@fedify/fedify 2.5.0-dev.2448 → 2.5.0-dev.2494

package/dist/federation/middleware.test.mjs

@@ -16,14 +16,14 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assertStrictEquals } from "../assert_strict_equals-CYvBmkpC.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { g as recordInboxActivity } from "../metrics-B-QxRSSR.mjs";
-import { _ as verifyJsonLd, a as compactJsonLd, m as signJsonLd, s as detachSignature } from "../ld-CQFuiah9.mjs";
-import { l as verifyObject, s as signObject } from "../proof-DPoF06nz.mjs";
-import { f as verifyRequest, l as signRequest } from "../http-BZkyQIkb.mjs";
+import { g as recordInboxActivity } from "../metrics-B7TvoAP7.mjs";
+import { _ as verifyJsonLd, a as compactJsonLd, m as signJsonLd, s as detachSignature } from "../ld-DUeBHFWH.mjs";
+import { l as verifyObject, s as signObject } from "../proof-DQh2z9fx.mjs";
+import { p as verifyRequest, u as signRequest } from "../http-CxKd10Lq.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-CpsDyqVN.mjs";
-import { T as handleBenchmarkTrigger, i as KvSpecDeterminer, n as FederationImpl, o as createFederation, r as InboxContextImpl, t as ContextImpl } from "../middleware-CuVa0UuS.mjs";
-import { t as doesActorOwnKey } from "../owner-ccKkQOAf.mjs";
+import { n as getAuthenticatedDocumentLoader } from "../docloader-DbBbDaY-.mjs";
+import { T as handleBenchmarkTrigger, i as KvSpecDeterminer, n as FederationImpl, o as createFederation, r as InboxContextImpl, t as ContextImpl } from "../middleware-BEaUojg7.mjs";
+import { t as doesActorOwnKey } from "../owner-CwijV0c5.mjs";
 import { t as CircuitBreaker } from "../circuit-breaker-XJ53md4S.mjs";
 import { t as TaskCodec } from "../codec-C6rTrpIp.mjs";
 import { t as markCircuitBreakerLegacySweepDone } from "../circuit-breaker-test-utils-DW6YC_Pe.mjs";
@@ -34,11 +34,11 @@ import { Create, CryptographicKey, Note, Offer, Person, getTypeId, lookupObject
 import { SpanStatusCode, metrics } from "@opentelemetry/api";
 import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
-import dns from "node:dns/promises";
 import { deepStrictEqual, ok, rejects, strictEqual, throws } from "node:assert/strict";
 import serialize from "json-canon";
 import { DataPointType, MeterProvider as MeterProvider$1, MetricReader } from "@opentelemetry/sdk-metrics";
 import { AsyncLocalStorage } from "node:async_hooks";
+import dns from "node:dns/promises";
 //#region ../fixture/src/fixtures/example.com/create.json
 var create_default = {
 	"@context": "https://www.w3.org/ns/activitystreams",
@@ -102,7 +102,7 @@ var person2_default = {
 };
 //#endregion
 //#region src/federation/middleware.test.ts
-const documentLoader = getDocumentLoader();
+const documentLoader = getDocumentLoader({ allowPrivateAddress: true });
 let logtapeLock = Promise.resolve();
 async function withLogtapeLock(fn) {
 	const run = logtapeLock.then(fn, fn);
@@ -657,7 +657,8 @@ test({
 			const federation = createFederation({
 				kv,
 				documentLoaderFactory: () => rejectingLoader,
-				contextLoaderFactory: () => mockDocumentLoader
+				contextLoaderFactory: () => mockDocumentLoader,
+				authenticatedDocumentLoaderFactory: (identity) => getAuthenticatedDocumentLoader(identity, { allowPrivateAddress: true })
 			});
 			let ctx = federation.createContext(new URL("https://example.com:1234/"), 123);
 			assertEquals(ctx.data, 123);
@@ -768,7 +769,7 @@ test({
 				documentUrl: "https://example.com/auth-check",
 				document: true
 			});
-			assertEquals(await ctx.lookupObject("https://example.com/object"), null);
+			assertEquals(await withDnsLookup(() => Promise.reject(/* @__PURE__ */ new Error("Resolver unavailable")), () => ctx.lookupObject("https://example.com/object")), null);
