@fedify/fedify 2.4.2 → 2.4.4

package/dist/{middleware-BqefXH6B.js → middleware-BOBF7req.js}

@@ -2,10 +2,10 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { $ as instrumentDocumentLoader, A as hasSignature, At as isPortableUri, C as InvalidContextReferenceError, Ct as getGatewayKeyBase, Dt as isCompatibleKeyId, E as compactJsonLd, Et as hasPortableActor, F as verifyCompactJsonLd, G as validateCryptoKey, M as isClearlyMalformedContextReference, N as isInvalidUrlTypeError, Nt as name, O as detachSignature, Ot as isPortableId, P as signJsonLd, Pt as version, Q as getRemoteHost, R as wrapContextLoaderForJsonLd, S as normalizeOutgoingActivityJsonLd, St as getCanonicalPortableId, Tt as getRawCanonicalPortableId, W as importJwk, X as getDurationMs, Z as getFederationMetrics, _ as verifyObject, at as recordCollectionTotalItems, b as verifyPortableObjectProofWithRoot, bt as verificationObservation, c as verifyRequestDetailed, ct as recordInboxActivity, d as InvalidPortableObjectIdError, dt as recordWebFingerHandle, et as isAbortError, f as classifyFep2277CoreType, ft as registerQueueDepthGauge, g as verifyMapLocalProof, h as signObject, i as selectRequestSignature, it as recordCollectionRequest, j as hasSignatureLike, jt as isSameObjectId, k as getNormalizationContextLoader, kt as isPortableKeyId, lt as recordOutboxActivity, m as hasProofLike, mt as formatAcceptSignature, n as listRequestSignatures, nt as recordCollectionDispatchDuration, o as validateMaxSignatures, pt as preloadedOnlyDocumentLoader, q as MAX_PORTABLE_KEY_TTL, r as parseRfc9421SignatureInput, rt as recordCollectionPageItems, s as verifyRequest, st as recordFanoutRecipients, t as doubleKnock, tt as recordCircuitBreakerStateChange, ut as recordOutboxEnqueue, v as verifyPortableObjectProof, vt as observeAttempt, w as assertSafeJsonLd, wt as getPortableDid, xt as getAuthenticationOrigin, y as verifyPortableObjectProofPolicy, yt as snapshotKey, z as exportJwk } from "./http-Qq7jR2rC.js";
+import { $ as instrumentDocumentLoader, A as hasSignature, At as isPortableUri, C as InvalidContextReferenceError, Ct as getGatewayKeyBase, Dt as isCompatibleKeyId, E as compactJsonLd, Et as hasPortableActor, F as verifyCompactJsonLd, G as validateCryptoKey, M as isClearlyMalformedContextReference, N as isInvalidUrlTypeError, Nt as name, O as detachSignature, Ot as isPortableId, P as signJsonLd, Pt as version, Q as getRemoteHost, R as wrapContextLoaderForJsonLd, S as normalizeOutgoingActivityJsonLd, St as getCanonicalPortableId, Tt as getRawCanonicalPortableId, W as importJwk, X as getDurationMs, Z as getFederationMetrics, _ as verifyObject, at as recordCollectionTotalItems, b as verifyPortableObjectProofWithRoot, bt as verificationObservation, c as verifyRequestDetailed, ct as recordInboxActivity, d as InvalidPortableObjectIdError, dt as recordWebFingerHandle, et as isAbortError, f as classifyFep2277CoreType, ft as registerQueueDepthGauge, g as verifyMapLocalProof, h as signObject, i as selectRequestSignature, it as recordCollectionRequest, j as hasSignatureLike, jt as isSameObjectId, k as getNormalizationContextLoader, kt as isPortableKeyId, lt as recordOutboxActivity, m as hasProofLike, mt as formatAcceptSignature, n as listRequestSignatures, nt as recordCollectionDispatchDuration, o as validateMaxSignatures, pt as preloadedOnlyDocumentLoader, q as MAX_PORTABLE_KEY_TTL, r as parseRfc9421SignatureInput, rt as recordCollectionPageItems, s as verifyRequest, st as recordFanoutRecipients, t as doubleKnock, tt as recordCircuitBreakerStateChange, ut as recordOutboxEnqueue, v as verifyPortableObjectProof, vt as observeAttempt, w as assertSafeJsonLd, wt as getPortableDid, xt as getAuthenticationOrigin, y as verifyPortableObjectProofPolicy, yt as snapshotKey, z as exportJwk } from "./http-D_AGUmSq.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-_S2_MeLF.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-CfIc190c.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-B0SZfzFb.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-CjdP7fQ4.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-C0AsMZ4U.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, PUBLIC_COLLECTION, Tombstone, getTypeId, isActor, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -2777,12 +2777,41 @@ async function isInAudience(object, actor, options = {}) {
 }
 //#endregion
 //#region src/federation/inbox.ts
+/**
+* Checks whether an activity's ID and all of its actor IDs have the same
+* [FEP-fe34] origin.  Activities without an ID have no origin to authenticate.
