@fedify/fedify 2.4.0-dev.2169 → 2.4.0-dev.2193

package/dist/sig/http.test.mjs

@@ -2,6 +2,7 @@ import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
+import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as AssertionError } from "../assertion_error-B-cx0fFA.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertExists } from "../assert_exists-cffSpJ7X.mjs";
@@ -11,11 +12,12 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { n as exportJwk } from "../key-gIhVZO3p.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, i as formatRfc9421SignatureParameters, l as signRequest, n as doubleKnock, o as parseRfc9421Signature, r as formatRfc9421Signature, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as timingSafeEqual } from "../http-Bd6rZlJX.mjs";
-import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { n as exportJwk } from "../key-DA3Yx8p2.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, f as verifyRequest, i as formatRfc9421SignatureParameters, l as signRequest, n as doubleKnock, o as parseRfc9421Signature, p as verifyRequestDetailed, r as formatRfc9421Signature, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as timingSafeEqual } from "../http-DQf9Mw4V.mjs";
+import { a as rsaPrivateKey3, i as rsaPrivateKey2, l as rsaPublicKey5, n as ed25519PrivateKey, o as rsaPublicKey1, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { t as KvKeyCache } from "../keycache-Da8A8mZa.mjs";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
-import { FetchError, exportSpki } from "@fedify/vocab-runtime";
+import { FetchError, exportSpki, getDocumentLoader } from "@fedify/vocab-runtime";
 import { encodeBase64 } from "byte-encodings/base64";
 //#region ../../node_modules/.pnpm/@jsr+std__assert@0.226.0/node_modules/@jsr/std__assert/assert_string_includes.js
 /**
@@ -258,7 +260,7 @@ test("verifyRequestDetailed() records failure details on span", async () => {
 	assertEquals(span.attributes["http_signatures.key_fetch_status"], 410);
 });
 test("verifyRequestDetailed() records verification duration metric", async (t) => {
-	const buildSignedRequest = () => signRequest(new Request("https://example.com/inbox", {
+	const buildSignedRequest = (spec) => signRequest(new Request("https://example.com/inbox", {
 		method: "POST",
 		headers: {
 			"Content-Type": "application/activity+json",
@@ -269,7 +271,7 @@ test("verifyRequestDetailed() records verification duration metric", async (t) =
 			type: "Create",
 			actor: "https://example.com/key2"
 		})
-	}), rsaPrivateKey2, new URL("https://example.com/key2"));
+	}), rsaPrivateKey2, new URL("https://example.com/key2"), { spec });
 	await t.step("verified path emits one measurement", async () => {
 		const [meterProvider, recorder] = createTestMeterProvider();
 		assert((await verifyRequestDetailed(await buildSignedRequest(), {
@@ -372,23 +374,26 @@ test("verifyRequestDetailed() records verification duration metric", async (t) =
 		assertEquals(recorder.getMeasurements("activitypub.signature.verification.duration").length, 1);
 	});
 	await t.step("cached-key retry emits one measurement, not two", async () => {
-		const [meterProvider, recorder] = createTestMeterProvider();
-		const cache = { "https://example.com/key2": rsaPublicKey1 };
-		assertExists(await verifyRequest(await buildSignedRequest(), {
-			contextLoader: mockDocumentLoader,
-			documentLoader: mockDocumentLoader,
-			meterProvider,
-			keyCache: {
-				get(keyId) {
-					return Promise.resolve(cache[keyId.href]);
-				},
-				set(keyId, k) {
