@fedify/fedify 2.4.0-pr.936.41 → 2.5.0-dev.2271

package/dist/sig/owner.test.mjs

@@ -1,12 +1,12 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { t as assertEquals } from "../assert_equals-BV7oLMxm.mjs";
-import "../std__assert-B2NnY9bq.mjs";
-import { r as assertFalse } from "../assert_rejects-EgstcQy5.mjs";
-import { t as assert } from "../assert-CJ1KXcvv.mjs";
-import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-Dbyd7bhl.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-Br9YYzn_.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-DYgfTFHy.mjs";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 //#region src/sig/owner.test.ts
@@ -40,7 +40,7 @@ test("doesActorOwnKey() records OpenTelemetry span", async () => {
 		id: new URL("https://example.com/activity"),
 		actor: new URL("https://example.com/person")
 	}), new CryptographicKey({
-		id: new URL("https://example.com/person#key"),
+		id: new URL("https://example.com/key"),
 		owner: new URL("https://example.com/person")
 	}), {
 		documentLoader: mockDocumentLoader,
@@ -50,9 +50,108 @@ test("doesActorOwnKey() records OpenTelemetry span", async () => {
 	assertEquals(spans.length, 1);
 	const span = spans[0];
 	assertEquals(span.attributes["activitypub.actor.id"], "https://example.com/person");
-	assertEquals(span.attributes["activitypub.key.id"], "https://example.com/person#key");
+	assertEquals(span.attributes["activitypub.key.id"], "https://example.com/key");
 	assertEquals(span.attributes["activitypub.key_ownership.verified"], true);
-	assertEquals(span.attributes["activitypub.key_ownership.method"], "owner_id");
+	assertEquals(span.attributes["activitypub.key_ownership.method"], "key_owner");
+});
+test("doesActorOwnKey() rejects a key that only claims to be owned", async () => {
+	const options = {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	};
+	assertFalse(await doesActorOwnKey(new Create({ actor: new URL("https://example.com/person") }), new CryptographicKey({
+		id: new URL("https://attacker.example/key"),
+		owner: new URL("https://example.com/person")
+	}), options));
+	const unresolvable = new URL("https://impersonated.invalid/users/victim");
+	assertFalse(await doesActorOwnKey(new Create({ actor: unresolvable }), new CryptographicKey({
+		id: new URL("https://attacker.example/key"),
+		owner: unresolvable
+	}), options));
+});
+test("doesActorOwnKey() ignores an actor embedded in the activity", async () => {
+	const { publicKeyPem } = await rsaPublicKey1.toJsonLd({ contextLoader: mockDocumentLoader });
+	const activity = await Create.fromJsonLd({
+		"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
+		id: "https://example.com/activity",
+		type: "Create",
+		actor: {
+			id: "https://example.com/person",
+			type: "Person",
+			publicKey: {
+				id: "https://attacker.example/key",
+				type: "CryptographicKey",
+				owner: "https://example.com/person",
+				publicKeyPem
+			}
+		}
+	}, {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	assertEquals(activity.actorId, new URL("https://example.com/person"));
+	assertFalse(await doesActorOwnKey(activity, new CryptographicKey({ id: new URL("https://attacker.example/key") }), {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	}));
+});
+test("getKeyOwner() rejects an actor document from another origin", async () => {
+	const keyId = "https://attacker.example/key";
+	const { publicKeyPem } = await rsaPublicKey1.toJsonLd({ contextLoader: mockDocumentLoader });
+	const options = {
+		documentLoader(resource) {
+			if (resource === keyId) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
+					id: "https://example.com/person",
+					type: "Person",
+					publicKey: [{
+						id: keyId,
+						type: "CryptographicKey",
+						publicKeyPem
+					}]
+				}
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader
+	};
+	assertEquals(await getKeyOwner(new URL(keyId), options), null);
+});
+test("doesActorOwnKey() matches a key that leaves its id implicit", async () => {
+	const actorId = "https://example.com/implicit-key-actor";
+	const { publicKeyPem } = await rsaPublicKey1.toJsonLd({ contextLoader: mockDocumentLoader });
+	const options = {
+		documentLoader(resource) {
+			if (resource === actorId) return Promise.resolve({
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
+					id: actorId,
+					type: "Person",
+					publicKey: [{
+						type: "CryptographicKey",
+						owner: actorId,
+						publicKeyPem
+					}]
+				}
+			});
+			return mockDocumentLoader(resource);
+		},
+		contextLoader: mockDocumentLoader
+	};
+	const activity = new Create({ actor: new URL(actorId) });
+	assert(await doesActorOwnKey(activity, new CryptographicKey({
+		owner: new URL(actorId),
+		publicKey: rsaPublicKey1.publicKey
+	}), options));
+	assertFalse(await doesActorOwnKey(activity, new CryptographicKey({
+		owner: new URL(actorId),
+		publicKey: rsaPublicKey2.publicKey
+	}), options));
 });
 //#endregion
 export {};

package/dist/sig/portable-collection.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";