@fedify/fedify 2.4.0-pr.936.41 → 2.5.0-dev.2271

package/dist/sig/portable-interop.test.mjs

@@ -0,0 +1,156 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { c as verifyPortableObjectProof, d as verifyProof } from "../proof-Dxy6ByqI.mjs";
+import { n as getKeyOwner } from "../owner-DYgfTFHy.mjs";
+import { t as verifyPortableObject } from "../portable-collection-C74P1vtC.mjs";
+import { Application, DataIntegrityProof, lookupObject } from "@fedify/vocab";
+import { mockDocumentLoader, test } from "@fedify/fixture";
+//#region test-vectors/fep-ef61/tootik-v0.25.4/actor.json
+var actor_default = {
+	"@context": [
+		"https://www.w3.org/ns/activitystreams",
+		"https://w3id.org/security/data-integrity/v1",
+		"https://w3id.org/security/v1"
+	],
+	id: "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor",
+	type: "Application",
+	inbox: "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor/inbox",
+	outbox: "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor/outbox",
+	preferredUsername: "actor",
+	followers: "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor/followers",
+	publicKey: {
+		"id": "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor#main-key",
+		"owner": "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor",
+		"publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr70sLuCyvDBKblca6Jsk\nJW5ZmTpmyFK4gY6dpDkjvsokBjTR6oUO5GF7QGT4xGaGDtnzhd+K0/IE2Jo2cbBu\nTAK92xo3qB4nL+0XIfqXK/ju/pIo4ClZ1oHYNeJnmjGDAJmZmaf9/b0sd0osfTPX\nWSqAkgZuxZYrWSXKs6WYuEJof5YfTHgH5PBzwtQGyexZKYkumyrq5lazeEvqBLyx\nyNc5u6LdkkHP+HR9DJIQ3CDv6d1yQ7ELiP5pXvKRV9jJKlBQ1TK1vlMGC8GcBlDy\nQT0UsbM/1lRbxnbbqiwY6rFlT6FpHd5cl9tblGU6sF9gyCDATCHAdZ/2laUzParD\n+QIDAQAB\n-----END PUBLIC KEY-----\n"
+	},
+	icon: [{
+		"type": "Image",
+		"mediaType": "image/gif",
+		"url": "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor/icon.gif"
+	}],
+	manuallyApprovesFollowers: false,
+	assertionMethod: [{
+		"id": "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor#ed25519-key",
+		"type": "Multikey",
+		"controller": "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor",
+		"publicKeyMultibase": "z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE"
+	}, {
+		"id": "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor#ml-dsa-44-key",
+		"type": "Multikey",
+		"controller": "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor",
+		"publicKeyMultibase": "ukCRpmFGeqQvqCAsbrRIKdfH1ZD2Y-2NiDr5tmgYFceiWCipFyeJKL65fEBcHa3gIBJbuzwvTfFeiMppDxvQySHhXFMf12o2mZ1d9Rw5fP9JKxSgCH7TyjeXEsvN6Zv_3q3ignCU3UxQKL5q2Yks9bfQkDxPJdDvzgyP5D0lDWulx1I9wyQS_f0SXG-Muph2rHBIT_u30ZuN7PHNNk7VAv4AWn7DlbJ6h2871YgFD7YHmtZiq_YCWerBe9TPBAoIOYEY1LV_nPVEe5xDIBlQ2EXYcfJviKQ1rB1iP4c0uoxdGm1RLDOXd65EDmtzil_R1Y5Le4s5td6AV2iFanIQtoJabH1IfL3Ju9n1nM-X3T8YM5FCngvoFME7UxhUHUggZ7vbWy_hy99tRvlaPG3U2OogtyPELx1o91itRjVH276UB8frLb06oJj6RzHE8pwfImH7POETjxEMPzfX4RA7BQVge6TU3fiBx4V4wmofJ3eiMu6yo497mUjJMiFjnt4AC1xiY8_XzdAauJag55HjKDf1xKNHIpQe2IE_n2zJvjfh__coWwl5qJLyszAVBZTn-MTg8nS--PTZMZPaDJSwk9NAT6qdCAnaP5PPkoWlTedCVbDNE-az45x9rKs3sob1OVoJW-2Ogf0S37noPe3L2lfUidr32k5fXPCsg3GfB0F5ZS9sQ-ZBzQvgchArohI1DnX9cbObTj4bGrJu_N9SPFLp0jYQb5bujeIDdpiVu46PVbv4fV4gxQAt4XPZLExZq_WQhKVVn3A89NU6qwxKsAp1LWoouehQSSNaC-Wif7ev5vaCSE0eeTOCO0Ip1URirY7hKhjbp-hfAMx_Vnoj5gQeiRQkUW2oxkgXEpfdzJDvVoeaTmJ_k3soJlJYjp9ZJAc9qn8ygsFpRKFMUYZQL3Wcj7vFxjlX_42a-5p0_0UHA7JjK3UlvE_nG9cIeoqU-WgygEU9rf1CCJflppbwXMFmBQvJ1oMDoutbZTuDIdnRO5DVQ4uNEPyT3p_kv0smEGU3lzZERTYHPM-CNEF5Pk2rrVea9WxpC0TG2njHxmHsO0nCWmUgoB3cAMWpby-YBaen1xvXt5po7ge5KD3SC_cXMSLAJem_ZMVWtR070zXCJdsoB-GN8nFTchyjPpI6SLxXcVwWXNEzI_dEvcx0YTEwlI9OEDuF2rizU4UzZMIT_Ec5OgEehh-o0MLpgLRvLo15TOz0FFZfaKYWfVS6CEBxHg0g3XwmvbrhA47ZJNfLYniPV4K7ELTp3nsoe9xZo2yORy8KiYUV9AETu90oZd-ZnZG_J1IXY7HmzT3DQ5rXWRMHx1Uym_SU7TCk0hIvFpta012lS_Hv8OZ2cnXC70VUx8_LS27ICE4k6xJbwxZCZZ0oLZ_XSicvg9vOP_N7KWbR_Jc7sxjpIDc2IY9EUNn0FiGs6IDy-YJJ5kq31N0Di28uYuX910sAbymPGl--SD1feo4-SBXA9qejrfq85iHcgKWpOVmID1HxulHKZRcKM-T_TfEVlHUPvkiPo61xda2ak1ni05GpPc_iknAFUbM1D6eIh4mFSxdnLTDXVkvNByPb8QCaZCwOSiN5bDy-CvHseH7uuDrwilnqgMruLQmVj0oj2HM1vsjQqXMdVWi6dtfaj1qqyf8Cti_bt7m0qPKe4B6Mc9ALBFtk6gGLjAuygg4_WSCAr8WPnDjrLEI7Xmo_uFvPRsDEfQUCvXVP_vapaCr6vSPvQ-hJmXy2-u5qe"
+	}],
+	"implements": [
+		{
+			"href": "https://datatracker.ietf.org/doc/html/rfc9421",
+			"name": "RFC-9421: HTTP Message Signatures"
+		},
+		{
+			"href": "https://datatracker.ietf.org/doc/html/rfc9421#name-eddsa-using-curve-edwards25",
+			"name": "RFC-9421 signatures using the Ed25519 algorithm"
+		},
+		{
+			"href": "https://c2sp.org/httpsig-pq@v1.0.0#ml-dsa-44",
+			"name": "RFC-9421 signatures using the ml-dsa-44 algorithm"
+		}
+	],
+	gateways: ["https://tootik.example"],
+	proof: {
+		"@context": [
+			"https://www.w3.org/ns/activitystreams",
+			"https://w3id.org/security/data-integrity/v1",
+			"https://w3id.org/security/v1"
+		],
+		"type": "DataIntegrityProof",
+		"cryptosuite": "eddsa-jcs-2022",
+		"verificationMethod": "did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE#z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE",
+		"proofPurpose": "assertionMethod",
+		"proofValue": "zjGdNqPpqgx45ecMAz8jY3gVRrTphG5Cn7v9EiBKn7WyeHtdvTYPSkzyvWqZqfQuw92Kn3pD58qXw6wFTLAvkWee",
+		"created": "2026-09-30T11:57:45Z"
+	}
+};
+//#endregion
+//#region src/sig/portable-interop.test.ts
+const options = {
+	contextLoader: mockDocumentLoader,
+	documentLoader() {
+		throw new TypeError("The captured did:key proof must resolve locally");
+	}
+};
+test("tootik v0.25.4 actor has a valid DID proof", async () => {
+	const key = await verifyProof(actor_default, await DataIntegrityProof.fromJsonLd(actor_default.proof, options), options);
+	assert(key != null);
+	assertEquals(key.id?.href, actor_default.proof.verificationMethod);
+});
+test("tootik v0.25.4 actor proof rejects tampering", async () => {
+	const proof = await DataIntegrityProof.fromJsonLd(actor_default.proof, options);
