@fedify/fedify 2.4.0-dev.2084 → 2.4.0-dev.2093

package/dist/sig/compound-proof-verification.test.mjs

@@ -4,12 +4,14 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { i as verifyMapLocalProof, s as verifyPortableObjectProofPolicy } from "../proof-ozG4HfcQ.mjs";
-import { a as verifyCompoundPortableObjectProofs, o as verifyCompoundProofDocuments } from "../compound-proof-B6Aj2kGY.mjs";
+import { a as verifyMapLocalProof, c as verifyPortableObjectProofPolicy } from "../proof-DVXC6nYz.mjs";
+import { n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, o as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-CTx_lewQ.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
+import { CryptographicKey, Multikey, Person } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";
-import { encodeMultibase } from "@fedify/vocab-runtime";
+import { encodeMultibase, exportDidKey, parseIri } from "@fedify/vocab-runtime";
 import serialize from "json-canon";
 //#region src/sig/compound-proof-verification.test.ts
 const limits = {
@@ -461,5 +463,160 @@ test("verifyCompoundPortableObjectProofs() reports the policy-validated ID", asy
 	assertEquals(result.portableObjects.length, 1);
 	assertEquals(result.portableObjects[0].id, map_local_create_note_default.documents.innerUnsecuredDocument.id);
 });
+const compatibleDid = await exportDidKey(ed25519PublicKey.publicKey);
+const compatibleVerificationMethod = `${compatibleDid}#${compatibleDid.slice(8)}`;
+const compatibleActorId = `https://gw.example/.well-known/apgateway/${compatibleDid}/actor`;
+const compatibleContext = ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"];
+async function signCompatible(document) {
+	return await secureRawDocument(document, await crypto.subtle.exportKey("jwk", ed25519PrivateKey), compatibleVerificationMethod);
+}
+async function compatibleActor(id = compatibleActorId, keyBase = compatibleActorId) {
+	const actorId = parseIri(id);
+	return await new Person({
+		id: actorId,
+		inbox: new URL(`${keyBase}/inbox`),
+		outbox: new URL(`${keyBase}/outbox`),
+		gateways: [new URL("https://gw.example")],
+		publicKey: new CryptographicKey({
+			id: new URL(`${keyBase}#main-key`),
+			owner: actorId,
+			publicKey: rsaPublicKey2.publicKey
+		}),
+		assertionMethods: [new Multikey({
+			id: new URL(`${keyBase}#ed25519-key`),
+			controller: actorId,
+			publicKey: ed25519PublicKey.publicKey
+		})]
+	}).toJsonLd({
+		format: "compact",
+		contextLoader: mockDocumentLoader
+	});
+}
+test("verifyCompoundPortableObjectProofs() treats compatible-ID maps as portable", async () => {
+	const note = {
+		"@context": [...compatibleContext],
+		id: `${compatibleActorId}/notes/1`,
+		type: "Note",
+		attributedTo: compatibleActorId,
+		content: "Hello"
+	};
+	const ordinary = {
+		"@context": [...compatibleContext],
+		id: "https://social.example/activities/1",
+		type: "Announce",
+		actor: "https://social.example/users/bob",
+		object: note
+	};
+	assertEquals(inspectCompoundPortableObjectApplicability(ordinary, limits), "present");
+	assert(containsCompoundPortableObject(ordinary));
+	const result = await verifyCompoundPortableObjectProofs(ordinary, limits, options);
+	assert(result.status === "ok");
+	assertEquals(result.verified, false);
+	assertEquals(result.portableObjects.map((o) => [o.path, o.verified]), [["/object", false]]);
+	const signed = await verifyCompoundPortableObjectProofs({
+		...ordinary,
+		object: await signCompatible(note)
+	}, limits, options);
+	assert(signed.status === "ok");
+	assert(signed.verified);
+});
