@fedify/fedify 2.4.0-dev.2253 → 2.4.0-dev.2259

package/dist/sig/verification.test.mjs

@@ -0,0 +1,310 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { a as verificationObservation } from "../verification-Dpfcw8ml.mjs";
+import { h as verifyJsonLd, p as signJsonLd } from "../ld-UsN-TIPh.mjs";
+import { a as signObject, s as verifyObject } from "../proof-BHRf_jMG.mjs";
+import { l as signRequest, p as verifyRequestDetailed } from "../http-BqSbUEiQ.mjs";
+import { i as rsaPrivateKey2, n as ed25519PrivateKey, o as rsaPublicKey1, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
+import { Activity, Create, CryptographicKey, Multikey } from "@fedify/vocab";
+import { FetchError } from "@fedify/vocab-runtime";
+import { mockDocumentLoader, test } from "@fedify/fixture";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+//#region src/sig/verification.test.ts
+const loaders = {
+	documentLoader: mockDocumentLoader,
+	contextLoader: mockDocumentLoader
+};
+function observation() {
+	return { attempts: [] };
+}
+test("LDS evidence has no checks for absent or malformed signatures", async () => {
+	const json = await new Create({ actor: rsaPublicKey2.ownerId }).toJsonLd(loaders);
+	for (const signature of [
+		void 0,
+		null,
+		"invalid",
+		[],
+		{}
+	]) {
+		const evidence = observation();
+		strictEqual(await verifyJsonLd(signature === void 0 ? json : {
+			...json,
+			signature
+		}, {
+			...loaders,
+			[verificationObservation]: evidence
+		}), false);
+		const attempt = evidence.attempts[0];
+		ok(attempt.status === "rejected");
+		strictEqual(attempt.reason.type, signature === void 0 ? "noSignature" : "signatureVerificationFailed");
+		deepStrictEqual(attempt.checks, []);
+	}
+});
+test("signature evidence preserves stale and fresh HTTP keys for both specs", async () => {
+	for (const spec of ["draft-cavage-http-signatures-12", "rfc9421"]) {
+		const evidence = observation();
+		const signed = await signRequest(new Request("https://example.com/inbox", {
+			method: "POST",
+			body: "{}"
+		}), rsaPrivateKey2, rsaPublicKey2.id, { spec });
+		const stale = rsaPublicKey1.clone({ id: rsaPublicKey2.id });
+		strictEqual((await verifyRequestDetailed(signed, {
+			...loaders,
+			[verificationObservation]: evidence,
+			keyCache: {
+				get: () => Promise.resolve(stale),
+				set: () => Promise.resolve()
+			}
+		})).verified, true);
+		const attempt = evidence.attempts[0];
+		ok(attempt.status === "verified");
+		strictEqual(attempt.checks.length, 1);
+		const check = attempt.checks[0];
+		ok(check.status === "verified");
+		strictEqual(check.triedKeys.length, 2);
+		strictEqual(check.triedKeys[0].publicKey, rsaPublicKey1.publicKey);
+		deepStrictEqual(await crypto.subtle.exportKey("jwk", check.triedKeys[1].publicKey), await crypto.subtle.exportKey("jwk", rsaPublicKey2.publicKey));
+		strictEqual(check.key, check.triedKeys[1]);
+		strictEqual(attempt.signatures[0], check);
+	}
+});
+test("signature evidence retains the failed key when HTTP refresh cannot load", async () => {
+	for (const spec of ["draft-cavage-http-signatures-12", "rfc9421"]) {
+		const evidence = observation();
+		const signed = await signRequest(new Request("https://example.com/inbox", {
+			method: "POST",
+			body: "{}"
+		}), rsaPrivateKey2, rsaPublicKey2.id, { spec });
+		const response = new Response(null, { status: 410 });
+		strictEqual((await verifyRequestDetailed(signed, {
+			...loaders,
+			[verificationObservation]: evidence,
+			documentLoader: () => Promise.reject(new FetchError(rsaPublicKey2.id, "gone", response)),
+			keyCache: {
+				get: () => Promise.resolve(rsaPublicKey1.clone({ id: rsaPublicKey2.id })),
+				set: () => Promise.resolve()
+			}
+		})).verified, false);
+		const check = evidence.attempts[0].checks[0];
+		ok(check.status === "rejected");
+		strictEqual(check.reason.type, "keyFetchError");
+		strictEqual(check.triedKeys[0].publicKey, rsaPublicKey1.publicKey);
+	}
+});
+test("signature evidence preserves failed LDS keys and successful stale-key refresh", async () => {
+	const signed = await signJsonLd(await new Create({ actor: new URL("https://example.com/person") }).toJsonLd(loaders), rsaPrivateKey2, rsaPublicKey2.id, loaders);
+	const evidence = observation();
+	strictEqual(await verifyJsonLd(signed, {
+		...loaders,
+		[verificationObservation]: evidence,
+		keyCache: {
+			get: () => Promise.resolve(rsaPublicKey1.clone({ id: rsaPublicKey2.id })),
