@fedify/fedify 2.4.0-dev.2054 → 2.4.0-dev.2063

package/dist/sig/portable-collection.test.mjs

@@ -0,0 +1,971 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { n as version, t as name } from "../deno-CVZgG4sc.mjs";
+import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
+import { c as verifyPortableObjectProofWithRoot, o as verifyPortableObjectProof } from "../proof-B69bJaSn.mjs";
+import { getLogger } from "@logtape/logtape";
+import { Collection, CollectionPage, Note, Object as Object$1, OrderedCollection, Person, isActor, traverseCollection } from "@fedify/vocab";
+import { trace } from "@opentelemetry/api";
+import { test } from "@fedify/fixture";
+import { FetchError, canonicalizePortableUri, encodeMultibase, exportDidKey, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, parseIri, preloadedContexts } from "@fedify/vocab-runtime";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import serialize from "json-canon";
+import { dereferencePortableIri, getPortableGatewayCandidates } from "@fedify/vocab-runtime/internal/portable-dereference";
+//#region src/sig/portable-collection.ts
+const logger = getLogger([
+	"fedify",
+	"sig",
+	"proof"
+]);
+const AS_NAMESPACE = "https://www.w3.org/ns/activitystreams#";
+const AS_ATTRIBUTED_TO = `${AS_NAMESPACE}attributedTo`;
+const AS_PART_OF = `${AS_NAMESPACE}partOf`;
+/**
+* The properties through which a collection refers to its pages, and a page
+* to other pages of the same collection.
+*/
+const PAGING_PROPERTIES = new Set([
+	"first",
+	"last",
+	"current",
+	"next",
+	"prev"
+].map((p) => AS_NAMESPACE + p));
+/**
+* The properties through which an actor refers to its own collections.
+*/
+const ACTOR_COLLECTION_PROPERTIES = /* @__PURE__ */ new Set([
+	"http://www.w3.org/ns/ldp#inbox",
+	`${AS_NAMESPACE}outbox`,
+	`${AS_NAMESPACE}followers`,
+	`${AS_NAMESPACE}following`,
+	`${AS_NAMESPACE}liked`
+]);
+const contextStates = /* @__PURE__ */ new WeakMap();
+function createContext(state) {
+	const token = Object.freeze(Object.create(null));
+	contextStates.set(token, state);
+	return token;
+}
+function getContextState(context) {
+	if (context == null || typeof context !== "object") return void 0;
+	return contextStates.get(context);
+}
+function canonicalize(id) {
+	try {
+		return canonicalizePortableUri(typeof id === "string" ? id : formatIri(id));
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+function toUrl(canonicalId) {
+	return parseIri(canonicalId);
+}
+function canonicalizeAll(ids) {
+	const result = [];
+	for (const id of ids) {
+		const canonical = canonicalize(id);
+		if (canonical == null) return null;
+		result.push(canonical);
+	}
+	return result;
+}
+function getExpandedIds(node, property) {
+	const values = node[property];
+	if (values == null) return [];
+	if (!Array.isArray(values)) return null;
+	const ids = [];
+	for (const value of values) {
+		if (value == null || typeof value !== "object" || Array.isArray(value) || typeof value["@id"] !== "string") return null;
+		ids.push(value["@id"]);
+	}
+	return ids;
+}
+function parseAll(ids) {
+	const result = [];
+	for (const id of ids) try {
+		result.push(parseIri(id));
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+	return result;
+}
+function describeRoot(root) {
+	const rawId = root["@id"];
+	if (typeof rawId !== "string") return null;
+	const id = canonicalize(rawId);
+	if (id == null) return null;
+	const partOf = getExpandedIds(root, AS_PART_OF);
+	const attributedTo = getExpandedIds(root, AS_ATTRIBUTED_TO);
+	return {
+		id,
+		url: toUrl(id),
+		origin: getFe34Origin(id),
+		partOf: partOf == null ? null : canonicalizeAll(partOf),
+		attributedTo: attributedTo == null ? null : canonicalizeAll(attributedTo),
+		attributedToUrls: attributedTo == null ? null : parseAll(attributedTo)
+	};
+}
+function describeObject(object) {
+	if (!(object instanceof Object$1) || object.id == null) return null;
+	const id = canonicalize(object.id);
+	if (id == null) return null;
+	const partOfId = object instanceof CollectionPage ? object.partOfId : null;
+	return {
+		id,
+		url: toUrl(id),
+		origin: getFe34Origin(id),
+		partOf: canonicalizeAll(partOfId == null ? [] : [partOfId]),
+		attributedTo: canonicalizeAll(object.attributionIds),
+		attributedToUrls: object.attributionIds
+	};
+}
+function fail(reason) {
+	return {
+		verified: false,
+		reason
+	};
+}
+/**
+* Walks the referrer chain of a collection or page to find the root
+* collection and its owner candidate, checking every page on the way.
