@fedify/fedify 2.0.28-dev.1974 → 2.0.28-dev.1982

package/dist/federation/middleware.test.mjs

@@ -6,22 +6,21 @@ import { n as RouterError } from "../router-CrMLXoOr.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { n as assertStrictEquals } from "../std__assert-Duiq_YC9.mjs";
 import { n as assertFalse, t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
-import { t as assertInstanceOf } from "../assert_instance_of-C4Ri6VuN.mjs";
+import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
 import { t as assertNotEquals } from "../assert_not_equals--wG9hV7u.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { l as verifyRequest, s as signRequest } from "../http--P33qRwW.mjs";
-import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CtZLJq76.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-_hXTUC-b.mjs";
-import { a as compactJsonLd, f as signJsonLd, m as verifyJsonLd, s as detachSignature } from "../ld-CN2nacLy.mjs";
-import { t as doesActorOwnKey } from "../owner-CFgyZgkz.mjs";
-import { n as signObject, r as verifyObject } from "../proof-CpEH24hi.mjs";
-import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
-import { a as createFederation, i as KvSpecDeterminer, n as FederationImpl, r as InboxContextImpl, t as ContextImpl } from "../middleware-DpEJSmjy.mjs";
+import { l as verifyRequest, s as signRequest } from "../http-Bu3NxfGb.mjs";
+import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-BXUqhXNd.mjs";
+import { a as compactJsonLd, f as signJsonLd, m as verifyJsonLd, s as detachSignature } from "../ld-D0uFMLmq.mjs";
+import { t as doesActorOwnKey } from "../owner-Bzg6w7eA.mjs";
+import { n as signObject, r as verifyObject } from "../proof-CgLA51pO.mjs";
+import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
+import { a as createFederation, i as KvSpecDeterminer, n as FederationImpl, r as InboxContextImpl, t as ContextImpl } from "../middleware-BuVM1K-J.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import * as vocab from "@fedify/vocab";
 import { Create, Offer, Person, getTypeId, lookupObject } from "@fedify/vocab";
-import { getDocumentLoader } from "@fedify/vocab-runtime";
+import { UrlError, getDocumentLoader } from "@fedify/vocab-runtime";
 //#region ../fixture/src/fixtures/example.com/create.json
 var id$2 = "https://example.com/create";
 var create_default = {
@@ -2816,6 +2815,7 @@ test("FederationImpl.processQueuedTask() permanent failure", async (t) => {
 					return Promise.resolve();
 				}
 			},
+			allowPrivateAddress: true,
 			...options.permanentFailureStatusCodes ? { permanentFailureStatusCodes: options.permanentFailureStatusCodes } : {}
 		});
 		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox");
@@ -3667,5 +3667,93 @@ test("KvSpecDeterminer", async (t) => {
 		assertEquals(spec, "rfc9421");
 	});
 });
+test("ContextImpl.sendActivity() honors the private-address policy", async (t) => {
