@fedify/fedify 2.4.0-dev.2256 → 2.4.0-dev.2259

package/dist/{key-CEsu7oaD.mjs → key-DecAtABm.mjs}

@@ -2,8 +2,9 @@ import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { c as isPortableActorDocument, d as isPortableUri, l as isPortableId, m as parseKeyIdString, s as isCompatibleKeyId } from "./portable-key-id-Ca30-hOa.mjs";
-import { n as version, t as name } from "./deno-AmcRMq5z.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-CocsZP0E.mjs";
+import { a as verificationObservation } from "./verification-Dpfcw8ml.mjs";
+import { n as version, t as name } from "./deno-C8XaXmPB.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-DWCn4VXX.mjs";
 import { n as attachKeyOwnerEvidence, t as MAX_PORTABLE_KEY_TTL } from "./key-owner-evidence-APB6NpSk.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";
@@ -898,12 +899,38 @@ async function fetchPortableActorKey(cacheKey, cls, options, onCachedUnavailable
 	};
 }
 async function fetchKeyInternal(keyId, cls, options = {}) {
-	return await fetchKeyWithResult(typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
+	return await fetchKeyWithResult(typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId, cls, options, async (_cacheKey, _keyId, _keyCache, _logger) => {
+		const check = options[verificationObservation]?.check;
+		if (check != null) try {
+			const result = await _keyCache?.getFetchError?.(_cacheKey);
+			if (result != null) check.reason = {
+				type: "keyFetchError",
+				keyId: new URL(_cacheKey.href),
+				result
+			};
+		} catch {}
 		return {
 			key: null,
 			cached: true
 		};
 	}, async (error, cacheKey, keyId, keyCache, logger) => {
+		const check = options[verificationObservation]?.check;
+		if (check != null) {
+			let result;
+			try {
+				result = error instanceof FetchError && error.response != null ? {
+					status: error.response.status,
+					response: error.response.clone()
+				} : { error: error instanceof Error ? error : new Error(String(error)) };
+			} catch {
+				result = { error: error instanceof Error ? error : /* @__PURE__ */ new Error() };
+			}
+			check.reason = {
+				type: "keyFetchError",
+				keyId: new URL(cacheKey.href),
+				result
+			};
+		}
 		logger.debug("Failed to fetch key {keyId}.", {
 			keyId,
 			error

package/dist/{kv-cache-CJS4mImS.mjs → kv-cache-CWWlMv-s.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-CocsZP0E.mjs";
+import { p as recordDocumentCache } from "./metrics-DWCn4VXX.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-BEWuZSB4.cjs → kv-cache-D73yVcE5.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-1fZ83jj7.cjs");
+const require_http = require("./http-Cki-npuA.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");

package/dist/{kv-cache-CGhEgt98.js → kv-cache-J0v3UbUn.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { G as validateCryptoKey, ot as recordDocumentCache, t as doubleKnock } from "./http-BGb3QioZ.js";
+import { G as validateCryptoKey, ot as recordDocumentCache, t as doubleKnock } from "./http-OMtKlbx1.js";
 import { getLogger } from "@logtape/logtape";
 import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, resolveDocumentLoaderTimeout, validatePublicUrl, withDocumentLoaderTimeout } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";