+			set: () => Promise.resolve()
+		}
+	}), false);
+	const attempt = evidence.attempts[0];
+	ok(attempt.status === "rejected");
+	strictEqual(attempt.reason.type, "missingOwner");
+	strictEqual(attempt.checks[0].status, "verified");
+	strictEqual(attempt.checks[0].triedKeys.length, 2);
+	const bad = observation();
+	strictEqual(await verifyJsonLd(signed, {
+		...loaders,
+		[verificationObservation]: bad,
+		documentLoader: async () => ({
+			contextUrl: null,
+			documentUrl: rsaPublicKey2.id.href,
+			document: await new CryptographicKey({
+				id: rsaPublicKey2.id,
+				publicKey: rsaPublicKey1.publicKey
+			}).toJsonLd(loaders)
+		})
+	}), false);
+	strictEqual(bad.attempts[0].checks[0].status, "rejected");
+	strictEqual(bad.attempts[0].checks[0].triedKeys.length, 1);
+});
+test("signature evidence preserves multiple valid proofs despite uncovered attribution", async () => {
+	const second = await signObject(await signObject(new Create({ actor: new URL("https://example.com/person") }), ed25519PrivateKey, ed25519Multikey.id, loaders), ed25519PrivateKey, ed25519Multikey.id, loaders);
+	const evidence = observation();
+	strictEqual(await verifyObject(Activity, await second.toJsonLd(loaders), {
+		...loaders,
+		[verificationObservation]: evidence
+	}), null);
+	const attempt = evidence.attempts[0];
+	ok(attempt.status === "rejected");
+	strictEqual(attempt.reason.type, "uncoveredAttribution");
+	strictEqual(attempt.checks.length, 2);
+	ok(attempt.checks.every((check) => check.status === "verified"));
+});
+test("signature evidence preserves OIP stale keys when fresh verification fails", async () => {
+	const signed = await signObject(new Create({ actor: ed25519Multikey.controllerId }), ed25519PrivateKey, ed25519Multikey.id, loaders);
+	const pair = await crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
+	const stale = new Multikey({
+		id: ed25519Multikey.id,
+		controller: null,
+		publicKey: pair.publicKey
+	});
+	const evidence = observation();
+	strictEqual(await verifyObject(Activity, await signed.toJsonLd(loaders), {
+		...loaders,
+		[verificationObservation]: evidence,
+		keyCache: {
+			get: () => Promise.resolve(stale),
+			set: () => Promise.resolve()
+		},
+		documentLoader: async () => ({
+			contextUrl: null,
+			documentUrl: ed25519Multikey.id.href,
+			document: await stale.toJsonLd(loaders)
+		})
+	}), null);
+	const check = evidence.attempts[0].checks[0];
+	strictEqual(check.status, "rejected");
+	strictEqual(check.triedKeys.length, 2);
+	strictEqual(check.triedKeys[0].publicKey, pair.publicKey);
+});
+test("OIP check preserves the literal declared key ID", async () => {
+	const json = await (await signObject(new Create({ actor: ed25519Multikey.controllerId }), ed25519PrivateKey, ed25519Multikey.id, loaders)).toJsonLd(loaders);
+	const proof = json.proof;
+	const declaredKeyId = "https://EXAMPLE.com/person2#key4";
+	proof.verificationMethod = declaredKeyId;
+	const evidence = observation();
+	await verifyObject(Activity, json, {
+		...loaders,
+		[verificationObservation]: evidence
+	});
+	strictEqual(evidence.attempts[0].checks[0].declaredKeyId, declaredKeyId);
+});
+test("signature observation cannot turn a cached miss into a metadata exception", async () => {
+	const json = await signJsonLd(await new Create({ actor: new URL("https://example.com/person") }).toJsonLd(loaders), rsaPrivateKey2, rsaPublicKey2.id, loaders);
+	const evidence = observation();
+	const cache = {
+		get: () => Promise.resolve(null),
+		set: () => Promise.resolve(),
+		getFetchError: () => Promise.reject(/* @__PURE__ */ new Error("diagnostic unavailable"))
+	};
+	strictEqual(await verifyJsonLd(json, {
+		...loaders,
+		keyCache: cache,
+		[verificationObservation]: evidence
+	}), false);
+	strictEqual(evidence.attempts[0].checks[0].status, "rejected");
+});
+test("signature observation preserves rejection for consumed fetch-error responses", async () => {
+	const json = await signJsonLd(await new Create({ actor: new URL("https://example.com/person") }).toJsonLd(loaders), rsaPrivateKey2, rsaPublicKey2.id, loaders);
+	const response = new Response("gone", { status: 410 });
+	await response.text();
+	const error = new FetchError(rsaPublicKey2.id, "gone", response);
+	const options = {
+		...loaders,
+		documentLoader: () => Promise.reject(error)
+	};
+	strictEqual(await verifyJsonLd(json, options), false);
+	const evidence = observation();
+	strictEqual(await verifyJsonLd(json, {
