@fedify/fedify 2.4.0-pr.936.41 → 2.5.0-dev.2271

package/dist/federation/collection.test.mjs

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { t as assertEquals } from "../assert_equals-BV7oLMxm.mjs";
-import "../std__assert-B2NnY9bq.mjs";
-import { n as digest, t as buildCollectionSynchronizationHeader } from "../collection-BIhlldqK.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { n as digest, t as buildCollectionSynchronizationHeader } from "../collection-CnnP1UAv.mjs";
 import { test } from "@fedify/fixture";
 import { decodeHex } from "byte-encodings/hex";
 //#region src/federation/collection.test.ts

package/dist/federation/compound-fanout.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";

package/dist/federation/compound-fanout.test.mjs

@@ -0,0 +1,228 @@
+import { Temporal } from "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
+import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { n as exportJwk } from "../key-BspPiXqn.mjs";
+import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
+import { a as signObject, d as verifyProof } from "../proof-Dxy6ByqI.mjs";
+import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { n as FederationImpl } from "../middleware-D7_LO-Vs.mjs";
+import { Create, DataIntegrityProof, Note } from "@fedify/vocab";
+import { exportDidKey, parseIri } from "@fedify/vocab-runtime";
+import { mockDocumentLoader, test } from "@fedify/fixture";
+import serialize from "json-canon";
+//#region src/federation/compound-fanout.test.ts
+const options = {
+	contextLoader: mockDocumentLoader,
+	documentLoader: mockDocumentLoader
+};
+const context = ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"];
+const childContext = [...context, { ex: "https://example.com/ns#" }];
+async function parseProof(document) {
+	const proof = document.proof;
+	return await DataIntegrityProof.fromJsonLd({
+		"@context": document["@context"],
+		...proof
+	}, options);
+}
+test("fanout delivery keeps an embedded signed child intact", async () => {
+	const created = Temporal.Instant.from("2023-02-24T23:36:38Z");
+	const childDid = await exportDidKey(ed25519PublicKey.publicKey);
+	const childKeyId = new URL(`${childDid}#${childDid.substring(8)}`);
+	const child = await signObject(new Note({
+		id: parseIri(`ap+ef61://${childDid}/objects/fanned-out`),
+		attribution: parseIri(`ap+ef61://${childDid}/actor`),
+		content: "A portable note carried through the fanout queue"
+	}), ed25519PrivateKey, childKeyId, {
+		...options,
+		context: childContext,
+		created
+	});
+	const compound = await normalizeOutgoingActivityJsonLd(await (await signObject(new Create({
+		id: new URL("https://example.com/activities/fanned-out"),
+		actor: new URL("https://example.com/person"),
+		object: child
+	}), ed25519PrivateKey, childKeyId, {
+		...options,
+		context,
+		created
+	})).toJsonLd({
+		format: "compact",
+		...options,
+		context
+	}), mockDocumentLoader, { preserveNestedSecuredDocuments: true });
+	const securedChild = compound.object;
+	assertEquals(securedChild["@context"], childContext);
+	esm_default.spyGlobal();
+	try {
+		let delivered = null;
+		esm_default.post("https://example.com/inbox", async (cl) => {
+			delivered = await cl.request.json();
+			return new Response(null, { status: 202 });
+		});
+		const federation = new FederationImpl({
+			kv: new MemoryKvStore(),
+			contextLoaderFactory: () => mockDocumentLoader
+		});
+		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox");
+		const message = {
+			type: "fanout",
+			id: crypto.randomUUID(),
+			baseUrl: "https://example.com",
+			keys: [{
+				keyId: rsaPublicKey2.id.href,
+				privateKey: await exportJwk(rsaPrivateKey2)
+			}],
+			inboxes: { "https://example.com/inbox": {
+				actorIds: ["https://example.com/recipient"],
+				sharedInbox: false
+			} },
+			activity: compound,
+			activityId: "https://example.com/activities/fanned-out",
+			activityType: "https://www.w3.org/ns/activitystreams#Create",
+			normalizeExistingProofs: true,
+			traceContext: {}
+		};
+		await federation.processQueuedTask(void 0, message);
