@fedify/fedify 2.4.0-dev.2122 → 2.4.0-dev.2129

package/dist/sig/portable-key.test.mjs

@@ -2,12 +2,12 @@ import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
-import { i as fetchKey } from "../key-PyYvun0F.mjs";
-import { h as verifyJsonLd, p as signJsonLd } from "../ld-u4JOD4iO.mjs";
-import { n as createProof, u as verifyProof } from "../proof-BCOg7Njv.mjs";
-import { d as verifyRequest, f as verifyRequestDetailed, l as signRequest } from "../http-B9BQDNIy.mjs";
+import { i as fetchKey } from "../key-DolJjJab.mjs";
+import { h as verifyJsonLd, p as signJsonLd } from "../ld-Dwc176V4.mjs";
+import { n as createProof, u as verifyProof } from "../proof-B4_0E-KU.mjs";
+import { d as verifyRequest, f as verifyRequestDetailed, l as signRequest } from "../http-BpOiZE09.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-CPFM-sqo.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-BNHhwjNu.mjs";
 import { t as KvKeyCache } from "../keycache-BInaECGj.mjs";
 import { Create, CryptographicKey, Multikey, Note, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
@@ -715,5 +715,479 @@ test("verifyRequest() binds gateway keys to the actor whose document is signed",
 		contextLoader: shiftingContextLoader
 	}), null);
 });
+test("verifyRequest() matches gateway keys listed under ap: URIs", async () => {
+	const portableKeyId = parseIri(`${actorId}#main-key`);
+	const cases = {
+		"both properties": await actorJson({ key: portableKeyId }),
+		"assertionMethod only": await actorJson({
+			key: portableKeyId,
+			publicKey: null
+		}),
+		"publicKey only": await actorJson({
+			key: portableKeyId,
+			assertionMethod: false
+		})
+	};
+	for (const [name, document] of Object.entries(cases)) {
+		const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(document) });
+		for (const spec of specs) {
+			const key = await verifyRequest(await signedRequest(spec), {
+				documentLoader,
+				contextLoader,
+				spec
+			});
+			strictEqual(key?.id?.href, keyId.href, `${name}, ${spec}`);
+			strictEqual(key?.ownerId?.href, parseIri(actorId).href, name);
+		}
+	}
+});
+test("verifyRequest() rejects ambiguous or foreign aliases of gateway keys", async () => {
+	const portableKeyId = `${actorId}#main-key`;
+	const base = await actorJson();
+	const assertionMethod = base.assertionMethod;
+	const publicKey = base.publicKey;
+	const cases = {
+		"an exact entry and an ap: alias in assertionMethod": {
+			...base,
+			assertionMethod: [assertionMethod, {
+				...assertionMethod,
+				id: portableKeyId
+			}]
+		},
+		"a reference and an embedded ap: alias in assertionMethod": {
+			...base,
+			assertionMethod: [keyId.href, {
+				...assertionMethod,
+				id: portableKeyId
+			}]
+		},
+		"an exact entry and an ap: alias in publicKey": {
+			...base,
+			publicKey: [publicKey, {
+				...publicKey,
+				id: portableKeyId
+			}]
+		},
+		"a key of another gateway": await actorJson({ key: new URL(`${compatibleId(gw2)}#main-key`) }),
+		"an ap: key ID with dot segments": {
+			...base,
+			assertionMethod: {
+				...assertionMethod,
+				id: portableKeyId.replace("/actor#", "/x/../actor#")
+			},
+			publicKey: {
+				...publicKey,
+				id: portableKeyId.replace("/actor#", "/x/../actor#")
+			}
+		},
+		"a compatible key ID with dot segments": {
+			...base,
+			assertionMethod: {
+				...assertionMethod,
+				id: keyId.href.replace("/actor#", "/x/../actor#")
+			},
+			publicKey: {
+				...publicKey,
+				id: keyId.href.replace("/actor#", "/x/../actor#")
+			}
+		}
+	};
+	for (const [name, document] of Object.entries(cases)) {
+		const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(document) });
+		strictEqual(await verifyRequest(await signedRequest(), {
+			documentLoader,
+			contextLoader
+		}), null, name);
+	}
+});
+test("verifyRequest() refuses key IDs whose identity URL parsing changes", async () => {