+*
+* Origins are compared by `getAuthenticationOrigin()`, so a portable activity
+* and its portable actors, including compatible identifiers on any gateway,
+* are compared by their DIDs.  An ID that has no supported origin, such as an
+* opaque URN, never matches.
+*
+* The caller is responsible for rejecting a missing primary actor ID before
+* relying on this check.
+*
+* [FEP-fe34]: https://w3id.org/fep/fe34
+* @internal
+*/
+function actorsHaveSameOrigin(activity) {
+	if (activity.id == null) return true;
+	const origin = getAuthenticationOrigin(activity.id);
+	return origin != null && activity.actorIds.every((actor) => getAuthenticationOrigin(actor) === origin);
+}
 async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", { activity: json });
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
+		return "missingActor";
+	}
 	let cacheKey = null;
 	if (activity.id != null) {
 		const inboxContext = inboxContextFactory(recipient, json, activity.id?.href, getTypeId(activity).href);
@@ -2818,15 +2847,6 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 			return "alreadyProcessed";
 		}
 	}
-	if (activity.actorId == null) {
-		logger.error("Missing actor.", { activity: json });
-		span.setStatus({
-			code: SpanStatusCode.ERROR,
-			message: "Missing actor."
-		});
-		recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
-		return "missingActor";
-	}
 	span.setAttribute("activitypub.actor.id", activity.actorId.href);
 	if (queue != null) {
 		const carrier = {};
@@ -2935,7 +2955,7 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 }
 //#endregion
 //#region src/federation/keycache.ts
-const KEY_CACHE_GENERATION = "2";
+const KEY_CACHE_GENERATION = "3";
 const COMPATIBLE_KEY_SEGMENT = "__compatible";
 const MAX_OWNER_BYTES = 32 * 1024;
 function isCompatibleKeyEntry(value) {
@@ -4740,13 +4760,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$2.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$1.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$2),
+		kind: getCollectionMetricKind(name$1),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -4792,7 +4812,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$2, filterPredicate);
+						const items = filterCollectionItems(page.items, name$1, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -4834,7 +4854,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 		} else {
 			const uri = new URL(portable == null ? baseUri : pageBase);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -4850,7 +4870,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$2, filterPredicate);
+					const items = filterCollectionItems(page.items, name$1, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -5999,11 +6019,49 @@ async function handleInboxInternal(request, parameters, span) {
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
 	}
+	if (!skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+		observation.authentication = {
+			status: "rejected",
+			reason: { type: "verificationFailed" }
+		};
+		logger.error("The activity ({activityId}) and its actors do not have the same origin.", {
+			activity: json,
+			recipient,
+			activityId: activity.id.href,
+			actorIds: activity.actorIds.map((actor) => actor.href)
+		});
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+		});
+		return new Response("The activity and its actors do not have the same origin.", {
+			status: 401,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 	observation.authentication = skipSignatureVerification ? { status: "skipped" } : {
 		status: "verified",
 		attempts: observation.verification.attempts.filter((attempt) => attempt.status === "verified")
 	};
 	observation.stage = "dispatch";
+	if (activity.actorId == null) {
+		observation.result = {
+			disposition: "rejected",
+			reason: "missingActor"
+		};
+		logger.error("Missing actor.", {
+			activity: json,
+			recipient
+		});
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		return new Response("Missing actor.", {
+			status: 400,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 	const routeResult = await routeActivity({
 		context: ctx,
 		json,
@@ -6224,8 +6282,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
-		this.name = name$1;
+	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
+		this.name = name$2;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -9260,6 +9318,35 @@ var FederationImpl = class extends FederationBuilderImpl {
 					span.setAttribute("activitypub.activity.id", activity.id.href);
 					listenerSpan.setAttribute("activitypub.activity.id", activity.id.href);
 				}
+				if (activity.actorId == null) {
+					logger.error("Missing actor in queued incoming activity.", {
+						activityId: activity.id?.href,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					listenerSpan.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: "Missing actor."
