@fedify/fedify 2.5.0-dev.2446 → 2.5.0-dev.2492

package/dist/inbox-BjihTKLo.mjs

@@ -0,0 +1,312 @@
+import { Temporal } from "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { t as getAuthenticationOrigin } from "./portable-key-id-Ca30-hOa.mjs";
+import { o as serializeAuthentication, r as getEffectivePrincipals } from "./inbox-authentication-DflPYlLL.mjs";
+import { n as version, t as name } from "./deno-iOAA7iRN.mjs";
+import { g as recordInboxActivity, n as getDurationMs, r as getFederationMetrics } from "./metrics-CpxvUrBz.mjs";
+import { getLogger } from "@logtape/logtape";
+import { getTypeId } from "@fedify/vocab";
+import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
+//#region src/federation/inbox.ts
+/**
+* Checks whether an activity's ID and all of its actor IDs have the same
+* [FEP-fe34] origin.  Activities without an ID have no origin to authenticate.
+*
+* Origins are compared by `getAuthenticationOrigin()`, so a portable activity
+* and its portable actors, including compatible identifiers on any gateway,
+* are compared by their DIDs.  An ID that has no supported origin, such as an
+* opaque URN, never matches.
+*
+* The caller is responsible for rejecting a missing primary actor ID before
+* relying on this check.
+*
+* [FEP-fe34]: https://w3id.org/fep/fe34
+* @internal
+*/
+function actorsHaveSameOrigin(activity) {
+	if (activity.id == null) return true;
+	const origin = getAuthenticationOrigin(activity.id);
+	return origin != null && activity.actorIds.every((actor) => getAuthenticationOrigin(actor) === origin);
+}
+/**
+* The headroom that the size check of a queued inbox message leaves for the
+* fields that grow when Fedify retries the message, e.g., its attempt count.
+*/
+const QUEUED_MESSAGE_HEADROOM = 64;
+/**
+* Computes the idempotency key of an incoming activity.
+* @returns The key, or `null` if the activity is not deduplicated.
+* @internal
+*/
+async function getInboxIdempotencyKey(strategy, inboxContext, activity, origin, recipient, prefix) {
+	if (activity.id == null) return null;
+	strategy ??= "per-inbox";
+	let keyString;
+	if (typeof strategy === "function") keyString = await strategy(inboxContext(), activity);
+	else switch (strategy) {
+		case "global":
+			keyString = activity.id.href;
+			break;
+		case "per-origin":
+			keyString = `${origin}\n${activity.id.href}`;
+			break;
+		case "per-inbox":
+			keyString = `${origin}\n${activity.id.href}\n${recipient == null ? "sharedInbox" : `inbox\n${recipient}`}`;
+			break;
+		default: keyString = `${origin}\n${activity.id.href}`;
+	}
+	return keyString == null ? null : [...prefix, keyString];
+}
+/**
+* Checks whether an incoming activity has already been processed, by its
+* idempotency key, or by the key that queue workers of older versions of
+* Fedify recorded.
+* @internal
+*/
+async function isInboxActivityProcessed(kv, cacheKey, activity, origin, prefix) {
+	if (cacheKey == null) return false;
+	if (await kv.get(cacheKey) === true) return true;
+	if (activity.id == null) return false;
+	return await kv.get([
+		...prefix,
+		origin,
+		activity.id.href
+	]) === true;
+}
+/**
+* The bytes added to the UTF-8 JSON length of a message for each of its JSON
+* values, to bound the size of serialization formats other than JSON, such
+* as the structured serialization of Deno KV, which spends more bytes than
+* JSON on type tags and lengths of small values, e.g., empty arrays, and up
+* to nine bytes on a fractional number that JSON writes in three.
+*/
+const PER_VALUE_SERIALIZATION_OVERHEAD = 8;
+/**
+* Estimates, conservatively, how large a queued message is once a queue
+* backend serializes it: the UTF-8 length of its JSON serialization, plus
+* a fixed overhead for each JSON value in it, plus the bytes that encoding
+* strings beyond Latin-1 as UTF-16 adds.
+* @internal
+*/
+function estimateQueuedMessageSize(message) {
+	const encoder = new TextEncoder();
+	let values = 0;
+	let stringExpansion = 0;
+	const countString = (value) => {
+		values++;
+		if (!/[\u0100-\uffff]/.test(value)) return;
+		const expansion = value.length * 2 - encoder.encode(value).byteLength;
+		if (expansion > 0) stringExpansion += expansion;
+	};
+	const count = (value) => {
+		if (typeof value === "string") {
+			countString(value);
+			return;
+		}
+		values++;
+		if (Array.isArray(value)) for (const item of value) count(item);
+		else if (value != null && typeof value === "object") for (const [key, item] of Object.entries(value)) {
+			if (item === void 0) continue;
+			countString(key);
+			count(item);
+		}
+	};
+	count(message);
+	return encoder.encode(JSON.stringify(message)).byteLength + stringExpansion + values * PER_VALUE_SERIALIZATION_OVERHEAD;
+}
+/**
+* Checks whether an activity that declares no actor is authenticated: at
+* least one principal must be authenticated for it, and its ID, if any, must
+* have the same [FEP-fe34] origin as one of those principals.
