@fedify/fedify 2.4.0-pr.936.41 → 2.5.0-dev.2271

package/dist/sig/portable-collection.test.mjs

@@ -0,0 +1,697 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
+import { t as verifyPortableObject } from "../portable-collection-C74P1vtC.mjs";
+import { Collection, CollectionPage, Note, OrderedCollection, Person, traverseCollection } from "@fedify/vocab";
+import { FetchError, encodeMultibase, exportDidKey, preloadedContexts } from "@fedify/vocab-runtime";
+import { test } from "@fedify/fixture";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import serialize from "json-canon";
+//#region src/sig/portable-collection.test.ts
+const AS = "https://www.w3.org/ns/activitystreams#";
+const context = [
+	"https://www.w3.org/ns/activitystreams",
+	"https://w3id.org/security/data-integrity/v1",
+	"https://w3id.org/fep/ef61"
+];
+const did = await exportDidKey(ed25519PublicKey.publicKey);
+const keyId = `${did}#${did.slice(8)}`;
+const otherKeyPair = await crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
+const otherDid = await exportDidKey(otherKeyPair.publicKey);
+const actorId = `ap://${did}/actor`;
+const outboxId = `ap://${did}/actor/outbox`;
+const gw1 = "https://gw1.example";
+const gw2 = "https://gw2.example";
+const evil = "https://evil.example";
+function gatewayUrl(gateway, id) {
+	return `${gateway}/.well-known/apgateway/${id.replace(/^ap:\/\//, "")}`;
+}
+async function sign(document, privateKey = ed25519PrivateKey, verificationMethod = keyId) {
+	const proofConfig = {
+		"@context": document["@context"],
+		type: "DataIntegrityProof",
+		cryptosuite: "eddsa-jcs-2022",
+		verificationMethod,
+		proofPurpose: "assertionMethod",
+		created: "2023-02-24T23:36:38Z"
+	};
+	const encoder = new TextEncoder();
+	const proofDigest = await crypto.subtle.digest("SHA-256", encoder.encode(serialize(proofConfig)));
+	const messageDigest = await crypto.subtle.digest("SHA-256", encoder.encode(serialize(document)));
+	const digest = /* @__PURE__ */ new Uint8Array(64);
+	digest.set(new Uint8Array(proofDigest), 0);
+	digest.set(new Uint8Array(messageDigest), 32);
+	const signature = await crypto.subtle.sign("Ed25519", privateKey, digest);
+	return {
+		...document,
+		proof: {
+			...proofConfig,
+			proofValue: new TextDecoder().decode(encodeMultibase("base58btc", new Uint8Array(signature)))
+		}
+	};
+}
+function actor(overrides = {}) {
+	return {
+		"@context": context,
+		id: actorId,
+		type: "Person",
+		inbox: `ap://${did}/actor/inbox`,
+		outbox: outboxId,
+		followers: `ap://${did}/actor/followers`,
+		gateways: [gw1, gw2],
+		...overrides
+	};
+}
+function outbox(overrides = {}) {
+	return {
+		"@context": context,
+		id: outboxId,
+		type: "OrderedCollection",
+		totalItems: 0,
+		...overrides
+	};
+}
+const contextLoader = (url) => {
+	const document = preloadedContexts[url];
+	if (document == null) return Promise.reject(/* @__PURE__ */ new Error(`No context: ${url}`));
+	return Promise.resolve({
+		contextUrl: null,
+		documentUrl: url,
+		document
+	});
+};
+function createLoader(responses) {
+	const fetched = [];
+	const loader = (url) => {
+		fetched.push(url);
+		let response = responses[url];
+		let documentUrl = url;
+		if (response != null && "redirect" in response) {
+			documentUrl = response.redirect;
+			response = responses[documentUrl];
+		}
+		if (response == null) return Promise.reject(URL.canParse(url) ? new FetchError(url, "HTTP 404", new Response(null, { status: 404 })) : /* @__PURE__ */ new Error(`Not found: ${url}`));
+		return Promise.resolve({
+			contextUrl: null,
+			documentUrl,
+			document: structuredClone(response)
+		});
+	};