+					});
+					recordInboxActivity(this.meterProvider, "rejected", activityType);
+					listenerSpan.end();
+					return;
+				}
+				if (!this.skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+					logger.error("The queued activity ({activityId}) and its actors do not have the same origin.", {
+						activityId: activity.id.href,
+						actorIds: activity.actorIds.map((actor) => actor.href),
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					listenerSpan.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+					});
+					recordInboxActivity(this.meterProvider, "rejected", activityType);
+					listenerSpan.end();
+					return;
+				}
 				cacheKey = activity.id == null ? null : [
 					...this.kvPrefixes.activityIdempotence,
 					context.origin,
@@ -11336,6 +11423,20 @@ var ContextImpl = class ContextImpl {
 			recipient,
 			activity: json
 		});
+		if (activity.actorId == null) {
+			logger.debug("Activity is missing an actor; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
+		if (activity.id != null && !actorsHaveSameOrigin(activity)) {
+			logger.debug("Activity has actors from different origins; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
 		const routeResult = await routeActivity({
 			context: this,
 			json,

package/dist/{middleware-DFtNaBcH.mjs → middleware-BYojyPi4.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-C-swet0z.mjs";
+import { n as FederationImpl } from "./middleware-C_gtR3fV.mjs";
 export { FederationImpl };

package/dist/{middleware-C-swet0z.mjs → middleware-C_gtR3fV.mjs}

@@ -4,27 +4,28 @@ globalThis.addEventListener = () => {};
 import { d as isPortableUri, f as isSameObjectId, i as getPortableDid, l as isPortableId, n as getCanonicalPortableId, o as hasPortableActor, r as getGatewayKeyBase, s as isCompatibleKeyId, t as getAuthenticationOrigin, u as isPortableKeyId } from "./portable-key-id-Ca30-hOa.mjs";
 import { n as isPubliclyAddressedNode, t as isInAudience } from "./audience-CHQ-FlLD.mjs";
 import { a as verificationObservation, r as snapshotKey, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
-import { n as version, t as name } from "./deno-BZ4z-lJJ.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-CRv6_IBg.mjs";
+import { n as version, t as name } from "./deno-CO1X_K_q.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-BguhdXt-.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
-import { T as validateCryptoKey, _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike, w as importJwk, y as exportJwk } from "./ld-Dkkyk65e.mjs";
+import { T as validateCryptoKey, _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike, w as importJwk, y as exportJwk } from "./ld-Cy86r-Ty.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { a as signObject, c as verifyPortableObjectProof, i as hasProofLike, s as verifyObject, t as InvalidPortableObjectIdError, u as verifyPortableObjectProofWithRoot } from "./proof-DuSE1ABD.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as validateMaxSignatures, f as verifyRequest, p as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-B5w_qcIg.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-DUXXI-7G.mjs";
-import { n as kvCache } from "./kv-cache-BgQMAKIg.mjs";
+import { a as signObject, c as verifyPortableObjectProof, i as hasProofLike, s as verifyObject, t as InvalidPortableObjectIdError, u as verifyPortableObjectProofWithRoot } from "./proof-kJtQ49gr.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as validateMaxSignatures, f as verifyRequest, p as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-DkLKT8Vp.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-DFB_TNVp.mjs";
+import { n as kvCache } from "./kv-cache-BxfOpUP9.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-CEnNz8O7.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-BHUhedVc.mjs";
-import { t as verifyPortableObject } from "./portable-collection-DONEPTXV.mjs";
-import { a as getOrderingDestination, i as sendActivityThroughGateways, n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-D9oTjA6A.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-9ovCSqLp.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-Dc-Lg_Xn.mjs";
+import { t as verifyPortableObject } from "./portable-collection-DSKqMgvr.mjs";
+import { a as getOrderingDestination, i as sendActivityThroughGateways, n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-D6hcL5qf.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-DdY0E0w9.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-XJ53md4S.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as inspectCompoundPortableObjectApplicability, c as verifyServedPortableObjects, i as findUnsupportedCompoundProofShape, o as verifyCompoundPortableObjectProofs, r as findEmbeddedProofWithoutContext, t as containsCompoundPortableObject } from "./compound-proof-G2J_bU0u.mjs";
