@fedify/fedify 2.2.12 → 2.2.14-dev.2082

package/dist/{key-B4kUuy3o.mjs → key-DiziIx9e.mjs}

@@ -1,7 +1,7 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-DeYUdFal.mjs";
+import { n as version, t as name } from "./deno-CV4wsQzy.mjs";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, getDocumentLoader } from "@fedify/vocab-runtime";
@@ -85,6 +85,118 @@ async function importJwk(jwk, type) {
 	validateCryptoKey(key, type);
 	return key;
 }
+/**
+* Fetches the document that the given actor URI dereferences to, and returns
+* the actor only if the host that served the document is authoritative for
+* the id the document claims.
+*
+* Only the origin that serves an actor id can speak for it.  Without that
+* rule any host could serve a document describing somebody else's actor—and
+* listing its own keys as that actor's.
+*
+* @param actorId The URI of the actor to fetch.
+* @param options Options for fetching the document.
+* @returns The actor, or `null` if the document cannot be fetched, is not an
+*          actor, or belongs to another origin.
+* @internal
+*/
+async function fetchActorDocument(actorId, options = {}) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const contextLoader = options.contextLoader ?? getDocumentLoader();
+	const { tracerProvider } = options;
+	let document;
+	let documentUrl = actorId;
+	try {
+		const remoteDocument = await documentLoader(actorId.href);
+		document = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", actorId);
+	} catch (error) {
+		logger.debug("Failed to fetch the actor {actorId}: {error}", {
+			actorId: actorId.href,
+			error
+		});
+		return null;
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider,
+			baseUrl: documentUrl
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.debug("The document served at {documentUrl} is not a valid object: {error}", {
+			documentUrl: documentUrl.href,
+			error
+		});
+		return null;
+	}
+	if (!isActor(object)) return null;
+	if (object.id == null || object.id.origin !== documentUrl.origin) {
+		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as that actor's document.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href
+		});
+		return null;
+	}
+	return object;
+}
+/**
+* Resolves the owner that the given key claims, and returns it only if the
+* claim holds.
+*
+* The `owner` of a {@link CryptographicKey}, like the `controller` of
+* a {@link Multikey}, proves nothing on its own: the key document and the
+* claim inside it are served by the same host, so anyone able to serve a key
+* document can name any actor in the world as its owner.  The claim becomes
+* meaningful only once the named actor's own document is fetched and turns
+* out to link back to the key.  This function performs that mutual-link
+* check, which is the only sound way to learn a fetched key's owner.
+*
+* The claimed owner is always dereferenced, never read out of the key
+* document: an owner embedded there is written by whoever wrote the key.
+*
+* @param key The key whose ownership claim is to be verified.  It must carry
+*            an `id`, as that is what the owner has to link back to.
+* @param options Options for fetching the claimed owner.
+* @returns The verified owner, or `null` if the key claims no owner, the
+*          owner cannot be fetched, or the owner does not link back to
+*          the key.
+* @internal
+*/
+async function verifyKeyOwnership(key, options = {}) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const keyId = key.id;
+	if (keyId == null) return null;
+	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
+	if (claimedOwnerId == null) return null;
+	const owner = await fetchActorDocument(claimedOwnerId, options);
+	if (owner == null) {
+		logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims could not be resolved.", {
+			keyId: keyId.href,
+			claimedOwnerId: claimedOwnerId.href
+		});
+		return null;
+	}
+	const linkedKeyIds = key instanceof CryptographicKey ? owner.publicKeyIds : owner.assertionMethodIds;
+	for (const linkedKeyId of linkedKeyIds) if (linkedKeyId.href === keyId.href) return owner;
+	logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims does not list the key as its own.", {
+		keyId: keyId.href,
+		claimedOwnerId: claimedOwnerId.href
+	});
+	return null;
+}
 async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 	tracerProvider ??= trace.getTracerProvider();
 	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.fetch_key", {
@@ -212,7 +324,7 @@ async function getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger) {
 async function clearFetchErrorMetadata(keyId, keyCache) {
 	await keyCache?.setFetchError?.(keyId, null);
 }
-async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider }, logger) {
+async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider }, logger) {
 	let object;
 	try {
 		object = await Object$1.fromJsonLd(document, {
@@ -242,8 +354,22 @@ async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoade
 		}
 	}
 	let key = null;
-	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object;
+	let ownerDocument = null;
+	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
 	else if (isActor(object)) {
+		if (object.id == null || object.id.origin !== documentUrl.origin) {
+			logger.debug("Failed to verify; the document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin.", {
+				keyId,
+				documentUrl: documentUrl.href,
+				actorId: object.id?.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+		ownerDocument = object;
 		const keys = cls === CryptographicKey ? object.getPublicKeys({
 			documentLoader,
 			contextLoader,
@@ -305,6 +431,25 @@ async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoade
 			cached: false
 		};
 	}
+	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
+	if (ownerDocument != null && claimedOwnerId == null) key = key instanceof CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
+	else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
+		if (await verifyKeyOwnership(key, {
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		}) == null) {
+			logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
+				keyId,
+				claimedOwnerId: claimedOwnerId.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+	}
 	if (keyCache != null) {
 		await keyCache.set(cacheKey, key);
 		logger.debug("Key {keyId} cached.", { keyId });
@@ -328,12 +473,15 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 	if (cached != null) return cached;
 	logger.debug("Fetching key {keyId} to verify signature...", { keyId });
 	let document;
+	let documentUrl = cacheKey;
 	try {
-		document = (await (options.documentLoader ?? getDocumentLoader())(keyId)).document;
+		const remoteDocument = await (options.documentLoader ?? getDocumentLoader())(keyId);
+		document = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", cacheKey);
 	} catch (error) {
 		return await onFetchError(error, cacheKey, keyId, keyCache, logger);
 	}
-	return await resolveFetchedKey(document, cacheKey, keyId, cls, options, logger);
+	return await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
 }
 async function fetchKeyInternal(keyId, cls, options = {}) {
 	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
@@ -359,4 +507,4 @@ async function fetchKeyInternal(keyId, cls, options = {}) {
 	});
 }
 //#endregion
-export { importJwk as a, generateCryptoKeyPair as i, fetchKey as n, validateCryptoKey as o, fetchKeyDetailed as r, exportJwk as t };
+export { generateCryptoKeyPair as a, verifyKeyOwnership as c, fetchKeyDetailed as i, fetchActorDocument as n, importJwk as o, fetchKey as r, validateCryptoKey as s, exportJwk as t };