+test("verifyCompoundPortableObjectProofs() checks compatible activity IDs", async () => {
+	const create = (did) => ({
+		"@context": [...compatibleContext],
+		id: `https://gw.example/.well-known/apgateway/${did}/activities/1`,
+		type: "Create",
+		actor: compatibleActorId,
+		object: "https://social.example/notes/1"
+	});
+	const own = await verifyCompoundPortableObjectProofs(await signCompatible(create(compatibleDid)), limits, options);
+	assert(own.status === "ok");
+	assert(own.verified);
+	const forged = await verifyCompoundPortableObjectProofs(await signCompatible(create("did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK")), limits, options);
+	assert(forged.status === "ok");
+	assertEquals(forged.verified, false);
+	const [object] = forged.portableObjects;
+	assert(!object.verified);
+	assertEquals(object.reason.type, "verificationMethodMismatch");
+});
+test("verifyCompoundPortableObjectProofs() exempts keys embedded in portable actors", async () => {
+	let result = await verifyCompoundPortableObjectProofs(await signCompatible(await compatibleActor()), limits, options);
+	assert(result.status === "ok");
+	assert(result.verified);
+	assertEquals(result.portableObjects.map((o) => o.path), [""]);
+	result = await verifyCompoundPortableObjectProofs(await signCompatible(await compatibleActor(`ap://${compatibleDid}/actor`)), limits, options);
+	assert(result.status === "ok");
+	assert(result.verified);
+	result = await verifyCompoundPortableObjectProofs({
+		"@context": [...compatibleContext],
+		id: "https://social.example/activities/2",
+		type: "Update",
+		actor: "https://social.example/users/bob",
+		object: await signCompatible(await compatibleActor())
+	}, limits, options);
+	assert(result.status === "ok");
+	assert(result.verified);
+});
+test("verifyCompoundPortableObjectProofs() exempts only keys of the parent itself", async () => {
+	const actor = await compatibleActor();
+	const otherActorId = "https://gw.example/.well-known/apgateway/did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK/actor";
+	const publicKey = actor.publicKey;
+	const cases = {
+		"a key of another actor": {
+			...actor,
+			publicKey: {
+				...publicKey,
+				id: `${otherActorId}#main-key`,
+				owner: otherActorId
+			}
+		},
+		"a key owned by another actor": {
+			...actor,
+			publicKey: {
+				...publicKey,
+				owner: otherActorId
+			}
+		},
+		"a non-key object": {
+			...actor,
+			publicKey: {
+				id: `${compatibleActorId}#note`,
+				type: "Note",
+				content: "Not a key"
+			}
+		},
+		"a key with extra content": {
+			...actor,
+			publicKey: {
+				...publicKey,
+				name: "Extra"
+			}
+		},
+		"a key under another property": {
+			...actor,
+			attachment: structuredClone(publicKey)
+		},
+		"a parent context with a keyword alias": {
+			...actor,
+			"@context": [...actor["@context"], { kind: "@type" }]
+		},
+		"a key with a scoped context": {
+			...actor,
+			publicKey: {
+				...publicKey,
+				"@context": { CryptographicKey: {
+					"@id": "https://w3id.org/security#Key",
+					"@context": {}
+				} }
+			}
+		}
+	};
+	for (const [name, document] of Object.entries(cases)) {
+		const result = await verifyCompoundPortableObjectProofs(await signCompatible(document), limits, options);
+		assert(result.status === "ok", name);
+		assertEquals(result.verified, false, name);
+		assert(result.portableObjects.find((o) => o.path === "")?.verified, name);
+		assert(result.portableObjects.some((o) => o.path !== "" && !o.verified), name);
+	}
+});
 //#endregion
 export {};

