@fedify/fedify 2.4.0-pr.934.40 → 2.4.0

package/dist/federation/handler.test.mjs

@@ -1,22 +1,25 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-BJXxPElm.mjs";
-import { t as MemoryKvStore } from "../kv-CXBAok3k.mjs";
-import { t as assertEquals } from "../assert_equals-BV7oLMxm.mjs";
-import "../std__assert-B2NnY9bq.mjs";
-import { n as assertGreaterOrEqual, t as assertRejects } from "../assert_rejects-EgstcQy5.mjs";
-import { t as assertInstanceOf } from "../assert_instance_of-Q9KTBnrf.mjs";
-import { t as assert } from "../assert-CJ1KXcvv.mjs";
-import { r as parseAcceptSignature } from "../accept-8PiolDP7.mjs";
-import { s as signRequest } from "../http-Dm0JAUa_.mjs";
-import { a as rsaPrivateKey3, c as rsaPublicKey3, s as rsaPublicKey2 } from "../keys-Dbyd7bhl.mjs";
-import { a as compactJsonLd, p as signJsonLd } from "../ld-DAPAVL_7.mjs";
-import { c as handleActor, d as handleInbox, f as handleObject, h as respondWithObjectIfAcceptable, l as handleCollection, m as respondWithObject, o as createFederation, p as handleOutbox, u as handleCustomCollection } from "../middleware-O2LHXFEk.mjs";
-import { t as ActivityListenerSet } from "../activity-listener-BtTSxZWA.mjs";
-import { Activity, Create, Note, Person, Tombstone } from "@fedify/vocab";
+import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-8Tu9kea0.mjs";
+import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import { t as assertGreaterOrEqual } from "../assert_greater_or_equal-BlafOF4-.mjs";
+import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { r as parseAcceptSignature } from "../accept-CPVqki78.mjs";
+import { o as generateCryptoKeyPair } from "../key-D979vduq.mjs";
+import { a as compactJsonLd, p as signJsonLd } from "../ld-wmqC-95l.mjs";
+import { a as signObject } from "../proof-DeC9pb6t.mjs";
+import { l as signRequest } from "../http-BAgKAAGY.mjs";
+import { a as rsaPrivateKey3, c as rsaPublicKey3, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { d as handleCustomCollection, f as handleInbox, g as respondWithObjectIfAcceptable, h as respondWithObject, l as handleActor, m as handleOutbox, o as createFederation, p as handleObject, u as handleCollection } from "../middleware-CqQ5Qahj.mjs";
+import { t as ActivityListenerSet } from "../activity-listener-C-BSbKI7.mjs";
+import { Activity, Create, CryptographicKey, Multikey, Note, Person, Tombstone } from "@fedify/vocab";
+import { FetchError, parseIri } from "@fedify/vocab-runtime";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
-import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/handler.test.ts
 const QUOTE_CONTEXT_TERMS = {
 	QuoteAuthorization: "https://w3id.org/fep/044f#QuoteAuthorization",
@@ -106,6 +109,7 @@ test("handleActor()", async () => {
 	assertEquals(await response.json(), {
 		"@context": [
 			"https://www.w3.org/ns/activitystreams",
+			"https://w3id.org/fep/ef61",
 			"https://w3id.org/security/v1",
 			"https://w3id.org/security/data-integrity/v1",
 			"https://www.w3.org/ns/did/v1",
@@ -195,6 +199,7 @@ test("handleActor()", async () => {
 	assertEquals(await response.json(), {
 		"@context": [
 			"https://www.w3.org/ns/activitystreams",
+			"https://w3id.org/fep/ef61",
 			"https://w3id.org/security/v1",
 			"https://w3id.org/security/data-integrity/v1",
 			"https://www.w3.org/ns/did/v1",
@@ -495,6 +500,119 @@ test("handleObject()", async () => {
 	assertEquals(onNotFoundCalled, null);
 	assertEquals(onUnauthorizedCalled, null);
 });
+test("handleObject() with a tombstone", async () => {
+	const federation = createFederation({ kv: new MemoryKvStore() });
+	const url = new URL("https://example.com/users/someone/notes/123");
+	let context = createRequestContext({
+		federation,
+		data: void 0,
+		url,
+		request: new Request(url, { headers: { Accept: "application/activity+json" } })
+	});
+	const objectDispatcher = (_ctx, values) => {
+		if (values.id !== "123") return null;
+		return new Tombstone({
+			id: new URL(`https://example.com/users/${values.identifier}/notes/${values.id}`),
+			formerType: Note,
+			deleted: Temporal.Instant.from("2024-01-15T00:00:00Z")
+		});
+	};
+	let onNotFoundCalled = null;
+	const onNotFound = (request) => {
+		onNotFoundCalled = request;
+		return new Response("Not found", { status: 404 });
+	};
