@fedify/fedify 2.4.0-dev.1964 → 2.4.0-dev.1995

package/dist/{proof-D5Ajk4DJ.mjs → proof-BDxNVZ3E.mjs}

@@ -1,12 +1,12 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CtG93ohj.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B9N27cCB.mjs";
-import { n as fetchKey, o as validateCryptoKey } from "./key-BVjgbs_9.mjs";
+import { n as version, t as name } from "./deno-CABhzCb_.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CISXCvB1.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-Ccs8cnd7.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience-Cc2YJ3ip.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-B5Ne7JoL.mjs";
-import { c as getNormalizationContextLoader } from "./ld-OuCeQFny.mjs";
+import { c as getNormalizationContextLoader } from "./ld-qup__MAW.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -164,7 +164,31 @@ async function signObject(object, privateKey, keyId, options = {}) {
 async function verifyProof(jsonLd, proof, options = {}) {
 	return await verifyProofWithMessageDigestCache(jsonLd, proof, options);
 }
-async function verifyProofWithMessageDigestCache(jsonLd, proof, options, messageDigestCache = {}, rawProofCandidate) {
+/**
+* Verifies the one direct literal proof on a map-local secured document.
+*
+* Unlike {@link verifyProof}, this removes only the literal `proof` member
+* from the message digest.  JSON-LD aliases remain part of the signed input,
+* and the document's received `@context` is not replaced by the proof
+* configuration context.
+*
+* @internal
+*/
+async function verifyMapLocalProof(jsonLd, options = {}) {
+	if (!isJsonLdNode(jsonLd) || !globalThis.Object.hasOwn(jsonLd, "proof") || !isJsonLdNode(jsonLd.proof)) return null;
+	const proofContextLoader = getNormalizationContextLoader(preloadedOnlyDocumentLoader);
+	try {
+		const [candidate] = await parseRawProofCandidates(jsonLd, [jsonLd.proof], options, proofContextLoader);
+		if (candidate.proof == null) return null;
+		return await verifyProofWithMessageDigestCache(jsonLd, candidate.proof, options, {
+			proofContextLoader,
+			proofPropertyMode: "literal"
+		}, candidate);
+	} catch {
+		return null;
+	}
+}
+async function verifyProofWithMessageDigestCache(jsonLd, proof, options, messageDigestCache = {}, rawProofCandidate, keyIdBoundByCaller = false) {
 	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("object_integrity_proofs.verify", async (span) => {
 		const start = performance.now();
 		let verified = false;
@@ -176,7 +200,7 @@ async function verifyProofWithMessageDigestCache(jsonLd, proof, options, message
 			if (proof.proofValue != null) span.setAttribute("object_integrity_proofs.signature", encodeHex(proof.proofValue));
 		}
 		try {
-			const key = await verifyProofInternal(jsonLd, proof, options, messageDigestCache, rawProofCandidate);
+			const key = await verifyProofInternal(jsonLd, proof, options, messageDigestCache, rawProofCandidate, keyIdBoundByCaller);
 			if (key == null) span.setStatus({ code: SpanStatusCode.ERROR });
 			else verified = true;
 			return key;
@@ -234,10 +258,11 @@ async function getJsonLdPropertyNames(jsonLd, propertyIri, defaults, documentLoa
 async function getProofPropertyNames(jsonLd, documentLoader = preloadedOnlyDocumentLoader) {
 	return await getJsonLdPropertyNames(jsonLd, SECURITY_PROOF, ["proof", SECURITY_PROOF], documentLoader) ?? /* @__PURE__ */ new Set(["proof", SECURITY_PROOF]);
 }
-async function createProofMessageDigests(jsonLd, proofContextLoader, context) {
+async function createProofMessageDigests(jsonLd, proofContextLoader, context, proofPropertyMode = "jsonLd") {
 	const msg = { ...jsonLd };
-	for (const property of await getProofPropertyNames(msg, proofContextLoader)) delete msg[property];
-	if (context != null) msg["@context"] = structuredClone(context);
+	if (proofPropertyMode === "literal") delete msg.proof;
+	else for (const property of await getProofPropertyNames(msg, proofContextLoader)) delete msg[property];
+	if (proofPropertyMode === "jsonLd" && context != null) msg["@context"] = structuredClone(context);
 	const encoder = new TextEncoder();
 	const digest = async (value) => {
 		const bytes = encoder.encode(serialize(value));
@@ -493,12 +518,15 @@ async function hasValidProofOptions(proofConfig, options, documentLoader) {
