@fedify/vocab-runtime 2.4.0-dev.1599 → 2.4.0-dev.1634

package/dist/{url-BlFta-Eh.js → url-DGVbSVVi.js}

@@ -63,7 +63,7 @@ function canonicalizePortableUri(input) {
 	const parsed = parsePortableIri(input);
 	if (parsed == null) throw new TypeError("Invalid portable ActivityPub IRI.");
 	const match = input.match(PORTABLE_IRI_PATTERN);
-	return `ap+ef61://${normalizePortableAuthority(decodePortableAuthority(parsed.host).replace(DID_SCHEME_PATTERN, "did:"))}${normalizePortableComponent(match[3])}${match[5] == null ? "" : normalizePortableComponent(match[5])}`;
+	return `ap+ef61://${normalizePortableAuthority(getDidUrlOrigin(decodePortableAuthority(parsed.host)))}${normalizePortableComponent(match[3])}${match[5] == null ? "" : normalizePortableComponent(match[5])}`;
 }
 /**
 * Checks whether two FEP-ef61 portable ActivityPub URIs identify the same
@@ -88,6 +88,45 @@ function arePortableUrisEqual(left, right) {
 	}
 }
 /**
+* Computes an IRI's FEP-fe34 origin.
+*
+* HTTP(S) IRIs use their web origin.  FEP-ef61 portable ActivityPub IRIs and
+* DID URLs use their DID as a cryptographic origin.
+*
+* @throws {TypeError} If the IRI does not have a supported FEP-fe34 origin.
+* @since 2.4.0
+*/
+function getFe34Origin(input) {
+	if (input instanceof URL) {
+		const portable = normalizePortableUrl(input);
+		if (portable != null) return getPortableCryptographicOrigin(portable);
+		if (input.protocol === "did:") return getDidUrlOrigin(input.href);
+		if (input.protocol === "http:" || input.protocol === "https:") return input.origin;
+		throw new TypeError("Unsupported FEP-fe34 origin IRI.");
+	}
+	const portable = parsePortableIri(input);
+	if (portable != null) return getPortableCryptographicOrigin(portable);
+	if (DID_SCHEME_PATTERN.test(input)) return getDidUrlOrigin(input);
+	const parsed = new URL(input);
+	if (parsed.protocol === "http:" || parsed.protocol === "https:") return parsed.origin;
+	throw new TypeError("Unsupported FEP-fe34 origin IRI.");
+}
+/**
+* Checks whether two IRIs have the same FEP-fe34 origin.
+*
+* Malformed or unsupported IRIs are treated as non-matching.
+*
+* @since 2.4.0
+*/
+function haveSameFe34Origin(left, right) {
+	try {
+		return getFe34Origin(left) === getFe34Origin(right);
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+}
+/**
 * Checks whether two IRIs have the same origin.
 */
 function haveSameIriOrigin(left, right) {
@@ -97,15 +136,25 @@ function getComparableIriOrigin(iri) {
 	iri = normalizePortableUrl(iri) ?? iri;
 	if (iri.origin !== "null") return iri.origin;
 	if (iri.host !== "") {
-		const host = iri.protocol === "ap+ef61:" ? encodeURIComponent(decodePortableAuthority(iri.host).replace(DID_SCHEME_PATTERN, "did:")) : iri.host;