+		...options,
+		[verificationObservation]: evidence
+	}), false);
+	const check = evidence.attempts[0].checks[0];
+	ok(check.status === "rejected" && check.reason.type === "keyFetchError");
+	let cloneThrows = false;
+	try {
+		response.clone();
+	} catch {
+		cloneThrows = true;
+	}
+	if (cloneThrows) {
+		ok("error" in check.reason.result);
+		strictEqual(check.reason.result.error, error);
+	} else {
+		ok("status" in check.reason.result);
+		strictEqual(check.reason.result.status, 410);
+	}
+});
+test("OIP check retains aliased declarations without extra context fetches", async () => {
+	const json = await (await signObject(new Create({ actor: ed25519Multikey.controllerId }), ed25519PrivateKey, ed25519Multikey.id, loaders)).toJsonLd(loaders);
+	const proof = json.proof;
+	const context = { vm: {
+		"@id": "https://w3id.org/security#verificationMethod",
+		"@type": "@id"
+	} };
+	const contextUrl = "https://example.com/custom-proof-context";
+	json["@context"] = [...json["@context"], contextUrl];
+	proof["@context"] = [...proof["@context"], contextUrl];
+	const declaredKeyId = "https://EXAMPLE.com/person2#key4";
+	proof.vm = declaredKeyId;
+	delete proof.verificationMethod;
+	const run = async (evidence) => {
+		let fetches = 0;
+		await verifyObject(Activity, structuredClone(json), {
+			...loaders,
+			contextLoader: async (url, options) => {
+				fetches++;
+				if (url === contextUrl) return {
+					contextUrl: null,
+					documentUrl: url,
+					document: { "@context": context }
+				};
+				return await mockDocumentLoader(url, options);
+			},
+			...evidence == null ? {} : { [verificationObservation]: evidence }
+		});
+		return fetches;
+	};
+	const baselineFetches = await run();
+	const evidence = observation();
+	strictEqual(await run(evidence), baselineFetches);
+	strictEqual(evidence.attempts[0].checks[0].declaredKeyId, declaredKeyId);
+});
+test("OIP check preserves compact node identifiers and their aliases", async () => {
+	for (const idProperty of [
+		"id",
+		"rawId",
+		"scopedId"
+	]) {
+		const json = await (await signObject(new Create({ actor: ed25519Multikey.controllerId }), ed25519PrivateKey, ed25519Multikey.id, loaders)).toJsonLd(loaders);
+		const proof = json.proof;
+		const context = {
+			rawId: "@id",
+			vm: {
+				"@id": "https://w3id.org/security#verificationMethod",
+				"@type": "@id",
+				"@context": { scopedId: "@id" }
+			}
+		};
+		json["@context"] = [...json["@context"], context];
+		proof["@context"] = [...proof["@context"], context];
+		const declaredKeyId = "https://EXAMPLE.com/person2#key4";
+		if (idProperty === "scopedId") {
+			proof.vm = { [idProperty]: declaredKeyId };
+			delete proof.verificationMethod;
+		} else proof.verificationMethod = { [idProperty]: declaredKeyId };
+		const evidence = observation();
+		await verifyObject(Activity, json, {
+			...loaders,
+			[verificationObservation]: evidence
+		});
+		strictEqual(evidence.attempts[0].checks[0].declaredKeyId, declaredKeyId);
+	}
+});
+test("signature evidence excludes keys loaded before canonicalization errors", async () => {
+	const json = await (await signObject(new Create({ actor: ed25519Multikey.controllerId }), ed25519PrivateKey, ed25519Multikey.id, loaders)).toJsonLd(loaders);
+	json.extra = JSON.parse("1e400");
+	const evidence = observation();
+	let thrown = false;
+	try {
+		await verifyObject(Activity, json, {
+			...loaders,
+			[verificationObservation]: evidence
+		});
+	} catch {
+		thrown = true;
+	}
+	strictEqual(thrown, true);
+	const check = evidence.attempts[0].checks[0];
+	strictEqual(check.status, "error");
+	deepStrictEqual(check.triedKeys, []);
+});
+//#endregion
+export {};

package/dist/{temporal-CBVv0xRB.mjs → temporal-BRFH_dte.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-Dx8r_qJU.mjs";
+import { c as getNormalizationContextLoader } from "./ld-UsN-TIPh.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {

package/dist/testing/kv.test.mjs

@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { n as baseOptions, o as stringSchema, t as MockQueue } from "../tasks-IG3pHfvZ.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
-import { o as createFederation } from "../middleware-B0RRI88k.mjs";
+import { o as createFederation } from "../middleware-CkjwiEBd.mjs";
 //#region src/testing/kv.test.ts
 test("ManualClockKvStore keeps an entry at its exact expiration instant", async () => {
 	const kv = new ManualClockKvStore();