@fedify/fedify 2.4.0-dev.1988 → 2.4.0-dev.2010

package/dist/{middleware-DCpiAsZi.mjs → middleware-pHwDTAnq.mjs}

@@ -1,26 +1,27 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BgMEefEr.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-CrqsHP0l.mjs";
+import { n as version, t as name } from "./deno-Ckq9TwCv.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-B47Cm5gK.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
-import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-Cwbg5ggV.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-CtidZS_t.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-DEYs99FZ.mjs";
-import { n as kvCache } from "./kv-cache-DHiR8yTf.mjs";
+import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-zxzx01Ec.mjs";
+import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-DZaAutqg.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-DUKEPG-O.mjs";
+import { n as kvCache } from "./kv-cache-CbrUX90H.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-B5Ne7JoL.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-DpnpgjyX.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-CzhdWyTt.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-BqVXJLW8.mjs";
-import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-DL8Iid3a.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-6jS4xFsX.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-Cts78G9N.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-CD_TN0e8.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-u3IJRhVx.mjs";
+import { a as verifyObject, n as hasProofLike, r as signObject } from "./proof-D3te0SP-.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-CDr0Zivk.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-asm96yV1.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-C5NqoLBJ.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
+import { n as inspectCompoundPortableObjectApplicability, r as verifyCompoundPortableObjectProofs } from "./compound-proof-7UIAueLV.mjs";
 import { t as KvKeyCache } from "./keycache-BUDHB5rY.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-DcyzeytP.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-DKhVF_Uk.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -513,6 +514,12 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 //#endregion
 //#region src/federation/handler.ts
 const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
+const INBOX_COMPOUND_PROOF_LIMITS = {
+	maxDepth: 64,
+	maxMaps: 1e4,
+	maxProofs: 32,
+	maxBytes: 10 * 1024 * 1024
+};
 function isRemoteContextLoadingFailure$1(error) {
 	return error instanceof Error && typeof error.details === "object" && error.details != null && error.details.code === "loading remote context failed";
 }
@@ -637,13 +644,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$2.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$1.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$2),
+		kind: getCollectionMetricKind(name$1),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -684,7 +691,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$2, filterPredicate);
+						const items = filterCollectionItems(page.items, name$1, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -724,7 +731,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 		} else {
 			const uri = new URL(baseUri);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -740,7 +747,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$2, filterPredicate);
+					const items = filterCollectionItems(page.items, name$1, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -1634,6 +1641,31 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	if (!skipSignatureVerification) {
+		if (inspectCompoundPortableObjectApplicability(json, INBOX_COMPOUND_PROOF_LIMITS) !== "absent") {
+			const compoundProof = await verifyCompoundPortableObjectProofs(json, INBOX_COMPOUND_PROOF_LIMITS, {
+				documentLoader: ctx.documentLoader,
+				keyCache,
+				meterProvider,
+				tracerProvider
+			});
+			if (compoundProof.status !== "ok" || !compoundProof.verified) {
+				logger.error("Failed to verify compound portable Object Integrity Proofs.", {
+					recipient,
+					activity: json,
+					reason: compoundProof.status === "unsupported" ? compoundProof.reason.type : "invalidProof"
+				});
+				span.setStatus({
+					code: SpanStatusCode.ERROR,
+					message: "Failed to verify compound portable Object Integrity Proofs."
+				});
+				return new Response("Failed to verify compound portable Object Integrity Proofs.", {
+					status: 401,
+					headers: { "Content-Type": "text/plain; charset=utf-8" }
+				});
+			}
+		}
+	}
 	if (pendingNonceLabel != null) {
 		if (!await verifySignatureNonce(request, kv, kvPrefixes.acceptSignatureNonce, pendingNonceLabel)) {
 			getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("invalidNonce", httpSigKey?.id == null ? void 0 : getRemoteHost(httpSigKey.id));
@@ -1808,8 +1840,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$1;
+	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
+		this.name = name$2;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;