+	return Object.assign(loader, { fetched });
+}
+function linkFrom(object, property, overrides = {}) {
+	return {
+		object,
+		id: object.id ?? null,
+		property: AS + property,
+		...overrides
+	};
+}
+async function verify(document, options) {
+	return await verifyPortableObject(document, {
+		contextLoader,
+		...options
+	});
+}
+function assertFailure(result, type) {
+	ok(!result.verified, `expected ${type}, got ${JSON.stringify(result)}`);
+	strictEqual(result.reason.type, type);
+}
+const signedActor = await sign(actor());
+const actorObject = await Person.fromJsonLd(signedActor, { contextLoader });
+test("verifyPortableObject() trusts unsecured collections from listed gateways", async () => {
+	const documentLoader = createLoader({ [gatewayUrl(gw1, actorId)]: signedActor });
+	const result = await verify(outbox(), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw2, outboxId)),
+		gatewayHints: [new URL(gw1)],
+		referrer: linkFrom(actorObject, "outbox")
+	});
+	ok(result.verified);
+	strictEqual(result.method, "gateway");
+	if (result.method !== "gateway") return;
+	deepStrictEqual(result.gateway, new URL(gw2));
+	strictEqual(result.owner.href, actorObject.id?.href);
+	deepStrictEqual(documentLoader.fetched, [gatewayUrl(gw1, actorId)]);
+});
+test("verifyPortableObject() rejects unsecured collections from unlisted gateways", async () => {
+	const result = await verify(outbox(), {
+		documentLoader: createLoader({ [gatewayUrl(gw1, actorId)]: signedActor }),
+		documentUrl: new URL(gatewayUrl(evil, outboxId)),
+		gatewayHints: [new URL(evil), new URL(gw1)],
+		referrer: linkFrom(actorObject, "outbox")
+	});
+	assertFailure(result, "untrustedGateway");
+	if (result.verified || result.reason.type !== "untrustedGateway") return;
+	deepStrictEqual(result.reason.gateway, new URL(evil));
+	deepStrictEqual(result.reason.gateways, [new URL(gw1), new URL(gw2)]);
+});
+test("verifyPortableObject() uses the actual fetch source", async () => {
+	const documentLoader = createLoader({ [gatewayUrl(gw1, actorId)]: signedActor });
+	const referrer = linkFrom(actorObject, "outbox");
+	const gateways = [new URL(gw1)];
+	assertFailure(await verify(outbox(), {
+		documentLoader,
+		gateways,
+		referrer
+	}), "unknownCollectionSource");
+	assertFailure(await verify(outbox(), {
+		documentLoader,
+		gateways,
+		referrer,
+		documentUrl: new URL("https://gw1.example/cdn/outbox.json")
+	}), "unknownCollectionSource");
+	assertFailure(await verify(outbox(), {
+		documentLoader,
+		gateways,
+		referrer,
+		documentUrl: new URL(gatewayUrl(gw1, `ap://${did}/actor/inbox`))
+	}), "unknownCollectionSource");
+	assertFailure(await verify(outbox(), {
+		documentLoader,
+		gateways,
+		referrer,
+		documentUrl: new URL(`https://user@gw1.example/.well-known/apgateway/${did}/actor/outbox`)
+	}), "unknownCollectionSource");
+	const result = await verify(outbox({ id: gatewayUrl(evil, outboxId) }), {
+		documentLoader,
+		gateways,
+		referrer,
+		documentUrl: new URL(gatewayUrl(gw1, outboxId))
+	});
+	ok(result.verified);
+	strictEqual(result.method, "gateway");
+	if (result.method !== "gateway") return;
+	deepStrictEqual(result.gateway, new URL(gw1));
+	assertFailure(await verify(outbox({ id: `${evil}/outbox` }), {
+		documentLoader,
+		gateways,
+		referrer,
+		documentUrl: new URL(gatewayUrl(gw1, outboxId))
+	}), "notPortableObject");
+});
+test("verifyPortableObject() trusts unsecured collections of compatible-ID actors", async () => {
+	const compatibleActorId = gatewayUrl(gw1, actorId);
+	const compatibleOutboxId = gatewayUrl(gw1, outboxId);
+	const signed = await sign(actor({
+		id: compatibleActorId,
