@fedify/fedify 2.4.0-pr.936.41 → 2.5.0-dev.2271

package/dist/key-DfPsX8hv.mjs

@@ -1,453 +0,0 @@
-import "temporal-polyfill";
-import "urlpattern-polyfill";
-globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BHzKn9Ig.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-DMk-nTxI.mjs";
-import { getLogger } from "@logtape/logtape";
-import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";
-import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
-import { FetchError, getDocumentLoader, parseDidKeyVerificationMethod } from "@fedify/vocab-runtime";
-//#region src/sig/key.ts
-/**
-* Checks if the given key is valid and supported.  No-op if the key is valid,
-* otherwise throws an error.
-* @param key The key to check.
-* @param type Which type of key to check.  If not specified, the key can be
-*             either public or private.
-* @throws {TypeError} If the key is invalid or unsupported.
-*/
-function validateCryptoKey(key, type) {
-	if (type != null && key.type !== type) throw new TypeError(`The key is not a ${type} key.`);
-	if (!key.extractable) throw new TypeError("The key is not extractable.");
-	if (key.algorithm.name !== "RSASSA-PKCS1-v1_5" && key.algorithm.name !== "Ed25519") throw new TypeError("Currently only RSASSA-PKCS1-v1_5 and Ed25519 keys are supported.  More algorithms will be added in the future!");
-	if (key.algorithm.name === "RSASSA-PKCS1-v1_5") {
-		if (key.algorithm.hash.name !== "SHA-256") throw new TypeError("For compatibility with the existing Fediverse software (e.g., Mastodon), hash algorithm for RSASSA-PKCS1-v1_5 keys must be SHA-256.");
-	}
-}
-/**
-* Generates a key pair which is appropriate for Fedify.
-* @param algorithm The algorithm to use.  Currently only RSASSA-PKCS1-v1_5 and
-*                  Ed25519 are supported.
-* @returns The generated key pair.
-* @throws {TypeError} If the algorithm is unsupported.
-*/
-function generateCryptoKeyPair(algorithm) {
-	if (algorithm == null) getLogger([
-		"fedify",
-		"sig",
-		"key"
-	]).warn("No algorithm specified.  Using RSASSA-PKCS1-v1_5 by default, but it is recommended to specify the algorithm explicitly as the parameter will be required in the future.");
-	if (algorithm == null || algorithm === "RSASSA-PKCS1-v1_5") return crypto.subtle.generateKey({
-		name: "RSASSA-PKCS1-v1_5",
-		modulusLength: 4096,
-		publicExponent: new Uint8Array([
-			1,
-			0,
-			1
-		]),
-		hash: "SHA-256"
-	}, true, ["sign", "verify"]);
-	else if (algorithm === "Ed25519") return crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
-	throw new TypeError("Unsupported algorithm: " + algorithm);
-}
-/**
-* Exports a key in JWK format.
-* @param key The key to export.  Either public or private key.
-* @returns The exported key in JWK format.  The key is suitable for
-*          serialization and storage.
-* @throws {TypeError} If the key is invalid or unsupported.
-*/
-async function exportJwk(key) {
-	validateCryptoKey(key);
-	const jwk = await crypto.subtle.exportKey("jwk", key);
-	if (jwk.crv === "Ed25519") jwk.alg = "Ed25519";
-	return jwk;
-}
-/**
-* Imports a key from JWK format.
-* @param jwk The key in JWK format.
-* @param type Which type of key to import, either `"public"` or `"private"`.
-* @returns The imported key.
-* @throws {TypeError} If the key is invalid or unsupported.