package/dist/mod.cjs

@@ -3,11 +3,11 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-Z3anvCd-.cjs");
-const require_federation = require("./federation-DzPUG_AP.cjs");
+const require_http = require("./http-DQBfmkrS.cjs");
+const require_federation = require("./federation-CgbvMauV.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_proof = require("./proof-DHu5zI0Z.cjs");
-const require_kv_cache = require("./kv-cache-BM2-w-Wq.cjs");
+const require_owner = require("./owner--mNatWct.cjs");
+const require_kv_cache = require("./kv-cache-sy8OMNT8.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");
 require("./sig/mod.cjs");
@@ -21,17 +21,17 @@ exports.Router = require_federation.Router;
 exports.RouterError = require_federation.RouterError;
 exports.SendActivityError = require_federation.SendActivityError;
 exports.actorDehydrator = require_transformers.actorDehydrator;
-exports.attachSignature = require_proof.attachSignature;
+exports.attachSignature = require_owner.attachSignature;
 exports.autoIdAssigner = require_transformers.autoIdAssigner;
 exports.buildCollectionSynchronizationHeader = require_federation.buildCollectionSynchronizationHeader;
 exports.createExponentialBackoffPolicy = require_federation.createExponentialBackoffPolicy;
 exports.createFederation = require_federation.createFederation;
 exports.createFederationBuilder = require_federation.createFederationBuilder;
-exports.createProof = require_proof.createProof;
-exports.createSignature = require_proof.createSignature;
-exports.detachSignature = require_proof.detachSignature;
+exports.createProof = require_owner.createProof;
+exports.createSignature = require_owner.createSignature;
+exports.detachSignature = require_owner.detachSignature;
 exports.digest = require_federation.digest;
-exports.doesActorOwnKey = require_proof.doesActorOwnKey;
+exports.doesActorOwnKey = require_owner.doesActorOwnKey;
 exports.exportJwk = require_http.exportJwk;
 exports.fetchKey = require_http.fetchKey;
 exports.fetchKeyDetailed = require_http.fetchKeyDetailed;
@@ -40,11 +40,11 @@ exports.fulfillAcceptSignature = require_http.fulfillAcceptSignature;
 exports.generateCryptoKeyPair = require_http.generateCryptoKeyPair;
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.getDefaultActivityTransformers = require_transformers.getDefaultActivityTransformers;
-exports.getKeyOwner = require_proof.getKeyOwner;
+exports.getKeyOwner = require_owner.getKeyOwner;
 exports.getNodeInfo = require_types.getNodeInfo;
 exports.handleWebFinger = require_federation.handleWebFinger;
-exports.hasProofLike = require_proof.hasProofLike;
-exports.hasSignatureLike = require_proof.hasSignatureLike;
+exports.hasProofLike = require_owner.hasProofLike;
+exports.hasSignatureLike = require_owner.hasSignatureLike;
 exports.importJwk = require_http.importJwk;
 exports.kvCache = require_kv_cache.kvCache;
 exports.nodeInfoToJson = require_types.nodeInfoToJson;
@@ -54,17 +54,17 @@ exports.parseCircuitBreakerKvState = require_federation.parseCircuitBreakerKvSta
 exports.parseNodeInfo = require_types.parseNodeInfo;
 exports.respondWithObject = require_federation.respondWithObject;
 exports.respondWithObjectIfAcceptable = require_federation.respondWithObjectIfAcceptable;
-exports.signJsonLd = require_proof.signJsonLd;
-exports.signObject = require_proof.signObject;
+exports.signJsonLd = require_owner.signJsonLd;
+exports.signObject = require_owner.signObject;
 exports.signRequest = require_http.signRequest;
 exports.validateAcceptSignature = require_http.validateAcceptSignature;
-exports.verifyJsonLd = require_proof.verifyJsonLd;
-exports.verifyObject = require_proof.verifyObject;
-exports.verifyPortableObjectProof = require_proof.verifyPortableObjectProof;
-exports.verifyProof = require_proof.verifyProof;
+exports.verifyJsonLd = require_owner.verifyJsonLd;
+exports.verifyObject = require_owner.verifyObject;
+exports.verifyPortableObjectProof = require_owner.verifyPortableObjectProof;
+exports.verifyProof = require_owner.verifyProof;
 exports.verifyRequest = require_http.verifyRequest;
 exports.verifyRequestDetailed = require_http.verifyRequestDetailed;
-exports.verifySignature = require_proof.verifySignature;
+exports.verifySignature = require_owner.verifySignature;
 var _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 Object.keys(_fedify_vocab_runtime).forEach(function(k) {
 	if (k !== "default" && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {

package/dist/mod.js

@@ -3,11 +3,11 @@ import { URLPattern } from "urlpattern-polyfill";
 import "./rolldown-runtime-BC-Eo5Mj.js";
 import { n as autoIdAssigner, r as getDefaultActivityTransformers, t as actorDehydrator } from "./transformers-DAtXl_Kc.js";
 import "./compat/mod.js";
-import { F as validateAcceptSignature, M as formatAcceptSignature, N as fulfillAcceptSignature, P as parseAcceptSignature, a as verifyRequestDetailed, c as fetchKey, d as importJwk, i as verifyRequest, l as fetchKeyDetailed, o as exportJwk, r as signRequest, u as generateCryptoKeyPair } from "./http-CgwqtxAy.js";
-import { a as respondWithObject, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as SendActivityError, l as CircuitBreaker, n as handleWebFinger, o as respondWithObjectIfAcceptable, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-CeCj5caM.js";
+import { F as validateAcceptSignature, M as formatAcceptSignature, N as fulfillAcceptSignature, P as parseAcceptSignature, a as verifyRequestDetailed, c as fetchKey, d as importJwk, i as verifyRequest, l as fetchKeyDetailed, o as exportJwk, r as signRequest, u as generateCryptoKeyPair } from "./http-DQA2JOEJ.js";
+import { a as respondWithObject, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as SendActivityError, l as CircuitBreaker, n as handleWebFinger, o as respondWithObjectIfAcceptable, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-U0OIuqwD.js";
 import { n as getNodeInfo, r as parseNodeInfo, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { C as verifyJsonLd, a as verifyPortableObjectProof, c as doesActorOwnKey, f as attachSignature, h as detachSignature, i as verifyObject, l as getKeyOwner, m as createSignature, n as hasProofLike, o as verifyProof, r as signObject, t as createProof, v as hasSignatureLike, w as verifySignature, x as signJsonLd } from "./proof-CUghqhAf.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-CykuL0ya.js";
+import { S as signJsonLd, T as verifySignature, a as signObject, c as verifyPortableObjectProof, g as detachSignature, h as createSignature, i as hasProofLike, n as getKeyOwner, p as attachSignature, r as createProof, s as verifyObject, t as doesActorOwnKey, u as verifyProof, w as verifyJsonLd, y as hasSignatureLike } from "./owner-BNKC3s6G.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-BBoePTOJ.js";
 import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue, Router, RouterError } from "./federation/mod.js";
 import "./nodeinfo/mod.js";
 import "./runtime/mod.js";

package/dist/nodeinfo/handler.test.mjs

@@ -5,7 +5,7 @@ import { r as createRequestContext } from "../context-CbS35fLr.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-CBlRfA-_.mjs";
 import "../std__assert-CxFT0MNt.mjs";
-import { _ as handleNodeInfo, o as createFederation, v as handleNodeInfoJrd } from "../middleware-DCpiAsZi.mjs";
+import { _ as handleNodeInfo, o as createFederation, v as handleNodeInfoJrd } from "../middleware-pHwDTAnq.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/handler.test.ts
 test("handleNodeInfo()", async () => {