@fedify/fedify 2.4.0-pr.936.41 → 2.5.0-dev.2271

package/dist/sig/key-owner-evidence.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";

package/dist/sig/key-owner-evidence.test.mjs

@@ -0,0 +1,100 @@
+import { Temporal } from "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { n as getCanonicalPortableId } from "../portable-key-id-Ca30-hOa.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { a as promoteKeyOwnerEvidence, i as parseKeyOwnerEvidence, n as attachKeyOwnerEvidence, r as getVerifiedKeyOwnerEvidence } from "../key-owner-evidence-APB6NpSk.mjs";
+import { r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { CryptographicKey, Person } from "@fedify/vocab";
+import { exportDidKey, parseIri } from "@fedify/vocab-runtime";
+import { test } from "@fedify/fixture";
+//#region src/sig/key-owner-evidence.test.ts
+const did = await exportDidKey(ed25519PublicKey.publicKey);
+const rawActorId = `ap://${did}/actors/alice`;
+const actorId = parseIri(rawActorId);
+const keyId = new URL(`https://gw.example/.well-known/apgateway/${did}/actors/alice#main-key`);
+const document = {
+	"@id": rawActorId,
+	"@type": ["https://www.w3.org/ns/activitystreams#Person"],
+	"https://www.w3.org/ns/activitystreams#name": [{ "@value": "Alice" }]
+};
+const expires = Temporal.Now.instant().add({ hours: 1 });
+function createKey(owner = actorId) {
+	return new CryptographicKey({
+		id: new URL(keyId.href),
+		owner: parseIri(owner.href),
+		publicKey: rsaPublicKey2.publicKey
+	});
+}
+test("getVerifiedKeyOwnerEvidence() only returns promoted evidence", () => {
+	const key = createKey();
+	assert(attachKeyOwnerEvidence(key, document, expires));
+	assertEquals(getVerifiedKeyOwnerEvidence(key), void 0);
+	promoteKeyOwnerEvidence(key);
+	const evidence = getVerifiedKeyOwnerEvidence(key);
+	assertEquals(evidence?.ownerId, getCanonicalPortableId(actorId));
+	assertEquals(evidence?.keyId, keyId.href);
+	assertEquals(evidence?.expires, expires);
+	const other = createKey();
+	promoteKeyOwnerEvidence(other);
+	assertEquals(getVerifiedKeyOwnerEvidence(other), void 0);
+});
+test("attachKeyOwnerEvidence() refuses evidence about other actors", () => {
+	const otherActorId = parseIri(`ap://${did}/actors/bob`);
+	assertFalse(attachKeyOwnerEvidence(createKey(otherActorId), {
+		...document,
+		"@id": otherActorId.href
+	}, expires));
+	assertFalse(attachKeyOwnerEvidence(createKey(), {
+		...document,
+		"@id": `ap://${did}/actors/bob`
+	}, expires));
+	assertFalse(attachKeyOwnerEvidence(createKey(), {
+		...document,
+		"@id": `ap://${did}/x/../actors/alice`
+	}, expires));
+	assertFalse(attachKeyOwnerEvidence(createKey(), {}, expires));
+	assertFalse(attachKeyOwnerEvidence(createKey(), [document], expires));
+});
+test("getVerifiedKeyOwnerEvidence() ignores expired evidence", () => {
+	const key = createKey();
+	attachKeyOwnerEvidence(key, document, expires);
+	promoteKeyOwnerEvidence(key);
+	assert(getVerifiedKeyOwnerEvidence(key, expires.subtract({ seconds: 1 })));
+	assertEquals(getVerifiedKeyOwnerEvidence(key, expires), void 0);
+});
+test("getVerifiedKeyOwnerEvidence() ignores keys changed since", () => {
+	const key = createKey();
+	attachKeyOwnerEvidence(key, document, expires);
+	promoteKeyOwnerEvidence(key);
+	key.clone({}).ownerId.href = parseIri(`ap://${did}/actors/bob`).href;
+	assertEquals(getVerifiedKeyOwnerEvidence(key), void 0);
+	const moved = createKey();
+	attachKeyOwnerEvidence(moved, document, expires);
+	promoteKeyOwnerEvidence(moved);
+	moved.ownerId.href = `https://other.example/.well-known/apgateway/${did}/actors/alice`;
+	assertEquals(getVerifiedKeyOwnerEvidence(moved), void 0);
+	const verified = createKey();
+	attachKeyOwnerEvidence(verified, document, expires);
+	promoteKeyOwnerEvidence(verified);
+	assertEquals(getVerifiedKeyOwnerEvidence(verified.clone({})), void 0);
+});
+test("parseKeyOwnerEvidence() parses a new actor every time", async () => {
+	const key = createKey();
+	const doc = structuredClone(document);
+	attachKeyOwnerEvidence(key, doc, expires);
+	promoteKeyOwnerEvidence(key);
+	doc["@id"] = `ap://${did}/actors/bob`;
+	const evidence = getVerifiedKeyOwnerEvidence(key);
+	const actor = await parseKeyOwnerEvidence(evidence);
+	assert(actor instanceof Person);
+	assertEquals(actor.id?.href, actorId.href);
+	assertEquals(actor.name?.toString(), "Alice");
+	actor.id.href = parseIri(`ap://${did}/actors/bob`).href;
+	assertEquals((await parseKeyOwnerEvidence(evidence))?.id?.href, actorId.href);
+});
+//#endregion
+export {};