-*/
-async function importJwk(jwk, type) {
-	let key;
-	if (jwk.kty === "RSA" && jwk.alg === "RS256") key = await crypto.subtle.importKey("jwk", jwk, {
-		name: "RSASSA-PKCS1-v1_5",
-		hash: "SHA-256"
-	}, true, type === "public" ? ["verify"] : ["sign"]);
-	else if (jwk.kty === "OKP" && jwk.crv === "Ed25519") {
-		if (navigator?.userAgent === "Cloudflare-Workers") {
-			jwk = { ...jwk };
-			delete jwk.alg;
-		}
-		key = await crypto.subtle.importKey("jwk", jwk, "Ed25519", true, type === "public" ? ["verify"] : ["sign"]);
-	} else throw new TypeError("Unsupported JWK format.");
-	validateCryptoKey(key, type);
-	return key;
-}
-async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
-	tracerProvider ??= trace.getTracerProvider();
-	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.fetch_key", {
-		kind: SpanKind.CLIENT,
-		attributes: {
-			"http.method": "GET",
-			"url.full": keyId.href,
-			"url.scheme": keyId.protocol.replace(/:$/, ""),
-			"url.domain": keyId.hostname,
-			"url.path": keyId.pathname,
-			"url.query": keyId.search.replace(/^\?/, ""),
-			"url.fragment": keyId.hash.replace(/^#/, "")
-		}
-	}, async (span) => {
-		try {
-			const result = await fetcher();
-			span.setAttribute("activitypub.actor.key.cached", result.cached);
-			return result;
-		} catch (e) {
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(e)
-			});
-			throw e;
-		} finally {
-			span.end();
-		}
-	});
-}
-/**
-* Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL.
-* If the given URL contains an {@link Actor} object, it tries to find
-* the corresponding key in the `publicKey` or `assertionMethod` property.
-* @template T The type of the key to fetch.  Either {@link CryptographicKey}
-*              or {@link Multikey}.
-* @param keyId The URL of the key.
-* @param cls The class of the key to fetch.  Either {@link CryptographicKey}
-*            or {@link Multikey}.
-* @param options Options for fetching the key.  See {@link FetchKeyOptions}.
-* @returns The fetched key or `null` if the key is not found.
-* @since 1.3.0
-*/
-function fetchKey(keyId, cls, options = {}) {
-	keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
-	return withFetchKeySpan(keyId, options.tracerProvider, () => fetchKeyInternal(keyId, cls, options));
-}
-/**
-* Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL,
-* preserving transport-level fetch failures for callers that need to inspect
-* why the key could not be loaded.
-*
-* @template T The type of the key to fetch.  Either {@link CryptographicKey}
-*              or {@link Multikey}.
-* @param keyId The URL of the key.
-* @param cls The class of the key to fetch.  Either {@link CryptographicKey}
-*            or {@link Multikey}.
-* @param options Options for fetching the key.
-* @returns The fetched key, or detailed fetch failure information.
-* @since 2.1.0
-*/
-async function fetchKeyDetailed(keyId, cls, options = {}) {
-	const cacheKey = typeof keyId === "string" ? new URL(keyId) : keyId;
-	return await withFetchKeySpan(cacheKey, options.tracerProvider, async () => {
-		return await fetchKeyWithResult(cacheKey, cls, options, async (cacheKey, keyId, keyCache, logger) => {
-			const fetchError = await keyCache?.getFetchError?.(cacheKey);
-			if (fetchError != null) {
-				logger.debug("Entry {keyId} found in cache with preserved fetch failure details.", { keyId });
-				return {
-					key: null,
-					cached: true,
-					fetchError
-				};
-			}
-			logger.debug("Entry {keyId} found in cache, but no fetch failure details are available.", { keyId });
-			return {
-				key: null,
-				cached: true
-			};
-		}, async (error, cacheKey, keyId, keyCache, logger) => {
-			logger.debug("Failed to fetch key {keyId}.", {
-				keyId,
-				error
-			});
-			await keyCache?.set(cacheKey, null);
-			if (error instanceof FetchError && error.response != null) {
-				const fetchError = {
-					status: error.response.status,
-					response: error.response.clone()