package/dist/{keycache-EGATflN-.mjs → keycache-C1aVprwy.mjs}

@@ -3,6 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 //#region src/federation/keycache.ts
+const KEY_CACHE_GENERATION = "2";
 var KvKeyCache = class {
 	kv;
 	prefix;
@@ -23,13 +24,20 @@ var KvKeyCache = class {
 			keyId.href
 		];
 	}
+	#entryKey(keyId) {
+		return [
+			...this.prefix,
+			KEY_CACHE_GENERATION,
+			keyId.href
+		];
+	}
 	async get(keyId) {
 		const negativeExpiration = this.nullKeys.get(keyId.href);
 		if (negativeExpiration != null) {
 			if (Temporal.Now.instant().until(negativeExpiration).sign >= 0) return null;
 			this.nullKeys.delete(keyId.href);
 		}
-		const serialized = await this.kv.get([...this.prefix, keyId.href]);
+		const serialized = await this.kv.get(this.#entryKey(keyId));
 		if (serialized === void 0) return void 0;
 		if (serialized === null) {
 			this.nullKeys.set(keyId.href, Temporal.Now.instant().add(this.unavailableKeyTtl));
@@ -41,7 +49,7 @@ var KvKeyCache = class {
 			try {
 				return await Multikey.fromJsonLd(serialized, this.options);
 			} catch {
-				await this.kv.delete([...this.prefix, keyId.href]);
+				await this.kv.delete(this.#entryKey(keyId));
 				return;
 			}
 		}
@@ -49,12 +57,12 @@ var KvKeyCache = class {
 	async set(keyId, key) {
 		if (key == null) {
 			this.nullKeys.set(keyId.href, Temporal.Now.instant().add(this.unavailableKeyTtl));
-			await this.kv.set([...this.prefix, keyId.href], null, { ttl: this.unavailableKeyTtl });
+			await this.kv.set(this.#entryKey(keyId), null, { ttl: this.unavailableKeyTtl });
 			return;
 		}
 		this.nullKeys.delete(keyId.href);
 		const serialized = await key.toJsonLd(this.options);
-		await this.kv.set([...this.prefix, keyId.href], serialized);
+		await this.kv.set(this.#entryKey(keyId), serialized);
 	}
 	async getFetchError(keyId) {
 		const cached = await this.kv.get(this.#getFetchErrorKey(keyId));

