@fedify/fedify 2.0.33 → 2.0.34-dev.2423

package/dist/{middleware-BGl-31cO.js → middleware-hfX624bD.js}

@@ -2,10 +2,10 @@ import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./chunk-CRNNMoPX.js";
 import { r as getDefaultActivityTransformers } from "./transformers-BGMIq1cs.js";
-import { c as importJwk, d as name, f as version, i as exportJwk, l as validateCryptoKey, r as verifyRequest, t as doubleKnock } from "./http-DaSZw9Op.js";
+import { c as importJwk, d as name, f as version, i as exportJwk, l as validateCryptoKey, r as verifyRequest, t as doubleKnock } from "./http-C_lGOZVR.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-miAYfiGO.js";
-import { _ as signJsonLd, a as doesActorOwnKey, c as assertSafeJsonLd, f as detachSignature, g as isInvalidUrlTypeError, h as isClearlyMalformedContextReference, m as hasSignature, n as signObject, o as getKeyOwner, p as getNormalizationContextLoader, r as verifyObject, s as InvalidContextReferenceError, u as compactJsonLd, v as verifyCompactJsonLd, x as wrapContextLoaderForJsonLd } from "./proof-BkLdxRY-.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-D95UjzfB.js";
+import { _ as signJsonLd, a as doesActorOwnKey, c as assertSafeJsonLd, f as detachSignature, g as isInvalidUrlTypeError, h as isClearlyMalformedContextReference, m as hasSignature, n as signObject, o as getKeyOwner, p as getNormalizationContextLoader, r as verifyObject, s as InvalidContextReferenceError, u as compactJsonLd, v as verifyCompactJsonLd, x as wrapContextLoaderForJsonLd } from "./proof-BAxqx8DQ.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DgG5Sj35.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
@@ -878,7 +878,7 @@ async function buildCollectionSynchronizationHeader(collectionId, actorIds) {
 //#region src/federation/keycache.ts
 const NULL_KEY_CACHE_VALUE = { _fedify: "key-unavailable" };
 const NULL_KEY_CACHE_TTL = Temporal.Duration.from({ minutes: 5 });
-const KEY_CACHE_GENERATION = "2";
+const KEY_CACHE_GENERATION = "3";
 function isNullKeyCacheValue(value) {
 	return typeof value === "object" && value != null && "_fedify" in value && value._fedify === NULL_KEY_CACHE_VALUE._fedify;
 }

package/dist/mod.cjs

@@ -4,11 +4,11 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-DDcVe30Y.cjs");
 const require_transformers = require("./transformers-NeAONrAq.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-qvfJE6bK.cjs");
-const require_middleware = require("./middleware-C9GIRvU2.cjs");
+const require_http = require("./http-CuYc-XkP.cjs");
+const require_middleware = require("./middleware-CHSunb_b.cjs");
 const require_types = require("./types-DRPjmHVV.cjs");
-const require_proof = require("./proof-D7USj3fe.cjs");
-const require_kv_cache = require("./kv-cache-BKk8naEu.cjs");
+const require_proof = require("./proof-CIg5BBtv.cjs");
+const require_kv_cache = require("./kv-cache-DhMHcykY.cjs");
 const require_federation_mod = require("./federation/mod.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");

