@fedify/fedify 2.4.0-pr.936.41 → 2.5.0-dev.2271

package/dist/sig/verification.test.mjs

@@ -0,0 +1,310 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { a as verificationObservation } from "../verification-Dpfcw8ml.mjs";
+import { h as verifyJsonLd, p as signJsonLd } from "../ld-CzaP-hJl.mjs";
+import { a as signObject, s as verifyObject } from "../proof-Dxy6ByqI.mjs";
+import { l as signRequest, p as verifyRequestDetailed } from "../http-siciWkmx.mjs";
+import { i as rsaPrivateKey2, n as ed25519PrivateKey, o as rsaPublicKey1, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
+import { Activity, Create, CryptographicKey, Multikey } from "@fedify/vocab";
+import { FetchError } from "@fedify/vocab-runtime";
+import { mockDocumentLoader, test } from "@fedify/fixture";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+//#region src/sig/verification.test.ts
+const loaders = {
+	documentLoader: mockDocumentLoader,
+	contextLoader: mockDocumentLoader
+};
+function observation() {
+	return { attempts: [] };
+}
+test("LDS evidence has no checks for absent or malformed signatures", async () => {
+	const json = await new Create({ actor: rsaPublicKey2.ownerId }).toJsonLd(loaders);
+	for (const signature of [
+		void 0,
+		null,
+		"invalid",
+		[],
+		{}
+	]) {
+		const evidence = observation();
+		strictEqual(await verifyJsonLd(signature === void 0 ? json : {
+			...json,
+			signature
+		}, {
+			...loaders,
+			[verificationObservation]: evidence
+		}), false);
+		const attempt = evidence.attempts[0];
+		ok(attempt.status === "rejected");
+		strictEqual(attempt.reason.type, signature === void 0 ? "noSignature" : "signatureVerificationFailed");
+		deepStrictEqual(attempt.checks, []);
+	}
+});
+test("signature evidence preserves stale and fresh HTTP keys for both specs", async () => {
+	for (const spec of ["draft-cavage-http-signatures-12", "rfc9421"]) {
+		const evidence = observation();
+		const signed = await signRequest(new Request("https://example.com/inbox", {
+			method: "POST",
+			body: "{}"
+		}), rsaPrivateKey2, rsaPublicKey2.id, { spec });
+		const stale = rsaPublicKey1.clone({ id: rsaPublicKey2.id });
+		strictEqual((await verifyRequestDetailed(signed, {
+			...loaders,
+			[verificationObservation]: evidence,
+			keyCache: {
+				get: () => Promise.resolve(stale),
+				set: () => Promise.resolve()
+			}
+		})).verified, true);
+		const attempt = evidence.attempts[0];
+		ok(attempt.status === "verified");
+		strictEqual(attempt.checks.length, 1);
+		const check = attempt.checks[0];
+		ok(check.status === "verified");
+		strictEqual(check.triedKeys.length, 2);
+		strictEqual(check.triedKeys[0].publicKey, rsaPublicKey1.publicKey);
+		deepStrictEqual(await crypto.subtle.exportKey("jwk", check.triedKeys[1].publicKey), await crypto.subtle.exportKey("jwk", rsaPublicKey2.publicKey));
+		strictEqual(check.key, check.triedKeys[1]);
+		strictEqual(attempt.signatures[0], check);
+	}
+});
+test("signature evidence retains the failed key when HTTP refresh cannot load", async () => {
+	for (const spec of ["draft-cavage-http-signatures-12", "rfc9421"]) {
+		const evidence = observation();
+		const signed = await signRequest(new Request("https://example.com/inbox", {
+			method: "POST",
+			body: "{}"
+		}), rsaPrivateKey2, rsaPublicKey2.id, { spec });
+		const response = new Response(null, { status: 410 });
+		strictEqual((await verifyRequestDetailed(signed, {
+			...loaders,
+			[verificationObservation]: evidence,
+			documentLoader: () => Promise.reject(new FetchError(rsaPublicKey2.id, "gone", response)),
+			keyCache: {
+				get: () => Promise.resolve(rsaPublicKey1.clone({ id: rsaPublicKey2.id })),
+				set: () => Promise.resolve()
+			}
+		})).verified, false);
+		const check = evidence.attempts[0].checks[0];
+		ok(check.status === "rejected");
+		strictEqual(check.reason.type, "keyFetchError");
+		strictEqual(check.triedKeys[0].publicKey, rsaPublicKey1.publicKey);
+	}
+});
+test("signature evidence preserves failed LDS keys and successful stale-key refresh", async () => {
+	const signed = await signJsonLd(await new Create({ actor: new URL("https://example.com/person") }).toJsonLd(loaders), rsaPrivateKey2, rsaPublicKey2.id, loaders);