package/dist/sig/compound-proof.test.mjs

@@ -6,9 +6,9 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { n as preloadedOnlyDocumentLoader } from "../public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { l as verifyProof, r as signObject } from "../proof-ozG4HfcQ.mjs";
+import { i as signObject, u as verifyProof } from "../proof-DVXC6nYz.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { o as verifyCompoundProofDocuments } from "../compound-proof-B6Aj2kGY.mjs";
+import { o as verifyCompoundProofDocuments } from "../compound-proof-CTx_lewQ.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { Create, DataIntegrityProof, Note, Question } from "@fedify/vocab";

package/dist/sig/http.test.mjs

@@ -11,8 +11,8 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { t as exportJwk } from "../key-BJrp524f.mjs";
-import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase, u as verifyRequestDetailed } from "../http-B0VRNipE.mjs";
+import { t as exportJwk } from "../key-Dwm4VswT.mjs";
+import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase, u as verifyRequestDetailed } from "../http-B2ftY0Ha.mjs";
 import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, exportSpki } from "@fedify/vocab-runtime";

package/dist/sig/key.test.mjs

@@ -6,7 +6,7 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as generateCryptoKeyPair, i as fetchKeyDetailed, o as importJwk, r as fetchKey, s as validateCryptoKey, t as exportJwk } from "../key-BJrp524f.mjs";
+import { a as generateCryptoKeyPair, i as fetchKeyDetailed, o as importJwk, r as fetchKey, s as validateCryptoKey, t as exportJwk } from "../key-Dwm4VswT.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/ld.test.mjs

@@ -8,8 +8,8 @@ import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as generateCryptoKeyPair } from "../key-BJrp524f.mjs";
-import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-BmFz5NLA.mjs";
+import { a as generateCryptoKeyPair } from "../key-Dwm4VswT.mjs";
+import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-BYZOoDzZ.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/mod.cjs

@@ -1,8 +1,8 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_http = require("../http-B5q1CHtL.cjs");
-const require_owner = require("../owner-BQFZtFV4.cjs");
-const require_sig = require("../sig-k3C8sF7g.cjs");
+const require_http = require("../http-DSaSAN7X.cjs");
+const require_owner = require("../owner-szIZl4qI.cjs");
+const require_sig = require("../sig-CXOKN4Br.cjs");
 exports.attachSignature = require_http.attachSignature;
 exports.createProof = require_http.createProof;
 exports.createSignature = require_http.createSignature;

package/dist/sig/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
 import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-xlG-jRdB.cjs";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-BF0L9cMt.cjs";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-HDSvS-ww.cjs";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-C8LieBzF.cjs";
 export { AcceptSignatureMember, AcceptSignatureParameters, CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
 import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-n2v6DPxu.js";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-BSzr5-I8.js";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-C9WSpZWm.js";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-Coacostr.js";
 export { AcceptSignatureMember, AcceptSignatureParameters, CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/mod.js

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { A as verifySignature, D as signJsonLd, F as fetchKeyDetailed, I as generateCryptoKeyPair, L as importJwk, M as exportJwk, P as fetchKey, a as verifyRequestDetailed, b as createSignature, c as hasProofLike, d as verifyObject, dt as fulfillAcceptSignature, f as verifyPortableObjectProof, ft as parseAcceptSignature, h as verifyProof, i as verifyRequest, k as verifyJsonLd, l as signObject, pt as validateAcceptSignature, r as signRequest, s as createProof, ut as formatAcceptSignature, v as attachSignature, w as hasSignatureLike, x as detachSignature } from "../http-4PCCvhsU.js";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-_pbbgLJK.js";
-import { t as verifyPortableObject } from "../sig-DhdomAN0.js";
+import { C as detachSignature, E as hasSignatureLike, I as fetchKey, L as fetchKeyDetailed, M as verifySignature, P as exportJwk, R as generateCryptoKeyPair, S as createSignature, a as verifyRequestDetailed, b as attachSignature, c as createProof, ct as parseAcceptSignature, f as verifyObject, g as verifyProof, i as verifyRequest, j as verifyJsonLd, k as signJsonLd, l as hasProofLike, lt as validateAcceptSignature, ot as formatAcceptSignature, p as verifyPortableObjectProof, r as signRequest, st as fulfillAcceptSignature, u as signObject, z as importJwk } from "../http-DyT7DP1Y.js";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-DAGSC5gX.js";
+import { t as verifyPortableObject } from "../sig-B5Ell7pO.js";
 export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/owner.test.mjs