package/dist/sig/key.test.mjs

@@ -1,15 +1,16 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { t as assertEquals } from "../assert_equals-BV7oLMxm.mjs";
-import "../std__assert-B2NnY9bq.mjs";
-import { t as assertRejects } from "../assert_rejects-EgstcQy5.mjs";
-import { t as assertThrows } from "../assert_throws-NiFfqbnH.mjs";
-import { a as importJwk, i as generateCryptoKeyPair, n as fetchKey, o as validateCryptoKey, r as fetchKeyDetailed, t as exportJwk } from "../key-DfPsX8hv.mjs";
-import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-Dbyd7bhl.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, i as fetchKey, n as exportJwk, o as generateCryptoKeyPair, s as importJwk } from "../key-BspPiXqn.mjs";
+import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey, Multikey } from "@fedify/vocab";
-import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, exportDidKey } from "@fedify/vocab-runtime";
+import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 //#region src/sig/key.test.ts
 test("validateCryptoKey()", async () => {
 	const pkcs1v15 = await crypto.subtle.generateKey({
@@ -267,7 +268,7 @@ test("fetchKeyDetailed()", async () => {
 		key: rsaPublicKey1,
 		cached: false
 	});
-	assertEquals(documentLoaderCalls, 1);
+	assertEquals(documentLoaderCalls, 2);
 	const spans = exporter.getSpans("activitypub.fetch_key");
 	assertEquals(spans.length, 2);
 	assertEquals(spans[0].attributes["activitypub.actor.key.cached"], true);
@@ -584,6 +585,51 @@ test("fetchKey() works when meterProvider is omitted", async () => {
 		contextLoader: mockDocumentLoader
 	})).cached, false);
 });
+test("fetchKey() rejects standalone keys with a mismatched id", async () => {
+	for (const { keyId, standaloneKey, fetch } of [{
+		keyId: "https://example.com/key",
+		standaloneKey: rsaPublicKey1,
+		fetch: (keyId, options) => fetchKey(keyId, CryptographicKey, options)
+	}, {
+		keyId: "https://example.com/multikey",
+		standaloneKey: ed25519Multikey,
+		fetch: (keyId, options) => fetchKey(keyId, Multikey, options)
+	}]) {
+		const cache = {};
+		const options = {
+			async documentLoader(resource) {
+				if (resource === keyId) return {
+					contextUrl: null,
+					documentUrl: resource,
+					document: {
+						...await standaloneKey.toJsonLd({ contextLoader: mockDocumentLoader }),
+						id: "https://example.com/different-key"
+					}
+				};
+				return await mockDocumentLoader(resource);
+			},
+			contextLoader: mockDocumentLoader,
+			keyCache: {
+				get(keyId) {
+					return Promise.resolve(cache[keyId.href]);
+				},
+				set(keyId, key) {
+					cache[keyId.href] = key;
+					return Promise.resolve();
+				}
+			}
+		};
+		assertEquals(await fetch(keyId, options), {
+			key: null,
+			cached: false
+		});
+		assertEquals(cache, { [keyId]: null });
+		assertEquals(await fetch(keyId, options), {
+			key: null,
+			cached: true
+		});
+	}
+});
 test("fetchKey() returns null for a malformed actor publicKey", async () => {
 	const actorId = "https://example.com/malformed-public-key";
 	const keyId = "https://example.com/malformed-public-key#main-key";
@@ -634,5 +680,171 @@ test("fetchKey() returns null for a malformed actor publicKey", async () => {
 		cached: true
 	});
 });
+test("fetchKey() rejects a key whose owner does not link back", async () => {
+	const keyId = "https://attacker.example/key";
+	const keyDocument = await rsaPublicKey1.toJsonLd({ contextLoader: mockDocumentLoader });
+	const serveKeyOwnedBy = (owner) => ({
+		documentLoader(resource) {
+			if (resource === keyId) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					...keyDocument,
+					id: keyId,
+					owner
+				}
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader
+	});
+	assertEquals(await fetchKey(keyId, CryptographicKey, serveKeyOwnedBy("https://example.com/person")), {
+		key: null,
+		cached: false
+	});
+	assertEquals(await fetchKey(keyId, CryptographicKey, serveKeyOwnedBy("https://impersonated.invalid/users/victim")), {
+		key: null,
+		cached: false
+	});
+});
+test("fetchKey() rejects a Multikey whose controller does not link back", async () => {