-import { t as KvKeyCache } from "./keycache-D-MNltOk.mjs";
+import { a as inspectCompoundPortableObjectApplicability, c as verifyServedPortableObjects, i as findUnsupportedCompoundProofShape, o as verifyCompoundPortableObjectProofs, r as findEmbeddedProofWithoutContext, t as containsCompoundPortableObject } from "./compound-proof-fxkyiXYM.mjs";
+import { n as routeActivity, t as actorsHaveSameOrigin } from "./inbox-Di1-EKqa.mjs";
+import { t as KvKeyCache } from "./keycache-N2opu4-3.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-iyAxBq0I.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-C8WqyM34.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -638,164 +639,6 @@ function visitJsonMaps(json, visit) {
 	}
 }
 //#endregion
-//#region src/federation/inbox.ts
-async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	let cacheKey = null;
-	if (activity.id != null) {
-		const inboxContext = inboxContextFactory(recipient, json, activity.id?.href, getTypeId(activity).href);
-		const strategy = idempotencyStrategy ?? "per-inbox";
-		let keyString;
-		if (typeof strategy === "function") keyString = await strategy(inboxContext, activity);
-		else switch (strategy) {
-			case "global":
-				keyString = activity.id.href;
-				break;
-			case "per-origin":
-				keyString = `${ctx.origin}\n${activity.id.href}`;
-				break;
-			case "per-inbox":
-				keyString = `${ctx.origin}\n${activity.id.href}\n${recipient == null ? "sharedInbox" : `inbox\n${recipient}`}`;
-				break;
-			default: keyString = `${ctx.origin}\n${activity.id.href}`;
-		}
-		if (keyString != null) cacheKey = [...kvPrefixes.activityIdempotence, keyString];
-	}
-	if (cacheKey != null) {
-		if (await kv.get(cacheKey) === true) {
-			logger.debug("Activity {activityId} has already been processed.", {
-				activityId: activity.id?.href,
-				activity: json,
-				recipient
-			});
-			span.setStatus({
-				code: SpanStatusCode.UNSET,
-				message: `Activity ${activity.id?.href} has already been processed.`
-			});
-			recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
-			return "alreadyProcessed";
-		}
-	}
-	if (activity.actorId == null) {
-		logger.error("Missing actor.", { activity: json });
-		span.setStatus({
-			code: SpanStatusCode.ERROR,
-			message: "Missing actor."
-		});
-		recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
-		return "missingActor";
-	}
-	span.setAttribute("activitypub.actor.id", activity.actorId.href);
-	if (queue != null) {
-		const carrier = {};
-		propagation.inject(context.active(), carrier);
-		try {
-			await queue.enqueue({
-				type: "inbox",
-				id: crypto.randomUUID(),
-				baseUrl: ctx.origin,
-				activity: originalJson ?? json,
-				...normalizedActivity == null ? {} : { normalizedActivity },
-				...ldSignatureVerified == null ? {} : { ldSignatureVerified },
-				identifier: recipient,
-				attempt: 0,
-				started: (/* @__PURE__ */ new Date()).toISOString(),
-				traceContext: carrier
-			});
-		} catch (error) {
-			logger.error("Failed to enqueue the incoming activity {activityId}:\n{error}", {
-				error,
-				activityId: activity.id?.href,
-				activity: json,
-				recipient
-			});
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: `Failed to enqueue the incoming activity ${activity.id?.href}.`
-			});
-			throw error;
-		}
-		getFederationMetrics(meterProvider).recordQueueTaskEnqueued({
-			role: "inbox",
-			queue,
-			activityType: getTypeId(activity).href
-		}, 0);
-		recordInboxActivity(meterProvider, "queued", getTypeId(activity).href);
-		logger.info("Activity {activityId} is enqueued.", {
-			activityId: activity.id?.href,
-			activity: json,
-			recipient
-		});
-		return "enqueued";
-	}
-	tracerProvider = tracerProvider ?? trace.getTracerProvider();
-	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.dispatch_inbox_listener", { kind: SpanKind.INTERNAL }, async (span) => {
-		const dispatched = inboxListeners?.dispatchWithClass(activity);
-		if (dispatched == null) {
-			logger.error("Unsupported activity type:\n{activity}", {
-				activity: json,
-				recipient
-			});
-			span.setStatus({
-				code: SpanStatusCode.UNSET,
-				message: `Unsupported activity type: ${getTypeId(activity).href}`
-			});
-			recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
-			span.end();
-			return "unsupportedActivity";
-		}
-		const { class: cls, listener } = dispatched;
