@fedify/fedify 2.2.19 → 2.2.20

package/dist/testing/mod.d.mts

@@ -5,7 +5,6 @@ import { Activity, Actor, Collection, CryptographicKey, Hashtag, Link, LookupObj
 import { Link as Link$1, LookupWebFingerOptions, ResourceDescriptor } from "@fedify/webfinger";
 import { TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader, GetUserAgentOptions } from "@fedify/vocab-runtime";
-
 //#region src/nodeinfo/types.d.ts
 /**
  * The type of the result of parsing JSON.
@@ -1942,6 +1941,11 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * Gets the public key of the sender, if any exists and it is verified.
    * Otherwise, `null` is returned.
    *
+   * Successful results are reused for this request regardless of the options.
+   * Pending checks and `null` results are reused for the same effective
+   * document and context loaders, including failed lookups.  Rejected checks
+   * can be retried.  Shared work uses the first caller's tracer provider.
+   *
    * This can be used for implementing [authorized fetch] (also known as
    * secure mode) in ActivityPub.
    *
@@ -1955,6 +1959,11 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * Gets the public key of the sender, if any exists and it is verified.
    * Otherwise, `null` is returned.
    *
+   * Successful results are reused for this request regardless of the options.
+   * Pending checks and `null` results are reused for the same effective
+   * document and context loaders, including failed lookups.  Rejected checks
+   * can be retried.  Shared work uses the first caller's tracer provider.
+   *
    * This can be used for implementing [authorized fetch] (also known as
    * secure mode) in ActivityPub.
    *
@@ -1974,6 +1983,14 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * Gets the owner of the signed key, if any exists and it is verified.
    * Otherwise, `null` is returned.
    *
+   * Verified keys and owners are reused for this request regardless of the
+   * options.  Pending checks are shared for the same effective document and
+   * context loaders.  A `null` result from an owner lookup after key
+   * verification is retained for those loaders.  A `null` result caused by
+   * an unverified key is not retained, allowing an owner lookup after another
+   * loader verifies the key.  Rejected checks can be retried.  Shared work
+   * uses the first caller's tracer provider.
+   *
    * This can be used for implementing [authorized fetch] (also known as
    * secure mode) in ActivityPub.
    *
@@ -1988,6 +2005,14 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * Gets the owner of the signed key, if any exists and it is verified.
    * Otherwise, `null` is returned.
    *
+   * Verified keys and owners are reused for this request regardless of the
+   * options.  Pending checks are shared for the same effective document and
+   * context loaders.  A `null` result from an owner lookup after key
+   * verification is retained for those loaders.  A `null` result caused by
+   * an unverified key is not retained, allowing an owner lookup after another
+   * loader verifies the key.  Rejected checks can be retried.  Shared work
+   * uses the first caller's tracer provider.
+   *
    * This can be used for implementing [authorized fetch] (also known as
    * secure mode) in ActivityPub.
    *

package/dist/{types-miAYfiGO.js → types-B1_pRFE_.js}

@@ -1,7 +1,8 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { getLogger } from "@logtape/logtape";
-import { FetchError, UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getUserAgent } from "@fedify/vocab-runtime";
+import { openPublicFetch } from "@fedify/vocab-runtime/internal";
 //#region src/utils/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */
 const MAX_BODY_SIZE = 16 * 1024 * 1024;
@@ -84,23 +85,34 @@ const logger = getLogger([
 ]);
 const DEFAULT_MAX_REDIRECTION = 5;
 /**
-* Fetches a URL while guarding against SSRF.  Before every request—including
-* each redirect hop—the destination is validated with
-* {@link validatePublicUrl}, so that loopback, link-local, and private
-* addresses, as well as non-HTTP(S) schemes such as `data:`, are rejected.
-* Redirects are followed manually with a cap, so that a public URL cannot
-* bounce the request to an internal address.
+* Fetches a URL while guarding against SSRF.  Every request—including each
+* redirect hop—is made in its own session opened with `openPublicFetch()`,
+* which rejects loopback, link-local, and private addresses, as well as
+* non-HTTP(S) schemes such as `data:`, and connects only to the validated
+* addresses where the runtime supports it.  Redirects are followed manually
+* with a cap, so that a public URL cannot bounce the request to an internal
+* address.