+		assert(delivered != null);
+		const body = delivered;
+		delete body.signature;
+		assertEquals(serialize(body), serialize(compound));
+		const embedded = body.object;
+		assertEquals((await verifyProof(embedded, await parseProof(embedded), options))?.id, childKeyId);
+		assertEquals((await verifyProof(body, await parseProof(body), options))?.id, childKeyId);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("forced fanout signs before serializing so the child survives", async () => {
+	const created = Temporal.Instant.from("2023-02-24T23:36:38Z");
+	const childDid = await exportDidKey(ed25519PublicKey.publicKey);
+	const childKeyId = new URL(`${childDid}#${childDid.substring(8)}`);
+	const child = await signObject(new Note({
+		id: parseIri(`ap+ef61://${childDid}/objects/forced-fanout`),
+		attribution: parseIri(`ap+ef61://${childDid}/actor`),
+		content: "A portable note sent through a forced fanout"
+	}), ed25519PrivateKey, childKeyId, {
+		...options,
+		context: childContext,
+		created
+	});
+	const activity = new Create({
+		id: new URL("https://example.com/activities/forced-fanout"),
+		actor: new URL("https://example.com/person"),
+		object: child
+	});
+	esm_default.spyGlobal();
+	try {
+		let delivered = null;
+		esm_default.post("https://example.com/inbox", async (cl) => {
+			delivered = await cl.request.json();
+			return new Response(null, { status: 202 });
+		});
+		const queued = [];
+		const federation = new FederationImpl({
+			kv: new MemoryKvStore(),
+			queue: {
+				enqueue(message) {
+					queued.push(message);
+					return Promise.resolve();
+				},
+				listen() {
+					return Promise.resolve();
+				}
+			},
+			manuallyStartQueue: true,
+			contextLoaderFactory: () => mockDocumentLoader
+		});
+		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox");
+		await federation.createContext(new URL("https://example.com/")).sendActivity({
+			keyId: childKeyId,
+			privateKey: ed25519PrivateKey
+		}, {
+			id: new URL("https://example.com/users/bob"),
+			inboxId: new URL("https://example.com/inbox")
+		}, activity, { fanout: "force" });
+		assertEquals(queued.length, 1);
+		for (let i = 0; i < queued.length; i++) await federation.processQueuedTask(void 0, queued[i]);
+		assert(delivered != null);
+		const body = delivered;
+		delete body.signature;
+		const embedded = body.object;
+		assertEquals(embedded["@context"], childContext);
+		assertEquals((await verifyProof(embedded, await parseProof(embedded), options))?.id, childKeyId);
+		assertEquals((await verifyProof(body, await parseProof(body), options))?.id, childKeyId);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("an already signed activity keeps its single proof through fanout", async () => {
+	const created = Temporal.Instant.from("2023-02-24T23:36:38Z");
+	const childDid = await exportDidKey(ed25519PublicKey.publicKey);
+	const childKeyId = new URL(`${childDid}#${childDid.substring(8)}`);
+	const child = await signObject(new Note({
+		id: parseIri(`ap+ef61://${childDid}/objects/pre-signed`),
+		attribution: parseIri(`ap+ef61://${childDid}/actor`),
+		content: "A portable note in a pre-signed activity"
+	}), ed25519PrivateKey, childKeyId, {
+		...options,
+		context: childContext,
+		created
+	});
+	const activity = await signObject(new Create({
+		id: new URL("https://example.com/activities/pre-signed"),
+		actor: new URL("https://example.com/person"),
+		object: child
+	}), ed25519PrivateKey, childKeyId, {
+		...options,
+		created
+	});
+	esm_default.spyGlobal();
+	try {
+		let delivered = null;
+		esm_default.post("https://example.com/inbox", async (cl) => {
+			delivered = await cl.request.json();
+			return new Response(null, { status: 202 });
+		});
+		const queued = [];
+		const federation = new FederationImpl({
+			kv: new MemoryKvStore(),
+			queue: {
+				enqueue(message) {
+					queued.push(message);
+					return Promise.resolve();
+				},
+				listen() {
+					return Promise.resolve();
+				}
+			},
+			manuallyStartQueue: true,
+			contextLoaderFactory: () => mockDocumentLoader
+		});
+		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox");
