@fedify/fedify 2.4.0-pr.934.40 → 2.4.0

package/dist/federation/portable-chain.test.mjs

@@ -0,0 +1,370 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
+import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { n as exportJwk } from "../key-D979vduq.mjs";
+import { c as verifyPortableObjectProof, s as verifyObject } from "../proof-DeC9pb6t.mjs";
+import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { n as FederationImpl } from "../middleware-CqQ5Qahj.mjs";
+import { Create, DataIntegrityProof, Note, OrderedCollection, Person, traverseCollection } from "@fedify/vocab";
+import { FetchError, encodeMultibase, exportDidKey } from "@fedify/vocab-runtime";
+import { mockDocumentLoader, test } from "@fedify/fixture";
+import serialize from "json-canon";
+//#region src/federation/portable-chain.test.ts
+const did = await exportDidKey(ed25519PublicKey.publicKey);
+const keyId = `${did}#${did.slice(8)}`;
+const GATEWAY = "https://gw.example";
+const context = [
+	"https://www.w3.org/ns/activitystreams",
+	"https://w3id.org/security/data-integrity/v1",
+	"https://w3id.org/fep/ef61"
+];
+function compatible(path, gateway = GATEWAY) {
+	return `${gateway}/.well-known/apgateway/${did}${path}`;
+}
+async function sign(document, proofOptions = {}) {
+	const proofConfig = {
+		"@context": document["@context"],
+		...proofOptions,
+		type: "DataIntegrityProof",
+		cryptosuite: "eddsa-jcs-2022",
+		verificationMethod: keyId,
+		proofPurpose: "assertionMethod",
+		created: "2023-02-24T23:36:38Z"
+	};
+	const encoder = new TextEncoder();
+	const digest = /* @__PURE__ */ new Uint8Array(64);
+	digest.set(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(serialize(proofConfig)))), 0);
+	digest.set(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(serialize(document)))), 32);
+	const signature = await crypto.subtle.sign("Ed25519", ed25519PrivateKey, digest);
+	return {
+		...document,
+		proof: {
+			...proofConfig,
+			proofValue: new TextDecoder().decode(encodeMultibase("base58btc", new Uint8Array(signature)))
+		}
+	};
+}
+function note(path, content = "A portable note") {
+	return {
+		"@context": context,
+		id: compatible(path),
+		type: "Note",
+		attributedTo: compatible("/actor"),
+		content
+	};
+}
+function activity(object, id = compatible("/activities/1")) {
+	return {
+		"@context": context,
+		id,
+		type: "Create",
+		actor: compatible("/actor"),
+		object
+	};
+}
+function actor() {
+	return {
+		"@context": context,
+		id: compatible("/actor"),
+		type: "Person",
+		inbox: compatible("/actor/inbox"),
+		outbox: compatible("/actor/outbox"),
+		gateways: [GATEWAY]
+	};
+}
+function createLoader(responses) {
+	const fetched = [];
+	const loader = (url) => {
+		url = url.replace(/^ap\+ef61:/, "ap:");
+		fetched.push(url);
+		const document = responses[url];
+		if (document == null) {
+			if (!URL.canParse(url)) return Promise.reject(/* @__PURE__ */ new Error(`Not found: ${url}`));
+			if (!url.includes("/.well-known/apgateway/")) return mockDocumentLoader(url);
+			return Promise.reject(new FetchError(url, "HTTP 404", new Response(null, { status: 404 })));
+		}
+		return Promise.resolve({
+			contextUrl: null,
+			documentUrl: url,
+			document: structuredClone(document)
+		});
+	};
+	return Object.assign(loader, { fetched });
+}
+function createFederation(documentLoader, queue) {
+	return new FederationImpl({
+		kv: new MemoryKvStore(),
+		queue,
+		manuallyStartQueue: true,
+		contextLoaderFactory: () => mockDocumentLoader,
+		documentLoaderFactory: () => documentLoader
+	});
+}
+test("Context.verifyPortableObject", async (t) => {
+	const signed = await sign(note("/notes/1"));
