@fedify/fedify 2.5.0-dev.2446 → 2.5.0-dev.2492

package/dist/inbox-view-D-skypg-.mjs

@@ -0,0 +1,385 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { c as getNormalizationContextLoader, p as markEffectiveContextLoader, s as detachSignature, y as wrapContextLoaderForJsonLd } from "./ld-CdvcOEXQ.mjs";
+import { preloadedContexts } from "@fedify/vocab-runtime";
+import { encodeHex } from "byte-encodings/hex";
+import jsonld from "@fedify/vocab-runtime/jsonld";
+import serialize from "json-canon";
+//#region src/federation/inbox-view.ts
+/**
+* The interpretation of an incoming activity that Fedify authenticated, kept
+* so that listeners, authorization helpers, and queue workers observe the
+* same JSON-LD meaning that signature verification observed.
+*
+* Every JSON-LD processing step of one delivery goes through a request-scoped
+* *context snapshot*, which memoizes the remote context responses so that
+* a nondeterministic or mutable remote context cannot give verification and
+* dispatch different meanings.  The snapshot is serialized into queued
+* messages, so that workers and retries replay the very same responses
+* without loading contexts again.
+* @module
+*/
+/**
+* Thrown when replaying an interpretation needs a context response that its
+* snapshot does not have, or has with a different content.
+* @internal
+*/
+var ContextSnapshotMissError = class extends Error {
+	url;
+	constructor(url, reason) {
+		super(`Context ${url} cannot be replayed: ${reason}.`);
+		this.name = "ContextSnapshotMissError";
+		this.url = url;
+	}
+};
+function normalizeUrl(url) {
+	return URL.canParse(url) ? new URL(url).href : url;
+}
+/**
+* Creates the context snapshot of a delivery.
+* @param base The caller's context loader.
+* @returns The snapshot.
+* @internal
+*/
+function createContextSnapshot(base) {
+	const underlying = {
+		standard: wrapContextLoaderForJsonLd(base),
+		normalization: getNormalizationContextLoader(base)
+	};
+	const cache = /* @__PURE__ */ new Map();
+	const recorded = /* @__PURE__ */ new Map();
+	const loaders = /* @__PURE__ */ new Map();
+	let released = false;
+	return {
+		loader(policy) {
+			let loader = loaders.get(policy);
+			if (loader != null) return loader;
+			const effective = underlying[policy];
+			loader = markEffectiveContextLoader(async (url, options) => {
+				if (released) return await effective(url, options);
+				const normalizedUrl = normalizeUrl(url);
+				const key = `${policy}\n${normalizedUrl}`;
+				let promise = cache.get(key);
+				if (promise == null) {
+					promise = Promise.resolve(effective(url, options)).then((response) => {
+						const cloned = normalizeResponse(structuredClone(response));
+						recorded.set(key, {
+							policy,
+							url: normalizedUrl,
+							response: structuredClone(cloned)
+						});
+						return cloned;
+					});
+					promise.catch(() => {});
+					cache.set(key, promise);
+				}
+				return structuredClone(await promise);
+			}, policy);
+			loaders.set(policy, loader);
+			return loader;
+		},
+		entries() {
+			return [...recorded.values()];
+		},
+		release() {
+			released = true;
+		}
+	};
+}
+function getBundledResponse(url) {
+	if (!(url in preloadedContexts)) return null;
+	return {
+		contextUrl: null,
+		document: preloadedContexts[url],
+		documentUrl: url
+	};
+}
+async function sha256(value) {
+	return encodeHex(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(serialize(value))));
+}
+function normalizeResponse(response) {
+	return {
+		contextUrl: response.contextUrl ?? null,
+		document: response.document,
+		documentUrl: response.documentUrl
+	};
+}
+/**
+* Serializes the entries of a context snapshot for a queued message.
+* @param entries The entries.
+* @returns The serialized entries, which are plain JSON values.