+		inbox: gatewayUrl(gw1, `ap://${did}/actor/inbox`),
+		outbox: compatibleOutboxId,
+		followers: gatewayUrl(gw1, `ap://${did}/actor/followers`)
+	}));
+	const collection = outbox({
+		id: compatibleOutboxId,
+		attributedTo: compatibleActorId
+	});
+	const documentLoader = createLoader({ [compatibleActorId]: signed });
+	const result = await verify(collection, {
+		documentLoader,
+		documentUrl: new URL(compatibleOutboxId)
+	});
+	ok(result.verified, JSON.stringify(result));
+	strictEqual(result.method, "gateway");
+	if (result.method !== "gateway") return;
+	deepStrictEqual(result.gateway, new URL(gw1));
+	deepStrictEqual(documentLoader.fetched, [compatibleActorId]);
+	const noGateways = createLoader({ [compatibleActorId]: signed });
+	assertFailure(await verify(collection, {
+		documentLoader: noGateways,
+		documentUrl: new URL(compatibleOutboxId),
+		gateways: []
+	}), "collectionOwnerUnavailable");
+	deepStrictEqual(noGateways.fetched.filter((url) => url === compatibleActorId), []);
+	assertFailure(await verify(collection, {
+		documentLoader: createLoader({ [compatibleActorId]: actor({
+			id: compatibleActorId,
+			outbox: compatibleOutboxId
+		}) }),
+		documentUrl: new URL(compatibleOutboxId)
+	}), "collectionOwnerUnavailable");
+});
+test("verifyPortableObject() requires an unambiguous owner", async () => {
+	const base = {
+		documentLoader: createLoader({ [gatewayUrl(gw1, actorId)]: signedActor }),
+		documentUrl: new URL(gatewayUrl(gw1, outboxId)),
+		gateways: [new URL(gw1)]
+	};
+	assertFailure(await verify(outbox(), base), "unknownCollectionOwner");
+	const note = await Note.fromJsonLd({
+		"@context": context,
+		id: `ap://${did}/notes/1`,
+		type: "Note"
+	}, { contextLoader });
+	assertFailure(await verify(outbox(), {
+		...base,
+		referrer: linkFrom(note, "replies")
+	}), "unknownCollectionOwner");
+	const attributed = await verify(outbox({ attributedTo: actorId }), base);
+	ok(attributed.verified);
+	strictEqual(attributed.method, "gateway");
+	assertFailure(await verify(outbox({ attributedTo: [actorId, `ap://${did}/actor2`] }), base), "conflictingCollectionOwners");
+	assertFailure(await verify(outbox({ attributedTo: `ap://${did}/actor2` }), {
+		...base,
+		referrer: linkFrom(actorObject, "outbox")
+	}), "conflictingCollectionOwners");
+	assertFailure(await verify(outbox({ attributedTo: "https://example.com/actor" }), base), "unknownCollectionOwner");
+});
+test("verifyPortableObject() requires the owner to share the collection's DID", async () => {
+	const foreignActorId = `ap://${otherDid}/actor`;
+	const foreignActor = await sign(actor({
+		id: foreignActorId,
+		gateways: [evil]
+	}), otherKeyPair.privateKey, `${otherDid}#${otherDid.slice(8)}`);
+	const foreignActorObject = await Person.fromJsonLd(foreignActor, { contextLoader });
+	const documentLoader = createLoader({ [gatewayUrl(evil, foreignActorId)]: foreignActor });
+	const base = {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(evil, outboxId)),
+		gateways: [new URL(evil)]
+	};
+	assertFailure(await verify(outbox(), {
+		...base,
+		referrer: linkFrom(foreignActorObject, "outbox")
+	}), "unknownCollectionOwner");
+	assertFailure(await verify(outbox({ attributedTo: foreignActorId }), base), "unknownCollectionOwner");
+	deepStrictEqual(documentLoader.fetched, []);
+});
+test("verifyPortableObject() confirms the owner with its actor document", async () => {
+	const documentUrl = new URL(gatewayUrl(gw1, outboxId));
+	const gateways = [new URL(gw1)];
+	const referrer = linkFrom(actorObject, "outbox");
+	assertFailure(await verify(outbox(), {
+		documentLoader: createLoader({}),
