@fedify/fedify 2.4.0-dev.2256 → 2.4.0-dev.2259

package/dist/{http-DkqWu-sm.mjs → http-BqSbUEiQ.mjs}

@@ -2,12 +2,13 @@ import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { m as parseKeyIdString } from "./portable-key-id-Ca30-hOa.mjs";
-import { n as version, t as name } from "./deno-AmcRMq5z.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CocsZP0E.mjs";
+import { a as verificationObservation, i as triedKey, n as observeCheck, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
+import { n as version, t as name } from "./deno-C8XaXmPB.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DWCn4VXX.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
 import { a as promoteKeyOwnerEvidence } from "./key-owner-evidence-APB6NpSk.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-CEsu7oaD.mjs";
-import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-woGH_1nn.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-DecAtABm.mjs";
+import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-LlMkP-vz.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -478,6 +479,14 @@ async function verifyRequest(request, options = {}) {
 * @since 2.1.0
 */
 async function verifyRequestDetailed(request, options = {}) {
+	if (options[verificationObservation] != null && options[verificationObservation]?.attempt == null) return await observeAttempt(options, "http", async (observation) => {
+		const result = await verifyRequestDetailed(request, {
+			...options,
+			[verificationObservation]: observation
+		});
+		if (!result.verified) observation.attempt.reason = result.reason.type === "noSignature" ? { type: "noSignature" } : { type: "signatureVerificationFailed" };
+		return result;
+	}, (result) => result.verified);
 	if (options.maxSignatures !== void 0) validateMaxSignatures(options.maxSignatures, "maxSignatures");
 	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("http_signatures.verify", async (span) => {
 		if (span.isRecording()) {
@@ -516,7 +525,27 @@ async function verifyRequestDetailed(request, options = {}) {
 		}
 	});
 }
-async function verifyRequestDraft(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, meterProvider, tracerProvider } = {}) {
+async function verifyRequestDraft(request, span, metricsContext, options = {}) {
+	if (options[verificationObservation]?.check != null) return await verifyRequestDraftInternal(request, span, metricsContext, options);
+	let result = noSignatureResult();
+	const raw = request.headers.get("Signature");
+	const declared = raw == null ? null : parseDraftSignature(raw)?.keyId ?? null;
+	if (raw == null) return result;
+	await observeCheck(options, {
+		mechanism: "http",
+		spec: "draft-cavage-http-signatures-12",
+		label: null
+	}, declared, async (observation) => {
+		result = await verifyRequestDraftInternal(request, span, metricsContext, {
+			...options,
+			[verificationObservation]: observation
+		});
+		if (!result.verified && result.reason.type === "keyFetchError" && observation.check != null) observation.check.reason = result.reason;
+		return result.verified ? result.key : null;
+	});
+	return result;
+}
+async function verifyRequestDraftInternal(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, meterProvider, tracerProvider, [verificationObservation]: observation } = {}) {
 	const logger = getLogger([
 		"fedify",
 		"sig",
@@ -697,6 +726,7 @@ async function verifyRequestDraft(request, span, metricsContext, { documentLoade
 	const message = headerNames.map((name) => `${name}: ` + (name === "(request-target)" ? `${request.method.toLowerCase()} ${new URL(request.url).pathname}` : name === "(created)" ? sigValues.created ?? "" : name === "(expires)" ? sigValues.expires ?? "" : name === "host" ? request.headers.get("host") ?? new URL(request.url).host : request.headers.get(name))).join("\n");
 	const sig = decodeBase64(signature);
 	span?.setAttribute("http_signatures.signature", encodeHex(sig));
+	triedKey({ [verificationObservation]: observation }, key);
 	if (!await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message))) {
 		if (cached) {
 			logger.debug("Failed to verify with the cached key {keyId}; signature {signature} is invalid.  Retrying with the freshly fetched key...", {
@@ -711,7 +741,8 @@ async function verifyRequestDraft(request, span, metricsContext, { documentLoade
 				currentTime,
 				keyCache: bypassKeyCacheReads(keyCache),
 				meterProvider,
-				tracerProvider
+				tracerProvider,
+				[verificationObservation]: observation
 			});
 		}
 		logger.debug("Failed to verify with the fetched key {keyId}; signature {signature} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
@@ -797,7 +828,7 @@ async function verifyRfc9421ContentDigest(digestHeader, body) {
 * @returns Whether the signature is verified, and the algorithm of the
 *          signature if it is supported.