@@ -6,7 +6,7 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-CsKVgMzk.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-Cgx2Dc7I.mjs";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 //#region src/sig/owner.test.ts

package/dist/sig/portable-collection.test.mjs

@@ -1,17 +1,17 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "../deno-Dn-py9Zy.mjs";
-import { c as verifyPortableObjectProofWithRoot, o as verifyPortableObjectProof } from "../proof-ozG4HfcQ.mjs";
+import { n as version, t as name } from "../deno-8t8k_6Yv.mjs";
+import { l as verifyPortableObjectProofWithRoot, s as verifyPortableObjectProof } from "../proof-DVXC6nYz.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Collection, CollectionPage, Note, Object as Object$1, OrderedCollection, Person, isActor, traverseCollection } from "@fedify/vocab";
 import { trace } from "@opentelemetry/api";
 import { test } from "@fedify/fixture";
 import { FetchError, canonicalizePortableUri, encodeMultibase, exportDidKey, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, parseIri, preloadedContexts } from "@fedify/vocab-runtime";
+import { dereferencePortableIri, getPortableGatewayCandidates } from "@fedify/vocab-runtime/internal/portable-dereference";
 import serialize from "json-canon";
 import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
-import { dereferencePortableIri, getPortableGatewayCandidates } from "@fedify/vocab-runtime/internal/portable-dereference";
 //#region src/sig/portable-collection.ts
 const logger = getLogger([
 	"fedify",
@@ -54,6 +54,8 @@ function getContextState(context) {
 }
 function canonicalize(id) {
 	try {
+		const portable = fromCompatibleEf61Id(id);
+		if (portable != null) return canonicalizePortableUri(formatIri(portable));
 		return canonicalizePortableUri(typeof id === "string" ? id : formatIri(id));
 	} catch (error) {
 		if (error instanceof TypeError) return null;
@@ -234,7 +236,20 @@ async function fetchOwner(candidate, options) {
 	const contextLoader = options.contextLoader ?? getDocumentLoader();
 	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
-	const gateways = options.gateways ?? (getPortableGatewayCandidates(candidate).length > 0 ? void 0 : options.gatewayHints);
+	let inferredGateways;
+	try {
+		const portable = fromCompatibleEf61Id(candidate);
+		if (portable != null) {
+			inferredGateways = [new URL(candidate.origin)];
+			candidate = portable;
+		}
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.debug("The owner {owner} of a portable collection is a malformed compatible identifier.", { owner: candidate.href });
+		return null;
+	}
+	const gateways = options.gateways ?? (inferredGateways != null || getPortableGatewayCandidates(candidate).length > 0 ? void 0 : options.gatewayHints);
+	if (options.gateways != null) inferredGateways = void 0;
 	const span = tracer.startSpan("activitypub.lookup_object");
 	try {
