@fedify/fedify 2.4.0-dev.2084 → 2.4.0-dev.2099

package/dist/{http-B0VRNipE.mjs → http-DsgawTd8.mjs}

@@ -1,11 +1,11 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-Beod6tzO.mjs";
+import { n as version, t as name } from "./deno-dxdvl2XZ.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-BP3vdBpb.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
-import { i as fetchKeyDetailed, s as validateCryptoKey } from "./key-BJrp524f.mjs";
-import { n as verifyPortableGatewayKeyDocument } from "./portable-key-B4R-CiIV.mjs";
+import { i as fetchKeyDetailed, s as validateCryptoKey } from "./key-DYfmjnmp.mjs";
+import { n as verifyPortableGatewayKeyDocument } from "./portable-key-D0mWbV9G.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -13,7 +13,7 @@ import { FetchError } from "@fedify/vocab-runtime";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { encodeHex } from "byte-encodings/hex";
-import { Item, decodeDict, encodeItem } from "structured-field-values";
+import { Item, decodeDict, encodeDict, encodeItem } from "structured-field-values";
 //#region src/sig/http.ts
 const DEFAULT_MAX_REDIRECTION = 20;
 const DOUBLE_KNOCK_TRANSPORT_RETRY_DELAY_MS = 100;
@@ -202,6 +202,81 @@ function parseRfc9421Signature(signature) {
 	for (const [key, value] of Object.entries(dict)) if (value.value instanceof Uint8Array) result[key] = value.value;
 	return result;
 }
+/**
+* Parses the `Signature` header of draft-cavage HTTP Signatures into its
+* fields, e.g., `keyId` and `headers`.
+*/
+function parseDraftSignature(signature) {
+	return Object.fromEntries(signature.split(",").map((pair) => pair.match(/^\s*([A-Za-z]+)=(?:"([^"]*)"|(\d+))\s*$/)).filter((m) => m != null).map((m) => [m[1], m[2] ?? m[3]]));
+}
+/**
+* Lists the HTTP Signatures that a request claims to carry, without verifying
+* any of them.  Signatures whose key IDs are not URLs are left out.
+* @param request The request.
+* @returns The signatures; RFC 9421 ones if the request has
+*          a `Signature-Input` header, or a draft-cavage one otherwise.
+* @internal
+*/
+function listRequestSignatures(request) {
+	const signatureInput = request.headers.get("Signature-Input");
+	if (signatureInput != null) {
+		const signatures = [];
+		const inputs = parseRfc9421SignatureInput(signatureInput);
+		for (const [label, input] of Object.entries(inputs)) {
+			const keyId = parseKeyId(input.keyId);
+			if (keyId == null) continue;
+			signatures.push({
+				keyId,
+				label,
+				components: input.components
+			});
+		}
+		return signatures;
+	}
+	const signature = request.headers.get("Signature");
+	if (signature == null) return [];
+	const values = parseDraftSignature(signature);
+	const keyId = parseKeyId(values.keyId);
+	if (keyId == null) return [];
+	return [{
+		keyId,
+		label: null,
+		components: (values.headers ?? "").split(/\s+/g).filter((name) => name !== "").map((name) => ({
+			value: name,
+			params: {}
+		}))
+	}];
+}
+/**
+* Makes a copy of a request that carries only one of its RFC 9421 signatures,
+* so that verifying the copy verifies that signature and no other.
+* A draft-cavage signature is the only one in its request, so the request is
+* just copied.
+* @param request The request, whose body must not be consumed.
+* @param signature One of the signatures that {@link listRequestSignatures}
+*                  lists for the request.
+* @returns The copy of the request.
+* @internal
+*/
+function selectRequestSignature(request, signature) {
+	const copy = request.clone();
+	if (signature.label == null) return copy;
+	const { label } = signature;
+	const pick = (header) => {
+		if (header == null) return "";
+		let dict;
+		try {
+			dict = decodeDict(header);
+		} catch {
+			return "";
+		}
+		return Object.hasOwn(dict, label) ? encodeDict({ [label]: dict[label] }) : "";
+	};
+	const headers = new Headers(copy.headers);
+	headers.set("Signature-Input", pick(headers.get("Signature-Input")));
+	headers.set("Signature", pick(headers.get("Signature")));
+	return new Request(copy, { headers });
+}
 async function signRequestRfc9421(request, privateKey, keyId, span, currentTime, bodyBuffer, rfc9421Options) {
 	if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
 	const url = new URL(request.url);
@@ -433,7 +508,7 @@ async function verifyRequestDraft(request, span, metricsContext, { documentLoade
 		logger.debug("Failed to verify; no Signature header found.", { headers: Object.fromEntries(request.headers.entries()) });
 		return noSignatureResult();
 	}
-	const sigValues = Object.fromEntries(sigHeader.split(",").map((pair) => pair.match(/^\s*([A-Za-z]+)=(?:"([^"]*)"|(\d+))\s*$/)).filter((m) => m != null).map((m) => [m[1], m[2] ?? m[3]]));
+	const sigValues = parseDraftSignature(sigHeader);
 	const parsedKeyId = parseKeyId(sigValues.keyId);
 	const dateHeader = request.headers.get("Date");
 	if (dateHeader == null) {
@@ -1106,4 +1181,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { parseRfc9421Signature as a, timingSafeEqual as c, formatRfc9421SignatureParameters as i, verifyRequest as l, doubleKnock as n, parseRfc9421SignatureInput as o, formatRfc9421Signature as r, signRequest as s, createRfc9421SignatureBase as t, verifyRequestDetailed as u };
+export { listRequestSignatures as a, selectRequestSignature as c, verifyRequest as d, verifyRequestDetailed as f, formatRfc9421SignatureParameters as i, signRequest as l, doubleKnock as n, parseRfc9421Signature as o, formatRfc9421Signature as r, parseRfc9421SignatureInput as s, createRfc9421SignatureBase as t, timingSafeEqual as u };