+	for (const allowPrivateAddress of [false, true]) await t.step(`allowPrivateAddress: ${allowPrivateAddress}`, async () => {
+		const inbox = "http://127.0.0.1/inbox";
+		esm_default.mockGlobal().post(inbox, 202);
+		try {
+			const ctx = createFederation({
+				kv: new MemoryKvStore(),
+				allowPrivateAddress
+			}).createContext(new URL("https://example.com/"));
+			const send = () => ctx.sendActivity({
+				privateKey: ed25519PrivateKey,
+				keyId: ed25519Multikey.id
+			}, new Person({
+				id: new URL("https://example.com/recipient"),
+				inbox: new URL(inbox)
+			}), new Create({
+				id: new URL("https://example.com/activity"),
+				actor: new URL("https://example.com/person")
+			}), { immediate: true });
+			if (allowPrivateAddress) {
+				await send();
+				assertEquals(esm_default.callHistory.calls(inbox).length, 1);
+			} else {
+				await assertRejects(send, UrlError);
+				assertEquals(esm_default.callHistory.calls(inbox).length, 0);
+			}
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+});
+test("Federation.fetch() bounds inbox bodies before dispatch", async () => {
+	let dispatched = false;
+	const json = JSON.stringify({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://example.com/activities/bounded",
+		type: "Create",
+		actor: "https://example.com/actor"
+	});
+	const size = 16 * 1024 * 1024;
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		skipSignatureVerification: true,
+		contextLoaderFactory: () => mockDocumentLoader
+	});
+	federation.setActorDispatcher("/actors/{identifier}", () => new Person({ id: new URL("https://example.com/actor") }));
+	federation.setInboxListeners("/actors/{identifier}/inbox", "/inbox").on(Create, () => {
+		dispatched = true;
+	});
+	for (const contentLength of [
+		void 0,
+		"1",
+		String(size + 1)
+	]) {
+		assertEquals((await federation.fetch(new Request("https://example.com/inbox", {
+			method: "POST",
+			headers: contentLength == null ? {} : { "Content-Length": contentLength },
+			body: json.padEnd(size + 1)
+		}), { contextData: void 0 })).status, 413);
+		assertFalse(dispatched);
+	}
+	let canceled = false;
+	let pulls = 0;
+	const body = new ReadableStream({
+		pull(controller) {
+			pulls++;
+			controller.enqueue(new Uint8Array(64 * 1024));
+		},
+		cancel() {
+			canceled = true;
+		}
+	}, { highWaterMark: 0 });
+	const request = new Request("https://example.com/inbox", {
+		method: "POST",
+		body,
+		duplex: "half"
+	});
+	assertEquals((await federation.fetch(request, { contextData: void 0 })).status, 413);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert(canceled);
+	assert(pulls <= 260);
+	assertFalse(dispatched);
+	assertEquals((await federation.fetch(new Request("https://example.com/inbox", {
+		method: "POST",
+		body: json
+	}), { contextData: void 0 })).status, 202);
+	assert(dispatched);
+});
 //#endregion
 export {};

