@fedify/fedify 2.2.17 → 2.2.18

package/dist/{middleware-5qLdPLro.mjs → middleware-CHoUjmJm.mjs}

@@ -2,25 +2,26 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as RouterError } from "./router-CrMLXoOr.mjs";
-import { n as version, t as name } from "./deno-Cya0rbEr.mjs";
+import { n as version, t as name } from "./deno-JUTr6LYC.mjs";
 import { t as formatAcceptSignature } from "./accept-Dd__NiUL.mjs";
-import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-BMHNd0gP.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-dobCLGG2.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-Dz0Z1Y07.mjs";
+import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-D0ahOVjf.mjs";
+import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-lCmKCZBI.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-BGjq1F5U.mjs";
 import { n as kvCache } from "./kv-cache-FsT1ljhs.mjs";
 import { t as KvKeyCache } from "./keycache-Dkc_sflV.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-B_m0qw8j.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-Dk85kXZz.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-CJOXIehz.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-BUTMEkbn.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-amccRMrV.mjs";
-import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-DrGrnZVE.mjs";
+import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-DS1Zl6BX.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-9F_u23dc.mjs";
 import { t as nodeInfoToJson } from "./types-J53Kw7so.mjs";
-import { t as FederationBuilderImpl } from "./builder-a-kl29PE.mjs";
+import { t as FederationBuilderImpl } from "./builder-DAbQyxmb.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-D-HqUuA2.mjs";
-import { t as acceptsJsonLd } from "./negotiation-BHtZN6Y1.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-Bnwa_2NC.mjs";
-import { t as createExponentialBackoffPolicy } from "./retry-bMXBL97A.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-Co-E7yJn.mjs";
+import { n as routeActivity, t as actorsHaveSameOrigin } from "./inbox-DMATfdEI.mjs";
+import { t as acceptsJsonLd } from "./negotiation-SQvQgUqe.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-Biz6zK6e.mjs";
+import { t as createExponentialBackoffPolicy } from "./retry-v_sGLH1d.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-fnPrh9Zm.mjs";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
@@ -154,147 +155,6 @@ function handleNodeInfoJrd(_request, context) {
 	return Promise.resolve(response);
 }
 //#endregion
-//#region src/federation/inbox.ts
-async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, tracerProvider, idempotencyStrategy }) {
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	let cacheKey = null;
-	if (activity.id != null) {
-		const inboxContext = inboxContextFactory(recipient, json, activity.id?.href, getTypeId(activity).href);
-		const strategy = idempotencyStrategy ?? "per-inbox";
-		let keyString;
-		if (typeof strategy === "function") keyString = await strategy(inboxContext, activity);
-		else switch (strategy) {
-			case "global":
-				keyString = activity.id.href;
-				break;
-			case "per-origin":
-				keyString = `${ctx.origin}\n${activity.id.href}`;
-				break;
-			case "per-inbox":
-				keyString = `${ctx.origin}\n${activity.id.href}\n${recipient == null ? "sharedInbox" : `inbox\n${recipient}`}`;
-				break;
-			default: keyString = `${ctx.origin}\n${activity.id.href}`;
-		}
-		if (keyString != null) cacheKey = [...kvPrefixes.activityIdempotence, keyString];
-	}
-	if (cacheKey != null) {
-		if (await kv.get(cacheKey) === true) {
-			logger.debug("Activity {activityId} has already been processed.", {
-				activityId: activity.id?.href,
-				activity: json,
-				recipient
-			});
-			span.setStatus({
-				code: SpanStatusCode.UNSET,
-				message: `Activity ${activity.id?.href} has already been processed.`
-			});
-			return "alreadyProcessed";
-		}
-	}
-	if (activity.actorId == null) {
-		logger.error("Missing actor.", { activity: json });
-		span.setStatus({
-			code: SpanStatusCode.ERROR,
-			message: "Missing actor."