 			await assertRejects(() => ctx.sendActivity({ identifier: "handle" }, [], new vocab.Create({})), TypeError, "The activity to send must have at least one actor property.");
 			await ctx.sendActivity({ identifier: "handle" }, [], new vocab.Create({ actor: new URL("https://example.com/users/handle") }));
 			esm_default.get("https://example.com/object", () => new Response(JSON.stringify({
@@ -1017,7 +1018,7 @@ test({
 			assertStrictEquals(clone.contextLoader, ctx.contextLoader);
 			assertStrictEquals(clone.federation, ctx.federation);
 		});
-		esm_default.get("https://example.com/.well-known/nodeinfo", (cl) => {
+		esm_default.get("path:/.well-known/nodeinfo", (cl) => {
 			const headers = cl.options.headers ?? {};
 			assertEquals(new Headers(headers).get("User-Agent"), "CustomUserAgent/1.2.3");
 			return new Response(JSON.stringify({ links: [{
@@ -1025,7 +1026,7 @@ test({
 				href: "https://example.com/nodeinfo/2.1"
 			}] }));
 		});
-		esm_default.get("https://example.com/nodeinfo/2.1", (cl) => {
+		esm_default.get("path:/nodeinfo/2.1", (cl) => {
 			const headers = cl.options.headers ?? {};
 			assertEquals(new Headers(headers).get("User-Agent"), "CustomUserAgent/1.2.3");
 			return new Response(JSON.stringify({
@@ -1046,7 +1047,11 @@ test({
 				kv,
 				userAgent: "CustomUserAgent/1.2.3"
 			}).createContext(new URL("https://example.com/"), 123);
-			assertEquals(await ctx.lookupNodeInfo("https://example.com/"), {
+			const lookupExample = () => Promise.resolve([{
+				address: "93.184.215.14",
+				family: 4
+			}]);
+			assertEquals(await withDnsLookup(lookupExample, () => ctx.lookupNodeInfo("https://example.com/")), {
 				software: {
 					name: "foo",
 					version: "1.2.3"
@@ -1058,7 +1063,7 @@ test({
 					localComments: 456
 				}
 			});
-			assertEquals(await ctx.lookupNodeInfo("https://example.com/", { parse: "none" }), {
+			assertEquals(await withDnsLookup(lookupExample, () => ctx.lookupNodeInfo("https://example.com/", { parse: "none" })), {
 				software: {
 					name: "foo",
 					version: "1.2.3"
@@ -1258,6 +1263,408 @@ test({
 		esm_default.hardReset();
 	}
 });
+test("Federation.fetch() accepts unencoded path colons", async () => {
+	const identifier = "https://pod.example/alice";
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		contextLoaderFactory: () => mockDocumentLoader
+	});
+	const dispatched = [];
+	federation.setActorDispatcher("/users/{identifier}", (ctx, id) => {
+		dispatched.push(id);
+		assertEquals(ctx.url.pathname, "/users/https:%2F%2Fpod.example%2Falice");
+		assertEquals(ctx.url.search, "?page=1");
+		assertEquals(ctx.request.url, ctx.url.href);
+		return new vocab.Person({ id: ctx.getActorUri(id) });
+	});
+	const request = new Request("https://local.example/users/https:%2F%2Fpod.example%2Falice?page=1", { headers: { Accept: "application/activity+json" } });
+	const response = await federation.fetch(request, { contextData: void 0 });
+	assertEquals(response.status, 200);
+	assertEquals(dispatched, [identifier]);
+	const canonical = "https://local.example/users/https%3A%2F%2Fpod.example%2Falice";
+	const body = await response.json();
+	assert(body != null && typeof body === "object" && "id" in body);
+	assertEquals(body.id, canonical);
+	const ctx = federation.createContext(request, void 0);
+	assertEquals(ctx.getActorUri(identifier).href, canonical);
+	assertEquals(ctx.parseUri(new URL(canonical)), {
+		type: "actor",
+		identifier
+	});
+	assertEquals(ctx.parseUri(new URL(request.url)), null);
+	assertEquals(ctx.parseUri(new URL(canonical.replace("local.example", "other.example"))), null);
+});
+test("Federation.fetch() verifies signatures over unencoded path colons", async (t) => {
+	const identifier = "https://pod.example/alice";
+	const canonical = "https://local.example/users/https%3A%2F%2Fpod.example%2Falice/inbox";