+* @internal
+*/
+async function serializeContextSnapshot(entries) {
+	const result = [];
+	for (const entry of entries) {
+		const response = normalizeResponse(entry.response);
+		const hash = await sha256(response);
+		const bundled = getBundledResponse(entry.url);
+		if (bundled != null && await sha256(bundled) === hash) result.push({
+			policy: entry.policy,
+			url: entry.url,
+			sha256: hash,
+			bundled: true
+		});
+		else result.push({
+			policy: entry.policy,
+			url: entry.url,
+			sha256: hash,
+			response: structuredClone(response)
+		});
+	}
+	return result;
+}
+function isRemoteDocument(value) {
+	if (value == null || typeof value !== "object") return false;
+	const record = value;
+	return typeof record.documentUrl === "string" && "document" in record && (record.contextUrl == null || typeof record.contextUrl === "string");
+}
+/**
+* Restores the entries of a serialized context snapshot, verifying the
+* hashes of stored responses.  Bundled entries are reconstructed from the
+* contexts this version of Fedify bundles.
+* @param entries The serialized entries.
+* @returns The entries.
+* @throws {ContextSnapshotMissError} If an entry is malformed, or its
+*                                    content does not match its hash.
+* @internal
+*/
+async function deserializeContextSnapshot(entries) {
+	if (!Array.isArray(entries)) throw new ContextSnapshotMissError("(snapshot)", "malformed snapshot");
+	const result = [];
+	for (const entry of entries) {
+		if (entry == null || typeof entry !== "object" || entry.policy !== "standard" && entry.policy !== "normalization" || typeof entry.url !== "string" || typeof entry.sha256 !== "string") throw new ContextSnapshotMissError("(snapshot)", "malformed entry");
+		let response;
+		if (entry.bundled === true) {
+			response = getBundledResponse(entry.url);
+			if (response == null) throw new ContextSnapshotMissError(entry.url, "not bundled");
+		} else if (isRemoteDocument(entry.response)) response = normalizeResponse(entry.response);
+		else throw new ContextSnapshotMissError(entry.url, "malformed entry");
+		if (entry.bundled !== true && await sha256(response) !== entry.sha256) throw new ContextSnapshotMissError(entry.url, "content mismatch");
+		result.push({
+			policy: entry.policy,
+			url: entry.url,
+			response: structuredClone(response)
+		});
+	}
+	return result;
+}
+/**
+* Creates a context loader of a policy that serves only the responses of
+* a snapshot.  It is marked as the effective loader of the policy.
+* @param entries The snapshot's entries.
+* @param policy The policy.
+* @returns The loader, which throws {@link ContextSnapshotMissError} for
+*          anything else.
+* @internal
+*/
+function createSnapshotOnlyLoader(entries, policy) {
+	const responses = /* @__PURE__ */ new Map();
+	for (const entry of entries) if (entry.policy === policy) responses.set(entry.url, entry.response);
+	return markEffectiveContextLoader(async (url) => {
+		const response = responses.get(normalizeUrl(url));
+		if (response == null) throw new ContextSnapshotMissError(url, "not in the snapshot");
+		return structuredClone(response);
+	}, policy);
+}
+/**
+* Creates a {@link ReleasableLoader}.
+* @param strict The loader to use until release.
+* @param fallback The loader to use after release.
+* @param policy The policy both loaders apply.
+* @returns The releasable loader.
+* @internal
+*/
+function createReleasableLoader(strict, fallback, policy) {
+	let released = false;
+	return {
+		loader: markEffectiveContextLoader((url, options) => released ? fallback(url, options) : strict(url, options), policy),
+		release() {
+			released = true;
+		}
+	};
+}
+/**
+* Expands a JSON-LD document with the given context loader.
+* @param document The document.
+* @param contextLoader The context loader.
+* @returns The expanded document.
+* @internal
+*/
+async function expandDocument(document, contextLoader) {
+	return await jsonld.expand(document, { documentLoader: contextLoader });
+}
+/**
+* Computes the digest of an expanded document.
+* @param expanded The expanded document.
+* @returns The hex-encoded SHA-256 of its canonical JSON.
+* @internal
+*/
+function digestExpandedDocument(expanded) {
+	return sha256(expanded);
+}
+/**
+* Deeply freezes a JSON value.
+* @param value The value.
+* @returns The same value, frozen.
+* @internal
+*/
+function deepFreeze(value) {
+	if (value != null && typeof value === "object" && !Object.isFrozen(value)) {
+		Object.freeze(value);
+		for (const child of Object.values(value)) deepFreeze(child);
+	}
+	return value;
+}
+const ACTOR_IRI = "https://www.w3.org/ns/activitystreams#actor";
+/**
+* Gets the single root node of an expanded document.
+* @param expanded The expanded document.
+* @returns The root node, or `null` if there is not exactly one.
