@fedify/fedify 2.3.13 → 2.3.14

package/dist/utils/docloader.test.mjs

@@ -5,9 +5,9 @@ import { t as esm_default } from "../esm-vrlUxr60.mjs";
 import { t as assertEquals } from "../assert_equals-C-ZRDbaf.mjs";
 import "../std__assert-BjJn2daJ.mjs";
 import { t as assertRejects } from "../assert_rejects-D1HYAik3.mjs";
-import { l as verifyRequest } from "../http-BRrpIDS1.mjs";
+import { l as verifyRequest } from "../http-BCSf1KIY.mjs";
 import { i as rsaPrivateKey2 } from "../keys-BAK-tUlf.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-QDpF5t9M.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-yuyzZC9a.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";
@@ -466,6 +466,70 @@ const unsupportedUrls = [
 	"file:///collection",
 	`data:application/ld+json,${encodeURIComponent(JSON.stringify({ id: "https://example.com/data" }))}`
 ];
+function isCredentialUrlError(error) {
+	return error instanceof UrlError && error.reason === "disallowed" && error.message === "URLs with credentials are not allowed";
+}
+test("getAuthenticatedDocumentLoader() rejects URLs with credentials", async (t) => {
+	const identity = {
+		keyId: new URL("https://example.com/key2"),
+		privateKey: rsaPrivateKey2
+	};
+	const start = "https://8.8.8.8/start";
+	const target = "https://user:pass@8.8.8.8/document";
+	for (const allowPrivateAddress of [false, true]) {
+		const loader = getAuthenticatedDocumentLoader(identity, { allowPrivateAddress });
+		for (const path of [
+			"direct",
+			"redirect",
+			"Link",
+			"HTML"
+		]) await t.step(`${path}, allowPrivateAddress=${allowPrivateAddress}`, async () => {
+			await withFetchStub((request) => {
+				if (request.url !== start) return Response.json({});
+				if (path === "redirect") return Response.redirect(target, 302);
+				if (path === "HTML") return new Response(`<link rel="alternate" type="application/activity+json" href="${target}">`, { headers: { "Content-Type": "text/html" } });
+				return new Response("", { headers: {
+					"Content-Type": "text/plain",
+					Link: `<${target}>; rel="alternate"; type="application/activity+json"`
+				} });
+			}, async (fetched) => {
+				await rejects(loader(path === "direct" ? target : start), isCredentialUrlError);
+				deepStrictEqual(fetched.map((r) => r.url), path === "direct" ? [] : [start]);
+			});
+		});
+		for (const url of [
+			"https://user@8.8.8.8/document",
+			"https://:pass@8.8.8.8/document",
+			"https://%75ser:p%40ss@8.8.8.8/document",
+			"http://user:pass@8.8.8.8/document"
+		]) await t.step(`${url}, allowPrivateAddress=${allowPrivateAddress}`, async () => {
+			await withFetchStub(() => Response.json({}), async (fetched) => {
+				await rejects(loader(url), isCredentialUrlError);
+				deepStrictEqual(fetched, []);
+			});
+		});
+		for (const url of ["https://:@8.8.8.8/document", "https://8.8.8.8/@user?q=@pass"]) await t.step(`allows ${url}, allowPrivateAddress=${allowPrivateAddress}`, async () => {
+			await withFetchStub(() => Response.json({ done: true }), async (fetched) => {
+				deepStrictEqual((await loader(url)).document, { done: true });
+				deepStrictEqual(fetched.map((r) => r.url), [new URL(url).href]);
+			});
+		});
+	}
+	for (const firstSpec of ["rfc9421", "draft-cavage-http-signatures-12"]) await t.step(`redirect after fallback from ${firstSpec}`, async () => {
+		const loader = getAuthenticatedDocumentLoader(identity, {
+			allowPrivateAddress: true,
+			specDeterminer: {
+				determineSpec: () => firstSpec,
+				rememberSpec: () => {}
+			}
+		});
+		await withFetchStub((request) => request.url !== start ? Response.json({}) : request.headers.has("Signature-Input") === (firstSpec === "rfc9421") ? new Response(null, { status: 401 }) : Response.redirect(target, 302), async (fetched) => {
+			await rejects(loader(start), isCredentialUrlError);
+			deepStrictEqual(fetched.map((r) => r.url), [start, start]);
+			deepStrictEqual(fetched.map((r) => r.headers.has("Signature-Input")), [firstSpec === "rfc9421", firstSpec !== "rfc9421"]);
+		});
+	});
+});
 function isUnsupportedProtocolError(error, url) {
 	return error instanceof UrlError && error.message === `Unsupported protocol: ${new URL(url).protocol}` && error.reason === "disallowed";
 }

package/dist/utils/kv-cache.test.mjs

@@ -1,7 +1,7 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as kvCache, t as MockKvStore } from "../kv-cache-Clx3SwMp.mjs";
+import { n as kvCache, t as MockKvStore } from "../kv-cache-C69dzgQi.mjs";
 import { deepStrictEqual, throws } from "node:assert";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { preloadedContexts } from "@fedify/vocab-runtime";

package/dist/utils/mod.cjs

@@ -1,6 +1,6 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_kv_cache = require("../kv-cache-poF6Tqnz.cjs");
+const require_kv_cache = require("../kv-cache-Bg4utAuv.cjs");
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.kvCache = require_kv_cache.kvCache;

package/dist/utils/mod.js

@@ -1,4 +1,4 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-BmqdF048.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-LBCwHNLu.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "2.3.13",
+  "version": "2.3.14",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",
@@ -152,10 +152,10 @@
     "jsonld": "^9.0.0",
     "structured-field-values": "^2.0.4",
     "urlpattern-polyfill": "^10.1.0",
-    "@fedify/uri-template": "2.3.13",
-    "@fedify/vocab": "2.3.13",
-    "@fedify/vocab-runtime": "2.3.13",
-    "@fedify/webfinger": "2.3.13"
+    "@fedify/vocab-runtime": "2.3.14",
+    "@fedify/uri-template": "2.3.14",
+    "@fedify/webfinger": "2.3.14",
+    "@fedify/vocab": "2.3.14"
   },
   "devDependencies": {
     "@std/assert": "npm:@jsr/std__assert@^0.226.0",
@@ -168,7 +168,7 @@
     "typescript": "^6.0.0",
     "wrangler": "^4.17.0",
     "@fedify/fixture": "2.0.0",
-    "@fedify/vocab-tools": "^2.3.13"
+    "@fedify/vocab-tools": "^2.3.14"
   },
   "scripts": {
     "build:self": "tsdown",