@fedify/fedify 2.4.0-dev.2190 → 2.4.0-dev.2200

package/dist/sig/owner.test.mjs

@@ -6,7 +6,7 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-Dem4fbwc.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-DpxyMeo9.mjs";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 //#region src/sig/owner.test.ts

package/dist/sig/portable-collection.test.mjs

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { t as verifyPortableObject } from "../portable-collection-BL6aZlQ0.mjs";
+import { t as verifyPortableObject } from "../portable-collection-DOL3l2C9.mjs";
 import { Collection, CollectionPage, Note, OrderedCollection, Person, traverseCollection } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
 import { FetchError, encodeMultibase, exportDidKey, preloadedContexts } from "@fedify/vocab-runtime";

package/dist/sig/portable-key.test.mjs

@@ -2,13 +2,13 @@ import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
-import { a as fetchKeyDetailed, i as fetchKey } from "../key-DyXf88bq.mjs";
-import { h as verifyJsonLd, p as signJsonLd } from "../ld-oQj6j_hP.mjs";
-import { d as verifyProof, r as createProof } from "../proof-C9115DX_.mjs";
-import { n as resolvePortableActorKey } from "../portable-key-Duue9Y2Y.mjs";
-import { f as verifyRequest, l as signRequest, p as verifyRequestDetailed } from "../http-Y1ObT1A8.mjs";
+import { a as fetchKeyDetailed, i as fetchKey } from "../key-DYgoirTo.mjs";
+import { h as verifyJsonLd, p as signJsonLd } from "../ld-eIekvNtm.mjs";
+import { d as verifyProof, r as createProof } from "../proof-B9DEHHiO.mjs";
+import { n as resolvePortableActorKey } from "../portable-key-B8kTV4n8.mjs";
+import { f as verifyRequest, l as signRequest, p as verifyRequestDetailed } from "../http-BQq1Uldg.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-Dem4fbwc.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-DpxyMeo9.mjs";
 import { t as KvKeyCache } from "../keycache-Da8A8mZa.mjs";
 import { Create, CryptographicKey, Multikey, Note, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";

package/dist/sig/proof.test.mjs

@@ -10,10 +10,10 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { a as signObject, c as verifyPortableObjectProof, d as verifyProof, i as hasProofLike, r as createProof, s as verifyObject } from "../proof-C9115DX_.mjs";
-import { f as verifyRequest } from "../http-Y1ObT1A8.mjs";
+import { a as signObject, c as verifyPortableObjectProof, d as verifyProof, i as hasProofLike, r as createProof, s as verifyObject } from "../proof-B9DEHHiO.mjs";
+import { f as verifyRequest } from "../http-BQq1Uldg.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-u6zzOExF.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-U141HKIl.mjs";
 import { Create, DataIntegrityProof, Document, Multikey, Note, PUBLIC_COLLECTION, Place, Translation } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { decodeMultibase, encodeMultibase, exportDidKey, exportMultibaseKey, formatIri, importMultibaseKey, parseIri } from "@fedify/vocab-runtime";
@@ -33,6 +33,7 @@ const portableDid = await exportDidKey(ed25519PublicKey.publicKey);
 const portableDidMethod = portableDid.substring(8);
 const portableKeyId = new URL(`${portableDid}#${portableDidMethod}`);
 const portableContext = ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"];
+const portableActorContext = [...portableContext, "https://w3id.org/fep/ef61"];
 const portableProofCreated = "2023-02-24T23:36:38Z";
 async function signPortableJsonLd(document, { privateKey = ed25519PrivateKey, verificationMethod = portableKeyId, proofOptions = {} } = {}) {
 	const proofConfig = {
@@ -933,11 +934,12 @@ test("verifyPortableObjectProof()", async (t) => {
 	});
 	await t.step("verifies portable actors and activities by shape", async () => {
 		for (const document of [{
-			"@context": portableContext,
+			"@context": portableActorContext,
 			id: `ap+ef61://did:key:${portableDidMethod}/actor`,
 			type: "UnknownActorType",
 			inbox: "https://gateway.example/users/alice/inbox",
-			outbox: "https://gateway.example/users/alice/outbox"
+			outbox: "https://gateway.example/users/alice/outbox",
+			gateways: ["https://gateway.example"]
 		}, {
 			"@context": portableContext,
 			id: `ap://did:key:${portableDidMethod}/activities/1`,
@@ -950,6 +952,137 @@ test("verifyPortableObjectProof()", async (t) => {
 			assertEquals(result.keys.length, 1);
 		}
 	});
+	await t.step("requires portable actors to have valid gateways", async () => {
+		const actorIds = [
+			`ap://did:key:${portableDidMethod}/actor`,
+			`ap+ef61://did%3Akey%3A${portableDidMethod}/actor`,
+			`https://gateway.example/.well-known/apgateway/did:key:${portableDidMethod}/actor`
+		];
+		const actor = (id, extra) => ({
+			"@context": portableActorContext,
+			id,
+			type: "Person",
+			inbox: `${id}/inbox`,
+			outbox: `${id}/outbox`,
+			...extra
+		});
+		const validGateways = [
+			["https://gateway.example"],
+			["https://gateway.example/"],
+			["https://gateway.example", "http://other.example:8080"]
+		];
+		const invalidGateways = [
+			{},
+			{ gateways: [] },
+			{ gateways: ["https://gateway.example/path"] },
+			{ gateways: ["https://gateway.example/?query"] },
+			{ gateways: ["https://gateway.example/#fragment"] },
+			{ gateways: ["ftp://gateway.example"] },
+			{ gateways: ["https://user:password@gateway.example"] },
+			{ gateways: ["gateway.example"] },
+			{ gateways: ["https://gateway.example", "https://other.example/path"] }
+		];
+		for (const id of actorIds) {
+			for (const gateways of validGateways) assert((await verifyPortableObjectProof(await signPortableJsonLd(actor(id, { gateways })), options)).verified, `${id} with ${gateways}`);
+			for (const extra of invalidGateways) assertEquals(await verifyPortableObjectProof(await signPortableJsonLd(actor(id, extra)), options), {
+				verified: false,
+				reason: { type: "invalidGateways" }
+			}, `${id} with ${JSON.stringify(extra)}`);
+		}
+	});
+	await t.step("reads gateways in any JSON-LD form", async () => {
+		const id = `ap://did:key:${portableDidMethod}/actor`;
+		const property = "https://w3id.org/fep/ef61/gateways";
+		const documents = [
+			{
+				"@context": portableContext,
+				[property]: { "@list": [{ "@id": "https://gateway.example" }] }
+			},
+			{
+				"@context": portableContext,
+				[property]: "https://gateway.example"
+			},
+			{
+				"@context": [...portableContext, { relays: {
+					"@id": property,
+					"@type": "@id",
+					"@container": "@list"
+				} }],
+				relays: ["https://gateway.example"]
+			}
+		];
+		for (const document of documents) assert((await verifyPortableObjectProof(await signPortableJsonLd({
+			...document,
+			id,
+			type: "Person",
+			inbox: `${id}/inbox`,
+			outbox: `${id}/outbox`
+		}), options)).verified, JSON.stringify(document));
+		assertEquals(await verifyPortableObjectProof(await signPortableJsonLd({
+			"@context": portableContext,
+			id,
+			type: "Person",
+			inbox: `${id}/inbox`,
+			outbox: `${id}/outbox`,
+			[property]: [{ "@list": [{ "@id": "https://gateway.example" }] }, { "@list": [{ "@id": "https://other.example" }] }]
+		}), options), {
+			verified: false,
+			reason: { type: "invalidGateways" }
+		});
+	});
+	await t.step("checks gateways only for FEP-2277 actors", async () => {
+		assert((await verifyPortableObjectProof(await signPortableJsonLd({
+			"@context": portableContext,
+			id: `ap://did:key:${portableDidMethod}/actor`,
+			type: "Person",
+			inbox: `ap://did:key:${portableDidMethod}/actor/inbox`
+		}), options)).verified);
+		assert((await verifyPortableObjectProof(await signPortableJsonLd(unsignedObject), options)).verified);
+	});
+	await t.step("checks gateways after the proof shape and before the keys", async () => {
+		const id = `ap://did:key:${portableDidMethod}/actor`;
+		const document = {
+			"@context": portableActorContext,
+			id,
+			type: "Person",
+			inbox: `${id}/inbox`,
+			outbox: `${id}/outbox`
+		};
+		assertEquals(await verifyPortableObjectProof(document, options), {
+			verified: false,
+			reason: { type: "missingProof" }
+		});
+		const keyIds = [];
+		const keyCache = {
+			get(keyId) {
+				keyIds.push(keyId.href);
+				return Promise.resolve(void 0);
+			},
+			set(keyId) {
+				keyIds.push(keyId.href);
+				return Promise.resolve();
+			}
+		};
+		assertEquals(await verifyPortableObjectProof({
+			...await signPortableJsonLd(document),
+			name: "Tampered"
+		}, {
+			...options,
+			keyCache
+		}), {
+			verified: false,
+			reason: { type: "invalidGateways" }
+		});
+		assertEquals(keyIds, []);
+		assert((await verifyPortableObjectProof(await signPortableJsonLd({
+			...document,
+			gateways: ["https://gateway.example"]
+		}), {
+			...options,
+			keyCache
+		})).verified);
+		assert(keyIds.length > 0);
+	});
 	await t.step("uses the normative FEP-2277 precedence order", async () => {
 		for (const document of [{
 			"@context": portableContext,
@@ -1067,11 +1200,12 @@ test("verifyPortableObjectProof()", async (t) => {
 	await t.step("treats compatible identifiers as portable IDs", async () => {
 		const compatibleActorId = `https://gateway.example/.well-known/apgateway/did:key:${portableDidMethod}/actor`;
 		const actor = {
-			"@context": portableContext,
+			"@context": portableActorContext,
 			id: compatibleActorId,
 			type: "Person",
 			inbox: `${compatibleActorId}/inbox`,
-			outbox: `${compatibleActorId}/outbox`
+			outbox: `${compatibleActorId}/outbox`,
+			gateways: ["https://gateway.example"]
 		};
 		const signed = await signPortableJsonLd(actor);
 		const result = await verifyPortableObjectProof(signed, options);

