@fedify/fedify 2.1.23 → 2.1.24

package/dist/federation/middleware.test.mjs

@@ -6,22 +6,21 @@ import { n as RouterError } from "../router-CrMLXoOr.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { n as assertStrictEquals } from "../std__assert-Duiq_YC9.mjs";
 import { n as assertFalse, t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
-import { t as assertInstanceOf } from "../assert_instance_of-C4Ri6VuN.mjs";
+import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
 import { t as assertNotEquals } from "../assert_not_equals--wG9hV7u.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { l as verifyRequest, s as signRequest } from "../http-DIh9_s_-.mjs";
-import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-BAK-tUlf.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-B-IG1dVk.mjs";
-import { a as compactJsonLd, f as signJsonLd, m as verifyJsonLd, s as detachSignature } from "../ld-Ch6FVq7X.mjs";
-import { t as doesActorOwnKey } from "../owner-Cygg-fHW.mjs";
-import { n as signObject, r as verifyObject } from "../proof-Dt5GV-xi.mjs";
-import { t as MemoryKvStore } from "../kv-tL2TOE9X.mjs";
-import { a as createFederation, i as KvSpecDeterminer, n as FederationImpl, r as InboxContextImpl, t as ContextImpl } from "../middleware-D2O8b03q.mjs";
+import { l as verifyRequest, s as signRequest } from "../http-UyebnM2c.mjs";
+import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CtZLJq76.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-DdEK2tXP.mjs";
+import { a as compactJsonLd, f as signJsonLd, m as verifyJsonLd, s as detachSignature } from "../ld-BSvHU-S0.mjs";
+import { t as doesActorOwnKey } from "../owner-CaaCVHsG.mjs";
+import { n as signObject, r as verifyObject } from "../proof-_AyA4r7z.mjs";
+import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
+import { a as createFederation, i as KvSpecDeterminer, n as FederationImpl, r as InboxContextImpl, t as ContextImpl } from "../middleware-Dy18K1xP.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import * as vocab from "@fedify/vocab";
 import { Create, Offer, Person, getTypeId, lookupObject } from "@fedify/vocab";
-import { FetchError, getDocumentLoader } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";
 //#region ../fixture/src/fixtures/example.com/create.json
 var id$2 = "https://example.com/create";
 var create_default = {
@@ -3016,6 +3015,7 @@ test("FederationImpl.processQueuedTask() permanent failure", async (t) => {
 					return Promise.resolve();
 				}
 			},
+			allowPrivateAddress: true,
 			...options.permanentFailureStatusCodes ? { permanentFailureStatusCodes: options.permanentFailureStatusCodes } : {}
 		});
 		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox");
@@ -3867,5 +3867,93 @@ test("KvSpecDeterminer", async (t) => {
 		assertEquals(spec, "rfc9421");
 	});
 });
+test("ContextImpl.sendActivity() honors the private-address policy", async (t) => {