+* @internal
+*/
+function getRootNode(expanded) {
+	if (expanded.length !== 1) return null;
+	const node = expanded[0];
+	if (node == null || typeof node !== "object" || Array.isArray(node)) return null;
+	return node;
+}
+/**
+* Gets the values of a property of an expanded node, unwrapping a single
+* `@list` container the way generated vocabulary decoders do.
+* @param node The expanded node.
+* @param iri The property IRI.
+* @returns The values, or an empty array if the property is absent.
+* @internal
+*/
+function getPropertyValues(node, iri) {
+	const values = node[iri];
+	if (values == null) return [];
+	if (!Array.isArray(values)) return [values];
+	if (values.length === 1 && values[0] != null && typeof values[0] === "object" && "@list" in values[0]) {
+		const list = values[0]["@list"];
+		return Array.isArray(list) ? list : [list];
+	}
+	return values;
+}
+/**
+* Tells whether the root node of an expanded activity declares any `actor`
+* value at all, including blank nodes, anonymous or untyped nodes, and
+* literals, which ID accessors and typed parsing may drop.
+* @param expanded The expanded activity.
+* @returns `"absent"` if the root node declares no actor; `"present"`
+*          otherwise, including when there is no single root node.
+* @internal
+*/
+function getActorPresence(expanded) {
+	const root = getRootNode(expanded);
+	if (root == null) return "present";
+	return getPropertyValues(root, ACTOR_IRI).length < 1 ? "absent" : "present";
+}
+/**
+* Builds the serialized view of an authenticated activity.  The document is
+* expanded through the snapshot, so that the snapshot holds every context
+* response the interpretation needs.
+* @param snapshot The delivery's context snapshot.
+* @param source Which document the activity was parsed from.
+* @returns The serialized view and the expanded activity.
+* @internal
+*/
+async function buildVerifiedActivityView(snapshot, source) {
+	const loader = snapshot.loader(source.policy);
+	const used = /* @__PURE__ */ new Set();
+	const expanded = await expandDocument(source.document, markEffectiveContextLoader((url, options) => {
+		used.add(normalizeUrl(url));
+		return loader(url, options);
+	}, source.policy));
+	const entries = snapshot.entries().filter((entry) => entry.policy === source.policy && used.has(entry.url));
+	const contexts = await serializeContextSnapshot(entries);
+	const references = /* @__PURE__ */ new Set();
+	collectContextReferences(source.document, source.baseUrl?.href, references);
+	for (const entry of entries) {
+		const { contextUrl, document } = entry.response;
+		collectContextReferences(document, entry.url, references);
+		if (contextUrl != null) collectContextReferences({ "@context": contextUrl }, entry.url, references);
+	}
+	return {
+		replayable: [...references].every((url) => used.has(url)),
+		view: {
+			version: 1,
+			policy: source.policy,
+			source: source.source,
+			baseUrl: source.baseUrl?.href ?? null,
+			contexts,
+			expandedDigest: await digestExpandedDocument(expanded)
+		},
+		expanded
+	};
+}
+/**
+* Collects the remote context references of a JSON-LD document or context
+* document: every IRI given as a value of `@context` at any depth, including
+* scoped contexts of term definitions, and of `@import`.
+* @param value The document.
+* @param base The URL to resolve relative references against.
+* @param references The set to add the normalized references to.
+*/
+function collectContextReferences(value, base, references) {
+	const add = (reference) => {
+		let url = reference;
+		if (base != null && URL.canParse(reference, base)) url = new URL(reference, base).href;
+		references.add(normalizeUrl(url));
+	};
+	const collectContext = (context) => {
+		if (typeof context === "string") add(context);
+		else if (Array.isArray(context)) for (const item of context) collectContext(item);
+		else if (context != null && typeof context === "object") {
+			const imported = context["@import"];
+			if (typeof imported === "string") add(imported);
+			walk(context);
+		}
+	};
+	const walk = (node) => {
+		if (Array.isArray(node)) for (const item of node) walk(item);
+		else if (node != null && typeof node === "object") for (const [key, item] of Object.entries(node)) if (key === "@context") collectContext(item);
+		else walk(item);
+	};
+	walk(value);
+}
+/**
+* Validates the shape of a serialized view taken from a queued message.
+* @param value The value of the message's `verifiedView` field.
+* @returns The view, or `null` if it is malformed or of an unsupported
+*          version.