package/dist/{kv-cache-CIZ1m-94.js → kv-cache-CM-zJoep.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { d as validateCryptoKey, t as doubleKnock } from "./http-CNsxTbVr.js";
+import { f as validateCryptoKey, t as doubleKnock } from "./http-C5T-lWqB.js";
 import { getLogger } from "@logtape/logtape";
 import { curry } from "es-toolkit";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";

package/dist/{kv-cache-BtXEUvHT.cjs → kv-cache-DGPEHc1T.cjs}

@@ -1,7 +1,7 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 require("./chunk-DDcVe30Y.cjs");
-const require_http = require("./http-D6cIKrI1.cjs");
+const require_http = require("./http-BWNuy1sb.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let es_toolkit = require("es-toolkit");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");

package/dist/{ld-2R9vZ_ym.mjs → ld-BAeuDKjx.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-DeYUdFal.mjs";
-import { n as fetchKey, o as validateCryptoKey } from "./key-B4kUuy3o.mjs";
+import { n as version, t as name } from "./deno-CV4wsQzy.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-DiziIx9e.mjs";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { getDocumentLoader } from "@fedify/vocab-runtime";

package/dist/{middleware-CjrIRAsQ.cjs → middleware-BbbKc-Tr.cjs}

@@ -2,10 +2,10 @@ const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 const require_chunk = require("./chunk-DDcVe30Y.cjs");
 const require_transformers = require("./transformers-NeAONrAq.cjs");
-const require_http = require("./http-D6cIKrI1.cjs");
-const require_proof = require("./proof-CmtXtaul.cjs");
-const require_types = require("./types-m8u9L86X.cjs");
-const require_kv_cache = require("./kv-cache-BtXEUvHT.cjs");
+const require_http = require("./http-BWNuy1sb.cjs");
+const require_types = require("./types-DWs-qZaY.cjs");
+const require_proof = require("./proof-7T47tIu5.cjs");
+const require_kv_cache = require("./kv-cache-DGPEHc1T.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
@@ -212,7 +212,7 @@ var FederationBuilderImpl = class {
 		this.collectionTypeIds = {};
 	}
 	async build(options) {
-		const { FederationImpl } = await Promise.resolve().then(() => require("./middleware-2bSnAJOQ.cjs"));
+		const { FederationImpl } = await Promise.resolve().then(() => require("./middleware-XNvq3NUZ.cjs"));
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();
@@ -915,6 +915,7 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 }
 //#endregion
 //#region src/federation/keycache.ts
+const KEY_CACHE_GENERATION = "2";
 var KvKeyCache = class {
 	kv;
 	prefix;
@@ -935,13 +936,20 @@ var KvKeyCache = class {
 			keyId.href
 		];
 	}
+	#entryKey(keyId) {
+		return [
+			...this.prefix,
+			KEY_CACHE_GENERATION,
+			keyId.href
+		];
+	}
 	async get(keyId) {
 		const negativeExpiration = this.nullKeys.get(keyId.href);
 		if (negativeExpiration != null) {
 			if (Temporal.Now.instant().until(negativeExpiration).sign >= 0) return null;
 			this.nullKeys.delete(keyId.href);
 		}
-		const serialized = await this.kv.get([...this.prefix, keyId.href]);
+		const serialized = await this.kv.get(this.#entryKey(keyId));
 		if (serialized === void 0) return void 0;
 		if (serialized === null) {
 			this.nullKeys.set(keyId.href, Temporal.Now.instant().add(this.unavailableKeyTtl));
@@ -953,7 +961,7 @@ var KvKeyCache = class {
 			try {
 				return await _fedify_vocab.Multikey.fromJsonLd(serialized, this.options);
 			} catch {
-				await this.kv.delete([...this.prefix, keyId.href]);
+				await this.kv.delete(this.#entryKey(keyId));
 				return;
 			}
 		}
@@ -961,12 +969,12 @@ var KvKeyCache = class {
 	async set(keyId, key) {
 		if (key == null) {
 			this.nullKeys.set(keyId.href, Temporal.Now.instant().add(this.unavailableKeyTtl));
-			await this.kv.set([...this.prefix, keyId.href], null, { ttl: this.unavailableKeyTtl });
+			await this.kv.set(this.#entryKey(keyId), null, { ttl: this.unavailableKeyTtl });
 			return;
 		}
 		this.nullKeys.delete(keyId.href);
 		const serialized = await key.toJsonLd(this.options);
-		await this.kv.set([...this.prefix, keyId.href], serialized);
+		await this.kv.set(this.#entryKey(keyId), serialized);
 	}
 	async getFetchError(keyId) {
 		const cached = await this.kv.get(this.#getFetchErrorKey(keyId));
@@ -1687,8 +1695,16 @@ async function handleInboxInternal(request, parameters, span) {
 	}
 	let json;
 	try {
-		json = await request.clone().json();
+		json = JSON.parse(await require_types.readBoundedText(request.clone(), require_types.MAX_BODY_SIZE, request.url));
