@fedify/fedify 2.4.0-dev.2077 → 2.4.0-dev.2093

package/dist/federation/portable-inbox.test.mjs

@@ -8,11 +8,11 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { p as signJsonLd } from "../ld-l0B9nREb.mjs";
-import { r as signObject } from "../proof-CVL7JnZd.mjs";
-import { s as signRequest } from "../http-CCJ97Jql.mjs";
+import { p as signJsonLd } from "../ld-BYZOoDzZ.mjs";
+import { i as signObject } from "../proof-DVXC6nYz.mjs";
+import { s as signRequest, u as verifyRequestDetailed } from "../http-B2ftY0Ha.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { c as forwardPortableInboxActivity, l as resolvePortableInboxForwardingOptions, o as createFederation } from "../middleware-BMgzqBtr.mjs";
+import { l as forwardPortableInboxActivity, o as createFederation, u as resolvePortableInboxForwardingOptions } from "../middleware-E_0IH72m.mjs";
 import { Create, Follow, Note, Person, Tombstone } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { exportDidKey, formatIri, parseIri } from "@fedify/vocab-runtime";
@@ -56,7 +56,7 @@ function setup({ gateways = [
 	LOCAL,
 	GATEWAY2,
 	GATEWAY3
-], kv = new MemoryKvStore(), queue, options = {}, actor, listenerError = false, keyPairs = true, onSharedInboxKey } = {}) {
+], kv = new MemoryKvStore(), queue, options = {}, actor, listenerError = false, keyPairs = true, aliceKeyPairs = [], mapPortableActorId, onSharedInboxKey } = {}) {
 	const federation = createFederation({
 		kv,
 		...options.allowPrivateAddress ? {} : {
@@ -83,7 +83,8 @@ function setup({ gateways = [
 	if (keyPairs) actorCallbacks.setKeyPairsDispatcher((_ctx, identifier) => identifier === "ordinary" ? [{
 		privateKey: rsaPrivateKey2,
 		publicKey: rsaPublicKey2.publicKey
-	}] : []);
+	}] : identifier === "alice" ? aliceKeyPairs : []);
+	if (mapPortableActorId != null) actorCallbacks.mapPortableActorId((_ctx, identifier) => mapPortableActorId(identifier));
 	const inboxListeners = federation.setInboxListeners("/users/{identifier}/inbox", "/inbox");
 	if (onSharedInboxKey != null) inboxListeners.setSharedKeyDispatcher(() => {
 		onSharedInboxKey();
@@ -494,6 +495,7 @@ test("forwardPortableInboxActivity() does not wait for slow gateways", async ()
 		const activityId = parseIri(`ap+ef61://${did}/follows/slow`);
 		const parameters = {
 			recipient: {
+				actorId: parseIri(`ap+ef61://${did}/users/alice`),
 				inboxId: parseIri(`ap+ef61://${did}/users/alice/inbox`),
 				canonicalInboxId: `ap://${did}/users/alice/inbox`,
 				gateways: [new URL(LOCAL), new URL(GATEWAY2)]
@@ -520,6 +522,511 @@ test("forwardPortableInboxActivity() does not wait for slow gateways", async ()
 		esm_default.hardReset();
 	}
 });
+function compatibleAlice(path = "/users/alice", { authority = did, origin = LOCAL, gateways = [
+	LOCAL,
+	GATEWAY2,
+	GATEWAY3
+] } = {}) {
+	return {
+		id: new URL(`${origin}/.well-known/apgateway/${authority}${path}`),
+		inbox: new URL(inboxUrl(authority, `${path}/inbox`, origin)),
+		gateways: gateways.map((g) => new URL(g))
+	};
+}
+test("Federation.fetch() delivers to portable inboxes of compatible-ID actors", async (t) => {
+	const apAlice = parseIri(`ap+ef61://${did}/users/alice`);
+	const apInbox = parseIri(`ap+ef61://${did}/users/alice/inbox`);
+	const cases = [
+		[
+			"compatible actor and inbox",
+			compatibleAlice(),
+			""
+		],
+		[
+			"on another gateway",
+			compatibleAlice(void 0, { origin: GATEWAY2 }),
+			""
+		],
+		[
+			"compatible actor and ap: inbox",
+			{
+				...compatibleAlice(),
+				inbox: apInbox
+			},
+			""
+		],
+		[
+			"ap: actor and compatible inbox",
+			{
+				...compatibleAlice(),
+				id: apAlice
+			},
+			""
+		],
+		[
+			"compatible inbox with a query",
+			{