+		const host = iri.protocol === "ap+ef61:" ? encodeURIComponent(getDidUrlOrigin(decodePortableAuthority(iri.host))) : iri.host;
 		return `${iri.protocol}//${host}`;
 	}
 	return iri.href;
 }
+function getPortableCryptographicOrigin(iri) {
+	return getDidUrlOrigin(decodePortableAuthority(iri.host));
+}
+function getDidUrlOrigin(iri) {
+	const did = iri.split(/[/?#]/, 1)[0].replace(DID_SCHEME_PATTERN, "did:");
+	if (!DID_PATTERN.test(did)) throw new TypeError("Invalid DID URL.");
+	const parts = did.split(":");
+	parts[1] = parts[1].toLowerCase();
+	return normalizePortableAuthority(parts.join(":"));
+}
 function parsePortableIri(iri) {
 	const match = iri.match(PORTABLE_IRI_PATTERN);
 	if (match == null) return null;
-	const authority = decodePortableAuthority(match[2]);
+	const authority = getDidUrlOrigin(decodePortableAuthority(match[2]));
 	if (!DID_PATTERN.test(authority)) throw new TypeError("Invalid portable ActivityPub IRI authority.");
 	if (match[3] === "") throw new TypeError("Invalid portable ActivityPub IRI path.");
 	return new URL(`ap+ef61://${encodeURIComponent(authority)}${match[3]}${match[4] ?? ""}${match[5] ?? ""}`);
@@ -162,6 +211,20 @@ function parseAtUri(uri) {
 	return new URL("at://" + encodeURIComponent(authority) + path);
 }
 /**
+* Checks whether the URL is an FEP-ef61 gateway base URI.
+*/
+function isGatewayUrl(url) {
+	return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "" && url.pathname === "/" && url.search === "" && url.hash === "";
+}
+/**
+* Parses and validates an FEP-ef61 gateway base URI.
+*/
+function parseGatewayUrl(url) {
+	const parsed = parseIri(url);
+	if (!isGatewayUrl(parsed)) throw new TypeError("FEP-ef61 gateways must be HTTP(S) base URIs with no credentials, path, query, or fragment.");
+	return parsed;
+}
+/**
 * Validates a URL to prevent SSRF attacks.
 */
 async function validatePublicUrl(url) {
@@ -327,4 +390,4 @@ function matchesIPv6Prefix(address, prefixWords, prefixLength) {
 	return true;
 }
 //#endregion
-export { formatIri as a, isValidPublicIPv6Address as c, validatePublicUrl as d, expandIPv6Address as i, parseIri as l, arePortableUrisEqual as n, haveSameIriOrigin as o, canonicalizePortableUri as r, isValidPublicIPv4Address as s, UrlError as t, parseJsonLdId as u };
+export { formatIri as a, haveSameIriOrigin as c, isValidPublicIPv6Address as d, parseGatewayUrl as f, validatePublicUrl as h, expandIPv6Address as i, isGatewayUrl as l, parseJsonLdId as m, arePortableUrisEqual as n, getFe34Origin as o, parseIri as p, canonicalizePortableUri as r, haveSameFe34Origin as s, UrlError as t, isValidPublicIPv4Address as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.4.0-dev.1599+7b19967f",
+  "version": "2.4.0-dev.1634+3b4bfbb6",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",