+	for (const allowPrivateAddress of [false, true]) await t.step(`allowPrivateAddress: ${allowPrivateAddress}`, async () => {
+		const inbox = "http://127.0.0.1/inbox";
+		esm_default.mockGlobal().post(inbox, 202);
+		try {
+			const ctx = createFederation({
+				kv: new MemoryKvStore(),
+				allowPrivateAddress
+			}).createContext(new URL("https://example.com/"));
+			const send = () => ctx.sendActivity({
+				privateKey: ed25519PrivateKey,
+				keyId: ed25519Multikey.id
+			}, new Person({
+				id: new URL("https://example.com/recipient"),
+				inbox: new URL(inbox)
+			}), new Create({
+				id: new URL("https://example.com/activity"),
+				actor: new URL("https://example.com/person")
+			}), { immediate: true });
+			if (allowPrivateAddress) {
+				await send();
+				assertEquals(esm_default.callHistory.calls(inbox).length, 1);
+			} else {
+				await assertRejects(send, UrlError);
+				assertEquals(esm_default.callHistory.calls(inbox).length, 0);
+			}
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+});
+test("Federation.fetch() bounds inbox bodies before dispatch", async () => {
+	let dispatched = false;
+	const json = JSON.stringify({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://example.com/activities/bounded",
+		type: "Create",
+		actor: "https://example.com/actor"
+	});
+	const size = 16 * 1024 * 1024;
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		skipSignatureVerification: true,
+		contextLoaderFactory: () => mockDocumentLoader
+	});
+	federation.setActorDispatcher("/actors/{identifier}", () => new Person({ id: new URL("https://example.com/actor") }));
+	federation.setInboxListeners("/actors/{identifier}/inbox", "/inbox").on(Create, () => {
+		dispatched = true;
+	});
+	for (const contentLength of [
+		void 0,
+		"1",
+		String(size + 1)
+	]) {
+		assertEquals((await federation.fetch(new Request("https://example.com/inbox", {
+			method: "POST",
+			headers: contentLength == null ? {} : { "Content-Length": contentLength },
+			body: json.padEnd(size + 1)
+		}), { contextData: void 0 })).status, 413);
+		assertFalse(dispatched);
+	}
+	let canceled = false;
+	let pulls = 0;
+	const body = new ReadableStream({
+		pull(controller) {
+			pulls++;
+			controller.enqueue(new Uint8Array(64 * 1024));
+		},
+		cancel() {
+			canceled = true;
+		}
+	}, { highWaterMark: 0 });
+	const request = new Request("https://example.com/inbox", {
+		method: "POST",
+		body,
+		duplex: "half"
+	});
+	assertEquals((await federation.fetch(request, { contextData: void 0 })).status, 413);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert(canceled);
+	assert(pulls <= 260);
+	assertFalse(dispatched);
+	assertEquals((await federation.fetch(new Request("https://example.com/inbox", {
+		method: "POST",
+		body: json
+	}), { contextData: void 0 })).status, 202);
+	assert(dispatched);
+});
 //#endregion
 export {};