+	const keyId = "https://attacker.example/multikey";
+	const keyDocument = await ed25519Multikey.toJsonLd({ contextLoader: mockDocumentLoader });
+	assertEquals(await fetchKey(keyId, Multikey, {
+		documentLoader(resource) {
+			if (resource === keyId) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					...keyDocument,
+					id: keyId,
+					controller: "https://example.com/person2"
+				}
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader
+	}), {
+		key: null,
+		cached: false
+	});
+});
+test("fetchKey() rejects an actor document from another origin", async () => {
+	const keyId = "https://attacker.example/key";
+	const impersonated = "https://example.com/person";
+	const { publicKeyPem } = await rsaPublicKey1.toJsonLd({ contextLoader: mockDocumentLoader });
+	assertEquals(await fetchKey(keyId, CryptographicKey, {
+		documentLoader(resource) {
+			if (resource === keyId) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
+					id: impersonated,
+					type: "Person",
+					publicKey: [{
+						id: `${impersonated}#main-key`,
+						type: "CryptographicKey",
+						owner: impersonated,
+						publicKeyPem
+					}]
+				}
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader
+	}), {
+		key: null,
+		cached: false
+	});
+});
+test("fetchKey() rejects a key that disowns the actor document holding it", async () => {
+	const actorId = "https://attacker.example/actor";
+	const keyId = `${actorId}#main-key`;
+	const { publicKeyPem } = await rsaPublicKey1.toJsonLd({ contextLoader: mockDocumentLoader });
+	assertEquals(await fetchKey(keyId, CryptographicKey, {
+		documentLoader(resource) {
+			if (resource === keyId || resource === actorId) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
+					id: actorId,
+					type: "Person",
+					publicKey: [{
+						id: keyId,
+						type: "CryptographicKey",
+						owner: "https://example.com/person",
+						publicKeyPem
+					}]
+				}
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader
+	}), {
+		key: null,
+		cached: false
+	});
+});
+test("fetchKey() records the owner its actor document establishes", async () => {
+	const { key } = await fetchKey("https://example.com/users/handle#main-key", CryptographicKey, {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	assertEquals(key?.ownerId, new URL("https://example.com/users/handle"));
+});
+test("fetchKey() accepts a key document that leaves its id implicit", async () => {
+	const keyId = "https://example.com/key";
+	const keyDocument = await rsaPublicKey1.toJsonLd({ contextLoader: mockDocumentLoader });
+	delete keyDocument.id;
+	const { key } = await fetchKey(keyId, CryptographicKey, {
+		documentLoader(resource) {
+			if (resource === keyId) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: keyDocument
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader
+	});
+	assertEquals(key?.id, new URL(keyId));
+	assertEquals(key?.ownerId, new URL("https://example.com/person"));
+	assert(key?.publicKey != null);
+});
+test("fetchKey() records the controller an actor document establishes", async () => {
+	const actorId = "https://example.com/multikey-actor";
+	const keyId = `${actorId}#assertion`;
+	const { publicKeyMultibase } = await ed25519Multikey.toJsonLd({ contextLoader: mockDocumentLoader });
+	const { key } = await fetchKey(keyId, Multikey, {
+		documentLoader(resource) {
+			if (resource === actorId || resource === keyId) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: actorId,
+				document: {
+					"@context": [
+						"https://www.w3.org/ns/activitystreams",
+						"https://w3id.org/security/v1",
+						"https://w3id.org/security/multikey/v1",
+						"https://w3id.org/security/data-integrity/v1",
+						"https://www.w3.org/ns/did/v1"
+					],
+					id: actorId,
+					type: "Person",
+					assertionMethod: [{
+						id: keyId,
+						type: "Multikey",
+						publicKeyMultibase
+					}]
+				}
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader
+	});
+	assertEquals(key?.controllerId, new URL(actorId));
+	assert(key?.publicKey != null);
+});
 //#endregion
 export {};

