@fedify/fedify 2.4.0-dev.2077 → 2.4.0-dev.2093

package/dist/federation/outgoing-proof.test.mjs

@@ -7,12 +7,13 @@ import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { t as exportJwk } from "../key-IxTTC8Yf.mjs";
-import { s as detachSignature } from "../ld-l0B9nREb.mjs";
-import { r as signObject } from "../proof-CVL7JnZd.mjs";
+import { t as exportJwk } from "../key-Dwm4VswT.mjs";
+import { s as detachSignature } from "../ld-BYZOoDzZ.mjs";
+import { i as signObject } from "../proof-DVXC6nYz.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as FederationImpl, o as createFederation } from "../middleware-BMgzqBtr.mjs";
-import { a as verifyCompoundPortableObjectProofs } from "../compound-proof-Cayy-ECj.mjs";
+import { c as assertPortableActorActivity, n as FederationImpl, o as createFederation } from "../middleware-E_0IH72m.mjs";
+import { a as verifyCompoundPortableObjectProofs } from "../compound-proof-CTx_lewQ.mjs";
+import { configure, reset } from "@logtape/logtape";
 import { Create, Note, Person } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { exportDidKey, parseIri } from "@fedify/vocab-runtime";
@@ -222,6 +223,29 @@ test("a non-portable activity embedding portable objects needs one key", async (
 	assertEquals(accepted.bodies.length, 1);
 	assertEquals(proofOf(accepted.bodies[0]).verificationMethod, ed25519PublicKey.id.href);
 });
+test("a non-portable activity embedding compatible-ID objects needs one key", async () => {
+	const owner = await didKey();
+	const compatibleId = (path) => new URL(`https://gw.example/.well-known/apgateway/${owner.did}${path}`);
+	const child = await signObject(new Note({
+		id: compatibleId(`/objects/${crypto.randomUUID()}`),
+		attribution: compatibleId("/actor"),
+		content: "A portable note"
+	}), owner.privateKey, owner.keyId, {
+		...options,
+		context: childContext,
+		created
+	});
+	const ctx = createTestFederation().createContext(new URL("https://example.com/"));
+	const keys = [sender(await didKey()), sender(await didKey())];
+	assertEquals((await capture(() => assertRejects(() => ctx.sendActivity([rsaKey, ...keys], recipient, httpCreate(child)), TypeError, "exactly one Ed25519 key"))).bodies.length, 0);
+	const key = {
+		keyId: ed25519PublicKey.id,
+		privateKey: ed25519PrivateKey
+	};
+	const accepted = await capture(() => ctx.sendActivity([rsaKey, key], recipient, httpCreate(child)));
+	assertEquals(accepted.bodies.length, 1);
+	await assertCompoundVerifies(accepted.bodies[0]);
+});
 test("an activity without portable objects is still signed by every key", async () => {
 	const ctx = createTestFederation().createContext(new URL("https://example.com/"));
 	const keys = [await didKey(), await didKey()];
@@ -392,5 +416,230 @@ test("a Fedify inbox accepts a portable activity Fedify produced", async () => {
 	});
 	assertEquals([(await receiving.fetch(requests[0], { contextData: void 0 })).status, received], [202, 1]);
 });
+const gateway = "https://gw.example";
+function compatibleId(did, path, origin = gateway) {
+	return new URL(`${origin}/.well-known/apgateway/${did}${path}`);
+}
+function compatibleCreate(owner, object, { id, actor } = {}) {
+	return new Create({
+		id: id ?? compatibleId(owner.did, `/activities/${crypto.randomUUID()}`),
+		actor: actor ?? compatibleId(owner.did, "/actor"),
+		object
+	});
+}
+test("a compatible-ID activity is signed only by the key matching its DID", async () => {
+	const owner = await didKey();
+	const childOwner = await didKey();
+	const child = await signedChild(childOwner);
+	const ctx = createTestFederation().createContext(new URL("https://example.com/"));
+	const { bodies, requests } = await capture(async () => ctx.sendActivity([
+		rsaKey,
+		sender(await didKey()),
+		sender(owner),
+		sender(childOwner)
+	], recipient, compatibleCreate(owner, child)));
+	assertEquals(bodies.length, 1);
+	assertEquals(proofOf(bodies[0]).verificationMethod, owner.keyId.href);
+	assert(requests[0].headers.has("Signature"));
+	assertEquals(bodies[0].signature, void 0);
+	await assertCompoundVerifies(bodies[0]);
+});
+test("a compatible-ID actor's activity needs an ID of the actor's DID", async () => {
+	const owner = await didKey();
+	const other = await didKey();
+	const cases = [
+		[
+			"a compatible activity ID of another DID",