-				};
-				await keyCache?.setFetchError?.(cacheKey, fetchError);
-				return {
-					key: null,
-					cached: false,
-					fetchError
-				};
-			}
-			const fetchError = { error: error instanceof Error ? error : new Error(String(error)) };
-			await keyCache?.setFetchError?.(cacheKey, fetchError);
-			return {
-				key: null,
-				cached: false,
-				fetchError
-			};
-		});
-	});
-}
-async function getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger) {
-	if (keyCache == null) return null;
-	const cachedKey = await keyCache.get(cacheKey);
-	const hit = checkCachedKeyHit(cachedKey, keyId, cls, logger);
-	if (hit != null) return hit;
-	if (cachedKey === null) {
-		logger.debug("Entry {keyId} found in cache, but it is unavailable.", { keyId });
-		return {
-			key: null,
-			cached: true
-		};
-	}
-	return null;
-}
-function checkCachedKeyHit(cachedKey, keyId, cls, logger) {
-	if (cachedKey instanceof cls && cachedKey.publicKey != null) {
-		logger.debug("Key {keyId} found in cache.", { keyId });
-		return {
-			key: cachedKey,
-			cached: true
-		};
-	}
-	return null;
-}
-async function clearFetchErrorMetadata(keyId, keyCache) {
-	await keyCache?.setFetchError?.(keyId, null);
-}
-function isDidKeyUrl(keyId) {
-	return keyId.protocol === "did:" && keyId.pathname.startsWith("key:");
-}
-async function doRawKeysMatch(left, right) {
-	const [leftRaw, rightRaw] = await Promise.all([crypto.subtle.exportKey("raw", left), crypto.subtle.exportKey("raw", right)]);
-	if (leftRaw.byteLength !== rightRaw.byteLength) return false;
-	const leftBytes = new Uint8Array(leftRaw);
-	const rightBytes = new Uint8Array(rightRaw);
-	return leftBytes.every((byte, index) => byte === rightBytes[index]);
-}
-async function isCachedDidKeyValid(key, verificationMethod) {
-	try {
-		return key.id?.href === verificationMethod.id.href && key.controllerId?.href === verificationMethod.controller.href && await doRawKeysMatch(key.publicKey, verificationMethod.publicKey);
-	} catch {
-		return false;
-	}
-}
-async function resolveDidKey(cacheKey, cls, keyCache, logger) {
-	if (!isDidKeyUrl(cacheKey)) return null;
-	const keyId = cacheKey.href;
-	if (!(cls === Multikey)) {
-		logger.debug("Failed to resolve did:key {keyId}; did:key verification methods are only supported as Multikey values.", { keyId });
-		return {
-			key: null,
-			cached: false
-		};
-	}
-	let verificationMethod;
-	try {
-		verificationMethod = await parseDidKeyVerificationMethod(cacheKey);
-	} catch (error) {
-		logger.debug("Failed to resolve did:key verification method {keyId}: {error}", {
-			keyId,
-			error
-		});
-		return {
-			key: null,
-			cached: false
-		};
-	}
-	const hit = checkCachedKeyHit(await keyCache?.get(cacheKey), keyId, cls, logger);
-	if (hit?.key instanceof Multikey && await isCachedDidKeyValid(hit.key, verificationMethod)) return hit;
-	const key = new Multikey({
-		id: verificationMethod.id,
-		controller: verificationMethod.controller,
-		publicKey: verificationMethod.publicKey
-	});
-	await keyCache?.set(cacheKey, key);
-	await clearFetchErrorMetadata(cacheKey, keyCache);
-	logger.debug("Resolved did:key verification method {keyId}.", { keyId });
-	return {
-		key,
-		cached: false
-	};
-}
-async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider }, logger) {
-	let object;
-	try {
-		object = await Object$1.fromJsonLd(document, {
-			documentLoader,
-			contextLoader,
-			tracerProvider
-		});
-	} catch (e) {
-		if (!(e instanceof TypeError)) throw e;
-		try {
-			object = await cls.fromJsonLd(document, {
-				documentLoader,
-				contextLoader,
-				tracerProvider
-			});
-		} catch (e) {
-			if (e instanceof TypeError) {
-				logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
-				await keyCache?.set(cacheKey, null);
-				await clearFetchErrorMetadata(cacheKey, keyCache);
-				return {
-					key: null,
-					cached: false
-				};
-			}
-			throw e;
-		}
-	}
-	let key = null;