package/src/contexts/fep-ef61.json

@@ -0,0 +1,10 @@
+{
+  "@context": {
+    "gateways": {
+      "@id": "https://w3id.org/fep/ef61/gateways",
+      "@type": "@id",
+      "@container": "@list"
+    },
+    "digestMultibase": "https://www.w3.org/ns/credentials/v2#digestMultibase"
+  }
+}

package/src/contexts/security-data-integrity-v1.json

@@ -3,10 +3,6 @@
     "id": "@id",
     "type": "@type",
     "@protected": true,
-    "digestMultibase": {
-      "@id": "https://w3id.org/security#digestMultibase",
-      "@type": "https://w3id.org/security#multibase"
-    },
     "proof": {
       "@id": "https://w3id.org/security#proof",
       "@type": "@id",

package/src/contexts.ts

@@ -8,6 +8,7 @@ import activitystreams from "./contexts/activitystreams.json" with {
 import didV1 from "./contexts/did-v1.json" with { type: "json" };
 import fep5711 from "./contexts/fep-5711.json" with { type: "json" };
 import fep7aa9 from "./contexts/fep-7aa9.json" with { type: "json" };
+import fepEf61 from "./contexts/fep-ef61.json" with { type: "json" };
 import gotosocial from "./contexts/gotosocial.json" with { type: "json" };
 import identityV1 from "./contexts/identity-v1.json" with { type: "json" };
 import joinLemmyContext from "./contexts/join-lemmy.json" with { type: "json" };
@@ -37,6 +38,7 @@ const preloadedContexts: Record<string, unknown> = {
   "https://gotosocial.org/ns": gotosocial,
   "https://w3id.org/fep/5711": fep5711,
   "https://w3id.org/fep/7aa9": fep7aa9,
+  "https://w3id.org/fep/ef61": fepEf61,
 
   // Lemmy's context document is served as application/json without the JSON-LD
   // context Link header.  The default document loader treats that as a regular

package/src/docloader.ts

@@ -351,8 +351,10 @@ export interface GetDocumentLoaderOptions extends DocumentLoaderFactoryOptions {
  * - <https://www.w3.org/ns/activitystreams>
  * - <https://w3id.org/security/v1>
  * - <https://w3id.org/security/data-integrity/v1>
+ * - <https://w3id.org/security/data-integrity/v2>
  * - <https://www.w3.org/ns/did/v1>
  * - <https://w3id.org/security/multikey/v1>
+ * - <https://w3id.org/fep/ef61>
  * - <https://purl.archive.org/socialweb/webfinger>
  * - <http://schema.org/>
  * @param options Options for the document loader.

package/src/internal/jsonld-cache.ts

@@ -1,6 +1,6 @@
 import type { DocumentLoader } from "../docloader.ts";
 import jsonld from "../jsonld.ts";
-import { formatIri, haveSameIriOrigin } from "../url.ts";
+import { formatIri, haveSameFe34Origin, haveSameIriOrigin } from "../url.ts";
 
 const noJsonLdContext = Symbol("noJsonLdContext");
 
@@ -28,7 +28,8 @@ export function isTrustedIriOrigin(
   right: URL | null | undefined,
 ): boolean {
   return options.crossOrigin === "trust" || left == null ||
-    (right != null && haveSameIriOrigin(left, right));
+    (right != null &&
+      (haveSameIriOrigin(left, right) || haveSameFe34Origin(left, right)));
 }
 
 /**

package/src/mod.ts

@@ -58,9 +58,13 @@ export {
   canonicalizePortableUri,
   expandIPv6Address,
   formatIri,
+  getFe34Origin,
+  haveSameFe34Origin,
   haveSameIriOrigin,
+  isGatewayUrl,
   isValidPublicIPv4Address,
   isValidPublicIPv6Address,
+  parseGatewayUrl,
   parseIri,
   parseJsonLdId,
   UrlError,

package/src/url.test.ts

@@ -5,9 +5,13 @@ import {
   canonicalizePortableUri,
   expandIPv6Address,
   formatIri,
+  getFe34Origin,
+  haveSameFe34Origin,
   haveSameIriOrigin,
+  isGatewayUrl,
   isValidPublicIPv4Address,
   isValidPublicIPv6Address,
+  parseGatewayUrl,
   parseIri,
   parseJsonLdId,
   UrlError,
@@ -30,15 +34,16 @@ test("parseIri() accepts portable ActivityPub URI schemes", () => {
   }
 });
 