-		span.updateName(`activitypub.dispatch_inbox_listener ${cls.name}`);
-		try {
-			const activityType = getTypeId(activity).href;
-			const started = performance.now();
-			try {
-				const contextFactory = listenerInboxContextFactory ?? inboxContextFactory;
-				await listener(contextFactory(recipient, contextFactory === inboxContextFactory ? json : originalJson ?? json, activity.id?.href, activityType), activity);
-			} finally {
-				getFederationMetrics(meterProvider).recordInboxProcessingDuration(activityType, getDurationMs(started));
-			}
-		} catch (error) {
-			try {
-				await inboxErrorHandler?.(ctx, error);
-			} catch (error) {
-				logger.error("An unexpected error occurred in inbox error handler:\n{error}", {
-					error,
-					activityId: activity.id?.href,
-					activity: json,
-					recipient
-				});
-			}
-			logger.error("Failed to process the incoming activity {activityId}:\n{error}", {
-				error,
-				activityId: activity.id?.href,
-				activity: json,
-				recipient
-			});
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
-			span.end();
-			return "error";
-		}
-		recordInboxActivity(meterProvider, "processed", getTypeId(activity).href);
-		if (cacheKey != null) await kv.set(cacheKey, true, { ttl: Temporal.Duration.from({ days: 1 }) });
-		logger.info("Activity {activityId} has been processed.", {
-			activityId: activity.id?.href,
-			activity: json,
-			recipient
-		});
-		span.end();
-		return "success";
-	});
-}
-//#endregion
 //#region src/federation/portable.ts
 /**
 * The media type that FEP-ef61 gateways must use for portable objects.
@@ -1725,13 +1568,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$2.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$1.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$2),
+		kind: getCollectionMetricKind(name$1),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -1777,7 +1620,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$2, filterPredicate);
+						const items = filterCollectionItems(page.items, name$1, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -1819,7 +1662,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 		} else {
 			const uri = new URL(portable == null ? baseUri : pageBase);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -1835,7 +1678,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$2, filterPredicate);
+					const items = filterCollectionItems(page.items, name$1, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -2984,11 +2827,49 @@ async function handleInboxInternal(request, parameters, span) {
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
 	}
+	if (!skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+		observation.authentication = {
+			status: "rejected",
+			reason: { type: "verificationFailed" }
+		};
+		logger.error("The activity ({activityId}) and its actors do not have the same origin.", {
+			activity: json,
+			recipient,
+			activityId: activity.id.href,
+			actorIds: activity.actorIds.map((actor) => actor.href)
+		});
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+		});
+		return new Response("The activity and its actors do not have the same origin.", {
+			status: 401,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 	observation.authentication = skipSignatureVerification ? { status: "skipped" } : {
 		status: "verified",
 		attempts: observation.verification.attempts.filter((attempt) => attempt.status === "verified")
 	};
 	observation.stage = "dispatch";
+	if (activity.actorId == null) {
+		observation.result = {
+			disposition: "rejected",
+			reason: "missingActor"
+		};
+		logger.error("Missing actor.", {
+			activity: json,
+			recipient
+		});
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		return new Response("Missing actor.", {
+			status: 400,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 	const routeResult = await routeActivity({
 		context: ctx,
 		json,
@@ -3209,8 +3090,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
-		this.name = name$1;
+	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
+		this.name = name$2;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -5836,6 +5717,35 @@ var FederationImpl = class extends FederationBuilderImpl {
 					span.setAttribute("activitypub.activity.id", activity.id.href);
 					listenerSpan.setAttribute("activitypub.activity.id", activity.id.href);
 				}
+				if (activity.actorId == null) {
+					logger.error("Missing actor in queued incoming activity.", {
+						activityId: activity.id?.href,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					listenerSpan.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: "Missing actor."