+	const encoded = "https://local.example/users/https%3A%2F%2Fpod.example%2Falice/inbox?delivery=1";
+	const normalized = encoded.replace("%3A", ":");
+	for (const spec of ["draft-cavage-http-signatures-12", "rfc9421"]) for (const target of [
+		"encoded",
+		"normalized",
+		"changed after signing"
+	]) await t.step(`${spec}: ${target}`, async () => {
+		const recipients = [];
+		const federation = createFederation({
+			kv: new MemoryKvStore(),
+			documentLoaderFactory: () => mockDocumentLoader,
+			contextLoaderFactory: () => mockDocumentLoader
+		});
+		federation.setActorDispatcher("/users/{identifier}", (ctx, id) => new vocab.Person({ id: ctx.getActorUri(id) })).setKeyPairsDispatcher(() => []);
+		federation.setInboxListeners("/users/{identifier}/inbox").on(vocab.Create, (ctx) => {
+			recipients.push(ctx.recipient);
+		});
+		const signed = await signRequest(new Request(target === "normalized" ? normalized : encoded, {
+			method: "POST",
+			headers: { "Content-Type": "application/activity+json" },
+			body: JSON.stringify(create_default)
+		}), rsaPrivateKey2, rsaPublicKey2.id, { spec });
+		const request = target === "changed after signing" ? new Request(normalized, signed) : signed;
+		const response = await federation.fetch(request, { contextData: void 0 });
+		assertEquals(request.url, target === "encoded" ? encoded : normalized);
+		const valid = target !== "changed after signing";
+		assertEquals(response.status, valid ? 202 : 401);
+		assertEquals(recipients, valid ? [identifier] : []);
+		assertEquals(federation.createContext(new URL(canonical), void 0).getInboxUri(identifier).href, canonical);
+	});
+});
+test("RequestContext signature checks", async (t) => {
+	const [tracerProvider, exporter] = createTestTracerProvider();
+	const keyId = rsaPublicKey3.id.href;
+	const ownerId = rsaPublicKey3.ownerId.href;
+	const request = await signRequest(new Request("https://example.com/"), rsaPrivateKey3, rsaPublicKey3.id);
+	function setup(options = {}) {
+		const loads = {
+			key: 0,
+			owner: 0
+		};
+		const loader = async (url, loaderOptions) => {
+			if (url === keyId) loads.key++;
+			else if (url === ownerId) loads.owner++;
+			await options.gate;
+			return await (options.load ?? mockDocumentLoader)(url, loaderOptions);
+		};
+		const federation = createFederation({
+			kv: new MemoryKvStore(),
+			documentLoaderFactory: () => loader,
+			contextLoaderFactory: () => mockDocumentLoader,
+			tracerProvider: options.tracerProvider ?? tracerProvider
+		});
+		return {
+			ctx: federation.createContext(options.request ?? new Request(request), void 0),
+			loads,
+			loader,
+			federation
+		};
+	}
+	try {
+		for (const mode of [
+			"keys",
+			"owners",
+			"warm owners",
+			"mixed"
+		]) await t.step(`coalesces ${mode}`, async () => {
+			exporter.clear();
+			let release;
+			const { ctx, loads, loader } = setup({ gate: new Promise((resolve) => release = resolve) });
+			if (mode === "warm owners") {
+				release();
+				assert(await ctx.getSignedKey());
+			}
+			const results = Promise.all(Array.from({ length: 8 }, (_, i) => {
+				const options = i % 2 === 0 ? {} : {
+					documentLoader: loader,
+					contextLoader: ctx.contextLoader,
+					tracerProvider
+				};
+				return mode === "keys" || mode === "mixed" && i % 2 === 0 ? ctx.getSignedKey(options) : ctx.getSignedKeyOwner(options);
+			}));
+			release();
+			for (const result of await results) assert(result != null);
+			assertEquals(loads, {
+				key: 1,
+				owner: mode === "keys" ? 0 : 1
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 1);
+			assert(await ctx.getSignedKey());
+			if (mode !== "keys") assert(await ctx.getSignedKeyOwner());
+			assertEquals(loads, {
+				key: 1,
+				owner: mode === "keys" ? 0 : 1
+			});
+		});
+		await t.step("memoizes null keys", async () => {
