@fedify/fedify 2.4.0-dev.2054 → 2.4.0-dev.2063
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/{builder-C86Z3BKs.mjs → builder-BzS4brdy.mjs} +8 -2
- package/dist/compat/mod.d.cts +1 -1
- package/dist/compat/mod.d.ts +1 -1
- package/dist/compat/transformers.test.mjs +1 -1
- package/dist/{compound-proof-BcZqTCwy.mjs → compound-proof-BrSXP5so.mjs} +1 -1
- package/dist/{context-BJPHhBmD.d.ts → context-D_gg4M0n.d.ts} +102 -1
- package/dist/{context-Bh_mJfbD.d.cts → context-b36TpPoG.d.cts} +102 -1
- package/dist/{deno-Bz6KTcon.mjs → deno-CVZgG4sc.mjs} +1 -1
- package/dist/{docloader-DS54zLD1.mjs → docloader-DBb8z7_l.mjs} +2 -2
- package/dist/federation/builder.test.mjs +1 -1
- package/dist/federation/compound-fanout.test.mjs +3 -3
- package/dist/federation/handler-compound-proof.test.mjs +3 -3
- package/dist/federation/handler.test.mjs +5 -5
- package/dist/federation/hashlink-media.test.d.mts +2 -0
- package/dist/federation/hashlink-media.test.mjs +422 -0
- package/dist/federation/idempotency.test.mjs +2 -2
- package/dist/federation/metrics.test.mjs +1 -1
- package/dist/federation/middleware.test.mjs +7 -7
- package/dist/federation/mod.cjs +1 -1
- package/dist/federation/mod.d.cts +3 -3
- package/dist/federation/mod.d.ts +3 -3
- package/dist/federation/mod.js +1 -1
- package/dist/federation/outgoing-proof.test.mjs +5 -5
- package/dist/federation/portable.test.mjs +3 -3
- package/dist/federation/router.test.mjs +2 -152
- package/dist/federation/send.test.mjs +3 -3
- package/dist/federation/tasks/enqueue.test.mjs +1 -1
- package/dist/federation/tasks/tasks.test.mjs +2 -2
- package/dist/federation/temporal.test.mjs +1 -1
- package/dist/federation/webfinger.test.mjs +1 -1
- package/dist/{federation-su1OEWsM.cjs → federation-BrsIzNK5.cjs} +139 -21
- package/dist/{http-C3WGK1dL.js → http-99KVDtMr.js} +1 -1
- package/dist/{http-LmUsMjK_.cjs → http-CVjwUCCu.cjs} +1 -1
- package/dist/{http-Ty805y3A.mjs → http-znjq5j6a.mjs} +3 -3
- package/dist/{key-BMc-2eW0.mjs → key-BnMA6vpl.mjs} +2 -2
- package/dist/{kv-cache-BhPPtHg7.mjs → kv-cache--REpvHgG.mjs} +1 -1
- package/dist/{kv-cache-CuaZnk6r.cjs → kv-cache-D2O0JspA.cjs} +1 -1
- package/dist/{kv-cache-BcHCmrC8.js → kv-cache-aijDx_jN.js} +1 -1
- package/dist/{ld-OpXWt-80.mjs → ld-BBVP8ock.mjs} +3 -3
- package/dist/{metrics-CTAe8lYz.mjs → metrics-B5spFq82.mjs} +1 -1
- package/dist/{middleware-C-JLcqy7.mjs → middleware-ClrGS1xy.mjs} +1 -1
- package/dist/{middleware-BtwW3G41.mjs → middleware-Cw8EWwAT.mjs} +145 -33
- package/dist/{middleware-_CMav1o7.js → middleware-CzYM4cJI.js} +140 -22
- package/dist/{mod-DU8aVzQJ.d.cts → mod-Bfenkg_c.d.cts} +1 -1
- package/dist/{mod-BofpDIcU.d.ts → mod-BhMvsgdF.d.ts} +1 -1
- package/dist/{mod-CNRAxXEb.d.ts → mod-Dhm7SqyE.d.ts} +150 -2
- package/dist/{mod-CVQFWefn.d.cts → mod-pLbeNwcC.d.cts} +150 -2
- package/dist/mod.cjs +6 -5
- package/dist/mod.d.cts +5 -5
- package/dist/mod.d.ts +5 -5
- package/dist/mod.js +6 -6
- package/dist/nodeinfo/handler.test.mjs +1 -1
- package/dist/{owner-Bcm4pLXw.cjs → owner-CHBQ0sSj.cjs} +34 -2
- package/dist/{owner-B-TLr-1I.js → owner-Cu_KMvQN.js} +29 -3
- package/dist/{owner-RxB_eQpU.mjs → owner-Hc0hvbbX.mjs} +2 -2
- package/dist/{proof-CVf2XbEa.mjs → proof-B69bJaSn.mjs} +32 -6
- package/dist/router-u5O5KCQr.mjs +156 -0
- package/dist/{send-DF9KzhJH.mjs → send-BB5rBhvN.mjs} +3 -3
- package/dist/sig/compound-proof-discovery.test.mjs +1 -1
- package/dist/sig/compound-proof-producer.test.mjs +1 -1
- package/dist/sig/compound-proof-verification.test.mjs +2 -2
- package/dist/sig/compound-proof.test.mjs +2 -2
- package/dist/sig/http.test.mjs +2 -2
- package/dist/sig/key.test.mjs +1 -1
- package/dist/sig/ld.test.mjs +2 -2
- package/dist/sig/mod.cjs +4 -2
- package/dist/sig/mod.d.cts +2 -2
- package/dist/sig/mod.d.ts +2 -2
- package/dist/sig/mod.js +4 -3
- package/dist/sig/owner.test.mjs +1 -1
- package/dist/sig/portable-collection.test.d.mts +2 -0
- package/dist/sig/portable-collection.test.mjs +971 -0
- package/dist/sig/proof.test.mjs +3 -3