 		const object = await dereferencePortableIri(candidate, {
@@ -242,6 +257,7 @@ async function fetchOwner(candidate, options) {
 			contextLoader,
 			tracerProvider,
 			gateways,
+			...inferredGateways == null ? {} : { inferredGateways },
 			verifyPortableObject: (document, verifierOptions) => verifyPortableObjectProof(document, {
 				...options,
 				...verifierOptions
@@ -569,13 +585,61 @@ test("verifyPortableObject() uses the actual fetch source", async () => {
 		referrer,
 		documentUrl: new URL(`https://user@gw1.example/.well-known/apgateway/${did}/actor/outbox`)
 	}), "unknownCollectionSource");
-	assertFailure(await verify(outbox({ id: gatewayUrl(evil, outboxId) }), {
+	const result = await verify(outbox({ id: gatewayUrl(evil, outboxId) }), {
+		documentLoader,
+		gateways,
+		referrer,
+		documentUrl: new URL(gatewayUrl(gw1, outboxId))
+	});
+	ok(result.verified);
+	strictEqual(result.method, "gateway");
+	if (result.method !== "gateway") return;
+	deepStrictEqual(result.gateway, new URL(gw1));
+	assertFailure(await verify(outbox({ id: `${evil}/outbox` }), {
 		documentLoader,
 		gateways,
 		referrer,
 		documentUrl: new URL(gatewayUrl(gw1, outboxId))
 	}), "notPortableObject");
 });
+test("verifyPortableObject() trusts unsecured collections of compatible-ID actors", async () => {
+	const compatibleActorId = gatewayUrl(gw1, actorId);
+	const compatibleOutboxId = gatewayUrl(gw1, outboxId);
+	const signed = await sign(actor({
+		id: compatibleActorId,
+		inbox: gatewayUrl(gw1, `ap://${did}/actor/inbox`),
+		outbox: compatibleOutboxId,
+		followers: gatewayUrl(gw1, `ap://${did}/actor/followers`)
+	}));
+	const collection = outbox({
+		id: compatibleOutboxId,
+		attributedTo: compatibleActorId
+	});
+	const documentLoader = createLoader({ [compatibleActorId]: signed });
+	const result = await verify(collection, {
+		documentLoader,
+		documentUrl: new URL(compatibleOutboxId)
+	});
+	ok(result.verified, JSON.stringify(result));
+	strictEqual(result.method, "gateway");
+	if (result.method !== "gateway") return;
+	deepStrictEqual(result.gateway, new URL(gw1));
+	deepStrictEqual(documentLoader.fetched, [compatibleActorId]);
+	const noGateways = createLoader({ [compatibleActorId]: signed });
+	assertFailure(await verify(collection, {
+		documentLoader: noGateways,
+		documentUrl: new URL(compatibleOutboxId),
+		gateways: []
+	}), "collectionOwnerUnavailable");
+	deepStrictEqual(noGateways.fetched.filter((url) => url === compatibleActorId), []);
+	assertFailure(await verify(collection, {
+		documentLoader: createLoader({ [compatibleActorId]: actor({
+			id: compatibleActorId,
+			outbox: compatibleOutboxId
+		}) }),
+		documentUrl: new URL(compatibleOutboxId)
+	}), "collectionOwnerUnavailable");
+});
 test("verifyPortableObject() requires an unambiguous owner", async () => {
 	const base = {
 		documentLoader: createLoader({ [gatewayUrl(gw1, actorId)]: signedActor }),