-					cache[keyId.href] = k;
-					return Promise.resolve();
+		for (const spec of ["draft-cavage-http-signatures-12", "rfc9421"]) {
+			const [meterProvider, recorder] = createTestMeterProvider();
+			const cache = { "https://example.com/key2": rsaPublicKey1 };
+			assertExists(await verifyRequest(await buildSignedRequest(spec), {
+				contextLoader: mockDocumentLoader,
+				documentLoader: mockDocumentLoader,
+				meterProvider,
+				keyCache: {
+					get(keyId) {
+						return Promise.resolve(cache[keyId.href]);
+					},
+					set(keyId, k) {
+						cache[keyId.href] = k;
+						return Promise.resolve();
+					}
 				}
-			}
-		}));
-		assertEquals(recorder.getMeasurements("activitypub.signature.verification.duration").length, 1);
+			}), spec);
+			assertEquals(recorder.getMeasurements("activitypub.signature.verification.duration").length, 1, spec);
+			assertEquals(recorder.getMeasurements("activitypub.signature.key_fetch.duration").length, 2, spec);
+		}
 	});
 	await t.step("key fetch records result=fetched on a cold cache", async () => {
 		const [meterProvider, recorder] = createTestMeterProvider();
@@ -691,10 +696,394 @@ for (const failure of [
 			return mockDocumentLoader(url, options);
 		}
 	}), failure === "digest mismatch" ? null : rsaPublicKey2);
-	assertEquals(loaded, failure === "digest mismatch" ? [] : failure === "missing key" ? ["https://example.com/missing-key", "https://example.com/key2"] : ["https://example.com/key2", "https://example.com/key2"]);
+	assertEquals(loaded, failure === "digest mismatch" ? [] : failure === "missing key" ? ["https://example.com/missing-key", "https://example.com/key2"] : ["https://example.com/key2"]);
 	assertFalse(request.bodyUsed);
 	assertEquals(await request.text(), failure === "digest mismatch" ? "Tampered body" : body);
 });
+async function signRfc9421Many(signatures, currentTime) {
+	let request = new Request("https://example.com/inbox", {
+		method: "POST",
+		body: "Hello, world!"
+	});
+	let i = 0;
+	for (const signature of signatures) {
+		const { label, keyId, privateKey } = typeof signature === "string" ? { keyId: signature } : signature;
+		i++;
+		request = await signRequest(request, privateKey ?? rsaPrivateKey2, new URL(keyId), {
+			spec: "rfc9421",
+			currentTime,
+			rfc9421: { label: label ?? `sig${i}` }
+		});
+	}
+	return request;
+}
+function splitRfc9421Header(header) {
+	return Object.fromEntries(header.split(/,\s*/).map((member) => [member.slice(0, member.indexOf("=")), member]));
+}
+function createCountingKeyLoader() {
+	const loaded = [];
+	const loader = (url, options) => {
+		loaded.push(url);
+		if (url === "https://example.com/key2") return mockDocumentLoader(url, options);
+		return Promise.reject(new FetchError(url, `Not found: ${url}`));
+	};
+	return Object.assign(loader, { loaded });
+}
+test("verifyRequestDetailed() [rfc9421] caps the number of signatures", async (t) => {
+	const currentTime = Temporal.Instant.from("2024-03-05T08:09:44Z");
+	const missing = (n) => `https://example.com/missing-${n}`;
+	const valid = "https://example.com/key2";
+	await t.step("fetches only the keys of the first signatures", async () => {
+		const request = await signRfc9421Many([
+			1,
+			2,
+			3,
+			4,
+			5
+		].map(missing), currentTime);
+		for (const [maxSignatures, count] of [
+			[void 0, 3],
+			[1, 1],
+			[5, 5],
+			[Infinity, 5]
+		]) {
+			const documentLoader = createCountingKeyLoader();
+			const result = await verifyRequestDetailed(request, {
+				documentLoader,
+				contextLoader: mockDocumentLoader,