 	if (previousProof == null || previousProof.present && typeof previousProof.value !== "string" && (!Array.isArray(previousProof.value) || previousProof.value.some((item) => typeof item !== "string"))) return false;
 	return true;
 }
-async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, rawProofCandidate) {
+async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, rawProofCandidate, keyIdBoundByCaller = false) {
 	if (!isJsonLdNode(jsonLd) || proof.cryptosuite !== "eddsa-jcs-2022" || proof.verificationMethodId == null || proof.proofPurpose !== "assertionMethod" || proof.proofValue == null || proof.created == null) return null;
 	const proofContextLoader = messageDigestCache.proofContextLoader ?? preloadedOnlyDocumentLoader;
 	const proofConfiguration = await createProofConfiguration(jsonLd, proof, options, proofContextLoader, rawProofCandidate);
 	if (proofConfiguration == null || !await hasValidProofOptions(proofConfiguration.value, options, proofContextLoader)) return null;
-	const publicKeyPromise = measureSignatureKeyFetch(options.meterProvider, "object_integrity", () => fetchKey(proof.verificationMethodId, Multikey, options));
+	const publicKeyPromise = measureSignatureKeyFetch(options.meterProvider, "object_integrity", () => fetchKey(proof.verificationMethodId, Multikey, {
+		...options,
+		keyIdBoundByCaller
+	}));
 	const proofBytes = new TextEncoder().encode(serialize(proofConfiguration.value));
 	const proofDigest = await crypto.subtle.digest("SHA-256", proofBytes);
 	let fetchedKey;
@@ -532,7 +560,7 @@ async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, r
 					get: () => Promise.resolve(void 0),
 					set: async (keyId, key) => await options.keyCache?.set(keyId, key)
 				}
-			}, messageDigestCache, rawProofCandidate);
+			}, messageDigestCache, rawProofCandidate, keyIdBoundByCaller);
 		}
 		logger.debug("The fetched key (verificationMethod) for the proof is not a valid Ed25519 key:\n{keyId}", {
 			proof,
@@ -551,13 +579,15 @@ async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, r
 	const messageDigestValues = messageDigestCache.values ??= /* @__PURE__ */ new Map();
 	let messageDigestsPromise = messageDigestValues.get(messageDigestKey);
 	if (messageDigestsPromise == null) {
-		messageDigestsPromise = createProofMessageDigests(jsonLd, messageDigestCache.proofContextLoader, proofConfiguration.context);
+		messageDigestsPromise = createProofMessageDigests(jsonLd, messageDigestCache.proofContextLoader, proofConfiguration.context, messageDigestCache.proofPropertyMode);
 		messageDigestValues.set(messageDigestKey, messageDigestsPromise);
 	}
 	const messageDigests = await messageDigestsPromise;
 	if (await verifyCandidate(messageDigests.onWire)) return publicKey;
-	const normalizedDigest = await messageDigests.normalized();
-	if (normalizedDigest != null && await verifyCandidate(normalizedDigest)) return publicKey;
+	if (messageDigestCache.proofPropertyMode !== "literal") {
+		const normalizedDigest = await messageDigests.normalized();
+		if (normalizedDigest != null && await verifyCandidate(normalizedDigest)) return publicKey;
+	}
 	if (fetchedKey.cached) {
 		logger.debug("Failed to verify the proof with the cached key {keyId}; retrying with the freshly fetched key...", {
 			keyId: proof.verificationMethodId.href,
@@ -569,7 +599,7 @@ async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, r
 				get: () => Promise.resolve(void 0),
 				set: async (keyId, key) => await options.keyCache?.set(keyId, key)
 			}
-		}, messageDigestCache, rawProofCandidate);
+		}, messageDigestCache, rawProofCandidate, keyIdBoundByCaller);
 	}
 	logger.debug("Failed to verify the proof with the fetched key {keyId}:\n{proof}", {
 		keyId: proof.verificationMethodId.href,
@@ -649,59 +679,55 @@ async function expandPortableObjectRoot(jsonLd, contextLoader) {
 		}
 	};
 }
-/**
-* Verifies the FEP-ef61 Object Integrity Proof policy for a portable object.
-*
-* This applies the FEP-2277 core-type classification to the top-level JSON-LD
-* node.  Portable actors, activities, and objects require proofs.  A portable
-* collection without a proof is reported separately so a caller can apply a
-* gateway trust policy.  Embedded portable objects are not traversed.
-*
-* Every proof must use a DID URL whose DID matches the portable object's
-* authority, and every proof must pass {@link verifyProof}.
-*
-* @param jsonLd The JSON-LD document to verify.