-	if (object instanceof cls) key = object;
-	else if (isActor(object)) {
-		const keys = cls === CryptographicKey ? object.getPublicKeys({
-			documentLoader,
-			contextLoader,
-			suppressError: true,
-			tracerProvider
-		}) : object.getAssertionMethods({
-			documentLoader,
-			contextLoader,
-			suppressError: true,
-			tracerProvider
-		});
-		let length = 0;
-		let lastKey = null;
-		try {
-			for await (const k of keys) {
-				length++;
-				lastKey = k;
-				if (k.id?.href === keyId) {
-					key = k;
-					break;
-				}
-			}
-		} catch (e) {
-			if (!(e instanceof TypeError)) throw e;
-			logger.debug("Failed to verify; a malformed key was encountered while iterating the keys of {keyId}; treating it as a missing key: {error}", {
-				keyId,
-				error: e
-			});
-		}
-		const keyIdUrl = new URL(keyId);
-		if (key == null && keyIdUrl.hash === "" && length === 1) key = lastKey;
-		if (key == null) {
-			logger.debug("Failed to verify; object {keyId} returned an {actorType}, but has no key matching {keyId}.", {
-				keyId,
-				actorType: object.constructor.name
-			});
-			await keyCache?.set(cacheKey, null);
-			await clearFetchErrorMetadata(cacheKey, keyCache);
-			return {
-				key: null,
-				cached: false
-			};
-		}
-	} else {
-		logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
-		await keyCache?.set(cacheKey, null);
-		await clearFetchErrorMetadata(cacheKey, keyCache);
-		return {
-			key: null,
-			cached: false
-		};
-	}
-	if (key.publicKey == null) {
-		logger.debug("Failed to verify; key {keyId} has no publicKeyPem field.", { keyId });
-		await keyCache?.set(cacheKey, null);
-		await clearFetchErrorMetadata(cacheKey, keyCache);
-		return {
-			key: null,
-			cached: false
-		};
-	}
-	if (keyCache != null) {
-		await keyCache.set(cacheKey, key);
-		logger.debug("Key {keyId} cached.", { keyId });
-	}
-	await clearFetchErrorMetadata(cacheKey, keyCache);
-	return {
-		key,
-		cached: false
-	};
-}
-async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, onFetchError) {
-	const start = performance.now();
-	let outcome = { result: "error" };
-	try {
-		const logger = getLogger([
-			"fedify",
-			"sig",
-			"key"
-		]);
-		const keyId = cacheKey.href;
-		const keyCache = options.keyCache;
-		const didKey = await resolveDidKey(cacheKey, cls, keyCache, logger);
-		if (didKey != null) {
-			outcome = { result: didKey.key == null ? "invalid" : didKey.cached ? "hit" : "fetched" };
-			return didKey;
-		}
-		const cached = await getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger);
-		if (cached?.key === null && cached.cached) {
-			const cachedUnavailable = await onCachedUnavailable(cacheKey, keyId, keyCache, logger);
-			outcome = { result: "hit" };
-			return cachedUnavailable;
-		}
-		if (cached != null) {
-			outcome = { result: "hit" };
-			return cached;
-		}
-		logger.debug("Fetching key {keyId} to verify signature...", { keyId });
-		let document;
-		try {
-			document = (await (options.documentLoader ?? getDocumentLoader())(keyId)).document;
-		} catch (error) {
-			const classified = classifyFetchError(error);
-			const errored = await onFetchError(error, cacheKey, keyId, keyCache, logger);
-			outcome = classified;
-			return errored;
-		}
-		const resolved = await resolveFetchedKey(document, cacheKey, keyId, cls, options, logger);
-		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
-		return resolved;
-	} finally {
-		recordKeyLookup(options.meterProvider, {
-			durationMs: getDurationMs(start),
-			result: outcome.result,
-			remoteUrl: cacheKey,
-			cacheEnabled: options.keyCache != null,
-			statusCode: outcome.statusCode
-		});
-	}
-}
-async function fetchKeyInternal(keyId, cls, options = {}) {
-	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
-		return {
-			key: null,
-			cached: true
-		};
-	}, async (error, cacheKey, keyId, keyCache, logger) => {
-		logger.debug("Failed to fetch key {keyId}.", {
-			keyId,
-			error
-		});