package/dist/mod.js

@@ -3,11 +3,11 @@ import { URLPattern } from "urlpattern-polyfill";
 import "./chunk-CRNNMoPX.js";
 import { n as autoIdAssigner, r as getDefaultActivityTransformers, t as actorDehydrator } from "./transformers-BGMIq1cs.js";
 import "./compat/mod.js";
-import { c as importJwk, i as exportJwk, n as signRequest, o as fetchKey, r as verifyRequest, s as generateCryptoKeyPair } from "./http-DaSZw9Op.js";
-import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "./middleware-BGl-31cO.js";
+import { c as importJwk, i as exportJwk, n as signRequest, o as fetchKey, r as verifyRequest, s as generateCryptoKeyPair } from "./http-C_lGOZVR.js";
+import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "./middleware-hfX624bD.js";
 import { n as getNodeInfo, r as parseNodeInfo, t as nodeInfoToJson } from "./types-miAYfiGO.js";
-import { _ as signJsonLd, a as doesActorOwnKey, b as verifySignature, d as createSignature, f as detachSignature, i as verifyProof, l as attachSignature, n as signObject, o as getKeyOwner, r as verifyObject, t as createProof, y as verifyJsonLd } from "./proof-BkLdxRY-.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-D95UjzfB.js";
+import { _ as signJsonLd, a as doesActorOwnKey, b as verifySignature, d as createSignature, f as detachSignature, i as verifyProof, l as attachSignature, n as signObject, o as getKeyOwner, r as verifyObject, t as createProof, y as verifyJsonLd } from "./proof-BAxqx8DQ.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DgG5Sj35.js";
 import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue } from "./federation/mod.js";
 import "./nodeinfo/mod.js";
 import "./runtime/mod.js";

package/dist/nodeinfo/handler.test.mjs

@@ -5,7 +5,7 @@ import { n as createRequestContext } from "../context-Juj6bdHC.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-DflMZha5.mjs";
 import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
-import { a as createFederation, h as handleNodeInfoJrd, m as handleNodeInfo } from "../middleware-DOo95yst.mjs";
+import { a as createFederation, h as handleNodeInfoJrd, m as handleNodeInfo } from "../middleware-CeIMgD2N.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/handler.test.ts
 test("handleNodeInfo()", async () => {

package/dist/{owner-9OeM4q1P.mjs → owner-adLePX_5.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-DxxJ7DXK.mjs";
-import { n as fetchActorDocument, s as verifyKeyOwnership, t as exportJwk } from "./key-Bs7PNRrg.mjs";
+import { n as version, t as name } from "./deno-VKs2mmuk.mjs";
+import { n as fetchActorDocument, s as verifyKeyOwnership, t as exportJwk } from "./key-wwpJQHM0.mjs";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { getDocumentLoader } from "@fedify/vocab-runtime";

package/dist/{proof-BkLdxRY-.js → proof-BAxqx8DQ.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { a as fetchActorDocument, d as name, f as version, i as exportJwk, l as validateCryptoKey, o as fetchKey, u as verifyKeyOwnership } from "./http-DaSZw9Op.js";
+import { a as fetchActorDocument, d as name, f as version, i as exportJwk, l as validateCryptoKey, o as fetchKey, u as verifyKeyOwnership } from "./http-C_lGOZVR.js";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1, getTypeId, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{proof-D7USj3fe.cjs → proof-CIg5BBtv.cjs}

@@ -1,7 +1,7 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 const require_chunk = require("./chunk-DDcVe30Y.cjs");
-const require_http = require("./http-qvfJE6bK.cjs");
+const require_http = require("./http-CuYc-XkP.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");

package/dist/{proof-B-oGOuzf.mjs → proof-De7RbPGn.mjs}

@@ -1,8 +1,8 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-DxxJ7DXK.mjs";
-import { o as validateCryptoKey, r as fetchKey } from "./key-Bs7PNRrg.mjs";
+import { n as version, t as name } from "./deno-VKs2mmuk.mjs";
+import { o as validateCryptoKey, r as fetchKey } from "./key-wwpJQHM0.mjs";
 import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";

package/dist/{send-Bjw1BCUr.mjs → send-KK7FluNF.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-DxxJ7DXK.mjs";
-import { n as doubleKnock } from "./http-CWWgD1YT.mjs";
+import { n as version, t as name } from "./deno-VKs2mmuk.mjs";
+import { n as doubleKnock } from "./http-5zy1STVq.mjs";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, validatePublicUrl } from "@fedify/vocab-runtime";
 import { getLogger } from "@logtape/logtape";

package/dist/sig/http.test.mjs

@@ -7,8 +7,8 @@ import { i as assertExists, t as assertStringIncludes } from "../std__assert-Dfl
 import { r as assertFalse, t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
-import { t as exportJwk } from "../key-Bs7PNRrg.mjs";
-import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase } from "../http-CWWgD1YT.mjs";
+import { t as exportJwk } from "../key-wwpJQHM0.mjs";
+import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase } from "../http-5zy1STVq.mjs";
 import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-CCxRJhWa.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, exportSpki } from "@fedify/vocab-runtime";

package/dist/sig/key.test.mjs

@@ -3,12 +3,12 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { n as assertStrictEquals } from "../std__assert-DflMZha5.mjs";
-import { t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
+import { r as assertFalse, t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
-import { a as importJwk, i as generateCryptoKeyPair, o as validateCryptoKey, r as fetchKey, t as exportJwk } from "../key-Bs7PNRrg.mjs";
+import { a as importJwk, i as generateCryptoKeyPair, o as validateCryptoKey, r as fetchKey, t as exportJwk } from "../key-wwpJQHM0.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
-import { g as wrapContextLoaderForJsonLd } from "../ld-BlH5jQ7T.mjs";
+import { g as wrapContextLoaderForJsonLd } from "../ld-BCjStgTd.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { CryptographicKey, Multikey, Person } from "@fedify/vocab";
 import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";
@@ -655,5 +655,199 @@ test("fetchKey() records the controller an actor document establishes", async ()
 	assertEquals(key?.controllerId, new URL(actorId));
 	assert(key?.publicKey != null);
 });
+test("fetchKey() rejects a key whose owner redirects to another actor", async () => {
+	const keyId = "https://evil.example/keys/1";
+	const victim = "https://victim.example/users/alice";
+	const mallory = "https://evil.example/users/mallory";
+	const { publicKeyPem } = await rsaPublicKey3.toJsonLd({ contextLoader: mockDocumentLoader });
+	const cache = {};
+	assertEquals(await fetchKey(keyId, CryptographicKey, {
+		documentLoader(resource) {
+			if (resource === keyId) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					"@context": "https://w3id.org/security/v1",
+					id: keyId,
+					type: "CryptographicKey",
+					owner: victim,
+					publicKeyPem
+				}
+			});
+			if (resource === victim || resource === mallory) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: mallory,
+				document: {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
+					id: mallory,
+					type: "Person",
+					publicKey: keyId
+				}
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader,
+		keyCache: {
+			get(keyId) {
+				return Promise.resolve(cache[keyId.href]);
+			},
+			set(keyId, key) {
+				cache[keyId.href] = key;
+				return Promise.resolve();
+			}
+		}
+	}), {
+		key: null,
+		cached: false
+	});
+	assertEquals(cache, { [keyId]: null });
+});
+test("fetchKey() rejects a key whose owner resolves to another actor on the same origin", async () => {
+	const keyId = "https://victim.example/keys/bob";
+	const victim = "https://victim.example/users/alice";
+	const bob = "https://victim.example/users/bob";
+	const { publicKeyPem } = await rsaPublicKey3.toJsonLd({ contextLoader: mockDocumentLoader });
+	assertEquals(await fetchKey(keyId, CryptographicKey, {
+		documentLoader(resource) {
+			if (resource === keyId) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					"@context": "https://w3id.org/security/v1",
+					id: keyId,
