@fedify/fedify 2.4.0-dev.2030 → 2.4.0-dev.2047

package/dist/sig/proof.test.mjs

@@ -1,6 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
+import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import { t as assertGreaterOrEqual } from "../assert_greater_or_equal-BlafOF4-.mjs";
@@ -8,9 +9,11 @@ import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { l as verifyRequest } from "../http-CK6kjLnO.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-BRlNjHlQ.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { a as verifyObject, c as verifyProof, n as hasProofLike, o as verifyPortableObjectProof, r as signObject, t as createProof } from "../proof-BVxJu5vv.mjs";
+import { a as verifyObject, c as verifyProof, n as hasProofLike, o as verifyPortableObjectProof, r as signObject, t as createProof } from "../proof-fKycdssC.mjs";
 import { Create, DataIntegrityProof, Document, Multikey, Note, PUBLIC_COLLECTION, Place, Translation } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { decodeMultibase, encodeMultibase, exportDidKey, exportMultibaseKey, formatIri, importMultibaseKey, parseIri } from "@fedify/vocab-runtime";
@@ -1613,6 +1616,80 @@ test("verifyObject() hydrates pending proof references", async () => {
 	assertEquals(proofFetches, 1);
 	assertInstanceOf(verified, Note);
 });
+test("verifyObject() hydrates portable proof references with gateway hints", async () => {
+	const did = await exportDidKey(ed25519PublicKey.publicKey);
+	const method = did.substring(8);
+	const keyId = new URL(`${did}#${method}`);
+	const proofId = `ap://did:key:${method}/proofs/1`;
+	const proofReference = `${proofId}?@gateway=https%3A%2F%2Fgateway.example`;
+	const signed = await signPortableJsonLd({
+		"@context": portableContext,
+		id: `ap://did:key:${method}/objects/1`,
+		type: "Note",
+		attributedTo: `ap://did:key:${method}/actor`,
+		content: "Portable note with a hinted proof reference"
+	}, {
+		verificationMethod: keyId,
+		proofOptions: { id: proofId }
+	});
+	const rawProof = signed.proof;
+	const referencedJsonLd = { ...signed };
+	delete referencedJsonLd.proof;
+	referencedJsonLd["https://w3id.org/security#proof"] = [{ "@graph": [rawProof] }, { "@graph": [{ "@id": proofReference }] }];
+	const fetched = [];
+	const verified = await verifyObject(Note, referencedJsonLd, {
+		documentLoader(url) {
+			fetched.push(url);
+			return Promise.resolve({
+				contextUrl: null,
+				document: structuredClone(rawProof),
+				documentUrl: url
+			});
+		},
+		contextLoader: mockDocumentLoader
+	});
+	assertEquals(fetched, [formatIri(parseIri(proofReference))]);
+	assertInstanceOf(verified, Note);
+});
+test("verifyObject() rejects portable proof references it cannot dereference", async () => {
+	const did = await exportDidKey(ed25519PublicKey.publicKey);
+	const method = did.substring(8);
+	const keyId = new URL(`${did}#${method}`);
+	const proofUrl = `ap://did:key:${method}/proofs/2`;
+	const signed = await signPortableJsonLd({
+		"@context": portableContext,
+		id: `ap://did:key:${method}/objects/1`,
+		type: "Note",
+		attributedTo: `ap://did:key:${method}/actor`,
+		content: "Portable note with an extra referenced proof"