package/dist/federation/mod.cjs

@@ -2,7 +2,7 @@ const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../chunk-DDcVe30Y.cjs");
-const require_middleware = require("../middleware-CUNIlYzF.cjs");
+const require_middleware = require("../middleware-CCYqHlzn.cjs");
 let es_toolkit = require("es-toolkit");
 //#region src/federation/kv.ts
 /**

package/dist/federation/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $ as ActorKeyPairsDispatcher, A as createFederation, B as RouterRouteResult, C as InboxChallengePolicy, D as FederationKvPrefixes, E as Rfc6570Expression, F as Message, G as InProcessMessageQueueOptions, H as respondWithObject, I as createFederationBuilder, J as MessageQueueListenOptions, K as MessageQueue, L as Router, M as RetryContext, N as RetryPolicy, O as FederationOrigin, P as createExponentialBackoffPolicy, Q as ActorHandleMapper, R as RouterError, S as IdempotencyStrategy, St as digest, T as ObjectCallbackSetters, U as respondWithObjectIfAcceptable, V as RespondWithObjectOptions, W as InProcessMessageQueue, X as ActorAliasMapper, Y as ParallelMessageQueue, Z as ActorDispatcher, _ as FederationBuilder, _t as WebFingerLinksDispatcher, a as InboxContext, at as CustomCollectionCursor, b as FederationStartQueueOptions, bt as PageItems, c as RouteActivityOptions, ct as InboxListener, d as ActorCallbackSetters, dt as ObjectDispatcher, et as AuthorizePredicate, f as CollectionCallbackSetters, ft as OutboxErrorHandler, g as Federation, gt as UnverifiedActivityReason, h as Federatable, ht as UnverifiedActivityHandler, i as GetSignedKeyOptions, it as CustomCollectionCounter, j as CreateExponentialBackoffPolicyOptions, k as FederationQueueOptions, l as SendActivityOptions, lt as NodeInfoDispatcher, m as CustomCollectionCallbackSetters, mt as SharedInboxKeyDispatcher, n as Context, nt as CollectionCursor, o as ParseUriResult, ot as CustomCollectionDispatcher, p as ConstructorWithTypeId, pt as OutboxPermanentFailureHandler, q as MessageQueueEnqueueOptions, r as ForwardActivityOptions, rt as CollectionDispatcher, s as RequestContext, st as InboxErrorHandler, t as ActorKeyPair, tt as CollectionCounter, u as SendActivityOptionsForCollection, ut as ObjectAuthorizePredicate, v as FederationFetchOptions, vt as SendActivityError, w as InboxListenerSetters, x as IdempotencyKeyCallback, xt as buildCollectionSynchronizationHeader, y as FederationOptions, yt as SenderKeyPair, z as RouterOptions } from "../context-o22vjzS2.cjs";
+import { $ as ActorKeyPairsDispatcher, A as createFederation, B as RouterRouteResult, C as InboxChallengePolicy, D as FederationKvPrefixes, E as Rfc6570Expression, F as Message, G as InProcessMessageQueueOptions, H as respondWithObject, I as createFederationBuilder, J as MessageQueueListenOptions, K as MessageQueue, L as Router, M as RetryContext, N as RetryPolicy, O as FederationOrigin, P as createExponentialBackoffPolicy, Q as ActorHandleMapper, R as RouterError, S as IdempotencyStrategy, St as digest, T as ObjectCallbackSetters, U as respondWithObjectIfAcceptable, V as RespondWithObjectOptions, W as InProcessMessageQueue, X as ActorAliasMapper, Y as ParallelMessageQueue, Z as ActorDispatcher, _ as FederationBuilder, _t as WebFingerLinksDispatcher, a as InboxContext, at as CustomCollectionCursor, b as FederationStartQueueOptions, bt as PageItems, c as RouteActivityOptions, ct as InboxListener, d as ActorCallbackSetters, dt as ObjectDispatcher, et as AuthorizePredicate, f as CollectionCallbackSetters, ft as OutboxErrorHandler, g as Federation, gt as UnverifiedActivityReason, h as Federatable, ht as UnverifiedActivityHandler, i as GetSignedKeyOptions, it as CustomCollectionCounter, j as CreateExponentialBackoffPolicyOptions, k as FederationQueueOptions, l as SendActivityOptions, lt as NodeInfoDispatcher, m as CustomCollectionCallbackSetters, mt as SharedInboxKeyDispatcher, n as Context, nt as CollectionCursor, o as ParseUriResult, ot as CustomCollectionDispatcher, p as ConstructorWithTypeId, pt as OutboxPermanentFailureHandler, q as MessageQueueEnqueueOptions, r as ForwardActivityOptions, rt as CollectionDispatcher, s as RequestContext, st as InboxErrorHandler, t as ActorKeyPair, tt as CollectionCounter, u as SendActivityOptionsForCollection, ut as ObjectAuthorizePredicate, v as FederationFetchOptions, vt as SendActivityError, w as InboxListenerSetters, x as IdempotencyKeyCallback, xt as buildCollectionSynchronizationHeader, y as FederationOptions, yt as SenderKeyPair, z as RouterOptions } from "../context-D4s0Wk3N.cjs";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "../kv-gJ8LYbxX.cjs";
-import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-0dF0OeGw.cjs";
+import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-Bx80LUTA.cjs";
 export { ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, Federatable, Federation, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, ForwardActivityOptions, GetSignedKeyOptions, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MemoryKvStore, Message, MessageQueue, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfoDispatcher, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboxErrorHandler, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseUriResult, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, SharedInboxKeyDispatcher, UnverifiedActivityHandler, UnverifiedActivityReason, WebFingerHandlerParameters, WebFingerLinksDispatcher, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, handleWebFinger, respondWithObject, respondWithObjectIfAcceptable };