+*/
+function resolveChain(node, referrer) {
+	const pages = [];
+	let top = node;
+	let link = referrer;
+	let state;
+	while (link != null && PAGING_PROPERTIES.has(link.property)) {
+		pages.push(top);
+		state = getContextState(link.collectionContext);
+		if (state != null) break;
+		const parent = describeObject(link.object);
+		if (parent == null || link.truncated) return fail({ type: "unknownCollectionOwner" });
+		top = parent;
+		link = link.referrer;
+	}
+	let rootId;
+	let rootOrigin;
+	let candidate;
+	if (state != null) {
+		rootId = state.rootId;
+		rootOrigin = state.rootOrigin;
+		const ownerCandidate = state.owner == null ? state.ownerCandidate : { id: canonicalize(state.owner.id) };
+		if (ownerCandidate == null) return fail({ type: "unknownCollectionOwner" });
+		candidate = ownerCandidate;
+	} else {
+		rootId = top.id;
+		rootOrigin = top.origin;
+		const attributedTo = top.attributedTo;
+		if (attributedTo == null) return fail({ type: "unknownCollectionOwner" });
+		if (link != null && ACTOR_COLLECTION_PROPERTIES.has(link.property)) {
+			const id = link.id == null ? null : canonicalize(link.id);
+			if (id == null) return fail({ type: "unknownCollectionOwner" });
+			candidate = {
+				id,
+				object: link.object,
+				acceptance: link.acceptance
+			};
+		} else if (attributedTo.length === 1) candidate = {
+			id: attributedTo[0],
+			url: top.attributedToUrls?.[0]
+		};
+		else if (attributedTo.length > 1) return fail({
+			type: "conflictingCollectionOwners",
+			candidates: attributedTo.map(toUrl)
+		});
+		else return fail({ type: "unknownCollectionOwner" });
+		const conflict = attributedTo.find((id) => id !== candidate.id);
+		if (conflict != null) return fail({
+			type: "conflictingCollectionOwners",
+			candidates: [toUrl(candidate.id), toUrl(conflict)]
+		});
+	}
+	if (getFe34Origin(candidate.id) !== rootOrigin) return fail({ type: "unknownCollectionOwner" });
+	for (const page of pages) {
+		if (page.origin !== rootOrigin) return fail({
+			type: "collectionPageMismatch",
+			pageId: page.url,
+			collectionId: toUrl(rootId),
+			partOf: null
+		});
+		if (page.partOf == null) return fail({ type: "unknownCollectionOwner" });
+		const partOf = page.partOf.find((id) => id !== rootId);
+		if (partOf != null) return fail({
+			type: "collectionPageMismatch",
+			pageId: page.url,
+			collectionId: toUrl(rootId),
+			partOf: toUrl(partOf)
+		});
+		if (page.attributedTo == null) return fail({ type: "unknownCollectionOwner" });
+		const conflict = page.attributedTo.find((id) => id !== candidate.id);
+		if (conflict != null) return fail({
+			type: "conflictingCollectionOwners",
+			candidates: [toUrl(candidate.id), toUrl(conflict)]
+		});
+	}
+	return {
+		rootId,
+		rootOrigin,
+		owner: state?.owner ?? null,
+		candidate
+	};
+}
+function getActorCollectionIds(actor) {
+	const ids = [];
+	for (const id of [
+		actor.inboxId,
+		actor.outboxId,
+		actor.followersId,
+		actor.followingId,
+		actor.likedId
+	]) {
+		if (id == null) continue;
+		const canonical = canonicalize(id);
+		if (canonical != null) ids.push(canonical);
+	}
+	return ids;
+}
+async function fetchOwner(candidate, options) {
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const contextLoader = options.contextLoader ?? getDocumentLoader();
+	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
+	const tracer = tracerProvider.getTracer(name, version);
+	const gateways = options.gateways ?? (getPortableGatewayCandidates(candidate).length > 0 ? void 0 : options.gatewayHints);
+	const span = tracer.startSpan("activitypub.lookup_object");
+	try {
+		const object = await dereferencePortableIri(candidate, {
+			documentLoader,
+			contextLoader,
+			tracerProvider,
+			gateways,
+			verifyPortableObject: (document, verifierOptions) => verifyPortableObjectProof(document, {
+				...options,
+				...verifierOptions