+*
+* The final response is passed to `consume`, which must consume or cancel its
+* body; the session is closed after `consume` settles.  The cancellation of
+* redirect response bodies is started before their sessions are closed.
 * @param url The URL to fetch.
 * @param headers The request headers.
-* @returns The final response, or `null` if the URL is disallowed, its
-*          hostname cannot be resolved, or there are too many redirects.
+* @param consume The function to consume the final response with.
+* @param deps The dependencies.
+* @returns The value returned by `consume`, or `null` if the URL is
+*          disallowed, its hostname cannot be resolved, or there are too many
+*          redirects.
+* @internal
 */
-async function fetchPublicUrl(url, headers) {
+async function fetchPublicUrl(url, headers, consume, deps = {}) {
+	const openHop = deps.openHop ?? ((hopUrl) => openPublicFetch(hopUrl));
 	let current = url instanceof URL ? url : new URL(url);
 	let redirected = 0;
 	while (true) {
+		let session;
 		try {
-			await validatePublicUrl(current.href);
+			session = await openHop(current.href);
 		} catch (e) {
 			if (e instanceof UrlError) {
 				if (e.reason === "dns") logger.error("DNS lookup failed for {url}: {error}", {
@@ -115,52 +127,89 @@ async function fetchPublicUrl(url, headers) {
 			}
 			throw e;
 		}
-		const response = await fetch(current, {
-			headers,
-			redirect: "manual"
-		});
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-			redirected++;
-			if (redirected >= DEFAULT_MAX_REDIRECTION) {
-				logger.error("Too many redirections ({redirections}) while fetching {url}.", {
-					redirections: redirected,
-					url: current.href
-				});
-				return null;
-			}
-			const next = new URL(response.headers.get("Location"), response.url == null || response.url === "" ? current : response.url);
-			if (next.protocol !== current.protocol) {
-				logger.error("Refused a redirect to a different protocol ({protocol} to {redirectedProtocol}) while fetching NodeInfo.", {
-					protocol: current.protocol,
-					redirectedProtocol: next.protocol
-				});
-				return null;
-			}
-			current = next;
-			continue;
+		let location;
+		try {
+			const response = await session.fetch(current, {
+				headers,
+				redirect: "manual"
+			});
+			if (response.status < 300 || response.status >= 400 || !response.headers.has("Location")) return await consume(response);
+			location = response.headers.get("Location");
+			cancelBody(response, current);
+		} finally {
+			await session.close();
+		}
+		redirected++;
+		if (redirected >= DEFAULT_MAX_REDIRECTION) {
+			logger.error("Too many redirections ({redirections}) while fetching {url}.", {
+				redirections: redirected,
+				url: current.href
+			});
+			return null;
+		}
+		const next = new URL(location, current);
+		if (next.protocol !== current.protocol) {
+			logger.error("Refused a redirect to a different protocol ({protocol} to {redirectedProtocol}) while fetching NodeInfo.", {
+				protocol: current.protocol,
+				redirectedProtocol: next.protocol
+			});
+			return null;
 		}
-		return response;
+		current = next;
 	}
 }
+/**
+* Starts cancelling a response body that is not read, without waiting for it
+* to settle.  The cancellation of a branch of a tee (e.g., a body cloned by
+* a fetch mock) settles only after the other branch is cancelled too, per
+* the Streams standard, so awaiting it could block forever.  A failure is
+* only logged.
+*/
+function cancelBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		logger.debug("Failed to cancel the response body from {url}: {error}", {
+			url: url.toString(),
+			error
+		});
+	});
+}
 async function getNodeInfo(url, options = {}) {
+	return await getNodeInfoInternal(url, options);
+}
+/**
+* The implementation of {@link getNodeInfo}, which is not exported from any
+* entry point.
+* @param url The base URL of the server, or the URL of the NodeInfo document
+*            if `options.direct` is turned on.
+* @param options Options for fetching the NodeInfo document.