+		await federation.createContext(new URL("https://example.com/")).sendActivity({
+			keyId: childKeyId,
+			privateKey: ed25519PrivateKey
+		}, {
+			id: new URL("https://example.com/users/bob"),
+			inboxId: new URL("https://example.com/inbox")
+		}, activity, { fanout: "force" });
+		for (let i = 0; i < queued.length; i++) await federation.processQueuedTask(void 0, queued[i]);
+		assert(delivered != null);
+		const body = delivered;
+		delete body.signature;
+		assert(!Array.isArray(body.proof));
+		assertEquals((await verifyProof(body, await parseProof(body), options))?.id, childKeyId);
+		const embedded = body.object;
+		assertEquals(embedded["@context"], childContext);
+		assertEquals((await verifyProof(embedded, await parseProof(embedded), options))?.id, childKeyId);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+//#endregion
+export {};

package/dist/federation/handler-compound-proof.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";

package/dist/federation/handler-compound-proof.test.mjs

@@ -0,0 +1,384 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { r as createRequestContext, t as createInboxContext } from "../context-8Tu9kea0.mjs";
+import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { a as compactJsonLd, m as verifyCompactJsonLd, p as signJsonLd } from "../ld-CzaP-hJl.mjs";
+import { l as signRequest } from "../http-siciWkmx.mjs";
+import { a as rsaPrivateKey3, c as rsaPublicKey3, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { f as handleInbox, o as createFederation } from "../middleware-D7_LO-Vs.mjs";
+import { t as ActivityListenerSet } from "../activity-listener-C-BSbKI7.mjs";
+import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
+import { Create, CryptographicKey, Multikey, Person, Update } from "@fedify/vocab";
+import { encodeMultibase, exportDidKey, parseIri } from "@fedify/vocab-runtime";
+import { mockDocumentLoader, test } from "@fedify/fixture";
+import serialize from "json-canon";
+//#region src/federation/handler-compound-proof.test.ts
+async function sha256(value) {
+	return new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value)));
+}
+async function secureDocument(unsecuredDocument, privateJwk, verificationMethod) {
+	const proofConfiguration = {
+		"@context": unsecuredDocument["@context"],
+		type: "DataIntegrityProof",
+		cryptosuite: "eddsa-jcs-2022",
+		verificationMethod,
+		proofPurpose: "assertionMethod",
+		created: "2023-02-24T23:36:38Z"
+	};
+	const proofHash = await sha256(serialize(proofConfiguration));
+	const documentHash = await sha256(serialize(unsecuredDocument));
+	const input = /* @__PURE__ */ new Uint8Array(64);
+	input.set(proofHash);
+	input.set(documentHash, proofHash.length);
+	const privateKey = await crypto.subtle.importKey("jwk", privateJwk, "Ed25519", false, ["sign"]);
+	const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", privateKey, input));
+	return {
+		...unsecuredDocument,
+		proof: {
+			...proofConfiguration,
+			proofValue: new TextDecoder().decode(encodeMultibase("base58btc", signature))
+		}
+	};
+}
+function requestFor(body) {
+	return new Request("https://example.com/inbox", {
+		method: "POST",
+		body: JSON.stringify(body)
+	});
+}
+async function handle(requestOrBody, dispatched) {
+	const request = requestOrBody instanceof Request ? requestOrBody : requestFor(requestOrBody);
+	const context = createRequestContext({
+		federation: createFederation({ kv: new MemoryKvStore() }),
+		request,
+		url: new URL(request.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	const inboxListeners = new ActivityListenerSet();
+	const count = () => {
+		if (dispatched != null) dispatched.count++;
+	};
+	inboxListeners.add(Create, count);
+	inboxListeners.add(Update, count);
+	return await handleInbox(request, {
+		recipient: null,
+		context,
+		inboxContextFactory() {
+			return createInboxContext({
+				...context,
+				clone: void 0
+			});
+		},
+		kv: new MemoryKvStore(),
+		kvPrefixes: {
+			activityIdempotence: ["_fedify", "activityIdempotence"],
+			publicKey: ["_fedify", "publicKey"],