+			}),
+			suppressError: true,
+			span,
+			parse: (document, parseOptions) => Object$1.fromJsonLd(document, {
+				documentLoader,
+				contextLoader: parseOptions.contextLoader,
+				tracerProvider,
+				baseUrl: parseOptions.baseUrl
+			})
+		});
+		return isActor(object) ? object : null;
+	} catch (error) {
+		logger.debug("Failed to fetch the owner {owner} of a portable collection: {error}", {
+			owner: formatIri(candidate),
+			error
+		});
+		return null;
+	} finally {
+		span.end();
+	}
+}
+async function resolveOwner(chain, options) {
+	if (chain.owner != null) return chain.owner;
+	const { candidate } = chain;
+	const candidateUrl = toUrl(candidate.id);
+	let actor = null;
+	if (candidate.acceptance === "verified" && isActor(candidate.object) && candidate.object.id != null && canonicalize(candidate.object.id) === candidate.id) actor = candidate.object;
+	else actor = await fetchOwner(candidate.url ?? (candidate.object instanceof Object$1 && candidate.object.id != null ? candidate.object.id : candidateUrl), options);
+	if (actor == null || actor.id == null) return fail({
+		type: "collectionOwnerUnavailable",
+		owner: candidateUrl
+	});
+	const gateways = actor.gateways;
+	if (gateways.length < 1) return fail({
+		type: "collectionOwnerUnavailable",
+		owner: candidateUrl
+	});
+	if (!getActorCollectionIds(actor).includes(chain.rootId)) return fail({
+		type: "collectionNotListedByOwner",
+		owner: candidateUrl,
+		collectionId: toUrl(chain.rootId)
+	});
+	return {
+		id: candidateUrl,
+		gateways
+	};
+}
+function getSourceGateway(node, documentUrl) {
+	if (documentUrl == null || documentUrl.protocol !== "http:" && documentUrl.protocol !== "https:") return null;
+	let portableId;
+	try {
+		portableId = fromCompatibleEf61Id(documentUrl);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+	if (portableId == null || canonicalize(portableId) !== node.id) return null;
+	return new URL(documentUrl.origin);
+}
+/**
+* Applies the [FEP-ef61] trust policy to a portable object fetched through
+* a gateway.
+*
+* Portable actors, activities, objects, and collections with proofs are
+* verified by {@link verifyPortableObjectProof}.  A portable collection or
+* collection page without a proof is accepted only if all of the following
+* hold:
+*
+*  -  It was retrieved from a gateway: its final URL (`documentUrl`) is
+*     a compatible identifier for the same portable collection.
+*  -  Its owner is determined unambiguously: the actor whose `inbox`,
+*     `outbox`, `followers`, `following`, or `liked` property referred to
+*     the collection, or the single actor in its `attributedTo`.  A page
+*     inherits the owner of the collection it was reached from through
+*     `first`, `last`, `current`, `next`, or `prev`, and must not name
+*     another collection in `partOf`.
+*  -  The owner's actor document is verified by its proof and lists the
+*     collection as its `inbox`, `outbox`, `followers`, `following`, or
+*     `liked`.
+*  -  The gateway that served the collection is in the owner's `gateways`.
+*
+* Where the document came from and which object referred to it are passed
+* by property accessors when this function is used as their
+* `verifyPortableObject` option.  Objects embedded in an unsecured
+* collection accepted this way are not trusted: accessors dereference and
+* verify them one by one.
+*
+* Note that acceptance through the gateway policy does not verify anything
+* cryptographically; it only means that the owner trusts the gateway.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param jsonLd The JSON-LD document to verify.
+* @param options Additional options.  See also
+*                {@link VerifyPortableObjectOptions}.
+* @returns The detailed result.
+* @throws {TypeError} If the input is not a single JSON-LD object or has a
+*                     malformed portable ID.