+	assertEquals(await verifyProof({
+		...actor_default,
+		preferredUsername: "tampered"
+	}, proof, options), null);
+});
+test("tootik v0.25.4 actor retains its unmapped gateways", async () => {
+	const original = structuredClone(actor_default);
+	assertEquals(actor_default.gateways, ["https://tootik.example"]);
+	const parsed = await Application.fromJsonLd(actor_default, options);
+	assertEquals(parsed.id?.href, actor_default.id);
+	assertEquals(parsed.gateways, [new URL("https://tootik.example")]);
+	assert((await verifyPortableObjectProof(actor_default, options)).verified);
+	assertEquals(actor_default, original);
+});
+const loadedOptions = {
+	contextLoader: mockDocumentLoader,
+	documentLoader(url) {
+		assertEquals(url.split("#")[0], actor_default.id);
+		return Promise.resolve({
+			document: structuredClone(actor_default),
+			documentUrl: actor_default.id,
+			contextUrl: null
+		});
+	}
+};
+test("tootik v0.25.4 actor can be looked up and own a gateway key", async () => {
+	const parsed = await lookupObject(actor_default.id, {
+		...loadedOptions,
+		verifyPortableObject: verifyPortableObjectProof
+	});
+	assert(parsed instanceof Application);
+	assertEquals(parsed.gateways, [new URL("https://tootik.example")]);
+	const owner = await getKeyOwner(new URL(actor_default.publicKey.id), loadedOptions);
+	assert(owner != null);
+	assertEquals(owner.id?.href, actor_default.id);
+	assertEquals(owner.gateways, [new URL("https://tootik.example")]);
+});
+test("tootik v0.25.4 actor authenticates its gateway for collections", async () => {
+	const result = await verifyPortableObject({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: actor_default.outbox,
+		type: "OrderedCollection",
+		attributedTo: actor_default.id,
+		orderedItems: []
+	}, {
+		...loadedOptions,
+		documentUrl: new URL(actor_default.outbox)
+	});
+	assert(result.verified);
+	assertEquals(result.method, "gateway");
+	if (result.method === "gateway") assertEquals(result.gateway, new URL("https://tootik.example"));
+});
+test("tootik v0.25.4 actor rejects tampered gateways", async () => {
+	assertEquals(await verifyPortableObjectProof({
+		...actor_default,
+		gateways: ["https://attacker.example"]
+	}, options), {
+		verified: false,
+		reason: {
+			type: "invalidProof",
+			proofIndex: 0
+		}
+	});
+});
+//#endregion
+export {};

package/dist/sig/portable-key-id.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";

package/dist/sig/portable-key-id.test.mjs

@@ -0,0 +1,67 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { f as isSameObjectId, t as getAuthenticationOrigin } from "../portable-key-id-Ca30-hOa.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
+import { exportDidKey, parseIri } from "@fedify/vocab-runtime";
+import { test } from "@fedify/fixture";
+//#region src/sig/portable-key-id.test.ts
+const did = await exportDidKey(ed25519PublicKey.publicKey);
+const otherDid = await exportDidKey((await crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"])).publicKey);