+* @internal
+*/
+function parseSerializedVerifiedActivityView(value) {
+	if (value == null || typeof value !== "object") return null;
+	const view = value;
+	if (view.version !== 1 || view.policy !== "standard" && view.policy !== "normalization" || view.source !== "activity" && view.source !== "normalizedActivity" || view.baseUrl !== null && (typeof view.baseUrl !== "string" || !URL.canParse(view.baseUrl)) || !Array.isArray(view.contexts) || typeof view.expandedDigest !== "string") return null;
+	return view;
+}
+/**
+* Restores a view from a queued message without loading any context.
+* @param view The serialized view.
+* @param message The fields of the message the view refers to.
+* @returns The restored view.
+* @throws {ContextSnapshotMissError} If the view cannot be replayed exactly.
+* @internal
+*/
+async function restoreVerifiedActivityView(view, message) {
+	const loader = createSnapshotOnlyLoader(await deserializeContextSnapshot(view.contexts), view.policy);
+	if (view.source === "normalizedActivity" && message.normalizedActivity == null) throw new ContextSnapshotMissError("(normalizedActivity)", "the normalized activity is missing");
+	const document = detachSignature(view.source === "activity" ? message.activity : message.normalizedActivity);
+	const expanded = await expandDocument(document, loader);
+	if (await digestExpandedDocument(expanded) !== view.expandedDigest) throw new ContextSnapshotMissError("(activity)", "the interpretation does not match the authenticated one");
+	return {
+		document,
+		loader,
+		expanded,
+		baseUrl: view.baseUrl == null ? null : new URL(view.baseUrl)
+	};
+}
+//#endregion
+export { createSnapshotOnlyLoader as a, expandDocument as c, parseSerializedVerifiedActivityView as d, restoreVerifiedActivityView as f, createReleasableLoader as i, getActorPresence as l, buildVerifiedActivityView as n, deepFreeze as o, serializeContextSnapshot as p, createContextSnapshot as r, deserializeContextSnapshot as s, ContextSnapshotMissError as t, getPropertyValues as u };

package/dist/{key-nYGY4QB9.d.cts → key-DbLNT-vA.d.ts}

@@ -1,8 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { Actor, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
-import { DocumentLoader, PortableObjectVerifier } from "@fedify/vocab-runtime";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
-
+import { DocumentLoader, PortableObjectVerifier } from "@fedify/vocab-runtime";
 //#region src/sig/proof.d.ts
 /**
 * Checks if the given JSON-LD document has a DataIntegrityProof-like object,

package/dist/{key-DhsBxxZN.d.ts → key-DlHT4R6k.d.cts}

@@ -1,8 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { Actor, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
-import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader, PortableObjectVerifier } from "@fedify/vocab-runtime";
-
+import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 //#region src/sig/proof.d.ts
 /**
 * Checks if the given JSON-LD document has a DataIntegrityProof-like object,

package/dist/{kv-cache-D_m3A241.mjs → kv-cache-Cmsyke4d.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-D3LHk6Z4.mjs";
+import { p as recordDocumentCache } from "./metrics-CpxvUrBz.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-7015lbrx.js → kv-cache-DQcte7ES.js}

@@ -1,9 +1,10 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { ct as recordDocumentCache, q as validateCryptoKey, t as doubleKnock } from "./http-DlNxxW_5.js";
+import { X as validateCryptoKey, dt as recordDocumentCache, t as doubleKnockScoped } from "./http-ChXUU_3c.js";
 import { getLogger } from "@logtape/logtape";
-import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, resolveDocumentLoaderTimeout, validatePublicUrl, withDocumentLoaderTimeout } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, resolveDocumentLoaderTimeout, withDocumentLoaderTimeout } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";
+import { openDirectFetch, openPublicFetch } from "@fedify/vocab-runtime/internal";
 //#region src/utils/docloader.ts
 const logger$1 = getLogger([
 	"fedify",
@@ -27,13 +28,35 @@ const DEFAULT_MAX_REDIRECTION = 20;
 * @throws {RangeError} If the `timeout` option is invalid.
 * @since 0.4.0
 */
-function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, timeout, tracerProvider } = {}) {
+function getAuthenticatedDocumentLoader(identity, options = {}) {
+	return createAuthenticatedDocumentLoader(identity, options);
+}
+/**
+* The placeholder that the alternate document callback of
+* `getRemoteDocument()` returns, so that the alternate document is loaded
+* after the current hop is closed.