+	let onUnauthorizedCalled = null;
+	const onUnauthorized = (request) => {
+		onUnauthorizedCalled = request;
+		return new Response("Unauthorized", { status: 401 });
+	};
+	let response = await handleObject(context.request, {
+		context,
+		values: {
+			identifier: "someone",
+			id: "123"
+		},
+		objectDispatcher,
+		onNotFound,
+		onUnauthorized
+	});
+	assertEquals(response.status, 410);
+	assertEquals(response.headers.get("Content-Type"), "application/activity+json");
+	assertEquals(response.headers.get("Vary"), "Accept");
+	const body = await response.json();
+	assertEquals(body.id, "https://example.com/users/someone/notes/123");
+	assertEquals(body.type, "Tombstone");
+	assertEquals(body.formerType, "as:Note");
+	assertEquals(body.deleted, "2024-01-15T00:00:00Z");
+	assertEquals(onNotFoundCalled, null);
+	assertEquals(onUnauthorizedCalled, null);
+	response = await handleObject(context.request, {
+		context,
+		values: {
+			identifier: "someone",
+			id: "456"
+		},
+		objectDispatcher,
+		onNotFound,
+		onUnauthorized
+	});
+	assertEquals(response.status, 404);
+	assertEquals(onNotFoundCalled, context.request);
+	assertEquals(onUnauthorizedCalled, null);
+	onNotFoundCalled = null;
+	let authorized = false;
+	const authorizePredicate = () => authorized;
+	response = await handleObject(context.request, {
+		context,
+		values: {
+			identifier: "someone",
+			id: "123"
+		},
+		objectDispatcher,
+		authorizePredicate,
+		onNotFound,
+		onUnauthorized
+	});
+	assertEquals(response.status, 401);
+	assertEquals(onNotFoundCalled, null);
+	assertEquals(onUnauthorizedCalled, context.request);
+	onUnauthorizedCalled = null;
+	authorized = true;
+	response = await handleObject(context.request, {
+		context,
+		values: {
+			identifier: "someone",
+			id: "123"
+		},
+		objectDispatcher,
+		authorizePredicate,
+		onNotFound,
+		onUnauthorized
+	});
+	assertEquals(response.status, 410);
+	assertEquals(onUnauthorizedCalled, null);
+	context = createRequestContext({
+		...context,
+		request: new Request(url, {
+			method: "HEAD",
+			headers: { Accept: "application/activity+json" }
+		})
+	});
+	response = await handleObject(context.request, {
+		context,
+		values: {
+			identifier: "someone",
+			id: "123"
+		},
+		objectDispatcher,
+		onNotFound,
+		onUnauthorized
+	});
+	assertEquals(response.status, 410);
+	assertEquals(response.headers.get("Content-Type"), "application/activity+json");
+	assertEquals(response.body, null);
+});
 test("handleCollection()", async () => {
 	let context = createRequestContext({
 		federation: createFederation({ kv: new MemoryKvStore() }),
@@ -1124,6 +1242,67 @@ test("handleCollection() records not_found collection metrics", async () => {
 	assertEquals(durations[0].attributes["activitypub.collection.result"], "not_found");
 	assertEquals(recorder.getMeasurements("activitypub.collection.page.items").length, 0);
 });
+test("handleInbox() reports dispatch context errors before a failing error hook", async () => {
+	const kv = new MemoryKvStore();
+	const federation = createFederation({ kv });
+	const request = await signRequest(new Request("https://example.com/inbox", {
+		method: "POST",
+		body: JSON.stringify(await new Create({ actor: rsaPublicKey3.ownerId }).toJsonLd({ contextLoader: mockDocumentLoader }))
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const context = createRequestContext({
+		federation,
+		request,
+		url: new URL(request.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	const error = /* @__PURE__ */ new Error("Cannot create dispatch context");
+	const reports = [];
+	const listeners = new ActivityListenerSet();
+	let listenerCalled = false;
+	listeners.add(Create, () => {
+		listenerCalled = true;
+	});
+	let errorHookCalled = false;
+	assertEquals((await handleInbox(request, {
+		context,
+		recipient: null,
+		kv,
+		kvPrefixes: {
+			activityIdempotence: ["activity"],
+			publicKey: ["key"],
+			acceptSignatureNonce: ["nonce"]
+		},
+		actorDispatcher: () => new Person({}),
+		inboxListeners: listeners,
+		inboxContextFactory: () => {
+			throw error;
+		},
+		inboxErrorHandler: (_ctx, value) => {
+			assertEquals(value, error);
+			errorHookCalled = true;
+			throw new Error("Error hook failed");
+		},
+		inboxRequestFinishedHandler: (_ctx, report) => {