+	}, { verificationMethod: keyId });
+	const rawProof = signed.proof;
+	const withProofs = (proofs) => {
+		const referencedJsonLd = { ...signed };
+		delete referencedJsonLd.proof;
+		referencedJsonLd["https://w3id.org/security#proof"] = proofs;
+		return referencedJsonLd;
+	};
+	const embedded = { "@graph": [rawProof] };
+	const referenced = { "@graph": [{ "@id": proofUrl }] };
+	for (const [id, referencedJsonLd] of [
+		[`ap://did:key:${method}/proofs/3`, withProofs([embedded, referenced])],
+		[`ap://did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK/proofs/2`, withProofs([embedded, referenced])],
+		[`ap://did:key:${method}/proofs/3`, withProofs([referenced, embedded])]
+	]) assertEquals(await verifyObject(Note, referencedJsonLd, {
+		documentLoader(url) {
+			return Promise.resolve({
+				contextUrl: null,
+				document: {
+					...rawProof,
+					id
+				},
+				documentUrl: url
+			});
+		},
+		contextLoader: mockDocumentLoader
+	}), null);
+});
 test("verifyObject() accepts multiple portable attributions from the same did:key origin", async () => {
 	const did = await exportDidKey(ed25519PublicKey.publicKey);
 	const method = did.substring(8);
@@ -1818,5 +1895,135 @@ test("verifyObject() rejects a key that claims a forged controller", async () =>
 		contextLoader: mockDocumentLoader
 	}), null);
 });
+test("verifyPortableObjectProof() verifies objects fetched through gateways", async (t) => {
+	const objectId = `ap://${portableDid}/objects/gateway`;
+	const gatewayUrl = `https://gateway.example/.well-known/apgateway/${portableDid}/objects/gateway`;
+	const signedNote = await signPortableJsonLd({
+		"@context": portableContext,
+		id: objectId,
+		type: "Note",
+		attributedTo: `ap://${portableDid}/actor`,
+		content: "Hello from a gateway"
+	});
+	const getObject = async (document, object = objectId, url = gatewayUrl) => {
+		return await (await Create.fromJsonLd({
+			"@context": "https://www.w3.org/ns/activitystreams",
+			type: "Create",
+			id: `ap://${portableDid}/activities/1`,
+			object
+		}, { contextLoader: mockDocumentLoader })).getObject({
+			documentLoader: async (requestUrl) => {
+				if (requestUrl !== url) throw new Error(`Unexpected URL: ${requestUrl}`);
+				return {
+					contextUrl: null,
+					documentUrl: requestUrl,
+					document
+				};
+			},
+			contextLoader: mockDocumentLoader,
+			gateways: ["https://gateway.example"],
+			verifyPortableObject: verifyPortableObjectProof
+		});
+	};
+	await t.step("a properly signed object", async () => {
+		const object = await getObject(signedNote);
+		assertInstanceOf(object, Note);
+		assertEquals(object.content, "Hello from a gateway");
+	});
+	await t.step("a tampered object", async () => {
+		assertEquals(await getObject({
+			...signedNote,
+			content: "Tampered"
+		}), null);
+	});
+	await t.step("an object without a proof", async () => {
+		const { proof: _, ...unsigned } = signedNote;
+		assertEquals(await getObject(unsigned), null);
+	});
+	await t.step("an object without an ID", async () => {
+		const withoutId = await signPortableJsonLd({
+			"@context": portableContext,
+			type: "Note",