package/dist/federation/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $ as ActorKeyPairsDispatcher, A as createFederation, B as RouterRouteResult, C as InboxChallengePolicy, D as FederationKvPrefixes, E as Rfc6570Expression, F as Message, G as InProcessMessageQueueOptions, H as respondWithObject, I as createFederationBuilder, J as MessageQueueListenOptions, K as MessageQueue, L as Router, M as RetryContext, N as RetryPolicy, O as FederationOrigin, P as createExponentialBackoffPolicy, Q as ActorHandleMapper, R as RouterError, S as IdempotencyStrategy, St as digest, T as ObjectCallbackSetters, U as respondWithObjectIfAcceptable, V as RespondWithObjectOptions, W as InProcessMessageQueue, X as ActorAliasMapper, Y as ParallelMessageQueue, Z as ActorDispatcher, _ as FederationBuilder, _t as WebFingerLinksDispatcher, a as InboxContext, at as CustomCollectionCursor, b as FederationStartQueueOptions, bt as PageItems, c as RouteActivityOptions, ct as InboxListener, d as ActorCallbackSetters, dt as ObjectDispatcher, et as AuthorizePredicate, f as CollectionCallbackSetters, ft as OutboxErrorHandler, g as Federation, gt as UnverifiedActivityReason, h as Federatable, ht as UnverifiedActivityHandler, i as GetSignedKeyOptions, it as CustomCollectionCounter, j as CreateExponentialBackoffPolicyOptions, k as FederationQueueOptions, l as SendActivityOptions, lt as NodeInfoDispatcher, m as CustomCollectionCallbackSetters, mt as SharedInboxKeyDispatcher, n as Context, nt as CollectionCursor, o as ParseUriResult, ot as CustomCollectionDispatcher, p as ConstructorWithTypeId, pt as OutboxPermanentFailureHandler, q as MessageQueueEnqueueOptions, r as ForwardActivityOptions, rt as CollectionDispatcher, s as RequestContext, st as InboxErrorHandler, t as ActorKeyPair, tt as CollectionCounter, u as SendActivityOptionsForCollection, ut as ObjectAuthorizePredicate, v as FederationFetchOptions, vt as SendActivityError, w as InboxListenerSetters, x as IdempotencyKeyCallback, xt as buildCollectionSynchronizationHeader, y as FederationOptions, yt as SenderKeyPair, z as RouterOptions } from "../context-_l9t359k.js";
+import { $ as ActorKeyPairsDispatcher, A as createFederation, B as RouterRouteResult, C as InboxChallengePolicy, D as FederationKvPrefixes, E as Rfc6570Expression, F as Message, G as InProcessMessageQueueOptions, H as respondWithObject, I as createFederationBuilder, J as MessageQueueListenOptions, K as MessageQueue, L as Router, M as RetryContext, N as RetryPolicy, O as FederationOrigin, P as createExponentialBackoffPolicy, Q as ActorHandleMapper, R as RouterError, S as IdempotencyStrategy, St as digest, T as ObjectCallbackSetters, U as respondWithObjectIfAcceptable, V as RespondWithObjectOptions, W as InProcessMessageQueue, X as ActorAliasMapper, Y as ParallelMessageQueue, Z as ActorDispatcher, _ as FederationBuilder, _t as WebFingerLinksDispatcher, a as InboxContext, at as CustomCollectionCursor, b as FederationStartQueueOptions, bt as PageItems, c as RouteActivityOptions, ct as InboxListener, d as ActorCallbackSetters, dt as ObjectDispatcher, et as AuthorizePredicate, f as CollectionCallbackSetters, ft as OutboxErrorHandler, g as Federation, gt as UnverifiedActivityReason, h as Federatable, ht as UnverifiedActivityHandler, i as GetSignedKeyOptions, it as CustomCollectionCounter, j as CreateExponentialBackoffPolicyOptions, k as FederationQueueOptions, l as SendActivityOptions, lt as NodeInfoDispatcher, m as CustomCollectionCallbackSetters, mt as SharedInboxKeyDispatcher, n as Context, nt as CollectionCursor, o as ParseUriResult, ot as CustomCollectionDispatcher, p as ConstructorWithTypeId, pt as OutboxPermanentFailureHandler, q as MessageQueueEnqueueOptions, r as ForwardActivityOptions, rt as CollectionDispatcher, s as RequestContext, st as InboxErrorHandler, t as ActorKeyPair, tt as CollectionCounter, u as SendActivityOptionsForCollection, ut as ObjectAuthorizePredicate, v as FederationFetchOptions, vt as SendActivityError, w as InboxListenerSetters, x as IdempotencyKeyCallback, xt as buildCollectionSynchronizationHeader, y as FederationOptions, yt as SenderKeyPair, z as RouterOptions } from "../context-BgU5UWTx.js";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "../kv-D6hNiMTK.js";
-import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-Bv1elC-b.js";
+import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-DcAiY74j.js";
 export { ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, Federatable, Federation, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, ForwardActivityOptions, GetSignedKeyOptions, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MemoryKvStore, Message, MessageQueue, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfoDispatcher, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboxErrorHandler, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseUriResult, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, SharedInboxKeyDispatcher, UnverifiedActivityHandler, UnverifiedActivityReason, WebFingerHandlerParameters, WebFingerLinksDispatcher, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, handleWebFinger, respondWithObject, respondWithObjectIfAcceptable };