-		});
-		return "missingActor";
-	}
-	span.setAttribute("activitypub.actor.id", activity.actorId.href);
-	if (queue != null) {
-		const carrier = {};
-		propagation.inject(context.active(), carrier);
-		try {
-			await queue.enqueue({
-				type: "inbox",
-				id: crypto.randomUUID(),
-				baseUrl: ctx.origin,
-				activity: originalJson ?? json,
-				...normalizedActivity == null ? {} : { normalizedActivity },
-				...ldSignatureVerified == null ? {} : { ldSignatureVerified },
-				identifier: recipient,
-				attempt: 0,
-				started: (/* @__PURE__ */ new Date()).toISOString(),
-				traceContext: carrier
-			});
-		} catch (error) {
-			logger.error("Failed to enqueue the incoming activity {activityId}:\n{error}", {
-				error,
-				activityId: activity.id?.href,
-				activity: json,
-				recipient
-			});
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: `Failed to enqueue the incoming activity ${activity.id?.href}.`
-			});
-			throw error;
-		}
-		logger.info("Activity {activityId} is enqueued.", {
-			activityId: activity.id?.href,
-			activity: json,
-			recipient
-		});
-		return "enqueued";
-	}
-	tracerProvider = tracerProvider ?? trace.getTracerProvider();
-	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.dispatch_inbox_listener", { kind: SpanKind.INTERNAL }, async (span) => {
-		const dispatched = inboxListeners?.dispatchWithClass(activity);
-		if (dispatched == null) {
-			logger.error("Unsupported activity type:\n{activity}", {
-				activity: json,
-				recipient
-			});
-			span.setStatus({
-				code: SpanStatusCode.UNSET,
-				message: `Unsupported activity type: ${getTypeId(activity).href}`
-			});
-			span.end();
-			return "unsupportedActivity";
-		}
-		const { class: cls, listener } = dispatched;
-		span.updateName(`activitypub.dispatch_inbox_listener ${cls.name}`);
-		try {
-			const contextFactory = listenerInboxContextFactory ?? inboxContextFactory;
-			await listener(contextFactory(recipient, contextFactory === inboxContextFactory ? json : originalJson ?? json, activity?.id?.href, getTypeId(activity).href), activity);
-		} catch (error) {
-			try {
-				await inboxErrorHandler?.(ctx, error);
-			} catch (error) {
-				logger.error("An unexpected error occurred in inbox error handler:\n{error}", {
-					error,
-					activityId: activity.id?.href,
-					activity: json,
-					recipient
-				});
-			}
-			logger.error("Failed to process the incoming activity {activityId}:\n{error}", {
-				error,
-				activityId: activity.id?.href,
-				activity: json,
-				recipient
-			});
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			span.end();
-			return "error";
-		}
-		if (cacheKey != null) await kv.set(cacheKey, true, { ttl: Temporal.Duration.from({ days: 1 }) });
-		logger.info("Activity {activityId} has been processed.", {
-			activityId: activity.id?.href,
-			activity: json,
-			recipient
-		});
-		span.end();
-		return "success";
-	});
-}
-//#endregion
 //#region src/federation/handler.ts
 const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
 function isRemoteContextLoadingFailure$1(error) {
@@ -1160,6 +1020,36 @@ async function handleInboxInternal(request, parameters, span) {
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
 	}
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", {
+			activity: json,
+			recipient
+		});
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		return new Response("Missing actor.", {
+			status: 400,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
+	if (!skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+		logger.error("The activity ({activityId}) and its actors do not have the same origin.", {
+			activity: json,
+			recipient,
+			activityId: activity.id.href,
+			actorIds: activity.actorIds.map((actor) => actor.href)
+		});
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+		});
+		return new Response("The activity and its actors do not have the same origin.", {
+			status: 401,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 	const routeResult = await routeActivity({
 		context: ctx,
 		json,
@@ -2360,6 +2250,33 @@ var FederationImpl = class extends FederationBuilderImpl {
 				activity = await Activity.fromJsonLd(parseInput, parseContext);
 				span.setAttribute("activitypub.activity.type", getTypeId(activity).href);
 				if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
+				if (activity.actorId == null) {
+					logger.error("Missing actor in queued incoming activity.", {
+						activityId: activity.id?.href,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: "Missing actor."