+					});
+					recordInboxActivity(this.meterProvider, "rejected", activityType);
+					listenerSpan.end();
+					return;
+				}
+				if (!this.skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+					logger.error("The queued activity ({activityId}) and its actors do not have the same origin.", {
+						activityId: activity.id.href,
+						actorIds: activity.actorIds.map((actor) => actor.href),
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					listenerSpan.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+					});
+					recordInboxActivity(this.meterProvider, "rejected", activityType);
+					listenerSpan.end();
+					return;
+				}
 				cacheKey = activity.id == null ? null : [
 					...this.kvPrefixes.activityIdempotence,
 					context.origin,
@@ -7912,6 +7822,20 @@ var ContextImpl = class ContextImpl {
 			recipient,
 			activity: json
 		});
+		if (activity.actorId == null) {
+			logger.debug("Activity is missing an actor; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
+		if (activity.id != null && !actorsHaveSameOrigin(activity)) {
+			logger.debug("Activity has actors from different origins; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
 		const routeResult = await routeActivity({
 			context: this,
 			json,

package/dist/mod.cjs

@@ -3,11 +3,11 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-x1satM4y.cjs");
-const require_federation = require("./federation-DpT8bDM6.cjs");
+const require_http = require("./http-g5f1D2tm.cjs");
+const require_federation = require("./federation-Bf4FEork.cjs");
 const require_types = require("./types-poIao40f.cjs");
-const require_portable_collection = require("./portable-collection-DL-1Wy1s.cjs");
-const require_kv_cache = require("./kv-cache-D4throaQ.cjs");
+const require_portable_collection = require("./portable-collection-Bl2UkqcO.cjs");
+const require_kv_cache = require("./kv-cache-HsXADkl9.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");
 require("./sig/mod.cjs");

package/dist/mod.js

@@ -3,11 +3,11 @@ import { URLPattern } from "urlpattern-polyfill";
 import "./rolldown-runtime-BC-Eo5Mj.js";
 import { n as autoIdAssigner, r as getDefaultActivityTransformers, t as actorDehydrator } from "./transformers-DAtXl_Kc.js";
 import "./compat/mod.js";
-import { D as createSignature, H as fetchKeyDetailed, I as verifyJsonLd, L as verifySignature, O as detachSignature, P as signJsonLd, T as attachSignature, U as generateCryptoKeyPair, V as fetchKey, W as importJwk, _ as verifyObject, _t as validateAcceptSignature, a as signRequest, c as verifyRequestDetailed, gt as parseAcceptSignature, h as signObject, ht as fulfillAcceptSignature, j as hasSignatureLike, m as hasProofLike, mt as formatAcceptSignature, p as createProof, s as verifyRequest, v as verifyPortableObjectProof, x as verifyProof, z as exportJwk } from "./http-Qq7jR2rC.js";
-import { a as respondWithObjectIfAcceptable, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as respondWithObject, l as CircuitBreaker, n as handleWebFinger, o as SendActivityError, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-BqefXH6B.js";
+import { D as createSignature, H as fetchKeyDetailed, I as verifyJsonLd, L as verifySignature, O as detachSignature, P as signJsonLd, T as attachSignature, U as generateCryptoKeyPair, V as fetchKey, W as importJwk, _ as verifyObject, _t as validateAcceptSignature, a as signRequest, c as verifyRequestDetailed, gt as parseAcceptSignature, h as signObject, ht as fulfillAcceptSignature, j as hasSignatureLike, m as hasProofLike, mt as formatAcceptSignature, p as createProof, s as verifyRequest, v as verifyPortableObjectProof, x as verifyProof, z as exportJwk } from "./http-D_AGUmSq.js";
+import { a as respondWithObjectIfAcceptable, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as respondWithObject, l as CircuitBreaker, n as handleWebFinger, o as SendActivityError, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-BOBF7req.js";
 import { n as getNodeInfo, r as parseNodeInfo, t as nodeInfoToJson } from "./types-_S2_MeLF.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-CfIc190c.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-B0SZfzFb.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-CjdP7fQ4.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-C0AsMZ4U.js";
 import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue, Router, RouterError } from "./federation/mod.js";
 import "./nodeinfo/mod.js";
 import "./runtime/mod.js";