+			content: "Hello from a gateway"
+		});
+		assertEquals(await getObject(withoutId), null);
+	});
+	await t.step("another object of the same DID", async () => {
+		assertEquals(await getObject(signedNote, `ap://${portableDid}/objects/other`, `https://gateway.example/.well-known/apgateway/${portableDid}/objects/other`), null);
+	});
+	await t.step("an object signed by another DID", async () => {
+		const otherDid = await exportDidKey(await crypto.subtle.importKey("jwk", {
+			kty: "OKP",
+			crv: "Ed25519",
+			x: "sA2Nk45_dz1RVlqtNqYj9TRPf10ZYPnPPo4SYg6igQ8",
+			key_ops: ["verify"],
+			ext: true
+		}, "Ed25519", true, ["verify"]));
+		const otherObjectId = `ap://${otherDid}/objects/gateway`;
+		const otherGatewayUrl = `https://gateway.example/.well-known/apgateway/${otherDid}/objects/gateway`;
+		const spoofed = await signPortableJsonLd({
+			"@context": portableContext,
+			id: otherObjectId,
+			type: "Note",
+			content: "Spoofed"
+		});
+		assertEquals(await getObject(spoofed, otherObjectId, otherGatewayUrl), null);
+		const forged = await signPortableJsonLd({
+			"@context": portableContext,
+			id: objectId,
+			type: "Note",
+			content: "Forged"
+		}, { privateKey: fep8b32TestVectorPrivateKey });
+		assertEquals(await getObject(forged), null);
+	});
+});
+test("getAuthenticatedDocumentLoader() signs portable object requests to gateways", {
+	sanitizeResources: false,
+	sanitizeOps: false
+}, async () => {
+	const objectId = `ap://${portableDid}/objects/private`;
+	const signedNote = await signPortableJsonLd({
+		"@context": portableContext,
+		id: objectId,
+		type: "Note",
+		attributedTo: `ap://${portableDid}/actor`,
+		content: "Followers only"
+	});
+	esm_default.spyGlobal();
+	let signed = false;
+	let accept = null;
+	esm_default.get(`https://example.com/.well-known/apgateway/${portableDid}/objects/private`, async (cl) => {
+		accept = cl.request.headers.get("Accept");
+		signed = await verifyRequest(cl.request, {
+			documentLoader: mockDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			currentTime: Temporal.Now.instant()
+		}) != null;
+		if (!signed) return new Response(null, { status: 401 });
+		return new Response(JSON.stringify(signedNote), { headers: { "Content-Type": "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"" } });
+	});
+	try {
+		const object = await (await Create.fromJsonLd({
+			"@context": "https://www.w3.org/ns/activitystreams",
+			type: "Create",
+			id: `ap://${portableDid}/activities/1`,
+			object: objectId
+		}, { contextLoader: mockDocumentLoader })).getObject({
+			documentLoader: getAuthenticatedDocumentLoader({
+				keyId: new URL("https://example.com/key2"),
+				privateKey: rsaPrivateKey2
+			}),
+			contextLoader: mockDocumentLoader,
+			gateways: ["https://example.com"],
+			verifyPortableObject: verifyPortableObjectProof
+		});
+		assertInstanceOf(object, Note);
+		assertEquals(object.content, "Followers only");
+		assert(signed);
+		assertEquals(accept, "application/activity+json, application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"");
+	} finally {
+		esm_default.hardReset();
+	}
+});
 //#endregion
 export {};

package/dist/{temporal-CCf0lZV3.mjs → temporal-SUiLJ0Co.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-B16KUSIQ.mjs";
+import { c as getNormalizationContextLoader } from "./ld-CNWm8mJc.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {

package/dist/testing/kv.test.mjs

@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { n as baseOptions, o as stringSchema, t as MockQueue } from "../tasks-dbCShlCb.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
-import { o as createFederation } from "../middleware-C7_hqDnl.mjs";
+import { o as createFederation } from "../middleware-CtFNjIUD.mjs";
 //#region src/testing/kv.test.ts
 test("ManualClockKvStore keeps an entry at its exact expiration instant", async () => {
 	const kv = new ManualClockKvStore();

package/dist/testing/mod.d.mts

@@ -2700,6 +2700,35 @@ interface Context<TContextData> {
    * @since 0.7.0
    */
   getObjectUri<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an object with the given class and
+   * values under the given DID authority.
+   *
+   * The path is the same as the one {@link Context.getObjectUri} builds from
+   * the object dispatcher's path, but the result is an `ap+ef61:` URI whose
+   * authority is the DID, e.g., `ap+ef61://did:key:z6Mk.../notes/123`.
+   * Such an object can be served through the FEP-ef61 gateway endpoint,
+   * `/.well-known/apgateway/did:key:z6Mk.../notes/123`, by the same object
+   * dispatcher.
+   *
+   * The returned `URL` keeps the DID authority percent-encoded, because
+   * the `URL` class cannot represent the canonical form.  Use `formatIri()`
+   * from `@fedify/vocab-runtime` to get the canonical string, e.g.,
+   * `ap+ef61://did:key:z6Mk.../notes/123`.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param cls The class of the object.
+   * @param values The values to pass to the object dispatcher.
+   * @param authority The DID that controls the object, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.
+   * @returns The object's portable ID.
+   * @throws {RouterError} If no object dispatcher is available for the class.
+   * @throws {TypeError} If values are invalid or the authority is not a DID.
+   * @since 2.4.0
+   */
+  getPortableObjectUri<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>, authority: string): URL;
   /**
    * Builds the URI of an actor's outbox with the given identifier.
    * @param identifier The actor's identifier.
@@ -2846,7 +2875,13 @@ interface Context<TContextData> {
    * ```
    *
    * It's almost the same as the {@link lookupObject} function, but it uses
-   * the context's document loader and context loader by default.
+   * the context's document loader and context loader by default.  It also
+   * uses `verifyPortableObjectProof()` as the `verifyPortableObject`
+   * option by default (since 2.4.0), so [FEP-ef61] portable objects,
+   * including portable actors found through WebFinger, are looked up through
+   * their gateways and returned only if they have valid proofs.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
    *
    * @param identifier The URI or fediverse handle to look up.
    * @param options Lookup options.
@@ -3020,6 +3055,29 @@ interface Context<TContextData> {
    */
   getCollectionUri<TParam extends Record<string, string>>(name: string | symbol, values: TParam): URL;
 }
+/**
+ * Information about an [FEP-ef61] portable object requested through
+ * the gateway endpoint.  See {@link RequestContext.portableRequest}.
+ *
+ * [FEP-ef61]: https://w3id.org/fep/ef61
+ * @since 2.4.0
+ */
+interface PortableRequest {
+  /**
+   * The DID authority of the requested portable object, e.g.,
+   * `did:key:z6Mk...`.  It comes from the request path, so it is not
+   * evidence that this server hosts objects for the DID.
+   */
+  readonly authority: string;
+  /**
+   * The ID of the requested portable object, e.g.,
+   * `ap+ef61://did:key:z6Mk.../notes/123`, without a query.  Like other
+   * portable IDs, the `URL` keeps the DID authority percent-encoded; use
+   * `formatIri()` from `@fedify/vocab-runtime` to get the canonical string.
+   * Each access returns a new `URL` instance.
+   */
+  readonly id: URL;
+}
 /**
  * Options for {@link RequestContext.getActor}.
  * @since 2.2.0
@@ -3045,6 +3103,46 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * The URL of the request.
    */
   readonly url: URL;
+  /**
+   * Information about the [FEP-ef61] portable object requested through
+   * the gateway endpoint, e.g.,
+   * `GET /.well-known/apgateway/did:key:z6Mk.../notes/123`.  It is
+   * `undefined` for ordinary requests.
+   *
+   * The authority comes from the request path, so it is not evidence that
+   * this server hosts objects for the DID.  An object dispatcher has to check
+   * that by itself.
+   *
+   * It describes the incoming request, so it stays the same in contexts
+   * derived from this one, e.g., by {@link RequestContext.getObject}.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   * @since 2.4.0
+   */
+  readonly portableRequest?: PortableRequest;
+  /**
+   * Builds the [FEP-ef61] portable ID of an object with the given class and
+   * values.  It works the same as {@link Context.getPortableObjectUri}, except
+   * that the authority can be omitted while handling a portable gateway
+   * request.  In that case, the DID in {@link RequestContext.portableRequest}
+   * is used.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param cls The class of the object.
+   * @param values The values to pass to the object dispatcher.
+   * @param authority The DID that controls the object, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.  Defaults to the DID of
+   *                  the requested portable object.
+   * @returns The object's portable ID.
+   * @throws {RouterError} If no object dispatcher is available for the class.
+   * @throws {TypeError} If values are invalid, the authority is not a DID, or
+   *                     the authority is omitted outside a portable gateway
+   *                     request.
+   * @since 2.4.0
+   */
+  getPortableObjectUri<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>, authority?: string): URL;
   /**
    * Creates a new context with the same properties as this one,
    * but with the given data.

package/dist/testing/mod.mjs

@@ -2,8 +2,8 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { r as testDefinitions } from "../dist-BQvArojP.mjs";
-import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-CbS35fLr.mjs";
+import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-DG5QeQ8W.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, r as envelopeSchema, t as MockQueue } from "../tasks-dbCShlCb.mjs";
-import "../testing-hbky2gMN.mjs";
+import "../testing-By1YYsIK.mjs";
 export { ManualClockKvStore, MockQueue, baseOptions, createInboxContext, createOutboxContext, createRequestContext, envelopeSchema, makeSchema, numberSchema, stringSchema, testDefinitions };

package/dist/{testing-hbky2gMN.mjs → testing-By1YYsIK.mjs}

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import "./dist-BQvArojP.mjs";
-import "./context-CbS35fLr.mjs";
+import "./context-DG5QeQ8W.mjs";
 import "./kv-DBRWVx3Q.mjs";
 import "./tasks-dbCShlCb.mjs";
 export {};

package/dist/utils/docloader.test.mjs

@@ -5,9 +5,9 @@ import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
-import { l as verifyRequest } from "../http-D4WPcJUe.mjs";
+import { l as verifyRequest } from "../http-CK6kjLnO.mjs";
 import { i as rsaPrivateKey2 } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-qUudHZVH.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-BRlNjHlQ.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";
 //#region src/utils/docloader.test.ts

package/dist/utils/kv-cache.test.mjs

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as kvCache, t as MockKvStore } from "../kv-cache-BXdT7pJQ.mjs";
+import { n as kvCache, t as MockKvStore } from "../kv-cache-YATuzCy-.mjs";
 import { deepStrictEqual, throws } from "node:assert";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { preloadedContexts } from "@fedify/vocab-runtime";

package/dist/utils/mod.cjs

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_kv_cache = require("../kv-cache-8K70pjtX.cjs");
+const require_kv_cache = require("../kv-cache-CvEicbrf.cjs");
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.kvCache = require_kv_cache.kvCache;

package/dist/utils/mod.js

@@ -1,4 +1,4 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-BswMKQjC.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-fi_-XZco.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "2.4.0-dev.2030+e6b3de3d",
+  "version": "2.4.0-dev.2047+140b94db",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",
@@ -151,15 +151,15 @@
     "structured-field-values": "^2.0.4",
     "temporal-polyfill": "^1.0.1",
     "urlpattern-polyfill": "^10.1.0",
-    "@fedify/vocab": "2.4.0-dev.2030+e6b3de3d",
-    "@fedify/uri-template": "2.4.0-dev.2030+e6b3de3d",
-    "@fedify/webfinger": "2.4.0-dev.2030+e6b3de3d",
-    "@fedify/vocab-runtime": "2.4.0-dev.2030+e6b3de3d"
+    "@fedify/uri-template": "2.4.0-dev.2047+140b94db",
+    "@fedify/vocab": "2.4.0-dev.2047+140b94db",
+    "@fedify/vocab-runtime": "2.4.0-dev.2047+140b94db",
+    "@fedify/webfinger": "2.4.0-dev.2047+140b94db"
   },
   "devDependencies": {
     "@std/assert": "npm:@jsr/std__assert@^0.226.0",
     "@std/path": "npm:@jsr/std__path@^1.0.6",
-    "@types/node": "^24.2.1",
+    "@types/node": "^24.12.2",
     "fetch-mock": "^12.5.4",
     "miniflare": "^4.20250523.0",
     "tsdown": "^0.22.0",
@@ -167,7 +167,7 @@
     "typescript": "^6.0.0",
     "wrangler": "^4.17.0",
     "@fedify/fixture": "2.0.0",
-    "@fedify/vocab-tools": "^2.4.0-dev.2030+e6b3de3d"
+    "@fedify/vocab-tools": "^2.4.0-dev.2047+140b94db"
   },
   "scripts": {
     "build:self": "tsdown",