+					type: "CryptographicKey",
+					owner: victim,
+					publicKeyPem
+				}
+			});
+			if (resource === victim || resource === bob) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
+					id: bob,
+					type: "Person",
+					publicKey: keyId
+				}
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader
+	}), {
+		key: null,
+		cached: false
+	});
+});
+test("fetchKey() rejects a Multikey whose controller redirects to another actor", async () => {
+	const keyId = "https://evil.example/keys/ed25519";
+	const victim = "https://victim.example/users/alice";
+	const mallory = "https://evil.example/users/mallory";
+	const multikeyDocument = await ed25519Multikey.toJsonLd({ contextLoader: mockDocumentLoader });
+	assertEquals(await fetchKey(keyId, Multikey, {
+		documentLoader(resource) {
+			if (resource === keyId) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					...multikeyDocument,
+					id: keyId,
+					controller: victim
+				}
+			});
+			if (resource === victim || resource === mallory) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: mallory,
+				document: {
+					"@context": [
+						"https://www.w3.org/ns/activitystreams",
+						"https://w3id.org/security/v1",
+						"https://w3id.org/security/multikey/v1",
+						"https://w3id.org/security/data-integrity/v1",
+						"https://www.w3.org/ns/did/v1"
+					],
+					id: mallory,
+					type: "Person",
+					assertionMethod: [keyId]
+				}
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader
+	}), {
+		key: null,
+		cached: false
+	});
+});
+test("fetchKey() accepts an owner whose document URL differs from its id", async () => {
+	const keyId = "https://victim.example/keys/alice";
+	const alice = "https://victim.example/users/alice";
+	const { publicKeyPem } = await rsaPublicKey3.toJsonLd({ contextLoader: mockDocumentLoader });
+	const { key, cached } = await fetchKey(keyId, CryptographicKey, {
+		documentLoader(resource) {
+			if (resource === keyId) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					"@context": "https://w3id.org/security/v1",
+					id: keyId,
+					type: "CryptographicKey",
+					owner: alice,
+					publicKeyPem
+				}
+			});
+			if (resource === alice) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: `${alice}.json`,
+				document: {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
+					id: alice,
+					type: "Person",
+					publicKey: keyId
+				}
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader
+	});
+	assertFalse(cached);
+	assertEquals(key?.id, new URL(keyId));
+	assertEquals(key?.ownerId, new URL(alice));
+});
+test("fetchKey() rejects an owner reached through a normalization redirect", async () => {
+	const keyId = "https://victim.example/keys/alice";
+	const canonical = "https://victim.example/users/alice";
+	const nonCanonical = "https://victim.example/users/Alice";
+	const { publicKeyPem } = await rsaPublicKey3.toJsonLd({ contextLoader: mockDocumentLoader });
+	assertEquals(await fetchKey(keyId, CryptographicKey, {
+		documentLoader(resource) {
+			if (resource === keyId) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					"@context": "https://w3id.org/security/v1",
+					id: keyId,
+					type: "CryptographicKey",
+					owner: nonCanonical,
+					publicKeyPem
+				}
+			});
+			if (resource === canonical || resource === nonCanonical) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: canonical,
+				document: {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
+					id: canonical,
+					type: "Person",
+					publicKey: keyId
+				}
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader
+	}), {
+		key: null,
+		cached: false
+	});
+});
 //#endregion
 export {};