 */
-async function verifyRfc9421SignatureWithKey(request, sigInput, sigBytes, key, span) {
+async function verifyRfc9421SignatureWithKey(request, sigInput, sigBytes, key, span, observationOptions = {}) {
 	const logger = getLogger([
 		"fedify",
 		"sig",
@@ -853,6 +884,7 @@ async function verifyRfc9421SignatureWithKey(request, sigInput, sigBytes, key, s
 	}
 	let verified;
 	try {
+		triedKey(observationOptions, key);
 		verified = await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes);
 	} catch (error) {
 		logger.debug("Error during signature verification: {error}", {
@@ -880,7 +912,7 @@ async function verifyRfc9421SignatureWithKey(request, sigInput, sigBytes, key, s
 		mismatched: true
 	};
 }
-async function verifyRequestRfc9421(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, maxSignatures = 3, meterProvider, tracerProvider } = {}) {
+async function verifyRequestRfc9421(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, maxSignatures = 3, [verificationObservation]: observation, meterProvider, tracerProvider } = {}) {
 	const logger = getLogger([
 		"fedify",
 		"sig",
@@ -944,105 +976,116 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 	let body = null;
 	let digestValid = null;
 	for (const sigName of signatureNames) {
-		if (!signatures[sigName]) {
-			setFailure(invalidSignatureResult(parseKeyId(signatureInputs[sigName]?.keyId)));
-			continue;
-		}
-		const sigInput = signatureInputs[sigName];
-		const sigBytes = signatures[sigName];
-		const keyId = parseKeyId(sigInput.keyId);
-		if (!sigInput.keyId) {
-			logger.debug("Failed to verify; missing keyId in signature {signatureName}.", {
-				signatureName: sigName,
-				signatureInput: signatureInputHeader
-			});
-			setFailure(invalidSignatureResult(null));
-			continue;
-		}
-		if (!sigInput.created) {
-			logger.debug("Failed to verify; missing created timestamp in signature {signatureName}.", {
-				signatureName: sigName,
-				signatureInput: signatureInputHeader
-			});
-			setFailure(invalidSignatureResult(keyId));
-			continue;
-		}
-		const signatureCreated = Temporal.Instant.fromEpochMilliseconds(sigInput.created * 1e3);
-		const now = currentTime ?? Temporal.Now.instant();
-		if (timeWindow !== false) {
-			const tw = timeWindow ?? { hours: 1 };
-			if (Temporal.Instant.compare(signatureCreated, now.add(tw)) > 0) {
-				logger.debug("Failed to verify; signature created time is too far in the future.", {
-					created: signatureCreated.toString(),
-					now: now.toString()
-				});
-				setFailure(invalidSignatureResult(keyId));
-				continue;
-			} else if (Temporal.Instant.compare(signatureCreated, now.subtract(tw)) < 0) {
-				logger.debug("Failed to verify; signature created time is too far in the past.", {
-					created: signatureCreated.toString(),
-					now: now.toString()
-				});
-				setFailure(invalidSignatureResult(keyId));
-				continue;
+		let winning;
+		await observeCheck({ [verificationObservation]: observation }, {
+			mechanism: "http",
+			spec: "rfc9421",
+			label: sigName
+		}, signatureInputs[sigName]?.keyId ?? null, async (candidateObservation) => {
+			if (!signatures[sigName]) {
+				setFailure(invalidSignatureResult(parseKeyId(signatureInputs[sigName]?.keyId)));
+				return null;
 			}
-		}
-		if (request.method !== "GET" && request.method !== "HEAD" && sigInput.components.some((c) => c.value === "content-digest")) {
-			const contentDigestHeader = request.headers.get("Content-Digest");
-			if (!contentDigestHeader) {
-				logger.debug("Failed to verify; Content-Digest header required but not found.", { components: sigInput.components });
-				setFailure(invalidSignatureResult(keyId));
-				continue;
+			const sigInput = signatureInputs[sigName];
+			const sigBytes = signatures[sigName];
+			const keyId = parseKeyId(sigInput.keyId);
+			if (!sigInput.keyId) {
+				logger.debug("Failed to verify; missing keyId in signature {signatureName}.", {
+					signatureName: sigName,
+					signatureInput: signatureInputHeader
+				});
+				setFailure(invalidSignatureResult(null));
+				return null;
 			}
-			body ??= await request.arrayBuffer();
-			digestValid ??= await verifyRfc9421ContentDigest(contentDigestHeader, body);
-			if (!digestValid) {
-				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
+			if (!sigInput.created) {
+				logger.debug("Failed to verify; missing created timestamp in signature {signatureName}.", {
+					signatureName: sigName,
+					signatureInput: signatureInputHeader
+				});
 				setFailure(invalidSignatureResult(keyId));
-				continue;
+				return null;
 			}
-		}
-		span?.setAttribute("http_signatures.key_id", sigInput.keyId);
-		span?.setAttribute("http_signatures.created", sigInput.created.toString());