package/dist/sig/portable-key.test.mjs

@@ -1,13 +1,13 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { r as fetchKey } from "../key-BJrp524f.mjs";
-import { l as verifyRequest, s as signRequest } from "../http-B0VRNipE.mjs";
+import { r as fetchKey } from "../key-Dwm4VswT.mjs";
+import { l as verifyRequest, s as signRequest } from "../http-B2ftY0Ha.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-CsKVgMzk.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-Cgx2Dc7I.mjs";
 import { Create, CryptographicKey, Multikey, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
-import { FetchError, encodeMultibase, exportDidKey, parseIri, preloadedContexts } from "@fedify/vocab-runtime";
+import { FetchError, encodeMultibase, exportDidKey, exportSpki, parseIri, preloadedContexts } from "@fedify/vocab-runtime";
 import serialize from "json-canon";
 import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
 //#region src/sig/portable-key.test.ts
@@ -129,7 +129,16 @@ test("verifyRequest() rejects gateway keys that portable actors do not vouch for
 		"an unsigned actor document": unsigned,
 		"an actor document signed by another DID": await sign(unsigned, otherKeyPair.privateKey, `${otherDid}#${otherDid.slice(8)}`),
 		"an unlisted gateway": await sign(await actorJson({ gateways: [gw2] })),
-		"a key missing from assertionMethod": await sign(await actorJson({ assertionMethod: false })),
+		"a key missing from both assertionMethod and publicKey": await sign(await actorJson({
+			assertionMethod: false,
+			publicKey: null
+		})),
+		"a key referred to by URL in assertionMethod, embedded in publicKey": await sign({
+			...await actorJson({ assertionMethod: false }),
+			assertionMethod: [keyId.href]
+		}),
+		"a key only in publicKey without an owner": await sign(withoutPublicKeyOwner(await actorJson({ assertionMethod: false }))),
+		"two keys with the same ID in publicKey": await sign(await duplicatePublicKey(await actorJson({ assertionMethod: false }))),
 		"a key referred to by URL": await sign({
 			...await actorJson({
 				publicKey: null,
@@ -154,18 +163,175 @@ test("verifyRequest() rejects gateway keys that portable actors do not vouch for
 		contextLoader
 	}), null);
 });
-test("verifyRequest() keeps web-origin trust for compatible-ID actors", async () => {
-	const id = compatibleId(gw1);
-	const documentLoader = createLoader({ [id]: await actorJson({
-		id,
-		gateways: [gw1]
+function withoutPublicKeyOwner(json) {
+	const { owner: _, ...publicKey } = json.publicKey;
+	return {
+		...json,
+		publicKey
+	};
+}
+async function duplicatePublicKey(json) {
+	const publicKey = json.publicKey;
+	return {
+		...json,
+		publicKey: [publicKey, {
+			...publicKey,
+			publicKeyPem: await exportSpki(rsaPublicKey3.publicKey)
+		}]
+	};
+}
+test("verifyRequest() accepts gateway keys referred to by URL in publicKey", async () => {
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign({
+		...await actorJson({ publicKey: null }),
+		publicKey: keyId.href
 	}) });
+	strictEqual((await verifyRequest(await signedRequest(), {
+		documentLoader,
+		contextLoader
+	}))?.id?.href, keyId.href);
+});
+test("verifyRequest() accepts gateway keys only in publicKey", async () => {
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await actorJson({ assertionMethod: false })) });
 	const key = await verifyRequest(await signedRequest(), {
 		documentLoader,
 		contextLoader
 	});
 	strictEqual(key?.id?.href, keyId.href);
+	strictEqual(key?.ownerId?.href, parseIri(actorId).href);
+});
+test("verifyRequest() resolves gateway keys of compatible-ID actors", async () => {
+	const id = compatibleId(gw1);
+	const signed = await sign(await actorJson({
+		id,
+		gateways: [gw1]
+	}));
+	let key = await verifyRequest(await signedRequest(), {
+		documentLoader: createLoader({ [id]: signed }),
+		contextLoader
+	});
+	strictEqual(key?.id?.href, keyId.href);
 	strictEqual(key?.ownerId?.href, id);