package/dist/federation/mod.cjs

@@ -2,7 +2,7 @@ const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../chunk-DDcVe30Y.cjs");
-const require_middleware = require("../middleware-BXwn4gnl.cjs");
+const require_middleware = require("../middleware-D_7wZH27.cjs");
 let es_toolkit = require("es-toolkit");
 //#region src/federation/kv.ts
 /**

package/dist/federation/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $ as AuthorizePredicate, A as CreateExponentialBackoffPolicyOptions, B as RespondWithObjectOptions, C as InboxListenerSetters, D as FederationOrigin, E as FederationKvPrefixes, F as createFederationBuilder, G as MessageQueue, H as respondWithObjectIfAcceptable, I as Router, J as ParallelMessageQueue, K as MessageQueueEnqueueOptions, L as RouterError, M as RetryPolicy, N as createExponentialBackoffPolicy, O as FederationQueueOptions, P as Message, Q as ActorKeyPairsDispatcher, R as RouterOptions, S as IdempotencyStrategy, T as Rfc6570Expression, U as InProcessMessageQueue, V as respondWithObject, W as InProcessMessageQueueOptions, X as ActorDispatcher, Y as ActorAliasMapper, Z as ActorHandleMapper, _ as FederationBuilder, _t as PageItems, a as InboxContext, at as CustomCollectionDispatcher, b as FederationStartQueueOptions, c as RouteActivityOptions, ct as NodeInfoDispatcher, d as ActorCallbackSetters, dt as OutboxErrorHandler, et as CollectionCounter, f as CollectionCallbackSetters, ft as OutboxPermanentFailureHandler, g as Federation, gt as SenderKeyPair, h as Federatable, ht as SendActivityError, i as GetSignedKeyOptions, it as CustomCollectionCursor, j as RetryContext, k as createFederation, l as SendActivityOptions, lt as ObjectAuthorizePredicate, m as CustomCollectionCallbackSetters, mt as WebFingerLinksDispatcher, n as Context, nt as CollectionDispatcher, o as ParseUriResult, ot as InboxErrorHandler, p as ConstructorWithTypeId, pt as SharedInboxKeyDispatcher, q as MessageQueueListenOptions, r as ForwardActivityOptions, rt as CustomCollectionCounter, s as RequestContext, st as InboxListener, t as ActorKeyPair, tt as CollectionCursor, u as SendActivityOptionsForCollection, ut as ObjectDispatcher, v as FederationFetchOptions, vt as buildCollectionSynchronizationHeader, w as ObjectCallbackSetters, x as IdempotencyKeyCallback, y as FederationOptions, yt as digest, z as RouterRouteResult } from "../context-CJZHWLmz.cjs";
+import { $ as AuthorizePredicate, A as CreateExponentialBackoffPolicyOptions, B as RespondWithObjectOptions, C as InboxListenerSetters, D as FederationOrigin, E as FederationKvPrefixes, F as createFederationBuilder, G as MessageQueue, H as respondWithObjectIfAcceptable, I as Router, J as ParallelMessageQueue, K as MessageQueueEnqueueOptions, L as RouterError, M as RetryPolicy, N as createExponentialBackoffPolicy, O as FederationQueueOptions, P as Message, Q as ActorKeyPairsDispatcher, R as RouterOptions, S as IdempotencyStrategy, T as Rfc6570Expression, U as InProcessMessageQueue, V as respondWithObject, W as InProcessMessageQueueOptions, X as ActorDispatcher, Y as ActorAliasMapper, Z as ActorHandleMapper, _ as FederationBuilder, _t as PageItems, a as InboxContext, at as CustomCollectionDispatcher, b as FederationStartQueueOptions, c as RouteActivityOptions, ct as NodeInfoDispatcher, d as ActorCallbackSetters, dt as OutboxErrorHandler, et as CollectionCounter, f as CollectionCallbackSetters, ft as OutboxPermanentFailureHandler, g as Federation, gt as SenderKeyPair, h as Federatable, ht as SendActivityError, i as GetSignedKeyOptions, it as CustomCollectionCursor, j as RetryContext, k as createFederation, l as SendActivityOptions, lt as ObjectAuthorizePredicate, m as CustomCollectionCallbackSetters, mt as WebFingerLinksDispatcher, n as Context, nt as CollectionDispatcher, o as ParseUriResult, ot as InboxErrorHandler, p as ConstructorWithTypeId, pt as SharedInboxKeyDispatcher, q as MessageQueueListenOptions, r as ForwardActivityOptions, rt as CustomCollectionCounter, s as RequestContext, st as InboxListener, t as ActorKeyPair, tt as CollectionCursor, u as SendActivityOptionsForCollection, ut as ObjectDispatcher, v as FederationFetchOptions, vt as buildCollectionSynchronizationHeader, w as ObjectCallbackSetters, x as IdempotencyKeyCallback, y as FederationOptions, yt as digest, z as RouterRouteResult } from "../context-M_MxoQgC.cjs";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "../kv-gJ8LYbxX.cjs";
-import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-43DJyETz.cjs";
+import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-Dp5dfH-i.cjs";
 export { ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, Federatable, Federation, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, ForwardActivityOptions, GetSignedKeyOptions, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MemoryKvStore, Message, MessageQueue, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfoDispatcher, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboxErrorHandler, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseUriResult, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, SharedInboxKeyDispatcher, WebFingerHandlerParameters, WebFingerLinksDispatcher, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, handleWebFinger, respondWithObject, respondWithObjectIfAcceptable };