- package/dist/sig-B8WDBV-h.js +401 -0
- package/dist/sig-dut4BzEW.cjs +405 -0
- package/dist/{temporal-B6U3fEUW.mjs → temporal-CcRkOx3C.mjs} +1 -1
- package/dist/testing/kv.test.mjs +1 -1
- package/dist/testing/mod.d.mts +101 -0
- package/dist/utils/docloader.test.mjs +2 -2
- package/dist/utils/kv-cache.test.mjs +1 -1
- package/dist/utils/mod.cjs +1 -1
- package/dist/utils/mod.js +1 -1
- package/package.json +7 -7
|
@@ -0,0 +1,405 @@
|
|
|
1
|
+
const { URLPattern } = require("urlpattern-polyfill");
|
|
2
|
+
const require_http = require("./http-CVjwUCCu.cjs");
|
|
3
|
+
const require_owner = require("./owner-CHBQ0sSj.cjs");
|
|
4
|
+
let _logtape_logtape = require("@logtape/logtape");
|
|
5
|
+
let _fedify_vocab = require("@fedify/vocab");
|
|
6
|
+
let _opentelemetry_api = require("@opentelemetry/api");
|
|
7
|
+
let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
|
|
8
|
+
let _fedify_vocab_runtime_internal_portable_dereference = require("@fedify/vocab-runtime/internal/portable-dereference");
|
|
9
|
+
//#region src/sig/portable-collection.ts
|
|
10
|
+
const logger = (0, _logtape_logtape.getLogger)([
|
|
11
|
+
"fedify",
|
|
12
|
+
"sig",
|
|
13
|
+
"proof"
|
|
14
|
+
]);
|
|
15
|
+
const AS_NAMESPACE = "https://www.w3.org/ns/activitystreams#";
|
|
16
|
+
const AS_ATTRIBUTED_TO = `${AS_NAMESPACE}attributedTo`;
|
|
17
|
+
const AS_PART_OF = `${AS_NAMESPACE}partOf`;
|
|
18
|
+
/**
|
|
19
|
+
* The properties through which a collection refers to its pages, and a page
|
|
20
|
+
* to other pages of the same collection.
|
|
21
|
+
*/
|
|
22
|
+
const PAGING_PROPERTIES = new Set([
|
|
23
|
+
"first",
|
|
24
|
+
"last",
|
|
25
|
+
"current",
|
|
26
|
+
"next",
|
|
27
|
+
"prev"
|
|
28
|
+
].map((p) => AS_NAMESPACE + p));
|
|
29
|
+
/**
|
|
30
|
+
* The properties through which an actor refers to its own collections.
|
|
31
|
+
*/
|
|
32
|
+
const ACTOR_COLLECTION_PROPERTIES = /* @__PURE__ */ new Set([
|
|
33
|
+
"http://www.w3.org/ns/ldp#inbox",
|
|
34
|
+
`${AS_NAMESPACE}outbox`,
|
|
35
|
+
`${AS_NAMESPACE}followers`,
|
|
36
|
+
`${AS_NAMESPACE}following`,
|
|
37
|
+
`${AS_NAMESPACE}liked`
|
|
38
|
+
]);
|
|
39
|
+
const contextStates = /* @__PURE__ */ new WeakMap();
|
|
40
|
+
function createContext(state) {
|
|
41
|
+
const token = Object.freeze(Object.create(null));
|
|
42
|
+
contextStates.set(token, state);
|
|
43
|
+
return token;
|
|
44
|
+
}
|
|
45
|
+
function getContextState(context) {
|
|
46
|
+
if (context == null || typeof context !== "object") return void 0;
|
|
47
|
+
return contextStates.get(context);
|
|
48
|
+
}
|
|
49
|
+
function canonicalize(id) {
|
|
50
|
+
try {
|
|
51
|
+
return (0, _fedify_vocab_runtime.canonicalizePortableUri)(typeof id === "string" ? id : (0, _fedify_vocab_runtime.formatIri)(id));
|
|
52
|
+
} catch (error) {
|
|
53
|
+
if (error instanceof TypeError) return null;
|
|
54
|
+
throw error;
|
|
55
|
+
}
|
|
56
|
+
}
|
|
57
|
+
function toUrl(canonicalId) {
|
|
58
|
+
return (0, _fedify_vocab_runtime.parseIri)(canonicalId);
|
|
59
|
+
}
|
|
60
|
+
function canonicalizeAll(ids) {
|
|
61
|
+
const result = [];
|
|
62
|
+
for (const id of ids) {
|
|
63
|
+
const canonical = canonicalize(id);
|
|
64
|
+
if (canonical == null) return null;
|
|
65
|
+
result.push(canonical);
|
|
66
|
+
}
|
|
67
|
+
return result;
|
|
68
|
+
}
|
|
69
|
+
function getExpandedIds(node, property) {
|
|
70
|
+
const values = node[property];
|
|
71
|
+
if (values == null) return [];
|
|
72
|
+
if (!Array.isArray(values)) return null;
|
|
73
|
+
const ids = [];
|
|
74
|
+
for (const value of values) {
|
|
75
|
+
if (value == null || typeof value !== "object" || Array.isArray(value) || typeof value["@id"] !== "string") return null;
|
|
76
|
+
ids.push(value["@id"]);
|
|
77
|
+
}
|
|
78
|
+
return ids;
|
|
79
|
+
}
|
|
80
|
+
function parseAll(ids) {
|
|
81
|
+
const result = [];
|
|
82
|
+
for (const id of ids) try {
|
|
83
|
+
result.push((0, _fedify_vocab_runtime.parseIri)(id));
|
|
84
|
+