+*
+* [FEP-fe34]: https://w3id.org/fep/fe34
+* @returns `"ok"` if it is authenticated, or why it is not.
+* @internal
+*/
+function checkActorlessActivity(activity, authentication) {
+	const principals = getEffectivePrincipals(authentication);
+	if (principals.length < 1) return {
+		status: "noAuthenticatedPrincipal",
+		principals
+	};
+	if (activity.id == null) return {
+		status: "ok",
+		principals
+	};
+	const origin = getAuthenticationOrigin(activity.id);
+	if (origin == null || !principals.some((principal) => getAuthenticationOrigin(principal.id) === origin)) return {
+		status: "activityOriginMismatch",
+		principals
+	};
+	return {
+		status: "ok",
+		principals
+	};
+}
+/**
+* Same as {@link checkActorlessActivity}, but returns a boolean.
+* @internal
+*/
+function isActorlessActivityAuthenticated(activity, authentication) {
+	return checkActorlessActivity(activity, authentication).status === "ok";
+}
+async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, authentication, verifiedView, replayable, actorless, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	if (activity.actorId == null && !actorless) {
+		logger.error("Missing actor.", { activity: json });
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
+		return "missingActor";
+	}
+	const contextMetadata = { authentication };
+	const cacheKey = await getInboxIdempotencyKey(idempotencyStrategy, () => inboxContextFactory(recipient, json, activity.id?.href, getTypeId(activity).href, contextMetadata), activity, ctx.origin, recipient, kvPrefixes.activityIdempotence);
+	if (await isInboxActivityProcessed(kv, cacheKey, activity, ctx.origin, kvPrefixes.activityIdempotence)) {
+		logger.debug("Activity {activityId} has already been processed.", {
+			activityId: activity.id?.href,
+			activity: json,
+			recipient
+		});
+		span.setStatus({
+			code: SpanStatusCode.UNSET,
+			message: `Activity ${activity.id?.href} has already been processed.`
+		});
+		recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
+		return "alreadyProcessed";
+	}
+	if (activity.actorId != null) span.setAttribute("activitypub.actor.id", activity.actorId.href);
+	let message;
+	if (queue != null) {
+		const carrier = {};
+		propagation.inject(context.active(), carrier);
+		message = {
+			type: "inbox",
+			id: crypto.randomUUID(),
+			baseUrl: ctx.origin,
+			activity: originalJson ?? json,
+			...normalizedActivity == null ? {} : { normalizedActivity },
+			...ldSignatureVerified == null ? {} : { ldSignatureVerified },
+			...verifiedView == null ? {} : { verifiedView },
+			...authentication == null ? {} : { authentication: serializeAuthentication(authentication) },
+			identifier: recipient,
+			attempt: 0,
+			started: (/* @__PURE__ */ new Date()).toISOString(),
+			traceContext: carrier
+		};
+		const maxMessageSize = queue.maxMessageSize;
+		if (replayable === false) {
+			logger.warn("The incoming activity {activityId} uses a JSON-LD context that cannot be kept for the queue; processing it immediately instead.", {
+				activityId: activity.id?.href,
+				recipient
+			});
+			message = void 0;
+		} else if (maxMessageSize != null && estimateQueuedMessageSize(message) > maxMessageSize - QUEUED_MESSAGE_HEADROOM) {
+			logger.warn("The incoming activity {activityId} is too large to enqueue; processing it immediately instead.", {
+				activityId: activity.id?.href,
+				recipient,
+				maxMessageSize
+			});
+			message = void 0;
+		}
+	}
+	if (queue != null && message != null) {
+		try {
+			await queue.enqueue(message);
+		} catch (error) {
+			logger.error("Failed to enqueue the incoming activity {activityId}:\n{error}", {
+				error,
+				activityId: activity.id?.href,
+				activity: json,
+				recipient
+			});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: `Failed to enqueue the incoming activity ${activity.id?.href}.`
+			});
+			throw error;
+		}
+		getFederationMetrics(meterProvider).recordQueueTaskEnqueued({
+			role: "inbox",
+			queue,
+			activityType: getTypeId(activity).href
+		}, 0);
+		recordInboxActivity(meterProvider, "queued", getTypeId(activity).href);
+		logger.info("Activity {activityId} is enqueued.", {
+			activityId: activity.id?.href,
+			activity: json,
+			recipient