-* @param options Additional options.  See also
-*                {@link VerifyPortableObjectProofOptions}.
-* @returns The detailed portable proof-policy result.
-* @throws {TypeError} If the input is not a single JSON-LD object or has a
-*                     malformed portable ID.
-* @since 2.4.0
-*/
-async function verifyPortableObjectProof(jsonLd, options = {}) {
+async function preparePortableObjectProof(jsonLd, options) {
 	if (isJsonLdNode(jsonLd) && typeof jsonLd["@id"] === "string" && !PORTABLE_OBJECT_ID_PATTERN.test(jsonLd["@id"])) return {
-		verified: false,
-		reason: { type: "notPortableObject" }
+		prepared: false,
+		result: {
+			verified: false,
+			reason: { type: "notPortableObject" }
+		}
 	};
 	const { root, proofContextLoader } = await expandPortableObjectRoot(jsonLd, options.contextLoader);
 	const id = root["@id"];
 	if (typeof id !== "string" || !PORTABLE_OBJECT_ID_PATTERN.test(id)) return {
-		verified: false,
-		reason: { type: "notPortableObject" }
+		prepared: false,
+		result: {
+			verified: false,
+			reason: { type: "notPortableObject" }
+		}
 	};
 	const objectId = parseIri(id);
 	getFe34Origin(objectId);
 	const objectType = classifyFep2277CoreType(root);
 	if (objectType === "verificationMethod" || objectType === "publicKey" || objectType === "link") return {
-		verified: false,
-		reason: {
-			type: "unsupportedObjectType",
-			objectType
+		prepared: false,
+		result: {
+			verified: false,
+			reason: {
+				type: "unsupportedObjectType",
+				objectType
+			}
 		}
 	};
 	const proofValues = root[SECURITY_PROOF];
-	if (proofValues == null || Array.isArray(proofValues) && proofValues.length < 1) return objectType === "collection" ? {
-		verified: false,
-		reason: { type: "unsecuredCollection" }
-	} : {
-		verified: false,
-		reason: { type: "missingProof" }
+	if (proofValues == null || Array.isArray(proofValues) && proofValues.length < 1) return {
+		prepared: false,
+		result: objectType === "collection" ? {
+			verified: false,
+			reason: { type: "unsecuredCollection" }
+		} : {
+			verified: false,
+			reason: { type: "missingProof" }
+		}
 	};
 	if (!Array.isArray(proofValues)) return {
-		verified: false,
-		reason: {
-			type: "invalidProof",
-			proofIndex: 0
+		prepared: false,
+		result: {
+			verified: false,
+			reason: {
+				type: "invalidProof",
+				proofIndex: 0
+			}
 		}
 	};
 	const rawProofValues = isJsonLdNode(jsonLd) ? await getRawProofValues(jsonLd, proofContextLoader) : [];
@@ -709,10 +735,13 @@ async function verifyPortableObjectProof(jsonLd, options = {}) {
 	for (let proofIndex = 0; proofIndex < proofValues.length; proofIndex++) {
 		const proofValue = proofValues[proofIndex];
 		if (!hasValidPortableProofShape(proofValue)) return {
-			verified: false,
-			reason: {
-				type: "invalidProof",
-				proofIndex
+			prepared: false,
+			result: {
+				verified: false,
+				reason: {
+					type: "invalidProof",
+					proofIndex
+				}
 			}
 		};
 		let proof;
@@ -720,10 +749,13 @@ async function verifyPortableObjectProof(jsonLd, options = {}) {
 			proof = await DataIntegrityProof.fromJsonLd(proofValue, options);
 		} catch {
 			return {
-				verified: false,
-				reason: {
-					type: "invalidProof",
-					proofIndex
+				prepared: false,
+				result: {
+					verified: false,
+					reason: {
+						type: "invalidProof",
+						proofIndex
+					}
 				}
 			};
 		}
@@ -732,18 +764,24 @@ async function verifyPortableObjectProof(jsonLd, options = {}) {
 	for (let proofIndex = 0; proofIndex < proofs.length; proofIndex++) {
 		const verificationMethod = proofs[proofIndex].verificationMethodId;
 		if (verificationMethod == null) return {
-			verified: false,
-			reason: {
-				type: "invalidProof",
-				proofIndex
+			prepared: false,
+			result: {
+				verified: false,
+				reason: {
+					type: "invalidProof",
+					proofIndex
+				}
 			}
 		};
 		if (verificationMethod.protocol !== "did:") return {
-			verified: false,
-			reason: {
-				type: "unsupportedVerificationMethod",
-				proofIndex,
-				verificationMethod
+			prepared: false,
+			result: {
+				verified: false,
+				reason: {
+					type: "unsupportedVerificationMethod",
+					proofIndex,
+					verificationMethod
+				}
 			}
 		};
 		try {
@@ -751,24 +789,89 @@ async function verifyPortableObjectProof(jsonLd, options = {}) {
 		} catch (error) {
 			if (!(error instanceof TypeError)) throw error;
 			return {
+				prepared: false,
+				result: {
+					verified: false,
+					reason: {
+						type: "unsupportedVerificationMethod",
+						proofIndex,
+						verificationMethod
+					}
+				}
+			};
+		}
+		if (!haveSameFe34Origin(objectId, verificationMethod)) return {
