@fedify/fedify 2.4.0-dev.2084 → 2.4.0-dev.2093

package/dist/{key-BJrp524f.mjs → key-Dwm4VswT.mjs}

@@ -1,105 +1,13 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-Beod6tzO.mjs";
+import { n as version, t as name } from "./deno-8t8k_6Yv.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-B7YwKTFr.mjs";
+import { a as isCompatibleKeyId, o as isPortableActorDocument, s as isPortableId } from "./portable-key-id-Bva5iT3W.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
-import { FetchError, canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getDocumentLoader, parseDidKeyVerificationMethod, toCompatibleEf61Id } from "@fedify/vocab-runtime";
-//#region src/sig/portable-key-id.ts
-const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
-/**
-* Checks whether the URL is an `ap:` or `ap+ef61:` URI.
-* @internal
-*/
-function isPortableUri(url) {
-	return url.protocol === "ap:" || url.protocol === "ap+ef61:";
-}
-/**
-* Checks whether an activity is performed by an FEP-ef61 portable actor,
-* i.e., any of its actors has an `ap:` or `ap+ef61:` ID.
-* @internal
-*/
-function hasPortableActor(activity) {
-	return activity.actorIds.some(isPortableUri);
-}
-/**
-* Checks whether a key ID looks like an [FEP-ef61] compatible identifier,
-* i.e., an HTTP(S) URL under a gateway's `/.well-known/apgateway/did:` path.
-* Such a key ID names a key that a gateway holds for a portable actor, so it
-* is resolved only as a gateway key, and never cached in a key cache.
-*
-* [FEP-ef61]: https://w3id.org/fep/ef61
-* @internal
-*/
-function isCompatibleKeyId(keyId) {
-	return (keyId.protocol === "http:" || keyId.protocol === "https:") && COMPATIBLE_KEY_ID_PATH_PATTERN.test(keyId.pathname);
-}
-/**
-* Gets the canonical portable ID of an actor ID that is either an `ap:` or
-* `ap+ef61:` URI or a compatible identifier.
-* @returns The canonical portable ID, or `null` if the ID is neither, or is
-*          malformed.
-* @internal
-*/
-function getCanonicalPortableId(id) {
-	try {
-		if (isPortableUri(id)) return canonicalizePortableUri(formatIri(id));
-		const portable = fromCompatibleEf61Id(id);
-		if (portable == null) return null;
-		return canonicalizePortableUri(formatIri(portable));
-	} catch (error) {
-		if (error instanceof TypeError) return null;
-		throw error;
-	}
-}
-/**
-* Builds the base of the key IDs of a gateway's keys for a portable actor:
-* the actor's compatible identifier on the gateway.
-* @param actorId The portable actor's ID, either an `ap:` or `ap+ef61:` URI
-*                or a compatible identifier.  It must not have a fragment.
-* @param gateway The gateway's origin, e.g., `https://example.com`.
-* @returns The compatible identifier without query and fragment.
-* @throws {TypeError} If the actor ID is not a portable ID, or has
-*                     a fragment.
-* @internal
-*/
-function getGatewayKeyBase(actorId, gateway) {
-	let portable;
-	if (isPortableUri(actorId)) portable = actorId;
-	else try {
-		portable = fromCompatibleEf61Id(actorId);
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		portable = null;
-	}
-	if (portable == null) throw new TypeError(`The portable actor ID ${actorId.href} must be an ap: or ap+ef61: URI, or an FEP-ef61 compatible identifier.`);
-	if (portable.hash !== "") throw new TypeError(`The portable actor ID ${actorId.href} must not have a fragment.`);
-	const base = toCompatibleEf61Id(portable, gateway);
-	base.search = "";
-	base.hash = "";
-	return base;
-}
-/**
-* Tells whether a parsed document at a compatible key ID is a portable actor,
-* which makes the key a gateway key that only
-* {@link verifyPortableGatewayKeyDocument} can vouch for.
-* @internal
-*/
-function isPortableActorDocument(object) {
-	return isActor(object) && object.id != null && isPortableUri(object.id);
-}
-/**
-* Compares two public keys by their key material.
-* @internal
-*/
-async function isSamePublicKey(a, b) {
-	if (a.algorithm.name !== b.algorithm.name) return false;
-	const [x, y] = await Promise.all([crypto.subtle.exportKey("jwk", a), crypto.subtle.exportKey("jwk", b)]);
-	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
-}
-//#endregion
+import { FetchError, getDocumentLoader, parseDidKeyVerificationMethod } from "@fedify/vocab-runtime";
 //#region src/sig/key.ts
 /**
 * Checks if the given key is valid and supported.  No-op if the key is valid,
@@ -200,6 +108,10 @@ async function fetchActorDocument(actorId, options = {}) {
 		"sig",
 		"key"
 	]);
+	if (isPortableId(actorId)) {
+		logger.debug("The actor {actorId} is a portable actor, which is not authenticated by the web origin that serves it.", { actorId: actorId.href });
+		return null;
+	}
 	const documentLoader = options.documentLoader ?? getDocumentLoader();
 	const contextLoader = options.contextLoader ?? getDocumentLoader();
 	const { tracerProvider } = options;
@@ -233,6 +145,13 @@ async function fetchActorDocument(actorId, options = {}) {
 		return null;
 	}
 	if (!isActor(object)) return null;
+	if (object.id != null && isPortableId(object.id)) {
+		logger.debug("The document served at {documentUrl} claims to be the portable actor {actorId}, which is not authenticated by the web origin that serves it.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href
+		});
+		return null;
+	}
 	if (object.id == null || object.id.origin !== documentUrl.origin) {
 		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as that actor's document.", {
 			documentUrl: documentUrl.href,
@@ -567,7 +486,7 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 	let ownerDocument = null;
 	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
 	else if (isActor(object)) {
-		if (object.id == null || object.id.origin !== documentUrl.origin) {
+		if (object.id == null || isPortableId(object.id) || object.id.origin !== documentUrl.origin) {
 			logger.debug("Failed to verify; the document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin.", {
 				keyId,
 				documentUrl: documentUrl.href,
@@ -643,6 +562,18 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 	}
 	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
 	if (!(keyIdBoundByCaller && claimedOwnerId != null && claimedOwnerId.href === stripFragment(cacheKey)?.href)) {
+		if (claimedOwnerId != null && isPortableId(claimedOwnerId)) {
+			logger.debug("Failed to verify; key {keyId} claims the portable actor {claimedOwnerId} as its owner, but is not its gateway key.", {
+				keyId,
+				claimedOwnerId: claimedOwnerId.href
+			});
+			await keyCache?.set(cacheKey, null);
+			await clearFetchErrorMetadata(cacheKey, keyCache);
+			return {
+				key: null,
+				cached: false
+			};
+		}
 		if (ownerDocument != null && claimedOwnerId == null) key = key instanceof CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
 		else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
 			if (await verifyKeyOwnership(key, {
@@ -672,6 +603,15 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 		cached: false
 	};
 }
+/**
+* Tells whether a key claims a portable actor as its owner.  Such a key can
+* only be a gateway key, which is never cached, so a cached one was cached
+* by an older version that trusted web origins, and is fetched again.
+*/
+function claimsPortableOwner(key) {
+	const ownerId = key instanceof CryptographicKey ? key.ownerId : key?.controllerId;
+	return ownerId != null && isPortableId(ownerId);
+}
 async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, onFetchError) {
 	const start = performance.now();
 	let outcome = { result: "error" };
@@ -698,7 +638,7 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 			outcome = { result: "hit" };
 			return cachedUnavailable;
 		}
-		if (cached != null) {
+		if (cached != null && !claimsPortableOwner(cached.key)) {
 			outcome = { result: "hit" };
 			return cached;
 		}
@@ -752,4 +692,4 @@ async function fetchKeyInternal(keyId, cls, options = {}) {
 	});
 }
 //#endregion
-export { generateCryptoKeyPair as a, verifyKeyOwnership as c, hasPortableActor as d, isCompatibleKeyId as f, isSamePublicKey as h, fetchKeyDetailed as i, getCanonicalPortableId as l, isPortableUri as m, fetchActorDocument as n, importJwk as o, isPortableActorDocument as p, fetchKey as r, validateCryptoKey as s, exportJwk as t, getGatewayKeyBase as u };
+export { generateCryptoKeyPair as a, verifyKeyOwnership as c, fetchKeyDetailed as i, fetchActorDocument as n, importJwk as o, fetchKey as r, validateCryptoKey as s, exportJwk as t };