+				currentTime,
+				maxSignatures
+			});
+			assertFalse(result.verified);
+			assertEquals(result.reason.type, "keyFetchError");
+			assertEquals("keyId" in result.reason ? result.reason.keyId?.href : void 0, missing(count));
+			assertEquals(documentLoader.loaded, [
+				1,
+				2,
+				3,
+				4,
+				5
+			].slice(0, count).map(missing));
+		}
+	});
+	await t.step("accepts a valid signature within the cap", async () => {
+		const documentLoader = createCountingKeyLoader();
+		const result = await verifyRequestDetailed(await signRfc9421Many([
+			missing(1),
+			missing(2),
+			valid,
+			missing(4)
+		], currentTime), {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			currentTime
+		});
+		assert(result.verified);
+		assertEquals(result.key, rsaPublicKey2);
+		assertEquals(result.signatureLabel, "sig3");
+		assertEquals(documentLoader.loaded, [
+			missing(1),
+			missing(2),
+			valid
+		]);
+	});
+	await t.step("ignores a valid signature beyond the cap", async () => {
+		const request = await signRfc9421Many([
+			missing(1),
+			missing(2),
+			missing(3),
+			valid
+		], currentTime);
+		const documentLoader = createCountingKeyLoader();
+		const result = await verifyRequestDetailed(request, {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			currentTime
+		});
+		assertFalse(result.verified);
+		assertEquals(result.reason.type, "keyFetchError");
+		assertEquals("keyId" in result.reason ? result.reason.keyId?.href : void 0, missing(3));
+		assertEquals(documentLoader.loaded, [
+			1,
+			2,
+			3
+		].map(missing));
+		assertEquals(await verifyRequest(request, {
+			documentLoader: createCountingKeyLoader(),
+			contextLoader: mockDocumentLoader,
+			currentTime,
+			maxSignatures: 4
+		}), rsaPublicKey2);
+	});
+	await t.step("tries signatures in the header order", async () => {
+		const request = await signRfc9421Many([
+			{
+				label: "z",
+				keyId: missing(1)
+			},
+			{
+				label: "a",
+				keyId: valid
+			},
+			{
+				label: "m",
+				keyId: missing(3)
+			}
+		], currentTime);
+		const documentLoader = createCountingKeyLoader();
+		assertEquals(await verifyRequest(request, {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			currentTime,
+			maxSignatures: 1
+		}), null);
+		assertEquals(documentLoader.loaded, [missing(1)]);
+	});
+	await t.step("counts signatures that fail before their keys are fetched", async () => {
+		const outdated = await signRfc9421Many([{
+			label: "old",
+			keyId: missing(1)
+		}], currentTime.subtract({ hours: 2 }));
+		const signed = await signRfc9421Many([
+			{
+				label: "nobytes1",
+				keyId: missing(2)
+			},
+			{
+				label: "nobytes2",
+				keyId: missing(3)
+			},
+			{
+				label: "valid",
+				keyId: valid
+			}
+		], currentTime);
+		const inputs = {
+			...splitRfc9421Header(outdated.headers.get("Signature-Input")),
+			...splitRfc9421Header(signed.headers.get("Signature-Input"))
+		};
+		const signatures = {
+			...splitRfc9421Header(outdated.headers.get("Signature")),
+			...splitRfc9421Header(signed.headers.get("Signature"))
+		};
+		const build = (labels) => {
+			const headers = new Headers(signed.headers);
+			headers.set("Signature-Input", [`dropped=("@method");keyid="${missing(0)}"`, ...labels.map((label) => inputs[label])].join(", "));
+			headers.set("Signature", labels.filter((label) => !label.startsWith("nobytes")).map((label) => signatures[label]).join(", "));
+			return new Request(signed.url, {
+				method: "POST",
+				headers,
+				body: "Hello, world!"