package/dist/federation/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $ as AuthorizePredicate, A as CreateExponentialBackoffPolicyOptions, B as RespondWithObjectOptions, C as InboxListenerSetters, D as FederationOrigin, E as FederationKvPrefixes, F as createFederationBuilder, G as MessageQueue, H as respondWithObjectIfAcceptable, I as Router, J as ParallelMessageQueue, K as MessageQueueEnqueueOptions, L as RouterError, M as RetryPolicy, N as createExponentialBackoffPolicy, O as FederationQueueOptions, P as Message, Q as ActorKeyPairsDispatcher, R as RouterOptions, S as IdempotencyStrategy, T as Rfc6570Expression, U as InProcessMessageQueue, V as respondWithObject, W as InProcessMessageQueueOptions, X as ActorDispatcher, Y as ActorAliasMapper, Z as ActorHandleMapper, _ as FederationBuilder, _t as PageItems, a as InboxContext, at as CustomCollectionDispatcher, b as FederationStartQueueOptions, c as RouteActivityOptions, ct as NodeInfoDispatcher, d as ActorCallbackSetters, dt as OutboxErrorHandler, et as CollectionCounter, f as CollectionCallbackSetters, ft as OutboxPermanentFailureHandler, g as Federation, gt as SenderKeyPair, h as Federatable, ht as SendActivityError, i as GetSignedKeyOptions, it as CustomCollectionCursor, j as RetryContext, k as createFederation, l as SendActivityOptions, lt as ObjectAuthorizePredicate, m as CustomCollectionCallbackSetters, mt as WebFingerLinksDispatcher, n as Context, nt as CollectionDispatcher, o as ParseUriResult, ot as InboxErrorHandler, p as ConstructorWithTypeId, pt as SharedInboxKeyDispatcher, q as MessageQueueListenOptions, r as ForwardActivityOptions, rt as CustomCollectionCounter, s as RequestContext, st as InboxListener, t as ActorKeyPair, tt as CollectionCursor, u as SendActivityOptionsForCollection, ut as ObjectDispatcher, v as FederationFetchOptions, vt as buildCollectionSynchronizationHeader, w as ObjectCallbackSetters, x as IdempotencyKeyCallback, y as FederationOptions, yt as digest, z as RouterRouteResult } from "../context-DnsFj3yK.js";
+import { $ as AuthorizePredicate, A as CreateExponentialBackoffPolicyOptions, B as RespondWithObjectOptions, C as InboxListenerSetters, D as FederationOrigin, E as FederationKvPrefixes, F as createFederationBuilder, G as MessageQueue, H as respondWithObjectIfAcceptable, I as Router, J as ParallelMessageQueue, K as MessageQueueEnqueueOptions, L as RouterError, M as RetryPolicy, N as createExponentialBackoffPolicy, O as FederationQueueOptions, P as Message, Q as ActorKeyPairsDispatcher, R as RouterOptions, S as IdempotencyStrategy, T as Rfc6570Expression, U as InProcessMessageQueue, V as respondWithObject, W as InProcessMessageQueueOptions, X as ActorDispatcher, Y as ActorAliasMapper, Z as ActorHandleMapper, _ as FederationBuilder, _t as PageItems, a as InboxContext, at as CustomCollectionDispatcher, b as FederationStartQueueOptions, c as RouteActivityOptions, ct as NodeInfoDispatcher, d as ActorCallbackSetters, dt as OutboxErrorHandler, et as CollectionCounter, f as CollectionCallbackSetters, ft as OutboxPermanentFailureHandler, g as Federation, gt as SenderKeyPair, h as Federatable, ht as SendActivityError, i as GetSignedKeyOptions, it as CustomCollectionCursor, j as RetryContext, k as createFederation, l as SendActivityOptions, lt as ObjectAuthorizePredicate, m as CustomCollectionCallbackSetters, mt as WebFingerLinksDispatcher, n as Context, nt as CollectionDispatcher, o as ParseUriResult, ot as InboxErrorHandler, p as ConstructorWithTypeId, pt as SharedInboxKeyDispatcher, q as MessageQueueListenOptions, r as ForwardActivityOptions, rt as CustomCollectionCounter, s as RequestContext, st as InboxListener, t as ActorKeyPair, tt as CollectionCursor, u as SendActivityOptionsForCollection, ut as ObjectDispatcher, v as FederationFetchOptions, vt as buildCollectionSynchronizationHeader, w as ObjectCallbackSetters, x as IdempotencyKeyCallback, y as FederationOptions, yt as digest, z as RouterRouteResult } from "../context-B21klrfz.js";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "../kv-D6hNiMTK.js";
-import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-COgmn-UO.js";
+import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-D24V_w-K.js";
 export { ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, Federatable, Federation, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, ForwardActivityOptions, GetSignedKeyOptions, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MemoryKvStore, Message, MessageQueue, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfoDispatcher, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboxErrorHandler, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseUriResult, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, SharedInboxKeyDispatcher, WebFingerHandlerParameters, WebFingerLinksDispatcher, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, handleWebFinger, respondWithObject, respondWithObjectIfAcceptable };