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await actorJson()) });
+	const request = await signedRequest("draft-cavage-http-signatures-12");
+	const dotted = keyId.href.replace("/actor#", "/x/../actor#");
+	const headers = new Headers(request.headers);
+	headers.set("Signature", headers.get("Signature").replace(keyId.href, dotted));
+	strictEqual(await verifyRequest(new Request(request, { headers }), {
+		documentLoader,
+		contextLoader
+	}), null);
+	strictEqual(documentLoader.fetched.length, 0);
+	const dottedPortable = `${actorId.replace("/actor", "/x/../actor")}#main-key`;
+	for (const id of [
+		dotted,
+		dottedPortable,
+		` ${dotted}`,
+		` ${dottedPortable}`,
+		` ${parseIri(dottedPortable).href}`,
+		dottedPortable.replace("ap+ef61:", "ap+	ef61:"),
+		dotted.replace("did:key:", "did:ke	y:"),
+		`${gw1}/.well-known/apgateway/${did}/../../../users/alice#main-key`,
+		` ap://not-a-did/actor#main-key`
+	]) {
+		let error;
+		try {
+			await fetchKey(id, CryptographicKey, {
+				documentLoader,
+				contextLoader
+			});
+		} catch (e) {
+			error = e;
+		}
+		ok(error instanceof TypeError, id);
+	}
+});
+const apKeyId = parseIri(`${actorId}#main-key`);
+function hinted(...gateways) {
+	const query = gateways.map((g) => `@gateway=${encodeURIComponent(g)}`).join("&");
+	return parseIri(`${actorId}${query === "" ? "" : `?${query}`}#main-key`);
+}
+async function apActorJson(options = {}) {
+	return await actorJson({
+		key: apKeyId,
+		...options
+	});
+}
+test("verifyRequest() accepts keys of portable actors at ap: key IDs", async () => {
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await apActorJson()) });
+	const hintedKeyId = hinted(gw1);
+	for (const spec of specs) {
+		const key = await verifyRequest(await signedRequest(spec, hintedKeyId), {
+			documentLoader,
+			contextLoader,
+			spec
+		});
+		ok(key != null, spec);
+		strictEqual(key.id?.href, hintedKeyId.href, spec);
+		strictEqual(key.ownerId?.href, parseIri(actorId).href, spec);
+	}
+	const raw = `ap://${did}/actor?@gateway=${encodeURIComponent(gw1)}#main-key`;
+	for (const written of [raw, raw.replace(/^ap:/, "ap+ef61:")]) {
+		const request = await signedRequest("draft-cavage-http-signatures-12", hintedKeyId);
+		const headers = new Headers(request.headers);
+		headers.set("Signature", headers.get("Signature").replace(hintedKeyId.href, written));
+		strictEqual((await verifyRequest(new Request(request, { headers }), {
+			documentLoader,
+			contextLoader
+		}))?.ownerId?.href, parseIri(actorId).href, written);
+	}
+	deepStrictEqual([...new Set(documentLoader.fetched)], [compatibleId(gw1)]);
+});
+test("verifyRequest() asks the document loader for ap: key IDs without hints", async () => {
+	const documentLoader = createLoader({ [actorId]: await sign(await apActorJson()) });
+	strictEqual((await verifyRequest(await signedRequest(void 0, apKeyId), {
+		documentLoader,
+		contextLoader
+	}))?.ownerId?.href, parseIri(actorId).href);
+	deepStrictEqual(documentLoader.fetched, [actorId]);
+	const result = await verifyRequestDetailed(await signedRequest(void 0, apKeyId), {
+		documentLoader: createLoader({}),
+		contextLoader
+	});
+	ok(!result.verified);
+	strictEqual(result.reason.type, "keyFetchError");
+});
+test("verifyRequest() rejects keys at ap: key IDs that portable actors do not vouch for", async () => {
+	const unsigned = await apActorJson();
+	const ordinaryActorId = "https://gw1.example/users/alice";
+	const cases = {
+		"an unsigned actor document": unsigned,
+		"an actor document signed by another DID": await sign(unsigned, otherKeyPair.privateKey, `${otherDid}#${otherDid.slice(8)}`),
+		"a key missing from both assertionMethod and publicKey": await sign(await apActorJson({
+			assertionMethod: false,
+			publicKey: null
+		})),
+		"a key referred to by URL": await sign({
+			...await apActorJson({
+				publicKey: null,
+				assertionMethod: false
+			}),