+			});
+		};
+		let documentLoader = createCountingKeyLoader();
+		let result = await verifyRequestDetailed(build([
+			"old",
+			"nobytes1",
+			"valid"
+		]), {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			currentTime
+		});
+		assert(result.verified);
+		assertEquals(result.signatureLabel, "valid");
+		assertEquals(documentLoader.loaded, [valid]);
+		documentLoader = createCountingKeyLoader();
+		result = await verifyRequestDetailed(build([
+			"old",
+			"nobytes1",
+			"nobytes2",
+			"valid"
+		]), {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			currentTime
+		});
+		assertFalse(result.verified);
+		assertEquals(documentLoader.loaded, []);
+	});
+	await t.step("rejects an invalid maxSignatures", async () => {
+		const unsigned = new Request("https://example.com/inbox");
+		for (const maxSignatures of [
+			0,
+			-1,
+			1.5,
+			NaN,
+			2 ** 53,
+			-Infinity
+		]) {
+			await assertRejects(() => verifyRequestDetailed(unsigned, { maxSignatures }), RangeError);
+			await assertRejects(() => verifyRequest(unsigned, { maxSignatures }), RangeError);
+		}
+		await assertRejects(() => verifyRequestDetailed(unsigned, { maxSignatures: null }), RangeError);
+	});
+});
+test("verifyRequestDetailed() [rfc9421] looks up each key once per request", async (t) => {
+	const currentTime = Temporal.Instant.from("2024-03-05T08:09:44Z");
+	const missing = (n) => `https://example.com/missing-${n}`;
+	const valid = "https://example.com/key2";
+	const forged = {
+		keyId: valid,
+		privateKey: rsaPrivateKey3
+	};
+	await t.step("signatures naming the same key", async () => {
+		const request = await signRfc9421Many([
+			forged,
+			forged,
+			valid
+		], currentTime);
+		for (const keyCache of [void 0, new KvKeyCache(new MemoryKvStore(), ["pk"])]) {
+			const documentLoader = createCountingKeyLoader();
+			const result = await verifyRequestDetailed(request, {
+				documentLoader,
+				contextLoader: mockDocumentLoader,
+				currentTime,
+				keyCache
+			});
+			assert(result.verified);
+			assertEquals(result.signatureLabel, "sig3");
+			assertEquals(documentLoader.loaded, [valid]);
+		}
+	});
+	await t.step("signatures naming the same missing key", async () => {
+		const documentLoader = createCountingKeyLoader();
+		const result = await verifyRequestDetailed(await signRfc9421Many([
+			missing(1),
+			missing(1),
+			missing(1)
+		], currentTime), {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			currentTime
+		});
+		assertFalse(result.verified);
+		assertEquals(result.reason.type, "keyFetchError");
+		assertEquals(documentLoader.loaded, [missing(1)]);
+	});
+	await t.step("separate requests", async () => {
+		const request = await signRfc9421Many([valid], currentTime);
+		const documentLoader = createCountingKeyLoader();
+		const options = {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			currentTime
+		};
+		assertEquals(await verifyRequest(request, options), rsaPublicKey2);
+		assertEquals(await verifyRequest(request, options), rsaPublicKey2);
+		assertEquals(documentLoader.loaded, [valid, valid]);
+	});
+	const createStaleKeyCache = () => {
+		const gets = [];
+		return {
+			keyCache: {
+				get(keyId) {
+					gets.push(keyId.href);
+					return Promise.resolve(keyId.href === valid ? rsaPublicKey1 : keyId.href === missing(1) ? null : void 0);
+				},
+				set: () => Promise.resolve(),
+				getFetchError: (keyId) => Promise.resolve(keyId.href === missing(1) ? { error: new FetchError(keyId, "Cached failure") } : void 0),
+				setFetchError: () => Promise.resolve()
+			},
+			gets
+		};
+	};
+	await t.step("refreshes a stale cached key once, only for its signature", async () => {
+		const { keyCache, gets } = createStaleKeyCache();
+		const documentLoader = createCountingKeyLoader();
+		const result = await verifyRequestDetailed(await signRfc9421Many([
+			missing(1),
+			missing(2),
+			forged,
+			valid
+		], currentTime), {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			currentTime,
+			keyCache,
+			maxSignatures: 4
+		});
+		assert(result.verified);
+		assertEquals(result.key, rsaPublicKey2);
+		assertEquals(result.signatureLabel, "sig4");
+		assertEquals(documentLoader.loaded, [missing(2), valid]);
+		assertEquals(gets, [
+			missing(1),
+			missing(2),
+			valid
+		]);
+	});
+	await t.step("refreshes each stale cached key at most once", async () => {
+		const stale = (n) => `https://example.com/stale-${n}`;
+		const gets = [];
+		const keyCache = {
+			get(keyId) {
+				gets.push(keyId.href);
+				return Promise.resolve(rsaPublicKey1);
+			},
+			set: () => Promise.resolve()
+		};
+		const documentLoader = createCountingKeyLoader();
+		const result = await verifyRequestDetailed(await signRfc9421Many([
+			stale(1),
+			stale(2),
+			stale(1),
+			stale(4)
+		], currentTime), {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			currentTime,
+			keyCache
+		});
+		assertFalse(result.verified);
+		assertEquals(result.reason.type, "keyFetchError");
+		assertEquals("keyId" in result.reason ? result.reason.keyId?.href : void 0, stale(1));
+		assertEquals(documentLoader.loaded, [stale(1), stale(2)]);
+		assertEquals(gets, [stale(1), stale(2)]);
+	});
+	await t.step("does not refresh a cached key for other failures", async () => {
+		const [input] = Object.values(splitRfc9421Header((await signRfc9421Many([valid], currentTime)).headers.get("Signature-Input")));
+		const withAlg = (alg) => /;alg="[^"]*"/.test(input) ? input.replace(/;alg="[^"]*"/, `;alg="${alg}"`) : `${input};alg="${alg}"`;
+		for (const signatureInput of [withAlg("unknown"), input.replace(/^sig1=\([^)]*\)/, "sig1=(\"@unsupported\")")]) {
+			const request = await signRfc9421Many([valid], currentTime);
+			request.headers.set("Signature-Input", signatureInput);
+			const { keyCache } = createStaleKeyCache();
+			const documentLoader = createCountingKeyLoader();
+			assertEquals(await verifyRequest(request, {
+				documentLoader,
+				contextLoader: mockDocumentLoader,
+				currentTime,
+				keyCache
+			}), null, signatureInput);
+			assertEquals(documentLoader.loaded, [], signatureInput);
+		}
+	});
+	await t.step("refreshes a cached key of another algorithm family", async () => {
+		const keyId = ed25519PublicKey.id.href;
+		const request = await signRfc9421Many([keyId], currentTime);
+		const input = request.headers.get("Signature-Input");
+		request.headers.set("Signature-Input", /;alg="[^"]*"/.test(input) ? input.replace(/;alg="[^"]*"/, ";alg=\"ed25519\"") : `${input};alg="ed25519"`);
+		const { sig1 } = parseRfc9421SignatureInput(request.headers.get("Signature-Input"));
+		const signature = await crypto.subtle.sign("Ed25519", ed25519PrivateKey, new TextEncoder().encode(createRfc9421SignatureBase(request, sig1.components, sig1.parameters)));
+		request.headers.set("Signature", `sig1=:${encodeBase64(new Uint8Array(signature))}:`);
+		const loaded = [];
+		const result = await verifyRequestDetailed(request, {
+			documentLoader: (url, options) => {
+				loaded.push(url);
+				return mockDocumentLoader(url, options);
+			},
+			contextLoader: mockDocumentLoader,
+			currentTime,
+			keyCache: {
+				get: (id) => Promise.resolve(id.href === keyId ? rsaPublicKey1 : void 0),
+				set: () => Promise.resolve()
+			}
+		});
+		assert(result.verified);
+		assertEquals(result.key.id?.href, keyId);
+		assertEquals(loaded.length, 1);
+	});
+});
 test("verifyRequest() [rfc9421] manual POST verification", async () => {
 	const currentTimestamp = 1709626184;
 	const currentTime = Temporal.Instant.from("2024-03-05T08:09:44Z");
@@ -2166,6 +2555,29 @@ test("listRequestSignatures()", async (t) => {
 			"content-digest"
 		]);
 	});
+	await t.step("RFC 9421 beyond the limit", async () => {
+		const currentTime = Temporal.Instant.from("2024-03-05T08:09:44Z");