package/dist/federation/mod.js

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "../middleware-CwIT91Nc.js";
+import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "../middleware-DomxFoLd.js";
 import { isEqual } from "es-toolkit";
 //#region src/federation/kv.ts
 /**

package/dist/federation/mq.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { i as assertGreaterOrEqual, r as assertGreater } from "../std__assert-Duiq_YC9.mjs";
 import { n as assertFalse } from "../assert_rejects-B-qJtC9Z.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
+import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { test } from "@fedify/fixture";
 import { delay } from "es-toolkit";
 //#region src/federation/mq.ts

package/dist/federation/negotiation.test.mjs

@@ -3,8 +3,8 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import "../std__assert-Duiq_YC9.mjs";
 import { n as assertFalse } from "../assert_rejects-B-qJtC9Z.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { t as acceptsJsonLd } from "../negotiation-BehA2uul.mjs";
+import { t as assert } from "../assert-BhQd8QHP.mjs";
+import { t as acceptsJsonLd } from "../negotiation-TWEs6Cl8.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/negotiation.test.ts
 test("acceptsJsonLd()", () => {

package/dist/federation/retry.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { l as AssertionError, t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { t as assertNotEquals } from "../assert_not_equals--wG9hV7u.mjs";
-import { t as createExponentialBackoffPolicy } from "../retry-B_E3V_Dx.mjs";
+import { t as createExponentialBackoffPolicy } from "../retry-Ddbq3AcK.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/retry.test.ts
 test("createExponentialBackoffPolicy()", () => {

package/dist/federation/router.test.mjs

@@ -5,8 +5,8 @@ import { n as RouterError, t as Router } from "../router-CrMLXoOr.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-Duiq_YC9.mjs";
 import { n as assertFalse } from "../assert_rejects-B-qJtC9Z.mjs";
+import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/router.test.ts
 function setUp(options = {}) {

package/dist/federation/send.test.mjs

@@ -5,15 +5,15 @@ import { t as esm_default } from "../esm-DVILvP5e.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-Duiq_YC9.mjs";
 import { n as assertFalse, t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
-import { t as assertInstanceOf } from "../assert_instance_of-C4Ri6VuN.mjs";
+import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertNotEquals } from "../assert_not_equals--wG9hV7u.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { l as verifyRequest } from "../http--P33qRwW.mjs";
-import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CtZLJq76.mjs";
-import { t as doesActorOwnKey } from "../owner-CFgyZgkz.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-pXXMu19o.mjs";
+import { l as verifyRequest } from "../http-Bu3NxfGb.mjs";
+import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
+import { t as doesActorOwnKey } from "../owner-Bzg6w7eA.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-D89-FDX-.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { Activity, Application, Endpoints, Group, Person, Service } from "@fedify/vocab";
+import { UrlError } from "@fedify/vocab-runtime";
 //#region src/federation/send.test.ts
 test("extractInboxes()", () => {
 	const recipients = [
@@ -415,5 +415,137 @@ test("sendActivity() records OpenTelemetry span events", async (t) => {
 		esm_default.hardReset();
 	});
 });
+for (const signed of [false, true]) {
+	const keys = [{
+		privateKey: signed ? rsaPrivateKey2 : ed25519PrivateKey,
+		keyId: signed ? rsaPublicKey2.id : ed25519Multikey.id
+	}];
+	test(`sendActivity() validates destinations (signed: ${signed})`, async (t) => {
+		const activity = {
+			type: "Create",
+			id: "https://example.com/activity"
+		};
+		const publicInbox = "https://8.8.8.8/inbox";
+		const privateInbox = "http://127.0.0.1/inbox";
+		for (const target of [
+			privateInbox,
+			"http://169.254.169.254/",
+			"http://[::1]/"
+		]) await t.step(`rejects ${target} before fetching`, async () => {
+			esm_default.mockGlobal().catch(202);
+			try {
+				await assertRejects(() => sendActivity({
+					activity,
+					keys,
+					inbox: new URL(target)
+				}), UrlError);
+				assertEquals(esm_default.callHistory.calls().length, 0);
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+		for (const status of [
+			301,
+			302,
+			303,
+			307,
+			308
+		]) for (const allowPrivateAddress of [false, true]) await t.step(`${status} private redirect, opt-in: ${allowPrivateAddress}`, async () => {
+			esm_default.mockGlobal();
+			esm_default.route(publicInbox, {
+				status,
+				headers: { Location: privateInbox }
+			});
+			esm_default.route(privateInbox, 202);
+			try {
+				const send = () => sendActivity({
+					activity,
+					keys,
+					inbox: new URL(publicInbox),
+					allowPrivateAddress
+				});
+				if (allowPrivateAddress) {
+					await send();
+					const calls = esm_default.callHistory.calls(privateInbox);
+					assertEquals(calls.length, 1);
+					const request = calls[0].request;
+					const preservesBody = signed || status === 307 || status === 308;
+					assertEquals(request.method, preservesBody ? "POST" : "GET");
+					assertEquals(await request.clone().text(), preservesBody ? JSON.stringify(activity) : "");
+				} else {
+					await assertRejects(send, UrlError);
+					assertEquals(esm_default.callHistory.calls(privateInbox).length, 0);
+				}
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+		await t.step("rejects a private destination after a public redirect", async () => {
+			esm_default.mockGlobal().route(publicInbox, {
+				status: 307,
+				headers: { Location: "/next" }
+			}).route("https://8.8.8.8/next", {
+				status: 308,
+				headers: { Location: privateInbox }
+			}).route(privateInbox, 202);
+			try {
+				await assertRejects(() => sendActivity({
+					activity,
+					keys,
+					inbox: new URL(publicInbox)
+				}), UrlError);
+				assertEquals(esm_default.callHistory.calls(privateInbox).length, 0);
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+		await t.step("limits redirect loops", async () => {
+			esm_default.mockGlobal().route(publicInbox, {
+				status: 307,
+				headers: { Location: publicInbox }
+			});
+			try {
+				await assertRejects(() => sendActivity({
+					activity,
+					keys,
+					inbox: new URL(publicInbox)
+				}));
+				assert(esm_default.callHistory.calls().length <= 21);
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+		await t.step("allows a direct private inbox with opt-in", async () => {
+			esm_default.mockGlobal().route(privateInbox, 202);
+			try {
+				await sendActivity({
+					activity,
+					keys,
+					inbox: new URL(privateInbox),
+					allowPrivateAddress: true
+				});
+				assertEquals(esm_default.callHistory.calls(privateInbox).length, 1);
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+		await t.step("allows relative public redirects", async () => {
+			esm_default.mockGlobal().route(publicInbox, {
+				status: 307,
+				headers: { Location: "/next" }
+			}).route("https://8.8.8.8/next", 202);
+			try {
+				await sendActivity({
+					activity,
+					keys,
+					inbox: new URL(publicInbox)
+				});
+				assertEquals(esm_default.callHistory.calls("https://8.8.8.8/next").length, 1);
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+	});
+}
 //#endregion
 export {};

package/dist/federation/temporal.test.mjs

@@ -3,8 +3,8 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import "../std__assert-Duiq_YC9.mjs";
 import { n as assertFalse } from "../assert_rejects-B-qJtC9Z.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "../temporal-B4rBDksp.mjs";
+import { t as assert } from "../assert-BhQd8QHP.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "../temporal-DPJlkHh3.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/temporal.test.ts
 test("hasMalformedKnownTemporalLiteral() detects expanded proof timestamps", async () => {

