@fedify/fedify 2.1.0 → 2.1.2

package/dist/{http-CKDim8Tw.js → http-BTLPIzFa.mjs}

@@ -1,20 +1,19 @@
-
-      import { Temporal } from "@js-temporal/polyfill";
-      import { URLPattern } from "urlpattern-polyfill";
-      globalThis.addEventListener = () => {};
-    
-import { deno_default } from "./deno-BRMCYThi.js";
-import { fulfillAcceptSignature, parseAcceptSignature, validateAcceptSignature } from "./accept-D7sAxyNa.js";
-import { fetchKeyDetailed, validateCryptoKey } from "./key-BsSCz8Z_.js";
+import { Temporal } from "@js-temporal/polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { n as version, t as name } from "./deno-C5VMwnFV.mjs";
+import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-Dd__NiUL.mjs";
+import { o as validateCryptoKey, r as fetchKeyDetailed } from "./key-1MaItIGc.mjs";
 import { CryptographicKey } from "@fedify/vocab";
-import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
+import { FetchError } from "@fedify/vocab-runtime";
+import { getLogger } from "@logtape/logtape";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { encodeHex } from "byte-encodings/hex";
 import { Item, decodeDict, encodeItem } from "structured-field-values";
-
 //#region src/sig/http.ts
+const DEFAULT_MAX_REDIRECTION = 20;
 /**
 * Signs a request using the given private key.
 * @param request The request to sign.
@@ -26,9 +25,7 @@ import { Item, decodeDict, encodeItem } from "structured-field-values";
 */
 async function signRequest(request, privateKey, keyId, options = {}) {
 	validateCryptoKey(privateKey, "private");
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	return await tracer.startActiveSpan("http_signatures.sign", async (span) => {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("http_signatures.sign", async (span) => {
 		try {
 			const spec = options.spec ?? "draft-cavage-http-signatures-12";
 			let signed;
@@ -136,9 +133,7 @@ const derivedComponents = {
 * @returns The formatted signature string.
 */
 function formatRfc9421Signature(signature, components, parameters, label = "sig1") {
-	const signatureInputValue = `${label}=(${components.map((c) => formatComponentId(c)).join(" ")});${parameters}`;
-	const signatureValue = `${label}=:${encodeBase64(signature)}:`;
-	return [signatureInputValue, signatureValue];
+	return [`${label}=(${components.map((c) => formatComponentId(c)).join(" ")});${parameters}`, `${label}=:${encodeBase64(signature)}:`];
 }
 /**
 * Parse RFC 9421 Signature-Input header.
@@ -244,12 +239,11 @@ async function signRequestRfc9421(request, privateKey, keyId, span, currentTime,
 		value: "content-digest",
 		params: {}
 	}] : []];
-	const expires = rfc9421Options?.expires === true ? (currentTime.epochMilliseconds / 1e3 | 0) + 3600 : void 0;
 	const signatureParams = formatRfc9421SignatureParameters({
 		algorithm: "rsa-v1_5-sha256",
 		keyId,
 		created,
-		expires,
+		expires: rfc9421Options?.expires === true ? (currentTime.epochMilliseconds / 1e3 | 0) + 3600 : void 0,
 		nonce: rfc9421Options?.nonce,
 		tag: rfc9421Options?.tag
 	});
@@ -359,9 +353,7 @@ async function verifyRequest(request, options = {}) {
 * @since 2.1.0
 */
 async function verifyRequestDetailed(request, options = {}) {
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	return await tracer.startActiveSpan("http_signatures.verify", async (span) => {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("http_signatures.verify", async (span) => {
 		if (span.isRecording()) {
 			span.setAttribute(ATTR_HTTP_REQUEST_METHOD, request.method);
 			span.setAttribute(ATTR_URL_FULL, request.url);
@@ -556,8 +548,7 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 	const message = headerNames.map((name) => `${name}: ` + (name === "(request-target)" ? `${request.method.toLowerCase()} ${new URL(request.url).pathname}` : name === "(created)" ? sigValues.created ?? "" : name === "(expires)" ? sigValues.expires ?? "" : name === "host" ? request.headers.get("host") ?? new URL(request.url).host : request.headers.get(name))).join("\n");
 	const sig = decodeBase64(signature);
 	span?.setAttribute("http_signatures.signature", encodeHex(sig));
-	const verified = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message));
-	if (!verified) {
+	if (!await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message))) {
 		if (cached) {
 			logger.debug("Failed to verify with the cached key {keyId}; signature {signature} is invalid.  Retrying with the freshly fetched key...", {
 				keyId,
@@ -571,7 +562,7 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 				currentTime,
 				keyCache: {
 					get: () => Promise.resolve(void 0),
-					set: async (keyId$1, key$1) => await keyCache?.set(keyId$1, key$1)
+					set: async (keyId, key) => await keyCache?.set(keyId, key)
 				}
 			});
 		}
@@ -733,9 +724,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 				failure = invalidSignatureResult(keyId);
 				continue;
 			}
-			const body = await request.arrayBuffer();
-			const digestValid = await verifyRfc9421ContentDigest(contentDigestHeader, body);
-			if (!digestValid) {
+			if (!await verifyRfc9421ContentDigest(contentDigestHeader, await request.arrayBuffer())) {
 				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
 				failure = invalidSignatureResult(keyId);
 				continue;
@@ -793,8 +782,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 		const signatureBaseBytes = new TextEncoder().encode(signatureBase);
 		span?.setAttribute("http_signatures.signature", encodeHex(sigBytes));
 		try {
-			const verified = await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes);
-			if (verified) return {
+			if (await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes)) return {
 				verified: true,
 				key,
 				signatureLabel: sigName
@@ -808,7 +796,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 					currentTime,
 					keyCache: {
 						get: () => Promise.resolve(void 0),
-						set: async (keyId$1, key$1) => await keyCache?.set(keyId$1, key$1)
+						set: async (keyId, key) => await keyCache?.set(keyId, key)
 					},
 					spec: "rfc9421"
 				});
@@ -865,7 +853,11 @@ function createRedirectRequest(request, location, body) {
 * @since 1.6.0
 */
 async function doubleKnock(request, identity, options = {}) {
+	return await doubleKnockInternal(request, identity, options);
+}
+async function doubleKnockInternal(request, identity, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 	const { specDeterminer, log, tracerProvider, signal } = options;
+	visited.add(request.url);
 	const origin = new URL(request.url).origin;
 	const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
 	const body = options.body !== void 0 ? options.body : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
@@ -880,11 +872,13 @@ async function doubleKnock(request, identity, options = {}) {
 		signal
 	});
 	if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-		const location = response.headers.get("Location");
-		return doubleKnock(createRedirectRequest(request, location, body), identity, {
+		if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(request.url, `Too many redirections (${redirected + 1})`);
+		const redirectRequest = createRedirectRequest(request, response.headers.get("Location"), body);
+		if (visited.has(redirectRequest.url)) throw new FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
+		return doubleKnockInternal(redirectRequest, identity, {
 			...options,
 			body
-		});
+		}, redirected + 1, visited);
 	} else if (response.status === 400 || response.status === 401 || response.status > 401) {
 		const logger = getLogger([
 			"fedify",
@@ -927,13 +921,10 @@ async function doubleKnock(request, identity, options = {}) {
 					redirect: "manual",
 					signal
 				});
-				if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-					const location = response.headers.get("Location");
-					return doubleKnock(createRedirectRequest(request, location, body), identity, {
-						...options,
-						body
-					});
-				}
+				if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) return doubleKnock(createRedirectRequest(request, response.headers.get("Location"), body), identity, {
+					...options,
+					body
+				});
 			}
 			if (fulfilled && response.status < 300) {
 				await specDeterminer?.rememberSpec(origin, "rfc9421");
@@ -959,11 +950,13 @@ async function doubleKnock(request, identity, options = {}) {
 			signal
 		});
 		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-			const location = response.headers.get("Location");
-			return doubleKnock(createRedirectRequest(request, location, body), identity, {
+			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(request.url, `Too many redirections (${redirected + 1})`);
+			const redirectRequest = createRedirectRequest(request, response.headers.get("Location"), body);
+			if (visited.has(redirectRequest.url)) throw new FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
+			return doubleKnockInternal(redirectRequest, identity, {
 				...options,
 				body
-			});
+			}, redirected + 1, visited);
 		} else if (response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
 	} else await specDeterminer?.rememberSpec(origin, firstTrySpec);
 	return response;
@@ -995,6 +988,5 @@ function timingSafeEqual(a, b) {
 	result |= lenA ^ lenB;
 	return result === 0;
 }
-
 //#endregion
-export { createRfc9421SignatureBase, doubleKnock, formatRfc9421Signature, formatRfc9421SignatureParameters, parseRfc9421Signature, parseRfc9421SignatureInput, signRequest, timingSafeEqual, verifyRequest, verifyRequestDetailed };
+export { parseRfc9421Signature as a, timingSafeEqual as c, formatRfc9421SignatureParameters as i, verifyRequest as l, doubleKnock as n, parseRfc9421SignatureInput as o, formatRfc9421Signature as r, signRequest as s, createRfc9421SignatureBase as t, verifyRequestDetailed as u };

package/dist/{http-BudnHZE2.d.cts → http-CrGuipxe.d.cts}

@@ -3,7 +3,6 @@ import { DocumentLoader } from "@fedify/vocab-runtime";
 import { TracerProvider } from "@opentelemetry/api";
 
 //#region src/sig/key.d.ts
-
 /**
 * Generates a key pair which is appropriate for Fedify.
 * @param algorithm The algorithm to use.  Currently only RSASSA-PKCS1-v1_5 and
@@ -536,9 +535,5 @@ interface HttpMessageSignaturesSpecDeterminer {
   */
   rememberSpec(origin: string, spec: HttpMessageSignaturesSpec): void | Promise<void>;
 }
-/**
-* The options for double-knock requests.
-* @since 1.6.0
-*/
 //#endregion
-export { AcceptSignatureMember, AcceptSignatureParameters, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignRequestOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, importJwk, parseAcceptSignature, signRequest, validateAcceptSignature, verifyRequest, verifyRequestDetailed };
+export { exportJwk as C, importJwk as D, generateCryptoKeyPair as E, KeyCache as S, fetchKeyDetailed as T, validateAcceptSignature as _, VerifyRequestDetailedResult as a, FetchKeyOptions as b, signRequest as c, AcceptSignatureMember as d, AcceptSignatureParameters as f, parseAcceptSignature as g, fulfillAcceptSignature as h, SignRequestOptions as i, verifyRequest as l, formatAcceptSignature as m, HttpMessageSignaturesSpecDeterminer as n, VerifyRequestFailureReason as o, FulfillAcceptSignatureResult as p, Rfc9421SignRequestOptions as r, VerifyRequestOptions as s, HttpMessageSignaturesSpec as t, verifyRequestDetailed as u, FetchKeyDetailedResult as v, fetchKey as w, FetchKeyResult as x, FetchKeyErrorResult as y };