+	const evidence = observation();
+	strictEqual(await verifyJsonLd(signed, {
+		...loaders,
+		[verificationObservation]: evidence,
+		keyCache: {
+			get: () => Promise.resolve(rsaPublicKey1.clone({ id: rsaPublicKey2.id })),
+			set: () => Promise.resolve()
+		}
+	}), false);
+	const attempt = evidence.attempts[0];
+	ok(attempt.status === "rejected");
+	strictEqual(attempt.reason.type, "missingOwner");
+	strictEqual(attempt.checks[0].status, "verified");
+	strictEqual(attempt.checks[0].triedKeys.length, 2);
+	const bad = observation();
+	strictEqual(await verifyJsonLd(signed, {
+		...loaders,
+		[verificationObservation]: bad,
+		documentLoader: async () => ({
+			contextUrl: null,
+			documentUrl: rsaPublicKey2.id.href,
+			document: await new CryptographicKey({
+				id: rsaPublicKey2.id,
+				publicKey: rsaPublicKey1.publicKey
+			}).toJsonLd(loaders)
+		})
+	}), false);
+	strictEqual(bad.attempts[0].checks[0].status, "rejected");
+	strictEqual(bad.attempts[0].checks[0].triedKeys.length, 1);
+});
+test("signature evidence preserves multiple valid proofs despite uncovered attribution", async () => {
+	const second = await signObject(await signObject(new Create({ actor: new URL("https://example.com/person") }), ed25519PrivateKey, ed25519Multikey.id, loaders), ed25519PrivateKey, ed25519Multikey.id, loaders);
+	const evidence = observation();
+	strictEqual(await verifyObject(Activity, await second.toJsonLd(loaders), {
+		...loaders,
+		[verificationObservation]: evidence
+	}), null);
+	const attempt = evidence.attempts[0];
+	ok(attempt.status === "rejected");
+	strictEqual(attempt.reason.type, "uncoveredAttribution");
+	strictEqual(attempt.checks.length, 2);
+	ok(attempt.checks.every((check) => check.status === "verified"));
+});
+test("signature evidence preserves OIP stale keys when fresh verification fails", async () => {
+	const signed = await signObject(new Create({ actor: ed25519Multikey.controllerId }), ed25519PrivateKey, ed25519Multikey.id, loaders);
+	const pair = await crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
+	const stale = new Multikey({
+		id: ed25519Multikey.id,
+		controller: null,
+		publicKey: pair.publicKey
+	});
+	const evidence = observation();
+	strictEqual(await verifyObject(Activity, await signed.toJsonLd(loaders), {
+		...loaders,
+		[verificationObservation]: evidence,
+		keyCache: {
+			get: () => Promise.resolve(stale),
+			set: () => Promise.resolve()
+		},
+		documentLoader: async () => ({
+			contextUrl: null,
+			documentUrl: ed25519Multikey.id.href,
+			document: await stale.toJsonLd(loaders)
+		})
+	}), null);
+	const check = evidence.attempts[0].checks[0];
+	strictEqual(check.status, "rejected");
+	strictEqual(check.triedKeys.length, 2);
+	strictEqual(check.triedKeys[0].publicKey, pair.publicKey);
+});
+test("OIP check preserves the literal declared key ID", async () => {
+	const json = await (await signObject(new Create({ actor: ed25519Multikey.controllerId }), ed25519PrivateKey, ed25519Multikey.id, loaders)).toJsonLd(loaders);
+	const proof = json.proof;
+	const declaredKeyId = "https://EXAMPLE.com/person2#key4";
+	proof.verificationMethod = declaredKeyId;
+	const evidence = observation();
+	await verifyObject(Activity, json, {
+		...loaders,
+		[verificationObservation]: evidence
+	});
+	strictEqual(evidence.attempts[0].checks[0].declaredKeyId, declaredKeyId);
+});
+test("signature observation cannot turn a cached miss into a metadata exception", async () => {
+	const json = await signJsonLd(await new Create({ actor: new URL("https://example.com/person") }).toJsonLd(loaders), rsaPrivateKey2, rsaPublicKey2.id, loaders);
+	const evidence = observation();
+	const cache = {
+		get: () => Promise.resolve(null),
+		set: () => Promise.resolve(),
+		getFetchError: () => Promise.reject(/* @__PURE__ */ new Error("diagnostic unavailable"))
+	};
+	strictEqual(await verifyJsonLd(json, {
+		...loaders,
+		keyCache: cache,
+		[verificationObservation]: evidence
+	}), false);
+	strictEqual(evidence.attempts[0].checks[0].status, "rejected");
+});
+test("signature observation preserves rejection for consumed fetch-error responses", async () => {