-test("parseIri() accepts DID schemes case-insensitively", () => {
+test("parseIri() normalizes DID scheme and method casing", () => {
   const cases = [
     "ap://DID:key:z6Mkabc/actor",
     "ap://DID%3Akey%3Az6Mkabc/actor",
+    "ap://did:KEY:z6Mkabc/actor",
   ];
   for (const iri of cases) {
     deepStrictEqual(
       parseIri(iri),
-      new URL("ap+ef61://DID%3Akey%3Az6Mkabc/actor"),
+      new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor"),
     );
   }
 });
@@ -139,6 +144,14 @@ test("parseIri() rejects malformed portable DID authorities", () => {
 });
 
 test("haveSameIriOrigin() compares portable IRI authorities", () => {
+  ok(haveSameIriOrigin(
+    new URL("ftp://example.com/pub/1"),
+    new URL("ftp://example.com/pub/2"),
+  ));
+  ok(haveSameIriOrigin(
+    new URL("mailto:alice@example.com"),
+    new URL("mailto:alice@example.com"),
+  ));
   ok(haveSameIriOrigin(
     parseIri("ap://did:key:z6Mkabc/actor"),
     parseIri("ap://did:key:z6Mkabc/outbox"),
@@ -163,6 +176,122 @@ test("haveSameIriOrigin() compares portable IRI authorities", () => {
   );
 });
 
+test("getFe34Origin() computes web and cryptographic origins", () => {
+  deepStrictEqual(
+    getFe34Origin("https://Example.COM:443/users/alice"),
+    "https://example.com",
+  );
+  deepStrictEqual(
+    getFe34Origin(new URL("http://example.com:8080/notes/1")),
+    "http://example.com:8080",
+  );
+  deepStrictEqual(
+    getFe34Origin(
+      "ap://did:key:z6Mkabc/actor?gateways=https%3A%2F%2Fa.example",
+    ),
+    "did:key:z6Mkabc",
+  );
+  deepStrictEqual(
+    getFe34Origin("ap+ef61://did%3Akey%3Az6Mkabc/objects/1#fragment"),
+    "did:key:z6Mkabc",
+  );
+  deepStrictEqual(
+    getFe34Origin(new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor")),
+    "did:key:z6Mkabc",
+  );
+  deepStrictEqual(
+    getFe34Origin("did:key:z6Mkabc#z6Mkabc"),
+    "did:key:z6Mkabc",
+  );
+  deepStrictEqual(
+    getFe34Origin(new URL("did:key:z6Mkabc?service=activitypub#key")),
+    "did:key:z6Mkabc",
+  );
+  deepStrictEqual(
+    getFe34Origin("did:key:z6Mkabc/path/to/resource?service=activitypub#key"),
+    "did:key:z6Mkabc",
+  );
+  deepStrictEqual(
+    getFe34Origin("did:KEY:z6Mkabc#z6Mkabc"),
+    "did:key:z6Mkabc",
+  );
+  deepStrictEqual(
+    getFe34Origin("ap://did%3Aweb%3Afoo%2Dbar.example/actor"),
+    "did:web:foo-bar.example",
+  );
+  deepStrictEqual(
+    getFe34Origin("did:web:foo%2dbar.example#key"),
+    "did:web:foo-bar.example",
+  );
+});
+
+test("getFe34Origin() rejects unsupported or malformed identifiers", () => {
+  for (
+    const iri of [
+      "mailto:alice@example.com",
+      "ap://not-a-did/actor",
+      "ap://did:key/actor",
+      "did:key",
+      "did:key:",
+      "did:",
+    ]
+  ) {
+    throws(() => getFe34Origin(iri), TypeError);
+  }
+});
+
+test("haveSameFe34Origin() compares web and cryptographic origins", () => {
+  ok(haveSameFe34Origin(
+    "https://example.com/users/alice",
+    "https://example.com/notes/1",
+  ));
+  ok(
+    !haveSameFe34Origin(
+      "https://example.com/users/alice",
+      "http://example.com/users/alice",
+    ),
+  );
+  ok(
+    !haveSameFe34Origin(
+      "https://example.com/users/alice",
+      "https://example.com:8443/users/alice",
+    ),
+  );
+  ok(haveSameFe34Origin(
+    "ap://did:key:z6Mkabc/actor",
+    "ap+ef61://did%3Akey%3Az6Mkabc/objects/1",
+  ));
+  ok(haveSameFe34Origin(
+    "ap+ef61://did:key:z6Mkabc/actor",
+    "did:key:z6Mkabc#z6Mkabc",
+  ));
+  ok(haveSameFe34Origin(
+    "ap://did:KEY:z6Mkabc/actor",
+    "did:key:z6Mkabc#z6Mkabc",
+  ));
+  ok(haveSameFe34Origin(
+    "ap://did%3Aweb%3Afoo%2Dbar.example/actor",
+    "ap://did:web:foo-bar.example/note",
+  ));
+  ok(haveSameFe34Origin(
+    "ap://did%3Aexample%3Aabc%252fdef/actor",
+    "did:example:abc%2Fdef#key",
+  ));
+  ok(
+    !haveSameFe34Origin(
+      "ap+ef61://did:key:z6Mkabc/actor",
+      "did:key:z6Mkdef#z6Mkdef",
+    ),
+  );
+  ok(
+    !haveSameFe34Origin(
+      "ap+ef61://did:key:z6Mkabc/actor",
+      "https://example.com/actor",
+    ),
+  );
+  ok(!haveSameFe34Origin("ap://not-a-did/actor", "ap://not-a-did/actor"));
+});
+
 test("parseIri() normalizes portable URL instances", () => {
   deepStrictEqual(
     parseIri(new URL("ap+ef61://did%3Aexample%3Aabc%2Fdef/actor")),
@@ -511,6 +640,27 @@ test("parseIri() preserves encoded percent signs while decoding delimiters", ()
   );
 });
 