package/dist/federation/mod.js

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "../middleware-CYsQG25-.js";
+import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "../middleware-Do50b12a.js";
 import { isEqual } from "es-toolkit";
 //#region src/federation/kv.ts
 /**

package/dist/federation/mq.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { i as assertGreaterOrEqual, r as assertGreater } from "../std__assert-Duiq_YC9.mjs";
 import { n as assertFalse } from "../assert_rejects-B-qJtC9Z.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
+import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { test } from "@fedify/fixture";
 import { delay } from "es-toolkit";
 //#region src/federation/mq.ts

package/dist/federation/negotiation.test.mjs

@@ -3,8 +3,8 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import "../std__assert-Duiq_YC9.mjs";
 import { n as assertFalse } from "../assert_rejects-B-qJtC9Z.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { t as acceptsJsonLd } from "../negotiation-DnsfFF8I.mjs";
+import { t as assert } from "../assert-BhQd8QHP.mjs";
+import { t as acceptsJsonLd } from "../negotiation-BehA2uul.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/negotiation.test.ts
 test("acceptsJsonLd()", () => {

package/dist/federation/retry.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { l as AssertionError, t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { t as assertNotEquals } from "../assert_not_equals--wG9hV7u.mjs";
-import { t as createExponentialBackoffPolicy } from "../retry-CJL0poaU.mjs";
+import { t as createExponentialBackoffPolicy } from "../retry-B_E3V_Dx.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/retry.test.ts
 test("createExponentialBackoffPolicy()", () => {

package/dist/federation/router.test.mjs

@@ -5,8 +5,8 @@ import { n as RouterError, t as Router } from "../router-CrMLXoOr.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-Duiq_YC9.mjs";
 import { n as assertFalse } from "../assert_rejects-B-qJtC9Z.mjs";
+import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/router.test.ts
 function setUp(options = {}) {