+	const json = await signJsonLd(await new Create({ actor: new URL("https://example.com/person") }).toJsonLd(loaders), rsaPrivateKey2, rsaPublicKey2.id, loaders);
+	const response = new Response("gone", { status: 410 });
+	await response.text();
+	const error = new FetchError(rsaPublicKey2.id, "gone", response);
+	const options = {
+		...loaders,
+		documentLoader: () => Promise.reject(error)
+	};
+	strictEqual(await verifyJsonLd(json, options), false);
+	const evidence = observation();
+	strictEqual(await verifyJsonLd(json, {
+		...options,
+		[verificationObservation]: evidence
+	}), false);
+	const check = evidence.attempts[0].checks[0];
+	ok(check.status === "rejected" && check.reason.type === "keyFetchError");
+	let cloneThrows = false;
+	try {
+		response.clone();
+	} catch {
+		cloneThrows = true;
+	}
+	if (cloneThrows) {
+		ok("error" in check.reason.result);
+		strictEqual(check.reason.result.error, error);
+	} else {
+		ok("status" in check.reason.result);
+		strictEqual(check.reason.result.status, 410);
+	}
+});
+test("OIP check retains aliased declarations without extra context fetches", async () => {
+	const json = await (await signObject(new Create({ actor: ed25519Multikey.controllerId }), ed25519PrivateKey, ed25519Multikey.id, loaders)).toJsonLd(loaders);
+	const proof = json.proof;
+	const context = { vm: {
+		"@id": "https://w3id.org/security#verificationMethod",
+		"@type": "@id"
+	} };
+	const contextUrl = "https://example.com/custom-proof-context";
+	json["@context"] = [...json["@context"], contextUrl];
+	proof["@context"] = [...proof["@context"], contextUrl];
+	const declaredKeyId = "https://EXAMPLE.com/person2#key4";
+	proof.vm = declaredKeyId;
+	delete proof.verificationMethod;
+	const run = async (evidence) => {
+		let fetches = 0;
+		await verifyObject(Activity, structuredClone(json), {
+			...loaders,
+			contextLoader: async (url, options) => {
+				fetches++;
+				if (url === contextUrl) return {
+					contextUrl: null,
+					documentUrl: url,
+					document: { "@context": context }
+				};
+				return await mockDocumentLoader(url, options);
+			},
+			...evidence == null ? {} : { [verificationObservation]: evidence }
+		});
+		return fetches;
+	};
+	const baselineFetches = await run();
+	const evidence = observation();
+	strictEqual(await run(evidence), baselineFetches);
+	strictEqual(evidence.attempts[0].checks[0].declaredKeyId, declaredKeyId);
+});
+test("OIP check preserves compact node identifiers and their aliases", async () => {
+	for (const idProperty of [
+		"id",
+		"rawId",
+		"scopedId"
+	]) {
+		const json = await (await signObject(new Create({ actor: ed25519Multikey.controllerId }), ed25519PrivateKey, ed25519Multikey.id, loaders)).toJsonLd(loaders);
+		const proof = json.proof;
+		const context = {
+			rawId: "@id",
+			vm: {
+				"@id": "https://w3id.org/security#verificationMethod",
+				"@type": "@id",
+				"@context": { scopedId: "@id" }
+			}
+		};
+		json["@context"] = [...json["@context"], context];
+		proof["@context"] = [...proof["@context"], context];
+		const declaredKeyId = "https://EXAMPLE.com/person2#key4";
+		if (idProperty === "scopedId") {
+			proof.vm = { [idProperty]: declaredKeyId };
+			delete proof.verificationMethod;
+		} else proof.verificationMethod = { [idProperty]: declaredKeyId };
+		const evidence = observation();
+		await verifyObject(Activity, json, {
+			...loaders,
+			[verificationObservation]: evidence
+		});
+		strictEqual(evidence.attempts[0].checks[0].declaredKeyId, declaredKeyId);
+	}
+});
+test("signature evidence excludes keys loaded before canonicalization errors", async () => {
+	const json = await (await signObject(new Create({ actor: ed25519Multikey.controllerId }), ed25519PrivateKey, ed25519Multikey.id, loaders)).toJsonLd(loaders);
+	json.extra = JSON.parse("1e400");
+	const evidence = observation();
+	let thrown = false;
+	try {
+		await verifyObject(Activity, json, {
+			...loaders,
+			[verificationObservation]: evidence
+		});
+	} catch {
+		thrown = true;
+	}
+	strictEqual(thrown, true);
+	const check = evidence.attempts[0].checks[0];
+	strictEqual(check.status, "error");
+	deepStrictEqual(check.triedKeys, []);
+});
+//#endregion
+export {};