+		});
+		return "enqueued";
+	}
+	tracerProvider = tracerProvider ?? trace.getTracerProvider();
+	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.dispatch_inbox_listener", { kind: SpanKind.INTERNAL }, async (span) => {
+		const dispatched = inboxListeners?.dispatchWithClass(activity);
+		if (dispatched == null) {
+			logger.error("Unsupported activity type:\n{activity}", {
+				activity: json,
+				recipient
+			});
+			span.setStatus({
+				code: SpanStatusCode.UNSET,
+				message: `Unsupported activity type: ${getTypeId(activity).href}`
+			});
+			recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
+			span.end();
+			return "unsupportedActivity";
+		}
+		const { class: cls, listener } = dispatched;
+		span.updateName(`activitypub.dispatch_inbox_listener ${cls.name}`);
+		try {
+			const activityType = getTypeId(activity).href;
+			const started = performance.now();
+			try {
+				const contextFactory = listenerInboxContextFactory ?? inboxContextFactory;
+				await listener(contextFactory(recipient, contextFactory === inboxContextFactory ? json : originalJson ?? json, activity.id?.href, activityType, contextMetadata), activity);
+			} finally {
+				getFederationMetrics(meterProvider).recordInboxProcessingDuration(activityType, getDurationMs(started));
+			}
+		} catch (error) {
+			try {
+				await inboxErrorHandler?.(ctx, error);
+			} catch (error) {
+				logger.error("An unexpected error occurred in inbox error handler:\n{error}", {
+					error,
+					activityId: activity.id?.href,
+					activity: json,
+					recipient
+				});
+			}
+			logger.error("Failed to process the incoming activity {activityId}:\n{error}", {
+				error,
+				activityId: activity.id?.href,
+				activity: json,
+				recipient
+			});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
+			span.end();
+			return "error";
+		}
+		recordInboxActivity(meterProvider, "processed", getTypeId(activity).href);
+		if (cacheKey != null) await kv.set(cacheKey, true, { ttl: Temporal.Duration.from({ days: 1 }) });
+		logger.info("Activity {activityId} has been processed.", {
+			activityId: activity.id?.href,
+			activity: json,
+			recipient
+		});
+		span.end();
+		return "success";
+	});
+}
+//#endregion
+export { isActorlessActivityAuthenticated as a, getInboxIdempotencyKey as i, checkActorlessActivity as n, isInboxActivityProcessed as o, estimateQueuedMessageSize as r, routeActivity as s, actorsHaveSameOrigin as t };

package/dist/inbox-authentication-DflPYlLL.mjs

@@ -0,0 +1,171 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { i as getPortableDid, l as isPortableId, n as getCanonicalPortableId } from "./portable-key-id-Ca30-hOa.mjs";
+//#region src/federation/inbox-authentication.ts
+/**
+* The evidence of an activity that has not been authenticated by Fedify.
+*/
+const EMPTY_EVIDENCE = Object.freeze({
+	verified: false,
+	requestSigners: Object.freeze([]),
+	documentSigners: Object.freeze([]),
+	originAuthenticated: Object.freeze([]),
+	expandedActivity: Object.freeze([]),
+	baseUrl: null
+});
+/**
+* Gets the evidence of an activity that has not been authenticated.
+* @internal
+*/
+function getEmptyAuthenticationEvidence() {
+	return EMPTY_EVIDENCE;
+}
+/**
+* Gets the principals that an authorization decision should rely on.
+* @param evidence The evidence.
+* @param scope See {@link IsActorAuthenticatedOptions.scope}.
+* @returns The principals.
+* @internal
+*/
+function getEffectivePrincipals(evidence, scope = "effective") {
+	if (scope === "document" || evidence.documentSigners.length > 0) return evidence.documentSigners;
+	if (evidence.requestSigners.length > 0) return evidence.requestSigners;
+	return evidence.originAuthenticated;
+}
+/**
+* Normalizes an actor ID for comparison: portable IDs and compatible
+* identifiers to their canonical portable ID, other IDs to their `href`.
+* @returns The normalized ID, or `null` for a malformed portable ID.
+*/
+function normalizeActorId(id) {
+	return isPortableId(id) ? getCanonicalPortableId(id) : id.href;
+}
+/**
+* Checks whether the given principal authenticates the given actor.
+* @param principal The principal.
+* @param actorId The actor ID.
+* @returns `true` if the principal authenticates the actor.