+					});
+					span.end();
+					return;
+				}
+				if (!this.skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+					logger.error("The queued activity ({activityId}) and its actors do not have the same origin.", {
+						activityId: activity.id.href,
+						actorIds: activity.actorIds.map((actor) => actor.href),
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+					});
+					span.end();
+					return;
+				}
 				cacheKey = activity.id == null ? null : [
 					...this.kvPrefixes.activityIdempotence,
 					context.origin,
@@ -3521,20 +3438,6 @@ var ContextImpl = class ContextImpl {
 					activity: await fetched.toJsonLd({ contextLoader })
 				});
 				return false;
-			} else if (fetched.actorIds.length < 1) {
-				logger.debug("Fetched activity object is missing an actor; unable to verify.", {
-					recipient,
-					activity: await fetched.toJsonLd({ contextLoader })
-				});
-				return false;
-			}
-			const activityId = fetched.id;
-			if (!fetched.actorIds.every((actor) => actor.origin === activityId.origin)) {
-				logger.debug("Fetched activity object has actors from different origins; unable to verify.", {
-					recipient,
-					activity: await fetched.toJsonLd({ contextLoader })
-				});
-				return false;
 			}
 			logger.debug("Successfully fetched the remote activity object {activityId}; ignore the original activity and use the fetched one, which is trustworthy.");
 			activity = fetched;
@@ -3543,6 +3446,20 @@ var ContextImpl = class ContextImpl {
 			recipient,
 			activity: json
 		});
+		if (activity.actorId == null) {
+			logger.debug("Activity is missing an actor; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
+		if (activity.id != null && !actorsHaveSameOrigin(activity)) {
+			logger.debug("Activity has actors from different origins; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
 		const routeResult = await routeActivity({
 			context: this,
 			json,

package/dist/{middleware-ZKHfZ7zj.cjs → middleware-D3hx1aiI.cjs}

@@ -1,4 +1,4 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
-const require_middleware = require("./middleware-C7mI18WE.cjs");
+const require_middleware = require("./middleware-QcuVRA-q.cjs");
 exports.FederationImpl = require_middleware.FederationImpl;

package/dist/{middleware-C7mI18WE.cjs → middleware-QcuVRA-q.cjs}

@@ -2,10 +2,10 @@ const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 const require_chunk = require("./chunk-DDcVe30Y.cjs");
 const require_transformers = require("./transformers-NeAONrAq.cjs");
-const require_http = require("./http-C_aA2Zx1.cjs");
+const require_http = require("./http-DEH_eppX.cjs");
 const require_types = require("./types-DRPjmHVV.cjs");
-const require_proof = require("./proof-ClpE9zhD.cjs");
-const require_kv_cache = require("./kv-cache-Btp4kC_U.cjs");
+const require_proof = require("./proof-BeY7TsiS.cjs");
+const require_kv_cache = require("./kv-cache-CPEV_4nZ.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
@@ -213,7 +213,7 @@ var FederationBuilderImpl = class {
 		this.collectionTypeIds = {};
 	}
 	async build(options) {
-		const { FederationImpl } = await Promise.resolve().then(() => require("./middleware-ZKHfZ7zj.cjs"));
+		const { FederationImpl } = await Promise.resolve().then(() => require("./middleware-D3hx1aiI.cjs"));
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();
@@ -782,12 +782,33 @@ async function buildCollectionSynchronizationHeader(collectionId, actorIds) {
 }
 //#endregion
 //#region src/federation/inbox.ts
+/**
+* Checks whether an activity's ID and all of its actor IDs have the same
+* non-opaque origin.  Activities without an ID have no origin to authenticate.
