@fedify/fedify 2.5.0-dev.2446 → 2.5.0-dev.2448

package/dist/inbox-authentication-DflPYlLL.mjs

@@ -0,0 +1,171 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { i as getPortableDid, l as isPortableId, n as getCanonicalPortableId } from "./portable-key-id-Ca30-hOa.mjs";
+//#region src/federation/inbox-authentication.ts
+/**
+* The evidence of an activity that has not been authenticated by Fedify.
+*/
+const EMPTY_EVIDENCE = Object.freeze({
+	verified: false,
+	requestSigners: Object.freeze([]),
+	documentSigners: Object.freeze([]),
+	originAuthenticated: Object.freeze([]),
+	expandedActivity: Object.freeze([]),
+	baseUrl: null
+});
+/**
+* Gets the evidence of an activity that has not been authenticated.
+* @internal
+*/
+function getEmptyAuthenticationEvidence() {
+	return EMPTY_EVIDENCE;
+}
+/**
+* Gets the principals that an authorization decision should rely on.
+* @param evidence The evidence.
+* @param scope See {@link IsActorAuthenticatedOptions.scope}.
+* @returns The principals.
+* @internal
+*/
+function getEffectivePrincipals(evidence, scope = "effective") {
+	if (scope === "document" || evidence.documentSigners.length > 0) return evidence.documentSigners;
+	if (evidence.requestSigners.length > 0) return evidence.requestSigners;
+	return evidence.originAuthenticated;
+}
+/**
+* Normalizes an actor ID for comparison: portable IDs and compatible
+* identifiers to their canonical portable ID, other IDs to their `href`.
+* @returns The normalized ID, or `null` for a malformed portable ID.
+*/
+function normalizeActorId(id) {
+	return isPortableId(id) ? getCanonicalPortableId(id) : id.href;
+}
+/**
+* Checks whether the given principal authenticates the given actor.
+* @param principal The principal.
+* @param actorId The actor ID.
+* @returns `true` if the principal authenticates the actor.
+* @internal
+*/
+function principalAuthenticates(principal, actorId) {
+	if (principal.kind === "portableAuthority") {
+		if (!isPortableId(actorId)) return false;
+		const did = getPortableDid(actorId);
+		return did != null && did === getPortableDid(principal.id);
+	}
+	const expected = normalizeActorId(actorId);
+	return expected != null && normalizeActorId(principal.id) === expected;
+}
+/**
+* Checks whether the given evidence authenticates the given actor.
+*
+* Actor IDs are compared exactly, except that [FEP-ef61] portable IDs and
+* compatible identifiers are compared by their canonical portable IDs, and
+* a portable authority (a DID) authenticates the portable actors of that DID.
+*
+* @example
+* ``` typescript
+* federation
+*   .setInboxListeners("/users/{identifier}/inbox", "/inbox")
+*   .on(Follow, async (ctx, follow) => {
+*     if (follow.actorId == null) return;
+*     // The actor is always authenticated for activities that declare one,
+*     // but the same check works for any actor an activity names:
+*     isActorAuthenticated(ctx.authentication, follow.actorId);
+*   });
+* ```
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @param evidence The authentication evidence, usually
+*                 {@link InboxContext.authentication}.
+* @param actorId The actor ID to check.
+* @param options Options.
+* @returns `true` if the actor is authenticated.
+* @since 2.5.0
+*/
+function isActorAuthenticated(evidence, actorId, options = {}) {
+	return getEffectivePrincipals(evidence, options.scope).some((principal) => principalAuthenticates(principal, actorId));
+}
+function serializePrincipal(principal) {
+	return {
+		kind: principal.kind,
+		id: principal.id.href,
+		mechanism: principal.mechanism,
+		keyId: principal.keyId?.href ?? null
+	};
+}
+/**
+* Serializes the principals of the given evidence for a queued message.
