@fedify/fedify 2.3.6 → 2.3.8

package/dist/{http-DzgaVy-x.js → http-BKJYj9oz.js}

@@ -4,13 +4,13 @@ import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, metrics, trace } from "@opentelemetry/api";
 import { encodeHex } from "byte-encodings/hex";
-import { Item, decodeDict, encodeDict, encodeItem } from "structured-field-values";
 import { FetchError, getDocumentLoader } from "@fedify/vocab-runtime";
+import { Item, decodeDict, encodeDict, encodeItem } from "structured-field-values";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.3.6";
+var version = "2.3.8";
 //#endregion
 //#region src/sig/accept.ts
 /**
@@ -1038,6 +1038,118 @@ async function importJwk(jwk, type) {
 	validateCryptoKey(key, type);
 	return key;
 }
+/**
+* Fetches the document that the given actor URI dereferences to, and returns
+* the actor only if the host that served the document is authoritative for
+* the id the document claims.
+*
+* Only the origin that serves an actor id can speak for it.  Without that
+* rule any host could serve a document describing somebody else's actor—and
+* listing its own keys as that actor's.
+*
+* @param actorId The URI of the actor to fetch.
+* @param options Options for fetching the document.
+* @returns The actor, or `null` if the document cannot be fetched, is not an
+*          actor, or belongs to another origin.
+* @internal
+*/
+async function fetchActorDocument(actorId, options = {}) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const contextLoader = options.contextLoader ?? getDocumentLoader();
+	const { tracerProvider } = options;
+	let document;
+	let documentUrl = actorId;
+	try {
+		const remoteDocument = await documentLoader(actorId.href);
+		document = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", actorId);
+	} catch (error) {
+		logger.debug("Failed to fetch the actor {actorId}: {error}", {
+			actorId: actorId.href,
+			error
+		});
+		return null;
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider,
+			baseUrl: documentUrl
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.debug("The document served at {documentUrl} is not a valid object: {error}", {
+			documentUrl: documentUrl.href,
+			error
+		});
+		return null;
+	}
+	if (!isActor(object)) return null;
+	if (object.id == null || object.id.origin !== documentUrl.origin) {
+		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as that actor's document.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href
+		});
+		return null;
+	}
+	return object;
+}
+/**
+* Resolves the owner that the given key claims, and returns it only if the
+* claim holds.
+*
+* The `owner` of a {@link CryptographicKey}, like the `controller` of
+* a {@link Multikey}, proves nothing on its own: the key document and the
+* claim inside it are served by the same host, so anyone able to serve a key
+* document can name any actor in the world as its owner.  The claim becomes
+* meaningful only once the named actor's own document is fetched and turns
+* out to link back to the key.  This function performs that mutual-link
+* check, which is the only sound way to learn a fetched key's owner.
+*
+* The claimed owner is always dereferenced, never read out of the key
+* document: an owner embedded there is written by whoever wrote the key.
+*
+* @param key The key whose ownership claim is to be verified.  It must carry
+*            an `id`, as that is what the owner has to link back to.
+* @param options Options for fetching the claimed owner.
+* @returns The verified owner, or `null` if the key claims no owner, the
+*          owner cannot be fetched, or the owner does not link back to
+*          the key.
+* @internal
+*/
+async function verifyKeyOwnership(key, options = {}) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const keyId = key.id;
+	if (keyId == null) return null;
+	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
+	if (claimedOwnerId == null) return null;
+	const owner = await fetchActorDocument(claimedOwnerId, options);
+	if (owner == null) {
+		logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims could not be resolved.", {
+			keyId: keyId.href,
+			claimedOwnerId: claimedOwnerId.href
+		});
+		return null;
+	}
+	const linkedKeyIds = key instanceof CryptographicKey ? owner.publicKeyIds : owner.assertionMethodIds;
+	for (const linkedKeyId of linkedKeyIds) if (linkedKeyId.href === keyId.href) return owner;
+	logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims does not list the key as its own.", {
+		keyId: keyId.href,
+		claimedOwnerId: claimedOwnerId.href
+	});
+	return null;
+}
 async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 	tracerProvider ??= trace.getTracerProvider();
 	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.fetch_key", {
@@ -1165,7 +1277,7 @@ async function getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger) {
 async function clearFetchErrorMetadata(keyId, keyCache) {
 	await keyCache?.setFetchError?.(keyId, null);
 }
-async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider }, logger) {
+async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider }, logger) {
 	let object;
 	try {
 		object = await Object$1.fromJsonLd(document, {
@@ -1195,8 +1307,22 @@ async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoade
 		}
 	}
 	let key = null;
-	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object;
+	let ownerDocument = null;
+	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
 	else if (isActor(object)) {
+		if (object.id == null || object.id.origin !== documentUrl.origin) {
+			logger.debug("Failed to verify; the document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin.", {
+				keyId,
+				documentUrl: documentUrl.href,
+				actorId: object.id?.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+		ownerDocument = object;
 		const keys = cls === CryptographicKey ? object.getPublicKeys({
 			documentLoader,
 			contextLoader,
@@ -1258,6 +1384,25 @@ async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoade
 			cached: false
 		};
 	}
+	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
+	if (ownerDocument != null && claimedOwnerId == null) key = key instanceof CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
+	else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
+		if (await verifyKeyOwnership(key, {
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		}) == null) {
+			logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
+				keyId,
+				claimedOwnerId: claimedOwnerId.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+	}
 	if (keyCache != null) {
 		await keyCache.set(cacheKey, key);
 		logger.debug("Key {keyId} cached.", { keyId });
@@ -1291,15 +1436,18 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 		}
 		logger.debug("Fetching key {keyId} to verify signature...", { keyId });
 		let document;
+		let documentUrl = cacheKey;
 		try {
-			document = (await (options.documentLoader ?? getDocumentLoader())(keyId)).document;
+			const remoteDocument = await (options.documentLoader ?? getDocumentLoader())(keyId);
+			document = remoteDocument.document;
+			documentUrl = new URL(remoteDocument.documentUrl ?? "", cacheKey);
 		} catch (error) {
 			const classified = classifyFetchError(error);
 			const errored = await onFetchError(error, cacheKey, keyId, keyCache, logger);
 			outcome = classified;
 			return errored;
 		}
-		const resolved = await resolveFetchedKey(document, cacheKey, keyId, cls, options, logger);
+		const resolved = await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
 		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
 		return resolved;
 	} finally {
@@ -2414,4 +2562,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { formatAcceptSignature as A, recordDocumentCache as C, recordOutboxEnqueue as D, recordOutboxActivity as E, version as F, parseAcceptSignature as M, validateAcceptSignature as N, recordWebFingerHandle as O, name as P, recordCollectionTotalItems as S, recordInboxActivity as T, measureSignatureKeyFetch as _, verifyRequestDetailed as a, recordCollectionPageItems as b, fetchKeyDetailed as c, validateCryptoKey as d, getDurationMs as f, isAbortError$1 as g, instrumentDocumentLoader as h, verifyRequest as i, fulfillAcceptSignature as j, registerQueueDepthGauge as k, generateCryptoKeyPair as l, getRemoteHost as m, parseRfc9421SignatureInput as n, exportJwk as o, getFederationMetrics as p, signRequest as r, fetchKey as s, doubleKnock as t, importJwk as u, recordCircuitBreakerStateChange as v, recordFanoutRecipients as w, recordCollectionRequest as x, recordCollectionDispatchDuration as y };
+export { recordWebFingerHandle as A, recordCollectionRequest as C, recordInboxActivity as D, recordFanoutRecipients as E, validateAcceptSignature as F, name as I, version as L, formatAcceptSignature as M, fulfillAcceptSignature as N, recordOutboxActivity as O, parseAcceptSignature as P, recordCollectionPageItems as S, recordDocumentCache as T, instrumentDocumentLoader as _, verifyRequestDetailed as a, recordCircuitBreakerStateChange as b, fetchKey as c, importJwk as d, validateCryptoKey as f, getRemoteHost as g, getFederationMetrics as h, verifyRequest as i, registerQueueDepthGauge as j, recordOutboxEnqueue as k, fetchKeyDetailed as l, getDurationMs as m, parseRfc9421SignatureInput as n, exportJwk as o, verifyKeyOwnership as p, signRequest as r, fetchActorDocument as s, doubleKnock as t, generateCryptoKeyPair as u, isAbortError$1 as v, recordCollectionTotalItems as w, recordCollectionDispatchDuration as x, measureSignatureKeyFetch as y };

package/dist/{http-DL5ZJBC4.cjs → http-ChVf88XZ.cjs}

@@ -5,13 +5,13 @@ let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
 let byte_encodings_hex = require("byte-encodings/hex");
-let structured_field_values = require("structured-field-values");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
+let structured_field_values = require("structured-field-values");
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 let byte_encodings_base64 = require("byte-encodings/base64");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.3.6";
+var version = "2.3.8";
 //#endregion
 //#region src/sig/accept.ts
 /**
@@ -1039,6 +1039,118 @@ async function importJwk(jwk, type) {
 	validateCryptoKey(key, type);
 	return key;
 }
+/**
+* Fetches the document that the given actor URI dereferences to, and returns
+* the actor only if the host that served the document is authoritative for
+* the id the document claims.
+*
+* Only the origin that serves an actor id can speak for it.  Without that
+* rule any host could serve a document describing somebody else's actor—and
+* listing its own keys as that actor's.
+*
+* @param actorId The URI of the actor to fetch.
+* @param options Options for fetching the document.
+* @returns The actor, or `null` if the document cannot be fetched, is not an
+*          actor, or belongs to another origin.
+* @internal
+*/
+async function fetchActorDocument(actorId, options = {}) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const documentLoader = options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
+	const contextLoader = options.contextLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
+	const { tracerProvider } = options;
+	let document;
+	let documentUrl = actorId;
+	try {
+		const remoteDocument = await documentLoader(actorId.href);
+		document = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", actorId);
+	} catch (error) {
+		logger.debug("Failed to fetch the actor {actorId}: {error}", {
+			actorId: actorId.href,
+			error
+		});
+		return null;
+	}
+	let object;
+	try {
+		object = await _fedify_vocab.Object.fromJsonLd(document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider,
+			baseUrl: documentUrl
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.debug("The document served at {documentUrl} is not a valid object: {error}", {
+			documentUrl: documentUrl.href,
+			error
+		});
+		return null;
+	}
+	if (!(0, _fedify_vocab.isActor)(object)) return null;
+	if (object.id == null || object.id.origin !== documentUrl.origin) {
+		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as that actor's document.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href
+		});
+		return null;
+	}
+	return object;
+}
+/**
+* Resolves the owner that the given key claims, and returns it only if the
+* claim holds.
+*
+* The `owner` of a {@link CryptographicKey}, like the `controller` of
+* a {@link Multikey}, proves nothing on its own: the key document and the
+* claim inside it are served by the same host, so anyone able to serve a key
+* document can name any actor in the world as its owner.  The claim becomes
+* meaningful only once the named actor's own document is fetched and turns
+* out to link back to the key.  This function performs that mutual-link
+* check, which is the only sound way to learn a fetched key's owner.
+*
+* The claimed owner is always dereferenced, never read out of the key
+* document: an owner embedded there is written by whoever wrote the key.
+*
+* @param key The key whose ownership claim is to be verified.  It must carry
+*            an `id`, as that is what the owner has to link back to.
+* @param options Options for fetching the claimed owner.
+* @returns The verified owner, or `null` if the key claims no owner, the
+*          owner cannot be fetched, or the owner does not link back to
+*          the key.
+* @internal
+*/
+async function verifyKeyOwnership(key, options = {}) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const keyId = key.id;
+	if (keyId == null) return null;
+	const claimedOwnerId = key instanceof _fedify_vocab.CryptographicKey ? key.ownerId : key.controllerId;
+	if (claimedOwnerId == null) return null;
+	const owner = await fetchActorDocument(claimedOwnerId, options);
+	if (owner == null) {
+		logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims could not be resolved.", {
+			keyId: keyId.href,
+			claimedOwnerId: claimedOwnerId.href
+		});
+		return null;
+	}
+	const linkedKeyIds = key instanceof _fedify_vocab.CryptographicKey ? owner.publicKeyIds : owner.assertionMethodIds;
+	for (const linkedKeyId of linkedKeyIds) if (linkedKeyId.href === keyId.href) return owner;
+	logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims does not list the key as its own.", {
+		keyId: keyId.href,
+		claimedOwnerId: claimedOwnerId.href
+	});
+	return null;
+}
 async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 	tracerProvider ??= _opentelemetry_api.trace.getTracerProvider();
 	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.fetch_key", {
@@ -1166,7 +1278,7 @@ async function getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger) {
 async function clearFetchErrorMetadata(keyId, keyCache) {
 	await keyCache?.setFetchError?.(keyId, null);
 }
-async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider }, logger) {
+async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider }, logger) {
 	let object;
 	try {
 		object = await _fedify_vocab.Object.fromJsonLd(document, {
@@ -1196,8 +1308,22 @@ async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoade
 		}
 	}
 	let key = null;
-	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object;
+	let ownerDocument = null;
+	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
 	else if ((0, _fedify_vocab.isActor)(object)) {
+		if (object.id == null || object.id.origin !== documentUrl.origin) {
+			logger.debug("Failed to verify; the document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin.", {
+				keyId,
+				documentUrl: documentUrl.href,
+				actorId: object.id?.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+		ownerDocument = object;
 		const keys = cls === _fedify_vocab.CryptographicKey ? object.getPublicKeys({
 			documentLoader,
 			contextLoader,
@@ -1259,6 +1385,25 @@ async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoade
 			cached: false
 		};
 	}
+	const claimedOwnerId = key instanceof _fedify_vocab.CryptographicKey ? key.ownerId : key.controllerId;
+	if (ownerDocument != null && claimedOwnerId == null) key = key instanceof _fedify_vocab.CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
+	else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
+		if (await verifyKeyOwnership(key, {
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		}) == null) {
+			logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
+				keyId,
+				claimedOwnerId: claimedOwnerId.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+	}
 	if (keyCache != null) {
 		await keyCache.set(cacheKey, key);
 		logger.debug("Key {keyId} cached.", { keyId });
@@ -1292,15 +1437,18 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 		}
 		logger.debug("Fetching key {keyId} to verify signature...", { keyId });
 		let document;
+		let documentUrl = cacheKey;
 		try {
-			document = (await (options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)())(keyId)).document;
+			const remoteDocument = await (options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)())(keyId);
+			document = remoteDocument.document;
+			documentUrl = new URL(remoteDocument.documentUrl ?? "", cacheKey);
 		} catch (error) {
 			const classified = classifyFetchError(error);
 			const errored = await onFetchError(error, cacheKey, keyId, keyCache, logger);
 			outcome = classified;
 			return errored;
 		}
-		const resolved = await resolveFetchedKey(document, cacheKey, keyId, cls, options, logger);
+		const resolved = await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
 		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
 		return resolved;
 	} finally {
@@ -2427,6 +2575,12 @@ Object.defineProperty(exports, "exportJwk", {
 		return exportJwk;
 	}
 });
+Object.defineProperty(exports, "fetchActorDocument", {
+	enumerable: true,
+	get: function() {
+		return fetchActorDocument;
+	}
+});
 Object.defineProperty(exports, "fetchKey", {
 	enumerable: true,
 	get: function() {
@@ -2607,6 +2761,12 @@ Object.defineProperty(exports, "validateCryptoKey", {
 		return validateCryptoKey;
 	}
 });
+Object.defineProperty(exports, "verifyKeyOwnership", {
+	enumerable: true,
+	get: function() {
+		return verifyKeyOwnership;
+	}
+});
 Object.defineProperty(exports, "verifyRequest", {
 	enumerable: true,
 	get: function() {

package/dist/{http-BcbYkefs.mjs → http-ClEDLGpr.mjs}

@@ -1,10 +1,10 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-KC-uf6Un.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-D8s1eKfJ.mjs";
-import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPkZzmGN.mjs";
-import { o as validateCryptoKey, r as fetchKeyDetailed } from "./key-Cbkqgt-G.mjs";
+import { n as version, t as name } from "./deno--DCBC7WG.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-FDcYXRP5.mjs";
+import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-Dd__NiUL.mjs";
+import { i as fetchKeyDetailed, s as validateCryptoKey } from "./key-C-7sqo8D.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{http-lf8Hsd91.d.ts → http-DQmNpfym.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { CryptographicKey, Multikey } from "@fedify/vocab";
+import { Actor, CryptographicKey, Multikey } from "@fedify/vocab";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader } from "@fedify/vocab-runtime";
 

package/dist/{http-VyDTd4G3.d.cts → http-DiWQB8Mr.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { CryptographicKey, Multikey } from "@fedify/vocab";
+import { Actor, CryptographicKey, Multikey } from "@fedify/vocab";
 import { DocumentLoader } from "@fedify/vocab-runtime";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";