+	key = await verifyRequest(await signedRequest(), {
+		documentLoader: createLoader({ [id]: await sign(await actorJson({
+			id,
+			gateways: [gw1],
+			assertionMethod: false
+		})) }),
+		contextLoader
+	});
+	strictEqual(key?.id?.href, keyId.href);
+	const evil = "https://evil.example";
+	const evilId = compatibleId(evil);
+	const evilKeyId = new URL(`${evilId}#main-key`);
+	const unsigned = await actorJson({
+		id: evilId,
+		gateways: [evil],
+		key: evilKeyId
+	});
+	const documentLoader = createLoader({ [evilId]: unsigned });
+	strictEqual(await verifyRequest(await signedRequest(void 0, evilKeyId), {
+		documentLoader,
+		contextLoader
+	}), null);
+	strictEqual(await getKeyOwner(evilKeyId, {
+		documentLoader,
+		contextLoader
+	}), null);
+	strictEqual(await verifyRequest(await signedRequest(), {
+		documentLoader: createLoader({ [id]: await sign(await actorJson({
+			id,
+			gateways: [gw1]
+		}), otherKeyPair.privateKey, `${otherDid}#${otherDid.slice(8)}`) }),
+		contextLoader
+	}), null);
+});
+test("keys at ordinary URLs cannot belong to portable actors", async () => {
+	const evil = "https://evil.example";
+	const evilActorId = compatibleId(evil);
+	const evilKeyId = new URL(`${evil}/keys/1`);
+	const options = {
+		documentLoader: createLoader({
+			[evilKeyId.href]: {
+				"@context": "https://w3id.org/security/v1",
+				id: evilKeyId.href,
+				type: "Key",
+				owner: evilActorId,
+				publicKeyPem: await exportSpki(gatewayPublicKey)
+			},
+			[evilActorId]: await actorJson({
+				id: evilActorId,
+				gateways: [evil],
+				key: evilKeyId,
+				assertionMethod: false
+			})
+		}),
+		contextLoader
+	};
+	strictEqual(await verifyRequest(await signedRequest(void 0, evilKeyId), options), null);
+	strictEqual((await fetchKey(evilKeyId, CryptographicKey, options)).key, null);
+	strictEqual(await getKeyOwner(evilKeyId, options), null);
+	const key = new CryptographicKey({
+		id: evilKeyId,
+		owner: new URL(evilActorId),
+		publicKey: gatewayPublicKey
+	});
+	strictEqual(await getKeyOwner(key, options), null);
+	ok(!await doesActorOwnKey(new Create({
+		id: new URL(`${evil}/activities/1`),
+		actor: new URL(evilActorId)
+	}), key, options));
+	const actorKeyId = new URL(`${evil}/users/alice#main-key`);
+	for (const document of [await actorJson({
+		id: evilActorId,
+		gateways: [evil],
+		key: actorKeyId
+	}), withoutPublicKeyOwner(await actorJson({
+		id: evilActorId,
+		gateways: [evil],
+		key: actorKeyId,
+		assertionMethod: false
+	}))]) {
+		const actorOptions = {
+			documentLoader: createLoader({ [`${evil}/users/alice`]: document }),
+			contextLoader
+		};
+		strictEqual(await verifyRequest(await signedRequest(void 0, actorKeyId), actorOptions), null);
+		strictEqual((await fetchKey(actorKeyId, CryptographicKey, actorOptions)).key, null);
+		strictEqual(await getKeyOwner(actorKeyId, actorOptions), null);
+	}
+	const ownerKeyId = new URL(`${evil}/keys/2`);
+	const ownerOptions = {
+		documentLoader: createLoader({
+			[ownerKeyId.href]: {
+				"@context": "https://w3id.org/security/v1",
+				id: ownerKeyId.href,
+				type: "Key",
+				owner: `${evil}/users/bob`,
+				publicKeyPem: await exportSpki(gatewayPublicKey)
+			},
+			[`${evil}/users/bob`]: await actorJson({
+				id: evilActorId,
+				gateways: [evil],
+				key: ownerKeyId,
+				assertionMethod: false
+			})
+		}),
+		contextLoader
+	};
+	strictEqual(await getKeyOwner(ownerKeyId, ownerOptions), null);
+	strictEqual(await getKeyOwner(new CryptographicKey({
+		id: ownerKeyId,
+		owner: new URL(`${evil}/users/bob`),
+		publicKey: gatewayPublicKey
+	}), ownerOptions), null);
+	const keyCache = {
+		get: () => Promise.resolve(key),
+		set: () => Promise.resolve()
+	};
+	strictEqual((await fetchKey(evilKeyId, CryptographicKey, {
+		...options,
+		keyCache
+	})).key, null);
 });
 test("gateway keys are neither cached nor accepted outside HTTP Signatures", async () => {
 	const calls = [];