package/dist/{temporal-DKchpKyp.mjs → temporal-Cc1ymEup.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-oQj6j_hP.mjs";
+import { c as getNormalizationContextLoader } from "./ld-eIekvNtm.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {

package/dist/testing/kv.test.mjs

@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { n as baseOptions, o as stringSchema, t as MockQueue } from "../tasks-IG3pHfvZ.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
-import { o as createFederation } from "../middleware-Bdu2-OPD.mjs";
+import { o as createFederation } from "../middleware-BbTJ6C1-.mjs";
 //#region src/testing/kv.test.ts
 test("ManualClockKvStore keeps an entry at its exact expiration instant", async () => {
 	const kv = new ManualClockKvStore();

package/dist/utils/docloader.test.mjs

@@ -5,9 +5,9 @@ import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
-import { f as verifyRequest } from "../http-Y1ObT1A8.mjs";
+import { f as verifyRequest } from "../http-BQq1Uldg.mjs";
 import { i as rsaPrivateKey2 } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-u6zzOExF.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-U141HKIl.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";

package/dist/utils/kv-cache.test.mjs

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as kvCache, t as MockKvStore } from "../kv-cache-C8YjNAi_.mjs";
+import { n as kvCache, t as MockKvStore } from "../kv-cache-D0Mn-VQW.mjs";
 import { deepStrictEqual, throws } from "node:assert";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { preloadedContexts } from "@fedify/vocab-runtime";

package/dist/utils/mod.cjs

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_kv_cache = require("../kv-cache-DUXluAc0.cjs");
+const require_kv_cache = require("../kv-cache-f_GNq0e7.cjs");
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.kvCache = require_kv_cache.kvCache;

package/dist/utils/mod.js

@@ -1,4 +1,4 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-C02XitwK.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-Bpnt_Cck.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "2.4.0-dev.2190+be3a8be0",
+  "version": "2.4.0-dev.2200+e588a43c",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",
@@ -151,10 +151,10 @@
     "structured-field-values": "^2.0.4",
     "temporal-polyfill": "^1.0.1",
     "urlpattern-polyfill": "^10.1.0",
-    "@fedify/uri-template": "2.4.0-dev.2190+be3a8be0",
-    "@fedify/vocab-runtime": "2.4.0-dev.2190+be3a8be0",
-    "@fedify/vocab": "2.4.0-dev.2190+be3a8be0",
-    "@fedify/webfinger": "2.4.0-dev.2190+be3a8be0"
+    "@fedify/uri-template": "2.4.0-dev.2200+e588a43c",
+    "@fedify/vocab": "2.4.0-dev.2200+e588a43c",
+    "@fedify/vocab-runtime": "2.4.0-dev.2200+e588a43c",
+    "@fedify/webfinger": "2.4.0-dev.2200+e588a43c"
   },
   "devDependencies": {
     "@std/assert": "npm:@jsr/std__assert@^0.226.0",
@@ -167,7 +167,7 @@
     "typescript": "^6.0.0",
     "wrangler": "^4.17.0",
     "@fedify/fixture": "2.0.0",
-    "@fedify/vocab-tools": "^2.4.0-dev.2190+be3a8be0"
+    "@fedify/vocab-tools": "^2.4.0-dev.2200+e588a43c"
   },
   "scripts": {
     "build:self": "tsdown",