+			acceptSignatureNonce: ["_fedify", "acceptSignatureNonce"]
+		},
+		actorDispatcher() {
+			return null;
+		},
+		inboxListeners,
+		onNotFound() {
+			return new Response("Not found", { status: 404 });
+		},
+		signatureTimeWindow: { minutes: 5 },
+		skipSignatureVerification: false
+	});
+}
+test("handleInbox() enforces portable compound proofs atomically", async () => {
+	const valid = structuredClone(map_local_create_note_default.documents.finalSecuredCompound);
+	assertEquals((await handle(valid)).status, 202);
+	const unsignedInner = structuredClone(map_local_create_note_default.documents.outerUnsecuredDocument);
+	delete unsignedInner.object.proof;
+	const rejected = await handle(await secureDocument(unsignedInner, map_local_create_note_default.keys.outer.testPrivateKeyJwk, map_local_create_note_default.keys.outer.verificationMethod));
+	assertEquals([rejected.status, await rejected.text()], [401, "Failed to verify compound portable Object Integrity Proofs."]);
+	const tamperedInner = structuredClone(map_local_create_note_default.documents.outerUnsecuredDocument);
+	tamperedInner.object.content = "Tampered";
+	assertEquals((await handle(await secureDocument(tamperedInner, map_local_create_note_default.keys.outer.testPrivateKeyJwk, map_local_create_note_default.keys.outer.verificationMethod))).status, 401);
+	const changedAfterSigning = structuredClone(valid);
+	changedAfterSigning.summary = "Added after signing";
+	assertEquals((await handle(changedAfterSigning)).status, 401);
+});
+test("handleInbox() enforces compounds after alternate outer auth", async () => {
+	const createBody = (object) => ({
+		"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+		id: "https://example.com/activities/compound",
+		type: "Create",
+		actor: rsaPublicKey3.ownerId.href,
+		object
+	});
+	const validInner = structuredClone(map_local_create_note_default.documents.securedInner);
+	const unsignedInner = structuredClone(validInner);
+	delete unsignedInner.proof;
+	for (const authentication of ["http", "ld"]) {
+		const sign = async (body) => {
+			if (authentication === "http") return await signRequest(requestFor(body), rsaPrivateKey3, rsaPublicKey3.id);
+			return requestFor(await signJsonLd(body, rsaPrivateKey3, rsaPublicKey3.id, { contextLoader: mockDocumentLoader }));
+		};
+		const acceptedDispatch = { count: 0 };
+		assertEquals([(await handle(await sign(createBody(structuredClone(validInner))), acceptedDispatch)).status, acceptedDispatch.count], [202, 1]);
+		const rejectedDispatch = { count: 0 };
+		assertEquals([(await handle(await sign(createBody(structuredClone(unsignedInner))), rejectedDispatch)).status, rejectedDispatch.count], [401, 0]);
+	}
+	const proofSetInner = structuredClone(validInner);
+	proofSetInner.proof = [proofSetInner.proof];
+	const unsupportedDispatch = { count: 0 };
+	assertEquals([(await handle(await signRequest(requestFor(createBody(proofSetInner)), rsaPrivateKey3, rsaPublicKey3.id), unsupportedDispatch)).status, unsupportedDispatch.count], [401, 0]);
+});
+test("handleInbox() preserves ordinary top-level proof behavior", async () => {
+	assertEquals((await handle(await secureDocument({
+		"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+		id: "https://example.com/activities/ordinary",
+		type: "Create",
+		actor: map_local_create_note_default.keys.outer.controller,
+		object: {
+			id: "https://example.com/notes/ordinary",
+			type: "Note",
+			attributedTo: map_local_create_note_default.keys.outer.controller,
+			content: "An ordinary note"
+		}
+	}, map_local_create_note_default.keys.outer.testPrivateKeyJwk, map_local_create_note_default.keys.outer.verificationMethod))).status, 202);
+});
+async function signLd(document) {
+	return await signJsonLd(document, rsaPrivateKey3, rsaPublicKey3.id, { contextLoader: mockDocumentLoader });
+}
+async function isLdSignatureVerified(document) {
+	return await verifyCompactJsonLd(await compactJsonLd(document, mockDocumentLoader), {
+		contextLoader: mockDocumentLoader,
+		documentLoader: mockDocumentLoader
+	});
+}
+async function handleDispatched(body) {