+				...compatibleAlice(),
+				inbox: new URL(inboxUrl() + "?page=1")
+			},
+			"?page=1"
+		]
+	];
+	for (const [name, alice, query] of cases) await t.step(name, async () => {
+		const queue = new RecordingQueue();
+		const { federation, received } = setup({
+			queue,
+			actor: (_ctx, identifier) => identifier === "alice" ? new Person(alice) : null
+		});
+		assertEquals((await federation.fetch(post(inboxUrl(), await signedFollow()), { contextData: void 0 })).status, 202);
+		assertEquals(received.length, 1);
+		assertEquals(received[0].recipient, "alice");
+		assertEquals(queue.outbox.map((m) => m.inbox).sort(), [inboxUrl(did, "/users/alice/inbox", GATEWAY3) + query, inboxUrl(did, "/users/alice/inbox", GATEWAY2) + query]);
+	});
+	const json = await signedFollow();
+	const rejections = [
+		["DID mismatch", new Person(compatibleAlice(void 0, { authority: otherDid }))],
+		["inbox mismatch", new Person({
+			...compatibleAlice(),
+			inbox: new URL(inboxUrl(did, "/users/alice/other-inbox"))
+		})],
+		["this server is not a gateway of the actor", new Person(compatibleAlice(void 0, { gateways: [GATEWAY2] }))],
+		["malformed actor ID", new Person({
+			...compatibleAlice(),
+			id: new URL(compatibleAlice().id.href + "?@gateway=https%3A%2F%2Fexample.com")
+		})],
+		["malformed inbox ID", new Person({
+			...compatibleAlice(),
+			inbox: new URL(inboxUrl() + "?@gateway=https%3A%2F%2Fexample.com")
+		})]
+	];
+	for (const [name, actor] of rejections) await t.step(name, async () => {
+		const { federation, received } = setup({ actor: (_ctx, identifier) => identifier === "alice" ? actor : null });
+		assertEquals((await federation.fetch(post(inboxUrl(), json), { contextData: void 0 })).status, 404);
+		assertEquals(received.length, 0);
+	});
+});
+test("forwardPortableInboxActivity() deduplicates compatible activity IDs", async () => {
+	const kv = new MemoryKvStore();
+	const queue = new RecordingQueue();
+	const forward = (activityId) => forwardPortableInboxActivity({
+		recipient: {
+			actorId: compatibleAlice().id,
+			inboxId: parseIri(`ap+ef61://${did}/users/alice/inbox`),
+			canonicalInboxId: `ap+ef61://${did}/users/alice/inbox`,
+			gateways: [new URL(LOCAL), new URL(GATEWAY2)]
+		},
+		activity: { id: activityId.href },
+		activityId,
+		activityType: "https://www.w3.org/ns/activitystreams#Follow",
+		excludedOrigins: [LOCAL],
+		baseUrl: LOCAL,
+		kv,
+		kvPrefix: ["_fedify", "portableInboxForwarding"],
+		outboxQueue: queue
+	});
+	const path = `${did}/follows/compatible`;
+	assertEquals((await forward(new URL(`${LOCAL}/.well-known/apgateway/${path}`))).length, 1);
+	for (const id of [
+		new URL(`${GATEWAY2}/.well-known/apgateway/${path}`),
+		new URL(`${LOCAL}/.well-known/apgateway/${path}?x=1`),
+		parseIri(`ap://${path}`)
+	]) assertEquals(await forward(id), [], id.href);
+	assertEquals(queue.outbox.length, 1);
+});
+const aliceId = parseIri(`ap+ef61://${did}/users/alice`);
+const rsaGatewayKeyPair = await crypto.subtle.generateKey({
+	name: "RSASSA-PKCS1-v1_5",
+	modulusLength: 2048,
+	publicExponent: new Uint8Array([
+		1,
+		0,
+		1
+	]),
+	hash: "SHA-256"
+}, true, ["sign", "verify"]);
+function compatibleAliceId(origin = LOCAL) {
+	return `${origin}/.well-known/apgateway/${did}/users/alice`;
+}
+function mapAlice(identifier) {
+	return identifier === "alice" ? aliceId : null;
+}
+function signatureKeyId(headers) {
+	return headers.get("Signature-Input")?.match(/keyid="([^"]+)"/)?.[1] ?? headers.get("Signature")?.match(/keyId="([^"]+)"/)?.[1];
+}
+/**
+* Makes a document loader that serves Alice's actor document as the gateway
+* at {@link LOCAL} does: signed by her DID, and embedding the gateway keys in
+* its `assertionMethod`.