+*
+* The caller is responsible for rejecting a missing primary actor ID before
+* relying on this check.
+* @internal
+*/
+function actorsHaveSameOrigin(activity) {
+	if (activity.id == null) return true;
+	const origin = activity.id.origin;
+	return origin !== "null" && activity.actorIds.every((actor) => actor.origin === origin);
+}
 async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, tracerProvider, idempotencyStrategy }) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", { activity: json });
+		span.setStatus({
+			code: _opentelemetry_api.SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		return "missingActor";
+	}
 	let cacheKey = null;
 	if (activity.id != null) {
 		const inboxContext = inboxContextFactory(recipient, json, activity.id?.href, (0, _fedify_vocab.getTypeId)(activity).href);
@@ -822,14 +843,6 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 			return "alreadyProcessed";
 		}
 	}
-	if (activity.actorId == null) {
-		logger.error("Missing actor.", { activity: json });
-		span.setStatus({
-			code: _opentelemetry_api.SpanStatusCode.ERROR,
-			message: "Missing actor."
-		});
-		return "missingActor";
-	}
 	span.setAttribute("activitypub.actor.id", activity.actorId.href);
 	if (queue != null) {
 		const carrier = {};
@@ -2059,6 +2072,36 @@ async function handleInboxInternal(request, parameters, span) {
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
 	}
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", {
+			activity: json,
+			recipient
+		});
+		span.setStatus({
+			code: _opentelemetry_api.SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		return new Response("Missing actor.", {
+			status: 400,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
+	if (!skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+		logger.error("The activity ({activityId}) and its actors do not have the same origin.", {
+			activity: json,
+			recipient,
+			activityId: activity.id.href,
+			actorIds: activity.actorIds.map((actor) => actor.href)
+		});
+		span.setStatus({
+			code: _opentelemetry_api.SpanStatusCode.ERROR,
+			message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+		});
+		return new Response("The activity and its actors do not have the same origin.", {
+			status: 401,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 	const routeResult = await routeActivity({
 		context: ctx,
 		json,
@@ -3575,6 +3618,33 @@ var FederationImpl = class extends FederationBuilderImpl {
 				activity = await _fedify_vocab.Activity.fromJsonLd(parseInput, parseContext);
 				span.setAttribute("activitypub.activity.type", (0, _fedify_vocab.getTypeId)(activity).href);
 				if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
+				if (activity.actorId == null) {
+					logger.error("Missing actor in queued incoming activity.", {
+						activityId: activity.id?.href,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: _opentelemetry_api.SpanStatusCode.ERROR,
+						message: "Missing actor."
+					});
+					span.end();
+					return;
+				}
+				if (!this.skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+					logger.error("The queued activity ({activityId}) and its actors do not have the same origin.", {
+						activityId: activity.id.href,
+						actorIds: activity.actorIds.map((actor) => actor.href),
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: _opentelemetry_api.SpanStatusCode.ERROR,
+						message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+					});
+					span.end();
+					return;
+				}
 				cacheKey = activity.id == null ? null : [
 					...this.kvPrefixes.activityIdempotence,
 					context.origin,
@@ -4736,20 +4806,6 @@ var ContextImpl = class ContextImpl {
 					activity: await fetched.toJsonLd({ contextLoader })
 				});
 				return false;
-			} else if (fetched.actorIds.length < 1) {
-				logger.debug("Fetched activity object is missing an actor; unable to verify.", {
-					recipient,
-					activity: await fetched.toJsonLd({ contextLoader })
-				});
-				return false;
-			}
-			const activityId = fetched.id;
-			if (!fetched.actorIds.every((actor) => actor.origin === activityId.origin)) {