+			assertionMethod: [apKeyId.href]
+		}),
+		"a key only in publicKey without an owner": await sign(withoutPublicKeyOwner(await apActorJson({ assertionMethod: false }))),
+		"a publicKey entry with other key material": await sign(await apActorJson({ publicKey: rsaPublicKey3.publicKey })),
+		"a key only at a compatible identifier": await sign(await actorJson()),
+		"an actor without gateways": await sign(await apActorJson({ gateways: [] })),
+		"the document of another actor": await sign(await apActorJson({ id: `${actorId}/other` })),
+		"an ordinary actor": await actorJson({
+			id: ordinaryActorId,
+			key: apKeyId
+		}),
+		"a standalone key": {
+			"@context": "https://w3id.org/security/v1",
+			id: apKeyId.href,
+			type: "Key",
+			owner: actorId,
+			publicKeyPem: await exportSpki(gatewayPublicKey)
+		}
+	};
+	for (const [name, document] of Object.entries(cases)) {
+		const documentLoader = createLoader({ [compatibleId(gw1)]: document });
+		strictEqual(await verifyRequest(await signedRequest(void 0, hinted(gw1)), {
+			documentLoader,
+			contextLoader
+		}), null, name);
+	}
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await apActorJson()) });
+	strictEqual(await verifyRequest(await signedRequest(void 0, parseIri(`${actorId}?@gateway=${encodeURIComponent(gw1)}`)), {
+		documentLoader,
+		contextLoader
+	}), null);
+	strictEqual(documentLoader.fetched.length, 0);
+});
+test("verifyRequest() tries the gateways of ap: key IDs in order", async () => {
+	const signed = await sign(await apActorJson());
+	const cases = {
+		"an invalid document at the first gateway": {
+			[compatibleId(gw1)]: await apActorJson(),
+			[compatibleId(gw2)]: signed
+		},
+		"an unreachable first gateway": { [compatibleId(gw2)]: signed }
+	};
+	for (const [name, responses] of Object.entries(cases)) {
+		const documentLoader = createLoader(responses);
+		strictEqual((await verifyRequest(await signedRequest(void 0, hinted(gw1, gw2)), {
+			documentLoader,
+			contextLoader
+		}))?.ownerId?.href, parseIri(actorId).href, name);
+		deepStrictEqual(documentLoader.fetched, [compatibleId(gw1), compatibleId(gw2)], name);
+	}
+	const documentLoader = createLoader({
+		[compatibleId(gw1)]: signed,
+		[compatibleId(gw2)]: signed
+	});
+	ok(await verifyRequest(await signedRequest(void 0, hinted(gw1, gw2)), {
+		documentLoader,
+		contextLoader
+	}) != null);
+	deepStrictEqual(documentLoader.fetched, [compatibleId(gw1)]);
+	const gateways = Array.from({ length: 7 }, (_, i) => `https://gw${i + 10}.example`);
+	const many = createLoader({});
+	ok(!(await verifyRequestDetailed(await signedRequest(void 0, hinted(...gateways)), {
+		documentLoader: many,
+		contextLoader
+	})).verified);
+	deepStrictEqual(many.fetched, gateways.slice(0, 5).map((g) => compatibleId(g)));
+});
+function failingLoader(responses) {
+	const fetched = [];
+	const loader = (url) => {
+		fetched.push(url);
+		const response = responses[url.replace(/#.*$/, "")] ?? 404;
+		if (typeof response === "number") return Promise.reject(new FetchError(url, `HTTP ${response}`, new Response(null, { status: response })));
+		return Promise.resolve({
+			contextUrl: null,
+			documentUrl: url,
+			document: structuredClone(response)
+		});
+	};
+	return Object.assign(loader, { fetched });
+}
+test("verifyRequest() reports why keys at ap: key IDs could not be looked up", async () => {
+	const hintedKeyId = hinted(gw1, gw2);
+	const invalid = await apActorJson();
+	const cases = [
+		{
+			name: "every gateway serves an invalid document",
+			responses: {
+				[compatibleId(gw1)]: invalid,
+				[compatibleId(gw2)]: invalid
+			},
+			reason: "invalidSignature",
+			cached: true
+		},
+		{
+			name: "every gateway responds with 410 Gone",
+			responses: {
+				[compatibleId(gw1)]: 410,
+				[compatibleId(gw2)]: 410
+			},
+			reason: "keyFetchError",
+			status: 410,
+			cached: true
+		},