+			compatibleCreate(owner, void 0, { id: compatibleId(other.did, "/activities/1") }),
+			"with the same DID"
+		],
+		[
+			"an ap: activity ID of another DID",
+			compatibleCreate(owner, void 0, { id: parseIri(`ap://${other.did}/activities/1`) }),
+			"with the same DID"
+		],
+		[
+			"an ordinary activity ID",
+			compatibleCreate(owner, void 0, { id: new URL("https://gw.example/activities/1") }),
+			"with the same DID"
+		],
+		[
+			"a malformed compatible activity ID",
+			compatibleCreate(owner, void 0, { id: new URL(compatibleId(owner.did, "/activities/1").href + "?@gateway=https%3A%2F%2Fgw.example") }),
+			"with the same DID"
+		],
+		[
+			"a malformed compatible actor ID",
+			compatibleCreate(owner, void 0, { actor: new URL(compatibleId(owner.did, "/actor").href + "?@gateway=https%3A%2F%2Fgw.example") }),
+			"malformed FEP-ef61 portable ID"
+		],
+		[
+			"compatible actors of different DIDs",
+			new Create({
+				id: compatibleId(owner.did, "/activities/1"),
+				actors: [compatibleId(owner.did, "/actor"), compatibleId(other.did, "/actor")]
+			}),
+			"different DIDs"
+		]
+	];
+	for (const [name, activity, message] of cases) {
+		const ctx = createTestFederation().createContext(new URL("https://example.com/"));
+		const { bodies } = await capture(() => assertRejects(() => ctx.sendActivity([rsaKey, sender(owner)], recipient, activity), TypeError, message));
+		assertEquals(bodies.length, 0, name);
+	}
+});
+test("a compatible-ID activity without exactly one DID-matching key is rejected", async () => {
+	const owner = await didKey();
+	const cases = [
+		[
+			"no key matches",
+			[sender(await didKey())],
+			"none of its 1 Ed25519 keys"
+		],
+		[
+			"only a gateway key",
+			[{
+				keyId: compatibleId(owner.did, "/actor#main-key"),
+				privateKey: owner.privateKey
+			}],
+			"none of its 0 Ed25519 keys"
+		],
+		[
+			"several keys match",
+			[sender(owner), {
+				keyId: new URL(`${owner.did}#second`),
+				privateKey: owner.privateKey
+			}],
+			"2 of its Ed25519 keys"
+		]
+	];
+	for (const [name, keys, message] of cases) {
+		const ctx = createTestFederation().createContext(new URL("https://example.com/"));
+		const { bodies } = await capture(() => assertRejects(() => ctx.sendActivity([rsaKey, ...keys], recipient, compatibleCreate(owner)), TypeError, message));
+		assertEquals(bodies.length, 0, name);
+	}
+});
+test("compatible and ap: IDs of the same DID can be mixed", async () => {
+	const owner = await didKey();
+	const activities = [
+		compatibleCreate(owner, void 0, { id: parseIri(`ap://${owner.did}/activities/${crypto.randomUUID()}`) }),
+		compatibleCreate(owner, void 0, { actor: parseIri(`ap+ef61://${owner.did}/actor`) }),
+		compatibleCreate(owner, void 0, { id: compatibleId(owner.did, "/activities/1", "https://other.example") })
+	];
+	for (const activity of activities) {
+		const ctx = createTestFederation().createContext(new URL("https://example.com/"));
+		const { bodies } = await capture(async () => ctx.sendActivity([
+			rsaKey,
+			sender(await didKey()),
+			sender(owner)
+		], recipient, activity));
+		assertEquals(bodies.length, 1, activity.id?.href);
+		assertEquals(proofOf(bodies[0]).verificationMethod, owner.keyId.href);
+	}
+});
+test("a pre-signed compatible-ID activity is not re-signed", async () => {
+	const owner = await didKey();
+	const activity = await signObject(compatibleCreate(owner, await signedChild(await didKey())), owner.privateKey, owner.keyId, {
+		...options,
+		created
+	});
+	const ctx = createTestFederation().createContext(new URL("https://example.com/"));
+	const { bodies } = await capture(async () => ctx.sendActivity([
+		rsaKey,
+		sender(await didKey()),
+		sender(await didKey())
+	], recipient, activity));
+	assertEquals(bodies.length, 1);
+	assertEquals(proofOf(bodies[0]).verificationMethod, owner.keyId.href);
+	await assertCompoundVerifies(bodies[0]);
+});
+test("forced fanout selects the DID-matching key for a compatible-ID activity", async () => {
+	const owner = await didKey();
+	const { queue, queued } = createQueue();
+	const federation = createTestFederation(queue);
+	const ctx = federation.createContext(new URL("https://example.com/"));
+	const { bodies } = await capture(async () => {
+		await ctx.sendActivity([
+			rsaKey,
+			sender(await didKey()),