+	const ctx = createFederation(createLoader({})).createContext(new URL("https://example.com/"));
+	await t.step("is an own property that survives spreading", () => {
+		assert(Object.hasOwn(ctx, "verifyPortableObject"));
+		assert({ ...ctx }.verifyPortableObject === ctx.verifyPortableObject);
+		assert(ctx.clone(void 0).verifyPortableObject != null);
+	});
+	await t.step("verifies portable objects with the context's loaders", async () => {
+		assertEquals((await ctx.verifyPortableObject(signed, {})).verified, true);
+		assertEquals((await ctx.verifyPortableObject(note("/notes/1"), {})).verified, false);
+		assertEquals((await ctx.verifyPortableObject({
+			...signed,
+			content: "Forged"
+		}, {})).verified, false);
+	});
+});
+test("accessors given a Context verify references of compatible-ID objects", async (t) => {
+	const signed = await sign(note("/notes/1"));
+	const create = () => Create.fromJsonLd(activity(compatible("/notes/1")), { contextLoader: mockDocumentLoader });
+	await t.step("a signed object at the reference", async () => {
+		const loader = createLoader({ [compatible("/notes/1")]: signed });
+		const ctx = createFederation(loader).createContext(new URL("https://example.com/"));
+		const object = await (await create()).getObject(ctx);
+		assertInstanceOf(object, Note);
+		assertEquals(object.content, "A portable note");
+		assertEquals(loader.fetched, [compatible("/notes/1")]);
+	});
+	await t.step("an unsigned object at the reference", async () => {
+		const ctx = createFederation(createLoader({ [compatible("/notes/1")]: note("/notes/1") })).createContext(new URL("https://example.com/"));
+		assertEquals(await (await create()).getObject(ctx), null);
+	});
+	await t.step("a forged object at the reference", async () => {
+		const ctx = createFederation(createLoader({ [compatible("/notes/1")]: {
+			...signed,
+			content: "Forged"
+		} })).createContext(new URL("https://example.com/"));
+		assertEquals(await (await create()).getObject(ctx), null);
+	});
+	await t.step("an ordinary object's compatible reference", async () => {
+		const loader = createLoader({ [compatible("/notes/1")]: note("/notes/1") });
+		const ctx = createFederation(loader).createContext(new URL("https://example.com/"));
+		const create = await Create.fromJsonLd(activity(compatible("/notes/1"), "https://example.com/activities/1"), { contextLoader: mockDocumentLoader });
+		assertEquals(await create.getObject(ctx), null);
+		assertInstanceOf(await create.getObject({
+			documentLoader: loader,
+			contextLoader: mockDocumentLoader
+		}), Note);
+	});
+});
+function createRecordingQueue() {
+	const queued = [];
+	return {
+		queued,
+		queue: {
+			enqueue(message) {
+				queued.push(message);
+				return Promise.resolve();
+			},
+			listen() {
+				return Promise.resolve();
+			}
+		}
+	};
+}
+test("inbox listeners dereference references of compatible-ID activities without options", async (t) => {
+	const signedNote = await sign(note("/notes/1"));
+	const signedCreate = await sign(activity(compatible("/notes/1")));
+	for (const queued of [false, true]) for (const [label, served] of [["signed", signedNote], ["unsigned", note("/notes/1")]]) await t.step(`${label} object${queued ? " through a queue" : ""}`, async () => {
+		const loader = createLoader({ [compatible("/notes/1")]: served });
+		const { queue, queued: messages } = createRecordingQueue();
+		const federation = createFederation(loader, queued ? queue : void 0);
+		const results = [];
+		federation.setActorDispatcher("/users/{identifier}", () => null);
+		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(Create, async (_ctx, create) => {
+			const object = await create.getObject();
+			assert(object == null || object instanceof Note);