+test("getAuthenticationOrigin()", () => {
+	for (const id of [
+		parseIri(`ap://${did}/actor`),
+		parseIri(`ap+ef61://${did}/actor`),
+		parseIri(`ap+ef61://${encodeURIComponent(did)}/actor#main-key`),
+		parseIri(`ap://${did}/actor?@gateway=https%3A%2F%2Fgw.example`),
+		new URL(`https://gw.example/.well-known/apgateway/${did}/actor`),
+		new URL(`https://gw2.example/.well-known/apgateway/${did}/objects/1`),
+		new URL(`${did}#${did.slice(8)}`)
+	]) assertEquals(getAuthenticationOrigin(id), did, id.href);
+	assertEquals(getAuthenticationOrigin(parseIri(`ap+ef61://${otherDid}/actor`)), otherDid);
+	assertEquals(getAuthenticationOrigin(new URL("https://example.com:443/users/alice")), "https://example.com");
+	assertEquals(getAuthenticationOrigin(new URL("http://example.com:8080/users/alice")), "http://example.com:8080");
+	for (const id of [
+		new URL(`https://gw.example/.well-known/apgateway/${did}/actor?@gateway=https%3A%2F%2Fgw.example`),
+		new URL("https://gw.example/.well-known/apgateway/did:key:invalid!/a"),
+		new URL(`https://gw.example/.well-known/apgateway/${did}`),
+		new URL(`https://gw.example/.well-known/apgateway/${did}/actor%ZZ`),
+		new URL("urn:uuid:3d6f4c1e-2f8b-4d1a-9c6e-7b8a9d0e1f2a"),
+		new URL("tag:example.com,2026:actor")
+	]) assertEquals(getAuthenticationOrigin(id), null, id.href);
+});
+test("isSameObjectId()", () => {
+	const portable = parseIri(`ap+ef61://${did}/activities/1`);
+	for (const id of [
+		parseIri(`ap://${did}/activities/1`),
+		parseIri(`ap+ef61://${encodeURIComponent(did)}/activities/1`),
+		parseIri(`ap://${did}/activities/1?@gateway=https%3A%2F%2Fgw.example`),
+		new URL(`https://gw.example/.well-known/apgateway/${did}/activities/1`),
+		new URL(`https://gw2.example/.well-known/apgateway/${did}/activities/1`)
+	]) {
+		assert(isSameObjectId(portable, id), id.href);
+		assert(isSameObjectId(id, portable), id.href);
+	}
+	for (const id of [
+		parseIri(`ap+ef61://${otherDid}/activities/1`),
+		parseIri(`ap+ef61://${did}/activities/2`),
+		parseIri(`ap+ef61://${did}/activities/1#fragment`),
+		new URL(`https://gw.example/.well-known/apgateway/${did}/activities/1%ZZ`),
+		new URL("https://gw.example/activities/1")
+	]) {
+		assertFalse(isSameObjectId(portable, id), id.href);
+		assertFalse(isSameObjectId(id, portable), id.href);
+	}
+	const malformed = new URL(`https://gw.example/.well-known/apgateway/${did}/activities/1%ZZ`);
+	assertFalse(isSameObjectId(malformed, malformed));
+	const http = new URL("https://example.com/activities/1");
+	assert(isSameObjectId(http, new URL("https://example.com/activities/1")));
+	assertFalse(isSameObjectId(http, new URL("https://example.com/activities/1#a")));
+	assertFalse(isSameObjectId(http, new URL("https://example.com/activities/1?a")));
+});
+//#endregion
+export {};

package/dist/sig/portable-key.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";