+			reports.push(report);
+		},
+		onNotFound: () => new Response(null, { status: 404 }),
+		signatureTimeWindow: false,
+		skipSignatureVerification: false
+	})).status, 500);
+	assertEquals(listenerCalled, false);
+	assertEquals(errorHookCalled, true);
+	assertEquals(reports.length, 1);
+	assertEquals(reports[0].authentication.status, "verified");
+	assertEquals(reports[0].outcome, {
+		type: "response",
+		status: 500,
+		disposition: "failed",
+		reason: "listenerError",
+		error
+	});
+});
 test("handleInbox()", async () => {
 	const activity = new Create({
 		id: new URL("https://example.com/activities/1"),
@@ -2746,6 +2925,73 @@ test("handleOutbox()", async () => {
 	assertEquals(response.status, 500);
 	assertEquals(onErrorCalled, true);
 });
+test("handleOutbox() matches portable actors by their canonical IDs", async () => {
+	const federation = createFederation({ kv: new MemoryKvStore() });
+	const actorId = "ap+ef61://did:key:z6MkAlice/users/someone";
+	const actorDispatcher = (_ctx, identifier) => {
+		if (identifier !== "someone") return null;
+		return new Person({
+			id: parseIri(actorId),
+			name: "Someone"
+		});
+	};
+	const post = async (actor) => {
+		const request = new Request("https://example.com/users/someone/outbox", {
+			method: "POST",
+			body: JSON.stringify({
+				"@context": "https://www.w3.org/ns/activitystreams",
+				type: "Create",
+				id: "https://example.com/activities/1",
+				actor,
+				object: {
+					type: "Note",
+					content: "Hello, world!"
+				}
+			})
+		});
+		const context = createRequestContext({
+			federation,
+			request,
+			url: new URL(request.url),
+			data: void 0
+		});
+		const seen = [];
+		const listeners = new ActivityListenerSet();
+		listeners.add(Activity, (_ctx, activity) => {
+			seen.push(activity.id.href);
+		});
+		return [(await handleOutbox(request, {
+			identifier: "someone",
+			context,
+			outboxContextFactory(identifier) {
+				return createOutboxContext({
+					...context,
+					clone: void 0,
+					identifier
+				});
+			},
+			actorDispatcher,
+			outboxListeners: listeners,
+			onNotFound: () => new Response("Not found", { status: 404 }),
+			onUnauthorized: () => new Response("Unauthorized", { status: 401 })
+		})).status, seen.length];
+	};
+	for (const actor of [
+		actorId,
+		"ap://did:key:z6MkAlice/users/someone",
+		"ap+ef61://did%3Akey%3Az6MkAlice/users/someone",
+		"ap://did:key:z6MkAlice/users/someone?@gateway=https%3A%2F%2Fserver1.example&@gateway=https%3A%2F%2Fserver2.example",
+		"https://server2.example/.well-known/apgateway/did:key:z6MkAlice/users/someone"
+	]) assertEquals(await post(actor), [202, 1], actor);
+	for (const actor of [
+		"ap://did:key:z6MkBob/users/someone",
+		"ap://did:key:z6MkAlice/users/other?@gateway=https%3A%2F%2Fserver1.example",
+		"ap://did:key:z6MkAlice/users/someone#main-key",
+		"https://server1.example/.well-known/apgateway/did:key:z6MkAlice/users/someone?@gateway=https%3A%2F%2Fserver1.example",
+		"https://example.com/users/someone",
+		[actorId, "ap://did:key:z6MkAlice/users/other"]
+	]) assertEquals(await post(actor), [400, 0], String(actor));
+});
 test("handleInbox() preserves the raw signed payload for inboxContextFactory", async () => {
 	const federation = createFederation({ kv: new MemoryKvStore() });
 	const remoteContextUrl = "https://remote.example/contexts/ext";
@@ -4241,7 +4487,11 @@ test("handleInbox() nonce replay prevention", async () => {
 		if (identifier !== "someone") return null;
 		return new Person({ name: "Someone" });
 	};
+	let report;
 	const response = await handleInbox(signedRequest, {
+		inboxRequestFinishedHandler: (_ctx, value) => {
+			report = value;
+		},
 		recipient: "someone",
 		context,
 		inboxContextFactory(_activity) {
@@ -4269,6 +4519,12 @@ test("handleInbox() nonce replay prevention", async () => {
 		}
 	});
 	assertEquals(response.status, 401);
+	assert(report != null);
+	assertEquals(report.authentication, {
+		status: "rejected",
+		reason: { type: "invalidNonce" }
+	});
+	assertEquals(report.attempts.at(-1)?.status, "verified");
 	const acceptSig = response.headers.get("Accept-Signature");
 	assert(acceptSig != null, "Must emit fresh Accept-Signature challenge");
 	const parsed = parseAcceptSignature(acceptSig);
