@fedify/fedify 2.3.0-dev.1110 → 2.3.0-dev.1114

package/dist/{http-BLopFpvC.mjs → http-BmOZYc-8.mjs}

@@ -1,9 +1,10 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-hqC7tKJn.mjs";
-import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CceiKpCy.mjs";
-import { o as validateCryptoKey, r as fetchKeyDetailed } from "./key-DW1EVmtP.mjs";
+import { n as version, t as name } from "./deno-CF3jMgip.mjs";
+import { a as measureSignatureKeyFetch, n as getFederationMetrics, t as getDurationMs } from "./metrics-ek3ilf6c.mjs";
+import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CgDcxvjV.mjs";
+import { o as validateCryptoKey, r as fetchKeyDetailed } from "./key-B4I8H5Lc.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -317,6 +318,27 @@ function parseKeyId(value) {
 function getKeyFetchErrorName(error) {
 	return error.name || error.constructor.name || "Error";
 }
+/**
+* Known draft-cavage `algorithm` parameter values, used to keep the
+* `http_signatures.algorithm` metric attribute on a bounded set.  The header
+* field is attacker-controlled and not used to select the verification
+* algorithm, so unknown values are dropped from the metric to prevent
+* cardinality blow-up.
+*/
+const DRAFT_KNOWN_ALGORITHMS = new Set([
+	"ecdsa-sha256",
+	"ecdsa-sha384",
+	"ecdsa-sha512",
+	"ed25519",
+	"hs2019",
+	"rsa-sha1",
+	"rsa-sha256",
+	"rsa-sha512"
+]);
+function classifyHttpVerifyResult(result) {
+	if (result.verified) return "verified";
+	return result.reason.type === "noSignature" ? "missing" : "rejected";
+}
 function recordVerificationResult(span, result) {
 	span.setAttribute("http_signatures.verified", result.verified);
 	if (result.verified === true) return;
@@ -360,27 +382,37 @@ async function verifyRequestDetailed(request, options = {}) {
 			span.setAttribute(ATTR_URL_FULL, request.url);
 			for (const [name, value] of request.headers) span.setAttribute(ATTR_HTTP_REQUEST_HEADER(name), value);
 		}
+		const start = performance.now();
+		const metricsContext = {};
+		let result;
+		let threw = false;
 		try {
 			let spec = options.spec;
 			if (spec == null) spec = request.headers.has("Signature-Input") ? "rfc9421" : "draft-cavage-http-signatures-12";
-			let result;
-			if (spec === "rfc9421") result = await verifyRequestRfc9421(request, span, options);
-			else result = await verifyRequestDraft(request, span, options);
+			if (spec === "rfc9421") result = await verifyRequestRfc9421(request, span, metricsContext, options);
+			else result = await verifyRequestDraft(request, span, metricsContext, options);
 			recordVerificationResult(span, result);
 			if (!result.verified) span.setStatus({ code: SpanStatusCode.ERROR });
 			return result;
 		} catch (error) {
+			threw = true;
 			span.setStatus({
 				code: SpanStatusCode.ERROR,
 				message: String(error)
 			});
 			throw error;
 		} finally {
+			const classified = threw ? "error" : classifyHttpVerifyResult(result);
+			const failureReason = result != null && !result.verified && result.reason.type !== "noSignature" ? result.reason.type : void 0;
+			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "http", classified, {
+				algorithm: metricsContext.algorithm,
+				failureReason
+			});
 			span.end();
 		}
 	});
 }
-async function verifyRequestDraft(request, span, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, tracerProvider } = {}) {
+async function verifyRequestDraft(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, meterProvider, tracerProvider } = {}) {
 	const logger = getLogger([
 		"fedify",
 		"sig",
@@ -528,13 +560,17 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 	const keyIdUrl = parseKeyId(keyId);
 	if (keyIdUrl == null) return invalidSignatureResult(null);
 	span?.setAttribute("http_signatures.key_id", keyId);
-	if ("algorithm" in sigValues) span?.setAttribute("http_signatures.algorithm", sigValues.algorithm);
-	const { key, cached, fetchError } = await fetchKeyDetailed(keyIdUrl, CryptographicKey, {
+	if ("algorithm" in sigValues) {
+		span?.setAttribute("http_signatures.algorithm", sigValues.algorithm);
+		const normalizedAlgorithm = sigValues.algorithm.toLowerCase();
+		if (DRAFT_KNOWN_ALGORITHMS.has(normalizedAlgorithm)) metricsContext.algorithm = normalizedAlgorithm;
+	}
+	const { key, cached, fetchError } = await measureSignatureKeyFetch(meterProvider, "http", () => fetchKeyDetailed(keyIdUrl, CryptographicKey, {
 		documentLoader,
 		contextLoader,
 		keyCache,
 		tracerProvider
-	});
+	}));
 	if (fetchError != null) return keyFetchErrorResult(keyIdUrl, fetchError);
 	if (key == null) return invalidSignatureResult(keyIdUrl);
 	const headerNames = headers.split(/\s+/g);
@@ -556,7 +592,7 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 				signature,
 				message
 			});
-			return await verifyRequestDetailed(originalRequest, {
+			return await verifyRequestDraft(originalRequest, span, metricsContext, {
 				documentLoader,
 				contextLoader,
 				timeWindow,
@@ -564,7 +600,9 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 				keyCache: {
 					get: () => Promise.resolve(void 0),
 					set: async (keyId, key) => await keyCache?.set(keyId, key)
-				}
+				},
+				meterProvider,
+				tracerProvider
 			});
 		}
 		logger.debug("Failed to verify with the fetched key {keyId}; signature {signature} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
@@ -640,7 +678,7 @@ async function verifyRfc9421ContentDigest(digestHeader, body) {
 	}
 	return false;
 }
-async function verifyRequestRfc9421(request, span, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, tracerProvider } = {}) {
+async function verifyRequestRfc9421(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, meterProvider, tracerProvider } = {}) {
 	const logger = getLogger([
 		"fedify",
 		"sig",
@@ -674,9 +712,14 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 		return invalidSignatureResult(null);
 	}
 	let failure = noSignatureResult();
+	let failureAlgorithm;
+	const setFailure = (result, algorithm) => {
+		failure = result;
+		failureAlgorithm = algorithm;
+	};
 	for (const sigName of signatureNames) {
 		if (!signatures[sigName]) {
-			failure = invalidSignatureResult(parseKeyId(signatureInputs[sigName]?.keyId));
+			setFailure(invalidSignatureResult(parseKeyId(signatureInputs[sigName]?.keyId)));
 			continue;
 		}
 		const sigInput = signatureInputs[sigName];
@@ -687,7 +730,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 				signatureName: sigName,
 				signatureInput: signatureInputHeader
 			});
-			failure = invalidSignatureResult(null);
+			setFailure(invalidSignatureResult(null));
 			continue;
 		}
 		if (!sigInput.created) {
@@ -695,7 +738,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 				signatureName: sigName,
 				signatureInput: signatureInputHeader
 			});
-			failure = invalidSignatureResult(keyId);
+			setFailure(invalidSignatureResult(keyId));
 			continue;
 		}
 		const signatureCreated = Temporal.Instant.fromEpochMilliseconds(sigInput.created * 1e3);
@@ -707,14 +750,14 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 					created: signatureCreated.toString(),
 					now: now.toString()
 				});
-				failure = invalidSignatureResult(keyId);
+				setFailure(invalidSignatureResult(keyId));
 				continue;
 			} else if (Temporal.Instant.compare(signatureCreated, now.subtract(tw)) < 0) {
 				logger.debug("Failed to verify; signature created time is too far in the past.", {
 					created: signatureCreated.toString(),
 					now: now.toString()
 				});
-				failure = invalidSignatureResult(keyId);
+				setFailure(invalidSignatureResult(keyId));
 				continue;
 			}
 		}
@@ -722,34 +765,34 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 			const contentDigestHeader = request.headers.get("Content-Digest");
 			if (!contentDigestHeader) {
 				logger.debug("Failed to verify; Content-Digest header required but not found.", { components: sigInput.components });
-				failure = invalidSignatureResult(keyId);
+				setFailure(invalidSignatureResult(keyId));
 				continue;
 			}
 			if (!await verifyRfc9421ContentDigest(contentDigestHeader, await request.arrayBuffer())) {
 				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
-				failure = invalidSignatureResult(keyId);
+				setFailure(invalidSignatureResult(keyId));
 				continue;
 			}
 		}
 		span?.setAttribute("http_signatures.key_id", sigInput.keyId);
 		span?.setAttribute("http_signatures.created", sigInput.created.toString());
 		if (keyId == null) {
-			failure = invalidSignatureResult(null);
+			setFailure(invalidSignatureResult(null));
 			continue;
 		}
-		const { key, cached, fetchError } = await fetchKeyDetailed(keyId, CryptographicKey, {
+		const { key, cached, fetchError } = await measureSignatureKeyFetch(meterProvider, "http", () => fetchKeyDetailed(keyId, CryptographicKey, {
 			documentLoader,
 			contextLoader,
 			keyCache,
 			tracerProvider
-		});
+		}));
 		if (fetchError != null) {
-			failure = keyFetchErrorResult(keyId, fetchError);
+			setFailure(keyFetchErrorResult(keyId, fetchError));
 			continue;
 		}
 		if (!key) {
 			logger.debug("Failed to fetch key: {keyId}", { keyId: sigInput.keyId });
-			failure = invalidSignatureResult(keyId);
+			setFailure(invalidSignatureResult(keyId));
 			continue;
 		}
 		let alg = sigInput.alg?.toLowerCase();
@@ -761,12 +804,13 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 		}
 		if (alg) span?.setAttribute("http_signatures.algorithm", alg);
 		const algorithm = alg && rfc9421AlgorithmMap[alg];
+		const candidateAlgorithm = algorithm ? alg : void 0;
 		if (!algorithm) {
 			logger.debug("Failed to verify; unsupported algorithm: {algorithm}", {
 				algorithm: sigInput.alg,
 				supported: Object.keys(rfc9421AlgorithmMap)
 			});
-			failure = invalidSignatureResult(keyId);
+			setFailure(invalidSignatureResult(keyId));
 			continue;
 		}
 		let signatureBase;
@@ -777,20 +821,22 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 				error,
 				signatureInput: sigInput
 			});
-			failure = invalidSignatureResult(keyId);
+			setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
 			continue;
 		}
 		const signatureBaseBytes = new TextEncoder().encode(signatureBase);
 		span?.setAttribute("http_signatures.signature", encodeHex(sigBytes));
 		try {
-			if (await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes)) return {
-				verified: true,
-				key,
-				signatureLabel: sigName
-			};
-			else if (cached) {
+			if (await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes)) {
+				metricsContext.algorithm = candidateAlgorithm;
+				return {
+					verified: true,
+					key,
+					signatureLabel: sigName
+				};
+			} else if (cached) {
 				logger.debug("Failed to verify with cached key {keyId}; retrying with fresh key...", { keyId: sigInput.keyId });
-				return await verifyRequestDetailed(originalRequest, {
+				return await verifyRequestRfc9421(originalRequest, span, metricsContext, {
 					documentLoader,
 					contextLoader,
 					timeWindow,
@@ -799,14 +845,16 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 						get: () => Promise.resolve(void 0),
 						set: async (keyId, key) => await keyCache?.set(keyId, key)
 					},
-					spec: "rfc9421"
+					spec: "rfc9421",
+					meterProvider,
+					tracerProvider
 				});
 			} else {
 				logger.debug("Failed to verify signature with fetched key {keyId}; signature invalid.", {
 					keyId: sigInput.keyId,
 					signatureBase
 				});
-				failure = invalidSignatureResult(keyId);
+				setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
 			}
 		} catch (error) {
 			logger.debug("Error during signature verification: {error}", {
@@ -814,9 +862,10 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 				keyId: sigInput.keyId,
 				algorithm: sigInput.alg
 			});
-			failure = invalidSignatureResult(keyId);
+			setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
 		}
 	}
+	metricsContext.algorithm = failureAlgorithm;
 	return failure;
 }
 /**