package/dist/{ld-Cf4CPWN_.mjs → ld-UsN-TIPh.mjs}

@@ -1,9 +1,10 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-AmcRMq5z.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CocsZP0E.mjs";
-import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-CEsu7oaD.mjs";
+import { a as verificationObservation, i as triedKey, n as observeCheck, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
+import { n as version, t as name } from "./deno-C8XaXmPB.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DWCn4VXX.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-DecAtABm.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -450,6 +451,13 @@ function detachSignature(jsonLd) {
 */
 async function verifySignature(jsonLd, options = {}) {
 	if (!hasSignature(jsonLd)) return null;
+	if (options[verificationObservation]?.attempt != null && options[verificationObservation]?.check == null) {
+		const declared = getLdSignatureObject(jsonLd)?.creator;
+		return await observeCheck(options, { mechanism: "linkedData" }, typeof declared === "string" ? declared : null, (observation) => verifySignature(jsonLd, {
+			...options,
+			[verificationObservation]: observation
+		}));
+	}
 	const sig = jsonLd.signature;
 	let signature;
 	try {
@@ -495,6 +503,7 @@ async function verifySignature(jsonLd, options = {}) {
 	const encoder = new TextEncoder();
 	const message = sigOptsHash + docHash;
 	const messageBytes = encoder.encode(message);
+	triedKey(options, key);
 	if (await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes)) return key;
 	if (cached) {
 		logger.debug("Failed to verify with the cached key {keyId}; signature {signatureValue} is invalid.  Retrying with the freshly fetched key...", {
@@ -506,6 +515,7 @@ async function verifySignature(jsonLd, options = {}) {
 			keyCache: bypassKeyCacheReads(options.keyCache)
 		}));
 		if (key == null) return null;
+		triedKey(options, key);
 		return await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes) ? key : null;
 	}
 	logger.debug("Failed to verify with the fetched key {keyId}; signature {signatureValue} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
@@ -559,6 +569,14 @@ async function verifyCompactJsonLd(jsonLd, options = {}) {
 	return await verifyJsonLdInternal(jsonLd, options, false);
 }
 async function verifyJsonLdInternal(jsonLd, options, compact) {
+	if (options[verificationObservation]?.attempt == null) return await observeAttempt({
+		...options,
+		[verificationObservation]: options[verificationObservation] ?? { attempts: [] }
+	}, "linkedData", (observation) => verifyJsonLdInternal(jsonLd, {
+		...options,
+		[verificationObservation]: observation
+	}, compact), (value) => value);
+	const observation = options[verificationObservation];
 	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.verify", async (span) => {
 		const start = performance.now();
 		let verified = false;
@@ -571,6 +589,8 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 			} : options;
 			const compacted = compact ? hasSignature(jsonLd) ? await compactJsonLd(jsonLd, options.contextLoader) : jsonLd : jsonLd;
 			const object = await Object$1.fromJsonLd(compacted, verificationOptions);
+			observation?.parsedObject?.(object);
+			if (observation?.subject != null) observation.subject.id = object.id == null ? null : new URL(object.id.href);
 			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
 			span.setAttribute("activitypub.object.type", getTypeId(object).href);
 			const sig = getLdSignatureObject(jsonLd);
@@ -585,13 +605,21 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 			const attributions = new Set(object.attributionIds.map((uri) => uri.href));
 			if (object instanceof Activity) for (const uri of object.actorIds) attributions.add(uri.href);
 			const key = await verifySignature(compacted, verificationOptions);
-			if (key == null) return false;
+			if (key == null) {
+				if (observation?.attempt != null && !hasLdSignatureProperty(jsonLd)) observation.attempt.reason = { type: "noSignature" };
+				return false;
+			}
 			if (key.ownerId == null) {
+				if (observation?.attempt != null) observation.attempt.reason = { type: "missingOwner" };
 				logger.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
 				return false;
 			}
 			attributions.delete(key.ownerId.href);
 			if (attributions.size > 0) {
+				if (observation?.attempt != null) observation.attempt.reason = {
+					type: "uncoveredAttribution",
+					attributionIds: [...attributions].map((id) => new URL(id))
+				};
 				logger.debug("Some attributions are not authenticated by the Linked Data Signatures: {attributions}.", { attributions: [...attributions] });
 				return false;
 			}
@@ -605,8 +633,15 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 			});
 			throw error;
 		} finally {
+			if (observation?.attempt?.reason != null) {
+				span.setAttribute("activitypub.verification.failure_reason", observation.attempt.reason.type);
+				span.setStatus({ code: SpanStatusCode.ERROR });
+			}
 			const classified = threw ? "error" : verified ? "verified" : hasLdSignatureProperty(jsonLd) ? "rejected" : "missing";
-			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "linked_data", classified, { ldType: signatureType });
+			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "linked_data", classified, {
+				ldType: signatureType,
+				verificationFailureReason: verified || threw ? void 0 : observation?.attempt?.reason?.type ?? (hasLdSignatureProperty(jsonLd) ? "signatureVerificationFailed" : "noSignature")
+			});
 			span.end();
 		}
 	});

package/dist/{metrics-CocsZP0E.mjs → metrics-DWCn4VXX.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-AmcRMq5z.mjs";
+import { n as version, t as name } from "./deno-C8XaXmPB.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts
@@ -302,6 +302,7 @@ var FederationMetrics = class {
 		};
 		if (extra.algorithm != null) attributes["http_signatures.algorithm"] = extra.algorithm;
 		if (extra.failureReason != null) attributes["http_signatures.failure_reason"] = extra.failureReason;
+		if (extra.verificationFailureReason != null) attributes["activitypub.verification.failure_reason"] = extra.verificationFailureReason;
 		if (extra.ldType != null) attributes["ld_signatures.type"] = extra.ldType;
 		if (extra.cryptosuite != null) attributes["object_integrity_proofs.cryptosuite"] = extra.cryptosuite;
 		this.signatureVerificationDuration.record(durationMs, attributes);