+test("parseGatewayUrl() accepts only HTTP(S) base URIs", () => {
+  for (const url of ["https://server.example/", "http://server.example/"]) {
+    deepStrictEqual(parseGatewayUrl(url), new URL(url));
+    ok(isGatewayUrl(new URL(url)));
+  }
+
+  for (
+    const url of [
+      "ftp://server.example/",
+      "https://user:pass@server.example/",
+      "https://user@server.example/",
+      "https://server.example/path",
+      "https://server.example/?x=1",
+      "https://server.example/#fragment",
+    ]
+  ) {
+    throws(() => parseGatewayUrl(url), TypeError);
+    ok(!isGatewayUrl(new URL(url)));
+  }
+});
+
 test("validatePublicUrl()", async () => {
   await rejects(() => validatePublicUrl("ftp://localhost"), UrlError);
   await rejects(

package/src/url.ts

@@ -93,7 +93,7 @@ export function canonicalizePortableUri(input: string): string {
   // decodePortableAuthority() reverses the shared percent-encoded authority
   // path here rather than the raw did:-prefixed branch.
   const authority = normalizePortableAuthority(
-    decodePortableAuthority(parsed.host).replace(DID_SCHEME_PATTERN, "did:"),
+    getDidUrlOrigin(decodePortableAuthority(parsed.host)),
   );
   // Keep path and fragment text from the raw match to avoid URL dot-segment
   // normalization, but still encode raw characters and normalize
@@ -131,6 +131,56 @@ export function arePortableUrisEqual(
   }
 }
 