package/dist/federation/send.test.mjs

@@ -5,15 +5,15 @@ import { t as esm_default } from "../esm-DVILvP5e.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-Duiq_YC9.mjs";
 import { n as assertFalse, t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
-import { t as assertInstanceOf } from "../assert_instance_of-C4Ri6VuN.mjs";
+import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertNotEquals } from "../assert_not_equals--wG9hV7u.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { l as verifyRequest } from "../http-DIh9_s_-.mjs";
-import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-BAK-tUlf.mjs";
-import { t as doesActorOwnKey } from "../owner-Cygg-fHW.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-CqaJDT2z.mjs";
+import { l as verifyRequest } from "../http-UyebnM2c.mjs";
+import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CtZLJq76.mjs";
+import { t as doesActorOwnKey } from "../owner-CaaCVHsG.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-B1CRgb14.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { Activity, Application, Endpoints, Group, Person, Service } from "@fedify/vocab";
+import { UrlError } from "@fedify/vocab-runtime";
 //#region src/federation/send.test.ts
 test("extractInboxes()", () => {
 	const recipients = [
@@ -415,5 +415,137 @@ test("sendActivity() records OpenTelemetry span events", async (t) => {
 		esm_default.hardReset();
 	});
 });
+for (const signed of [false, true]) {
+	const keys = [{
+		privateKey: signed ? rsaPrivateKey2 : ed25519PrivateKey,
+		keyId: signed ? rsaPublicKey2.id : ed25519Multikey.id
+	}];
+	test(`sendActivity() validates destinations (signed: ${signed})`, async (t) => {
+		const activity = {
+			type: "Create",
+			id: "https://example.com/activity"
+		};
+		const publicInbox = "https://8.8.8.8/inbox";
+		const privateInbox = "http://127.0.0.1/inbox";
+		for (const target of [
+			privateInbox,
+			"http://169.254.169.254/",
+			"http://[::1]/"
+		]) await t.step(`rejects ${target} before fetching`, async () => {
+			esm_default.mockGlobal().catch(202);
+			try {
+				await assertRejects(() => sendActivity({
+					activity,
+					keys,
+					inbox: new URL(target)
+				}), UrlError);
+				assertEquals(esm_default.callHistory.calls().length, 0);
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+		for (const status of [
+			301,
+			302,
+			303,
+			307,
+			308
+		]) for (const allowPrivateAddress of [false, true]) await t.step(`${status} private redirect, opt-in: ${allowPrivateAddress}`, async () => {
+			esm_default.mockGlobal();
+			esm_default.route(publicInbox, {
+				status,
+				headers: { Location: privateInbox }
+			});
+			esm_default.route(privateInbox, 202);
+			try {
+				const send = () => sendActivity({
+					activity,
+					keys,
+					inbox: new URL(publicInbox),
+					allowPrivateAddress
+				});
+				if (allowPrivateAddress) {
+					await send();
+					const calls = esm_default.callHistory.calls(privateInbox);
+					assertEquals(calls.length, 1);
+					const request = calls[0].request;
+					const preservesBody = signed || status === 307 || status === 308;
+					assertEquals(request.method, preservesBody ? "POST" : "GET");
+					assertEquals(await request.clone().text(), preservesBody ? JSON.stringify(activity) : "");
+				} else {
+					await assertRejects(send, UrlError);
+					assertEquals(esm_default.callHistory.calls(privateInbox).length, 0);
+				}
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+		await t.step("rejects a private destination after a public redirect", async () => {
+			esm_default.mockGlobal().route(publicInbox, {
+				status: 307,
+				headers: { Location: "/next" }
+			}).route("https://8.8.8.8/next", {
+				status: 308,
+				headers: { Location: privateInbox }
+			}).route(privateInbox, 202);
+			try {
+				await assertRejects(() => sendActivity({
+					activity,
+					keys,
+					inbox: new URL(publicInbox)
+				}), UrlError);
+				assertEquals(esm_default.callHistory.calls(privateInbox).length, 0);
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+		await t.step("limits redirect loops", async () => {
+			esm_default.mockGlobal().route(publicInbox, {
+				status: 307,
+				headers: { Location: publicInbox }
+			});
+			try {
+				await assertRejects(() => sendActivity({
+					activity,
+					keys,
+					inbox: new URL(publicInbox)
+				}));
+				assert(esm_default.callHistory.calls().length <= 21);
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+		await t.step("allows a direct private inbox with opt-in", async () => {
+			esm_default.mockGlobal().route(privateInbox, 202);
+			try {
+				await sendActivity({
+					activity,
+					keys,
+					inbox: new URL(privateInbox),
+					allowPrivateAddress: true
+				});
+				assertEquals(esm_default.callHistory.calls(privateInbox).length, 1);
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+		await t.step("allows relative public redirects", async () => {
+			esm_default.mockGlobal().route(publicInbox, {
+				status: 307,
+				headers: { Location: "/next" }
+			}).route("https://8.8.8.8/next", 202);
+			try {
+				await sendActivity({
+					activity,
+					keys,
+					inbox: new URL(publicInbox)
+				});
+				assertEquals(esm_default.callHistory.calls("https://8.8.8.8/next").length, 1);
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+	});
+}
 //#endregion
 export {};

package/dist/federation/temporal.test.mjs

@@ -3,8 +3,8 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import "../std__assert-Duiq_YC9.mjs";
 import { n as assertFalse } from "../assert_rejects-B-qJtC9Z.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "../temporal-G_GDghC-.mjs";
+import { t as assert } from "../assert-BhQd8QHP.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "../temporal-Pmk5ouB1.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/temporal.test.ts
 test("hasMalformedKnownTemporalLiteral() detects expanded proof timestamps", async () => {

package/dist/federation/webfinger.test.mjs

@@ -4,8 +4,8 @@ globalThis.addEventListener = () => {};
 import { n as createRequestContext } from "../context-Juj6bdHC.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-Duiq_YC9.mjs";
-import { t as MemoryKvStore } from "../kv-tL2TOE9X.mjs";
-import { a as createFederation, o as handleWebFinger } from "../middleware-D2O8b03q.mjs";
+import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
+import { a as createFederation, o as handleWebFinger } from "../middleware-Dy18K1xP.mjs";
 import { test } from "@fedify/fixture";
 import { Image, Link, Person } from "@fedify/vocab";
 //#region src/federation/webfinger.test.ts

package/dist/{http-Yoq0YGz7.cjs → http-7FmLhLDv.cjs}

@@ -5,13 +5,13 @@ let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
 let byte_encodings_hex = require("byte-encodings/hex");
-let structured_field_values = require("structured-field-values");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
+let structured_field_values = require("structured-field-values");
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 let byte_encodings_base64 = require("byte-encodings/base64");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.1.23";
+var version = "2.1.24";
 //#endregion
 //#region src/sig/accept.ts
 /**
@@ -231,6 +231,118 @@ async function importJwk(jwk, type) {
 	validateCryptoKey(key, type);
 	return key;
 }
+/**
+* Fetches the document that the given actor URI dereferences to, and returns
+* the actor only if the host that served the document is authoritative for
+* the id the document claims.
+*
+* Only the origin that serves an actor id can speak for it.  Without that
+* rule any host could serve a document describing somebody else's actor—and
+* listing its own keys as that actor's.
+*
+* @param actorId The URI of the actor to fetch.
+* @param options Options for fetching the document.
+* @returns The actor, or `null` if the document cannot be fetched, is not an
+*          actor, or belongs to another origin.
+* @internal
+*/
+async function fetchActorDocument(actorId, options = {}) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const documentLoader = options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
+	const contextLoader = options.contextLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
+	const { tracerProvider } = options;
+	let document;
+	let documentUrl = actorId;
+	try {
+		const remoteDocument = await documentLoader(actorId.href);
+		document = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", actorId);
+	} catch (error) {
+		logger.debug("Failed to fetch the actor {actorId}: {error}", {
+			actorId: actorId.href,
+			error
+		});
+		return null;
+	}
+	let object;
+	try {
+		object = await _fedify_vocab.Object.fromJsonLd(document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider,
+			baseUrl: documentUrl
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.debug("The document served at {documentUrl} is not a valid object: {error}", {
+			documentUrl: documentUrl.href,
+			error
+		});
+		return null;
+	}
+	if (!(0, _fedify_vocab.isActor)(object)) return null;
+	if (object.id == null || object.id.origin !== documentUrl.origin) {
+		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as that actor's document.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href
+		});
+		return null;
+	}
+	return object;
+}
+/**
+* Resolves the owner that the given key claims, and returns it only if the
+* claim holds.
+*
+* The `owner` of a {@link CryptographicKey}, like the `controller` of
+* a {@link Multikey}, proves nothing on its own: the key document and the
+* claim inside it are served by the same host, so anyone able to serve a key
+* document can name any actor in the world as its owner.  The claim becomes
+* meaningful only once the named actor's own document is fetched and turns
+* out to link back to the key.  This function performs that mutual-link
+* check, which is the only sound way to learn a fetched key's owner.
+*
+* The claimed owner is always dereferenced, never read out of the key
+* document: an owner embedded there is written by whoever wrote the key.
+*
+* @param key The key whose ownership claim is to be verified.  It must carry
+*            an `id`, as that is what the owner has to link back to.
+* @param options Options for fetching the claimed owner.
+* @returns The verified owner, or `null` if the key claims no owner, the
+*          owner cannot be fetched, or the owner does not link back to
+*          the key.
+* @internal
+*/
+async function verifyKeyOwnership(key, options = {}) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const keyId = key.id;