@@ -4571,5 +4827,121 @@ test("handleInbox() challenge policy enabled + unverifiedActivityHandler throws
 	assertEquals(response.headers.get("Cache-Control"), "no-store", "Cache-Control: no-store must be set for challenge-response");
 	assertEquals(response.headers.get("Vary"), "Accept, Signature", "Vary header must include Accept and Signature");
 });
+test("handleInbox() rejects forged key ownership", async () => {
+	const impersonated = "https://example.com/person2";
+	const attackerKeyId = new URL("https://attacker.example/key");
+	const attackerMultikeyId = new URL("https://attacker.example/multikey");
+	const { privateKey, publicKey } = await generateCryptoKeyPair("RSASSA-PKCS1-v1_5");
+	const forgedKeyDocument = await new CryptographicKey({
+		id: attackerKeyId,
+		owner: new URL(impersonated),
+		publicKey
+	}).toJsonLd({ contextLoader: mockDocumentLoader });
+	const ed25519 = await generateCryptoKeyPair("Ed25519");
+	const forgedMultikeyDocument = await new Multikey({
+		id: attackerMultikeyId,
+		controller: new URL(impersonated),
+		publicKey: ed25519.publicKey
+	}).toJsonLd({ contextLoader: mockDocumentLoader });
+	const documentLoader = (resource) => {
+		if (resource === attackerKeyId.href) return Promise.resolve({
+			contextUrl: null,
+			documentUrl: resource,
+			document: forgedKeyDocument
+		});
+		if (resource === attackerMultikeyId.href) return Promise.resolve({
+			contextUrl: null,
+			documentUrl: resource,
+			document: forgedMultikeyDocument
+		});
+		return mockDocumentLoader(resource);
+	};
+	const federation = createFederation({ kv: new MemoryKvStore() });
+	const inboxOptions = {
+		kv: new MemoryKvStore(),
+		kvPrefixes: {
+			activityIdempotence: ["_fedify", "activityIdempotence"],
+			publicKey: ["_fedify", "publicKey"],
+			acceptSignatureNonce: ["_fedify", "acceptSignatureNonce"]
+		},
+		actorDispatcher: ((_ctx, identifier) => identifier === "someone" ? new Person({ name: "Someone" }) : null),
+		inboxListeners: new ActivityListenerSet(),
+		onNotFound: () => new Response("Not found", { status: 404 }),
+		signatureTimeWindow: { minutes: 5 },
+		skipSignatureVerification: false
+	};
+	const handle = async (request) => {
+		const context = createRequestContext({
+			federation,
+			request,
+			url: new URL(request.url),
+			data: void 0,
+			documentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		return await handleInbox(request, {
+			recipient: null,
+			context,
+			inboxContextFactory(_activity) {
+				return createInboxContext({
+					...context,
+					clone: void 0
+				});
+			},
+			...inboxOptions
+		});
+	};
+	const activity = {
+		"@context": [
+			"https://www.w3.org/ns/activitystreams",
+			"https://w3id.org/identity/v1",
+			"https://w3id.org/security/v1",
+			"https://w3id.org/security/data-integrity/v1"
+		],
+		id: "https://attacker.example/activities/1",
+		type: "Create",
+		actor: impersonated,
+		object: {
+			id: "https://attacker.example/notes/1",
+			type: "Note",
+			attributedTo: impersonated,
+			content: "Hello World!"
+		}
+	};
+	const httpSignedResponse = await handle(await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(activity)
+	}), privateKey, attackerKeyId));
+	const ldSignedResponse = await handle(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(await signJsonLd(activity, privateKey, attackerKeyId, { contextLoader: mockDocumentLoader }))
+	}));
+	const signedObject = await signObject(await Create.fromJsonLd(activity, {
+		documentLoader,
+		contextLoader: mockDocumentLoader
+	}), ed25519.privateKey, attackerMultikeyId, {
+		documentLoader,
+		contextLoader: mockDocumentLoader,
+		context: ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"]
+	});
+	const proofSignedResponse = await handle(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(await signedObject.toJsonLd({
+			format: "compact",
+			contextLoader: mockDocumentLoader,
+			context: ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"]
+		}))
+	}));
+	assertEquals([
+		httpSignedResponse.status,
+		ldSignedResponse.status,
+		proofSignedResponse.status
+	], [
+		401,
+		401,
+		401
+	]);
+	assertEquals(await httpSignedResponse.text(), "Failed to verify the request signature.");
+});
 //#endregion
 export {};

package/dist/federation/hashlink-media.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";