-				logger.debug("Fetched activity object has actors from different origins; unable to verify.", {
-					recipient,
-					activity: await fetched.toJsonLd({ contextLoader })
-				});
-				return false;
 			}
 			logger.debug("Successfully fetched the remote activity object {activityId}; ignore the original activity and use the fetched one, which is trustworthy.");
 			activity = fetched;
@@ -4758,6 +4814,20 @@ var ContextImpl = class ContextImpl {
 			recipient,
 			activity: json
 		});
+		if (activity.actorId == null) {
+			logger.debug("Activity is missing an actor; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
+		if (activity.id != null && !actorsHaveSameOrigin(activity)) {
+			logger.debug("Activity has actors from different origins; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
 		const routeResult = await routeActivity({
 			context: this,
 			json,

package/dist/{middleware-BchkzbpG.js → middleware-aNUajYPY.js}

@@ -2,10 +2,10 @@ import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./chunk-CRNNMoPX.js";
 import { r as getDefaultActivityTransformers } from "./transformers-BGMIq1cs.js";
-import { a as verifyRequestDetailed, d as importJwk, f as validateCryptoKey, i as verifyRequest, m as formatAcceptSignature, n as parseRfc9421SignatureInput, o as exportJwk, t as doubleKnock, v as name, y as version } from "./http-DkzPSl5o.js";
+import { a as verifyRequestDetailed, d as importJwk, f as validateCryptoKey, i as verifyRequest, m as formatAcceptSignature, n as parseRfc9421SignatureInput, o as exportJwk, t as doubleKnock, v as name, y as version } from "./http-OSYYhKM8.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-miAYfiGO.js";
-import { _ as hasSignatureLike, b as signJsonLd, c as getKeyOwner, f as compactJsonLd, g as hasSignature, h as getNormalizationContextLoader, i as verifyObject, l as InvalidContextReferenceError, m as detachSignature, n as hasProofLike, o as normalizeOutgoingActivityJsonLd, r as signObject, s as doesActorOwnKey, u as assertSafeJsonLd, v as isClearlyMalformedContextReference, w as wrapContextLoaderForJsonLd, x as verifyCompactJsonLd, y as isInvalidUrlTypeError } from "./proof-Bz6IdT2p.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DVhfMtqE.js";
+import { _ as hasSignatureLike, b as signJsonLd, c as getKeyOwner, f as compactJsonLd, g as hasSignature, h as getNormalizationContextLoader, i as verifyObject, l as InvalidContextReferenceError, m as detachSignature, n as hasProofLike, o as normalizeOutgoingActivityJsonLd, r as signObject, s as doesActorOwnKey, u as assertSafeJsonLd, v as isClearlyMalformedContextReference, w as wrapContextLoaderForJsonLd, x as verifyCompactJsonLd, y as isInvalidUrlTypeError } from "./proof-Bm3xyn3D.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-B7X4p1y7.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
@@ -781,12 +781,33 @@ async function buildCollectionSynchronizationHeader(collectionId, actorIds) {
 }
 //#endregion
 //#region src/federation/inbox.ts
+/**
+* Checks whether an activity's ID and all of its actor IDs have the same
+* non-opaque origin.  Activities without an ID have no origin to authenticate.
+*
+* The caller is responsible for rejecting a missing primary actor ID before
+* relying on this check.
+* @internal
+*/
+function actorsHaveSameOrigin(activity) {
+	if (activity.id == null) return true;
+	const origin = activity.id.origin;
+	return origin !== "null" && activity.actorIds.every((actor) => actor.origin === origin);
+}
 async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, tracerProvider, idempotencyStrategy }) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", { activity: json });
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		return "missingActor";
+	}
 	let cacheKey = null;
 	if (activity.id != null) {
 		const inboxContext = inboxContextFactory(recipient, json, activity.id?.href, getTypeId(activity).href);
@@ -821,14 +842,6 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 			return "alreadyProcessed";
 		}
 	}
-	if (activity.actorId == null) {
-		logger.error("Missing actor.", { activity: json });
-		span.setStatus({
-			code: SpanStatusCode.ERROR,
-			message: "Missing actor."