+		{
+			name: "the gateways respond with different statuses",
+			responses: {
+				[compatibleId(gw1)]: 404,
+				[compatibleId(gw2)]: 503
+			},
+			reason: "keyFetchError",
+			cached: true
+		},
+		{
+			name: "one gateway serves an invalid document, the other is gone",
+			responses: {
+				[compatibleId(gw1)]: invalid,
+				[compatibleId(gw2)]: 410
+			},
+			reason: "keyFetchError",
+			cached: false
+		}
+	];
+	for (const { name, responses, reason, status, cached } of cases) for (const spec of specs) {
+		const documentLoader = failingLoader(responses);
+		const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"]);
+		const options = {
+			documentLoader,
+			contextLoader,
+			keyCache,
+			spec
+		};
+		for (let i = 0; i < 2; i++) {
+			const result = await verifyRequestDetailed(await signedRequest(spec, hintedKeyId), options);
+			ok(!result.verified, `${name}, ${spec}`);
+			strictEqual(result.reason.type, reason, `${name}, ${spec}`);
+			if (result.reason.type === "keyFetchError") strictEqual("status" in result.reason.result ? result.reason.result.status : void 0, status, `${name}, ${spec}`);
+		}
+		strictEqual(documentLoader.fetched.length, cached ? 2 : 4, `${name}, ${spec}`);
+	}
+});
+test("verifyRequest() accepts keys at ap: key IDs only for HTTP Signatures", async () => {
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await apActorJson()) });
+	const hintedKeyId = hinted(gw1);
+	const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"]);
+	const options = {
+		documentLoader,
+		contextLoader,
+		keyCache
+	};
+	for (const cls of [CryptographicKey, Multikey]) strictEqual((cls === CryptographicKey ? await fetchKey(hintedKeyId, CryptographicKey, options) : await fetchKey(hintedKeyId, Multikey, options)).key, null);
+	strictEqual(documentLoader.fetched.length, 0);
+	for (let i = 0; i < 3; i++) {
+		const key = await verifyRequest(await signedRequest(void 0, hintedKeyId), options);
+		strictEqual(key?.id?.href, hintedKeyId.href);
+		strictEqual(key?.ownerId?.href, parseIri(actorId).href);
+	}
+	strictEqual(documentLoader.fetched.length, 1);
+	for (const cls of [CryptographicKey, Multikey]) strictEqual((cls === CryptographicKey ? await fetchKey(hintedKeyId, CryptographicKey, options) : await fetchKey(hintedKeyId, Multikey, options)).key, null);
+	const document = {
+		"@context": "https://www.w3.org/ns/activitystreams",
+		type: "Create",
+		id: "https://gw1.example/activities/1",
+		actor: compatibleId(gw1)
+	};
+	const { signature } = await signJsonLd(document, rsaPrivateKey2, hintedKeyId, { contextLoader });
+	ok(!await verifyJsonLd({
+		...document,
+		signature
+	}, options));
+	strictEqual(documentLoader.fetched.length, 1);
+	const legacyCache = {
+		get: () => Promise.resolve(new CryptographicKey({
+			id: hintedKeyId,
+			owner: parseIri(actorId),
+			publicKey: gatewayPublicKey
+		})),
+		set: () => Promise.resolve()
+	};
+	const empty = createLoader({});
+	strictEqual(await verifyRequest(await signedRequest(void 0, hintedKeyId), {
+		documentLoader: empty,
+		contextLoader,
+		keyCache: legacyCache
+	}), null);
+	strictEqual(empty.fetched.length, 1);
+});
+test("verifyRequest() refreshes a cached key at an ap: key ID that fails to verify", async () => {
+	for (const spec of specs) {
+		const responses = { [compatibleId(gw1)]: await sign(await apActorJson()) };
+		const documentLoader = failingLoader(responses);
+		const hintedKeyId = hinted(gw1, gw2);
+		const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"]);
+		const options = {
+			documentLoader,
+			contextLoader,
+			keyCache,
+			spec
+		};
+		ok(await verifyRequest(await signedRequest(spec, hintedKeyId), options) != null);
+		strictEqual(documentLoader.fetched.length, 1, spec);
+		responses[compatibleId(gw1)] = await apActorJson();
+		responses[compatibleId(gw2)] = 503;
+		ok(!(await verifyRequestDetailed(await signRequest(new Request("https://recipient.example/inbox", {