+	const dispatched = { count: 0 };
+	const response = await handle(body, dispatched);
+	return [
+		response.status,
+		await response.text(),
+		dispatched.count
+	];
+}
+const COMPOUND_FAILURE = "Failed to verify compound portable Object Integrity Proofs.";
+test("handleInbox() ignores a portable activity's Linked Data Signature", async () => {
+	const signed = await signLd(structuredClone(map_local_create_note_default.documents.finalSecuredCompound));
+	assertEquals(await isLdSignatureVerified(signed), false);
+	assertEquals(await handleDispatched(signed), [
+		202,
+		"",
+		1
+	]);
+	const bogus = structuredClone(map_local_create_note_default.documents.finalSecuredCompound);
+	bogus.signature = {
+		type: "RsaSignature2017",
+		creator: "https://example.com/keys/1",
+		created: "2023-02-24T23:36:38Z",
+		signatureValue: "not-a-signature"
+	};
+	assertEquals(await handleDispatched(bogus), [
+		202,
+		"",
+		1
+	]);
+	const tampered = structuredClone(map_local_create_note_default.documents.finalSecuredCompound);
+	tampered.object = {
+		...tampered.object,
+		content: "Tampered"
+	};
+	assertEquals((await handleDispatched(await signLd(tampered)))[0], 401);
+	const invalidInner = structuredClone(map_local_create_note_default.documents.outerUnsecuredDocument);
+	invalidInner.object.content = "Tampered";
+	assertEquals(await handleDispatched(await signLd(await secureDocument(invalidInner, map_local_create_note_default.keys.outer.testPrivateKeyJwk, map_local_create_note_default.keys.outer.verificationMethod))), [
+		401,
+		COMPOUND_FAILURE,
+		0
+	]);
+});
+test("handleInbox() verifies compounds with verified Linked Data Signatures", async () => {
+	const createBody = (object) => ({
+		"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+		id: "https://example.com/activities/compound-ld",
+		type: "Create",
+		actor: rsaPublicKey3.ownerId.href,
+		object
+	});
+	const privateJwk = await crypto.subtle.exportKey("jwk", ed25519PrivateKey);
+	const sign = async (object) => await signLd(await secureDocument(createBody(object), privateJwk, ed25519PublicKey.id.href));
+	const valid = await sign(structuredClone(map_local_create_note_default.documents.securedInner));
+	assertEquals(await isLdSignatureVerified(valid), true);
+	assertEquals(await handleDispatched(valid), [
+		202,
+		"",
+		1
+	]);
+	const invalidInner = structuredClone(map_local_create_note_default.documents.securedInner);
+	invalidInner.content = "Tampered";
+	const invalid = await sign(invalidInner);
+	assertEquals(await isLdSignatureVerified(invalid), true);
+	assertEquals(await handleDispatched(invalid), [
+		401,
+		COMPOUND_FAILURE,
+		0
+	]);
+});
+test("handleInbox() keeps embedded signature properties in proof inputs", async () => {
+	const innerWithSignature = await secureDocument({
+		...map_local_create_note_default.documents.innerUnsecuredDocument,
+		"@context": ["https://w3id.org/security/v1", ...map_local_create_note_default.documents.innerUnsecuredDocument["@context"]],
+		signature: {
+			type: "https://example.com/ns#ExampleSignature",
+			signatureValue: "covered by the inner proof"
+		}
+	}, map_local_create_note_default.keys.inner.testPrivateKeyJwk, map_local_create_note_default.keys.inner.verificationMethod);
+	const sign = async (object) => await signLd(await secureDocument({
+		...map_local_create_note_default.documents.outerUnsecuredDocument,
+		object
+	}, map_local_create_note_default.keys.outer.testPrivateKeyJwk, map_local_create_note_default.keys.outer.verificationMethod));
+	assertEquals(await handleDispatched(await sign(structuredClone(innerWithSignature))), [
+		202,
+		"",
+		1
+	]);
+	const innerWithoutSignature = structuredClone(innerWithSignature);
+	delete innerWithoutSignature.signature;
+	assertEquals(await handleDispatched(await sign(innerWithoutSignature)), [
+		401,
+		COMPOUND_FAILURE,
+		0
+	]);
+});
+test("handleInbox() inspects compounds without the Linked Data Signature", async () => {
+	const activity = await secureDocument({
+		"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+		id: "https://example.com/activities/ordinary-ld",