+* @internal
+*/
+function serializeAuthentication(evidence) {
+	return {
+		verified: evidence.verified,
+		requestSigners: evidence.requestSigners.map(serializePrincipal),
+		documentSigners: evidence.documentSigners.map(serializePrincipal),
+		originAuthenticated: evidence.originAuthenticated.map(serializePrincipal)
+	};
+}
+const KINDS = /* @__PURE__ */ new Set(["actor", "portableAuthority"]);
+const MECHANISMS = /* @__PURE__ */ new Set([
+	"httpSignatures",
+	"linkedDataSignatures",
+	"objectIntegrityProofs",
+	"origin"
+]);
+function deserializePrincipals(value) {
+	if (!Array.isArray(value)) return null;
+	const principals = [];
+	for (const item of value) {
+		if (item == null || typeof item !== "object" || !KINDS.has(item.kind) || !MECHANISMS.has(item.mechanism) || typeof item.id !== "string" || !URL.canParse(item.id) || item.keyId != null && (typeof item.keyId !== "string" || !URL.canParse(item.keyId))) return null;
+		principals.push(Object.freeze({
+			kind: item.kind,
+			id: new URL(item.id),
+			mechanism: item.mechanism,
+			keyId: item.keyId == null ? null : new URL(item.keyId)
+		}));
+	}
+	return principals;
+}
+/**
+* Restores the evidence of a queued message.
+* @param value The serialized principals.
+* @param expandedActivity The expanded activity, restored from the queued
+*                         verified view.
+* @param baseUrl The base URL, restored from the queued verified view.
+* @returns The evidence, or `null` if the serialized value is malformed.
+* @internal
+*/
+function deserializeAuthentication(value, expandedActivity, baseUrl) {
+	if (value == null || typeof value !== "object" || typeof value.verified !== "boolean") return null;
+	const record = value;
+	const requestSigners = deserializePrincipals(record.requestSigners);
+	const documentSigners = deserializePrincipals(record.documentSigners);
+	const originAuthenticated = deserializePrincipals(record.originAuthenticated);
+	if (requestSigners == null || documentSigners == null || originAuthenticated == null) return null;
+	return createAuthenticationEvidence({
+		verified: record.verified,
+		requestSigners,
+		documentSigners,
+		originAuthenticated,
+		expandedActivity,
+		baseUrl
+	});
+}
+/**
+* Creates frozen evidence.
+* @internal
+*/
+function createAuthenticationEvidence(evidence) {
+	return Object.freeze({
+		verified: evidence.verified,
+		requestSigners: Object.freeze([...evidence.requestSigners]),
+		documentSigners: Object.freeze([...evidence.documentSigners]),
+		originAuthenticated: Object.freeze([...evidence.originAuthenticated]),
+		expandedActivity: evidence.expandedActivity,
+		baseUrl: evidence.baseUrl
+	});
+}
+//#endregion
+export { isActorAuthenticated as a, getEmptyAuthenticationEvidence as i, deserializeAuthentication as n, serializeAuthentication as o, getEffectivePrincipals as r, createAuthenticationEvidence as t };

package/dist/inbox-view-NE9wXdLo.mjs

@@ -0,0 +1,385 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { c as getNormalizationContextLoader, p as markEffectiveContextLoader, s as detachSignature, y as wrapContextLoaderForJsonLd } from "./ld-CQFuiah9.mjs";
+import { preloadedContexts } from "@fedify/vocab-runtime";
+import { encodeHex } from "byte-encodings/hex";
+import jsonld from "@fedify/vocab-runtime/jsonld";
+import serialize from "json-canon";
+//#region src/federation/inbox-view.ts
+/**
+* The interpretation of an incoming activity that Fedify authenticated, kept
+* so that listeners, authorization helpers, and queue workers observe the
+* same JSON-LD meaning that signature verification observed.
+*
+* Every JSON-LD processing step of one delivery goes through a request-scoped
+* *context snapshot*, which memoizes the remote context responses so that
+* a nondeterministic or mutable remote context cannot give verification and
+* dispatch different meanings.  The snapshot is serialized into queued
+* messages, so that workers and retries replay the very same responses
+* without loading contexts again.
+* @module
+*/
+/**
+* Thrown when replaying an interpretation needs a context response that its
+* snapshot does not have, or has with a different content.
+* @internal
+*/
+var ContextSnapshotMissError = class extends Error {
+	url;
+	constructor(url, reason) {
+		super(`Context ${url} cannot be replayed: ${reason}.`);
+		this.name = "ContextSnapshotMissError";
+		this.url = url;
+	}
+};
+function normalizeUrl(url) {
+	return URL.canParse(url) ? new URL(url).href : url;
+}
+/**
+* Creates the context snapshot of a delivery.
+* @param base The caller's context loader.
+* @returns The snapshot.