+			method: "POST",
+			body: "{}",
+			headers: { "Content-Type": "application/activity+json" }
+		}), rsaPrivateKey3, hintedKeyId, { spec }), options)).verified, spec);
+		strictEqual(documentLoader.fetched.length, 3, spec);
+		const next = await verifyRequestDetailed(await signedRequest(spec, hintedKeyId), options);
+		ok(!next.verified, spec);
+		strictEqual(next.reason.type, "keyFetchError", spec);
+		strictEqual(documentLoader.fetched.length, 5, spec);
+	}
+});
+test("doesActorOwnKey() and getKeyOwner() resolve keys at ap: key IDs to portable actors", async () => {
+	const options = {
+		documentLoader: createLoader({ [compatibleId(gw1)]: await sign(await apActorJson()) }),
+		contextLoader
+	};
+	const hintedKeyId = hinted(gw1);
+	const key = new CryptographicKey({
+		id: hintedKeyId,
+		owner: parseIri(actorId),
+		publicKey: gatewayPublicKey
+	});
+	const activity = new Create({
+		id: parseIri(`${actorId.replace("/actor", "")}/activities/1`),
+		actor: parseIri(`ap://${did}/actor`)
+	});
+	ok(await doesActorOwnKey(activity, key, options));
+	strictEqual((await getKeyOwner(hintedKeyId, options))?.id?.href, parseIri(actorId).href);
+	strictEqual((await getKeyOwner(key, options))?.id?.href, parseIri(actorId).href);
+	ok(!await doesActorOwnKey(new Create({
+		id: parseIri(`ap+ef61://${otherDid}/activities/1`),
+		actor: parseIri(`ap+ef61://${otherDid}/actor`)
+	}), key, options));
+	const other = key.clone({ publicKey: rsaPublicKey3.publicKey });
+	ok(!await doesActorOwnKey(activity, other, options));
+	strictEqual(await getKeyOwner(other, options), null);
+	const unsigned = {
+		documentLoader: createLoader({ [compatibleId(gw1)]: await apActorJson() }),
+		contextLoader
+	};
+	ok(!await doesActorOwnKey(activity, key, unsigned));
+	strictEqual(await getKeyOwner(hintedKeyId, unsigned), null);
+});
+test("verifyRequest() does not trust a cached key at an ap: key ID for longer than its proof", async () => {
+	let now = Temporal.Now.instant();
+	const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"], { now: () => now });
+	const expires = now.add({ minutes: 30 });
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await apActorJson(), ed25519PrivateKey, didKeyId, { expires: expires.toString() }) });
+	const options = {
+		documentLoader,
+		contextLoader,
+		keyCache
+	};
+	const hintedKeyId = hinted(gw1);
+	ok(await verifyRequest(await signedRequest(void 0, hintedKeyId), options) != null);
+	now = expires.subtract({ seconds: 1 });
+	ok(await verifyRequest(await signedRequest(void 0, hintedKeyId), options) != null);
+	strictEqual(documentLoader.fetched.length, 1);
+	now = expires;
+	ok(await verifyRequest(await signedRequest(void 0, hintedKeyId), options) != null);
+	strictEqual(documentLoader.fetched.length, 2);
+});
+test("verifyRequest() does not cache keys at ap: key IDs it could not process", async () => {
+	let failures = 1;
+	const flakyContextLoader = (url, options) => {
+		if (failures > 0) {
+			failures--;
+			return Promise.reject(/* @__PURE__ */ new Error(`Temporarily failed to load ${url}`));
+		}
+		return contextLoader(url, options);
+	};
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await apActorJson()) });
+	const options = {
+		documentLoader,
+		contextLoader: flakyContextLoader,
+		keyCache: new KvKeyCache(new MemoryKvStore(), ["pk"])
+	};
+	const hintedKeyId = hinted(gw1);
+	const result = await verifyRequestDetailed(await signedRequest(void 0, hintedKeyId), options);
+	ok(!result.verified);
+	strictEqual(result.reason.type, "keyFetchError");
+	if (result.reason.type === "keyFetchError") ok(!("status" in result.reason.result));
+	strictEqual((await verifyRequest(await signedRequest(void 0, hintedKeyId), options))?.ownerId?.href, parseIri(actorId).href);
+	strictEqual(documentLoader.fetched.length, 2);
+});
 //#endregion
 export {};

