@fedify/fedify 2.4.0-dev.2127 → 2.4.0-dev.2141

package/dist/portable-key-C-fPq_Yf.mjs

@@ -1,214 +0,0 @@
-import "temporal-polyfill";
-import "urlpattern-polyfill";
-globalThis.addEventListener = () => {};
-import { l as isSamePublicKey, o as isPortableActorDocument, t as getCanonicalPortableId } from "./portable-key-id-T7lecIbt.mjs";
-import { l as verifyPortableObjectProofWithRoot } from "./proof-CW8k0R1G.mjs";
-import { getLogger } from "@logtape/logtape";
-import { CryptographicKey, Multikey, Object as Object$1 } from "@fedify/vocab";
-import { getDocumentLoader, isGatewayUrl } from "@fedify/vocab-runtime";
-//#region src/sig/portable-key.ts
-const logger = getLogger([
-	"fedify",
-	"sig",
-	"key"
-]);
-const SEC = "https://w3id.org/security#";
-/**
-* Verifies that the signed document of a portable actor vouches for
-* the gateway key with the given ID.
-*
-* A gateway key is accepted only if:
-*
-*  -  the document is an actor whose portable ID, i.e., its `ap:` ID or
-*     the canonical portable ID of its compatible identifier, is the one
-*     the key ID is the compatible identifier of;
-*  -  the document has a valid [FEP-8b32] Object Integrity Proof made by
-*     the DID of its ID, i.e., it satisfies the [FEP-ef61] proof policy;
-*  -  the document embeds a `Multikey` with that ID in its `assertionMethod`,
-*     whose `controller` is the actor, as [FEP-521a] requires, and a key
-*     embedded in its `publicKey` with the same ID agrees with it; or, if
-*     no `assertionMethod` entry has that ID, the document embeds
-*     a `CryptographicKey` with that ID in its `publicKey`, whose `owner` is
-*     the actor, as some publishers, e.g., tootik, list their RSA keys only
-*     there;
-*  -  no more than one entry of either property has that ID; and
-*  -  the key ID's origin is one of the actor's `gateways`.
-*
-* [FEP-8b32]: https://w3id.org/fep/8b32
-* [FEP-ef61]: https://w3id.org/fep/ef61
-* [FEP-521a]: https://w3id.org/fep/521a
-*
-* @param document The raw JSON-LD document served at the key ID.
-* @param actor The parsed document, which must be a portable actor.
-* @param keyId The key ID, which must be a compatible key ID.
-* @param options Loaders and telemetry providers.
-* @returns The verification result, which is never `legacy`.
-* @internal
-*/
-async function verifyPortableGatewayKeyDocument(document, actor, keyId, options = {}) {
-	const reject = (reason) => {
-		logger.debug("Failed to verify gateway key {keyId} of the portable actor {actorId}: {reason}", {
-			keyId: keyId.href,
-			actorId: actor.id?.href,
-			reason
-		});
-		return {
-			type: "rejected",
-			reason
-		};
-	};
-	const keyBase = new URL(keyId.href);
-	keyBase.hash = "";
-	const claimedActorId = getCanonicalPortableId(keyBase);
-	const actorId = actor.id == null ? null : getCanonicalPortableId(actor.id);
-	if (claimedActorId == null || actorId == null) return reject("The key ID or the actor ID is not a valid portable ID.");
-	if (claimedActorId !== actorId) return reject("The key ID is not a compatible identifier of the actor it dereferences to.");
-	let verification;
-	try {
-		verification = await verifyPortableObjectProofWithRoot(document, {
-			documentLoader: options.documentLoader,
-			contextLoader: options.contextLoader,
-			keyCache: options.keyCache,
-			tracerProvider: options.tracerProvider,
-			meterProvider: options.meterProvider
-		});
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		return reject(`The actor document is malformed: ${error.message}`);
-	}
-	const { result, root, expires } = verification;
-	if (!result.verified) return reject("The actor document does not satisfy the FEP-ef61 proof policy: " + result.reason.type);
-	if (root == null) return reject("The actor document could not be expanded.");
-	const refuse = (url) => Promise.reject(/* @__PURE__ */ new Error(`Refusing to fetch ${url}.`));
-	const parseEmbeddedPublicKey = async (node) => {
-		if (isReference(node)) return null;
-		let key;
-		try {
-			key = await CryptographicKey.fromJsonLd(node, {
-				documentLoader: refuse,
-				contextLoader: options.contextLoader,
-				tracerProvider: options.tracerProvider
-			});
-		} catch (error) {
-			if (!(error instanceof TypeError)) throw error;
-			return null;
-		}
-		return key.publicKey == null ? null : key;
-	};
-	let verifiedActor;
-	try {
-		verifiedActor = await Object$1.fromJsonLd(root, {
-			documentLoader: refuse,
-			contextLoader: options.contextLoader,
-			tracerProvider: options.tracerProvider
-		});
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		return reject("The verified actor document is malformed.");
-	}
-	if (!isPortableActorDocument(verifiedActor) || getCanonicalPortableId(verifiedActor.id) !== claimedActorId) return reject("The key ID is not a compatible identifier of the actor whose document is signed.");
-	actor = verifiedActor;
-	const assertionNodes = findNodes(root[`${SEC}assertionMethod`], keyId);
-	const publicKeyNodes = findNodes(root[`${SEC}publicKey`], keyId);
-	if (assertionNodes.length > 1 || publicKeyNodes.length > 1) return reject("The actor document has more than one key with the ID.");
-	let publicKey;
-	if (assertionNodes.length > 0) {
-		if (isReference(assertionNodes[0])) return reject("The actor document does not embed the key in its assertionMethod.");
-		let multikey;
-		try {
-			multikey = await Multikey.fromJsonLd(assertionNodes[0], {
-				documentLoader: refuse,
-				contextLoader: options.contextLoader,
-				tracerProvider: options.tracerProvider
-			});
-		} catch (error) {
-			if (!(error instanceof TypeError)) throw error;
-			return reject("The key in the assertionMethod is malformed.");
-		}
-		if (multikey.publicKey == null) return reject("The key in the assertionMethod has no public key.");
-		if (multikey.controllerId == null || getCanonicalPortableId(multikey.controllerId) !== actorId) return reject("The controller of the key is not the actor.");
-		publicKey = multikey.publicKey;
-		if (publicKeyNodes.length > 0 && !isReference(publicKeyNodes[0])) {
-			const embedded = await parseEmbeddedPublicKey(publicKeyNodes[0]);
-			if (embedded == null || !await isSamePublicKey(embedded.publicKey, publicKey) || embedded.ownerId != null && getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The key in the publicKey does not agree with the one in the assertionMethod.");
-		}
-	} else {
-		if (publicKeyNodes.length < 1) return reject("The actor document embeds the key in neither its assertionMethod nor its publicKey.");
-		const embedded = await parseEmbeddedPublicKey(publicKeyNodes[0]);
-		if (embedded == null) return reject("The key in the publicKey is not embedded or malformed.");
-		if (embedded.ownerId == null || getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The owner of the key is not the actor.");
-		publicKey = embedded.publicKey;
-	}
-	if (!actor.gateways.some((gateway) => isGatewayUrl(gateway) && gateway.origin === keyId.origin)) return reject(`The gateway ${keyId.origin} is not listed in the actor's gateways.`);
-	const key = new CryptographicKey({
-		id: keyId,
-		owner: actor.id,
-		publicKey
-	});
-	return {
-		type: "verified",
-		actor,
-		key,
-		...expires == null ? {} : { expires }
-	};
-}
-/**
-* Fetches the document at a compatible key ID, and resolves the key as
-* a gateway key if the document is a portable actor.
-*
-* @param keyId The key ID, which must be a compatible key ID.
-* @param options Loaders and telemetry providers.
-* @returns `legacy` if the document cannot be fetched or is not a portable
-*          actor, which leaves the key to the usual resolution; otherwise,
-*          the result of {@link verifyPortableGatewayKeyDocument}.
-* @internal
-*/
-async function fetchPortableGatewayKey(keyId, options = {}) {
-	const documentLoader = options.documentLoader ?? getDocumentLoader();
-	const contextLoader = options.contextLoader ?? getDocumentLoader();
-	let remoteDocument;
-	try {
-		remoteDocument = await documentLoader(keyId.href);
-	} catch (error) {
-		logger.debug("Failed to fetch key {keyId}: {error}", {
-			keyId: keyId.href,
-			error
-		});
-		return { type: "legacy" };
-	}
-	let object;
-	try {
-		object = await Object$1.fromJsonLd(remoteDocument.document, {
-			documentLoader,
-			contextLoader,
-			tracerProvider: options.tracerProvider
-		});
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		return { type: "legacy" };
-	}
-	if (!isPortableActorDocument(object)) return { type: "legacy" };
-	return await verifyPortableGatewayKeyDocument(remoteDocument.document, object, keyId, {
-		...options,
-		documentLoader,
-		contextLoader
-	});
-}
-function findNodes(values, id) {
-	if (!Array.isArray(values)) return [];
-	const nodes = [];
-	for (const value of values) {
-		if (value == null || typeof value !== "object" || Array.isArray(value)) continue;
-		const node = value;
-		const nodeId = node["@id"];
-		if (typeof nodeId !== "string" || !URL.canParse(nodeId)) continue;
-		if (new URL(nodeId).href === id.href) nodes.push(node);
-	}
-	return nodes;
-}
-/** A node with nothing but an `@id` is a reference, not an embedded key. */
-function isReference(node) {
-	return Object.keys(node).every((key) => key === "@id");
-}
-//#endregion
-export { verifyPortableGatewayKeyDocument as n, fetchPortableGatewayKey as t };