+		documentUrl,
+		gateways,
+		referrer
+	}), "collectionOwnerUnavailable");
+	assertFailure(await verify(outbox(), {
+		documentLoader: createLoader({ [gatewayUrl(gw1, actorId)]: actor() }),
+		documentUrl,
+		gateways,
+		referrer
+	}), "collectionOwnerUnavailable");
+	const { gateways: _, ...noGateways } = actor();
+	assertFailure(await verify(outbox(), {
+		documentLoader: createLoader({ [gatewayUrl(gw1, actorId)]: await sign(noGateways) }),
+		documentUrl,
+		gateways,
+		referrer
+	}), "collectionOwnerUnavailable");
+	const otherCollectionId = `ap://${did}/collections/1`;
+	assertFailure(await verify(outbox({
+		id: otherCollectionId,
+		attributedTo: actorId
+	}), {
+		documentLoader: createLoader({ [gatewayUrl(gw1, actorId)]: signedActor }),
+		documentUrl: new URL(gatewayUrl(gw1, otherCollectionId)),
+		gateways
+	}), "collectionNotListedByOwner");
+	const emptyLoader = createLoader({ [gatewayUrl(gw1, actorId)]: signedActor });
+	assertFailure(await verify(outbox(), {
+		documentLoader: emptyLoader,
+		documentUrl,
+		gateways: [],
+		gatewayHints: [new URL(gw1)],
+		referrer
+	}), "collectionOwnerUnavailable");
+	deepStrictEqual(emptyLoader.fetched, [`ap+ef61://${did}/actor`]);
+});
+test("verifyPortableObject() reuses a verified referring actor", async () => {
+	const documentLoader = createLoader({});
+	const result = await verify(outbox(), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, outboxId)),
+		referrer: linkFrom(actorObject, "outbox", { acceptance: "verified" })
+	});
+	ok(result.verified);
+	strictEqual(result.method, "gateway");
+	deepStrictEqual(documentLoader.fetched, []);
+});
+test("verifyPortableObject() does not downgrade signed collections", async () => {
+	const documentLoader = createLoader({});
+	const signedOutbox = await sign(outbox());
+	const result = await verify(signedOutbox, {
+		documentLoader,
+		referrer: linkFrom(actorObject, "outbox")
+	});
+	ok(result.verified);
+	strictEqual(result.method, "proof");
+	assertFailure(await verify({
+		...signedOutbox,
+		totalItems: 1
+	}, {
+		documentLoader: createLoader({ [gatewayUrl(gw1, actorId)]: signedActor }),
+		documentUrl: new URL(gatewayUrl(gw1, outboxId)),
+		gateways: [new URL(gw1)],
+		referrer: linkFrom(actorObject, "outbox")
+	}), "invalidProof");
+	assertFailure(await verify(outbox({ id: "https://example.com/outbox" }), { documentLoader }), "notPortableObject");
+});
+test("verifyPortableObject() checks pages against their collection", async () => {
+	const documentLoader = createLoader({ [gatewayUrl(gw1, actorId)]: signedActor });
+	const collectionResult = await verify(outbox(), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, outboxId)),
+		gateways: [new URL(gw1)],
+		referrer: linkFrom(actorObject, "outbox")
+	});
+	ok(collectionResult.verified);
+	const collection = await OrderedCollection.fromJsonLd(outbox(), { contextLoader });
+	const collectionContext = collectionResult.collectionContext;
+	const pageId = `ap://${did}/actor/outbox?page=1`;
+	const page = (overrides = {}) => ({
+		"@context": context,
+		id: pageId,
+		type: "OrderedCollectionPage",
+		partOf: outboxId,
+		orderedItems: [],
+		...overrides
+	});
+	const pageReferrer = linkFrom(collection, "first", { collectionContext });
+	const fetchedBefore = documentLoader.fetched.length;
+	const accepted = await verify(page(), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw2, pageId)),
+		referrer: pageReferrer
+	});
+	ok(accepted.verified);
+	strictEqual(accepted.method, "gateway");
+	strictEqual(documentLoader.fetched.length, fetchedBefore);
+	assertFailure(await verify(page(), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(evil, pageId)),
+		referrer: pageReferrer
+	}), "untrustedGateway");
+	assertFailure(await verify(page({ partOf: `ap://${did}/actor/inbox` }), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, pageId)),
+		referrer: pageReferrer
+	}), "collectionPageMismatch");
+	const foreignPageId = `ap://${otherDid}/outbox?page=1`;
+	assertFailure(await verify(page({
+		id: foreignPageId,
+		partOf: void 0
+	}), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, foreignPageId)),
+		referrer: pageReferrer
+	}), "collectionPageMismatch");
+	assertFailure(await verify(page({ attributedTo: `ap://${did}/actor2` }), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, pageId)),
+		referrer: pageReferrer
+	}), "conflictingCollectionOwners");
+	assertFailure(await verify(page({ attributedTo: actorId }), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, pageId)),
+		referrer: linkFrom(collection, "first")
+	}), "unknownCollectionOwner");
+	assertFailure(await verify(page(), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, pageId)),
+		referrer: linkFrom(collection, "first", { collectionContext: {
+			rootId: outboxId,
+			owner: null
+		} })
+	}), "unknownCollectionOwner");
+});
+test("verifyPortableObject() checks intermediate pages", async () => {
+	const documentLoader = createLoader({ [gatewayUrl(gw1, actorId)]: signedActor });
+	const collection = await OrderedCollection.fromJsonLd(outbox(), { contextLoader });
+	const intermediate = async (partOf) => await CollectionPage.fromJsonLd({
+		"@context": context,
+		id: `ap://${did}/actor/outbox?page=1`,
+		type: "OrderedCollectionPage",
+		partOf
+	}, { contextLoader });
+	const pageId = `ap://${did}/actor/outbox?page=2`;
+	const page = {
+		"@context": context,
+		id: pageId,
+		type: "OrderedCollectionPage",
+		partOf: outboxId,
+		orderedItems: []
+	};
+	const chain = (first) => linkFrom(first, "next", { referrer: linkFrom(collection, "first", { referrer: linkFrom(actorObject, "outbox") }) });
+	const options = {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, pageId)),
+		gateways: [new URL(gw1)]
+	};
+	const result = await verify(page, {
+		...options,
+		referrer: chain(await intermediate(outboxId))
+	});
+	ok(result.verified);
+	strictEqual(result.method, "gateway");
+	assertFailure(await verify(page, {
+		...options,
+		referrer: chain(await intermediate(`ap://${did}/actor/inbox`))
+	}), "collectionPageMismatch");
+	assertFailure(await verify(page, {
+		...options,
+		referrer: linkFrom(await intermediate(outboxId), "next", { truncated: true })
+	}), "unknownCollectionOwner");
+});
+test("verifyPortableObject() works with property accessors", async () => {
+	const itemId = `ap://${did}/notes/1`;
+	const note = await sign({
+		"@context": context,
+		id: itemId,
+		type: "Note",
+		attributedTo: actorId,
+		content: "Hello"
+	});
+	const page1Id = `ap://${did}/actor/outbox?page=1`;
+	const page2Id = `ap://${did}/actor/outbox?page=2`;
+	const page1 = {
+		id: page1Id,
+		type: "OrderedCollectionPage",
+		partOf: outboxId,
+		orderedItems: [{
+			id: itemId,
+			type: "Note",
+			content: "Forged"
+		}],
+		next: page2Id
+	};
+	const options = {
+		documentLoader: createLoader({
+			[gatewayUrl(gw1, actorId)]: signedActor,
+			[gatewayUrl(gw1, outboxId)]: outbox({ first: page1 }),
+			[gatewayUrl(gw1, page1Id)]: {
+				"@context": context,
+				...page1
+			},
+			[gatewayUrl(gw1, page2Id)]: {
+				"@context": context,
+				id: page2Id,
+				type: "OrderedCollectionPage",
+				partOf: outboxId,
+				orderedItems: [itemId]
+			},
+			[gatewayUrl(gw1, itemId)]: note
+		}),
+		contextLoader,