+*/
+const ALTERNATE_PLACEHOLDER = Object.freeze({
+	contextUrl: null,
+	document: null,
+	documentUrl: "about:blank"
+});
+/**
+* The implementation of {@link getAuthenticatedDocumentLoader}.  This is not
+* exported from any entry point.
+* @param identity The identity to get the document loader for.
+* @param options The options for the document loader.
+* @param deps The dependencies, for tests.
+* @returns The authenticated document loader.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+function createAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, timeout, tracerProvider } = {}, deps = {}) {
 	validateCryptoKey(identity.privateKey);
 	const resolvedTimeout = resolveDocumentLoaderTimeout(timeout);
 	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 		options?.signal?.throwIfAborted();
 		let currentUrl = new URL(url).href;
-		await validateUrl(currentUrl, options);
+		validateUrl(currentUrl);
 		visited.add(currentUrl);
 		const originalRequest = createActivityPubRequest(currentUrl, { userAgent });
 		function follow(nextUrl) {
@@ -42,46 +65,68 @@ function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedi
 			if (visited.has(nextUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${nextUrl}`);
 			redirected++;
 		}
-		const response = await doubleKnock(originalRequest, identity, {
+		const result = await doubleKnockScoped(originalRequest, identity, {
 			maxRedirection,
 			specDeterminer,
 			log: curry(logRequest)(logger$1),
 			tracerProvider,
 			signal: options?.signal,
-			validateRedirect: async (nextUrl) => {
+			validateRedirect: (nextUrl) => {
 				follow(nextUrl);
-				await validateUrl(nextUrl, options);
+				validateUrl(nextUrl);
 				visited.add(nextUrl);
 				currentUrl = nextUrl;
 			}
+		}, (hopUrl) => openHop(hopUrl, options), async (response) => {
+			options?.signal?.throwIfAborted();
+			let alternateUrl;
+			const document = await getRemoteDocument(currentUrl, response, (url) => {
+				alternateUrl = url;
+				return Promise.resolve(ALTERNATE_PLACEHOLDER);
+			}, options);
+			if (alternateUrl == null) return { document };
+			if (!response.bodyUsed && response.body?.locked !== true) response.body?.cancel().catch((error) => {
+				logger$1.debug("Failed to cancel the response body from {url}: {error}", {
+					url: currentUrl,
+					error
+				});
+			});
+			return { alternateUrl };
 		});
 		options?.signal?.throwIfAborted();
-		return getRemoteDocument(currentUrl, response, (alternateUrl) => {
-			follow(alternateUrl);
-			return load(alternateUrl, options, redirected, visited);
-		}, options);
+		if ("document" in result) return result.document;
+		follow(result.alternateUrl);
+		return load(result.alternateUrl, options, redirected, visited);
+	}
+	function openUnvalidatedHop(url, signal) {
+		if (deps.openHop != null) return deps.openHop(url);
+		return allowPrivateAddress ? openDirectFetch(url) : openPublicFetch(url, { signal });
+	}
+	async function openHop(url, options) {
+		try {
+			const session = await openUnvalidatedHop(url, options?.signal);
+			if (options?.signal?.aborted) {
+				await session.close();
+				options.signal.throwIfAborted();
+			}
+			return session;
+		} catch (error) {
+			if (error instanceof UrlError) if (error.reason === "dns") logger$1.debug("DNS lookup failed for {url}", {
+				url,
+				error
+			});
+			else logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
 	}
-	async function validateUrl(url, options) {
+	function validateUrl(url) {
 		const parsedUrl = new URL(url);
 		const protocol = parsedUrl.protocol;
 		if (protocol !== "http:" && protocol !== "https:") throw new UrlError(`Unsupported protocol: ${protocol}`);
 		if (parsedUrl.username !== "" || parsedUrl.password !== "") throw new UrlError("URLs with credentials are not allowed");
-		if (!allowPrivateAddress) {
-			try {
-				await validatePublicUrl(url);
-			} catch (error) {
-				if (error instanceof UrlError) if (error.reason === "dns") logger$1.debug("DNS lookup failed for {url}", {
-					url,
-					error
-				});
-				else logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
-					url,
-					error
-				});
-				throw error;
-			}
-			options?.signal?.throwIfAborted();
-		}
 	}
 	return withDocumentLoaderTimeout((url, options) => load(url, options), resolvedTimeout);
 }