+			results.push(object);
+		});
+		assertEquals((await federation.fetch(new Request("https://example.com/inbox", {
+			method: "POST",
+			headers: { "Content-Type": "application/activity+json" },
+			body: JSON.stringify(signedCreate)
+		}), { contextData: void 0 })).status, 202);
+		if (queued) {
+			assertEquals(messages.length, 1);
+			assertEquals(messages[0].type, "inbox");
+			await federation.processQueuedTask(void 0, messages[0]);
+		}
+		assertEquals(results.length, 1);
+		if (label === "signed") {
+			assertInstanceOf(results[0], Note);
+			assertEquals(results[0].content, "A portable note");
+		} else assertEquals(results[0], null);
+		assertEquals(loader.fetched, [compatible("/notes/1")]);
+	});
+});
+test("verifyObject() does not leave its proof verifier to returned objects", async () => {
+	const proofUrl = `ap://${did}/proofs/1`;
+	const { proof, ...document } = await sign(activity(compatible("/notes/1")), { id: proofUrl });
+	const referenced = {
+		...document,
+		"https://w3id.org/security#proof": [{ "@graph": [proof] }, { "@graph": [{ "@id": proofUrl }] }]
+	};
+	const loader = createLoader({ [proofUrl]: proof });
+	const verifier = () => Promise.resolve({ verified: false });
+	for (const verifyPortableObject of [void 0, verifier]) {
+		const create = await verifyObject(Create, referenced, {
+			contextLoader: mockDocumentLoader,
+			documentLoader: loader,
+			verifyPortableObject
+		});
+		assertInstanceOf(create, Create);
+		assert(loader.fetched.includes(proofUrl));
+		const proofs = await Array.fromAsync(create.getProofs());
+		assertEquals(proofs.length, 2);
+		for (const p of proofs) {
+			assertInstanceOf(p, DataIntegrityProof);
+			assert(p._verifyPortableObject === verifyPortableObject);
+		}
+		assert(create._verifyPortableObject === verifyPortableObject);
+	}
+});
+test("Context.lookupObject() applies the gateway policy to unsecured collections", async (t) => {
+	const outbox = {
+		"@context": context,
+		id: compatible("/actor/outbox"),
+		type: "OrderedCollection",
+		attributedTo: compatible("/actor"),
+		orderedItems: [compatible("/notes/1")]
+	};
+	const signedActor = await sign(actor());
+	await t.step("from a listed gateway", async () => {
+		const ctx = createFederation(createLoader({
+			[compatible("/actor")]: signedActor,
+			[compatible("/actor/outbox")]: outbox,
+			[compatible("/notes/1")]: note("/notes/1")
+		})).createContext(new URL("https://example.com/"));
+		const collection = await ctx.lookupObject(compatible("/actor/outbox"));
+		assertInstanceOf(collection, OrderedCollection);
+		assertEquals(await Array.fromAsync(collection.getItems()), []);
+		assertEquals(await Array.fromAsync(traverseCollection(collection, ctx)), []);
+		assertEquals(await ctx.lookupObject(compatible("/actor/outbox"), { verifyPortableObject: verifyPortableObjectProof }), null);
+	});
+	await t.step("from an unlisted gateway", async () => {
+		const evil = "https://evil.example";
+		assertEquals(await createFederation(createLoader({
+			[compatible("/actor", evil)]: signedActor,
+			[compatible("/actor/outbox", evil)]: {
+				...outbox,
+				id: compatible("/actor/outbox", evil)
+			}
+		})).createContext(new URL("https://example.com/")).lookupObject(compatible("/actor/outbox", evil)), null);
+	});
+	await t.step("with signed items", async () => {
+		const collection = await createFederation(createLoader({
+			[compatible("/actor")]: signedActor,
+			[compatible("/actor/outbox")]: outbox,
+			[compatible("/notes/1")]: await sign(note("/notes/1"))
+		})).createContext(new URL("https://example.com/")).lookupObject(compatible("/actor/outbox"));
+		assertInstanceOf(collection, OrderedCollection);