package/dist/federation/webfinger.test.mjs

@@ -4,8 +4,8 @@ globalThis.addEventListener = () => {};
 import { n as createRequestContext } from "../context-Juj6bdHC.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-Duiq_YC9.mjs";
-import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
-import { a as createFederation, o as handleWebFinger } from "../middleware-DpEJSmjy.mjs";
+import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
+import { a as createFederation, o as handleWebFinger } from "../middleware-BuVM1K-J.mjs";
 import { test } from "@fedify/fixture";
 import { Image, Link, Person } from "@fedify/vocab";
 //#region src/federation/webfinger.test.ts

package/dist/{http-BuaGj55w.cjs → http-BgOlx4n1.cjs}

@@ -11,7 +11,7 @@ let byte_encodings_base64 = require("byte-encodings/base64");
 let structured_field_values = require("structured-field-values");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.0.28-dev.1974+d70e3148";
+var version = "2.0.28-dev.1982+a57dec3f";
 //#endregion
 //#region src/sig/key.ts
 /**
@@ -93,6 +93,118 @@ async function importJwk(jwk, type) {
 	return key;
 }
 /**
+* Fetches the document that the given actor URI dereferences to, and returns
+* the actor only if the host that served the document is authoritative for
+* the id the document claims.
+*
+* Only the origin that serves an actor id can speak for it.  Without that
+* rule any host could serve a document describing somebody else's actor—and
+* listing its own keys as that actor's.
+*
+* @param actorId The URI of the actor to fetch.
+* @param options Options for fetching the document.
+* @returns The actor, or `null` if the document cannot be fetched, is not an
+*          actor, or belongs to another origin.
+* @internal
+*/
+async function fetchActorDocument(actorId, options = {}) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const documentLoader = options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
+	const contextLoader = options.contextLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
+	const { tracerProvider } = options;
+	let document;
+	let documentUrl = actorId;
+	try {
+		const remoteDocument = await documentLoader(actorId.href);
+		document = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", actorId);
+	} catch (error) {
+		logger.debug("Failed to fetch the actor {actorId}: {error}", {
+			actorId: actorId.href,
+			error
+		});
+		return null;
+	}
+	let object;
+	try {
+		object = await _fedify_vocab.Object.fromJsonLd(document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider,
+			baseUrl: documentUrl
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.debug("The document served at {documentUrl} is not a valid object: {error}", {
+			documentUrl: documentUrl.href,
+			error
+		});
+		return null;
+	}
+	if (!(0, _fedify_vocab.isActor)(object)) return null;
+	if (object.id == null || object.id.origin !== documentUrl.origin) {
+		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as that actor's document.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href
+		});
+		return null;
+	}
+	return object;
+}
+/**
+* Resolves the owner that the given key claims, and returns it only if the
+* claim holds.
+*
+* The `owner` of a {@link CryptographicKey}, like the `controller` of
+* a {@link Multikey}, proves nothing on its own: the key document and the
+* claim inside it are served by the same host, so anyone able to serve a key
+* document can name any actor in the world as its owner.  The claim becomes
+* meaningful only once the named actor's own document is fetched and turns
+* out to link back to the key.  This function performs that mutual-link
+* check, which is the only sound way to learn a fetched key's owner.
+*
+* The claimed owner is always dereferenced, never read out of the key
+* document: an owner embedded there is written by whoever wrote the key.
+*
+* @param key The key whose ownership claim is to be verified.  It must carry
+*            an `id`, as that is what the owner has to link back to.
+* @param options Options for fetching the claimed owner.
+* @returns The verified owner, or `null` if the key claims no owner, the
+*          owner cannot be fetched, or the owner does not link back to
+*          the key.
+* @internal
+*/
+async function verifyKeyOwnership(key, options = {}) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const keyId = key.id;
+	if (keyId == null) return null;
+	const claimedOwnerId = key instanceof _fedify_vocab.CryptographicKey ? key.ownerId : key.controllerId;
+	if (claimedOwnerId == null) return null;