package/dist/{key-BJrp524f.mjs → key-DYfmjnmp.mjs}

@@ -1,105 +1,13 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-Beod6tzO.mjs";
+import { n as version, t as name } from "./deno-dxdvl2XZ.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-BP3vdBpb.mjs";
+import { a as isCompatibleKeyId, o as isPortableActorDocument, s as isPortableId } from "./portable-key-id-Bva5iT3W.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
-import { FetchError, canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getDocumentLoader, parseDidKeyVerificationMethod, toCompatibleEf61Id } from "@fedify/vocab-runtime";
-//#region src/sig/portable-key-id.ts
-const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
-/**
-* Checks whether the URL is an `ap:` or `ap+ef61:` URI.
-* @internal
-*/
-function isPortableUri(url) {
-	return url.protocol === "ap:" || url.protocol === "ap+ef61:";
-}
-/**
-* Checks whether an activity is performed by an FEP-ef61 portable actor,
-* i.e., any of its actors has an `ap:` or `ap+ef61:` ID.
-* @internal
-*/
-function hasPortableActor(activity) {
-	return activity.actorIds.some(isPortableUri);
-}
-/**
-* Checks whether a key ID looks like an [FEP-ef61] compatible identifier,
-* i.e., an HTTP(S) URL under a gateway's `/.well-known/apgateway/did:` path.
-* Such a key ID names a key that a gateway holds for a portable actor, so it
-* is resolved only as a gateway key, and never cached in a key cache.
-*
-* [FEP-ef61]: https://w3id.org/fep/ef61
-* @internal
-*/
-function isCompatibleKeyId(keyId) {
-	return (keyId.protocol === "http:" || keyId.protocol === "https:") && COMPATIBLE_KEY_ID_PATH_PATTERN.test(keyId.pathname);
-}
-/**
-* Gets the canonical portable ID of an actor ID that is either an `ap:` or
-* `ap+ef61:` URI or a compatible identifier.
-* @returns The canonical portable ID, or `null` if the ID is neither, or is
-*          malformed.
-* @internal
-*/
-function getCanonicalPortableId(id) {
-	try {
-		if (isPortableUri(id)) return canonicalizePortableUri(formatIri(id));
-		const portable = fromCompatibleEf61Id(id);
-		if (portable == null) return null;
-		return canonicalizePortableUri(formatIri(portable));
-	} catch (error) {
-		if (error instanceof TypeError) return null;
-		throw error;
-	}
-}
-/**
-* Builds the base of the key IDs of a gateway's keys for a portable actor:
-* the actor's compatible identifier on the gateway.
-* @param actorId The portable actor's ID, either an `ap:` or `ap+ef61:` URI
-*                or a compatible identifier.  It must not have a fragment.
-* @param gateway The gateway's origin, e.g., `https://example.com`.
-* @returns The compatible identifier without query and fragment.
-* @throws {TypeError} If the actor ID is not a portable ID, or has
-*                     a fragment.
-* @internal
-*/
-function getGatewayKeyBase(actorId, gateway) {
-	let portable;
-	if (isPortableUri(actorId)) portable = actorId;
-	else try {
-		portable = fromCompatibleEf61Id(actorId);
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		portable = null;
-	}
-	if (portable == null) throw new TypeError(`The portable actor ID ${actorId.href} must be an ap: or ap+ef61: URI, or an FEP-ef61 compatible identifier.`);
-	if (portable.hash !== "") throw new TypeError(`The portable actor ID ${actorId.href} must not have a fragment.`);
-	const base = toCompatibleEf61Id(portable, gateway);
-	base.search = "";
-	base.hash = "";
-	return base;
-}
-/**
-* Tells whether a parsed document at a compatible key ID is a portable actor,
-* which makes the key a gateway key that only
-* {@link verifyPortableGatewayKeyDocument} can vouch for.
-* @internal
-*/
-function isPortableActorDocument(object) {
-	return isActor(object) && object.id != null && isPortableUri(object.id);
-}
-/**
-* Compares two public keys by their key material.
-* @internal
-*/
-async function isSamePublicKey(a, b) {
-	if (a.algorithm.name !== b.algorithm.name) return false;
-	const [x, y] = await Promise.all([crypto.subtle.exportKey("jwk", a), crypto.subtle.exportKey("jwk", b)]);
-	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
-}
-//#endregion
+import { FetchError, getDocumentLoader, parseDidKeyVerificationMethod } from "@fedify/vocab-runtime";