+		gateways: [gw1],
+		verifyPortableObject
+	};
+	const create = await Collection.fromJsonLd({
+		"@context": context,
+		type: "Collection",
+		items: [actorId]
+	}, { contextLoader });
+	const items = await Array.fromAsync(create.getItems(options));
+	strictEqual(items.length, 1);
+	ok(items[0] instanceof Person);
+	const outboxCollection = await items[0].getOutbox(options);
+	ok(outboxCollection instanceof OrderedCollection);
+	deepStrictEqual((await Array.fromAsync(traverseCollection(outboxCollection, options))).map((item) => item instanceof Note ? item.content : null), ["Hello", "Hello"]);
+	const evilLoader = createLoader({
+		[gatewayUrl(evil, actorId)]: signedActor,
+		[gatewayUrl(evil, outboxId)]: outbox()
+	});
+	strictEqual(await (await Person.fromJsonLd(signedActor, { contextLoader })).getOutbox({
+		...options,
+		documentLoader: evilLoader,
+		gateways: [evil]
+	}), null);
+});
+test("verifyPortableObject() lets pages inherit owners across signed and embedded collections", async () => {
+	const page1Id = `ap://${did}/actor/outbox?page=1`;
+	const page1 = {
+		"@context": context,
+		id: page1Id,
+		type: "OrderedCollectionPage",
+		partOf: outboxId,
+		orderedItems: []
+	};
+	const fetchPerson = async (options) => {
+		const wrapper = await Collection.fromJsonLd({
+			"@context": context,
+			type: "Collection",
+			items: [actorId]
+		}, { contextLoader });
+		const [person] = await Array.fromAsync(wrapper.getItems(options));
+		ok(person instanceof Person);
+		return person;
+	};
+	const signedOutbox = await sign(outbox({ first: page1Id }));
+	let documentLoader = createLoader({
+		[gatewayUrl(gw1, actorId)]: signedActor,
+		[gatewayUrl(gw1, outboxId)]: signedOutbox,
+		[gatewayUrl(gw2, page1Id)]: page1
+	});
+	let options = {
+		documentLoader,
+		contextLoader,
+		gateways: [gw1, gw2],
+		verifyPortableObject
+	};
+	let person = await fetchPerson(options);
+	let collection = await person.getOutbox(options);
+	ok(collection instanceof OrderedCollection);
+	ok(await collection.getFirst(options) instanceof CollectionPage);
+	const embeddingActor = await sign(actor({ outbox: {
+		id: outboxId,
+		type: "OrderedCollection",
+		first: page1Id
+	} }));
+	documentLoader = createLoader({
+		[gatewayUrl(gw1, actorId)]: embeddingActor,
+		[gatewayUrl(gw2, page1Id)]: page1,
+		[gatewayUrl(evil, page1Id)]: page1
+	});
+	options = {
+		...options,
+		documentLoader
+	};
+	person = await fetchPerson(options);
+	collection = await person.getOutbox(options);
+	ok(collection instanceof OrderedCollection);
+	ok(await collection.getFirst(options) instanceof CollectionPage);
+	deepStrictEqual(documentLoader.fetched, [
+		gatewayUrl(gw1, actorId),
+		gatewayUrl(gw1, page1Id),
+		gatewayUrl(gw2, page1Id)
+	]);
+	person = await fetchPerson(options);
+	collection = await person.getOutbox(options);
+	ok(collection instanceof OrderedCollection);
+	strictEqual(await collection.getFirst({
+		...options,
+		gateways: [evil]
+	}), null);
+});
+test("verifyPortableObject() reuses a verified actor for pages of signed collections", async () => {
+	const documentLoader = createLoader({});
+	const signed = await verify(await sign(outbox()), {
+		documentLoader,
+		referrer: linkFrom(actorObject, "outbox", { acceptance: "verified" })
+	});
+	ok(signed.verified);
+	strictEqual(signed.method, "proof");
+	const collection = await OrderedCollection.fromJsonLd(outbox(), { contextLoader });
+	const pageId = `ap://${did}/actor/outbox?page=1`;
+	const result = await verify({
+		"@context": context,
+		id: pageId,
+		type: "OrderedCollectionPage",
+		partOf: outboxId,
+		orderedItems: []