+	if (keyId == null) return null;
+	const claimedOwnerId = key instanceof _fedify_vocab.CryptographicKey ? key.ownerId : key.controllerId;
+	if (claimedOwnerId == null) return null;
+	const owner = await fetchActorDocument(claimedOwnerId, options);
+	if (owner == null) {
+		logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims could not be resolved.", {
+			keyId: keyId.href,
+			claimedOwnerId: claimedOwnerId.href
+		});
+		return null;
+	}
+	const linkedKeyIds = key instanceof _fedify_vocab.CryptographicKey ? owner.publicKeyIds : owner.assertionMethodIds;
+	for (const linkedKeyId of linkedKeyIds) if (linkedKeyId.href === keyId.href) return owner;
+	logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims does not list the key as its own.", {
+		keyId: keyId.href,
+		claimedOwnerId: claimedOwnerId.href
+	});
+	return null;
+}
 async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 	tracerProvider ??= _opentelemetry_api.trace.getTracerProvider();
 	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.fetch_key", {
@@ -358,7 +470,7 @@ async function getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger) {
 async function clearFetchErrorMetadata(keyId, keyCache) {
 	await keyCache?.setFetchError?.(keyId, null);
 }
-async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider }, logger) {
+async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider }, logger) {
 	let object;
 	try {
 		object = await _fedify_vocab.Object.fromJsonLd(document, {
@@ -388,8 +500,22 @@ async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoade
 		}
 	}
 	let key = null;
-	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object;
+	let ownerDocument = null;
+	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
 	else if ((0, _fedify_vocab.isActor)(object)) {
+		if (object.id == null || object.id.origin !== documentUrl.origin) {
+			logger.debug("Failed to verify; the document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin.", {
+				keyId,
+				documentUrl: documentUrl.href,
+				actorId: object.id?.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+		ownerDocument = object;
 		const keys = cls === _fedify_vocab.CryptographicKey ? object.getPublicKeys({
 			documentLoader,
 			contextLoader,
@@ -451,6 +577,25 @@ async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoade
 			cached: false
 		};
 	}
+	const claimedOwnerId = key instanceof _fedify_vocab.CryptographicKey ? key.ownerId : key.controllerId;
+	if (ownerDocument != null && claimedOwnerId == null) key = key instanceof _fedify_vocab.CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
+	else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
+		if (await verifyKeyOwnership(key, {
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		}) == null) {
+			logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
+				keyId,
+				claimedOwnerId: claimedOwnerId.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+	}
 	if (keyCache != null) {
 		await keyCache.set(cacheKey, key);
 		logger.debug("Key {keyId} cached.", { keyId });
@@ -474,12 +619,15 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 	if (cached != null) return cached;
 	logger.debug("Fetching key {keyId} to verify signature...", { keyId });
 	let document;
+	let documentUrl = cacheKey;
 	try {
-		document = (await (options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)())(keyId)).document;
+		const remoteDocument = await (options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)())(keyId);
+		document = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", cacheKey);
 	} catch (error) {
 		return await onFetchError(error, cacheKey, keyId, keyCache, logger);
 	}
-	return await resolveFetchedKey(document, cacheKey, keyId, cls, options, logger);
+	return await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
 }
 async function fetchKeyInternal(keyId, cls, options = {}) {
 	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
@@ -1544,6 +1692,12 @@ Object.defineProperty(exports, "exportJwk", {
 		return exportJwk;
 	}
 });
+Object.defineProperty(exports, "fetchActorDocument", {
+	enumerable: true,
+	get: function() {
+		return fetchActorDocument;
+	}
+});
 Object.defineProperty(exports, "fetchKey", {
 	enumerable: true,
 	get: function() {
@@ -1616,6 +1770,12 @@ Object.defineProperty(exports, "validateCryptoKey", {
 		return validateCryptoKey;
 	}
 });
+Object.defineProperty(exports, "verifyKeyOwnership", {
+	enumerable: true,
+	get: function() {
+		return verifyKeyOwnership;
+	}
+});
 Object.defineProperty(exports, "verifyRequest", {
 	enumerable: true,
 	get: function() {