+* @since 2.4.0
+*/
+async function verifyPortableObject(jsonLd, options = {}) {
+	const { result, root, objectType } = await verifyPortableObjectProofWithRoot(jsonLd, options);
+	if (result.verified) {
+		const node = objectType === "collection" && root != null ? describeRoot(root) : null;
+		const chain = node == null ? null : resolveChain(node, options.referrer);
+		if (chain == null || !("rootId" in chain)) return {
+			verified: true,
+			method: "proof",
+			keys: result.keys
+		};
+		return {
+			verified: true,
+			method: "proof",
+			keys: result.keys,
+			collectionContext: createContext({
+				rootId: chain.rootId,
+				rootOrigin: chain.rootOrigin,
+				owner: chain.owner,
+				ownerCandidate: chain.candidate
+			})
+		};
+	}
+	if (result.reason.type !== "unsecuredCollection") return {
+		verified: false,
+		reason: result.reason
+	};
+	const node = root == null ? null : describeRoot(root);
+	if (node == null) return fail({ type: "unknownCollectionOwner" });
+	const gateway = getSourceGateway(node, options.documentUrl);
+	if (gateway == null) return fail({
+		type: "unknownCollectionSource",
+		documentUrl: options.documentUrl ?? null
+	});
+	const chain = resolveChain(node, options.referrer);
+	if (!("rootId" in chain)) return chain;
+	const owner = await resolveOwner(chain, options);
+	if (!("gateways" in owner)) return owner;
+	if (!owner.gateways.some((g) => g.origin === gateway.origin)) return fail({
+		type: "untrustedGateway",
+		owner: owner.id,
+		gateway,
+		gateways: owner.gateways
+	});
+	return {
+		verified: true,
+		method: "gateway",
+		unsecured: true,
+		owner: owner.id,
+		gateway,
+		collectionContext: createContext({
+			rootId: chain.rootId,
+			rootOrigin: chain.rootOrigin,
+			owner,
+			ownerCandidate: null
+		})
+	};
+}
+//#endregion
+//#region src/sig/portable-collection.test.ts
+const AS = "https://www.w3.org/ns/activitystreams#";
+const context$1 = [
+	"https://www.w3.org/ns/activitystreams",
+	"https://w3id.org/security/data-integrity/v1",
+	"https://w3id.org/fep/ef61"
+];
+const did = await exportDidKey(ed25519PublicKey.publicKey);
+const keyId = `${did}#${did.slice(8)}`;
+const otherKeyPair = await crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
+const otherDid = await exportDidKey(otherKeyPair.publicKey);
+const actorId = `ap://${did}/actor`;
+const outboxId = `ap://${did}/actor/outbox`;
+const gw1 = "https://gw1.example";
+const gw2 = "https://gw2.example";
+const evil = "https://evil.example";
+function gatewayUrl(gateway, id) {
+	return `${gateway}/.well-known/apgateway/${id.replace(/^ap:\/\//, "")}`;
+}
+async function sign(document, privateKey = ed25519PrivateKey, verificationMethod = keyId) {
+	const proofConfig = {
+		"@context": document["@context"],
+		type: "DataIntegrityProof",
+		cryptosuite: "eddsa-jcs-2022",
+		verificationMethod,
+		proofPurpose: "assertionMethod",
+		created: "2023-02-24T23:36:38Z"
+	};
+	const encoder = new TextEncoder();
+	const proofDigest = await crypto.subtle.digest("SHA-256", encoder.encode(serialize(proofConfig)));
+	const messageDigest = await crypto.subtle.digest("SHA-256", encoder.encode(serialize(document)));
+	const digest = /* @__PURE__ */ new Uint8Array(64);
+	digest.set(new Uint8Array(proofDigest), 0);
+	digest.set(new Uint8Array(messageDigest), 32);
+	const signature = await crypto.subtle.sign("Ed25519", privateKey, digest);
+	return {
+		...document,
+		proof: {
+			...proofConfig,
+			proofValue: new TextDecoder().decode(encodeMultibase("base58btc", new Uint8Array(signature)))
+		}
+	};
+}
+function actor(overrides = {}) {
+	return {
+		"@context": context$1,
+		id: actorId,
+		type: "Person",
+		inbox: `ap://${did}/actor/inbox`,
+		outbox: outboxId,
+		followers: `ap://${did}/actor/followers`,
+		gateways: [gw1, gw2],
+		...overrides
+	};
+}
+function outbox(overrides = {}) {
+	return {
+		"@context": context$1,
+		id: outboxId,
+		type: "OrderedCollection",
+		totalItems: 0,
+		...overrides
+	};
+}
+const contextLoader = (url) => {
+	const document = preloadedContexts[url];
+	if (document == null) return Promise.reject(/* @__PURE__ */ new Error(`No context: ${url}`));
+	return Promise.resolve({
+		contextUrl: null,
+		documentUrl: url,
+		document
+	});
+};
+function createLoader(responses) {
+	const fetched = [];
+	const loader = (url) => {
+		fetched.push(url);
+		let response = responses[url];
+		let documentUrl = url;