+	const owner = await fetchActorDocument(claimedOwnerId, options);
+	if (owner == null) {
+		logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims could not be resolved.", {
+			keyId: keyId.href,
+			claimedOwnerId: claimedOwnerId.href
+		});
+		return null;
+	}
+	const linkedKeyIds = key instanceof _fedify_vocab.CryptographicKey ? owner.publicKeyIds : owner.assertionMethodIds;
+	for (const linkedKeyId of linkedKeyIds) if (linkedKeyId.href === keyId.href) return owner;
+	logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims does not list the key as its own.", {
+		keyId: keyId.href,
+		claimedOwnerId: claimedOwnerId.href
+	});
+	return null;
+}
+/**
 * Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL.
 * If the given URL contains an {@link Actor} object, it tries to find
 * the corresponding key in the `publicKey` or `assertionMethod` property.
@@ -161,8 +273,11 @@ async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, key
 	}
 	logger.debug("Fetching key {keyId} to verify signature...", { keyId });
 	let document;
+	let documentUrl = cacheKey;
 	try {
-		document = (await (documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)())(keyId)).document;
+		const remoteDocument = await (documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)())(keyId);
+		document = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", cacheKey);
 	} catch (_) {
 		logger.debug("Failed to fetch key {keyId}.", { keyId });
 		await keyCache?.set(cacheKey, null);
@@ -199,8 +314,22 @@ async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, key
 		}
 	}
 	let key = null;
-	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object;
+	let ownerDocument = null;
+	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
 	else if ((0, _fedify_vocab.isActor)(object)) {
+		if (object.id == null || object.id.origin !== documentUrl.origin) {
+			logger.debug("Failed to verify; the document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin.", {
+				keyId,
+				documentUrl: documentUrl.href,
+				actorId: object.id?.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+		ownerDocument = object;
 		const keys = cls === _fedify_vocab.CryptographicKey ? object.getPublicKeys({
 			documentLoader,
 			contextLoader,
@@ -259,6 +388,25 @@ async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, key
 			cached: false
 		};
 	}
+	const claimedOwnerId = key instanceof _fedify_vocab.CryptographicKey ? key.ownerId : key.controllerId;
+	if (ownerDocument != null && claimedOwnerId == null) key = key instanceof _fedify_vocab.CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
+	else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
+		if (await verifyKeyOwnership(key, {
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		}) == null) {
+			logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
+				keyId,
+				claimedOwnerId: claimedOwnerId.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+	}
 	if (keyCache != null) {
 		await keyCache.set(cacheKey, key);
 		logger.debug("Key {keyId} cached.", { keyId });
@@ -1122,6 +1270,12 @@ Object.defineProperty(exports, "exportJwk", {
 		return exportJwk;
 	}
 });
+Object.defineProperty(exports, "fetchActorDocument", {
+	enumerable: true,
+	get: function() {
+		return fetchActorDocument;
+	}
+});
 Object.defineProperty(exports, "fetchKey", {
 	enumerable: true,
 	get: function() {
@@ -1158,6 +1312,12 @@ Object.defineProperty(exports, "validateCryptoKey", {
 		return validateCryptoKey;
 	}
 });
+Object.defineProperty(exports, "verifyKeyOwnership", {
+	enumerable: true,
+	get: function() {
+		return verifyKeyOwnership;
+	}
+});
 Object.defineProperty(exports, "verifyRequest", {
 	enumerable: true,
 	get: function() {

package/dist/{http-C4D0ajx0.d.ts → http-Bs6thuCC.d.cts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
-import { CryptographicKey, Multikey } from "@fedify/vocab";
-import { TracerProvider } from "@opentelemetry/api";
+import { Actor, CryptographicKey, Multikey } from "@fedify/vocab";
 import { DocumentLoader } from "@fedify/vocab-runtime";
+import { TracerProvider } from "@opentelemetry/api";
 
 //#region src/sig/key.d.ts
 /**

package/dist/{http--P33qRwW.mjs → http-Bu3NxfGb.mjs}

@@ -1,8 +1,8 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CGtm12Ft.mjs";
-import { a as validateCryptoKey, n as fetchKey } from "./key-rC9mW1U5.mjs";
+import { n as version, t as name } from "./deno-eqaJj6JL.mjs";
+import { o as validateCryptoKey, r as fetchKey } from "./key-bSphUqhB.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";