+* @param deps The dependencies.
+* @returns The NodeInfo document if it could be fetched successfully.
+*          Otherwise, `undefined` is returned.
+* @internal
+*/
+async function getNodeInfoInternal(url, options = {}, deps = {}) {
 	try {
+		const headers = {
+			Accept: "application/json",
+			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
+		};
 		let nodeInfoUrl = url;
 		if (!options.direct) {
 			const wellKnownUrl = new URL("/.well-known/nodeinfo", url);
-			const wellKnownResponse = await fetchPublicUrl(wellKnownUrl, {
-				Accept: "application/json",
-				"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
-			});
-			if (wellKnownResponse == null) return void 0;
-			if (!wellKnownResponse.ok) {
-				logger.error("Failed to fetch {url}: {status} {statusText}", {
-					url: wellKnownUrl.href,
-					status: wellKnownResponse.status,
-					statusText: wellKnownResponse.statusText
-				});
-				return;
-			}
-			const wellKnownRd = JSON.parse(await readBoundedText(wellKnownResponse, MAX_BODY_SIZE, wellKnownUrl));
+			const wellKnown = await fetchPublicUrl(wellKnownUrl, headers, async (response) => {
+				if (!response.ok) {
+					logger.error("Failed to fetch {url}: {status} {statusText}", {
+						url: wellKnownUrl.href,
+						status: response.status,
+						statusText: response.statusText
+					});
+					cancelBody(response, wellKnownUrl);
+					return;
+				}
+				return { rd: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, wellKnownUrl)) };
+			}, deps);
+			if (wellKnown == null) return void 0;
+			const wellKnownRd = wellKnown.rd;
 			const link = wellKnownRd?.links?.find((link) => link != null && "rel" in link && (link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.0" || link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.1") && "href" in link && link.href != null);
 			if (link == null || link.href == null) {
 				logger.error("Failed to find a NodeInfo document link from {url}: {resourceDescriptor}", {
@@ -171,20 +220,20 @@ async function getNodeInfo(url, options = {}) {
 			}
 			nodeInfoUrl = link.href;
 		}
-		const response = await fetchPublicUrl(nodeInfoUrl, {
-			Accept: "application/json",
-			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
-		});
-		if (response == null) return void 0;
-		if (!response.ok) {
-			logger.error("Failed to fetch NodeInfo document from {url}: {status} {statusText}", {
-				url: nodeInfoUrl.toString(),
-				status: response.status,
-				statusText: response.statusText
-			});
-			return;
-		}
-		const data = JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, nodeInfoUrl));
+		const document = await fetchPublicUrl(nodeInfoUrl, headers, async (response) => {
+			if (!response.ok) {
+				logger.error("Failed to fetch NodeInfo document from {url}: {status} {statusText}", {
+					url: nodeInfoUrl.toString(),
+					status: response.status,
+					statusText: response.statusText
+				});
+				cancelBody(response, nodeInfoUrl);
+				return;
+			}
+			return { data: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, nodeInfoUrl)) };
+		}, deps);
+		if (document == null) return void 0;
+		const { data } = document;
 		if (options.parse === "none") return data;
 		return parseNodeInfo(data, { tryBestEffort: options.parse === "best-effort" }) ?? void 0;
 	} catch (error) {

package/dist/{types-DRPjmHVV.cjs → types-DOvyymM4.cjs}

@@ -3,6 +3,7 @@ const { URLPattern } = require("urlpattern-polyfill");
 require("./chunk-DDcVe30Y.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
+let _fedify_vocab_runtime_internal = require("@fedify/vocab-runtime/internal");
 //#region src/utils/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */
 const MAX_BODY_SIZE = 16 * 1024 * 1024;
@@ -85,23 +86,34 @@ const logger = (0, _logtape_logtape.getLogger)([
 ]);
 const DEFAULT_MAX_REDIRECTION = 5;
 /**
-* Fetches a URL while guarding against SSRF.  Before every request—including
-* each redirect hop—the destination is validated with
-* {@link validatePublicUrl}, so that loopback, link-local, and private
-* addresses, as well as non-HTTP(S) schemes such as `data:`, are rejected.