+		if (response != null && "redirect" in response) {
+			documentUrl = response.redirect;
+			response = responses[documentUrl];
+		}
+		if (response == null) return Promise.reject(URL.canParse(url) ? new FetchError(url, "HTTP 404", new Response(null, { status: 404 })) : /* @__PURE__ */ new Error(`Not found: ${url}`));
+		return Promise.resolve({
+			contextUrl: null,
+			documentUrl,
+			document: structuredClone(response)
+		});
+	};
+	return Object.assign(loader, { fetched });
+}
+function linkFrom(object, property, overrides = {}) {
+	return {
+		object,
+		id: object.id ?? null,
+		property: AS + property,
+		...overrides
+	};
+}
+async function verify(document, options) {
+	return await verifyPortableObject(document, {
+		contextLoader,
+		...options
+	});
+}
+function assertFailure(result, type) {
+	ok(!result.verified, `expected ${type}, got ${JSON.stringify(result)}`);
+	strictEqual(result.reason.type, type);
+}
+const signedActor = await sign(actor());
+const actorObject = await Person.fromJsonLd(signedActor, { contextLoader });
+test("verifyPortableObject() trusts unsecured collections from listed gateways", async () => {
+	const documentLoader = createLoader({ [gatewayUrl(gw1, actorId)]: signedActor });
+	const result = await verify(outbox(), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw2, outboxId)),
+		gatewayHints: [new URL(gw1)],
+		referrer: linkFrom(actorObject, "outbox")
+	});
+	ok(result.verified);
+	strictEqual(result.method, "gateway");
+	if (result.method !== "gateway") return;
+	deepStrictEqual(result.gateway, new URL(gw2));
+	strictEqual(result.owner.href, actorObject.id?.href);
+	deepStrictEqual(documentLoader.fetched, [gatewayUrl(gw1, actorId)]);
+});
+test("verifyPortableObject() rejects unsecured collections from unlisted gateways", async () => {
+	const result = await verify(outbox(), {
+		documentLoader: createLoader({ [gatewayUrl(gw1, actorId)]: signedActor }),
+		documentUrl: new URL(gatewayUrl(evil, outboxId)),
+		gatewayHints: [new URL(evil), new URL(gw1)],
+		referrer: linkFrom(actorObject, "outbox")
+	});
+	assertFailure(result, "untrustedGateway");
+	if (result.verified || result.reason.type !== "untrustedGateway") return;
+	deepStrictEqual(result.reason.gateway, new URL(evil));
+	deepStrictEqual(result.reason.gateways, [new URL(gw1), new URL(gw2)]);
+});
+test("verifyPortableObject() uses the actual fetch source", async () => {
+	const documentLoader = createLoader({ [gatewayUrl(gw1, actorId)]: signedActor });
+	const referrer = linkFrom(actorObject, "outbox");
+	const gateways = [new URL(gw1)];
+	assertFailure(await verify(outbox(), {
+		documentLoader,
+		gateways,
+		referrer
+	}), "unknownCollectionSource");
+	assertFailure(await verify(outbox(), {
+		documentLoader,
+		gateways,
+		referrer,
+		documentUrl: new URL("https://gw1.example/cdn/outbox.json")
+	}), "unknownCollectionSource");
+	assertFailure(await verify(outbox(), {
+		documentLoader,
+		gateways,
+		referrer,
+		documentUrl: new URL(gatewayUrl(gw1, `ap://${did}/actor/inbox`))
+	}), "unknownCollectionSource");
+	assertFailure(await verify(outbox(), {
+		documentLoader,
+		gateways,
+		referrer,
+		documentUrl: new URL(`https://user@gw1.example/.well-known/apgateway/${did}/actor/outbox`)
+	}), "unknownCollectionSource");
+	assertFailure(await verify(outbox({ id: gatewayUrl(evil, outboxId) }), {
+		documentLoader,
+		gateways,
+		referrer,
+		documentUrl: new URL(gatewayUrl(gw1, outboxId))
+	}), "notPortableObject");
+});
+test("verifyPortableObject() requires an unambiguous owner", async () => {
+	const base = {
+		documentLoader: createLoader({ [gatewayUrl(gw1, actorId)]: signedActor }),
+		documentUrl: new URL(gatewayUrl(gw1, outboxId)),
+		gateways: [new URL(gw1)]
+	};
+	assertFailure(await verify(outbox(), base), "unknownCollectionOwner");
+	const note = await Note.fromJsonLd({
+		"@context": context$1,
+		id: `ap://${did}/notes/1`,
+		type: "Note"
+	}, { contextLoader });
+	assertFailure(await verify(outbox(), {
+		...base,
+		referrer: linkFrom(note, "replies")
+	}), "unknownCollectionOwner");
+	const attributed = await verify(outbox({ attributedTo: actorId }), base);
+	ok(attributed.verified);
+	strictEqual(attributed.method, "gateway");
+	assertFailure(await verify(outbox({ attributedTo: [actorId, `ap://${did}/actor2`] }), base), "conflictingCollectionOwners");
+	assertFailure(await verify(outbox({ attributedTo: `ap://${did}/actor2` }), {