 	} catch (error) {
+		if (error instanceof require_types.BodyTooLargeError) {
+			request.body?.cancel(error).catch(() => {});
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			return new Response("Inbox body too large.", { status: 413 });
+		}
 		logger.error("Failed to parse JSON:\n{error}", {
 			recipient,
 			error
@@ -2705,18 +2721,31 @@ async function readLimitedResponseBody(response, maxBytes) {
 	if (truncated) result += "… (truncated)";
 	return result;
 }
-async function sendActivityInternal({ activity, activityId, keys, inbox, headers, specDeterminer, tracerProvider }, span) {
+async function sendActivityInternal({ activity, activityId, keys, inbox, allowPrivateAddress, headers, specDeterminer, tracerProvider }, span) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
 		"outbox"
 	]);
+	async function validateUrl(url) {
+		if (!allowPrivateAddress) try {
+			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
+		} catch (error) {
+			if (error instanceof _fedify_vocab_runtime.UrlError) logger.error("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
+	}
+	await validateUrl(inbox.href);
 	headers = new Headers(headers);
 	headers.set("Content-Type", "application/activity+json");
 	const request = new Request(inbox, {
 		method: "POST",
 		headers,
-		body: JSON.stringify(activity)
+		body: JSON.stringify(activity),
+		redirect: "manual"
 	});
 	let rsaKey = null;
 	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
@@ -2732,9 +2761,10 @@ async function sendActivityInternal({ activity, activityId, keys, inbox, headers
 	});
 	let response;
 	try {
-		response = rsaKey == null ? await fetch(request) : await require_http.doubleKnock(request, rsaKey, {
+		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await require_http.doubleKnock(request, rsaKey, {
 			tracerProvider,
-			specDeterminer
+			specDeterminer,
+			validateRedirect: validateUrl
 		});
 	} catch (error) {
 		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
@@ -2766,6 +2796,49 @@ async function sendActivityInternal({ activity, activityId, keys, inbox, headers
 		"activitypub.activity.id": activityId ?? ""
 	});
 }
+async function fetchWithValidatedRedirects(request, validateUrl) {
+	let body = await request.clone().text();
+	for (let redirects = 0;; redirects++) {
+		const response = await fetch(request, { redirect: "manual" });
+		const location = response.headers.get("Location");
+		if (![
+			301,
+			302,
+			303,
+			307,
+			308
+		].includes(response.status) || location == null) return response;
+		await response.body?.cancel();
+		if (redirects >= 20) throw new TypeError("Too many redirects");
+		const url = new URL(location, request.url);
+		await validateUrl(url.href);
+		const headers = new Headers(request.headers);
+		if (url.origin !== new URL(request.url).origin) {
+			headers.delete("Authorization");
+			headers.delete("Proxy-Authorization");
+			headers.delete("Cookie");
+			headers.delete("Host");
+		}
+		let method = request.method;
+		if ((response.status === 301 || response.status === 302) && method === "POST" || response.status === 303 && method !== "GET" && method !== "HEAD") {
+			method = "GET";
+			body = void 0;
+			for (const name of [
+				"Content-Encoding",
+				"Content-Language",
+				"Content-Length",
+				"Content-Location",
+				"Content-Type"
+			]) headers.delete(name);
+		}
+		request = new Request(url, {
+			method,
+			headers,
+			body,
+			redirect: "manual"
+		});
+	}
+}
 /**
 * An error that is thrown when an activity fails to send to a remote inbox.
 * It contains structured information about the failure, including the HTTP
@@ -3272,6 +3345,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		try {
 			await sendActivity({
+				allowPrivateAddress: this.allowPrivateAddress,
 				keys,
 				activity: message.activity,
 				activityId: message.activityId,
@@ -3666,6 +3740,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			const promises = [];
 			for (const inbox in inboxes) promises.push(sendActivity({
+				allowPrivateAddress: this.allowPrivateAddress,
 				keys,
 				activity: jsonLd,
 				activityId: activity.id?.href,
@@ -4848,6 +4923,7 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 		else logger.debug("Forwarding activity immediately without queue since queue is not set.");
 		const promises = [];
 		for (const inbox in inboxes) promises.push(sendActivity({
+			allowPrivateAddress: ctx.federation.allowPrivateAddress,
 			keys,
 			activity: ctx.activity,
 			activityId: ctx.activityId,