+*/
+async function createGatewayLoader(keyPairs) {
+	const { federation } = setup({
+		aliceKeyPairs: keyPairs,
+		mapPortableActorId: mapAlice
+	});
+	const keys = await federation.createContext(new URL(LOCAL)).getActorKeyPairs("alice");
+	const document = await (await signObject(new Person({
+		id: aliceId,
+		inbox: parseIri(`${aliceId.href}/inbox`),
+		gateways: [
+			new URL(LOCAL),
+			new URL(GATEWAY2),
+			new URL(GATEWAY3)
+		],
+		assertionMethods: keys.map((k) => k.multikey)
+	}), ed25519PrivateKey, keyId, { contextLoader: mockDocumentLoader })).toJsonLd({ contextLoader: mockDocumentLoader });
+	return (url) => {
+		if (url.replace(/#.*$/, "") !== compatibleAliceId()) return mockDocumentLoader(url);
+		return Promise.resolve({
+			contextUrl: null,
+			documentUrl: url,
+			document: structuredClone(document)
+		});
+	};
+}
+function toRequest({ url, headers, body }) {
+	return new Request(url, {
+		method: "POST",
+		headers,
+		body
+	});
+}
+async function assertSignedBy(request, expectedKeyId, documentLoader) {
+	assertEquals(signatureKeyId(request.headers), expectedKeyId);
+	const result = await verifyRequestDetailed(toRequest(request), {
+		documentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	assert(result.verified, JSON.stringify(result));
+	assertEquals(result.key.id?.href, expectedKeyId);
+}
+/** Records the requests made to the gateways other than {@link LOCAL}. */
+function captureGatewayRequests(respond = () => new Response(null, { status: 202 })) {
+	const requests = [];
+	esm_default.spyGlobal();
+	for (const gateway of [GATEWAY2, GATEWAY3]) esm_default.post(`begin:${gateway}/`, async (callLog) => {
+		const request = callLog.request;
+		const captured = {
+			url: request.url,
+			headers: new Headers(request.headers),
+			body: await request.text()
+		};
+		requests.push(captured);
+		return respond(captured);
+	});
+	return requests;
+}
+test("Federation.fetch() signs forwarded portable inbox deliveries with gateway keys", async (t) => {
+	const keyOrders = [[
+		"RSA key first",
+		[rsaGatewayKeyPair, otherKeyPair],
+		"#main-key"
+	], [
+		"Ed25519 key first",
+		[otherKeyPair, rsaGatewayKeyPair],
+		"#key-2"
+	]];
+	for (const [name, aliceKeyPairs, fragment] of keyOrders) await t.step(name, async () => {
+		const requests = captureGatewayRequests();
+		try {
+			const kv = new MemoryKvStore();
+			const { federation, received } = setup({
+				kv,
+				aliceKeyPairs,
+				mapPortableActorId: mapAlice,
+				options: { allowPrivateAddress: true }
+			});
+			const json = await signedFollow();
+			assertEquals((await federation.fetch(post(inboxUrl(), json), { contextData: void 0 })).status, 202);
+			assertEquals(received.length, 1);
+			assertEquals(requests.map((r) => r.url).sort(), [inboxUrl(did, "/users/alice/inbox", GATEWAY3), inboxUrl(did, "/users/alice/inbox", GATEWAY2)]);
+			const loader = await createGatewayLoader(aliceKeyPairs);
+			for (const request of requests) {
+				await assertSignedBy(request, compatibleAliceId() + fragment, loader);
+				assertEquals(JSON.parse(request.body), json);
+			}
+			assertEquals(await kv.get([
+				"_fedify",
+				"httpMessageSignaturesSpec",
+				GATEWAY2
+			]), "rfc9421");
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+});
+test("Federation.fetch() signs queued forwarded portable inbox deliveries with gateway keys", async () => {
+	const queue = new RecordingQueue();
+	const aliceKeyPairs = [otherKeyPair, rsaGatewayKeyPair];