-* Redirects are followed manually with a cap, so that a public URL cannot
-* bounce the request to an internal address.
+* Fetches a URL while guarding against SSRF.  Every request—including each
+* redirect hop—is made in its own session opened with `openPublicFetch()`,
+* which rejects loopback, link-local, and private addresses, as well as
+* non-HTTP(S) schemes such as `data:`, and connects only to the validated
+* addresses where the runtime supports it.  Redirects are followed manually
+* with a cap, so that a public URL cannot bounce the request to an internal
+* address.
+*
+* The final response is passed to `consume`, which must consume or cancel its
+* body; the session is closed after `consume` settles.  The cancellation of
+* redirect response bodies is started before their sessions are closed.
 * @param url The URL to fetch.
 * @param headers The request headers.
-* @returns The final response, or `null` if the URL is disallowed, its
-*          hostname cannot be resolved, or there are too many redirects.
+* @param consume The function to consume the final response with.
+* @param deps The dependencies.
+* @returns The value returned by `consume`, or `null` if the URL is
+*          disallowed, its hostname cannot be resolved, or there are too many
+*          redirects.
+* @internal
 */
-async function fetchPublicUrl(url, headers) {
+async function fetchPublicUrl(url, headers, consume, deps = {}) {
+	const openHop = deps.openHop ?? ((hopUrl) => (0, _fedify_vocab_runtime_internal.openPublicFetch)(hopUrl));
 	let current = url instanceof URL ? url : new URL(url);
 	let redirected = 0;
 	while (true) {
+		let session;
 		try {
-			await (0, _fedify_vocab_runtime.validatePublicUrl)(current.href);
+			session = await openHop(current.href);
 		} catch (e) {
 			if (e instanceof _fedify_vocab_runtime.UrlError) {
 				if (e.reason === "dns") logger.error("DNS lookup failed for {url}: {error}", {
@@ -116,52 +128,89 @@ async function fetchPublicUrl(url, headers) {
 			}
 			throw e;
 		}
-		const response = await fetch(current, {
-			headers,
-			redirect: "manual"
-		});
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-			redirected++;
-			if (redirected >= DEFAULT_MAX_REDIRECTION) {
-				logger.error("Too many redirections ({redirections}) while fetching {url}.", {
-					redirections: redirected,
-					url: current.href
-				});
-				return null;
-			}
-			const next = new URL(response.headers.get("Location"), response.url == null || response.url === "" ? current : response.url);
-			if (next.protocol !== current.protocol) {
-				logger.error("Refused a redirect to a different protocol ({protocol} to {redirectedProtocol}) while fetching NodeInfo.", {
-					protocol: current.protocol,
-					redirectedProtocol: next.protocol
-				});
-				return null;
-			}
-			current = next;
-			continue;
+		let location;
+		try {
+			const response = await session.fetch(current, {
+				headers,
+				redirect: "manual"
+			});
+			if (response.status < 300 || response.status >= 400 || !response.headers.has("Location")) return await consume(response);
+			location = response.headers.get("Location");
+			cancelBody(response, current);
+		} finally {
+			await session.close();
+		}
+		redirected++;
+		if (redirected >= DEFAULT_MAX_REDIRECTION) {
+			logger.error("Too many redirections ({redirections}) while fetching {url}.", {
+				redirections: redirected,
+				url: current.href
+			});
+			return null;
+		}
+		const next = new URL(location, current);
+		if (next.protocol !== current.protocol) {
+			logger.error("Refused a redirect to a different protocol ({protocol} to {redirectedProtocol}) while fetching NodeInfo.", {
+				protocol: current.protocol,
+				redirectedProtocol: next.protocol
+			});
+			return null;
 		}
-		return response;
+		current = next;
 	}
 }
+/**
+* Starts cancelling a response body that is not read, without waiting for it
+* to settle.  The cancellation of a branch of a tee (e.g., a body cloned by
+* a fetch mock) settles only after the other branch is cancelled too, per
+* the Streams standard, so awaiting it could block forever.  A failure is
+* only logged.
+*/
+function cancelBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		logger.debug("Failed to cancel the response body from {url}: {error}", {
+			url: url.toString(),
+			error
+		});
+	});
+}
 async function getNodeInfo(url, options = {}) {
+	return await getNodeInfoInternal(url, options);
+}
+/**
+* The implementation of {@link getNodeInfo}, which is not exported from any
+* entry point.
+* @param url The base URL of the server, or the URL of the NodeInfo document
+*            if `options.direct` is turned on.
+* @param options Options for fetching the NodeInfo document.
+* @param deps The dependencies.
+* @returns The NodeInfo document if it could be fetched successfully.
+*          Otherwise, `undefined` is returned.
+* @internal
+*/
+async function getNodeInfoInternal(url, options = {}, deps = {}) {
 	try {
+		const headers = {
+			Accept: "application/json",
+			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : (0, _fedify_vocab_runtime.getUserAgent)(options.userAgent)
+		};
 		let nodeInfoUrl = url;
 		if (!options.direct) {
 			const wellKnownUrl = new URL("/.well-known/nodeinfo", url);
-			const wellKnownResponse = await fetchPublicUrl(wellKnownUrl, {
-				Accept: "application/json",
-				"User-Agent": typeof options.userAgent === "string" ? options.userAgent : (0, _fedify_vocab_runtime.getUserAgent)(options.userAgent)
-			});
-			if (wellKnownResponse == null) return void 0;
-			if (!wellKnownResponse.ok) {
-				logger.error("Failed to fetch {url}: {status} {statusText}", {
-					url: wellKnownUrl.href,
-					status: wellKnownResponse.status,
-					statusText: wellKnownResponse.statusText
-				});
-				return;
-			}
-			const wellKnownRd = JSON.parse(await readBoundedText(wellKnownResponse, MAX_BODY_SIZE, wellKnownUrl));
+			const wellKnown = await fetchPublicUrl(wellKnownUrl, headers, async (response) => {
+				if (!response.ok) {
+					logger.error("Failed to fetch {url}: {status} {statusText}", {
+						url: wellKnownUrl.href,
+						status: response.status,
+						statusText: response.statusText
+					});
+					cancelBody(response, wellKnownUrl);
+					return;
+				}
+				return { rd: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, wellKnownUrl)) };
+			}, deps);
+			if (wellKnown == null) return void 0;
+			const wellKnownRd = wellKnown.rd;
 			const link = wellKnownRd?.links?.find((link) => link != null && "rel" in link && (link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.0" || link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.1") && "href" in link && link.href != null);
 			if (link == null || link.href == null) {
 				logger.error("Failed to find a NodeInfo document link from {url}: {resourceDescriptor}", {
@@ -172,20 +221,20 @@ async function getNodeInfo(url, options = {}) {
 			}
 			nodeInfoUrl = link.href;
 		}
-		const response = await fetchPublicUrl(nodeInfoUrl, {
-			Accept: "application/json",
-			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : (0, _fedify_vocab_runtime.getUserAgent)(options.userAgent)
-		});
-		if (response == null) return void 0;
-		if (!response.ok) {
-			logger.error("Failed to fetch NodeInfo document from {url}: {status} {statusText}", {
-				url: nodeInfoUrl.toString(),
-				status: response.status,
-				statusText: response.statusText
-			});
-			return;
-		}
-		const data = JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, nodeInfoUrl));
+		const document = await fetchPublicUrl(nodeInfoUrl, headers, async (response) => {
+			if (!response.ok) {
+				logger.error("Failed to fetch NodeInfo document from {url}: {status} {statusText}", {
+					url: nodeInfoUrl.toString(),
+					status: response.status,
+					statusText: response.statusText
+				});
+				cancelBody(response, nodeInfoUrl);
+				return;
+			}
+			return { data: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, nodeInfoUrl)) };
+		}, deps);
+		if (document == null) return void 0;
+		const { data } = document;
 		if (options.parse === "none") return data;
 		return parseNodeInfo(data, { tryBestEffort: options.parse === "best-effort" }) ?? void 0;
 	} catch (error) {