+* @internal
+*/
+function createContextSnapshot(base) {
+	const underlying = {
+		standard: wrapContextLoaderForJsonLd(base),
+		normalization: getNormalizationContextLoader(base)
+	};
+	const cache = /* @__PURE__ */ new Map();
+	const recorded = /* @__PURE__ */ new Map();
+	const loaders = /* @__PURE__ */ new Map();
+	let released = false;
+	return {
+		loader(policy) {
+			let loader = loaders.get(policy);
+			if (loader != null) return loader;
+			const effective = underlying[policy];
+			loader = markEffectiveContextLoader(async (url, options) => {
+				if (released) return await effective(url, options);
+				const normalizedUrl = normalizeUrl(url);
+				const key = `${policy}\n${normalizedUrl}`;
+				let promise = cache.get(key);
+				if (promise == null) {
+					promise = Promise.resolve(effective(url, options)).then((response) => {
+						const cloned = normalizeResponse(structuredClone(response));
+						recorded.set(key, {
+							policy,
+							url: normalizedUrl,
+							response: structuredClone(cloned)
+						});
+						return cloned;
+					});
+					promise.catch(() => {});
+					cache.set(key, promise);
+				}
+				return structuredClone(await promise);
+			}, policy);
+			loaders.set(policy, loader);
+			return loader;
+		},
+		entries() {
+			return [...recorded.values()];
+		},
+		release() {
+			released = true;
+		}
+	};
+}
+function getBundledResponse(url) {
+	if (!(url in preloadedContexts)) return null;
+	return {
+		contextUrl: null,
+		document: preloadedContexts[url],
+		documentUrl: url
+	};
+}
+async function sha256(value) {
+	return encodeHex(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(serialize(value))));
+}
+function normalizeResponse(response) {
+	return {
+		contextUrl: response.contextUrl ?? null,
+		document: response.document,
+		documentUrl: response.documentUrl
+	};
+}
+/**
+* Serializes the entries of a context snapshot for a queued message.
+* @param entries The entries.
+* @returns The serialized entries, which are plain JSON values.
+* @internal
+*/
+async function serializeContextSnapshot(entries) {
+	const result = [];
+	for (const entry of entries) {
+		const response = normalizeResponse(entry.response);
+		const hash = await sha256(response);
+		const bundled = getBundledResponse(entry.url);
+		if (bundled != null && await sha256(bundled) === hash) result.push({
+			policy: entry.policy,
+			url: entry.url,
+			sha256: hash,
+			bundled: true
+		});
+		else result.push({
+			policy: entry.policy,
+			url: entry.url,
+			sha256: hash,
+			response: structuredClone(response)
+		});
+	}
+	return result;
+}
+function isRemoteDocument(value) {
+	if (value == null || typeof value !== "object") return false;
+	const record = value;
+	return typeof record.documentUrl === "string" && "document" in record && (record.contextUrl == null || typeof record.contextUrl === "string");
+}
+/**
+* Restores the entries of a serialized context snapshot, verifying the
+* hashes of stored responses.  Bundled entries are reconstructed from the
+* contexts this version of Fedify bundles.
+* @param entries The serialized entries.
+* @returns The entries.
+* @throws {ContextSnapshotMissError} If an entry is malformed, or its
+*                                    content does not match its hash.
+* @internal
+*/
+async function deserializeContextSnapshot(entries) {
+	if (!Array.isArray(entries)) throw new ContextSnapshotMissError("(snapshot)", "malformed snapshot");
+	const result = [];
+	for (const entry of entries) {
+		if (entry == null || typeof entry !== "object" || entry.policy !== "standard" && entry.policy !== "normalization" || typeof entry.url !== "string" || typeof entry.sha256 !== "string") throw new ContextSnapshotMissError("(snapshot)", "malformed entry");
+		let response;
+		if (entry.bundled === true) {
+			response = getBundledResponse(entry.url);
+			if (response == null) throw new ContextSnapshotMissError(entry.url, "not bundled");
+		} else if (isRemoteDocument(entry.response)) response = normalizeResponse(entry.response);
+		else throw new ContextSnapshotMissError(entry.url, "malformed entry");
+		if (entry.bundled !== true && await sha256(response) !== entry.sha256) throw new ContextSnapshotMissError(entry.url, "content mismatch");
+		result.push({
+			policy: entry.policy,
+			url: entry.url,
+			response: structuredClone(response)
+		});
+	}
+	return result;
+}
+/**
+* Creates a context loader of a policy that serves only the responses of
+* a snapshot.  It is marked as the effective loader of the policy.
+* @param entries The snapshot's entries.
+* @param policy The policy.
+* @returns The loader, which throws {@link ContextSnapshotMissError} for
+*          anything else.
+* @internal
+*/
+function createSnapshotOnlyLoader(entries, policy) {
+	const responses = /* @__PURE__ */ new Map();
+	for (const entry of entries) if (entry.policy === policy) responses.set(entry.url, entry.response);
+	return markEffectiveContextLoader(async (url) => {
+		const response = responses.get(normalizeUrl(url));
+		if (response == null) throw new ContextSnapshotMissError(url, "not in the snapshot");
+		return structuredClone(response);
+	}, policy);
+}
+/**
+* Creates a {@link ReleasableLoader}.
+* @param strict The loader to use until release.
+* @param fallback The loader to use after release.
+* @param policy The policy both loaders apply.
+* @returns The releasable loader.
+* @internal
+*/
+function createReleasableLoader(strict, fallback, policy) {
+	let released = false;
+	return {
+		loader: markEffectiveContextLoader((url, options) => released ? fallback(url, options) : strict(url, options), policy),
+		release() {
+			released = true;
+		}
+	};
+}
+/**
+* Expands a JSON-LD document with the given context loader.
+* @param document The document.
+* @param contextLoader The context loader.
+* @returns The expanded document.
+* @internal
+*/
+async function expandDocument(document, contextLoader) {
+	return await jsonld.expand(document, { documentLoader: contextLoader });
+}
+/**
+* Computes the digest of an expanded document.
+* @param expanded The expanded document.
+* @returns The hex-encoded SHA-256 of its canonical JSON.
+* @internal
+*/
+function digestExpandedDocument(expanded) {
+	return sha256(expanded);
+}
+/**
+* Deeply freezes a JSON value.
+* @param value The value.
+* @returns The same value, frozen.
+* @internal
+*/
+function deepFreeze(value) {
+	if (value != null && typeof value === "object" && !Object.isFrozen(value)) {
+		Object.freeze(value);
+		for (const child of Object.values(value)) deepFreeze(child);
+	}
+	return value;
+}
+const ACTOR_IRI = "https://www.w3.org/ns/activitystreams#actor";
+/**
+* Gets the single root node of an expanded document.
+* @param expanded The expanded document.
+* @returns The root node, or `null` if there is not exactly one.
+* @internal
+*/
+function getRootNode(expanded) {
+	if (expanded.length !== 1) return null;
+	const node = expanded[0];
+	if (node == null || typeof node !== "object" || Array.isArray(node)) return null;
+	return node;
+}
+/**
+* Gets the values of a property of an expanded node, unwrapping a single
+* `@list` container the way generated vocabulary decoders do.
+* @param node The expanded node.
+* @param iri The property IRI.
+* @returns The values, or an empty array if the property is absent.
+* @internal
+*/
+function getPropertyValues(node, iri) {
+	const values = node[iri];
+	if (values == null) return [];
+	if (!Array.isArray(values)) return [values];
+	if (values.length === 1 && values[0] != null && typeof values[0] === "object" && "@list" in values[0]) {
+		const list = values[0]["@list"];
+		return Array.isArray(list) ? list : [list];
+	}
+	return values;
+}
+/**
+* Tells whether the root node of an expanded activity declares any `actor`
+* value at all, including blank nodes, anonymous or untyped nodes, and
+* literals, which ID accessors and typed parsing may drop.
+* @param expanded The expanded activity.
+* @returns `"absent"` if the root node declares no actor; `"present"`
+*          otherwise, including when there is no single root node.
+* @internal
+*/
+function getActorPresence(expanded) {
+	const root = getRootNode(expanded);
+	if (root == null) return "present";
+	return getPropertyValues(root, ACTOR_IRI).length < 1 ? "absent" : "present";
+}
+/**
+* Builds the serialized view of an authenticated activity.  The document is
+* expanded through the snapshot, so that the snapshot holds every context
+* response the interpretation needs.
+* @param snapshot The delivery's context snapshot.
+* @param source Which document the activity was parsed from.
+* @returns The serialized view and the expanded activity.
+* @internal
+*/
+async function buildVerifiedActivityView(snapshot, source) {
+	const loader = snapshot.loader(source.policy);
+	const used = /* @__PURE__ */ new Set();
+	const expanded = await expandDocument(source.document, markEffectiveContextLoader((url, options) => {
+		used.add(normalizeUrl(url));
+		return loader(url, options);
+	}, source.policy));
+	const entries = snapshot.entries().filter((entry) => entry.policy === source.policy && used.has(entry.url));
+	const contexts = await serializeContextSnapshot(entries);
+	const references = /* @__PURE__ */ new Set();
+	collectContextReferences(source.document, source.baseUrl?.href, references);
+	for (const entry of entries) {
+		const { contextUrl, document } = entry.response;
+		collectContextReferences(document, entry.url, references);
+		if (contextUrl != null) collectContextReferences({ "@context": contextUrl }, entry.url, references);
+	}
+	return {
+		replayable: [...references].every((url) => used.has(url)),
+		view: {
+			version: 1,
+			policy: source.policy,
+			source: source.source,
+			baseUrl: source.baseUrl?.href ?? null,
+			contexts,
+			expandedDigest: await digestExpandedDocument(expanded)
+		},
+		expanded
+	};
+}
+/**
+* Collects the remote context references of a JSON-LD document or context
+* document: every IRI given as a value of `@context` at any depth, including
+* scoped contexts of term definitions, and of `@import`.
+* @param value The document.
+* @param base The URL to resolve relative references against.
+* @param references The set to add the normalized references to.
+*/
+function collectContextReferences(value, base, references) {
+	const add = (reference) => {
+		let url = reference;
+		if (base != null && URL.canParse(reference, base)) url = new URL(reference, base).href;
+		references.add(normalizeUrl(url));
+	};
+	const collectContext = (context) => {
+		if (typeof context === "string") add(context);
+		else if (Array.isArray(context)) for (const item of context) collectContext(item);
+		else if (context != null && typeof context === "object") {
+			const imported = context["@import"];
+			if (typeof imported === "string") add(imported);
+			walk(context);
+		}
+	};
+	const walk = (node) => {
+		if (Array.isArray(node)) for (const item of node) walk(item);
+		else if (node != null && typeof node === "object") for (const [key, item] of Object.entries(node)) if (key === "@context") collectContext(item);
+		else walk(item);
+	};
+	walk(value);
+}
+/**
+* Validates the shape of a serialized view taken from a queued message.
+* @param value The value of the message's `verifiedView` field.
+* @returns The view, or `null` if it is malformed or of an unsupported
+*          version.
+* @internal
+*/
+function parseSerializedVerifiedActivityView(value) {
+	if (value == null || typeof value !== "object") return null;
+	const view = value;
+	if (view.version !== 1 || view.policy !== "standard" && view.policy !== "normalization" || view.source !== "activity" && view.source !== "normalizedActivity" || view.baseUrl !== null && (typeof view.baseUrl !== "string" || !URL.canParse(view.baseUrl)) || !Array.isArray(view.contexts) || typeof view.expandedDigest !== "string") return null;
+	return view;
+}
+/**
+* Restores a view from a queued message without loading any context.
+* @param view The serialized view.
+* @param message The fields of the message the view refers to.
+* @returns The restored view.
+* @throws {ContextSnapshotMissError} If the view cannot be replayed exactly.
+* @internal
+*/
+async function restoreVerifiedActivityView(view, message) {
+	const loader = createSnapshotOnlyLoader(await deserializeContextSnapshot(view.contexts), view.policy);
+	if (view.source === "normalizedActivity" && message.normalizedActivity == null) throw new ContextSnapshotMissError("(normalizedActivity)", "the normalized activity is missing");
+	const document = detachSignature(view.source === "activity" ? message.activity : message.normalizedActivity);
+	const expanded = await expandDocument(document, loader);
+	if (await digestExpandedDocument(expanded) !== view.expandedDigest) throw new ContextSnapshotMissError("(activity)", "the interpretation does not match the authenticated one");
+	return {
+		document,
+		loader,
+		expanded,
+		baseUrl: view.baseUrl == null ? null : new URL(view.baseUrl)
+	};
+}
+//#endregion
+export { createSnapshotOnlyLoader as a, expandDocument as c, parseSerializedVerifiedActivityView as d, restoreVerifiedActivityView as f, createReleasableLoader as i, getActorPresence as l, buildVerifiedActivityView as n, deepFreeze as o, serializeContextSnapshot as p, createContextSnapshot as r, deserializeContextSnapshot as s, ContextSnapshotMissError as t, getPropertyValues as u };