package/dist/std__assert-DvMDRPes.mjs

@@ -0,0 +1,8 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import "./assert_equals-Z6IcEbWU.mjs";
+import "./assert_throws-BYITOvPO.mjs";
+import "./assert_rejects-CTptdYck.mjs";
+import "./assert_strict_equals-CYvBmkpC.mjs";
+export {};

package/dist/{testing-CO7ftO8A.mjs → tasks-IG3pHfvZ.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { i as mockDocumentLoader } from "./context-BJXxPElm.mjs";
-import { t as MemoryKvStore } from "./kv-CXBAok3k.mjs";
+import { t as mockDocumentLoader } from "./dist-DJQM4u7i.mjs";
+import { t as MemoryKvStore } from "./kv-DCHkaJ9-.mjs";
 import { Note } from "@fedify/vocab";
 //#region src/testing/tasks.ts
 /**

package/dist/{temporal-fsXO5IvD.mjs → temporal-D0KJI4NF.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-Cj9F_5AP.mjs";
+import { c as getNormalizationContextLoader } from "./ld-CzaP-hJl.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {
@@ -28,7 +28,7 @@ function isMalformedDurationLiteral(value) {
 		return true;
 	}
 }
-const TEMPORAL_DATE_TIME_IRIS = new Set([
+const TEMPORAL_DATE_TIME_IRIS = /* @__PURE__ */ new Set([
 	"https://www.w3.org/ns/activitystreams#deleted",
 	"https://www.w3.org/ns/activitystreams#endTime",
 	"https://www.w3.org/ns/activitystreams#published",
@@ -37,7 +37,7 @@ const TEMPORAL_DATE_TIME_IRIS = new Set([
 	"http://purl.org/dc/terms/created",
 	"https://w3id.org/security#created"
 ]);
-const TEMPORAL_DURATION_IRIS = new Set(["https://www.w3.org/ns/activitystreams#duration"]);
+const TEMPORAL_DURATION_IRIS = /* @__PURE__ */ new Set(["https://www.w3.org/ns/activitystreams#duration"]);
 const QUESTION_CLOSED_IRI = "https://www.w3.org/ns/activitystreams#closed";
 const XSD_DATE_TIME_IRI = "http://www.w3.org/2001/XMLSchema#dateTime";
 function hasMalformedExpandedDateTimeLiteral(value) {

package/dist/testing/context.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";

package/dist/testing/context.test.mjs

@@ -0,0 +1,19 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { n as test } from "../dist-DJQM4u7i.mjs";
+import { strictEqual } from "node:assert/strict";
+//#region src/testing/context.test.ts
+test("ignored nested test steps return false", async (t) => {
+	let executed = false;
+	strictEqual(await t.step({
+		name: "ignored nested test step",
+		ignore: true,
+		fn() {
+			executed = true;
+		}
+	}), false);
+	strictEqual(executed, false);
+});
+//#endregion
+export {};

package/dist/testing/kv.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";

package/dist/testing/kv.test.mjs

@@ -0,0 +1,101 @@
+import { Temporal } from "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { n as test } from "../dist-DJQM4u7i.mjs";
+import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
+import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
+import { n as baseOptions, o as stringSchema, t as MockQueue } from "../tasks-IG3pHfvZ.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import { o as createFederation } from "../middleware-D7_LO-Vs.mjs";
+//#region src/testing/kv.test.ts
+test("ManualClockKvStore keeps an entry at its exact expiration instant", async () => {
+	const kv = new ManualClockKvStore();
+	const ttl = Temporal.Duration.from({ minutes: 10 });
+	await kv.set(["k"], "v", { ttl });
+	kv.advance(ttl);
+	assertEquals(kv.now, Temporal.Instant.fromEpochMilliseconds(6e5));
+	assertEquals(await kv.get(["k"]), "v");
+	kv.advance({ nanoseconds: 1 });
+	assertEquals(await kv.get(["k"]), void 0);
+});
+test("ManualClockKvStore.list() applies the same boundary", async () => {
+	const kv = new ManualClockKvStore();
+	const ttl = Temporal.Duration.from({ minutes: 10 });
+	await kv.set(["k"], "v", { ttl });
+	kv.advance(ttl);
+	assertEquals(await Array.fromAsync(kv.list()), [{
+		key: ["k"],
+		value: "v"
+	}]);
+	kv.advance({ nanoseconds: 1 });
+	assertEquals(await Array.fromAsync(kv.list()), []);
+});
+test("ManualClockKvStore.cas() applies the same boundary", async () => {
+	const ttl = Temporal.Duration.from({ minutes: 10 });
+	const atBoundary = new ManualClockKvStore();
+	await atBoundary.set(["k"], "v", { ttl });
+	atBoundary.advance(ttl);
+	assertEquals(await atBoundary.cas?.(["k"], "v", "w"), true);
+	const pastBoundary = new ManualClockKvStore();
+	await pastBoundary.set(["k"], "v", { ttl });
+	pastBoundary.advance(ttl);
+	pastBoundary.advance({ nanoseconds: 1 });
+	assertEquals(await pastBoundary.cas?.(["k"], "v", "w"), false);
+	assertEquals(await pastBoundary.get(["k"]), void 0);
+});
+test("ManualClockKvStore.cas() without a TTL clears the expiration", async () => {
+	const kv = new ManualClockKvStore();
+	const ttl = Temporal.Duration.from({ minutes: 10 });
+	await kv.set(["k"], "v", { ttl });
+	assertEquals(await kv.cas?.(["k"], "v", "w"), true);
+	kv.advance({ hours: 1 });
+	assertEquals(await kv.get(["k"]), "w");
+});
+test("ManualClockKvStore withholds the TTL from the wrapped store", async () => {
+	const inner = new MemoryKvStore();
+	const kv = new ManualClockKvStore(inner);
+	await kv.set(["k"], "v", { ttl: Temporal.Duration.from({ nanoseconds: 1 }) });
+	assertEquals(await inner.get(["k"]), "v");
+	assertEquals(await kv.get(["k"]), "v");
+});
+/**
+* A {@link KvStore} without `cas()`, standing in for backends that offer no
+* conditional write.
+*/
+var CaslessKvStore = class {
+	#inner = new MemoryKvStore();
+	get(key) {
+		return this.#inner.get(key);
+	}
+	set(key, value, options) {
+		return this.#inner.set(key, value, options);
+	}
+	delete(key) {
+		return this.#inner.delete(key);
+	}
+	list(prefix) {
+		return this.#inner.list(prefix);
+	}
+};
+test("ManualClockKvStore exposes cas() only when the wrapped store does", () => {
+	assertEquals(new ManualClockKvStore(new CaslessKvStore()).cas, void 0);
+	assertEquals(typeof new ManualClockKvStore(new MemoryKvStore()).cas, "function");
+});
+test("ManualClockKvStore over a store without cas() keeps the open deduplication fallback", async () => {
+	const queue = new MockQueue();
+	const federation = createFederation({
+		...baseOptions,
+		kv: new ManualClockKvStore(new CaslessKvStore()),
+		queue: { task: queue },
+		taskDeduplicationFallback: "open"
+	});
+	const task = federation.defineTask("casless-open-fallback", {
+		schema: stringSchema,
+		handler: () => {}
+	});
+	await federation.createContext(new URL("https://example.com/"), void 0).enqueueTask(task, "payload", { deduplicationKey: "k" });
+	assertEquals(queue.enqueued.length, 1);
+	assertEquals(queue.enqueued[0].options?.deduplicationKey, void 0);
+});
+//#endregion
+export {};