@fedify/fedify 2.4.0-dev.2073 → 2.4.0-dev.2084

package/dist/{federation-B1aeTKKN.cjs → federation-BLGx8JUH.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-DGk8XI38.cjs");
+const require_http = require("./http-B5q1CHtL.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-DCIH7Iq0.cjs");
-const require_kv_cache = require("./kv-cache-DvqkKNIj.cjs");
+const require_owner = require("./owner-BQFZtFV4.cjs");
+const require_kv_cache = require("./kv-cache-Dhhhrryv.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -2638,13 +2638,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$2.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$1.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(require_http.name, require_http.version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$2),
+		kind: getCollectionMetricKind(name$1),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -2685,7 +2685,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 							span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$2, filterPredicate);
+						const items = filterCollectionItems(page.items, name$1, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -2725,7 +2725,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 		} else {
 			const uri = new URL(baseUri);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
 				kind: _opentelemetry_api.SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -2741,7 +2741,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 						span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$2, filterPredicate);
+					const items = filterCollectionItems(page.items, name$1, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -3671,8 +3671,9 @@ async function handleInboxInternal(request, parameters, span) {
 		});
 	}
 	if (!skipSignatureVerification) {
-		if (inspectCompoundPortableObjectApplicability(json, INBOX_COMPOUND_PROOF_LIMITS) !== "absent") {
-			const compoundProof = await verifyCompoundPortableObjectProofs(json, INBOX_COMPOUND_PROOF_LIMITS, {
+		const compoundJson = Array.isArray(json) ? json : jsonWithoutSig;
+		if (inspectCompoundPortableObjectApplicability(compoundJson, INBOX_COMPOUND_PROOF_LIMITS) !== "absent") {
+			const compoundProof = await verifyCompoundPortableObjectProofs(compoundJson, INBOX_COMPOUND_PROOF_LIMITS, {
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
@@ -3888,8 +3889,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$1, values, context, callbacks, tracerProvider = _opentelemetry_api.trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$1;
+	constructor(name$2, values, context, callbacks, tracerProvider = _opentelemetry_api.trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
+		this.name = name$2;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -5058,6 +5059,7 @@ function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, loc
 	return {
 		status: "accepted",
 		recipient: {
+			actorId: id,
 			inboxId,
 			canonicalInboxId,
 			gateways
@@ -5091,8 +5093,11 @@ function canonicalize(iri) {
 * Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
 * forwarded.
 *
-* Forwarded requests are not signed with HTTP Signatures; the receiving
-* gateways authenticate the activity by its own proof.
+* Forwarded requests are signed with HTTP Signatures by the RSA key among
+* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
+* servers requiring HTTP Signatures accept them, and are sent unsigned
+* otherwise.  Either way, the receiving gateways authenticate the activity by
+* its own proof.
 * @param parameters The parameters.
 * @returns The target inbox URLs that the activity was handed off to.
 */
@@ -5164,20 +5169,59 @@ function getForwardingTargets(recipient, excludedOrigins) {
 	}
 	return targets;
 }
-async function forwardImmediately({ activity, activityId, activityType, allowPrivateAddress, options, meterProvider, tracerProvider }, inboxes) {
+/**
+* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
+* key, as {@link sendActivity} signs requests only with such a key.  Since
+* the targets have already been claimed, the activity is forwarded unsigned
+* rather than not at all if the key cannot be resolved or used.
+*/
+async function resolveForwardingKey({ getKeys, activityId }) {
+	if (getKeys == null) return null;
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	let key;
+	try {
+		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
+	} catch (error) {
+		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	if (key == null) return null;
+	try {
+		require_http.validateCryptoKey(key.privateKey, "private");
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	return key;
+}
+async function forwardImmediately(parameters, inboxes) {
+	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, options, meterProvider, tracerProvider } = parameters;
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
 	const deadline = (options ?? resolvePortableInboxForwardingOptions()).deadline.total("millisecond");
-	const sends = inboxes.map((inbox) => sendActivity({
+	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
 		activity,
 		activityId: activityId.href,
 		activityType,
-		keys: [],
+		keys: key == null ? [] : [key],
 		inbox,
 		allowPrivateAddress,
+		specDeterminer,
 		meterProvider,
 		tracerProvider
 	}).catch((error) => {
@@ -5186,9 +5230,9 @@ async function forwardImmediately({ activity, activityId, activityType, allowPri
 			inbox: inbox.href,
 			error
 		});
-	}));
+	}))));
 	let timer;
-	const timedOut = await Promise.race([Promise.all(sends).then(() => false), new Promise((resolve) => {
+	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
 		timer = setTimeout(() => resolve(true), deadline);
 	})]);
 	clearTimeout(timer);
@@ -5197,12 +5241,27 @@ async function forwardImmediately({ activity, activityId, activityType, allowPri
 		deadline
 	});
 }
-async function enqueueForwarding({ activity, activityId, activityType, baseUrl, startQueue, meterProvider }, outboxQueue, inboxes) {
+async function enqueueForwarding(parameters, outboxQueue, inboxes) {
+	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
+	const key = await resolveForwardingKey(parameters);
+	const keys = [];
+	if (key != null) try {
+		keys.push({
+			keyId: key.keyId.href,
+			privateKey: await require_http.exportJwk(key.privateKey)
+		});
+	} catch (error) {
+		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+	}
 	startQueue?.();
 	const started = (/* @__PURE__ */ new Date()).toISOString();
 	const traceContext = {};
@@ -5212,7 +5271,7 @@ async function enqueueForwarding({ activity, activityId, activityType, baseUrl,
 			type: "outbox",
 			id: crypto.randomUUID(),
 			baseUrl,
-			keys: [],
+			keys,
 			activity,
 			activityId: activityId.href,
 			activityType,
@@ -7895,6 +7954,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 						outboxQueue: this.outboxQueue,
 						startQueue: this.manuallyStartQueue ? void 0 : () => this._startQueueInternal(contextData),
 						allowPrivateAddress: this.allowPrivateAddress,
+						getKeys: () => this.#getPortableGatewayKeyPairs(context, identifier, recipient),
+						specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
 						options: this.portableInboxForwarding,
 						meterProvider: this.meterProvider,
 						tracerProvider: this.tracerProvider
@@ -7903,6 +7964,49 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}
 		});
 	}
+	/**
+	* Gets this server's gateway key pairs for the portable actor that owns
+	* a portable inbox, which sign the activities forwarded from the inbox.
+	* @param context The context.
+	* @param identifier The identifier of the portable actor.
+	* @param recipient The portable inbox.
+	* @returns The key pairs, or an empty array if the actor has no gateway
+	*          keys on this server.
+	*/
+	async #getPortableGatewayKeyPairs(context, identifier, recipient) {
+		const logger = (0, _logtape_logtape.getLogger)([
+			"fedify",
+			"federation",
+			"inbox"
+		]);
+		if (this.actorCallbacks?.keyPairsDispatcher == null || this.actorCallbacks.portableActorIdMapper == null) {
+			logger.debug("Forwarding activities from the portable inbox {inbox} without HTTP Signatures, as gateway keys need both a key pairs dispatcher and a portable actor ID mapper.", { inbox: recipient.canonicalInboxId });
+			return [];
+		}
+		const actorId = require_http.getCanonicalPortableId(recipient.actorId);
+		if (actorId == null) return [];
+		const keyPairs = await context.getActorKeyPairs(identifier);
+		for (const { cryptographicKey } of keyPairs) {
+			const owner = cryptographicKey.ownerId;
+			const canonicalOwner = owner == null ? null : require_http.getCanonicalPortableId(owner);
+			if (canonicalOwner === actorId) continue;
+			if (canonicalOwner == null) logger.debug("Forwarding activities from the portable inbox {inbox} without HTTP Signatures, as the key pairs of the actor {identifier} are not the gateway keys of a portable actor.", {
+				inbox: recipient.canonicalInboxId,
+				identifier
+			});
+			else logger.warn("Forwarding activities from the portable inbox {inbox} without HTTP Signatures, as the key pairs of the actor {identifier} are the gateway keys of {owner}, not of the recipient {actorId}.", {
+				inbox: recipient.canonicalInboxId,
+				identifier,
+				owner: canonicalOwner,
+				actorId
+			});
+			return [];
+		}
+		return keyPairs.map(({ keyId, privateKey }) => ({
+			keyId,
+			privateKey
+		}));
+	}
 	async #fetchHashlinkMedia(request, media, { onNotFound, contextData, span, metricState }) {
 		metricState.endpoint = "hashlink_media";
 		metricState.routeTemplate = HASHLINK_MEDIA_ROUTE_TEMPLATE;

package/dist/{http-vfTpzGEq.js → http-4PCCvhsU.js}

@@ -13,7 +13,7 @@ import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2073+2152dfc6";
+var version = "2.4.0-dev.2084+4b8bd325";
 //#endregion
 //#region src/sig/accept.ts
 /**

package/dist/{http-C7qHlv-b.mjs → http-B0VRNipE.mjs}

@@ -1,11 +1,11 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-LYTbBhYV.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DvlvYpq_.mjs";
+import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-Beod6tzO.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
-import { i as fetchKeyDetailed, s as validateCryptoKey } from "./key-BYXnTGro.mjs";
-import { n as verifyPortableGatewayKeyDocument } from "./portable-key-DCyKGCQd.mjs";
+import { i as fetchKeyDetailed, s as validateCryptoKey } from "./key-BJrp524f.mjs";
+import { n as verifyPortableGatewayKeyDocument } from "./portable-key-B4R-CiIV.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{http-DGk8XI38.cjs → http-B5q1CHtL.cjs}

@@ -15,7 +15,7 @@ let byte_encodings_base64 = require("byte-encodings/base64");
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2073+2152dfc6";
+var version = "2.4.0-dev.2084+4b8bd325";
 //#endregion
 //#region ../../node_modules/.pnpm/temporal-polyfill@1.0.1/node_modules/temporal-polyfill/chunks/root.js
 const NativeTemporal = globalThis.Temporal;

package/dist/{key-BYXnTGro.mjs → key-BJrp524f.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-LYTbBhYV.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-DvlvYpq_.mjs";
+import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-Beod6tzO.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{kv-cache-DCJuwdnB.js → kv-cache-1KUmAPH7.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { R as validateCryptoKey, nt as recordDocumentCache, t as doubleKnock } from "./http-vfTpzGEq.js";
+import { R as validateCryptoKey, nt as recordDocumentCache, t as doubleKnock } from "./http-4PCCvhsU.js";
 import { getLogger } from "@logtape/logtape";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";

package/dist/{kv-cache-DEH5jyND.mjs → kv-cache-C4C3LyYW.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-DvlvYpq_.mjs";
+import { p as recordDocumentCache } from "./metrics-Beod6tzO.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-DvqkKNIj.cjs → kv-cache-Dhhhrryv.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-DGk8XI38.cjs");
+const require_http = require("./http-B5q1CHtL.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");

package/dist/{ld-DT3e2hOv.mjs → ld-BmFz5NLA.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-LYTbBhYV.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DvlvYpq_.mjs";
-import { r as fetchKey, s as validateCryptoKey } from "./key-BYXnTGro.mjs";
+import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-Beod6tzO.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-BJrp524f.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{metrics-DvlvYpq_.mjs → metrics-Beod6tzO.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-LYTbBhYV.mjs";
+import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts

package/dist/{middleware-BJcez_E3.mjs → middleware-B7CNsyqt.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-CpyCNOW_.mjs";
+import { n as FederationImpl } from "./middleware-BKeQYPm0.mjs";
 export { FederationImpl };