+		...base,
+		referrer: linkFrom(actorObject, "outbox")
+	}), "conflictingCollectionOwners");
+	assertFailure(await verify(outbox({ attributedTo: "https://example.com/actor" }), base), "unknownCollectionOwner");
+});
+test("verifyPortableObject() requires the owner to share the collection's DID", async () => {
+	const foreignActorId = `ap://${otherDid}/actor`;
+	const foreignActor = await sign(actor({
+		id: foreignActorId,
+		gateways: [evil]
+	}), otherKeyPair.privateKey, `${otherDid}#${otherDid.slice(8)}`);
+	const foreignActorObject = await Person.fromJsonLd(foreignActor, { contextLoader });
+	const documentLoader = createLoader({ [gatewayUrl(evil, foreignActorId)]: foreignActor });
+	const base = {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(evil, outboxId)),
+		gateways: [new URL(evil)]
+	};
+	assertFailure(await verify(outbox(), {
+		...base,
+		referrer: linkFrom(foreignActorObject, "outbox")
+	}), "unknownCollectionOwner");
+	assertFailure(await verify(outbox({ attributedTo: foreignActorId }), base), "unknownCollectionOwner");
+	deepStrictEqual(documentLoader.fetched, []);
+});
+test("verifyPortableObject() confirms the owner with its actor document", async () => {
+	const documentUrl = new URL(gatewayUrl(gw1, outboxId));
+	const gateways = [new URL(gw1)];
+	const referrer = linkFrom(actorObject, "outbox");
+	assertFailure(await verify(outbox(), {
+		documentLoader: createLoader({}),
+		documentUrl,
+		gateways,
+		referrer
+	}), "collectionOwnerUnavailable");
+	assertFailure(await verify(outbox(), {
+		documentLoader: createLoader({ [gatewayUrl(gw1, actorId)]: actor() }),
+		documentUrl,
+		gateways,
+		referrer
+	}), "collectionOwnerUnavailable");
+	const { gateways: _, ...noGateways } = actor();
+	assertFailure(await verify(outbox(), {
+		documentLoader: createLoader({ [gatewayUrl(gw1, actorId)]: await sign(noGateways) }),
+		documentUrl,
+		gateways,
+		referrer
+	}), "collectionOwnerUnavailable");
+	const otherCollectionId = `ap://${did}/collections/1`;
+	assertFailure(await verify(outbox({
+		id: otherCollectionId,
+		attributedTo: actorId
+	}), {
+		documentLoader: createLoader({ [gatewayUrl(gw1, actorId)]: signedActor }),
+		documentUrl: new URL(gatewayUrl(gw1, otherCollectionId)),
+		gateways
+	}), "collectionNotListedByOwner");
+	const emptyLoader = createLoader({ [gatewayUrl(gw1, actorId)]: signedActor });
+	assertFailure(await verify(outbox(), {
+		documentLoader: emptyLoader,
+		documentUrl,
+		gateways: [],
+		gatewayHints: [new URL(gw1)],
+		referrer
+	}), "collectionOwnerUnavailable");
+	deepStrictEqual(emptyLoader.fetched, [`ap+ef61://${did}/actor`]);
+});
+test("verifyPortableObject() reuses a verified referring actor", async () => {
+	const documentLoader = createLoader({});
+	const result = await verify(outbox(), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, outboxId)),
+		referrer: linkFrom(actorObject, "outbox", { acceptance: "verified" })
+	});
+	ok(result.verified);
+	strictEqual(result.method, "gateway");
+	deepStrictEqual(documentLoader.fetched, []);
+});
+test("verifyPortableObject() does not downgrade signed collections", async () => {
+	const documentLoader = createLoader({});
+	const signedOutbox = await sign(outbox());
+	const result = await verify(signedOutbox, {
+		documentLoader,
+		referrer: linkFrom(actorObject, "outbox")
+	});
+	ok(result.verified);
+	strictEqual(result.method, "proof");
+	assertFailure(await verify({
+		...signedOutbox,
+		totalItems: 1
+	}, {
+		documentLoader: createLoader({ [gatewayUrl(gw1, actorId)]: signedActor }),
+		documentUrl: new URL(gatewayUrl(gw1, outboxId)),
+		gateways: [new URL(gw1)],
+		referrer: linkFrom(actorObject, "outbox")
+	}), "invalidProof");
+	assertFailure(await verify(outbox({ id: "https://example.com/outbox" }), { documentLoader }), "notPortableObject");
+});
+test("verifyPortableObject() checks pages against their collection", async () => {
+	const documentLoader = createLoader({ [gatewayUrl(gw1, actorId)]: signedActor });
+	const collectionResult = await verify(outbox(), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, outboxId)),
+		gateways: [new URL(gw1)],
+		referrer: linkFrom(actorObject, "outbox")
+	});
+	ok(collectionResult.verified);
+	const collection = await OrderedCollection.fromJsonLd(outbox(), { contextLoader });
+	const collectionContext = collectionResult.collectionContext;