+* @internal
+*/
+function principalAuthenticates(principal, actorId) {
+	if (principal.kind === "portableAuthority") {
+		if (!isPortableId(actorId)) return false;
+		const did = getPortableDid(actorId);
+		return did != null && did === getPortableDid(principal.id);
+	}
+	const expected = normalizeActorId(actorId);
+	return expected != null && normalizeActorId(principal.id) === expected;
+}
+/**
+* Checks whether the given evidence authenticates the given actor.
+*
+* Actor IDs are compared exactly, except that [FEP-ef61] portable IDs and
+* compatible identifiers are compared by their canonical portable IDs, and
+* a portable authority (a DID) authenticates the portable actors of that DID.
+*
+* @example
+* ``` typescript
+* federation
+*   .setInboxListeners("/users/{identifier}/inbox", "/inbox")
+*   .on(Follow, async (ctx, follow) => {
+*     if (follow.actorId == null) return;
+*     // The actor is always authenticated for activities that declare one,
+*     // but the same check works for any actor an activity names:
+*     isActorAuthenticated(ctx.authentication, follow.actorId);
+*   });
+* ```
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @param evidence The authentication evidence, usually
+*                 {@link InboxContext.authentication}.
+* @param actorId The actor ID to check.
+* @param options Options.
+* @returns `true` if the actor is authenticated.
+* @since 2.5.0
+*/
+function isActorAuthenticated(evidence, actorId, options = {}) {
+	return getEffectivePrincipals(evidence, options.scope).some((principal) => principalAuthenticates(principal, actorId));
+}
+function serializePrincipal(principal) {
+	return {
+		kind: principal.kind,
+		id: principal.id.href,
+		mechanism: principal.mechanism,
+		keyId: principal.keyId?.href ?? null
+	};
+}
+/**
+* Serializes the principals of the given evidence for a queued message.
+* @internal
+*/
+function serializeAuthentication(evidence) {
+	return {
+		verified: evidence.verified,
+		requestSigners: evidence.requestSigners.map(serializePrincipal),
+		documentSigners: evidence.documentSigners.map(serializePrincipal),
+		originAuthenticated: evidence.originAuthenticated.map(serializePrincipal)
+	};
+}
+const KINDS = /* @__PURE__ */ new Set(["actor", "portableAuthority"]);
+const MECHANISMS = /* @__PURE__ */ new Set([
+	"httpSignatures",
+	"linkedDataSignatures",
+	"objectIntegrityProofs",
+	"origin"
+]);
+function deserializePrincipals(value) {
+	if (!Array.isArray(value)) return null;
+	const principals = [];
+	for (const item of value) {
+		if (item == null || typeof item !== "object" || !KINDS.has(item.kind) || !MECHANISMS.has(item.mechanism) || typeof item.id !== "string" || !URL.canParse(item.id) || item.keyId != null && (typeof item.keyId !== "string" || !URL.canParse(item.keyId))) return null;
+		principals.push(Object.freeze({
+			kind: item.kind,
+			id: new URL(item.id),
+			mechanism: item.mechanism,
+			keyId: item.keyId == null ? null : new URL(item.keyId)
+		}));
+	}
+	return principals;
+}
+/**
+* Restores the evidence of a queued message.
+* @param value The serialized principals.
+* @param expandedActivity The expanded activity, restored from the queued
+*                         verified view.
+* @param baseUrl The base URL, restored from the queued verified view.
+* @returns The evidence, or `null` if the serialized value is malformed.
+* @internal
+*/
+function deserializeAuthentication(value, expandedActivity, baseUrl) {
+	if (value == null || typeof value !== "object" || typeof value.verified !== "boolean") return null;
+	const record = value;
+	const requestSigners = deserializePrincipals(record.requestSigners);
+	const documentSigners = deserializePrincipals(record.documentSigners);
+	const originAuthenticated = deserializePrincipals(record.originAuthenticated);
+	if (requestSigners == null || documentSigners == null || originAuthenticated == null) return null;
+	return createAuthenticationEvidence({
+		verified: record.verified,
+		requestSigners,
+		documentSigners,
+		originAuthenticated,
+		expandedActivity,
+		baseUrl
+	});
+}
+/**
+* Creates frozen evidence.
+* @internal
+*/
+function createAuthenticationEvidence(evidence) {
+	return Object.freeze({
+		verified: evidence.verified,
+		requestSigners: Object.freeze([...evidence.requestSigners]),
+		documentSigners: Object.freeze([...evidence.documentSigners]),
+		originAuthenticated: Object.freeze([...evidence.originAuthenticated]),
+		expandedActivity: evidence.expandedActivity,
+		baseUrl: evidence.baseUrl
+	});
+}
+//#endregion
+export { isActorAuthenticated as a, getEmptyAuthenticationEvidence as i, deserializeAuthentication as n, serializeAuthentication as o, getEffectivePrincipals as r, createAuthenticationEvidence as t };