package/dist/sig/proof.test.mjs

@@ -10,10 +10,10 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { i as signObject, n as createProof, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, u as verifyProof } from "../proof-BCOg7Njv.mjs";
-import { d as verifyRequest } from "../http-B9BQDNIy.mjs";
+import { i as signObject, n as createProof, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, u as verifyProof } from "../proof-B4_0E-KU.mjs";
+import { d as verifyRequest } from "../http-BpOiZE09.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-3BHaS20Z.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-BbS0rO-Y.mjs";
 import { Create, DataIntegrityProof, Document, Multikey, Note, PUBLIC_COLLECTION, Place, Translation } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { decodeMultibase, encodeMultibase, exportDidKey, exportMultibaseKey, formatIri, importMultibaseKey, parseIri } from "@fedify/vocab-runtime";

package/dist/{temporal-vjHOhBpy.mjs → temporal-78JVR3GK.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-u4JOD4iO.mjs";
+import { c as getNormalizationContextLoader } from "./ld-Dwc176V4.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {

package/dist/testing/kv.test.mjs

@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { n as baseOptions, o as stringSchema, t as MockQueue } from "../tasks-dbCShlCb.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
-import { o as createFederation } from "../middleware-CgOqRkK-.mjs";
+import { o as createFederation } from "../middleware-DN3MdTDg.mjs";
 //#region src/testing/kv.test.ts
 test("ManualClockKvStore keeps an entry at its exact expiration instant", async () => {
 	const kv = new ManualClockKvStore();

package/dist/testing/mod.d.mts

@@ -5,7 +5,7 @@ import { Router } from "@fedify/uri-template";
 import { Activity, Actor, Collection, CryptographicKey, Hashtag, Link, LookupObjectOptions, Multikey, Note, Object as Object$1, Recipient, Tombstone, TraverseCollectionOptions } from "@fedify/vocab";
 import { Link as Link$1, LookupWebFingerOptions, ResourceDescriptor } from "@fedify/webfinger";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
-import { AuthenticatedDocumentLoaderFactory, DocumentLoader, DocumentLoaderFactory, GetUserAgentOptions } from "@fedify/vocab-runtime";
+import { AuthenticatedDocumentLoaderFactory, DocumentLoader, DocumentLoaderFactory, GetUserAgentOptions, PortableObjectVerifier } from "@fedify/vocab-runtime";
 import { MeterProvider as MeterProvider$1, MetricReader } from "@opentelemetry/sdk-metrics";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 
@@ -2881,6 +2881,27 @@ interface Context<TContextData> {
    * The context loader for loading remote JSON-LD contexts.
    */
   readonly contextLoader: DocumentLoader;
+  /**
+   * The [FEP-ef61] portable object policy that this context applies to
+   * portable objects it dereferences.  It is `verifyPortableObject()` with
+   * this context's document loader, context loader, and tracer provider as
+   * defaults, which the options passed to it override.
+   *
+   * Since its name is the same as the `verifyPortableObject` option of
+   * property accessors, `lookupObject()`, and `traverseCollection()`, passing
+   * a context as their options applies the policy, e.g.,
+   * `await create.getObject(ctx)`.  Objects parsed with a context as options,
+   * such as activities that inboxes receive, also use it by default for
+   * their property accessors.  It never verifies an object by itself being
+   * there: it only applies to objects that are dereferenced.
+   *
+   * It is optional only so that custom implementations of this interface
+   * keep working; contexts that Fedify creates always have it.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   * @since 2.4.0
+   */
+  readonly verifyPortableObject?: PortableObjectVerifier;
   /**
    * The federation object that this context belongs to.
    * @since 1.6.0
@@ -3158,10 +3179,13 @@ interface Context<TContextData> {
    *
    * It's almost the same as the {@link lookupObject} function, but it uses
    * the context's document loader and context loader by default.  It also
-   * uses `verifyPortableObjectProof()` as the `verifyPortableObject`
+   * uses {@link Context.verifyPortableObject} as the `verifyPortableObject`
    * option by default (since 2.4.0), so [FEP-ef61] portable objects,
    * including portable actors found through WebFinger, are looked up through
-   * their gateways and returned only if they have valid proofs.
+   * their gateways and returned only if they have valid proofs, or, for
+   * collections without proofs, if they are served by gateways that their
+   * owners list.  The returned object uses the same policy by default for
+   * its property accessors.
    *
    * [FEP-ef61]: https://w3id.org/fep/ef61
    *
@@ -3187,7 +3211,9 @@ interface Context<TContextData> {
    * ```
    *
    * It's almost the same as the {@link traverseCollection} function, but it
-   * uses the context's document loader and context loader by default.
+   * uses the context's document loader and context loader by default.  It
+   * also uses {@link Context.verifyPortableObject} as the
+   * `verifyPortableObject` option by default (since 2.4.0).
    * @param collection The collection to traverse.
    * @param options Options for traversing the collection.
    * @returns An async iterable of each item in the collection.

package/dist/testing/mod.mjs

@@ -2,8 +2,8 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { r as testDefinitions } from "../dist-BQvArojP.mjs";
-import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-CoNRxGYp.mjs";
+import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-DfSVPcJ8.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, r as envelopeSchema, t as MockQueue } from "../tasks-dbCShlCb.mjs";
-import "../testing-BWq1dCzx.mjs";
+import "../testing-otQhu4aD.mjs";
 export { ManualClockKvStore, MockQueue, baseOptions, createInboxContext, createOutboxContext, createRequestContext, envelopeSchema, makeSchema, numberSchema, stringSchema, testDefinitions };

package/dist/{testing-BWq1dCzx.mjs → testing-otQhu4aD.mjs}

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import "./dist-BQvArojP.mjs";
-import "./context-CoNRxGYp.mjs";
+import "./context-DfSVPcJ8.mjs";
 import "./kv-DBRWVx3Q.mjs";
 import "./tasks-dbCShlCb.mjs";
 export {};