+		const signed = await signRfc9421Many([
+			1,
+			2,
+			3,
+			4
+		].map((n) => `https://example.com/key-${n}`), currentTime);
+		const headers = new Headers(signed.headers);
+		headers.set("Signature-Input", headers.get("Signature-Input").replace("https://example.com/key-1", "not a URL"));
+		const request = new Request(signed.url, {
+			method: "POST",
+			headers
+		});
+		const keyIds = (maxSignatures) => listRequestSignatures(request, maxSignatures).map((s) => s.keyId.href);
+		assertEquals(keyIds(), ["https://example.com/key-2", "https://example.com/key-3"]);
+		assertEquals(keyIds(1), []);
+		assertEquals(keyIds(Infinity), [
+			"https://example.com/key-2",
+			"https://example.com/key-3",
+			"https://example.com/key-4"
+		]);
+	});
 	await t.step("unsigned or malformed", () => {
 		assertEquals(listRequestSignatures(request()), []);
 		const malformed = request();
@@ -2208,5 +2620,65 @@ test("selectRequestSignature()", async () => {
 	assertEquals(await selected.text(), body);
 	assertEquals(await request.text(), body);
 });
+test("verifyRequestDetailed() reports a timed-out key fetch", async (t) => {
+	for (const stall of ["headers", "body"]) await t.step(`stalled ${stall}`, async () => {
+		esm_default.mockGlobal();
+		const keyId = new URL(`https://slow.example/actors/alice#${stall}`);
+		let requests = 0;
+		esm_default.get(`begin:https://slow.example/actors/alice`, () => {
+			requests++;
+			if (stall === "headers") return new Promise(() => {});
+			return new Response(new ReadableStream({ pull: () => new Promise(() => {}) }), { status: 404 });
+		});
+		const loader = getDocumentLoader({
+			allowPrivateAddress: true,
+			timeout: 100
+		});
+		const documentLoader = (url, options) => url.startsWith("https://slow.example/") ? loader(url, options) : mockDocumentLoader(url);
+		const kv = new MemoryKvStore();
+		try {
+			const sign = () => signRequest(new Request("https://example.com/inbox", {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/activity+json",
+					accept: "application/ld+json"
+				},
+				body: JSON.stringify({
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Create",
+					actor: "https://slow.example/actors/alice"
+				})
+			}), rsaPrivateKey2, keyId);
+			const result = await verifyRequestDetailed(await sign(), {
+				contextLoader: mockDocumentLoader,
+				documentLoader,
+				keyCache: new KvKeyCache(kv, ["pk"])
+			});
+			assertFalse(result.verified);
+			assert(result.reason.type === "keyFetchError");
+			assertEquals(result.reason.keyId, keyId);
+			assert("error" in result.reason.result);
+			const error = result.reason.result.error;
+			assert(error instanceof FetchError);
+			assertEquals(error.response, void 0);
+			assert(error.cause instanceof DOMException);
+			assertEquals(error.cause.name, "TimeoutError");
+			assertEquals(requests, 1);
+			const cached = await verifyRequestDetailed(await sign(), {
+				contextLoader: mockDocumentLoader,
+				documentLoader,
+				keyCache: new KvKeyCache(kv, ["pk"])
+			});
+			assertFalse(cached.verified);
+			assert(cached.reason.type === "keyFetchError");
+			assert("error" in cached.reason.result);
+			assertEquals(cached.reason.result.error.name, "FetchError");
+			assertStringIncludes(cached.reason.result.error.message, "Timed out after 100 ms");
+			assertEquals(requests, 1);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+});
 //#endregion
 export {};

package/dist/sig/key-owner-evidence.test.mjs

@@ -5,8 +5,8 @@ import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { t as getCanonicalPortableId } from "../portable-key-id-Bg259c4Z.mjs";
-import { a as promoteKeyOwnerEvidence, i as parseKeyOwnerEvidence, n as attachKeyOwnerEvidence, r as getVerifiedKeyOwnerEvidence } from "../key-owner-evidence-Bo3yaeL5.mjs";
+import { n as getCanonicalPortableId } from "../portable-key-id-Ca30-hOa.mjs";