+		const items = await Array.fromAsync(collection.getItems());
+		assertEquals(items.length, 1);
+		assertInstanceOf(items[0], Note);
+	});
+});
+test("traverseCollection() with a Context verifies pages and items of portable collections", async () => {
+	const loader = createLoader({
+		[compatible("/actor")]: await sign(actor()),
+		[compatible("/actor/outbox")]: {
+			"@context": context,
+			id: compatible("/actor/outbox"),
+			type: "OrderedCollection",
+			first: compatible("/actor/outbox/1")
+		},
+		[compatible("/actor/outbox/1")]: {
+			"@context": context,
+			id: compatible("/actor/outbox/1"),
+			type: "OrderedCollectionPage",
+			partOf: compatible("/actor/outbox"),
+			orderedItems: [compatible("/notes/1"), compatible("/notes/2")]
+		},
+		[compatible("/notes/1")]: await sign(note("/notes/1")),
+		[compatible("/notes/2")]: note("/notes/2", "Unsigned")
+	});
+	const ctx = createFederation(loader).createContext(new URL("https://example.com/"));
+	const outbox = await (await Person.fromJsonLd(actor(), { contextLoader: mockDocumentLoader })).getOutbox(ctx);
+	assertInstanceOf(outbox, OrderedCollection);
+	const items = await Array.fromAsync(traverseCollection(outbox, ctx));
+	assertEquals(items.length, 1);
+	assertInstanceOf(items[0], Note);
+	assertEquals(items[0].content, "A portable note");
+	assertInstanceOf(await items[0].getAttribution({ documentLoader: loader }), Person);
+	const outbox2 = await (await Person.fromJsonLd(actor(), { contextLoader: mockDocumentLoader })).getOutbox({
+		...ctx,
+		inheritPortableObjectVerifier: false
+	});
+	assertInstanceOf(outbox2, OrderedCollection);
+	const items2 = await Array.fromAsync(traverseCollection(outbox2, {
+		...ctx,
+		inheritPortableObjectVerifier: false
+	}));
+	assertEquals(items2.length, 1);
+	assertInstanceOf(items2[0], Note);
+	let error;
+	try {
+		await items2[0].getAttribution({ documentLoader: loader });
+	} catch (e) {
+		error = e;
+	}
+	assertInstanceOf(error, TypeError);
+	assertInstanceOf(await items2[0].getAttribution(ctx), Person);
+});
+test("onOutboxError receives activities that verify portable objects by default", async () => {
+	const loader = createLoader({ [compatible("/notes/1")]: await sign(note("/notes/1")) });
+	const received = [];
+	const federation = new FederationImpl({
+		kv: new MemoryKvStore(),
+		queue: createRecordingQueue().queue,
+		manuallyStartQueue: true,
+		contextLoaderFactory: () => mockDocumentLoader,
+		documentLoaderFactory: () => loader,
+		authenticatedDocumentLoaderFactory: () => loader,
+		onOutboxError: async (_error, activity) => {
+			try {
+				received.push(await activity?.getObject());
+			} catch (error) {
+				received.push(error);
+			}
+		}
+	});
+	const message = {
+		type: "outbox",
+		id: crypto.randomUUID(),
+		baseUrl: "https://example.com",
+		keys: [{
+			keyId: rsaPublicKey2.id.href,
+			privateKey: await exportJwk(rsaPrivateKey2)
+		}],
+		activity: await sign(activity(compatible("/notes/1"))),
+		activityId: compatible("/activities/1"),
+		activityType: "https://www.w3.org/ns/activitystreams#Create",
+		inbox: "https://remote.example/inbox",
+		sharedInbox: false,
+		started: (/* @__PURE__ */ new Date()).toISOString(),
+		attempt: 0,
+		headers: {},
+		traceContext: {}
+	};
+	esm_default.spyGlobal();
+	esm_default.post("https://remote.example/inbox", 500);
+	try {
+		await federation.processQueuedTask(void 0, message);
+	} finally {
+		esm_default.hardReset();
+	}
+	assertEquals(received.length, 1);
+	assertInstanceOf(received[0], Note);
+	assertEquals(loader.fetched, [compatible("/notes/1")]);
+});
+//#endregion
+export {};

package/dist/federation/portable-collection.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";