} catch (error) {
|
|
85
|
+
if (error instanceof TypeError) return null;
|
|
86
|
+
throw error;
|
|
87
|
+
}
|
|
88
|
+
return result;
|
|
89
|
+
}
|
|
90
|
+
function describeRoot(root) {
|
|
91
|
+
const rawId = root["@id"];
|
|
92
|
+
if (typeof rawId !== "string") return null;
|
|
93
|
+
const id = canonicalize(rawId);
|
|
94
|
+
if (id == null) return null;
|
|
95
|
+
const partOf = getExpandedIds(root, AS_PART_OF);
|
|
96
|
+
const attributedTo = getExpandedIds(root, AS_ATTRIBUTED_TO);
|
|
97
|
+
return {
|
|
98
|
+
id,
|
|
99
|
+
url: toUrl(id),
|
|
100
|
+
origin: (0, _fedify_vocab_runtime.getFe34Origin)(id),
|
|
101
|
+
partOf: partOf == null ? null : canonicalizeAll(partOf),
|
|
102
|
+
attributedTo: attributedTo == null ? null : canonicalizeAll(attributedTo),
|
|
103
|
+
attributedToUrls: attributedTo == null ? null : parseAll(attributedTo)
|
|
104
|
+
};
|
|
105
|
+
}
|
|
106
|
+
function describeObject(object) {
|
|
107
|
+
if (!(object instanceof _fedify_vocab.Object) || object.id == null) return null;
|
|
108
|
+
const id = canonicalize(object.id);
|
|
109
|
+
if (id == null) return null;
|
|
110
|
+
const partOfId = object instanceof _fedify_vocab.CollectionPage ? object.partOfId : null;
|
|
111
|
+
return {
|
|
112
|
+
id,
|
|
113
|
+
url: toUrl(id),
|
|
114
|
+
origin: (0, _fedify_vocab_runtime.getFe34Origin)(id),
|
|
115
|
+
partOf: canonicalizeAll(partOfId == null ? [] : [partOfId]),
|
|
116
|
+
attributedTo: canonicalizeAll(object.attributionIds),
|
|
117
|
+
attributedToUrls: object.attributionIds
|
|
118
|
+
};
|
|
119
|
+
}
|
|
120
|
+
function fail(reason) {
|
|
121
|
+
return {
|
|
122
|
+
verified: false,
|
|
123
|
+
reason
|
|
124
|
+
};
|
|
125
|
+
}
|
|
126
|
+
/**
|
|
127
|
+
* Walks the referrer chain of a collection or page to find the root
|
|
128
|
+
* collection and its owner candidate, checking every page on the way.
|
|
129
|
+
*/
|
|
130
|
+
function resolveChain(node, referrer) {
|
|
131
|
+
const pages = [];
|
|
132
|
+
let top = node;
|
|
133
|
+
let link = referrer;
|
|
134
|
+
let state;
|
|
135
|
+
while (link != null && PAGING_PROPERTIES.has(link.property)) {
|
|
136
|
+
pages.push(top);
|
|
137
|
+
state = getContextState(link.collectionContext);
|
|
138
|
+
if (state != null) break;
|
|
139
|
+
const parent = describeObject(link.object);
|
|
140
|
+
if (parent == null || link.truncated) return fail({ type: "unknownCollectionOwner" });
|
|
141
|
+
top = parent;
|
|
142
|
+
link = link.referrer;
|
|
143
|
+
}
|
|
144
|
+
let rootId;
|
|
145
|
+
let rootOrigin;
|
|
146
|
+
let candidate;
|
|
147
|
+
if (state != null) {
|
|
148
|
+
rootId = state.rootId;
|
|
149
|
+
rootOrigin = state.rootOrigin;
|
|
150
|
+
const ownerCandidate = state.owner == null ? state.ownerCandidate : { id: canonicalize(state.owner.id) };
|
|
151
|
+
if (ownerCandidate == null) return fail({ type: "unknownCollectionOwner" });
|
|
152
|
+
candidate = ownerCandidate;
|
|
153
|
+
} else {
|
|
154
|
+
rootId = top.id;
|
|
155
|
+
rootOrigin = top.origin;
|
|
156
|
+
const attributedTo = top.attributedTo;
|
|
157
|
+
if (attributedTo == null) return fail({ type: "unknownCollectionOwner" });
|
|
158
|
+
if (link != null && ACTOR_COLLECTION_PROPERTIES.has(link.property)) {
|
|
159
|
+
const id = link.id == null ? null : canonicalize(link.id);
|
|
160
|
+
if (id == null) return fail({ type: "unknownCollectionOwner" });
|
|
161
|
+
candidate = {
|
|
162
|
+
id,
|
|
163
|
+
object: link.object,
|
|
164
|
+
acceptance: link.acceptance
|
|
165
|
+
};
|
|
166
|
+
} else if (attributedTo.length === 1) candidate = {
|
|
167
|
+
id: attributedTo[0],
|
|
168
|
+
url: top.attributedToUrls?.[0]
|
|
169
|
+
};
|
|
170
|
+
else if (attributedTo.length > 1) return fail({
|
|
171
|
+
type: "conflictingCollectionOwners",
|
|
172
|
+
candidates: attributedTo.map(toUrl)
|
|
173
|
+
});
|
|
174
|
+
else return fail({ type: "unknownCollectionOwner" });
|
|
175
|
+
const conflict = attributedTo.find((id) => id !== candidate.id);
|
|
176