package/dist/sig/ld.test.mjs

@@ -5,9 +5,9 @@ import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { r as assertFalse, t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
 import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
-import { i as generateCryptoKeyPair } from "../key-Bs7PNRrg.mjs";
+import { i as generateCryptoKeyPair } from "../key-wwpJQHM0.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
-import { a as compactJsonLd, d as isInvalidUrlTypeError, f as signJsonLd, h as verifySignature, i as attachSignature, m as verifyJsonLd, n as UnsafeJsonLdError, o as createSignature, s as detachSignature } from "../ld-BlH5jQ7T.mjs";
+import { a as compactJsonLd, d as isInvalidUrlTypeError, f as signJsonLd, h as verifySignature, i as attachSignature, m as verifyJsonLd, n as UnsafeJsonLdError, o as createSignature, s as detachSignature } from "../ld-BCjStgTd.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { CryptographicKey } from "@fedify/vocab";
 import { encodeBase64 } from "byte-encodings/base64";
@@ -818,5 +818,50 @@ test("verifyJsonLd() rejects a key that claims a forged owner", async () => {
 		contextLoader: mockDocumentLoader
 	}));
 });
+test("verifyJsonLd() rejects a key whose owner redirects to another actor", async () => {
+	const keyId = new URL("https://evil.example/keys/1");
+	const victim = "https://victim.example/users/alice";
+	const mallory = "https://evil.example/users/mallory";
+	const { publicKeyPem } = await rsaPublicKey3.toJsonLd({ contextLoader: mockDocumentLoader });
+	const signed = await signJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://victim.example/activities/forged",
+		type: "Create",
+		actor: victim,
+		object: {
+			type: "Note",
+			content: "forged"
+		}
+	}, rsaPrivateKey3, keyId, { contextLoader: mockDocumentLoader });
+	const options = {
+		documentLoader(resource) {
+			if (resource === keyId.href) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					"@context": "https://w3id.org/security/v1",
+					id: keyId.href,
+					type: "CryptographicKey",
+					owner: victim,
+					publicKeyPem
+				}
+			});
+			if (resource === victim || resource === mallory) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: mallory,
+				document: {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
+					id: mallory,
+					type: "Person",
+					publicKey: keyId.href
+				}
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader
+	};
+	assertEquals(await verifySignature(signed, options), null);
+	assertFalse(await verifyJsonLd(signed, options));
+});
 //#endregion
 export {};

package/dist/sig/mod.cjs

@@ -1,8 +1,8 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_http = require("../http-qvfJE6bK.cjs");
-const require_proof = require("../proof-D7USj3fe.cjs");
+const require_http = require("../http-CuYc-XkP.cjs");
+const require_proof = require("../proof-CIg5BBtv.cjs");
 exports.attachSignature = require_proof.attachSignature;
 exports.createProof = require_proof.createProof;
 exports.createSignature = require_proof.createSignature;

package/dist/sig/mod.js

@@ -1,5 +1,5 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { c as importJwk, i as exportJwk, n as signRequest, o as fetchKey, r as verifyRequest, s as generateCryptoKeyPair } from "../http-DaSZw9Op.js";
-import { _ as signJsonLd, a as doesActorOwnKey, b as verifySignature, d as createSignature, f as detachSignature, i as verifyProof, l as attachSignature, n as signObject, o as getKeyOwner, r as verifyObject, t as createProof, y as verifyJsonLd } from "../proof-BkLdxRY-.js";
+import { c as importJwk, i as exportJwk, n as signRequest, o as fetchKey, r as verifyRequest, s as generateCryptoKeyPair } from "../http-C_lGOZVR.js";
+import { _ as signJsonLd, a as doesActorOwnKey, b as verifySignature, d as createSignature, f as detachSignature, i as verifyProof, l as attachSignature, n as signObject, o as getKeyOwner, r as verifyObject, t as createProof, y as verifyJsonLd } from "../proof-BAxqx8DQ.js";
 export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, generateCryptoKeyPair, getKeyOwner, importJwk, signJsonLd, signObject, signRequest, verifyJsonLd, verifyObject, verifyProof, verifyRequest, verifySignature };