package/dist/{kv-cache-Dhhhrryv.cjs → kv-cache-BSJAlP4C.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-B5q1CHtL.cjs");
+const require_http = require("./http-DSaSAN7X.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");

package/dist/{kv-cache-C4C3LyYW.mjs → kv-cache-D0yYukqk.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-Beod6tzO.mjs";
+import { p as recordDocumentCache } from "./metrics-B7YwKTFr.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-1KUmAPH7.js → kv-cache-DmroAz3M.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { R as validateCryptoKey, nt as recordDocumentCache, t as doubleKnock } from "./http-4PCCvhsU.js";
+import { B as validateCryptoKey, Q as recordDocumentCache, t as doubleKnock } from "./http-DyT7DP1Y.js";
 import { getLogger } from "@logtape/logtape";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";

package/dist/{ld-BmFz5NLA.mjs → ld-BYZOoDzZ.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-Beod6tzO.mjs";
-import { r as fetchKey, s as validateCryptoKey } from "./key-BJrp524f.mjs";
+import { n as version, t as name } from "./deno-8t8k_6Yv.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B7YwKTFr.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-Dwm4VswT.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{metrics-Beod6tzO.mjs → metrics-B7YwKTFr.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
+import { n as version, t as name } from "./deno-8t8k_6Yv.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts

package/dist/{middleware-B7CNsyqt.mjs → middleware-BNeqKSsL.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-BKeQYPm0.mjs";
+import { n as FederationImpl } from "./middleware-E_0IH72m.mjs";
 export { FederationImpl };