+			exporter.clear();
+			const { ctx, loads } = setup({ load: () => Promise.reject(/* @__PURE__ */ new Error("unavailable")) });
+			for (let i = 0; i < 3; i++) {
+				assertEquals(await ctx.getSignedKey(), null);
+				assertEquals(await ctx.getSignedKeyOwner(), null);
+			}
+			assertEquals(loads, {
+				key: 1,
+				owner: 0
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 1);
+			assert(await ctx.getSignedKey({ documentLoader: mockDocumentLoader }));
+			assert(await ctx.getSignedKeyOwner({ documentLoader: mockDocumentLoader }));
+		});
+		await t.step("coalesces key-owner FetchError results", async () => {
+			const { ctx, loads } = setup({ load: async (url, options) => {
+				if (url === ownerId) throw new FetchError(new URL(url), "HTTP 401: Unauthorized");
+				return await mockDocumentLoader(url, options);
+			} });
+			assert(await ctx.getSignedKey());
+			assertEquals(await Promise.all(Array.from({ length: 8 }, () => ctx.getSignedKeyOwner())), Array(8).fill(null));
+			assertEquals(await ctx.getSignedKeyOwner(), null);
+			assertEquals(loads, {
+				key: 1,
+				owner: 1
+			});
+			assert(await ctx.getSignedKeyOwner({ documentLoader: mockDocumentLoader }));
+		});
+		await t.step("memoizes unsigned requests", async () => {
+			exporter.clear();
+			const { ctx, loads } = setup({ request: new Request("https://example.com/") });
+			for (let i = 0; i < 3; i++) {
+				assertEquals(await ctx.getSignedKey(), null);
+				assertEquals(await ctx.getSignedKeyOwner(), null);
+			}
+			assertEquals(loads, {
+				key: 0,
+				owner: 0
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 1);
+		});
+		await t.step("memoizes null owners without trusting a key's owner claim", async () => {
+			const { ctx, loads } = setup({ load: async (url, options) => url === ownerId ? {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					...person2_default,
+					publicKey: []
+				}
+			} : await mockDocumentLoader(url, options) });
+			assert(await ctx.getSignedKey());
+			assertEquals(await Promise.all(Array.from({ length: 8 }, () => ctx.getSignedKeyOwner())), Array(8).fill(null));
+			for (let i = 0; i < 3; i++) assertEquals(await ctx.getSignedKeyOwner(), null);
+			assertEquals(loads, {
+				key: 1,
+				owner: 1
+			});
+			assert(await ctx.getSignedKeyOwner({ documentLoader: mockDocumentLoader }));
+			assert(await ctx.getSignedKeyOwner());
+		});
+		await t.step("isolates concurrent document loaders before success", async () => {
+			const { ctx, loads } = setup();
+			let otherLoads = 0;
+			const otherLoader = async (url, options) => {
+				otherLoads++;
+				if (url === ownerId) return {
+					documentUrl: url,
+					contextUrl: null,
+					document: {
+						...person2_default,
+						name: "Other view"
+					}
+				};
+				return await mockDocumentLoader(url, options);
+			};
+			const [first, second] = await Promise.all([ctx.getSignedKeyOwner(), ctx.getSignedKeyOwner({ documentLoader: otherLoader })]);
+			assertEquals(first?.name, "Jane Doe");
+			assertEquals(second?.name, "Other view");
+			const cached = await ctx.getSignedKeyOwner();
+			assert(cached === first || cached === second);
+			assertStrictEquals(await ctx.getSignedKeyOwner({ documentLoader: otherLoader }), cached);
+			assertEquals(loads, {
+				key: 1,
+				owner: 1
+			});
+			assertEquals(otherLoads, 2);
+		});
+		await t.step("preserves in-flight null while another loader succeeds", async () => {
+			exporter.clear();
+			let release;
+			const gate = new Promise((resolve) => release = resolve);
+			const { ctx, loads } = setup({ load: async () => {
+				await gate;
+				throw new TypeError("fetch failed");
+			} });
+			const failed = Promise.all([ctx.getSignedKey(), ctx.getSignedKeyOwner()]);
+			const owner = await ctx.getSignedKeyOwner({ documentLoader: mockDocumentLoader });