|
+
if (conflict != null) return fail({
|
|
177
|
+
type: "conflictingCollectionOwners",
|
|
178
|
+
candidates: [toUrl(candidate.id), toUrl(conflict)]
|
|
179
|
+
});
|
|
180
|
+
}
|
|
181
|
+
if ((0, _fedify_vocab_runtime.getFe34Origin)(candidate.id) !== rootOrigin) return fail({ type: "unknownCollectionOwner" });
|
|
182
|
+
for (const page of pages) {
|
|
183
|
+
if (page.origin !== rootOrigin) return fail({
|
|
184
|
+
type: "collectionPageMismatch",
|
|
185
|
+
pageId: page.url,
|
|
186
|
+
collectionId: toUrl(rootId),
|
|
187
|
+
partOf: null
|
|
188
|
+
});
|
|
189
|
+
if (page.partOf == null) return fail({ type: "unknownCollectionOwner" });
|
|
190
|
+
const partOf = page.partOf.find((id) => id !== rootId);
|
|
191
|
+
if (partOf != null) return fail({
|
|
192
|
+
type: "collectionPageMismatch",
|
|
193
|
+
pageId: page.url,
|
|
194
|
+
collectionId: toUrl(rootId),
|
|
195
|
+
partOf: toUrl(partOf)
|
|
196
|
+
});
|
|
197
|
+
if (page.attributedTo == null) return fail({ type: "unknownCollectionOwner" });
|
|
198
|
+
const conflict = page.attributedTo.find((id) => id !== candidate.id);
|
|
199
|
+
if (conflict != null) return fail({
|
|
200
|
+
type: "conflictingCollectionOwners",
|
|
201
|
+
candidates: [toUrl(candidate.id), toUrl(conflict)]
|
|
202
|
+
});
|
|
203
|
+
}
|
|
204
|
+
return {
|
|
205
|
+
rootId,
|
|
206
|
+
rootOrigin,
|
|
207
|
+
owner: state?.owner ?? null,
|
|
208
|
+
candidate
|
|
209
|
+
};
|
|
210
|
+
}
|
|
211
|
+
function getActorCollectionIds(actor) {
|
|
212
|
+
const ids = [];
|
|
213
|
+
for (const id of [
|
|
214
|
+
actor.inboxId,
|
|
215
|
+
actor.outboxId,
|
|
216
|
+
actor.followersId,
|
|
217
|
+
actor.followingId,
|
|
218
|
+
actor.likedId
|
|
219
|
+
]) {
|
|
220
|
+
if (id == null) continue;
|
|
221
|
+
const canonical = canonicalize(id);
|
|
222
|
+
if (canonical != null) ids.push(canonical);
|
|
223
|
+
}
|
|
224
|
+
return ids;
|
|
225
|
+
}
|
|
226
|
+
async function fetchOwner(candidate, options) {
|
|
227
|
+
const documentLoader = options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
|
|
228
|
+
const contextLoader = options.contextLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
|
|
229
|
+
const tracerProvider = options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
|
|
230
|
+
const tracer = tracerProvider.getTracer(require_http.name, require_http.version);
|
|
231
|
+
const gateways = options.gateways ?? ((0, _fedify_vocab_runtime_internal_portable_dereference.getPortableGatewayCandidates)(candidate).length > 0 ? void 0 : options.gatewayHints);
|
|
232
|
+
const span = tracer.startSpan("activitypub.lookup_object");
|
|
233
|
+
try {
|
|
234
|
+
const object = await (0, _fedify_vocab_runtime_internal_portable_dereference.dereferencePortableIri)(candidate, {
|
|
235
|
+
documentLoader,
|
|
236
|
+
contextLoader,
|
|
237
|
+
tracerProvider,
|
|
238
|
+
gateways,
|
|
239
|
+
verifyPortableObject: (document, verifierOptions) => require_owner.verifyPortableObjectProof(document, {
|
|
240
|
+
...options,
|
|
241
|
+
...verifierOptions
|
|
242
|
+
}),
|
|
243
|
+
suppressError: true,
|
|
244
|
+
span,
|
|
245
|
+
parse: (document, parseOptions) => _fedify_vocab.Object.fromJsonLd(document, {
|
|
246
|
+
documentLoader,
|
|
247
|
+
contextLoader: parseOptions.contextLoader,
|
|
248
|
+
tracerProvider,
|
|
249
|
+
baseUrl: parseOptions.baseUrl
|
|
250
|
+
})
|
|
251
|
+
});
|
|
252
|
+
return (0, _fedify_vocab.isActor)(object) ? object : null;
|
|
253
|
+
} catch (error) {
|
|
254
|
+
logger.debug("Failed to fetch the owner {owner} of a portable collection: {error}", {
|
|
255
|
+
owner: (0, _fedify_vocab_runtime.formatIri)(candidate),
|
|
256
|
+
error
|
|
257
|
+
});
|
|
258
|
+
return null;
|
|
259
|
+
} finally {
|
|
260
|
+
span.end();
|
|
261
|
+
}
|
|
262
|
+
}
|
|
263
|
+
async function resolveOwner(chain, options) {
|
|
264
|
+
if (chain.owner != null) return chain.owner;
|
|
265
|
+
const { candidate } = chain;
|
|
266
|
+
const candidateUrl = toUrl(candidate.id);
|
|
267
|
+
let actor = null;
|
|
268
|
+
if (candidate.acceptance === "verified" && (0, _fedify_vocab.isActor)(candidate.object) && candidate.object.id != null && canonicalize(candidate.object.id) === candidate.id) actor = candidate.object;
|
|
269
|
+
else actor = await fetchOwner(candidate.url ?? (candidate.object instanceof _fedify_vocab.Object && candidate.object.id != null ? candidate.object.id : candidateUrl), options);
|
|
270
|
+
if (actor == null || actor.id == null) return fail({
|
|
271
|
+
type: "collectionOwnerUnavailable",
|
|
272
|
+
owner: candidateUrl
|
|
273
|
+
});
|
|
274
|
+
const gateways = actor.gateways;
|
|
275
|
+
if (gateways.length < 1) return fail({
|
|
276
|
+
type: "collectionOwnerUnavailable",
|
|
277
|
+
owner: candidateUrl
|
|
278
|
+
});
|
|
279
|
+
if (!getActorCollectionIds(actor).includes(chain.rootId)) return fail({
|
|
280
|
+
type: "collectionNotListedByOwner",
|
|
281
|
+
owner: candidateUrl,
|
|
282
|
+
collectionId: toUrl(chain.rootId)
|
|
283
|
+
});
|
|
284
|
+
return {
|
|
285
|
+
id: candidateUrl,
|
|
286
|
+
gateways
|
|
287
|
+
};
|
|
288
|
+
}
|
|
289
|
+
function getSourceGateway(node, documentUrl) {
|
|
290
|
+
if (documentUrl == null || documentUrl.protocol !== "http:" && documentUrl.protocol !== "https:") return null;
|
|
291
|
+
let portableId;
|
|
292
|
+
try {
|
|
293
|
+
portableId = (0, _fedify_vocab_runtime.fromCompatibleEf61Id)(documentUrl);
|
|
294
|
+
} catch (error) {
|
|
295
|
+
if (error instanceof TypeError) return null;
|
|
296
|
+
throw error;
|
|
297
|
+
}
|
|
298
|
+
if (portableId == null || canonicalize(portableId) !== node.id) return null;
|
|
299
|
+
return new URL(documentUrl.origin);
|
|
300
|
+
}
|
|
301
|
+
/**
|
|
302
|
+
* Applies the [FEP-ef61] trust policy to a portable object fetched through
|
|
303
|
+
* a gateway.
|
|
304
|
+
*
|
|
305
|
+
* Portable actors, activities, objects, and collections with proofs are
|
|
306
|
+
* verified by {@link verifyPortableObjectProof}. A portable collection or
|
|
307
|
+
* collection page without a proof is accepted only if all of the following
|
|
308
|
+
* hold:
|
|
309
|
+
*
|
|
310
|
+
* - It was retrieved from a gateway: its final URL (`documentUrl`) is
|
|
311
|
+
* a compatible identifier for the same portable collection.
|
|
312
|
+
* - Its owner is determined unambiguously: the actor whose `inbox`,
|
|
313
|
+
* `outbox`, `followers`, `following`, or `liked` property referred to
|
|
314
|
+
* the collection, or the single actor in its `attributedTo`. A page
|
|
315
|
+
* inherits the owner of the collection it was reached from through
|
|
316
|
+
* `first`, `last`, `current`, `next`, or `prev`, and must not name
|
|
317
|
+
* another collection in `partOf`.
|
|
318
|
+
* - The owner's actor document is verified by its proof and lists the
|
|
319
|
+
* collection as its `inbox`, `outbox`, `followers`, `following`, or
|
|
320
|
+
* `liked`.
|
|
321
|
+
* - The gateway that served the collection is in the owner's `gateways`.
|
|
322
|
+
*
|
|
323
|
+
* Where the document came from and which object referred to it are passed
|
|
324
|
+
* by property accessors when this function is used as their
|
|
325
|
+
* `verifyPortableObject` option. Objects embedded in an unsecured
|
|
326
|
+
* collection accepted this way are not trusted: accessors dereference and
|
|
327
|
+
* verify them one by one.
|
|
328
|
+
*
|
|
329
|
+
* Note that acceptance through the gateway policy does not verify anything
|
|
330
|
+
* cryptographically; it only means that the owner trusts the gateway.
|
|
331
|
+
*
|
|
332
|
+
* [FEP-ef61]: https://w3id.org/fep/ef61
|
|
333
|
+
*
|
|
334
|
+
* @param jsonLd The JSON-LD document to verify.
|
|
335
|
+
* @param options Additional options. See also
|
|
336
|
+
* {@link VerifyPortableObjectOptions}.
|
|
337
|
+
* @returns The detailed result.
|
|
338
|
+
* @throws {TypeError} If the input is not a single JSON-LD object or has a
|
|
339
|
+
* malformed portable ID.
|
|
340
|
+
* @since 2.4.0
|
|
341
|
+
*/
|
|
342
|
+
async function verifyPortableObject(jsonLd, options = {}) {
|
|
343
|
+
const { result, root, objectType } = await require_owner.verifyPortableObjectProofWithRoot(jsonLd, options);
|
|
344
|
+
if (result.verified) {
|
|
345
|
+
const node = objectType === "collection" && root != null ? describeRoot(root) : null;
|
|
346
|
+
const chain = node == null ? null : resolveChain(node, options.referrer);
|
|
347
|
+
if (chain == null || !("rootId" in chain)) return {
|
|
348
|
+
verified: true,
|
|
349
|
+
method: "proof",
|
|
350
|
+
keys: result.keys
|
|
351
|
+
};
|
|
352
|
+
return {
|
|
353
|
+
verified: true,
|
|
354
|
+
method: "proof",
|
|
355
|
+
keys: result.keys,
|
|
356
|
+
collectionContext: createContext({
|
|
357
|
+
rootId: chain.rootId,
|
|
358
|
+
rootOrigin: chain.rootOrigin,
|
|
359
|
+
owner: chain.owner,
|
|
360
|
+
ownerCandidate: chain.candidate
|
|
361
|
+
})
|
|
362
|
+
};
|
|
363
|
+
}
|
|
364
|
+
if (result.reason.type !== "unsecuredCollection") return {
|
|
365
|
+
verified: false,
|
|
366
|
+
reason: result.reason
|
|
367
|
+
};
|
|
368
|
+
const node = root == null ? null : describeRoot(root);
|
|
369
|
+
if (node == null) return fail({ type: "unknownCollectionOwner" });
|
|
370
|
+
const gateway = getSourceGateway(node, options.documentUrl);
|
|
371
|
+
if (gateway == null) return fail({
|
|
372
|
+
type: "unknownCollectionSource",
|
|
373
|
+
documentUrl: options.documentUrl ?? null
|
|
374
|
+
});
|
|
375
|
+
const chain = resolveChain(node, options.referrer);
|
|
376
|
+
if (!("rootId" in chain)) return chain;
|
|
377
|
+
const owner = await resolveOwner(chain, options);
|
|
378
|
+
if (!("gateways" in owner)) return owner;
|
|
379
|
+
if (!owner.gateways.some((g) => g.origin === gateway.origin)) return fail({
|
|
380
|
+
type: "untrustedGateway",
|
|
381
|
+
owner: owner.id,
|
|
382
|
+
gateway,
|
|
383
|
+
gateways: owner.gateways
|
|
384
|
+
});
|
|
385
|
+
return {
|
|
386
|
+
verified: true,
|
|
387
|
+
method: "gateway",
|
|
388
|
+
unsecured: true,
|
|
389
|
+
owner: owner.id,
|
|
390
|
+
gateway,
|
|
391
|
+
collectionContext: createContext({
|
|
392
|
+
rootId: chain.rootId,
|
|
393
|
+
rootOrigin: chain.rootOrigin,
|
|
394
|
+
owner,
|
|
395
|
+
ownerCandidate: null
|
|
396
|
+
})
|
|
397
|
+
};
|
|
398
|
+
}
|
|
399
|
+
//#endregion
|
|
400
|
+
Object.defineProperty(exports, "verifyPortableObject", {
|
|
401
|
+
enumerable: true,
|
|
402
|
+
get: function() {
|
|
403
|
+
return verifyPortableObject;
|
|
404
|
+
}
|
|
405
|
+
});
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { Temporal } from "temporal-polyfill";
|
|
2
2
|
import "urlpattern-polyfill";
|
|
3
3
|
globalThis.addEventListener = () => {};
|
|
4
|
-
import { c as getNormalizationContextLoader } from "./ld-
|
|
4
|
+
import { c as getNormalizationContextLoader } from "./ld-BBVP8ock.mjs";
|
|
5
5
|
import jsonld from "@fedify/vocab-runtime/jsonld";
|
|
6
6
|
//#region src/federation/temporal.ts
|
|
7
7
|
function isPlainObject(value) {
|
package/dist/testing/kv.test.mjs
CHANGED
|
@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
|
|
|
6
6
|
import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
|
|
7
7
|
import { n as baseOptions, o as stringSchema, t as MockQueue } from "../tasks-dbCShlCb.mjs";
|
|
8
8
|
import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
|
|
9
|
-
import { o as createFederation } from "../middleware-
|
|
9
|
+
import { o as createFederation } from "../middleware-Cw8EWwAT.mjs";
|
|
10
10
|
//#region src/testing/kv.test.ts
|
|
11
11
|
test("ManualClockKvStore keeps an entry at its exact expiration instant", async () => {
|
|
12
12
|
const kv = new ManualClockKvStore();
|
package/dist/testing/mod.d.mts
CHANGED
|
@@ -463,6 +463,60 @@ type OutboxListener<TContextData, TActivity extends Activity> = (context: Outbox
|
|
|
463
463
|
* @since 2.4.0
|
|
464
464
|
*/
|
|
465
465
|
type MediaUploaderCallback<TContextData> = (context: RequestContext<TContextData>, identifier: string, file: File, object: Object$1) => Object$1 | URL | Promise<Object$1 | URL>;
|
|
466
|
+
/**
|
|
467
|
+
* A request for a resource addressed by a hashlink, which an
|
|
468
|
+
* [FEP-ef61](https://w3id.org/fep/ef61) gateway serves at
|
|
469
|
+
* `/.well-known/apgateway/hl:<digestMultibase>`.
|
|
470
|
+
*
|
|
471
|
+
* Fedify validates the hashlink before creating this object, so the digest is
|
|
472
|
+
* always a well-formed SHA-256 multihash.
|
|
473
|
+
*
|
|
474
|
+
* @since 2.4.0
|
|
475
|
+
*/
|
|
476
|
+
interface HashlinkMediaRequest {
|
|
477
|
+
/**
|
|
478
|
+
* The requested hashlink, i.e., `hl:` followed by
|
|
479
|
+
* {@link HashlinkMediaRequest.digestMultibase}, after percent-decoding and
|
|
480
|
+
* with its scheme lowercased.
|
|
481
|
+
*/
|
|
482
|
+
readonly hashlink: `hl:${string}`;
|
|
483
|
+
/**
|
|
484
|
+
* The multibase-encoded multihash as requested, which is the value that
|
|
485
|
+
* publishers put in the `digestMultibase` property. The same digest can be
|
|
486
|
+
* encoded in several multibase encodings; use
|
|
487
|
+
* {@link HashlinkMediaRequest.digest} as a storage key to find a resource
|
|
488
|
+
* regardless of the encoding.
|
|
489
|
+
*/
|
|
490
|
+
readonly digestMultibase: string;
|
|
491
|
+
/** The hash algorithm of the digest. */
|
|
492
|
+
readonly algorithm: "sha2-256";
|
|
493
|
+
/** The raw 32-byte SHA-256 digest of the resource. */
|
|
494
|
+
readonly digest: Uint8Array;
|
|
495
|
+
/**
|
|
496
|
+
* The multihash decoded from
|
|
497
|
+
* {@link HashlinkMediaRequest.digestMultibase}, i.e., the hash algorithm
|
|
498
|
+
* code and the digest length followed by the digest.
|
|
499
|
+
*/
|
|
500
|
+
readonly multihash: Uint8Array;
|
|
501
|
+
}
|
|
502
|
+
/**
|
|
503
|
+
* A callback that serves a resource addressed by a hashlink through the
|
|
504
|
+
* [FEP-ef61](https://w3id.org/fep/ef61) gateway endpoint.
|
|
505
|
+
*
|
|
506
|
+
* The returned response is sent as is, so the callback can stream its body
|
|
507
|
+
* and set headers such as `Content-Type` and `Cache-Control`. Fedify does not
|
|
508
|
+
* verify the response body against the digest, so the complete
|
|
509
|
+
* representation must be the exact bytes that hash to the requested digest.
|
|
510
|
+
*
|
|
511
|
+
* @template TContextData The context data to pass to the {@link Context}.
|
|
512
|
+
* @param context The request context.
|
|
513
|
+
* @param media The requested hashlink and its digest.
|
|
514
|
+
* @returns The response to send, or `null` if the resource is not stored on
|
|
515
|
+
* this server, which results in `404 Not Found`. It may be returned
|
|
516
|
+
* synchronously or wrapped in a `Promise`.
|
|
517
|
+
* @since 2.4.0
|
|
518
|
+
*/
|
|
519
|
+
type HashlinkMediaDispatcher<TContextData> = (context: RequestContext<TContextData>, media: HashlinkMediaRequest) => Response | null | Promise<Response | null>;
|
|
466
520
|
/**
|
|
467
521
|
* The reason why an incoming activity could not be verified.
|
|
468
522
|
*
|
|
@@ -1619,6 +1673,53 @@ interface Federatable<TContextData> extends TaskRegistry<TContextData> {
|
|
|
1619
1673
|
* @since 2.4.0
|
|
1620
1674
|
*/
|
|
1621
1675
|
setMediaUploader(path: `${string}${Rfc6570Expression<"identifier">}${string}`, callback: MediaUploaderCallback<TContextData>): MediaUploaderSetters<TContextData>;
|
|
1676
|
+
/**
|
|
1677
|
+
* Registers a dispatcher that serves resources addressed by hashlinks, such
|
|
1678
|
+
* as media attached to portable objects, through the
|
|
1679
|
+
* [FEP-ef61](https://w3id.org/fep/ef61) gateway endpoint, e.g.,
|
|
1680
|
+
* `GET /.well-known/apgateway/hl:zQmdfTbBqBPQ7VNxZEYEj14VmRuZBkqFbiwReogJgS1zR1n`.
|
|
1681
|
+
*
|
|
1682
|
+
* Fedify responds with `400 Bad Request` without calling the dispatcher if
|
|
1683
|
+
* the hashlink is malformed or its digest is not a SHA-256 multihash, and
|
|
1684
|
+
* with `404 Not Found` if the dispatcher returns `null`. Otherwise, the
|
|
1685
|
+
* response returned by the dispatcher is sent as is. Requests with methods
|
|
1686
|
+
* other than `GET` and `HEAD` get `405 Method Not Allowed`.
|
|
1687
|
+
*
|
|
1688
|
+
* Fedify does not verify the served bytes against the digest, as that would
|
|
1689
|
+
* require buffering the whole response body. The dispatcher must serve only
|
|
1690
|
+
* the resource whose complete representation hashes to the requested
|
|
1691
|
+
* digest, e.g., by using the digest as the storage key.
|
|
1692
|
+
*
|
|
1693
|
+
* This is not the upload API of the ActivityPub Media Upload extension,
|
|
1694
|
+
* which is registered through {@link Federatable.setMediaUploader}.
|
|
1695
|
+
*
|
|
1696
|
+
* @example
|
|
1697
|
+
* ``` typescript
|
|
1698
|
+
* federation.setHashlinkMediaDispatcher(async (ctx, media) => {
|
|
1699
|
+
* const file = await findPublicMedia(media.digest);
|
|
1700
|
+
* if (file == null) return null;
|
|
1701
|
+
* return new Response(
|
|
1702
|
+
* ctx.request.method === "HEAD" ? null : file.stream(),
|
|
1703
|
+
* {
|
|
1704
|
+
* headers: {
|
|
1705
|
+
* "Content-Type": file.mediaType,
|
|
1706
|
+
* "Content-Length": file.size.toString(),
|
|
1707
|
+
* "Cache-Control": "public, max-age=31536000, immutable",
|
|
1708
|
+
* "X-Content-Type-Options": "nosniff",
|
|
1709
|
+
* },
|
|
1710
|
+
* },
|
|
1711
|
+
* );
|
|
1712
|
+
* });
|
|
1713
|
+
* ```
|
|
1714
|
+
*
|
|
1715
|
+
* @param dispatcher A callback that returns the response serving the
|
|
1716
|
+
* requested resource, or `null` if it is not stored on
|
|
1717
|
+
* this server.
|
|
1718
|
+
* @throws {RouterError} Thrown if a hashlink media dispatcher is already
|
|
1719
|
+
* registered.
|
|
1720
|
+
* @since 2.4.0
|
|
1721
|
+
*/
|
|
1722
|
+
setHashlinkMediaDispatcher(dispatcher: HashlinkMediaDispatcher<TContextData>): void;
|
|
1622
1723
|
/**
|
|
1623
1724
|
* Registers a following collection dispatcher.
|
|
1624
1725
|
* @param path The URI path pattern for the following collection. The syntax
|
|
@@ -5,9 +5,9 @@ import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
|
|
|
5
5
|
import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
|
|
6
6
|
import "../std__assert-DvMDRPes.mjs";
|
|
7
7
|
import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
|
|
8
|
-
import { l as verifyRequest } from "../http-
|
|
8
|
+
import { l as verifyRequest } from "../http-znjq5j6a.mjs";
|
|
9
9
|
import { i as rsaPrivateKey2 } from "../keys-DIJNHW-Y.mjs";
|
|
10
|
-
import { t as getAuthenticatedDocumentLoader } from "../docloader-
|
|
10
|
+
import { t as getAuthenticatedDocumentLoader } from "../docloader-DBb8z7_l.mjs";
|
|
11
11
|
import { mockDocumentLoader, test } from "@fedify/fixture";
|
|
12
12
|
import { FetchError, UrlError } from "@fedify/vocab-runtime";
|
|
13
13
|
//#region src/utils/docloader.test.ts
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { Temporal } from "temporal-polyfill";
|
|
2
2
|
import { URLPattern } from "urlpattern-polyfill";
|
|
3
3
|
globalThis.addEventListener = () => {};
|
|
4
|
-
import { n as kvCache, t as MockKvStore } from "../kv-cache
|
|
4
|
+
import { n as kvCache, t as MockKvStore } from "../kv-cache--REpvHgG.mjs";
|
|
5
5
|
import { deepStrictEqual, throws } from "node:assert";
|
|
6
6
|
import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
|
|
7
7
|
import { preloadedContexts } from "@fedify/vocab-runtime";
|
package/dist/utils/mod.cjs
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
const { URLPattern } = require("urlpattern-polyfill");
|
|
2
2
|
Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
|
|
3
|
-
const require_kv_cache = require("../kv-cache-
|
|
3
|
+
const require_kv_cache = require("../kv-cache-D2O0JspA.cjs");
|
|
4
4
|
exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
|
|
5
5
|
exports.kvCache = require_kv_cache.kvCache;
|
package/dist/utils/mod.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
1
|
import { Temporal } from "temporal-polyfill";
|
|
2
2
|
import { URLPattern } from "urlpattern-polyfill";
|
|
3
|
-
import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-
|
|
3
|
+
import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-aijDx_jN.js";
|
|
4
4
|
export { getAuthenticatedDocumentLoader, kvCache };
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@fedify/fedify",
|
|
3
|
-
"version": "2.4.0-dev.
|
|
3
|
+
"version": "2.4.0-dev.2063+366c0362",
|
|
4
4
|
"description": "An ActivityPub server framework",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"ActivityPub",
|
|
@@ -151,10 +151,10 @@
|
|
|
151
151
|
"structured-field-values": "^2.0.4",
|
|
152
152
|
"temporal-polyfill": "^1.0.1",
|
|
153
153
|
"urlpattern-polyfill": "^10.1.0",
|
|
154
|
-
"@fedify/uri-template": "2.4.0-dev.
|
|
155
|
-
"@fedify/vocab": "2.4.0-dev.
|
|
156
|
-
"@fedify/
|
|
157
|
-
"@fedify/
|
|
154
|
+
"@fedify/uri-template": "2.4.0-dev.2063+366c0362",
|
|
155
|
+
"@fedify/vocab-runtime": "2.4.0-dev.2063+366c0362",
|
|
156
|
+
"@fedify/webfinger": "2.4.0-dev.2063+366c0362",
|
|
157
|
+
"@fedify/vocab": "2.4.0-dev.2063+366c0362"
|
|
158
158
|
},
|
|
159
159
|
"devDependencies": {
|
|
160
160
|
"@std/assert": "npm:@jsr/std__assert@^0.226.0",
|
|
@@ -166,8 +166,8 @@
|
|
|
166
166
|
"tsx": "^4.21.0",
|
|
167
167
|
"typescript": "^6.0.0",
|
|
168
168
|
"wrangler": "^4.17.0",
|
|
169
|
-
"@fedify/
|
|
170
|
-
"@fedify/
|
|
169
|
+
"@fedify/vocab-tools": "^2.4.0-dev.2063+366c0362",
|
|
170
|
+
"@fedify/fixture": "2.0.0"
|
|
171
171
|
},
|
|
172
172
|
"scripts": {
|
|
173
173
|
"build:self": "tsdown",
|