+/**
+ * Computes an IRI's FEP-fe34 origin.
+ *
+ * HTTP(S) IRIs use their web origin.  FEP-ef61 portable ActivityPub IRIs and
+ * DID URLs use their DID as a cryptographic origin.
+ *
+ * @throws {TypeError} If the IRI does not have a supported FEP-fe34 origin.
+ * @since 2.4.0
+ */
+export function getFe34Origin(input: string | URL): string {
+  if (input instanceof URL) {
+    const portable = normalizePortableUrl(input);
+    if (portable != null) return getPortableCryptographicOrigin(portable);
+    if (input.protocol === "did:") return getDidUrlOrigin(input.href);
+    if (input.protocol === "http:" || input.protocol === "https:") {
+      return input.origin;
+    }
+    throw new TypeError("Unsupported FEP-fe34 origin IRI.");
+  }
+
+  const portable = parsePortableIri(input);
+  if (portable != null) return getPortableCryptographicOrigin(portable);
+  if (DID_SCHEME_PATTERN.test(input)) return getDidUrlOrigin(input);
+
+  const parsed = new URL(input);
+  if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+    return parsed.origin;
+  }
+  throw new TypeError("Unsupported FEP-fe34 origin IRI.");
+}
+
+/**
+ * Checks whether two IRIs have the same FEP-fe34 origin.
+ *
+ * Malformed or unsupported IRIs are treated as non-matching.
+ *
+ * @since 2.4.0
+ */
+export function haveSameFe34Origin(
+  left: string | URL,
+  right: string | URL,
+): boolean {
+  try {
+    return getFe34Origin(left) === getFe34Origin(right);
+  } catch (error) {
+    if (error instanceof TypeError) return false;
+    throw error;
+  }
+}
+
 /**
  * Checks whether two IRIs have the same origin.
  */
@@ -144,7 +194,7 @@ function getComparableIriOrigin(iri: URL): string {
   if (iri.host !== "") {
     const host = iri.protocol === "ap+ef61:"
       ? encodeURIComponent(
-        decodePortableAuthority(iri.host).replace(DID_SCHEME_PATTERN, "did:"),
+        getDidUrlOrigin(decodePortableAuthority(iri.host)),
       )
       : iri.host;
     return `${iri.protocol}//${host}`;
@@ -152,6 +202,18 @@ function getComparableIriOrigin(iri: URL): string {
   return iri.href;
 }
 
+function getPortableCryptographicOrigin(iri: URL): string {
+  return getDidUrlOrigin(decodePortableAuthority(iri.host));
+}
+
+function getDidUrlOrigin(iri: string): string {
+  const did = iri.split(/[/?#]/, 1)[0].replace(DID_SCHEME_PATTERN, "did:");
+  if (!DID_PATTERN.test(did)) throw new TypeError("Invalid DID URL.");
+  const parts = did.split(":");
+  parts[1] = parts[1].toLowerCase();
+  return normalizePortableAuthority(parts.join(":"));
+}
+
 function parsePortableIri(iri: string): URL | null {
   const match = iri.match(PORTABLE_IRI_PATTERN);
   if (match == null) return null;
@@ -160,7 +222,7 @@ function parsePortableIri(iri: string): URL | null {
   // current FEP-ef61 interoperability, but normalize it to a percent-encoded
   // URL authority internally.  The ap: URI syntax may change later; see:
   // https://bnewbold.leaflet.pub/3mph4hzvbdc2v
-  const authority = decodePortableAuthority(match[2]);
+  const authority = getDidUrlOrigin(decodePortableAuthority(match[2]));
   if (!DID_PATTERN.test(authority)) {
     throw new TypeError("Invalid portable ActivityPub IRI authority.");
   }
@@ -261,6 +323,29 @@ function parseAtUri(uri: string): URL {
   return new URL("at://" + encodeURIComponent(authority) + path);
 }
 
+/**
+ * Checks whether the URL is an FEP-ef61 gateway base URI.
+ */
+export function isGatewayUrl(url: URL): boolean {
+  return (url.protocol === "http:" || url.protocol === "https:") &&
+    url.username === "" && url.password === "" &&
+    url.pathname === "/" && url.search === "" && url.hash === "";
+}
+
+/**
+ * Parses and validates an FEP-ef61 gateway base URI.
+ */
+export function parseGatewayUrl(url: string): URL {
+  const parsed = parseIri(url);
+  if (!isGatewayUrl(parsed)) {
+    throw new TypeError(
+      "FEP-ef61 gateways must be HTTP(S) base URIs with no credentials, " +
+        "path, query, or fragment.",
+    );
+  }
+  return parsed;
+}
+
 /**
  * Validates a URL to prevent SSRF attacks.
  */