-		await keyCache?.set(cacheKey, null);
-		if (error instanceof FetchError && error.response != null) await keyCache?.setFetchError?.(cacheKey, {
-			status: error.response.status,
-			response: error.response.clone()
-		});
-		else await keyCache?.setFetchError?.(cacheKey, { error: error instanceof Error ? error : new Error(String(error)) });
-		return {
-			key: null,
-			cached: false
-		};
-	});
-}
-//#endregion
-export { importJwk as a, generateCryptoKeyPair as i, fetchKey as n, validateCryptoKey as o, fetchKeyDetailed as r, exportJwk as t };

package/dist/keycache-_DHqz5z_.mjs

@@ -1,97 +0,0 @@
-import { Temporal } from "temporal-polyfill";
-import "urlpattern-polyfill";
-globalThis.addEventListener = () => {};
-import { CryptographicKey, Multikey } from "@fedify/vocab";
-//#region src/federation/keycache.ts
-var KvKeyCache = class {
-	kv;
-	prefix;
-	options;
-	unavailableKeyTtl;
-	nullKeys;
-	constructor(kv, prefix, options = {}) {
-		this.kv = kv;
-		this.prefix = prefix;
-		this.options = options;
-		this.unavailableKeyTtl = options.unavailableKeyTtl ?? Temporal.Duration.from({ minutes: 10 });
-		this.nullKeys = /* @__PURE__ */ new Map();
-	}
-	#getFetchErrorKey(keyId) {
-		return [
-			...this.prefix,
-			"__fetchError",
-			keyId.href
-		];
-	}
-	async get(keyId) {
-		const negativeExpiration = this.nullKeys.get(keyId.href);
-		if (negativeExpiration != null) {
-			if (Temporal.Now.instant().until(negativeExpiration).sign >= 0) return null;
-			this.nullKeys.delete(keyId.href);
-		}
-		const serialized = await this.kv.get([...this.prefix, keyId.href]);
-		if (serialized === void 0) return void 0;
-		if (serialized === null) {
-			this.nullKeys.set(keyId.href, Temporal.Now.instant().add(this.unavailableKeyTtl));
-			return null;
-		}
-		try {
-			return await CryptographicKey.fromJsonLd(serialized, this.options);
-		} catch {
-			try {
-				return await Multikey.fromJsonLd(serialized, this.options);
-			} catch {
-				await this.kv.delete([...this.prefix, keyId.href]);
-				return;
-			}
-		}
-	}
-	async set(keyId, key) {
-		if (key == null) {
-			this.nullKeys.set(keyId.href, Temporal.Now.instant().add(this.unavailableKeyTtl));
-			await this.kv.set([...this.prefix, keyId.href], null, { ttl: this.unavailableKeyTtl });
-			return;
-		}
-		this.nullKeys.delete(keyId.href);
-		const serialized = await key.toJsonLd(this.options);
-		await this.kv.set([...this.prefix, keyId.href], serialized);
-	}
-	async getFetchError(keyId) {
-		const cached = await this.kv.get(this.#getFetchErrorKey(keyId));
-		if (cached == null || typeof cached !== "object") return void 0;
-		if ("status" in cached && typeof cached.status === "number" && "statusText" in cached && typeof cached.statusText === "string" && "headers" in cached && Array.isArray(cached.headers) && "body" in cached && typeof cached.body === "string") return {
-			status: cached.status,
-			response: new Response(cached.body, {
-				status: cached.status,
-				statusText: cached.statusText,
-				headers: cached.headers
-			})
-		};
-		else if ("errorName" in cached && typeof cached.errorName === "string" && "errorMessage" in cached && typeof cached.errorMessage === "string") {
-			const error = new Error(cached.errorMessage);
-			error.name = cached.errorName;
-			return { error };
-		}
-	}
-	async setFetchError(keyId, error) {
-		if (error == null) {
-			await this.kv.delete(this.#getFetchErrorKey(keyId));
-			return;
-		}
-		if ("status" in error) {
-			await this.kv.set(this.#getFetchErrorKey(keyId), {
-				status: error.status,
-				statusText: error.response.statusText,
-				headers: Array.from(error.response.headers.entries()),
-				body: await error.response.clone().text()
-			}, { ttl: this.unavailableKeyTtl });
-			return;
-		}
-		await this.kv.set(this.#getFetchErrorKey(keyId), {
-			errorName: error.error.name,
-			errorMessage: error.error.message
-		}, { ttl: this.unavailableKeyTtl });
-	}
-};
-//#endregion
-export { KvKeyCache as t };