-		});
-		return "missingActor";
-	}
 	span.setAttribute("activitypub.actor.id", activity.actorId.href);
 	if (queue != null) {
 		const carrier = {};
@@ -2058,6 +2071,36 @@ async function handleInboxInternal(request, parameters, span) {
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
 	}
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", {
+			activity: json,
+			recipient
+		});
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		return new Response("Missing actor.", {
+			status: 400,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
+	if (!skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+		logger.error("The activity ({activityId}) and its actors do not have the same origin.", {
+			activity: json,
+			recipient,
+			activityId: activity.id.href,
+			actorIds: activity.actorIds.map((actor) => actor.href)
+		});
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+		});
+		return new Response("The activity and its actors do not have the same origin.", {
+			status: 401,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 	const routeResult = await routeActivity({
 		context: ctx,
 		json,
@@ -3582,6 +3625,33 @@ var FederationImpl = class extends FederationBuilderImpl {
 				activity = await Activity.fromJsonLd(parseInput, parseContext);
 				span.setAttribute("activitypub.activity.type", getTypeId(activity).href);
 				if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
+				if (activity.actorId == null) {
+					logger.error("Missing actor in queued incoming activity.", {
+						activityId: activity.id?.href,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: "Missing actor."
+					});
+					span.end();
+					return;
+				}
+				if (!this.skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+					logger.error("The queued activity ({activityId}) and its actors do not have the same origin.", {
+						activityId: activity.id.href,
+						actorIds: activity.actorIds.map((actor) => actor.href),
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+					});
+					span.end();
+					return;
+				}
 				cacheKey = activity.id == null ? null : [
 					...this.kvPrefixes.activityIdempotence,
 					context.origin,
@@ -4743,20 +4813,6 @@ var ContextImpl = class ContextImpl {
 					activity: await fetched.toJsonLd({ contextLoader })
 				});
 				return false;
-			} else if (fetched.actorIds.length < 1) {
-				logger.debug("Fetched activity object is missing an actor; unable to verify.", {
-					recipient,
-					activity: await fetched.toJsonLd({ contextLoader })
-				});
-				return false;
-			}
-			const activityId = fetched.id;
-			if (!fetched.actorIds.every((actor) => actor.origin === activityId.origin)) {
-				logger.debug("Fetched activity object has actors from different origins; unable to verify.", {
-					recipient,
-					activity: await fetched.toJsonLd({ contextLoader })
-				});
-				return false;
 			}
 			logger.debug("Successfully fetched the remote activity object {activityId}; ignore the original activity and use the fetched one, which is trustworthy.");
 			activity = fetched;
@@ -4765,6 +4821,20 @@ var ContextImpl = class ContextImpl {
 			recipient,
 			activity: json
 		});
+		if (activity.actorId == null) {
+			logger.debug("Activity is missing an actor; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
+		if (activity.id != null && !actorsHaveSameOrigin(activity)) {
+			logger.debug("Activity has actors from different origins; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
 		const routeResult = await routeActivity({
 			context: this,
 			json,

package/dist/mod.cjs

@@ -4,11 +4,11 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-DDcVe30Y.cjs");
 const require_transformers = require("./transformers-NeAONrAq.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-C_aA2Zx1.cjs");
-const require_middleware = require("./middleware-C7mI18WE.cjs");
+const require_http = require("./http-DEH_eppX.cjs");
+const require_middleware = require("./middleware-QcuVRA-q.cjs");
 const require_types = require("./types-DRPjmHVV.cjs");
-const require_proof = require("./proof-ClpE9zhD.cjs");
-const require_kv_cache = require("./kv-cache-Btp4kC_U.cjs");
+const require_proof = require("./proof-BeY7TsiS.cjs");
+const require_kv_cache = require("./kv-cache-CPEV_4nZ.cjs");
 const require_federation_mod = require("./federation/mod.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");