@fedify/fedify 2.4.0-dev.2256 → 2.4.0-dev.2260

package/dist/{kv-cache-CJS4mImS.mjs → kv-cache-D0kA0rml.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-CocsZP0E.mjs";
+import { p as recordDocumentCache } from "./metrics-BbBj-VZN.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-CGhEgt98.js → kv-cache-DZLpqhW9.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { G as validateCryptoKey, ot as recordDocumentCache, t as doubleKnock } from "./http-BGb3QioZ.js";
+import { G as validateCryptoKey, ot as recordDocumentCache, t as doubleKnock } from "./http-DRMu1C2T.js";
 import { getLogger } from "@logtape/logtape";
 import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, resolveDocumentLoaderTimeout, validatePublicUrl, withDocumentLoaderTimeout } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";

package/dist/{kv-cache-BEWuZSB4.cjs → kv-cache-mF8Zmjix.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-1fZ83jj7.cjs");
+const require_http = require("./http-BIhWdDf5.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");

package/dist/{ld-Cf4CPWN_.mjs → ld-BDMNyM2M.mjs}

@@ -1,9 +1,10 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-AmcRMq5z.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CocsZP0E.mjs";
-import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-CEsu7oaD.mjs";
+import { a as verificationObservation, i as triedKey, n as observeCheck, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
+import { n as version, t as name } from "./deno-DVP7DGJC.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-BbBj-VZN.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-B7N8mNoY.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -450,6 +451,13 @@ function detachSignature(jsonLd) {
 */
 async function verifySignature(jsonLd, options = {}) {
 	if (!hasSignature(jsonLd)) return null;
+	if (options[verificationObservation]?.attempt != null && options[verificationObservation]?.check == null) {
+		const declared = getLdSignatureObject(jsonLd)?.creator;
+		return await observeCheck(options, { mechanism: "linkedData" }, typeof declared === "string" ? declared : null, (observation) => verifySignature(jsonLd, {
+			...options,
+			[verificationObservation]: observation
+		}));
+	}
 	const sig = jsonLd.signature;
 	let signature;
 	try {
@@ -495,6 +503,7 @@ async function verifySignature(jsonLd, options = {}) {
 	const encoder = new TextEncoder();
 	const message = sigOptsHash + docHash;
 	const messageBytes = encoder.encode(message);
+	triedKey(options, key);
 	if (await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes)) return key;
 	if (cached) {
 		logger.debug("Failed to verify with the cached key {keyId}; signature {signatureValue} is invalid.  Retrying with the freshly fetched key...", {
@@ -506,6 +515,7 @@ async function verifySignature(jsonLd, options = {}) {
 			keyCache: bypassKeyCacheReads(options.keyCache)
 		}));
 		if (key == null) return null;
+		triedKey(options, key);
 		return await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes) ? key : null;
 	}
 	logger.debug("Failed to verify with the fetched key {keyId}; signature {signatureValue} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
@@ -559,6 +569,14 @@ async function verifyCompactJsonLd(jsonLd, options = {}) {
 	return await verifyJsonLdInternal(jsonLd, options, false);
 }
 async function verifyJsonLdInternal(jsonLd, options, compact) {
+	if (options[verificationObservation]?.attempt == null) return await observeAttempt({
+		...options,
+		[verificationObservation]: options[verificationObservation] ?? { attempts: [] }
+	}, "linkedData", (observation) => verifyJsonLdInternal(jsonLd, {
+		...options,
+		[verificationObservation]: observation
+	}, compact), (value) => value);
+	const observation = options[verificationObservation];
 	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.verify", async (span) => {
 		const start = performance.now();
 		let verified = false;
@@ -571,6 +589,8 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 			} : options;
 			const compacted = compact ? hasSignature(jsonLd) ? await compactJsonLd(jsonLd, options.contextLoader) : jsonLd : jsonLd;
 			const object = await Object$1.fromJsonLd(compacted, verificationOptions);
+			observation?.parsedObject?.(object);
+			if (observation?.subject != null) observation.subject.id = object.id == null ? null : new URL(object.id.href);
 			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
 			span.setAttribute("activitypub.object.type", getTypeId(object).href);
 			const sig = getLdSignatureObject(jsonLd);
@@ -585,13 +605,21 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 			const attributions = new Set(object.attributionIds.map((uri) => uri.href));
 			if (object instanceof Activity) for (const uri of object.actorIds) attributions.add(uri.href);
 			const key = await verifySignature(compacted, verificationOptions);
-			if (key == null) return false;
+			if (key == null) {
+				if (observation?.attempt != null && !hasLdSignatureProperty(jsonLd)) observation.attempt.reason = { type: "noSignature" };
+				return false;
+			}
 			if (key.ownerId == null) {
+				if (observation?.attempt != null) observation.attempt.reason = { type: "missingOwner" };
 				logger.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
 				return false;
 			}
 			attributions.delete(key.ownerId.href);
 			if (attributions.size > 0) {
+				if (observation?.attempt != null) observation.attempt.reason = {
+					type: "uncoveredAttribution",
+					attributionIds: [...attributions].map((id) => new URL(id))
+				};
 				logger.debug("Some attributions are not authenticated by the Linked Data Signatures: {attributions}.", { attributions: [...attributions] });
 				return false;
 			}
@@ -605,8 +633,15 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 			});
 			throw error;
 		} finally {
+			if (observation?.attempt?.reason != null) {
+				span.setAttribute("activitypub.verification.failure_reason", observation.attempt.reason.type);
+				span.setStatus({ code: SpanStatusCode.ERROR });
+			}
 			const classified = threw ? "error" : verified ? "verified" : hasLdSignatureProperty(jsonLd) ? "rejected" : "missing";
-			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "linked_data", classified, { ldType: signatureType });
+			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "linked_data", classified, {
+				ldType: signatureType,
+				verificationFailureReason: verified || threw ? void 0 : observation?.attempt?.reason?.type ?? (hasLdSignatureProperty(jsonLd) ? "signatureVerificationFailed" : "noSignature")
+			});
 			span.end();
 		}
 	});

package/dist/{metrics-CocsZP0E.mjs → metrics-BbBj-VZN.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-AmcRMq5z.mjs";
+import { n as version, t as name } from "./deno-DVP7DGJC.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts
@@ -302,6 +302,7 @@ var FederationMetrics = class {
 		};
 		if (extra.algorithm != null) attributes["http_signatures.algorithm"] = extra.algorithm;
 		if (extra.failureReason != null) attributes["http_signatures.failure_reason"] = extra.failureReason;
+		if (extra.verificationFailureReason != null) attributes["activitypub.verification.failure_reason"] = extra.verificationFailureReason;
 		if (extra.ldType != null) attributes["ld_signatures.type"] = extra.ldType;
 		if (extra.cryptosuite != null) attributes["object_integrity_proofs.cryptosuite"] = extra.cryptosuite;
 		this.signatureVerificationDuration.record(durationMs, attributes);

package/dist/{middleware-Cne_jMZo.mjs → middleware-CE1X7-UM.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-Dxn0E9ES.mjs";
+import { n as FederationImpl } from "./middleware-DAA7wDdS.mjs";
 export { FederationImpl };