+	const pageId = `ap://${did}/actor/outbox?page=1`;
+	const page = (overrides = {}) => ({
+		"@context": context$1,
+		id: pageId,
+		type: "OrderedCollectionPage",
+		partOf: outboxId,
+		orderedItems: [],
+		...overrides
+	});
+	const pageReferrer = linkFrom(collection, "first", { collectionContext });
+	const fetchedBefore = documentLoader.fetched.length;
+	const accepted = await verify(page(), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw2, pageId)),
+		referrer: pageReferrer
+	});
+	ok(accepted.verified);
+	strictEqual(accepted.method, "gateway");
+	strictEqual(documentLoader.fetched.length, fetchedBefore);
+	assertFailure(await verify(page(), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(evil, pageId)),
+		referrer: pageReferrer
+	}), "untrustedGateway");
+	assertFailure(await verify(page({ partOf: `ap://${did}/actor/inbox` }), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, pageId)),
+		referrer: pageReferrer
+	}), "collectionPageMismatch");
+	const foreignPageId = `ap://${otherDid}/outbox?page=1`;
+	assertFailure(await verify(page({
+		id: foreignPageId,
+		partOf: void 0
+	}), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, foreignPageId)),
+		referrer: pageReferrer
+	}), "collectionPageMismatch");
+	assertFailure(await verify(page({ attributedTo: `ap://${did}/actor2` }), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, pageId)),
+		referrer: pageReferrer
+	}), "conflictingCollectionOwners");
+	assertFailure(await verify(page({ attributedTo: actorId }), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, pageId)),
+		referrer: linkFrom(collection, "first")
+	}), "unknownCollectionOwner");
+	assertFailure(await verify(page(), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, pageId)),
+		referrer: linkFrom(collection, "first", { collectionContext: {
+			rootId: outboxId,
+			owner: null
+		} })
+	}), "unknownCollectionOwner");
+});
+test("verifyPortableObject() checks intermediate pages", async () => {
+	const documentLoader = createLoader({ [gatewayUrl(gw1, actorId)]: signedActor });
+	const collection = await OrderedCollection.fromJsonLd(outbox(), { contextLoader });
+	const intermediate = async (partOf) => await CollectionPage.fromJsonLd({
+		"@context": context$1,
+		id: `ap://${did}/actor/outbox?page=1`,
+		type: "OrderedCollectionPage",
+		partOf
+	}, { contextLoader });
+	const pageId = `ap://${did}/actor/outbox?page=2`;
+	const page = {
+		"@context": context$1,
+		id: pageId,
+		type: "OrderedCollectionPage",
+		partOf: outboxId,
+		orderedItems: []
+	};
+	const chain = (first) => linkFrom(first, "next", { referrer: linkFrom(collection, "first", { referrer: linkFrom(actorObject, "outbox") }) });
+	const options = {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, pageId)),
+		gateways: [new URL(gw1)]
+	};
+	const result = await verify(page, {
+		...options,
+		referrer: chain(await intermediate(outboxId))
+	});
+	ok(result.verified);
+	strictEqual(result.method, "gateway");
+	assertFailure(await verify(page, {
+		...options,
+		referrer: chain(await intermediate(`ap://${did}/actor/inbox`))
+	}), "collectionPageMismatch");
+	assertFailure(await verify(page, {
+		...options,
+		referrer: linkFrom(await intermediate(outboxId), "next", { truncated: true })
+	}), "unknownCollectionOwner");
+});
+test("verifyPortableObject() works with property accessors", async () => {
+	const itemId = `ap://${did}/notes/1`;
+	const note = await sign({
+		"@context": context$1,
+		id: itemId,
+		type: "Note",
+		attributedTo: actorId,
+		content: "Hello"
+	});
+	const page1Id = `ap://${did}/actor/outbox?page=1`;
+	const page2Id = `ap://${did}/actor/outbox?page=2`;
+	const page1 = {
+		id: page1Id,
+		type: "OrderedCollectionPage",
+		partOf: outboxId,
+		orderedItems: [{
+			id: itemId,
+			type: "Note",
+			content: "Forged"
+		}],
+		next: page2Id
+	};
+	const options = {
+		documentLoader: createLoader({
+			[gatewayUrl(gw1, actorId)]: signedActor,
+			[gatewayUrl(gw1, outboxId)]: outbox({ first: page1 }),
+			[gatewayUrl(gw1, page1Id)]: {
+				"@context": context$1,
+				...page1
+			},
+			[gatewayUrl(gw1, page2Id)]: {
+				"@context": context$1,
+				id: page2Id,
+				type: "OrderedCollectionPage",
+				partOf: outboxId,
+				orderedItems: [itemId]
+			},
+			[gatewayUrl(gw1, itemId)]: note
+		}),
+		contextLoader,
+		gateways: [gw1],
+		verifyPortableObject
+	};