+		type: "Create",
+		actor: map_local_create_note_default.keys.outer.controller,
+		object: {
+			id: "https://example.com/notes/ordinary-ld",
+			type: "Note",
+			attributedTo: map_local_create_note_default.keys.outer.controller,
+			content: "An ordinary note"
+		}
+	}, map_local_create_note_default.keys.outer.testPrivateKeyJwk, map_local_create_note_default.keys.outer.verificationMethod);
+	activity.signature = {
+		id: map_local_create_note_default.documents.innerUnsecuredDocument.id,
+		type: "RsaSignature2017",
+		creator: "https://example.com/keys/1",
+		created: "2023-02-24T23:36:38Z",
+		signatureValue: "not-a-signature"
+	};
+	assertEquals(await handleDispatched(activity), [
+		202,
+		"",
+		1
+	]);
+});
+test("handleInbox() accepts portable actors with keys at ap: URIs", async () => {
+	const did = await exportDidKey(ed25519PublicKey.publicKey);
+	const verificationMethod = `${did}#${did.slice(8)}`;
+	const privateJwk = await crypto.subtle.exportKey("jwk", ed25519PrivateKey);
+	const actorId = `ap://${did}/actor`;
+	const inboxId = `https://gw.example/.well-known/apgateway/${did}/actor/inbox`;
+	const actor = await new Person({
+		id: parseIri(actorId),
+		inbox: new URL(inboxId),
+		gateways: [new URL("https://gw.example")],
+		publicKey: new CryptographicKey({
+			id: parseIri(`${actorId}#main-key`),
+			owner: parseIri(actorId),
+			publicKey: rsaPublicKey2.publicKey
+		}),
+		assertionMethods: [new Multikey({
+			id: parseIri(`${actorId}#ed25519-key`),
+			controller: parseIri(actorId),
+			publicKey: ed25519PublicKey.publicKey
+		})]
+	}).toJsonLd({
+		format: "compact",
+		contextLoader: mockDocumentLoader
+	});
+	const update = async (keyBase) => {
+		const [multikey] = actor.assertionMethod;
+		return await secureDocument({
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+			id: `ap://${did}/activities/update`,
+			type: "Update",
+			actor: actorId,
+			object: await secureDocument({
+				...actor,
+				id: actorId,
+				publicKey: {
+					...actor.publicKey,
+					id: `${keyBase}#main-key`,
+					owner: actorId
+				},
+				assertionMethod: [{
+					...multikey,
+					id: `${keyBase}#ed25519-key`,
+					controller: actorId
+				}]
+			}, privateJwk, verificationMethod)
+		}, privateJwk, verificationMethod);
+	};
+	for (const keyBase of [actorId, `ap+ef61://${encodeURIComponent(did)}/actor`]) {
+		const dispatched = { count: 0 };
+		assertEquals([(await handle(await update(keyBase), dispatched)).status, dispatched.count], [202, 1], keyBase);
+	}
+	const dispatched = { count: 0 };
+	assertEquals([(await handle(await update("ap://did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK/actor"), dispatched)).status, dispatched.count], [401, 0]);
+});
+test("handleInbox() rejects embedded portable actors without valid gateways", async () => {
+	const did = await exportDidKey(ed25519PublicKey.publicKey);
+	const verificationMethod = `${did}#${did.slice(8)}`;
+	const privateJwk = await crypto.subtle.exportKey("jwk", ed25519PrivateKey);
+	const actorId = `ap://${did}/actor`;
+	const update = async (gateways) => await secureDocument({
+		"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+		id: `ap://${did}/activities/update`,
+		type: "Update",
+		actor: actorId,
+		object: await secureDocument({
+			"@context": [
+				"https://www.w3.org/ns/activitystreams",
+				"https://w3id.org/security/data-integrity/v1",
+				"https://w3id.org/fep/ef61"
+			],
+			id: actorId,
+			type: "Person",
+			inbox: `${actorId}/inbox`,
+			outbox: `${actorId}/outbox`,
+			...gateways
+		}, privateJwk, verificationMethod)
+	}, privateJwk, verificationMethod);
+	for (const [gateways, status, count] of [
+		[
+			{ gateways: ["https://gw.example"] },
+			202,
+			1
+		],
+		[
+			{},
+			401,
+			0
+		],
+		[
+			{ gateways: [] },
+			401,
+			0
+		],
+		[
+			{ gateways: ["https://gw.example/path"] },
+			400,
+			0
+		]
+	]) {
+		const dispatched = { count: 0 };
+		assertEquals([(await handle(await update(gateways), dispatched)).status, dispatched.count], [status, count], JSON.stringify(gateways));
+	}
+});
+//#endregion
+export {};