+			sender(owner)
+		], recipient, compatibleCreate(owner, await signedChild(await didKey())), { fanout: "force" });
+		assertEquals(queued.length, 1);
+		for (let i = 0; i < queued.length; i++) await federation.processQueuedTask(void 0, queued[i]);
+	});
+	assertEquals(bodies.length, 1);
+	assertEquals(proofOf(bodies[0]).verificationMethod, owner.keyId.href);
+	await assertCompoundVerifies(bodies[0]);
+});
+test("a Fedify inbox accepts an activity Fedify produced for a compatible-ID actor", async () => {
+	const owner = await didKey();
+	const child = await signedChild(await didKey());
+	const ctx = createTestFederation().createContext(new URL("https://example.com/"));
+	const { requests } = await capture(async () => ctx.sendActivity([sender(await didKey()), sender(owner)], recipient, compatibleCreate(owner, child)));
+	assertEquals(requests.length, 1);
+	let received = 0;
+	const receiving = createFederation({
+		kv: new MemoryKvStore(),
+		contextLoaderFactory: () => mockDocumentLoader,
+		documentLoaderFactory: () => mockDocumentLoader
+	});
+	receiving.setActorDispatcher("/users/{identifier}", () => null);
+	receiving.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(Create, () => {
+		received++;
+	});
+	const body = await requests[0].text();
+	const deliver = (json) => receiving.fetch(new Request(requests[0].url, {
+		method: "POST",
+		headers: requests[0].headers,
+		body: json
+	}), { contextData: void 0 });
+	assertEquals([(await deliver(body)).status, received], [202, 1]);
+	const forged = JSON.parse(body);
+	forged.actor = compatibleId((await didKey()).did, "/actor").href;
+	assertEquals([(await deliver(JSON.stringify(forged))).status, received], [401, 1]);
+});
+async function captureLogs(run) {
+	const records = [];
+	await reset();
+	try {
+		await configure({
+			sinks: { buffer: (record) => records.push(record) },
+			filters: {},
+			loggers: [{
+				category: ["logtape", "meta"],
+				sinks: []
+			}, {
+				category: [],
+				sinks: ["buffer"],
+				lowestLevel: "warning"
+			}]
+		});
+		await run();
+	} finally {
+		await reset();
+	}
+	return records.filter((record) => record.category[0] === "fedify");
+}
+test("an activity on another gateway than its compatible-ID actor is warned about", async () => {
+	const owner = await didKey();
+	const warnings = (activity) => captureLogs(() => assertPortableActorActivity(activity)).then((records) => records.map((r) => r.properties.activityId));
+	const other = compatibleId(owner.did, "/activities/1", "https://other.example");
+	assertEquals(await warnings(compatibleCreate(owner, void 0, { id: other })), [other.href]);
+	assertEquals(await warnings(compatibleCreate(owner)), []);
+	assertEquals(await warnings(compatibleCreate(owner, void 0, { id: parseIri(`ap://${owner.did}/activities/1`) })), []);
+	assertEquals(await warnings(compatibleCreate(owner, void 0, {
+		id: other,
+		actor: parseIri(`ap://${owner.did}/actor`)
+	})), []);
+});
+test("an unsigned activity with a malformed compatible ID is rejected", async () => {
+	const owner = await didKey();
+	const ctx = createTestFederation().createContext(new URL("https://example.com/"));
+	const { bodies } = await capture(() => assertRejects(() => ctx.sendActivity([rsaKey, sender(owner)], recipient, new Create({
+		id: new URL(compatibleId(owner.did, "/activities/1").href + "?@gateway=https%3A%2F%2Fgw.example"),
+		actor: new URL("https://example.com/users/alice")
+	})), TypeError, "malformed FEP-ef61 portable ID"));
+	assertEquals(bodies.length, 0);
+});
 //#endregion
 export {};

package/dist/federation/portable-gateway-keys.test.mjs

@@ -7,10 +7,10 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
-import { p as signJsonLd } from "../ld-l0B9nREb.mjs";
-import { s as signRequest } from "../http-CCJ97Jql.mjs";
+import { p as signJsonLd } from "../ld-BYZOoDzZ.mjs";
+import { s as signRequest } from "../http-B2ftY0Ha.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as FederationImpl, o as createFederation, p as handleInbox } from "../middleware-BMgzqBtr.mjs";
+import { m as handleInbox, n as FederationImpl, o as createFederation } from "../middleware-E_0IH72m.mjs";
 import { t as ActivityListenerSet } from "../activity-listener-C-BSbKI7.mjs";
 import { t as KvKeyCache } from "../keycache-BUDHB5rY.mjs";