+	const create = await Collection.fromJsonLd({
+		"@context": context$1,
+		type: "Collection",
+		items: [actorId]
+	}, { contextLoader });
+	const items = await Array.fromAsync(create.getItems(options));
+	strictEqual(items.length, 1);
+	ok(items[0] instanceof Person);
+	const outboxCollection = await items[0].getOutbox(options);
+	ok(outboxCollection instanceof OrderedCollection);
+	deepStrictEqual((await Array.fromAsync(traverseCollection(outboxCollection, options))).map((item) => item instanceof Note ? item.content : null), ["Hello", "Hello"]);
+	const evilLoader = createLoader({
+		[gatewayUrl(evil, actorId)]: signedActor,
+		[gatewayUrl(evil, outboxId)]: outbox()
+	});
+	strictEqual(await (await Person.fromJsonLd(signedActor, { contextLoader })).getOutbox({
+		...options,
+		documentLoader: evilLoader,
+		gateways: [evil]
+	}), null);
+});
+test("verifyPortableObject() lets pages inherit owners across signed and embedded collections", async () => {
+	const page1Id = `ap://${did}/actor/outbox?page=1`;
+	const page1 = {
+		"@context": context$1,
+		id: page1Id,
+		type: "OrderedCollectionPage",
+		partOf: outboxId,
+		orderedItems: []
+	};
+	const fetchPerson = async (options) => {
+		const wrapper = await Collection.fromJsonLd({
+			"@context": context$1,
+			type: "Collection",
+			items: [actorId]
+		}, { contextLoader });
+		const [person] = await Array.fromAsync(wrapper.getItems(options));
+		ok(person instanceof Person);
+		return person;
+	};
+	const signedOutbox = await sign(outbox({ first: page1Id }));
+	let documentLoader = createLoader({
+		[gatewayUrl(gw1, actorId)]: signedActor,
+		[gatewayUrl(gw1, outboxId)]: signedOutbox,
+		[gatewayUrl(gw2, page1Id)]: page1
+	});
+	let options = {
+		documentLoader,
+		contextLoader,
+		gateways: [gw1, gw2],
+		verifyPortableObject
+	};
+	let person = await fetchPerson(options);
+	let collection = await person.getOutbox(options);
+	ok(collection instanceof OrderedCollection);
+	ok(await collection.getFirst(options) instanceof CollectionPage);
+	const embeddingActor = await sign(actor({ outbox: {
+		id: outboxId,
+		type: "OrderedCollection",
+		first: page1Id
+	} }));
+	documentLoader = createLoader({
+		[gatewayUrl(gw1, actorId)]: embeddingActor,
+		[gatewayUrl(gw2, page1Id)]: page1,
+		[gatewayUrl(evil, page1Id)]: page1
+	});
+	options = {
+		...options,
+		documentLoader
+	};
+	person = await fetchPerson(options);
+	collection = await person.getOutbox(options);
+	ok(collection instanceof OrderedCollection);
+	ok(await collection.getFirst(options) instanceof CollectionPage);
+	deepStrictEqual(documentLoader.fetched, [
+		gatewayUrl(gw1, actorId),
+		gatewayUrl(gw1, page1Id),
+		gatewayUrl(gw2, page1Id)
+	]);
+	person = await fetchPerson(options);
+	collection = await person.getOutbox(options);
+	ok(collection instanceof OrderedCollection);
+	strictEqual(await collection.getFirst({
+		...options,
+		gateways: [evil]
+	}), null);
+});
+test("verifyPortableObject() reuses a verified actor for pages of signed collections", async () => {
+	const documentLoader = createLoader({});
+	const signed = await verify(await sign(outbox()), {
+		documentLoader,
+		referrer: linkFrom(actorObject, "outbox", { acceptance: "verified" })
+	});
+	ok(signed.verified);
+	strictEqual(signed.method, "proof");
+	const collection = await OrderedCollection.fromJsonLd(outbox(), { contextLoader });
+	const pageId = `ap://${did}/actor/outbox?page=1`;
+	const result = await verify({
+		"@context": context$1,
+		id: pageId,
+		type: "OrderedCollectionPage",
+		partOf: outboxId,
+		orderedItems: []
+	}, {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, pageId)),
+		referrer: linkFrom(collection, "first", { collectionContext: signed.collectionContext })
+	});
+	ok(result.verified);
+	strictEqual(result.method, "gateway");
+	deepStrictEqual(documentLoader.fetched, []);
+});
+test("verifyPortableObject() fetches the owner through attributedTo hints", async () => {
+	const documentLoader = createLoader({ [gatewayUrl(gw2, actorId)]: signedActor });
+	const result = await verify(outbox({ attributedTo: `${actorId}?@gateway=${encodeURIComponent(gw2)}` }), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, outboxId)),
+		gatewayHints: [new URL(gw1)]
+	});
+	ok(result.verified);
+	strictEqual(result.method, "gateway");
+	deepStrictEqual(documentLoader.fetched, [gatewayUrl(gw2, actorId)]);
+});
+//#endregion
+export {};