package/dist/sig/owner.test.mjs

@@ -6,7 +6,7 @@ import "../std__assert-DflMZha5.mjs";
 import { r as assertFalse } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-CCxRJhWa.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-9OeM4q1P.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-adLePX_5.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 //#region src/sig/owner.test.ts
@@ -153,5 +153,50 @@ test("doesActorOwnKey() matches a key that leaves its id implicit", async () =>
 		publicKey: rsaPublicKey2.publicKey
 	}), options));
 });
+test("doesActorOwnKey() rejects an actor ID that redirects to the key's owner", async () => {
+	const keyId = "https://evil.example/keys/1";
+	const victim = "https://victim.example/users/alice";
+	const mallory = "https://evil.example/users/mallory";
+	const { publicKeyPem } = await rsaPublicKey1.toJsonLd({ contextLoader: mockDocumentLoader });
+	const serveKeyOwnedBy = (owner) => ({
+		documentLoader(resource) {
+			if (resource === keyId) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					"@context": "https://w3id.org/security/v1",
+					id: keyId,
+					type: "CryptographicKey",
+					owner,
+					publicKeyPem
+				}
+			});
+			if (resource === victim || resource === mallory) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: mallory,
+				document: {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
+					id: mallory,
+					type: "Person",
+					publicKey: keyId
+				}
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader
+	});
+	const activity = new Create({ actor: new URL(victim) });
+	assertFalse(await doesActorOwnKey(activity, new CryptographicKey({
+		id: new URL(keyId),
+		owner: new URL(mallory),
+		publicKey: rsaPublicKey1.publicKey
+	}), serveKeyOwnedBy(mallory)));
+	assertFalse(await doesActorOwnKey(activity, new CryptographicKey({
+		id: new URL(keyId),
+		owner: new URL(victim),
+		publicKey: rsaPublicKey1.publicKey
+	}), serveKeyOwnedBy(victim)));
+	assertEquals(await getKeyOwner(new URL(keyId), serveKeyOwnedBy(victim)), null);
+});
 //#endregion
 export {};

package/dist/sig/proof.test.mjs

@@ -6,7 +6,7 @@ import "../std__assert-DflMZha5.mjs";
 import { n as assertInstanceOf } from "../assert-BhQd8QHP.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
-import { i as verifyProof, n as signObject, r as verifyObject, t as createProof } from "../proof-B-oGOuzf.mjs";
+import { i as verifyProof, n as signObject, r as verifyObject, t as createProof } from "../proof-De7RbPGn.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { Create, DataIntegrityProof, Multikey, Note, Place } from "@fedify/vocab";
 import { decodeMultibase, importMultibaseKey } from "@fedify/vocab-runtime";
@@ -322,5 +322,56 @@ test("verifyObject() rejects a key that claims a forged controller", async () =>
 		contextLoader: mockDocumentLoader
 	}), null);
 });
+test("verifyObject() rejects a key whose controller redirects to another actor", async () => {
+	const keyId = new URL("https://evil.example/keys/ed25519");
+	const victim = "https://victim.example/users/alice";
+	const mallory = "https://evil.example/users/mallory";
+	const multikeyDocument = await ed25519Multikey.toJsonLd({ contextLoader: mockDocumentLoader });
+	const signOptions = {
+		format: "compact",
+		contextLoader: mockDocumentLoader,
+		documentLoader: mockDocumentLoader,
+		context: ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"]
+	};
+	assertEquals(await verifyObject(Create, await (await signObject(new Create({
+		id: new URL("https://victim.example/activities/forged"),
+		actor: new URL(victim),
+		object: new Note({
+			id: new URL("https://victim.example/notes/forged"),
+			attribution: new URL(victim),
+			content: "forged"
+		})
+	}), ed25519PrivateKey, keyId, signOptions)).toJsonLd(signOptions), {
+		documentLoader(resource) {
+			if (resource === keyId.href) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					...multikeyDocument,
+					id: keyId.href,
+					controller: victim
+				}
+			});
+			if (resource === victim || resource === mallory) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: mallory,
+				document: {
+					"@context": [
+						"https://www.w3.org/ns/activitystreams",
+						"https://w3id.org/security/v1",
+						"https://w3id.org/security/multikey/v1",
+						"https://w3id.org/security/data-integrity/v1",
+						"https://www.w3.org/ns/did/v1"
+					],
+					id: mallory,
+					type: "Person",
+					assertionMethod: [keyId.href]
+				}
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader
+	}), null);
+});
 //#endregion
 export {};

package/dist/{temporal-Bf5PdJPv.mjs → temporal-D6Uf0KUy.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-BlH5jQ7T.mjs";
+import { c as getNormalizationContextLoader } from "./ld-BCjStgTd.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {