@fedify/fedify 2.4.0-dev.1727 → 2.4.0-dev.1740

package/dist/{temporal-DA3jx8x1.mjs → temporal-DLQIjuTn.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-CKujkAfG.mjs";
+import { c as getNormalizationContextLoader } from "./ld-DnT9sCWa.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {

package/dist/utils/docloader.test.mjs

@@ -5,9 +5,9 @@ import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
 import { t as assertEquals } from "../assert_equals-CBlRfA-_.mjs";
 import "../std__assert-CxFT0MNt.mjs";
 import { t as assertRejects } from "../assert_rejects-wFbSPn1O.mjs";
-import { l as verifyRequest } from "../http-TjhZfiSN.mjs";
+import { l as verifyRequest } from "../http-Day1kcpT.mjs";
 import { i as rsaPrivateKey2 } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-B3kuDBg9.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-Dg_7gMC7.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { UrlError } from "@fedify/vocab-runtime";
 //#region src/utils/docloader.test.ts

package/dist/utils/kv-cache.test.mjs

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as kvCache, t as MockKvStore } from "../kv-cache-CpILvhUV.mjs";
+import { n as kvCache, t as MockKvStore } from "../kv-cache-Bz6aQOOX.mjs";
 import { deepStrictEqual, throws } from "node:assert";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { preloadedContexts } from "@fedify/vocab-runtime";

package/dist/utils/mod.cjs

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_kv_cache = require("../kv-cache-BTVaZrf-.cjs");
+const require_kv_cache = require("../kv-cache-C4U_uBqD.cjs");
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.kvCache = require_kv_cache.kvCache;

package/dist/utils/mod.js

@@ -1,4 +1,4 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-CQsh-KUw.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-BIAB0HKx.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "2.4.0-dev.1727+1eadcb04",
+  "version": "2.4.0-dev.1740+32e9952c",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",
@@ -151,10 +151,10 @@
     "structured-field-values": "^2.0.4",
     "temporal-polyfill": "^1.0.1",
     "urlpattern-polyfill": "^10.1.0",
-    "@fedify/uri-template": "2.4.0-dev.1727+1eadcb04",
-    "@fedify/vocab": "2.4.0-dev.1727+1eadcb04",
-    "@fedify/vocab-runtime": "2.4.0-dev.1727+1eadcb04",
-    "@fedify/webfinger": "2.4.0-dev.1727+1eadcb04"
+    "@fedify/uri-template": "2.4.0-dev.1740+32e9952c",
+    "@fedify/vocab": "2.4.0-dev.1740+32e9952c",
+    "@fedify/vocab-runtime": "2.4.0-dev.1740+32e9952c",
+    "@fedify/webfinger": "2.4.0-dev.1740+32e9952c"
   },
   "devDependencies": {
     "@std/assert": "npm:@jsr/std__assert@^0.226.0",
@@ -167,7 +167,7 @@
     "typescript": "^6.0.0",
     "wrangler": "^4.17.0",
     "@fedify/fixture": "2.0.0",
-    "@fedify/vocab-tools": "^2.4.0-dev.1727+1eadcb04"
+    "@fedify/vocab-tools": "^2.4.0-dev.1740+32e9952c"
   },
   "scripts": {
     "build:self": "tsdown",

package/dist/proof-DeMR7Akd.mjs

@@ -1,316 +0,0 @@
-import { Temporal } from "temporal-polyfill";
-import "urlpattern-polyfill";
-globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Deyoxesx.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-AlCGTDrr.mjs";
-import { n as fetchKey, o as validateCryptoKey } from "./key-b4kf4yZT.mjs";
-import { n as preloadedOnlyDocumentLoader } from "./public-audience--9hx7IGx.mjs";
-import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-BQSHRLhg.mjs";
-import { getLogger } from "@logtape/logtape";
-import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
-import { SpanStatusCode, trace } from "@opentelemetry/api";
-import { haveSameFe34Origin } from "@fedify/vocab-runtime";
-import { encodeHex } from "byte-encodings/hex";
-import serialize from "json-canon";
-//#region src/sig/proof.ts
-/**
-* Known Object Integrity Proof `cryptosuite` values, used to keep
-* `object_integrity_proofs.cryptosuite` on a bounded set of spec-defined
-* string values.  Fedify currently signs and verifies only
-* `eddsa-jcs-2022`; other values come in only from external proofs and are
-* dropped from the metric attribute to avoid attacker-controlled
-* cardinality.
-*/
-const OIP_KNOWN_CRYPTOSUITES = /* @__PURE__ */ new Set(["eddsa-jcs-2022"]);
-const logger = getLogger([
-	"fedify",
-	"sig",
-	"proof"
-]);
-/**
-* Checks if the given JSON-LD document has a DataIntegrityProof-like object,
-* without fully deserializing it into vocabulary classes.
-* @param jsonLd The JSON-LD document to check.
-* @returns `true` if the document has a proof-like object; `false` otherwise.
-* @since 2.2.0
-*/
-function hasProofLike(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return false;
-	const record = jsonLd;
-	const proof = record.proof ?? record["https://w3id.org/security#proof"];
-	const getField = (source, compact, expanded) => source[compact] ?? source[expanded];
-	const isReference = (value) => {
-		if (typeof value === "string") return true;
-		if (Array.isArray(value)) return value.some(isReference);
-		return typeof value === "object" && value != null && ("id" in value && typeof value.id === "string" || "@id" in value && typeof value["@id"] === "string" || "@value" in value && typeof value["@value"] === "string");
-	};
-	const hasType = (value) => {
-		if (typeof value === "string") return value === "DataIntegrityProof" || value === "https://w3id.org/security#DataIntegrityProof";
-		if (Array.isArray(value)) return value.some(hasType);
-		return false;
-	};
-	const isProofLike = (value) => {
-		if (typeof value !== "object" || value == null) return false;
-		const proofRecord = value;
-		return hasType(proofRecord.type ?? proofRecord["@type"]) && isReference(getField(proofRecord, "verificationMethod", "https://w3id.org/security#verificationMethod")) && isReference(getField(proofRecord, "proofPurpose", "https://w3id.org/security#proofPurpose")) && isReference(getField(proofRecord, "proofValue", "https://w3id.org/security#proofValue"));
-	};
-	return Array.isArray(proof) ? proof.some(isProofLike) : isProofLike(proof);
-}
-/**
-* Creates a proof for the given object.
-* @param object The object to create a proof for.
-* @param privateKey The private key to sign the proof with.
-* @param keyId The key ID to use in the proof. It will be used by the verifier.
-* @param options Additional options.  See also {@link CreateProofOptions}.
-* @returns The created proof.
-* @throws {TypeError} If the private key is invalid or unsupported.
-* @since 0.10.0
-*/
-async function createProof(object, privateKey, keyId, { contextLoader, context, created } = {}) {
-	validateCryptoKey(privateKey, "private");
-	if (privateKey.algorithm.name !== "Ed25519") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
-	let compactMsg = await object.clone({ proofs: [] }).toJsonLd({
-		format: "compact",
-		contextLoader,
-		context
-	});
-	compactMsg = await normalizeOutgoingActivityJsonLd(compactMsg, contextLoader);
-	const msgCanon = serialize(compactMsg);
-	const encoder = new TextEncoder();
-	const msgBytes = encoder.encode(msgCanon);
-	const msgDigest = await crypto.subtle.digest("SHA-256", msgBytes);
-	created ??= Temporal.Now.instant();
-	const proofCanon = serialize({
-		"@context": compactMsg["@context"],
-		type: "DataIntegrityProof",
-		cryptosuite: "eddsa-jcs-2022",
-		verificationMethod: keyId.href,
-		proofPurpose: "assertionMethod",
-		created: created.toString()
-	});
-	const proofBytes = encoder.encode(proofCanon);
-	const proofDigest = await crypto.subtle.digest("SHA-256", proofBytes);
-	const digest = new Uint8Array(proofDigest.byteLength + msgDigest.byteLength);
-	digest.set(new Uint8Array(proofDigest), 0);
-	digest.set(new Uint8Array(msgDigest), proofDigest.byteLength);
-	const sig = await crypto.subtle.sign("Ed25519", privateKey, digest);
-	return new DataIntegrityProof({
-		cryptosuite: "eddsa-jcs-2022",
-		verificationMethod: keyId,
-		proofPurpose: "assertionMethod",
-		created: created ?? Temporal.Now.instant(),
-		proofValue: new Uint8Array(sig)
-	});
-}
-/**
-* Signs the given object with the private key and returns the signed object.
-* @param object The object to create a proof for.
-* @param privateKey The private key to sign the proof with.
-* @param keyId The key ID to use in the proof. It will be used by the verifier.
-* @param options Additional options.  See also {@link SignObjectOptions}.
-* @returns The signed object.
-* @throws {TypeError} If the private key is invalid or unsupported.
-* @since 0.10.0
-*/
-async function signObject(object, privateKey, keyId, options = {}) {
-	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("object_integrity_proofs.sign", { attributes: { "activitypub.object.type": getTypeId(object).href } }, async (span) => {
-		try {
-			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
-			const existingProofs = [];
-			for await (const proof of object.getProofs(options)) existingProofs.push(proof);
-			const proof = await createProof(object, privateKey, keyId, options);
-			if (span.isRecording()) {
-				if (proof.cryptosuite != null) span.setAttribute("object_integrity_proofs.cryptosuite", proof.cryptosuite);
-				if (proof.verificationMethodId != null) span.setAttribute("object_integrity_proofs.key_id", proof.verificationMethodId.href);
-				if (proof.proofValue != null) span.setAttribute("object_integrity_proofs.signature", encodeHex(proof.proofValue));
-			}
-			return object.clone({ proofs: [...existingProofs, proof] });
-		} catch (error) {
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			span.end();
-		}
-	});
-}
-/**
-* Verifies the given proof for the object.
-* @param jsonLd The JSON-LD object to verify the proof for.  If it contains
-*               any proofs, they will be ignored.
-* @param proof The proof to verify.
-* @param options Additional options.  See also {@link VerifyProofOptions}.
-* @returns The public key that was used to sign the proof, or `null` if the
-*          proof is invalid.
-* @since 0.10.0
-*/
-async function verifyProof(jsonLd, proof, options = {}) {
-	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("object_integrity_proofs.verify", async (span) => {
-		const start = performance.now();
-		let verified = false;
-		let threw = false;
-		const cryptosuite = proof.cryptosuite != null && OIP_KNOWN_CRYPTOSUITES.has(proof.cryptosuite) ? proof.cryptosuite : void 0;
-		if (span.isRecording()) {
-			if (proof.cryptosuite != null) span.setAttribute("object_integrity_proofs.cryptosuite", proof.cryptosuite);
-			if (proof.verificationMethodId != null) span.setAttribute("object_integrity_proofs.key_id", proof.verificationMethodId.href);
-			if (proof.proofValue != null) span.setAttribute("object_integrity_proofs.signature", encodeHex(proof.proofValue));
-		}
-		try {
-			const key = await verifyProofInternal(jsonLd, proof, options);
-			if (key == null) span.setStatus({ code: SpanStatusCode.ERROR });
-			else verified = true;
-			return key;
-		} catch (error) {
-			threw = true;
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			const classified = threw ? "error" : verified ? "verified" : "rejected";
-			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "object_integrity", classified, { cryptosuite });
-			span.end();
-		}
-	});
-}
-async function verifyProofInternal(jsonLd, proof, options) {
-	if (typeof jsonLd !== "object" || jsonLd == null || Array.isArray(jsonLd) || proof.cryptosuite !== "eddsa-jcs-2022" || proof.verificationMethodId == null || proof.proofPurpose !== "assertionMethod" || proof.proofValue == null || proof.created == null) return null;
-	const publicKeyPromise = measureSignatureKeyFetch(options.meterProvider, "object_integrity", () => fetchKey(proof.verificationMethodId, Multikey, options));
-	const proofConfig = {
-		"@context": jsonLd["@context"],
-		type: "DataIntegrityProof",
-		cryptosuite: proof.cryptosuite,
-		verificationMethod: proof.verificationMethodId.href,
-		proofPurpose: proof.proofPurpose,
-		created: proof.created.toString()
-	};
-	const encoder = new TextEncoder();
-	const proofBytes = encoder.encode(serialize(proofConfig));
-	const proofDigest = await crypto.subtle.digest("SHA-256", proofBytes);
-	const msg = { ...jsonLd };
-	if ("proof" in msg) delete msg.proof;
-	if ("https://w3id.org/security#proof" in msg) delete msg["https://w3id.org/security#proof"];
-	let fetchedKey;
-	try {
-		fetchedKey = await publicKeyPromise;
-	} catch (error) {
-		logger.debug("Failed to get the key (verificationMethod) for the proof:\n{proof}", {
-			proof,
-			keyId: proof.verificationMethodId.href,
-			error
-		});
-		return null;
-	}
-	const publicKey = fetchedKey.key;
-	if (publicKey == null) {
-		logger.debug("Failed to get the key (verificationMethod) for the proof:\n{proof}", {
-			proof,
-			keyId: proof.verificationMethodId.href
-		});
-		return null;
-	}
-	if (publicKey.publicKey.algorithm.name !== "Ed25519") {
-		if (fetchedKey.cached) {
-			logger.debug("The cached key (verificationMethod) for the proof is not a valid Ed25519 key:\n{keyId}; retrying with the freshly fetched key...", {
-				proof,
-				keyId: proof.verificationMethodId.href
-			});
-			return await verifyProofInternal(jsonLd, proof, {
-				...options,
-				keyCache: {
-					get: () => Promise.resolve(void 0),
-					set: async (keyId, key) => await options.keyCache?.set(keyId, key)
-				}
-			});
-		}
-		logger.debug("The fetched key (verificationMethod) for the proof is not a valid Ed25519 key:\n{keyId}", {
-			proof,
-			keyId: proof.verificationMethodId.href
-		});
-		return null;
-	}
-	const digest = new Uint8Array(proofDigest.byteLength + 32);
-	digest.set(new Uint8Array(proofDigest), 0);
-	const proofValue = proof.proofValue;
-	const verifyCandidate = async (candidate) => {
-		const msgBytes = encoder.encode(serialize(candidate));
-		const msgDigest = await crypto.subtle.digest("SHA-256", msgBytes);
-		digest.set(new Uint8Array(msgDigest), proofDigest.byteLength);
-		return await crypto.subtle.verify("Ed25519", publicKey.publicKey, proofValue.slice(), digest);
-	};
-	if (await verifyCandidate(msg)) return publicKey;
-	const normalized = await normalizeOutgoingActivityJsonLd(msg, preloadedOnlyDocumentLoader);
-	if (normalized !== msg && await verifyCandidate(normalized)) return publicKey;
-	if (fetchedKey.cached) {
-		logger.debug("Failed to verify the proof with the cached key {keyId}; retrying with the freshly fetched key...", {
-			keyId: proof.verificationMethodId.href,
-			proof
-		});
-		return await verifyProofInternal(jsonLd, proof, {
-			...options,
-			keyCache: {
-				get: () => Promise.resolve(void 0),
-				set: async (keyId, key) => await options.keyCache?.set(keyId, key)
-			}
-		});
-	}
-	logger.debug("Failed to verify the proof with the fetched key {keyId}:\n{proof}", {
-		keyId: proof.verificationMethodId.href,
-		proof
-	});
-	return null;
-}
-/**
-* Verifies the given object.  It will verify all the proofs in the object,
-* and succeed only if all the proofs are valid and all attributions and
-* actors are authenticated by the proofs.
-* @template T The type of the object to verify.
-* @param cls The class of the object to verify.  It must be a subclass of
-*            the {@link Object}.
-* @param jsonLd The JSON-LD object to verify.  It's assumed that the object
-*               is a compacted JSON-LD representation of a `T` with `@context`.
-* @param options Additional options.  See also {@link VerifyObjectOptions}.
-* @returns The object if it's verified, or `null` if it's not.
-* @throws {TypeError} If the object is invalid or unsupported.
-* @since 0.10.0
-*/
-async function verifyObject(cls, jsonLd, options = {}) {
-	const logger = getLogger([
-		"fedify",
-		"sig",
-		"proof"
-	]);
-	const object = await cls.fromJsonLd(jsonLd, options);
-	const attributions = new Set(object.attributionIds.map((uri) => uri.href));
-	if (object instanceof Activity) for (const uri of object.actorIds) attributions.add(uri.href);
-	for await (const proof of object.getProofs(options)) {
-		const key = await verifyProof(jsonLd, proof, options);
-		if (key === null) return null;
-		if (proof.verificationMethodId == null) return null;
-		if (key.controllerId == null) {
-			logger.debug("Key {keyId} does not have a controller.", { keyId: key.id?.href });
-			continue;
-		}
-		deleteAuthenticatedAttribution(attributions, key.controllerId, proof.verificationMethodId);
-	}
-	if (attributions.size > 0) {
-		logger.debug("Some attributions are not authenticated by the proofs: {attributions}.", { attributions: [...attributions] });
-		return null;
-	}
-	return object;
-}
-function deleteAuthenticatedAttribution(attributions, controllerId, verificationMethodId) {
-	const controllerHasCryptographicOrigin = hasCryptographicOrigin(controllerId.href);
-	const verificationMethodMatchesController = controllerHasCryptographicOrigin && hasCryptographicOrigin(verificationMethodId.href) && haveSameFe34Origin(controllerId, verificationMethodId);
-	if (!controllerHasCryptographicOrigin || verificationMethodMatchesController) attributions.delete(controllerId.href);
-	if (!verificationMethodMatchesController) return;
-	for (const attribution of [...attributions]) if (hasCryptographicOrigin(attribution) && haveSameFe34Origin(controllerId, attribution)) attributions.delete(attribution);
-}
-function hasCryptographicOrigin(iri) {
-	return /^did:/i.test(iri) || /^ap(?:\+ef61)?:\/\//i.test(iri);
-}
-//#endregion
-export { verifyProof as a, verifyObject as i, hasProofLike as n, signObject as r, createProof as t };