package/dist/sig/ld.test.mjs

@@ -1,18 +1,24 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { t as assertEquals } from "../assert_equals-BV7oLMxm.mjs";
-import { n as assertGreaterOrEqual, r as assertFalse, t as assertRejects } from "../assert_rejects-EgstcQy5.mjs";
-import { t as assertThrows } from "../assert_throws-NiFfqbnH.mjs";
-import { t as assert } from "../assert-CJ1KXcvv.mjs";
-import { i as generateCryptoKeyPair } from "../key-DfPsX8hv.mjs";
-import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-Dbyd7bhl.mjs";
-import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-Cj9F_5AP.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
+import { t as assertGreaterOrEqual } from "../assert_greater_or_equal-BlafOF4-.mjs";
+import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
+import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
+import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { o as generateCryptoKeyPair } from "../key-BspPiXqn.mjs";
+import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-CzaP-hJl.mjs";
+import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { encodeBase64 } from "byte-encodings/base64";
 //#region src/sig/ld.test.ts
 test("isInvalidUrlTypeError()", () => {
+	assert(isInvalidUrlTypeError(/* @__PURE__ */ new TypeError("Invalid URL string.")));
+	assertFalse(isInvalidUrlTypeError(/* @__PURE__ */ new Error("Invalid URL string.")));
+	assertFalse(isInvalidUrlTypeError(/* @__PURE__ */ new TypeError("Invalid URL string. Other error")));
 	assert(isInvalidUrlTypeError(/* @__PURE__ */ new TypeError("Invalid URL: http://[")));
 	assert(isInvalidUrlTypeError(/* @__PURE__ */ new TypeError("\"http://[\" cannot be parsed as a URL.")));
 	const error = /* @__PURE__ */ new TypeError("Failed to parse URL");
@@ -938,5 +944,57 @@ test("compactJsonLd() rejects inputs that compact into @graph wrappers", async (
 		content: "two"
 	}], mockDocumentLoader), UnsafeJsonLdError, "Unsupported JSON-LD keyword: @graph.");
 });
+test("verifyJsonLd() rejects a key that claims a forged owner", async () => {
+	const keyId = new URL("https://attacker.example/key");
+	const impersonated = "https://example.com/person";
+	const { publicKeyPem } = await rsaPublicKey2.toJsonLd({ contextLoader: mockDocumentLoader });
+	const signed = await signJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://attacker.example/activities/1",
+		type: "Create",
+		actor: impersonated
+	}, rsaPrivateKey2, keyId, { contextLoader: mockDocumentLoader });
+	const serveKeyOwnedBy = (owner) => (resource) => {
+		if (resource === keyId.href) return Promise.resolve({
+			contextUrl: null,
+			documentUrl: resource,
+			document: {
+				"@context": "https://w3id.org/security/v1",
+				id: keyId.href,
+				type: "CryptographicKey",
+				owner,
+				publicKeyPem
+			}
+		});
+		if (resource === "https://attacker.example/actor") return Promise.resolve({
+			contextUrl: null,
+			documentUrl: resource,
+			document: {
+				"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
+				id: resource,
+				type: "Person",
+				publicKey: [keyId.href]
+			}
+		});
+		return mockDocumentLoader(resource);
+	};
+	assertEquals(await verifySignature(signed, {
+		documentLoader: serveKeyOwnedBy(impersonated),
+		contextLoader: mockDocumentLoader
+	}), null);
+	assertFalse(await verifyJsonLd(signed, {
+		documentLoader: serveKeyOwnedBy(impersonated),
+		contextLoader: mockDocumentLoader
+	}));
+	const honestLoader = serveKeyOwnedBy("https://attacker.example/actor");
+	assertInstanceOf(await verifySignature(signed, {
+		documentLoader: honestLoader,
+		contextLoader: mockDocumentLoader
+	}), CryptographicKey);
+	assertFalse(await verifyJsonLd(signed, {
+		documentLoader: honestLoader,
+		contextLoader: mockDocumentLoader
+	}));
+});
 //#endregion
 export {};

package/dist/sig/mitra-receive-interop.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";