mockDocumentLoader,
+			rules: [
+				["https://example.org/", Temporal.Duration.from({ days: 1 })],
+				[new URL("https://example.net/"), Temporal.Duration.from({ days: 1 })],
+				[new URLPattern("https://example.com/*"), Temporal.Duration.from({ days: 30 })]
+			],
+			prefix: ["_test", "not cached"]
+		});
+		const result = await loader("https://example.com/object");
+		deepStrictEqual(result, {
+			contextUrl: null,
+			documentUrl: "https://example.com/object",
+			document: {
+				"@context": "https://www.w3.org/ns/activitystreams",
+				id: "https://example.com/object",
+				name: "Fetched object",
+				type: "Object"
+			}
+		});
+	});
+	await t.step("preloaded contexts bypass cache", async () => {
+		const kv$1 = new MockKvStore();
+		let loaderCalled = false;
+		const mockLoader = (url) => {
+			loaderCalled = true;
+			return Promise.resolve({
+				contextUrl: null,
+				documentUrl: url,
+				document: { "mock": "document" }
+			});
+		};
+		const loader = kvCache({
+			kv: kv$1,
+			loader: mockLoader,
+			prefix: ["_test", "preloaded"]
+		});
+		const activityStreamsUrl = "https://www.w3.org/ns/activitystreams";
+		loaderCalled = false;
+		const result = await loader(activityStreamsUrl);
+		deepStrictEqual(result, {
+			contextUrl: null,
+			documentUrl: activityStreamsUrl,
+			document: preloadedContexts[activityStreamsUrl]
+		});
+		deepStrictEqual(loaderCalled, false, "Loader should not be called for preloaded contexts");
+		const cachedValue = await kv$1.get([
+			"_test",
+			"preloaded",
+			activityStreamsUrl
+		]);
+		deepStrictEqual(cachedValue, void 0, "Preloaded contexts should not be cached in KV store");
+		const securityUrl = "https://w3id.org/security/v1";
+		loaderCalled = false;
+		const result2 = await loader(securityUrl);
+		deepStrictEqual(result2, {
+			contextUrl: null,
+			documentUrl: securityUrl,
+			document: preloadedContexts[securityUrl]
+		});
+		deepStrictEqual(loaderCalled, false, "Loader should not be called for preloaded contexts");
+		const nonPreloadedUrl = "https://example.com/not-preloaded";
+		loaderCalled = false;
+		const result3 = await loader(nonPreloadedUrl);
+		deepStrictEqual(result3, {
+			contextUrl: null,
+			documentUrl: nonPreloadedUrl,
+			document: { "mock": "document" }
+		});
+		deepStrictEqual(loaderCalled, true, "Loader should be called for non-preloaded URLs");
+		const cachedValue2 = await kv$1.get([
+			"_test",
+			"preloaded",
+			nonPreloadedUrl
+		]);
+		deepStrictEqual(cachedValue2, result3, "Non-preloaded URLs should be cached");
+	});
+});
+
+//#endregion

package/dist/utils/mod.cjs

@@ -0,0 +1,12 @@
+
+          const { Temporal } = require("@js-temporal/polyfill");
+          const { URLPattern } = require("urlpattern-polyfill");
+        
+require('../lookup-CfFkONZD.cjs');
+require('../actor-Ba9Z1eNJ.cjs');
+require('../http-Dofes42e.cjs');
+const require_kv_cache = require('../kv-cache-Dkvbn6rg.cjs');
+require('../utils-DyRU1gdZ.cjs');
+
+exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
+exports.kvCache = require_kv_cache.kvCache;

package/dist/utils/mod.d.cts

@@ -0,0 +1,5 @@
+import "../vocab-CeDBzu-f.cjs";
+import "../http-M8k5mKc0.cjs";
+import "../kv-Bxr0Q87_.cjs";
+import { getAuthenticatedDocumentLoader, kvCache } from "../mod-0noXw66R.cjs";
+export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.d.ts

@@ -0,0 +1,7 @@
+import { Temporal } from "@js-temporal/polyfill";
+import { URLPattern } from "urlpattern-polyfill";
+import "../vocab-BCWe1Ih5.js";
+import "../http-BbO0ejuk.js";
+import "../kv-BKNZ-Tb-.js";
+import { getAuthenticatedDocumentLoader, kvCache } from "../mod-B9M-8jm2.js";
+export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.js

@@ -0,0 +1,11 @@
+
+          import { Temporal } from "@js-temporal/polyfill";
+          import { URLPattern } from "urlpattern-polyfill";
+        
+import "../lookup-CHkCVZTU.js";
+import "../actor-DzhunPC_.js";
+import "../http-CUVx-vzb.js";
+import { getAuthenticatedDocumentLoader, kvCache } from "../kv-cache-CGXcDejL.js";
+import "../utils-D-Va7aXC.js";
+
+export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils-D-Va7aXC.js

@@ -0,0 +1,4 @@
+
+          import { Temporal } from "@js-temporal/polyfill";
+          import { URLPattern } from "urlpattern-polyfill";
+        

package/dist/utils-DyRU1gdZ.cjs

@@ -0,0 +1,4 @@
+
+          const { Temporal } = require("@js-temporal/polyfill");
+          const { URLPattern } = require("urlpattern-polyfill");
+        

package/dist/vocab/actor.test.js

@@ -3,19 +3,17 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { Application, Group, Organization, Person, Service, __export } from "../type-SK-d7Tbw.js";
+import { Application, Group, Organization, Person, Service, __export } from "../lookup-DQRtjvb1.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import { assert } from "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
-import "../lookup-Bn_HEC_d.js";
-import { getActorClassByTypeName, getActorHandle, getActorTypeName, isActor, normalizeActorHandle } from "../actor-Cc6B76eG.js";
-import { test } from "../testing-Z2omCvKy.js";
-import { assertStrictEquals } from "../std__assert-X-_kMxKM.js";
-import { assertFalse, assertRejects } from "../assert_rejects-DiIiJbZn.js";
-import "../assert_is_error-BPGph1Jx.js";
-import "../assert_not_equals-f3m3epl3.js";
-import { assertThrows } from "../assert_throws-BOO88avQ.js";
-import { esm_default } from "../esm-CHdxdkuH.js";
+import { getActorClassByTypeName, getActorHandle, getActorTypeName, isActor, normalizeActorHandle } from "../actor-BXHc5r-q.js";
+import { test } from "../testing-g4UC4liW.js";
+import { assertStrictEquals } from "../std__assert-DWivtrGR.js";
+import { assertFalse, assertRejects } from "../assert_rejects-Ce45JcFg.js";
+import { assertThrows } from "../assert_throws-BNXdRGWP.js";
+import "../assert_not_equals-C80BG-_5.js";
+import { esm_default } from "../esm-C-Qa1zEM.js";
 
 //#region ../../node_modules/.pnpm/fast-check@3.23.2/node_modules/fast-check/lib/esm/check/precondition/PreconditionFailure.js
 var PreconditionFailure = class PreconditionFailure extends Error {

package/dist/vocab/lookup.test.js

@@ -3,18 +3,16 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { Collection, Note, Object as Object$1, Person } from "../type-SK-d7Tbw.js";
+import { Collection, Note, Object as Object$1, Person, lookupObject, traverseCollection } from "../lookup-DQRtjvb1.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import { assertInstanceOf } from "../assert_instance_of-DHz7EHNU.js";
-import { lookupObject, traverseCollection } from "../lookup-Bn_HEC_d.js";
-import { mockDocumentLoader, test } from "../testing-Z2omCvKy.js";
-import "../std__assert-X-_kMxKM.js";
-import "../assert_rejects-DiIiJbZn.js";
-import "../assert_is_error-BPGph1Jx.js";
-import "../assert_not_equals-f3m3epl3.js";
-import "../assert_throws-BOO88avQ.js";
-import { esm_default } from "../esm-CHdxdkuH.js";
+import { mockDocumentLoader, test } from "../testing-g4UC4liW.js";
+import "../std__assert-DWivtrGR.js";
+import { assertRejects } from "../assert_rejects-Ce45JcFg.js";
+import "../assert_throws-BNXdRGWP.js";
+import "../assert_not_equals-C80BG-_5.js";
+import { esm_default } from "../esm-C-Qa1zEM.js";
 