+			assert(owner);
+			release();
+			assertEquals(await failed, [null, null]);
+			assertStrictEquals(await ctx.getSignedKeyOwner(), owner);
+			assert(await ctx.getSignedKey());
+			assertEquals(loads, {
+				key: 1,
+				owner: 0
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 2);
+		});
+		await t.step("isolates context loaders", async () => {
+			exporter.clear();
+			const { ctx, loads } = setup();
+			const otherContextLoader = (url, options) => mockDocumentLoader(url, options);
+			await Promise.all([ctx.getSignedKeyOwner(), ctx.getSignedKeyOwner({ contextLoader: otherContextLoader })]);
+			assertEquals(loads, {
+				key: 2,
+				owner: 2
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 2);
+		});
+		await t.step("shares work across tracer providers", async () => {
+			exporter.clear();
+			const [otherProvider, otherExporter] = createTestTracerProvider();
+			try {
+				const { ctx, loads } = setup();
+				await Promise.all([
+					ctx.getSignedKeyOwner(),
+					ctx.getSignedKeyOwner({ tracerProvider: otherProvider }),
+					ctx.getSignedKey(),
+					ctx.getSignedKey({ tracerProvider: otherProvider })
+				]);
+				assert(await ctx.getSignedKeyOwner({ tracerProvider: otherProvider }));
+				assertEquals(loads, {
+					key: 1,
+					owner: 1
+				});
+				assertEquals(exporter.getSpans("http_signatures.verify").length, 1);
+				assertEquals(otherExporter.getSpans("http_signatures.verify").length, 0);
+			} finally {
+				await otherProvider.shutdown();
+			}
+		});
+		await t.step("reuses success with a fresh authorization loader", async () => {
+			exporter.clear();
+			const { ctx, loads } = setup();
+			let freshLoads = 0;
+			const freshLoader = (url, options) => {
+				freshLoads++;
+				return mockDocumentLoader(url, options);
+			};
+			const key = await ctx.getSignedKey({ documentLoader: freshLoader });
+			assert(key);
+			assertStrictEquals(await ctx.getSignedKey(), key);
+			const owner = await ctx.getSignedKeyOwner();
+			assert(owner);
+			assertStrictEquals(await ctx.getSignedKeyOwner({ documentLoader: freshLoader }), owner);
+			assertEquals(loads, {
+				key: 0,
+				owner: 1
+			});
+			assertEquals(freshLoads, 1);
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 1);
+		});
+		await t.step("retains a transient owner lookup failure as null", async () => {
+			let fail = true;
+			const { ctx, loads } = setup({ load: async (url, options) => {
+				if (url === ownerId && fail) throw new TypeError("fetch failed");
+				return await mockDocumentLoader(url, options);
+			} });
+			assert(await ctx.getSignedKey());
+			assertEquals(await ctx.getSignedKeyOwner(), null);
+			fail = false;
+			assertEquals(await ctx.getSignedKeyOwner(), null);
+			assertEquals(loads, {
+				key: 1,
+				owner: 1
+			});
+			assert(await ctx.getSignedKeyOwner({ documentLoader: mockDocumentLoader }));
+		});
+		await t.step("rechecks an owner after another loader verifies the key", async () => {
+			let fail = true;
+			const { ctx, loads } = setup({ load: async (url, options) => {
+				if (url === keyId && fail) throw new TypeError("fetch failed");
+				return await mockDocumentLoader(url, options);
+			} });
+			assertEquals(await ctx.getSignedKeyOwner(), null);
+			fail = false;
+			assertEquals(await ctx.getSignedKeyOwner(), null);
+			assertEquals(loads, {
+				key: 1,
+				owner: 0
+			});
+			assert(await ctx.getSignedKey({ documentLoader: mockDocumentLoader }));
+			assertEquals((await ctx.getSignedKeyOwner())?.id?.href, ownerId);
+			assertEquals(loads, {
+				key: 1,
+				owner: 1
+			});
+		});
+		await t.step("retries unexpected key rejections from a rejection handler", async () => {
+			exporter.clear();
+			const failure = /* @__PURE__ */ new Error("transient context loader failure");
+			let rejectContext = true;
+			const contextLoader = async (url, options) => {
+				if (rejectContext) throw failure;
+				return await mockDocumentLoader(url, options);
+			};
+			const { ctx, loads } = setup();
+			const options = { contextLoader };
+			const failedKeys = Promise.allSettled([
+				ctx.getSignedKey(options),
+				ctx.getSignedKeyOwner(options),
+				ctx.getSignedKey(options)
+			]);
+			const recovery = ctx.getSignedKey(options).catch(() => {
+				rejectContext = false;
+				return ctx.getSignedKey(options);
+			});
+			for (const result of await failedKeys) assertEquals(result.status, "rejected");
+			assert(await recovery);
+			assertEquals(loads, {
+				key: 2,
+				owner: 0
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 2);
+		});
+		await t.step("retries owner rejections while retaining the verified key", async () => {
+			exporter.clear();
+			let rejectContext = false;
+			const contextLoader = async (url, options) => {
+				if (rejectContext) throw new Error("transient owner context failure");
+				return await mockDocumentLoader(url, options);
+			};
+			const { ctx, loads } = setup();
+			const options = { contextLoader };
+			assert(await ctx.getSignedKey(options));
+			assertEquals(loads, {
+				key: 1,
+				owner: 0
+			});
+			rejectContext = true;
+			const failures = await Promise.allSettled([ctx.getSignedKeyOwner(options), ctx.getSignedKeyOwner(options)]);
+			for (const result of failures) assertEquals(result.status, "rejected");
+			assertEquals(loads, {
+				key: 1,
+				owner: 1
+			});
+			rejectContext = false;
+			assert(await ctx.getSignedKeyOwner(options));
+			assertEquals(loads, {
+				key: 1,
+				owner: 2
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 1);
+		});
+		await t.step("keeps clones and separate requests independent", async () => {
+			exporter.clear();
+			const { ctx, loads, federation } = setup();
+			assert(await ctx.getSignedKeyOwner());
+			const clone = ctx.clone(void 0);
+			const separate = federation.createContext(new Request(request), void 0);
+			await Promise.all([clone.getSignedKeyOwner(), separate.getSignedKeyOwner()]);
+			assertEquals(loads, {
+				key: 1,
+				owner: 3
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 3);
+		});
+	} finally {
+		await tracerProvider.shutdown();
+	}
+});
 test("Federation.fetch() [rfc9421] multiple POST signatures", async (t) => {
 	for (const [name, validSecond, maxHttpSignatures] of [
 		[
@@ -1360,7 +1767,7 @@ test("Federation.fetch()", async (t) => {
 			kv,
 			documentLoaderFactory: () => mockDocumentLoader,
 			authenticatedDocumentLoaderFactory(identity) {
-				const docLoader = getAuthenticatedDocumentLoader(identity);
+				const docLoader = getAuthenticatedDocumentLoader(identity, { allowPrivateAddress: true });
 				return (url) => {
 					if (new URL(url).host === "example.com") return docLoader(url);
 					return mockDocumentLoader(url);
@@ -1811,7 +2218,7 @@ test("Federation.setInboxListeners()", async (t) => {
 			kv,
 			documentLoaderFactory: () => mockDocumentLoader,
 			authenticatedDocumentLoaderFactory(identity) {
-				const docLoader = getAuthenticatedDocumentLoader(identity);
+				const docLoader = getAuthenticatedDocumentLoader(identity, { allowPrivateAddress: true });
 				return (url) => {
 					const urlObj = new URL(url);
 					authenticatedRequests.push([url, identity.keyId.href]);
@@ -2134,7 +2541,7 @@ test("Federation.setInboxListeners()", async (t) => {
 			kv,
 			documentLoaderFactory: () => mockDocumentLoader,
 			authenticatedDocumentLoaderFactory(identity) {
-				const docLoader = getAuthenticatedDocumentLoader(identity);
+				const docLoader = getAuthenticatedDocumentLoader(identity, { allowPrivateAddress: true });
 				return (url) => {
 					if (new URL(url).host === "example.com") return docLoader(url);
 					return mockDocumentLoader(url);
@@ -2347,10 +2754,11 @@ test("Federation.setOutboxListeners()", async (t) => {
 						sinks: ["buffer"]
 					}]
 				});
-				const federation = createFederation({
+				const federation = new FederationImpl({
 					kv,
 					documentLoaderFactory: () => mockDocumentLoader
 				});
+				federation.allowPrivateAddress = true;
 				federation.setActorDispatcher("/users/{identifier}", (_ctx, identifier) => identifier === "john" ? new vocab.Person({}) : null).setKeyPairsDispatcher(() => [{
 					privateKey: rsaPrivateKey2,
 					publicKey: rsaPublicKey2.publicKey
@@ -2453,10 +2861,11 @@ test("Federation.setOutboxListeners()", async (t) => {
 						sinks: ["buffer"]
 					}]
 				});
-				const federation = createFederation({
+				const federation = new FederationImpl({
 					kv,
 					documentLoaderFactory: () => mockDocumentLoader
 				});
+				federation.allowPrivateAddress = true;
 				federation.setActorDispatcher("/{identifier}", (_ctx, identifier) => identifier === "person2" ? new vocab.Person({}) : null).setKeyPairsDispatcher(() => [{
 					privateKey: rsaPrivateKey2,
 					publicKey: rsaPublicKey2.publicKey
@@ -3136,7 +3545,7 @@ test("FederationImpl.sendActivity()", async (t) => {
 	});
 	const federation = new FederationImpl({
 		kv: new MemoryKvStore(),
-		contextLoaderFactory: () => mockDocumentLoader
+		allowPrivateAddress: true
 	});
 	const context = federation.createContext(new URL("https://example.com/"));
 	await t.step("success", async () => {
@@ -6863,7 +7272,7 @@ test("ContextImpl.sendActivity()", async (t) => {
 	const kv = new MemoryKvStore();
 	const federation = new FederationImpl({
 		kv,
-		contextLoaderFactory: () => mockDocumentLoader
+		allowPrivateAddress: true
 	});
 	federation.setActorDispatcher("/{identifier}", async (ctx, identifier) => {
 		if (identifier !== "1") return null;
@@ -6986,11 +7395,13 @@ test("ContextImpl.sendActivity()", async (t) => {
 	});
 	await t.step("records recipient span attributes correctly", async () => {
 		const [tracerProvider, exporter] = createTestTracerProvider();
-		const ctx = new FederationImpl({
+		const federation3 = new FederationImpl({
 			kv,
 			contextLoaderFactory: () => mockDocumentLoader,
 			tracerProvider
-		}).createContext(new URL("https://example.com/"), void 0);
+		});
+		federation3.allowPrivateAddress = true;
+		const ctx = federation3.createContext(new URL("https://example.com/"), void 0);
 		const activity = new vocab.Create({
 			id: new URL("https://example.com/activity/telemetry"),
 			actor: new URL("https://example.com/person"),
@@ -7024,7 +7435,7 @@ test("ContextImpl.sendActivity()", async (t) => {
 	};
 	const federation2 = new FederationImpl({
 		kv,
-		contextLoaderFactory: () => mockDocumentLoader,
+		allowPrivateAddress: true,
 		queue
 	});
 	federation2.setActorDispatcher("/{identifier}", async (ctx, identifier) => {
@@ -7195,7 +7606,7 @@ test("ContextImpl.sendActivity()", async (t) => {
 		const asyncEnqueued = [];
 		const fed = new FederationImpl({
 			kv,
-			contextLoaderFactory: () => mockDocumentLoader,
+			allowPrivateAddress: true,
 			queue: {
 				enqueue(message) {
 					return new Promise((resolve) => {
@@ -7422,10 +7833,10 @@ test({
 		const signedInvite = await signObject(new vocab.Invite({ actor: new URL("https://example.com/person2") }), ed25519PrivateKey, ed25519Multikey.id);
 		assert(await ctx.routeActivity("id", signedInvite));
 		assertEquals(activities, [[null, signedOffer], ["id", signedInvite]]);
-		assertFalse(await ctx.routeActivity(null, new vocab.Create({
+		assertFalse(await withDnsLookup(() => Promise.reject(/* @__PURE__ */ new Error("Resolver unavailable")), () => ctx.routeActivity(null, new vocab.Create({
 			id: new URL("https://example.com/not-found"),
 			actor: new URL("https://example.com/person")
-		})));
+		}))));
 		assertEquals(activities, [[null, signedOffer], ["id", signedInvite]]);
 		assertFalse(await ctx.routeActivity(null, new vocab.Create({
 			id: new URL("https://example.com/person"),
@@ -7932,7 +8343,7 @@ test("InboxContextImpl.forwardActivity()", async (t) => {
 	const kv = new MemoryKvStore();
 	const federation = new FederationImpl({
 		kv,
-		contextLoaderFactory: () => mockDocumentLoader
+		allowPrivateAddress: true
 	});
 	await t.step("skip", async () => {
 		await new InboxContextImpl(null, {
@@ -8055,6 +8466,7 @@ test("InboxContextImpl.forwardActivity()", async (t) => {
 			contextLoaderFactory: () => mockDocumentLoader,
 			tracerProvider
 		});
+		federationWithTracing.allowPrivateAddress = true;
 		await new InboxContextImpl(null, await signJsonLd({
 			"@context": "https://www.w3.org/ns/activitystreams",
 			"type": "Create",
@@ -8178,12 +8590,14 @@ test("createFederation() applies httpMessageSignaturesSpecTtl to remembered spec
 			return new Response(null, { status: key == null ? 401 : 202 });
 		});
 		const kv = new TtlRecordingKvStore();
-		const ctx = createFederation({
+		const federation = new FederationImpl({
 			kv,
 			documentLoaderFactory: () => mockDocumentLoader,
 			contextLoaderFactory: () => mockDocumentLoader,
 			httpMessageSignaturesSpecTtl: { days: 14 }
-		}).createContext(new URL("https://example.com/"), void 0);
+		});
+		federation.allowPrivateAddress = true;
+		const ctx = federation.createContext(new URL("https://example.com/"), void 0);
 		const specKey = [
 			"_fedify",
 			"httpMessageSignaturesSpec",
@@ -8230,12 +8644,17 @@ test("createFederation() applies publicKeyTtl to cached public keys", async () =
 		});
 		const keyId = "https://example.com/person2#key3";
 		const kv = new TtlRecordingKvStore();
-		const federation = createFederation({
+		const federation = new FederationImpl({
 			kv,
 			documentLoaderFactory: () => mockDocumentLoader,
 			contextLoaderFactory: () => mockDocumentLoader,
+			authenticatedDocumentLoaderFactory: (identity, options) => getAuthenticatedDocumentLoader(identity, {
+				...options,
+				allowPrivateAddress: true
+			}),
 			publicKeyTtl: { days: 7 }
 		});
+		federation.allowPrivateAddress = true;
 		const inbox = [];
 		federation.setActorDispatcher("/users/{identifier}", (_, identifier) => identifier === "john" ? new vocab.Person({}) : null).setKeyPairsDispatcher(() => [{
 			privateKey: rsaPrivateKey2,
@@ -8441,7 +8860,9 @@ test("ContextImpl.lookupWebFinger()", async (t) => {
 				links: []
 			};
 			esm_default.get("https://example.com/.well-known/webfinger?resource=acct%3Aalice%40example.com", { body: expected });
-			deepStrictEqual(await createFederation(mockOptions()).createContext(new URL("https://example.com/"), void 0).lookupWebFinger("acct:alice@example.com", { withDiagnostics: true }), expected);
+			const federation = new FederationImpl(mockOptions());
+			federation.allowPrivateAddress = true;
+			deepStrictEqual(await federation.createContext(new URL("https://example.com/"), void 0).lookupWebFinger("acct:alice@example.com", { withDiagnostics: true }), expected);
 		} finally {
 			esm_default.hardReset();
 		}
@@ -8872,5 +9293,19 @@ test("createFederation() validates documentLoaderTimeout", () => {
 		documentLoaderTimeout: Temporal.Duration.from({ seconds: 30 })
 	});
 });
+/**
+* Runs the given function while `node:dns/promises`' `lookup()`, which the
+* default public fetch resolves hostnames with, is replaced, so that no test
+* depends on the real DNS.
+*/
+async function withDnsLookup(lookup, fn) {
+	const originalLookup = dns.lookup;
+	dns.lookup = lookup;
+	try {
+		return await fn();
+	} finally {
+		dns.lookup = originalLookup;
+	}
+}
 //#endregion
 export {};