+	const { federation } = setup({
+		queue,
+		aliceKeyPairs,
+		mapPortableActorId: mapAlice,
+		options: { allowPrivateAddress: true }
+	});
+	assertEquals((await federation.fetch(post(inboxUrl(), await signedFollow()), { contextData: void 0 })).status, 202);
+	assertEquals(queue.outbox.length, 2);
+	const expectedKeyId = `${compatibleAliceId()}#key-2`;
+	for (const message of queue.outbox) {
+		assertEquals(message.keys.map((k) => k.keyId), [expectedKeyId]);
+		assertEquals(message.keys[0].privateKey.kty, "RSA");
+	}
+	const requests = captureGatewayRequests();
+	try {
+		for (const message of queue.outbox) await federation.processQueuedTask(void 0, message);
+	} finally {
+		esm_default.hardReset();
+	}
+	assertEquals(requests.length, 2);
+	const loader = await createGatewayLoader(aliceKeyPairs);
+	for (const request of requests) await assertSignedBy(request, expectedKeyId, loader);
+});
+test("Federation.fetch() forwards portable inbox deliveries unsigned without gateway keys", async (t) => {
+	const otherActorId = parseIri(`ap+ef61://${otherDid}/users/alice`);
+	const cases = [
+		["without a mapper", { aliceKeyPairs: [rsaGatewayKeyPair] }],
+		["the mapper returns null", {
+			aliceKeyPairs: [rsaGatewayKeyPair],
+			mapPortableActorId: () => null
+		}],
+		["the mapper returns another actor", {
+			aliceKeyPairs: [rsaGatewayKeyPair],
+			mapPortableActorId: () => otherActorId
+		}],
+		["the mapper returns another actor of the same DID", {
+			aliceKeyPairs: [rsaGatewayKeyPair],
+			mapPortableActorId: () => parseIri(`ap+ef61://${did}/users/bob`)
+		}],
+		["without a key pairs dispatcher", {
+			keyPairs: false,
+			mapPortableActorId: mapAlice
+		}],
+		["without key pairs", { mapPortableActorId: mapAlice }],
+		["without an RSA key", {
+			aliceKeyPairs: [otherKeyPair],
+			mapPortableActorId: mapAlice
+		}]
+	];
+	for (const [name, options] of cases) await t.step(name, async () => {
+		const queue = new RecordingQueue();
+		const { federation, received } = setup({
+			...options,
+			queue
+		});
+		assertEquals((await federation.fetch(post(inboxUrl(), await signedFollow()), { contextData: void 0 })).status, 202);
+		assertEquals(received.length, 1);
+		assertEquals(queue.outbox.length, 2);
+		for (const message of queue.outbox) assertEquals(message.keys, []);
+	});
+});
+test("Federation.fetch() signs forwarded portable inbox deliveries if the mapper returns an equivalent ID", async (t) => {
+	const ids = [
+		["ap: URI", parseIri(`ap://${did}/users/alice`)],
+		["percent-encoded DID", parseIri(`ap+ef61://${did.replaceAll(":", "%3A")}/users/alice`)],
+		["compatible identifier", new URL(compatibleAliceId(GATEWAY2))]
+	];
+	for (const [name, id] of ids) await t.step(name, async () => {
+		const queue = new RecordingQueue();
+		const { federation } = setup({
+			queue,
+			aliceKeyPairs: [rsaGatewayKeyPair],
+			mapPortableActorId: (identifier) => identifier === "alice" ? id : null
+		});
+		assertEquals((await federation.fetch(post(inboxUrl(), await signedFollow()), { contextData: void 0 })).status, 202);
+		assertEquals(queue.outbox.length, 2);
+		for (const message of queue.outbox) assertEquals(message.keys.map((k) => k.keyId), [`${compatibleAliceId()}#main-key`]);
+	});
+});
+test("Federation.fetch() signs forwarded portable inbox deliveries with the gateway keys of the canonical origin", async () => {
+	const queue = new RecordingQueue();
+	const { federation } = setup({
+		queue,
+		gateways: [
+			GATEWAY2,