 //#region src/vocab/lookup.test.ts
 test("lookupObject()", {
@@ -202,5 +200,255 @@ test("traverseCollection()", {
 		new Note({ content: "This is a third simple note" })
 	]);
 });
+test("FEP-fe34: lookupObject() cross-origin security", {
+	sanitizeResources: false,
+	sanitizeOps: false
+}, async (t) => {
+	await t.step("crossOrigin: ignore (default) - returns null for cross-origin objects", async () => {
+		const crossOriginDocumentLoader = async (url) => {
+			if (url === "https://example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "https://malicious.com/fake-note",
+					content: "This is a spoofed note from a different origin"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://example.com/note", {
+			documentLoader: crossOriginDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertEquals(result, null);
+	});
+	await t.step("crossOrigin: throw - throws error for cross-origin objects", async () => {
+		const crossOriginDocumentLoader = async (url) => {
+			if (url === "https://example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "https://malicious.com/fake-note",
+					content: "This is a spoofed note from a different origin"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		await assertRejects(() => lookupObject("https://example.com/note", {
+			documentLoader: crossOriginDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "throw"
+		}), Error, "The object's @id (https://malicious.com/fake-note) has a different origin than the document URL (https://example.com/note)");
+	});
+	await t.step("crossOrigin: trust - allows cross-origin objects", async () => {
+		const crossOriginDocumentLoader = async (url) => {
+			if (url === "https://example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "https://malicious.com/fake-note",
+					content: "This is a spoofed note from a different origin"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://example.com/note", {
+			documentLoader: crossOriginDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "trust"
+		});
+		assertInstanceOf(result, Note);
+		assertEquals(result.id, new URL("https://malicious.com/fake-note"));
+		assertEquals(result.content, "This is a spoofed note from a different origin");
+	});
+	await t.step("same-origin objects are always trusted", async () => {
+		const sameOriginDocumentLoader = async (url) => {
+			if (url === "https://example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "https://example.com/note",
+					content: "This is a legitimate note from the same origin"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://example.com/note", {
+			documentLoader: sameOriginDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertInstanceOf(result, Note);
+		assertEquals(result.id, new URL("https://example.com/note"));
+		assertEquals(result.content, "This is a legitimate note from the same origin");
+	});
+	await t.step("objects without @id are trusted", async () => {
+		const noIdDocumentLoader = async (url) => {
+			if (url === "https://example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					content: "This is a note without an ID"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://example.com/note", {
+			documentLoader: noIdDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertInstanceOf(result, Note);
+		assertEquals(result.id, null);
+		assertEquals(result.content, "This is a note without an ID");
+	});
+	await t.step("WebFinger lookup with cross-origin actor URL", async () => {
+		esm_default.spyGlobal();
+		esm_default.get("begin:https://example.com/.well-known/webfinger", {
+			subject: "acct:user@example.com",
+			links: [{
+				rel: "self",
+				href: "https://different-origin.com/actor",
+				type: "application/activity+json"
+			}]
+		});
+		const webfingerDocumentLoader = async (url) => {
+			if (url === "https://different-origin.com/actor") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Person",
+					id: "https://malicious.com/fake-actor",
+					name: "Fake Actor"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result1 = await lookupObject("@user@example.com", {
+			documentLoader: webfingerDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertEquals(result1, null);
+		await assertRejects(() => lookupObject("@user@example.com", {
+			documentLoader: webfingerDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "throw"
+		}), Error, "The object's @id (https://malicious.com/fake-actor) has a different origin than the document URL (https://different-origin.com/actor)");
+		const result2 = await lookupObject("@user@example.com", {
+			documentLoader: webfingerDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "trust"
+		});
+		assertInstanceOf(result2, Person);
+		assertEquals(result2.id, new URL("https://malicious.com/fake-actor"));
+		esm_default.removeRoutes();
+		esm_default.hardReset();
+	});
+	await t.step("subdomain same-origin check", async () => {
+		const subdomainDocumentLoader = async (url) => {
+			if (url === "https://api.example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "https://www.example.com/note",
+					content: "Cross-subdomain note"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://api.example.com/note", {
+			documentLoader: subdomainDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertEquals(result, null);
+	});
+	await t.step("different port same-origin check", async () => {
+		const differentPortDocumentLoader = async (url) => {
+			if (url === "https://example.com:8080/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "https://example.com:9090/note",
+					content: "Cross-port note"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://example.com:8080/note", {
+			documentLoader: differentPortDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertEquals(result, null);
+	});
+	await t.step("protocol difference same-origin check", async () => {
+		const differentProtocolDocumentLoader = async (url) => {
+			if (url === "https://example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "http://example.com/note",
+					content: "Cross-protocol note"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://example.com/note", {
+			documentLoader: differentProtocolDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertEquals(result, null);
+	});
+	await t.step("error handling with crossOrigin throw option", async () => {
+		const errorDocumentLoader = async (_url) => {
+			throw new Error("Network error");
+		};
+		const result = await lookupObject("https://example.com/note", {
+			documentLoader: errorDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "throw"
+		});
+		assertEquals(result, null);
+	});
+	await t.step("malformed JSON handling with cross-origin policy", async () => {
+		const malformedJsonDocumentLoader = async (url) => {
+			if (url === "https://example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: "invalid json"
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		assertEquals(await lookupObject("https://example.com/note", {
+			documentLoader: malformedJsonDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "ignore"
+		}), null);
+		assertEquals(await lookupObject("https://example.com/note", {
+			documentLoader: malformedJsonDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "throw"
+		}), null);
+		assertEquals(await lookupObject("https://example.com/note", {
+			documentLoader: malformedJsonDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "trust"
+		}), null);
+	});
+});
 
 //#endregion