+	}, {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, pageId)),
+		referrer: linkFrom(collection, "first", { collectionContext: signed.collectionContext })
+	});
+	ok(result.verified);
+	strictEqual(result.method, "gateway");
+	deepStrictEqual(documentLoader.fetched, []);
+});
+test("verifyPortableObject() fetches the owner through attributedTo hints", async () => {
+	const documentLoader = createLoader({ [gatewayUrl(gw2, actorId)]: signedActor });
+	const result = await verify(outbox({ attributedTo: `${actorId}?@gateway=${encodeURIComponent(gw2)}` }), {
+		documentLoader,
+		documentUrl: new URL(gatewayUrl(gw1, outboxId)),
+		gatewayHints: [new URL(gw1)]
+	});
+	ok(result.verified);
+	strictEqual(result.method, "gateway");
+	deepStrictEqual(documentLoader.fetched, [gatewayUrl(gw2, actorId)]);
+});
+test("verifyPortableObject() applies to compatible identifiers in accessors", async (t) => {
+	const noteId = `ap://${did}/notes/1`;
+	const signedNote = await sign({
+		"@context": context,
+		id: noteId,
+		type: "Note",
+		attributedTo: actorId,
+		content: "Hello"
+	});
+	const forgedNote = {
+		"@context": context,
+		id: noteId,
+		type: "Note",
+		attributedTo: actorId,
+		content: "Forged"
+	};
+	const collection = (items) => Collection.fromJsonLd({
+		"@context": context,
+		id: "https://example.com/collection",
+		type: "Collection",
+		items
+	}, { contextLoader });
+	const getItems = async (items, documentLoader) => await Array.fromAsync((await collection(items)).getItems({
+		documentLoader,
+		contextLoader,
+		verifyPortableObject
+	}));
+	await t.step("signed objects", async () => {
+		const documentLoader = createLoader({ [gatewayUrl(gw1, noteId)]: signedNote });
+		deepStrictEqual((await getItems([gatewayUrl(gw1, noteId)], documentLoader)).map((item) => item instanceof Note ? item.content : null), ["Hello"]);
+	});
+	await t.step("forged objects", async () => {
+		const documentLoader = createLoader({
+			[gatewayUrl(evil, noteId)]: forgedNote,
+			[gatewayUrl(evil, `ap://${did}/notes/2`)]: {
+				...forgedNote,
+				id: gatewayUrl(evil, `ap://${did}/notes/2`),
+				attributedTo: gatewayUrl(evil, actorId)
+			},
+			"https://evil.example/notes/1": { redirect: gatewayUrl(evil, noteId) },
+			[gatewayUrl("https://example.com", noteId)]: forgedNote
+		});
+		deepStrictEqual(await getItems([
+			gatewayUrl(evil, noteId),
+			gatewayUrl(evil, `ap://${did}/notes/2`),
+			"https://evil.example/notes/1",
+			{
+				id: gatewayUrl("https://example.com", noteId),
+				type: "Note",
+				content: "Forged"
+			}
+		], documentLoader), []);
+	});
+	await t.step("unsecured collections", async () => {
+		const unsecured = outbox({ attributedTo: actorId });
+		const documentLoader = createLoader({
+			[gatewayUrl(gw1, actorId)]: signedActor,
+			[gatewayUrl(gw1, outboxId)]: unsecured,
+			[gatewayUrl(evil, actorId)]: signedActor,
+			[gatewayUrl(evil, outboxId)]: unsecured
+		});
+		const items = await getItems([gatewayUrl(gw1, outboxId)], documentLoader);
+		strictEqual(items.length, 1);
+		ok(items[0] instanceof OrderedCollection);
+		deepStrictEqual(documentLoader.fetched, [gatewayUrl(gw1, outboxId), gatewayUrl(gw1, actorId)]);
+		deepStrictEqual(await getItems([gatewayUrl(evil, outboxId)], documentLoader), []);
+		deepStrictEqual(await getItems([gatewayUrl(gw1, outboxId)], createLoader({
+			[gatewayUrl(gw1, actorId)]: signedActor,
+			[gatewayUrl(gw1, outboxId)]: { redirect: gatewayUrl(evil, outboxId) },
+			[gatewayUrl(evil, outboxId)]: unsecured
+		})), []);
+	});
+});
+//#endregion
+export {};

package/dist/sig/portable-interop.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";