 //#region src/sig/key.ts
 /**
 * Checks if the given key is valid and supported.  No-op if the key is valid,
@@ -200,6 +108,10 @@ async function fetchActorDocument(actorId, options = {}) {
 		"sig",
 		"key"
 	]);
+	if (isPortableId(actorId)) {
+		logger.debug("The actor {actorId} is a portable actor, which is not authenticated by the web origin that serves it.", { actorId: actorId.href });
+		return null;
+	}
 	const documentLoader = options.documentLoader ?? getDocumentLoader();
 	const contextLoader = options.contextLoader ?? getDocumentLoader();
 	const { tracerProvider } = options;
@@ -233,6 +145,13 @@ async function fetchActorDocument(actorId, options = {}) {
 		return null;
 	}
 	if (!isActor(object)) return null;
+	if (object.id != null && isPortableId(object.id)) {
+		logger.debug("The document served at {documentUrl} claims to be the portable actor {actorId}, which is not authenticated by the web origin that serves it.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href
+		});
+		return null;
+	}
 	if (object.id == null || object.id.origin !== documentUrl.origin) {
 		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as that actor's document.", {
 			documentUrl: documentUrl.href,
@@ -567,7 +486,7 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 	let ownerDocument = null;
 	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
 	else if (isActor(object)) {
-		if (object.id == null || object.id.origin !== documentUrl.origin) {
+		if (object.id == null || isPortableId(object.id) || object.id.origin !== documentUrl.origin) {
 			logger.debug("Failed to verify; the document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin.", {
 				keyId,
 				documentUrl: documentUrl.href,
@@ -643,6 +562,18 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 	}
 	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
 	if (!(keyIdBoundByCaller && claimedOwnerId != null && claimedOwnerId.href === stripFragment(cacheKey)?.href)) {
+		if (claimedOwnerId != null && isPortableId(claimedOwnerId)) {
+			logger.debug("Failed to verify; key {keyId} claims the portable actor {claimedOwnerId} as its owner, but is not its gateway key.", {
+				keyId,
+				claimedOwnerId: claimedOwnerId.href
+			});
+			await keyCache?.set(cacheKey, null);
+			await clearFetchErrorMetadata(cacheKey, keyCache);
+			return {
+				key: null,
+				cached: false
+			};
+		}
 		if (ownerDocument != null && claimedOwnerId == null) key = key instanceof CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
 		else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
 			if (await verifyKeyOwnership(key, {
@@ -672,6 +603,15 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 		cached: false
 	};
 }
+/**
+* Tells whether a key claims a portable actor as its owner.  Such a key can
+* only be a gateway key, which is never cached, so a cached one was cached
+* by an older version that trusted web origins, and is fetched again.
+*/
+function claimsPortableOwner(key) {
+	const ownerId = key instanceof CryptographicKey ? key.ownerId : key?.controllerId;
+	return ownerId != null && isPortableId(ownerId);
+}
 async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, onFetchError) {
 	const start = performance.now();
 	let outcome = { result: "error" };
@@ -698,7 +638,7 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 			outcome = { result: "hit" };
 			return cachedUnavailable;
 		}
-		if (cached != null) {
+		if (cached != null && !claimsPortableOwner(cached.key)) {
 			outcome = { result: "hit" };
 			return cached;
 		}
@@ -752,4 +692,4 @@ async function fetchKeyInternal(keyId, cls, options = {}) {
 	});
 }
 //#endregion
-export { generateCryptoKeyPair as a, verifyKeyOwnership as c, hasPortableActor as d, isCompatibleKeyId as f, isSamePublicKey as h, fetchKeyDetailed as i, getCanonicalPortableId as l, isPortableUri as m, fetchActorDocument as n, importJwk as o, isPortableActorDocument as p, fetchKey as r, validateCryptoKey as s, exportJwk as t, getGatewayKeyBase as u };
+export { generateCryptoKeyPair as a, verifyKeyOwnership as c, fetchKeyDetailed as i, fetchActorDocument as n, importJwk as o, fetchKey as r, validateCryptoKey as s, exportJwk as t };