+import { a as promoteKeyOwnerEvidence, i as parseKeyOwnerEvidence, n as attachKeyOwnerEvidence, r as getVerifiedKeyOwnerEvidence } from "../key-owner-evidence-APB6NpSk.mjs";
 import { r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";

package/dist/sig/key.test.mjs

@@ -6,7 +6,7 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, i as fetchKey, n as exportJwk, o as generateCryptoKeyPair, s as importJwk } from "../key-gIhVZO3p.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, i as fetchKey, n as exportJwk, o as generateCryptoKeyPair, s as importJwk } from "../key-DA3Yx8p2.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/ld.test.mjs

@@ -8,8 +8,8 @@ import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { o as generateCryptoKeyPair } from "../key-gIhVZO3p.mjs";
-import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-BsTkRrwF.mjs";
+import { o as generateCryptoKeyPair } from "../key-DA3Yx8p2.mjs";
+import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-C15yzuY6.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/mod.cjs

@@ -1,7 +1,7 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_http = require("../http-5CJBdU8n.cjs");
-const require_portable_collection = require("../portable-collection-CnlCamup.cjs");
+const require_http = require("../http-BEivI0TS.cjs");
+const require_portable_collection = require("../portable-collection-BFSShzwh.cjs");
 exports.attachSignature = require_http.attachSignature;
 exports.createProof = require_http.createProof;
 exports.createSignature = require_http.createSignature;

package/dist/sig/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-DC1cqAQ2.cjs";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-BrwKINQn.cjs";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-BF0L9cMt.cjs";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-CPPqkyV_.cjs";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-DoTWIc7F.cjs";
 export { AcceptSignatureMember, AcceptSignatureParameters, CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-Cok5-vIC.js";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-DGx0KOws.js";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-BSzr5-I8.js";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod--jv6vyrP.js";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-Cy9VNHVw.js";
 export { AcceptSignatureMember, AcceptSignatureParameters, CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/mod.js

@@ -1,5 +1,5 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { A as hasSignatureLike, B as fetchKey, D as detachSignature, E as createSignature, F as verifyJsonLd, H as generateCryptoKeyPair, I as verifySignature, N as signJsonLd, R as exportJwk, U as importJwk, V as fetchKeyDetailed, _ as verifyPortableObjectProof, a as signRequest, b as verifyProof, f as createProof, g as verifyObject, gt as validateAcceptSignature, ht as parseAcceptSignature, m as signObject, mt as fulfillAcceptSignature, o as verifyRequest, p as hasProofLike, pt as formatAcceptSignature, s as verifyRequestDetailed, w as attachSignature } from "../http-BGpexPO7.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "../portable-collection-Bkdh_WpL.js";
+import { D as createSignature, H as fetchKeyDetailed, I as verifyJsonLd, L as verifySignature, O as detachSignature, P as signJsonLd, T as attachSignature, U as generateCryptoKeyPair, V as fetchKey, W as importJwk, _ as verifyObject, _t as validateAcceptSignature, a as signRequest, c as verifyRequestDetailed, gt as parseAcceptSignature, h as signObject, ht as fulfillAcceptSignature, j as hasSignatureLike, m as hasProofLike, mt as formatAcceptSignature, p as createProof, s as verifyRequest, v as verifyPortableObjectProof, x as verifyProof, z as exportJwk } from "../http-BGmxtpo2.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "../portable-collection-D535cSz_.js";
 export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };