@fedify/relay 2.4.0-dev.2169 → 2.4.0-dev.2193

package/dist/litepub.test.js

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as exportSpki, r as getDocumentLoader, t as isRelayFollowerData } from "./types-CUSXp8T2.js";
+import { n as exportSpki, r as getDocumentLoader, t as isRelayFollowerData } from "./types-D0DsNGmr.js";
 import { MemoryKvStore, signRequest } from "@fedify/fedify";
 import { createRelay } from "@fedify/relay";
 import { deepStrictEqual, ok, strictEqual } from "node:assert";

package/dist/mastodon.test.js

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as exportSpki, r as getDocumentLoader, t as isRelayFollowerData } from "./types-CUSXp8T2.js";
+import { n as exportSpki, r as getDocumentLoader, t as isRelayFollowerData } from "./types-D0DsNGmr.js";
 import { MemoryKvStore, signJsonLd, signRequest } from "@fedify/fedify";
 import { createRelay } from "@fedify/relay";
 import { deepStrictEqual, ok, strictEqual } from "node:assert";

package/dist/mod.d.cts

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { Context, KvStore, MessageQueue } from "@fedify/fedify";
 import { Actor } from "@fedify/vocab";
-//#region ../vocab-runtime/dist/docloader-ClQraSWr.d.ts
+//#region ../vocab-runtime/dist/docloader-C63enuyr.d.ts
 /**
 * Options for making `User-Agent` string.
 * @see {@link getUserAgent}
@@ -100,6 +100,28 @@ interface DocumentLoaderFactoryOptions {
   * @since 2.2.0
   */
   maxRedirection?: number;
+  /**
+  * The timeout in milliseconds for each call of the created document
+  * loader.  The timeout is shared by all the steps of a call, including
+  * URL validation, every HTTP redirect and alternate document link it
+  * follows, retries, and reading the response body; it does not restart
+  * for each of them.  It does not interrupt synchronous work such as
+  * parsing a document that has already been received.
+  *
+  * When a call times out, the loader throws a {@link FetchError} without
+  * a {@link FetchError.response}, whose `cause` is a `DOMException` named
+  * `"TimeoutError"`.  An `AbortSignal` passed through
+  * {@link DocumentLoaderOptions.signal} still cancels a call; in that case
+  * the loader throws the signal's reason as before.
+  *
+  * Fractional values are rounded up.  Set it to `null` to turn off the
+  * timeout.
+  * @default `10000` (10 seconds)
+  * @throws {RangeError} If the value is not a positive finite number or is
+  *                      greater than 2,147,483,647 (about 24.8 days).
+  * @since 2.4.0
+  */
+  timeout?: number | null;
 }
 /**
 * A factory function that creates an authenticated {@link DocumentLoader} for

package/dist/mod.d.ts

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { Context, KvStore, MessageQueue } from "@fedify/fedify";
 import { Actor } from "@fedify/vocab";
-//#region ../vocab-runtime/dist/docloader-ClQraSWr.d.ts
+//#region ../vocab-runtime/dist/docloader-C63enuyr.d.ts
 /**
 * Options for making `User-Agent` string.
 * @see {@link getUserAgent}
@@ -100,6 +100,28 @@ interface DocumentLoaderFactoryOptions {
   * @since 2.2.0
   */
   maxRedirection?: number;
+  /**
+  * The timeout in milliseconds for each call of the created document
+  * loader.  The timeout is shared by all the steps of a call, including
+  * URL validation, every HTTP redirect and alternate document link it
+  * follows, retries, and reading the response body; it does not restart
+  * for each of them.  It does not interrupt synchronous work such as
+  * parsing a document that has already been received.
+  *
+  * When a call times out, the loader throws a {@link FetchError} without
+  * a {@link FetchError.response}, whose `cause` is a `DOMException` named
+  * `"TimeoutError"`.  An `AbortSignal` passed through
+  * {@link DocumentLoaderOptions.signal} still cancels a call; in that case
+  * the loader throws the signal's reason as before.
+  *
+  * Fractional values are rounded up.  Set it to `null` to turn off the
+  * timeout.
+  * @default `10000` (10 seconds)
+  * @throws {RangeError} If the value is not a positive finite number or is
+  *                      greater than 2,147,483,647 (about 24.8 days).
+  * @since 2.4.0
+  */
+  timeout?: number | null;
 }
 /**
 * A factory function that creates an authenticated {@link DocumentLoader} for

package/dist/{types-CUSXp8T2.js → types-D0DsNGmr.js}

@@ -4536,7 +4536,7 @@ const preloadedContexts = {
 	} }
 };
 //#endregion
-//#region ../vocab-runtime/dist/url-BHZYe8Vu.js
+//#region ../vocab-runtime/dist/url-Be3moMor.js
 var UrlError = class extends Error {
 	/**
 	* The failure category. Defaults to `"disallowed"`.
@@ -26114,7 +26114,7 @@ var require_src = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 require_build();
 var import_src = /* @__PURE__ */ __toESM(require_src(), 1);
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.2169+0a45df07";
+var version = "2.4.0-dev.2193+402149b5";
 /**
 * Error thrown when fetching a JSON-LD document failed.
 */
@@ -26261,6 +26261,59 @@ async function readBoundedText(message, maxBytes, url) {
 		reader?.releaseLock();
 	}
 }
+/**
+* Reads raw bytes while limiting bytes received from the body stream.
+* Unlike {@link readBoundedText}, the bytes are returned as they were
+* received, without decoding.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The body bytes.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedBytes(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		getLogger([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return /* @__PURE__ */ new Uint8Array(0);
+		const chunks = [];
+		let size = 0;
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			chunks.push(value);
+		}
+		const bytes = new Uint8Array(size);
+		let offset = 0;
+		for (const chunk of chunks) {
+			bytes.set(chunk, offset);
+			offset += chunk.byteLength;
+		}
+		return bytes;
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 const parametersNeedLowerCase = ["rel", "type"];
 const regexpLinkWhitespace = /[\n\r\s\t]/;
 function validateURI(uri) {
@@ -26447,6 +26500,9 @@ const logger = getLogger([
 ]);
 const DEFAULT_MAX_REDIRECTION = 20;
 const MAX_HTML_SIZE = 1024 * 1024;
+const MAX_ERROR_BODY_SIZE = 1024 * 1024;
+const DEFAULT_TIMEOUT = 1e4;
+const MAX_TIMEOUT = 2147483647;
 function createResponseMetadata(response) {
 	return new Response(null, {
 		headers: response.headers,
@@ -26454,6 +26510,55 @@ function createResponseMetadata(response) {
 		statusText: response.statusText
 	});
 }
+const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([
+	204,
+	205,
+	304
+]);
+/**
+* Reads the body of an error response while the document loader is still
+* running, so that its timeout and `AbortSignal` also bound the read, and
+* nothing reading {@link FetchError.response} later waits on the network.
+* The body is kept byte for byte, unless it is too large or cannot be read;
+* then only the status and headers are kept.  A response whose status
+* the `Response` constructor does not accept (e.g., 999) is kept as a clone
+* whose body has been read in full; if its body is too large or cannot be
+* read, no response is kept at all.
+*/
+async function bufferErrorResponse(response, url, signal) {
+	if (response.status < 200 || response.status > 599) {
+		const clone = response.clone();
+		try {
+			await readBoundedBytes(response, MAX_ERROR_BODY_SIZE, url);
+		} catch (error) {
+			await clone.body?.cancel().catch(() => {});
+			if (signal?.aborted) throw error;
+			logger.debug("Failed to read the error response body from {url}: {error}", {
+				url,
+				error
+			});
+			return;
+		}
+		return clone;
+	}
+	if (response.body == null || NULL_BODY_STATUSES.has(response.status)) return createResponseMetadata(response);
+	let body;
+	try {
+		body = await readBoundedBytes(response, MAX_ERROR_BODY_SIZE, url);
+	} catch (error) {
+		if (signal?.aborted) throw error;
+		logger.debug("Failed to read the error response body from {url}: {error}", {
+			url,
+			error
+		});
+		return createResponseMetadata(response);
+	}
+	return new Response(body, {
+		headers: response.headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+}
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -26478,7 +26583,7 @@ async function getRemoteDocument(url, response, fetch, options) {
 			url: documentUrl,
 			headers: Object.fromEntries(response.headers.entries())
 		});
-		throw new FetchError(documentUrl, `HTTP ${response.status}: ${documentUrl}`, response.clone());
+		throw new FetchError(documentUrl, `HTTP ${response.status}: ${documentUrl}`, await bufferErrorResponse(response, documentUrl, options?.signal));
 	}
 	const contentType = response.headers.get("Content-Type");
 	const jsonLd = contentType == null || contentType === "application/activity+json" || contentType.startsWith("application/activity+json;") || contentType === "application/ld+json" || contentType.startsWith("application/ld+json;");
@@ -26565,9 +26670,87 @@ async function getRemoteDocument(url, response, fetch, options) {
 	};
 }
 /**
+* Resolves {@link DocumentLoaderFactoryOptions.timeout} into milliseconds.
+* @param timeout The timeout option.  `undefined` means the default timeout,
+*                and `null` means no timeout.
+* @returns The timeout in milliseconds, or `null` if it is turned off.
+* @throws {RangeError} If the timeout is invalid.
+* @internal
+*/
+function resolveDocumentLoaderTimeout(timeout) {
+	if (timeout === void 0) return DEFAULT_TIMEOUT;
+	if (timeout === null) return null;
+	if (typeof timeout !== "number" || !Number.isFinite(timeout) || timeout <= 0) throw new RangeError(`The document loader timeout must be a positive finite number of milliseconds, but got ${String(timeout)}.`);
+	const ms = Math.ceil(timeout);
+	if (ms > MAX_TIMEOUT) throw new RangeError(`The document loader timeout must not be greater than ${MAX_TIMEOUT} milliseconds, but got ${timeout}.`);
+	return ms;
+}
+/**
+* Bounds each call of the given document loader by the given timeout.
+* The timeout is combined with the caller's `signal`, and the combined
+* signal is passed to the loader.  The call settles no later than the
+* timeout even if the loader is stuck in a step that cannot be aborted,
+* e.g., a DNS lookup.
+*
+* A timed-out call throws a {@link FetchError} without a response, whose
+* `cause` is a `DOMException` named `"TimeoutError"`.  If the caller's
+* signal is aborted, its reason is thrown instead.
+* @param loader The document loader to bound.
+* @param timeout The timeout in milliseconds, or `null` for no timeout.
+*                It is assumed to have been resolved by
+*                {@link resolveDocumentLoaderTimeout}.
+* @returns The bounded document loader.
+* @internal
+*/
+function withDocumentLoaderTimeout(loader, timeout) {
+	if (timeout == null) return loader;
+	return async (url, options) => {
+		const callerSignal = options?.signal;
+		callerSignal?.throwIfAborted();
+		const controller = new AbortController();
+		const timeoutReason = new DOMException(`The document loader timed out after ${timeout} ms.`, "TimeoutError");
+		let timedOut = false;
+		const timer = setTimeout(() => {
+			timedOut = true;
+			controller.abort(timeoutReason);
+		}, timeout);
+		const onCallerAbort = () => controller.abort(callerSignal?.reason);
+		callerSignal?.addEventListener("abort", onCallerAbort, { once: true });
+		let onAbort;
+		const aborted = new Promise((_, reject) => {
+			onAbort = () => reject(controller.signal.reason);
+			controller.signal.addEventListener("abort", onAbort, { once: true });
+		});
+		const loading = loader(url, {
+			...options,
+			signal: controller.signal
+		});
+		loading.catch(() => {});
+		try {
+			return await Promise.race([loading, aborted]);
+		} catch (error) {
+			if (callerSignal?.aborted) throw callerSignal.reason;
+			if (!timedOut) throw error;
+			logger[options?.suppressError ? "warn" : "error"]("Timed out after {timeout} ms while fetching document: {url}", {
+				timeout,
+				url
+			});
+			const fetchError = new FetchError(url, `Timed out after ${timeout} ms`);
+			fetchError.cause = timeoutReason;
+			throw fetchError;
+		} finally {
+			clearTimeout(timer);
+			callerSignal?.removeEventListener("abort", onCallerAbort);
+			if (onAbort != null) controller.signal.removeEventListener("abort", onAbort);
+		}
+	};
+}
+/**
 * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
 * At most 20 HTTP redirects and alternate document links are followed in total
 * per call.  Revisiting a URL within that chain throws a {@link FetchError}.
+* Each call times out after 10 seconds by default; see
+* {@link DocumentLoaderFactoryOptions.timeout}.
 *
 * The created loader preloads the below frequently used contexts by default
 * (unless `options.skipPreloadedContexts` is set to `true`):
@@ -26587,7 +26770,8 @@ async function getRemoteDocument(url, response, fetch, options) {
 * @returns The document loader.
 * @since 1.3.0
 */
-function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedContexts, userAgent } = {}) {
+function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedContexts, timeout, userAgent } = {}) {
+	const resolvedTimeout = resolveDocumentLoaderTimeout(timeout);
 	const tracer = trace.getTracerProvider().getTracer(name, version);
 	const maximumRedirection = maxRedirection ?? DEFAULT_MAX_REDIRECTION;
 	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
@@ -26601,18 +26785,21 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 				documentUrl: currentUrl
 			};
 		}
-		if (!allowPrivateAddress) try {
-			await validatePublicUrl(currentUrl);
-		} catch (error) {
-			if (error instanceof UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
-				url: currentUrl,
-				error
-			});
-			else logger[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
-				url: currentUrl,
-				error
-			});
-			throw error;
+		if (!allowPrivateAddress) {
+			try {
+				await validatePublicUrl(currentUrl);
+			} catch (error) {
+				if (error instanceof UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+					url: currentUrl,
+					error
+				});
+				else logger[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
+					url: currentUrl,
+					error
+				});
+				throw error;
+			}
+			options?.signal?.throwIfAborted();
 		}
 		visited.add(currentUrl);
 		return await tracer.startActiveSpan("activitypub.fetch_document", {
@@ -26667,7 +26854,7 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 			}
 		});
 	}
-	return (url, options) => load(url, options);
+	return withDocumentLoaderTimeout((url, options) => load(url, options), resolvedTimeout);
 }
 function validateCryptoKey(key, type) {
 	if (type != null && key.type !== type) throw new TypeError(`The key is not a ${type} key.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/relay",
-  "version": "2.4.0-dev.2169+0a45df07",
+  "version": "2.4.0-dev.2193+402149b5",
   "description": "ActivityPub relay support for Fedify",
   "keywords": [
     "Fedify",
@@ -47,14 +47,14 @@
   "dependencies": {
     "@logtape/logtape": "^2.2.0",
     "temporal-polyfill": "^1.0.1",
-    "@fedify/vocab": "2.4.0-dev.2169+0a45df07",
-    "@fedify/fedify": "^2.4.0-dev.2169+0a45df07"
+    "@fedify/fedify": "^2.4.0-dev.2193+402149b5",
+    "@fedify/vocab": "2.4.0-dev.2193+402149b5"
   },
   "devDependencies": {
     "tsdown": "^0.22.0",
     "typescript": "^6.0.0",
     "urlpattern-polyfill": "^10.1.0",
-    "@fedify/vocab-runtime": "^2.4.0-dev.2169+0a45df07"
+    "@fedify/vocab-runtime": "^2.4.0-dev.2193+402149b5"
   },
   "scripts": {
     "build:self": "tsdown",