package/dist/{middleware-D5NE6PkU.mjs → middleware-CkJOjZjS.mjs}

@@ -2,25 +2,25 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as RouterError } from "./router-CrMLXoOr.mjs";
-import { n as version, t as name } from "./deno-DeYUdFal.mjs";
-import { t as formatAcceptSignature } from "./accept-CPkZzmGN.mjs";
-import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-B4kUuy3o.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-79lZeYEo.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-CXH2XqYP.mjs";
-import { n as kvCache } from "./kv-cache-DYsF2MhP.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-2R9vZ_ym.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CqYsVXcd.mjs";
-import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-CfUItkGW.mjs";
-import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-BzTt6nlk.mjs";
-import { t as getNodeInfo } from "./client-dx126nMS.mjs";
-import { t as nodeInfoToJson } from "./types-J53Kw7so.mjs";
-import { t as FederationBuilderImpl } from "./builder-TJzcpmDm.mjs";
-import { t as buildCollectionSynchronizationHeader } from "./collection-D-HqUuA2.mjs";
-import { t as KvKeyCache } from "./keycache-EGATflN-.mjs";
-import { t as acceptsJsonLd } from "./negotiation-SQvQgUqe.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-BYCnXIGk.mjs";
-import { t as createExponentialBackoffPolicy } from "./retry-v_sGLH1d.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-CZwOs7XD.mjs";
+import { n as version, t as name } from "./deno-CV4wsQzy.mjs";
+import { t as formatAcceptSignature } from "./accept-Dd__NiUL.mjs";
+import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-DiziIx9e.mjs";
+import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-C9MzFrOj.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-DV9F08Dn.mjs";
+import { n as kvCache } from "./kv-cache-FsT1ljhs.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-BAeuDKjx.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-D08_JUSb.mjs";
+import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-Dc2OXyB-.mjs";
+import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-_S-wFUFM.mjs";
+import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-CQ7zd8tW.mjs";
+import { t as nodeInfoToJson } from "./types-s4mCTGkT.mjs";
+import { t as FederationBuilderImpl } from "./builder-Cwgo1nK5.mjs";
+import { t as buildCollectionSynchronizationHeader } from "./collection-DnoYNwBC.mjs";
+import { t as KvKeyCache } from "./keycache-C1aVprwy.mjs";
+import { t as acceptsJsonLd } from "./negotiation-BHtZN6Y1.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-CX_L28b-.mjs";
+import { t as createExponentialBackoffPolicy } from "./retry-bMXBL97A.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-DmcKKipr.mjs";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
@@ -824,8 +824,16 @@ async function handleInboxInternal(request, parameters, span) {
 	}
 	let json;
 	try {
-		json = await request.clone().json();
+		json = JSON.parse(await readBoundedText(request.clone(), MAX_BODY_SIZE, request.url));
 	} catch (error) {
+		if (error instanceof BodyTooLargeError) {
+			request.body?.cancel(error).catch(() => {});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			return new Response("Inbox body too large.", { status: 413 });
+		}
 		logger.error("Failed to parse JSON:\n{error}", {
 			recipient,
 			error
@@ -2159,6 +2167,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		try {
 			await sendActivity({
+				allowPrivateAddress: this.allowPrivateAddress,
 				keys,
 				activity: message.activity,
 				activityId: message.activityId,
@@ -2553,6 +2562,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			const promises = [];
 			for (const inbox in inboxes) promises.push(sendActivity({
+				allowPrivateAddress: this.allowPrivateAddress,
 				keys,
 				activity: jsonLd,
 				activityId: activity.id?.href,
@@ -3735,6 +3745,7 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 		else logger.debug("Forwarding activity immediately without queue since queue is not set.");
 		const promises = [];
 		for (const inbox in inboxes) promises.push(sendActivity({
+			allowPrivateAddress: ctx.federation.allowPrivateAddress,
 			keys,
 			activity: ctx.activity,
 			activityId: ctx.activityId,

package/dist/{middleware-_qt3kHUU.mjs → middleware-DA2CvTQL.mjs}

@@ -1,5 +1,5 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-D5NE6PkU.mjs";
+import { n as FederationImpl } from "./middleware-CkJOjZjS.mjs";
 export { FederationImpl };