 import { Create, CryptographicKey, Person } from "@fedify/vocab";
@@ -229,11 +229,11 @@ test("Context.getDocumentLoader() signs requests with gateway keys for portable
 	}
 	assertEquals(keyId, gatewayKeyId.href);
 });
-async function actorDocument(gateways) {
-	const keys = await createTestFederation(() => actorId).createContext(new URL(gateway)).getActorKeyPairs("alice");
+async function actorDocument(gateways, id = actorId, signed = true) {
+	const keys = await createTestFederation(() => id).createContext(new URL(gateway)).getActorKeyPairs("alice");
 	const json = await new Person({
-		id: actorId,
-		inbox: parseIri(`${actorId.href}/inbox`),
+		id,
+		inbox: parseIri(`${id.href}/inbox`),
 		gateways: gateways.map((g) => new URL(g)),
 		publicKey: keys[0].cryptographicKey,
 		assertionMethods: keys.map((k) => k.multikey)
@@ -242,7 +242,7 @@ async function actorDocument(gateways) {
 		contextLoader: mockDocumentLoader
 	});
 	json["@context"] = [...json["@context"], "https://w3id.org/security/data-integrity/v1"];
-	return await sign(json);
+	return signed ? await sign(json) : json;
 }
 function createLoader(responses) {
 	return (url) => {
@@ -255,8 +255,8 @@ function createLoader(responses) {
 		});
 	};
 }
-async function deliver(body, gateways, { kv = new MemoryKvStore(), httpSignature = true } = {}) {
-	const documentLoader = createLoader({ [compatibleActorId(gateway)]: await actorDocument(gateways) });
+async function deliver(body, gateways, { kv = new MemoryKvStore(), httpSignature = true, actor } = {}) {
+	const documentLoader = createLoader({ [compatibleActorId(gateway)]: actor ?? await actorDocument(gateways) });
 	const unsigned = new Request("https://local.example/inbox", {
 		method: "POST",
 		body: JSON.stringify(body),
@@ -357,7 +357,68 @@ test("handleInbox() does not take Linked Data Signatures for portable actors", a
 		status: 401,
 		dispatched: 0
 	});
-	assertEquals(lastResponseText, "Activities of portable actors must have valid Object Integrity Proofs.");
+	assertEquals(lastResponseText, "Failed to verify the request signature.");
+});
+const otherDid = await exportDidKey((await crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"])).publicKey);
+function compatibleCreateJson(id, activityDid = did) {
+	return {
+		"@context": portableContext,
+		id: `${gateway}/.well-known/apgateway/${activityDid}/activities/${id}`,
+		type: "Create",
+		actor: compatibleActorId(gateway),
+		object: "https://example.com/notes/1"
+	};
+}
+test("handleInbox() does not trust compatible-ID actors by web origin", async () => {
+	const id = new URL(compatibleActorId(gateway));
+	for (const signed of [true, false]) {
+		const actor = await actorDocument([gateway], id, signed);
+		assertEquals(await deliver(compatibleCreateJson(`unsigned-${signed}`), [gateway], { actor }), {
+			status: 401,
+			dispatched: 0
+		}, `actor document signed: ${signed}`);
+	}
+	assertEquals(await deliver(await sign(compatibleCreateJson("signed")), [gateway], { actor: await actorDocument([gateway], id) }), {
+		status: 202,
+		dispatched: 1
+	});
+});
+test("handleInbox() requires proofs of compatible-ID actors", async () => {
+	assertEquals(await deliver(compatibleCreateJson("unsigned"), [gateway]), {
+		status: 401,
+		dispatched: 0
+	});
+	assertEquals(await deliver(await sign(compatibleCreateJson("signed")), [gateway]), {
+		status: 202,
+		dispatched: 1
+	});
+	assertEquals(await deliver(await sign(compatibleCreateJson("unsigned-request")), [gateway], { httpSignature: false }), {
+		status: 202,
+		dispatched: 1
+	});
+});
+test("handleInbox() checks the DIDs of compatible activity IDs", async () => {
+	for (const actor of [actorId.href, compatibleActorId(gateway)]) assertEquals(await deliver(await sign({
+		...compatibleCreateJson("forged", otherDid),
+		actor
+	}), [gateway]), {
+		status: 401,
+		dispatched: 0
+	}, actor);
+	assertEquals(await deliver(await sign({
+		...compatibleCreateJson("forged-ap"),
+		id: `ap://${otherDid}/activities/forged-ap`
+	}), [gateway]), {
+		status: 401,
+		dispatched: 0
+	});
+	assertEquals(await deliver(await sign({
+		...compatibleCreateJson("malformed"),
+		id: `https://user@example.com/.well-known/apgateway/${did}/activities/2`
+	}), [gateway]), {
+		status: 401,
+		dispatched: 0
+	});
 });
 //#endregion
 export {};