-		if (keyId == null) {
-			setFailure(invalidSignatureResult(null));
-			continue;
-		}
-		let lookup = keyLookups.get(keyId.href);
-		if (lookup == null) {
-			lookup = await lookUpKey(keyId, keyCache);
-			keyLookups.set(keyId.href, lookup);
-		}
-		while (true) {
-			const { key, cached, fetchError } = lookup;
-			if (fetchError != null) {
-				setFailure(keyFetchErrorResult(keyId, fetchError));
-				break;
+			const signatureCreated = Temporal.Instant.fromEpochMilliseconds(sigInput.created * 1e3);
+			const now = currentTime ?? Temporal.Now.instant();
+			if (timeWindow !== false) {
+				const tw = timeWindow ?? { hours: 1 };
+				if (Temporal.Instant.compare(signatureCreated, now.add(tw)) > 0) {
+					logger.debug("Failed to verify; signature created time is too far in the future.", {
+						created: signatureCreated.toString(),
+						now: now.toString()
+					});
+					setFailure(invalidSignatureResult(keyId));
+					return null;
+				} else if (Temporal.Instant.compare(signatureCreated, now.subtract(tw)) < 0) {
+					logger.debug("Failed to verify; signature created time is too far in the past.", {
+						created: signatureCreated.toString(),
+						now: now.toString()
+					});
+					setFailure(invalidSignatureResult(keyId));
+					return null;
+				}
 			}
-			if (!key) {
-				logger.debug("Failed to fetch key: {keyId}", { keyId: sigInput.keyId });
-				setFailure(invalidSignatureResult(keyId));
-				break;
+			if (request.method !== "GET" && request.method !== "HEAD" && sigInput.components.some((c) => c.value === "content-digest")) {
+				const contentDigestHeader = request.headers.get("Content-Digest");
+				if (!contentDigestHeader) {
+					logger.debug("Failed to verify; Content-Digest header required but not found.", { components: sigInput.components });
+					setFailure(invalidSignatureResult(keyId));
+					return null;
+				}
+				body ??= await request.arrayBuffer();
+				digestValid ??= await verifyRfc9421ContentDigest(contentDigestHeader, body);
+				if (!digestValid) {
+					logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
+					setFailure(invalidSignatureResult(keyId));
+					return null;
+				}
 			}
-			const result = await verifyRfc9421SignatureWithKey(request, sigInput, sigBytes, key, span);
-			if (result.verified) {
-				metricsContext.algorithm = result.algorithm;
-				return {
-					verified: true,
-					key,
-					signatureLabel: sigName
-				};
+			span?.setAttribute("http_signatures.key_id", sigInput.keyId);
+			span?.setAttribute("http_signatures.created", sigInput.created.toString());
+			if (keyId == null) {
+				setFailure(invalidSignatureResult(null));
+				return null;
 			}
-			if (result.mismatched && cached && !refreshedKeyIds.has(keyId.href)) {
-				logger.debug("Failed to verify with cached key {keyId}; retrying with fresh key...", { keyId: sigInput.keyId });
-				refreshedKeyIds.add(keyId.href);
-				lookup = await lookUpKey(keyId, bypassKeyCacheReads(keyCache));
+			let lookup = keyLookups.get(keyId.href);
+			if (lookup == null) {
+				lookup = await lookUpKey(keyId, keyCache);
 				keyLookups.set(keyId.href, lookup);
-				continue;
 			}
-			setFailure(invalidSignatureResult(keyId), result.algorithm);
-			break;
-		}
+			while (true) {
+				const { key, cached, fetchError } = lookup;
+				if (fetchError != null) {
+					setFailure(keyFetchErrorResult(keyId, fetchError));
+					break;
+				}
+				if (!key) {
+					logger.debug("Failed to fetch key: {keyId}", { keyId: sigInput.keyId });
+					setFailure(invalidSignatureResult(keyId));
+					break;
+				}
+				const result = await verifyRfc9421SignatureWithKey(request, sigInput, sigBytes, key, span, { [verificationObservation]: candidateObservation });
+				if (result.verified) {
+					metricsContext.algorithm = result.algorithm;
+					winning = {
+						verified: true,
+						key,
+						signatureLabel: sigName
+					};
+					return key;
+				}
+				if (result.mismatched && cached && !refreshedKeyIds.has(keyId.href)) {
+					logger.debug("Failed to verify with cached key {keyId}; retrying with fresh key...", { keyId: sigInput.keyId });
+					refreshedKeyIds.add(keyId.href);
+					lookup = await lookUpKey(keyId, bypassKeyCacheReads(keyCache));
+					keyLookups.set(keyId.href, lookup);
+					continue;
+				}
+				setFailure(invalidSignatureResult(keyId), result.algorithm);
+				break;
+			}
+			if (!failure.verified && failure.reason.type === "keyFetchError" && candidateObservation.check != null) candidateObservation.check.reason = failure.reason;
+			return null;
+		});
+		if (winning != null) return winning;
 	}
 	metricsContext.algorithm = failureAlgorithm;
 	return failure;