+			LOCAL,
+			GATEWAY3
+		],
+		aliceKeyPairs: [rsaGatewayKeyPair],
+		mapPortableActorId: mapAlice,
+		options: { origin: GATEWAY2 }
+	});
+	assertEquals((await federation.fetch(post(inboxUrl(), await signedFollow()), { contextData: void 0 })).status, 202);
+	assertEquals(queue.outbox.length, 1);
+	assertEquals(queue.outbox[0].keys.map((k) => k.keyId), [`${compatibleAliceId(GATEWAY2)}#main-key`]);
+});
+test("Federation.fetch() double-knocks forwarded portable inbox deliveries", async (t) => {
+	await t.step("firstKnock", async () => {
+		const requests = captureGatewayRequests();
+		try {
+			const { federation } = setup({
+				aliceKeyPairs: [rsaGatewayKeyPair],
+				mapPortableActorId: mapAlice,
+				options: {
+					allowPrivateAddress: true,
+					firstKnock: "draft-cavage-http-signatures-12"
+				}
+			});
+			assertEquals((await federation.fetch(post(inboxUrl(), await signedFollow()), { contextData: void 0 })).status, 202);
+			assertEquals(requests.length, 2);
+			for (const request of requests) {
+				assert(request.headers.has("Signature"));
+				assertFalse(request.headers.has("Signature-Input"));
+			}
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	await t.step("falls back to the other spec", async () => {
+		const requests = captureGatewayRequests((request) => new Response(null, { status: request.headers.has("Signature-Input") ? 401 : 202 }));
+		try {
+			const kv = new MemoryKvStore();
+			const { federation } = setup({
+				kv,
+				aliceKeyPairs: [rsaGatewayKeyPair],
+				mapPortableActorId: mapAlice,
+				options: { allowPrivateAddress: true }
+			});
+			assertEquals((await federation.fetch(post(inboxUrl(), await signedFollow()), { contextData: void 0 })).status, 202);
+			assertEquals(requests.length, 4);
+			const loader = await createGatewayLoader([rsaGatewayKeyPair]);
+			for (const request of requests) {
+				if (request.headers.has("Signature-Input")) continue;
+				await assertSignedBy(request, `${compatibleAliceId()}#main-key`, loader);
+			}
+			assertEquals(await kv.get([
+				"_fedify",
+				"httpMessageSignaturesSpec",
+				GATEWAY2
+			]), "draft-cavage-http-signatures-12");
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+});
+test("A Fedify gateway accepts signed forwarded portable inbox deliveries", async () => {
+	const requests = captureGatewayRequests();
+	let forwarded;
+	try {
+		const { federation } = setup({
+			aliceKeyPairs: [rsaGatewayKeyPair],
+			mapPortableActorId: mapAlice,
+			options: { allowPrivateAddress: true }
+		});
+		assertEquals((await federation.fetch(post(inboxUrl(), await signedFollow()), { contextData: void 0 })).status, 202);
+		forwarded = requests.find((r) => r.url.startsWith(`${GATEWAY2}/`));
+	} finally {
+		esm_default.hardReset();
+	}
+	await assertSignedBy(forwarded, `${compatibleAliceId()}#main-key`, await createGatewayLoader([rsaGatewayKeyPair]));
+	const queue = new RecordingQueue();
+	const { federation, received } = setup({
+		queue,
+		options: { origin: GATEWAY2 }
+	});
+	assertEquals((await federation.fetch(toRequest(forwarded), { contextData: void 0 })).status, 202);
+	assertEquals(received.length, 1);
+	assertEquals(received[0].recipient, "alice");
+	assertEquals(queue.outbox.map((m) => m.inbox).sort(), [inboxUrl(did, "/users/alice/inbox", LOCAL), inboxUrl(did, "/users/alice/inbox", GATEWAY3)]);
+});
+function forwardingParameters(overrides = {}) {
+	const activityId = parseIri(`ap+ef61://${did}/follows/${++activityCounter}`);
+	return {
+		recipient: {
+			actorId: aliceId,
+			inboxId: parseIri(`ap+ef61://${did}/users/alice/inbox`),
+			canonicalInboxId: `ap://${did}/users/alice/inbox`,
+			gateways: [new URL(LOCAL), new URL(GATEWAY2)]
+		},
+		activity: { id: formatIri(activityId) },
+		activityId,
+		activityType: "https://www.w3.org/ns/activitystreams#Follow",
+		excludedOrigins: [LOCAL],
+		baseUrl: LOCAL,
+		kv: new MemoryKvStore(),
+		kvPrefix: ["_fedify", "portableInboxForwarding"],
+		allowPrivateAddress: true,
+		...overrides
+	};
+}
+const gatewayKey = {
+	keyId: new URL(`${compatibleAliceId()}#main-key`),
+	privateKey: rsaGatewayKeyPair.privateKey
+};
+test("forwardPortableInboxActivity() gets keys only when it forwards", async () => {
+	let calls = 0;
+	const parameters = forwardingParameters({
+		outboxQueue: new RecordingQueue(),
+		getKeys: () => {
+			calls++;
+			return Promise.resolve([gatewayKey]);
+		}
+	});
+	assertEquals((await forwardPortableInboxActivity(parameters)).length, 1);
+	assertEquals(calls, 1);
+	assertEquals(await forwardPortableInboxActivity(parameters), []);
+	assertEquals(calls, 1);
+});
+test("forwardPortableInboxActivity() forwards unsigned if it cannot get keys", async (t) => {
+	const nonExtractable = await crypto.subtle.generateKey({
+		name: "RSASSA-PKCS1-v1_5",
+		modulusLength: 2048,
+		publicExponent: new Uint8Array([
+			1,
+			0,
+			1
+		]),
+		hash: "SHA-256"
+	}, false, ["sign", "verify"]);
+	const getKeysCases = [["getKeys() rejects", () => Promise.reject(/* @__PURE__ */ new Error("Unavailable."))], ["the key is not extractable", () => Promise.resolve([{
+		keyId: gatewayKey.keyId,
+		privateKey: nonExtractable.privateKey
+	}])]];
+	for (const [name, getKeys] of getKeysCases) {
+		await t.step(`${name} (queued)`, async () => {
+			const queue = new RecordingQueue();
+			assertEquals((await forwardPortableInboxActivity(forwardingParameters({
+				outboxQueue: queue,
+				getKeys
+			}))).length, 1);
+			assertEquals(queue.outbox.length, 1);
+			assertEquals(queue.outbox[0].keys, []);
+		});
+		await t.step(`${name} (immediate)`, async () => {
+			const requests = captureGatewayRequests();
+			try {
+				assertEquals((await forwardPortableInboxActivity(forwardingParameters({ getKeys }))).length, 1);
+			} finally {
+				esm_default.hardReset();
+			}
+			assertEquals(requests.length, 1);
+			assertEquals(signatureKeyId(requests[0].headers), void 0);
+		});
+	}
+});
+test("forwardPortableInboxActivity() does not wait for slow keys", async () => {
+	let release = () => {};
+	const pending = new Promise((resolve) => release = resolve);
+	const requests = captureGatewayRequests();
+	try {
+		const started = performance.now();
+		const forwarded = await forwardPortableInboxActivity(forwardingParameters({
+			options: resolvePortableInboxForwardingOptions({ deadline: { milliseconds: 10 } }),
+			getKeys: async () => {
+				await pending;
+				throw new Error("Unavailable.");
+			}
+		}));
+		assert(performance.now() - started < 5e3);
+		assertEquals(forwarded.length, 1);
+		assertEquals(requests.length, 0);
+		release();
+		for (let i = 0; i < 100 && requests.length < 1; i++) await new Promise((resolve) => setTimeout(resolve, 10));
+		assertEquals(requests.length, 1);
+		assertEquals(signatureKeyId(requests[0].headers), void 0);
+	} finally {
+		esm_default.hardReset();
+	}
+});
 test("Context.getPortableInboxUri()", async (t) => {
 	const { federation } = setup();
 	await t.step("Context", () => {