+			prepared: false,
+			result: {
 				verified: false,
 				reason: {
-					type: "unsupportedVerificationMethod",
+					type: "verificationMethodMismatch",
 					proofIndex,
+					objectId,
 					verificationMethod
 				}
-			};
-		}
-		if (!haveSameFe34Origin(objectId, verificationMethod)) return {
-			verified: false,
-			reason: {
-				type: "verificationMethodMismatch",
-				proofIndex,
-				objectId,
-				verificationMethod
 			}
 		};
 	}
+	return {
+		prepared: true,
+		objectId,
+		proofs,
+		rawProofValues,
+		proofContextLoader
+	};
+}
+/**
+* Applies portable-object proof policy to one map-local cryptographic result.
+*
+* @internal
+*/
+async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
+	const policyOptions = {
+		...options,
+		contextLoader: preloadedOnlyDocumentLoader
+	};
+	const prepared = await preparePortableObjectProof(jsonLd, policyOptions);
+	if (!prepared.prepared) return prepared.result;
+	const policyProof = prepared.proofs[0];
+	const literalProof = isJsonLdNode(jsonLd) && isJsonLdNode(jsonLd.proof) ? (await parseRawProofCandidates(jsonLd, [jsonLd.proof], policyOptions, prepared.proofContextLoader))[0]?.proof : null;
+	const verificationMethod = policyProof?.verificationMethodId;
+	if (prepared.proofs.length !== 1 || key == null || policyProof == null || literalProof == null || !sameProof(policyProof, literalProof) || verificationMethod == null || key.id?.href !== verificationMethod.href) return {
+		verified: false,
+		reason: {
+			type: "invalidProof",
+			proofIndex: prepared.proofs.length > 1 ? 1 : 0
+		}
+	};
+	return {
+		verified: true,
+		keys: [key],
+		objectId: formatIri(prepared.objectId)
+	};
+}
+/**
+* Verifies the FEP-ef61 Object Integrity Proof policy for a portable object.
+*
+* This applies the FEP-2277 core-type classification to the top-level JSON-LD
+* node.  Portable actors, activities, and objects require proofs.  A portable
+* collection without a proof is reported separately so a caller can apply a
+* gateway trust policy.  Embedded portable objects are not traversed.
+*
+* Every proof must use a DID URL whose DID matches the portable object's
+* authority, and every proof must pass {@link verifyProof}.
+*
+* @param jsonLd The JSON-LD document to verify.
+* @param options Additional options.  See also
+*                {@link VerifyPortableObjectProofOptions}.
+* @returns The detailed portable proof-policy result.
+* @throws {TypeError} If the input is not a single JSON-LD object or has a
+*                     malformed portable ID.
+* @since 2.4.0
+*/
+async function verifyPortableObjectProof(jsonLd, options = {}) {
+	const prepared = await preparePortableObjectProof(jsonLd, options);
+	if (!prepared.prepared) return prepared.result;
+	const { proofs, rawProofValues, proofContextLoader } = prepared;
 	const keys = [];
 	const rawProofCandidatePool = {
 		candidates: await parseRawProofCandidates(jsonLd, rawProofValues, options, proofContextLoader),
@@ -784,7 +887,7 @@ async function verifyPortableObjectProof(jsonLd, options = {}) {
 				proofIndex
 			}
 		};
-		const key = await verifyProofWithMessageDigestCache(jsonLd, proofs[proofIndex], options, messageDigestCache, rawProofCandidate);
+		const key = await verifyProofWithMessageDigestCache(jsonLd, proofs[proofIndex], options, messageDigestCache, rawProofCandidate, true);
 		if (key == null) return {
 			verified: false,
 			reason: {
@@ -887,4 +990,4 @@ function hasCryptographicOrigin(iri) {
 	return /^did:/i.test(iri) || /^ap(?:\+ef61)?:\/\//i.test(iri);
 }
 //#endregion
-export { verifyPortableObjectProof as a, verifyObject as i, hasProofLike as n, verifyProof as o, signObject as r, createProof as t };
+export { verifyObject as a, verifyProof as c, verifyMapLocalProof as i, hasProofLike as n, verifyPortableObjectProof as o, signObject as r, verifyPortableObjectProofPolicy as s, createProof as t };

package/dist/{send-DVXyUqhO.mjs → send-BzM5GLyn.mjs}

@@ -1,12 +1,12 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CtG93ohj.mjs";
-import { n as getDurationMs, r as getFederationMetrics } from "./metrics-B9N27cCB.mjs";
-import { n as doubleKnock } from "./http-D7LX-BL9.mjs";
+import { n as version, t as name } from "./deno-CABhzCb_.mjs";
+import { n as getDurationMs, r as getFederationMetrics } from "./metrics-CISXCvB1.mjs";
+import { n as doubleKnock } from "./http-D9urSO2D.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
-import { FetchError } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, validatePublicUrl } from "@fedify/vocab-runtime";
 //#region src/federation/send.ts
 /**
 * Extracts the inbox URLs from recipients.
@@ -112,7 +112,7 @@ async function readLimitedResponseBody(response, maxBytes) {
 	if (truncated) result += "… (truncated)";
 	return result;
 }
-async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, headers, specDeterminer, meterProvider, tracerProvider }, span) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
@@ -121,12 +121,25 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 	const federationMetrics = getFederationMetrics(meterProvider);
 	const started = performance.now();
 	let deliverySuccess = false;
+	async function validateUrl(url) {
+		if (!allowPrivateAddress) try {
+			await validatePublicUrl(url);
+		} catch (error) {
+			if (error instanceof UrlError) logger.error("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
+	}
+	await validateUrl(inbox.href);
 	headers = new Headers(headers);
 	headers.set("Content-Type", "application/activity+json");
 	const request = new Request(inbox, {
 		method: "POST",
 		headers,
-		body: JSON.stringify(activity)
+		body: JSON.stringify(activity),
+		redirect: "manual"
 	});
 	let rsaKey = null;
 	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
@@ -142,19 +155,20 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 	});
 	let response;
 	try {
-		response = rsaKey == null ? await fetch(request) : await doubleKnock(request, rsaKey, {
+		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await doubleKnock(request, rsaKey, {
 			tracerProvider,
-			specDeterminer
+			specDeterminer,
+			validateRedirect: validateUrl
 		});
 	} catch (error) {
-		const transportError = error instanceof FetchError ? error : createFetchError(inbox.href, error);
+		const failure = error instanceof FetchError || error instanceof UrlError ? error : createFetchError(inbox.href, error);
 		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
 			activityId,
 			inbox: inbox.href,
-			error: transportError
+			error: failure
 		});
 		federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
-		throw transportError;
+		throw failure;
 	}
 	try {
 		if (!response.ok) {
@@ -191,6 +205,49 @@ function createFetchError(url, cause) {
 	error.cause = cause;
 	return error;
 }
+async function fetchWithValidatedRedirects(request, validateUrl) {
+	let body = await request.clone().text();
+	for (let redirects = 0;; redirects++) {
+		const response = await fetch(request, { redirect: "manual" });
+		const location = response.headers.get("Location");
+		if (![
+			301,
+			302,
+			303,
+			307,
+			308
+		].includes(response.status) || location == null) return response;
+		await response.body?.cancel();
+		if (redirects >= 20) throw new TypeError("Too many redirects");
+		const url = new URL(location, request.url);
+		await validateUrl(url.href);
+		const headers = new Headers(request.headers);
+		if (url.origin !== new URL(request.url).origin) {
+			headers.delete("Authorization");
+			headers.delete("Proxy-Authorization");
+			headers.delete("Cookie");
+			headers.delete("Host");
+		}
+		let method = request.method;
+		if ((response.status === 301 || response.status === 302) && method === "POST" || response.status === 303 && method !== "GET" && method !== "HEAD") {
+			method = "GET";
+			body = void 0;
+			for (const name of [
+				"Content-Encoding",
+				"Content-Language",
+				"Content-Length",
+				"Content-Location",
+				"Content-Type"
+			]) headers.delete(name);
+		}
+		request = new Request(url, {
+			method,
+			headers,
+			body,
+			redirect: "manual"
+		});
+	}
+}
 /**
 * An error that is thrown when an activity fails to send to a remote inbox.
 * It contains structured information about the failure, including the HTTP

package/dist/sig/compound-proof-discovery.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";