package/dist/{kv-cache-1KUmAPH7.js → kv-cache-DIxwMeNi.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { R as validateCryptoKey, nt as recordDocumentCache, t as doubleKnock } from "./http-4PCCvhsU.js";
+import { H as validateCryptoKey, et as recordDocumentCache, t as doubleKnock } from "./http-D-rbr_Sy.js";
 import { getLogger } from "@logtape/logtape";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";

package/dist/{kv-cache-Dhhhrryv.cjs → kv-cache-Dvd-Q-E2.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-B5q1CHtL.cjs");
+const require_http = require("./http-C8cZTE3Y.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");

package/dist/{kv-cache-C4C3LyYW.mjs → kv-cache-EvOgrFsS.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-Beod6tzO.mjs";
+import { p as recordDocumentCache } from "./metrics-BP3vdBpb.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{ld-BmFz5NLA.mjs → ld-B00wWHzc.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-Beod6tzO.mjs";
-import { r as fetchKey, s as validateCryptoKey } from "./key-BJrp524f.mjs";
+import { n as version, t as name } from "./deno-dxdvl2XZ.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-BP3vdBpb.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-DYfmjnmp.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{metrics-Beod6tzO.mjs → metrics-BP3vdBpb.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
+import { n as version, t as name } from "./deno-dxdvl2XZ.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts