@fedify/vocab-tools 2.4.0-dev.1962 → 2.4.0-dev.1988

package/src/class.ts

@@ -283,6 +283,44 @@ function isValidLanguageTag(language: string): boolean {
   }
 }
 `;
+  // Contexts are activated by expanded property IRIs left after compaction.
+  const extraContexts = Object.fromEntries(
+    Object.values(types).flatMap((type) =>
+      type.properties.flatMap((property) =>
+        property.extraContext == null
+          ? []
+          : [[property.uri, property.extraContext]]
+      )
+    ),
+  );
+  if (Object.keys(extraContexts).length > 0) {
+    yield `
+const extraPropertyContexts: Readonly<Record<string, string>> =
+  ${JSON.stringify(extraContexts)};
+
+function getExtraContexts(document: unknown): string[] {
+  const contexts = new Set<string>();
+  const pending: unknown[] = [document];
+  while (pending.length > 0) {
+    const value = pending.pop();
+    if (value == null || typeof value !== "object") continue;
+    if (Array.isArray(value)) {
+      for (const item of value) pending.push(item);
+      continue;
+    }
+    if ("@value" in value) continue;
+    for (const [key, child] of globalThis.Object.entries(value)) {
+      if (key === "@context") continue;
+      if (globalThis.Object.hasOwn(extraPropertyContexts, key)) {
+        contexts.add(extraPropertyContexts[key]);
+      }
+      pending.push(child);
+    }
+  }
+  return [...contexts];
+}
+`;
+  }
   yield "\n\n";
   const portableIriKeys = new Set(["@id", "id"]);
   for (const type of Object.values(types)) {

package/src/codec.ts

@@ -265,13 +265,35 @@ export async function* generateEncoder(
         },
       );
     }
-    const docContext = options.context ??
+    let docContext: Parameters<typeof jsonld.compact>[1] = options.context ??
       ${JSON.stringify(type.defaultContext)};
-    const compacted = await jsonld.compact(
+    let compacted = await jsonld.compact(
       values,
       docContext,
       { documentLoader: options.contextLoader },
     );
+  `;
+  if (
+    Object.values(types).some((t) =>
+      t.properties.some((p) => p.extraContext != null)
+    )
+  ) {
+    yield `
+    if (options.context == null) {
+      const currentContexts = Array.isArray(docContext) ? docContext : [docContext];
+      const additionalContexts = getExtraContexts(compacted).filter(
+        context => !currentContexts.includes(context)
+      );
+      if (additionalContexts.length > 0) {
+        docContext = [...currentContexts, ...additionalContexts];
+        compacted = await jsonld.compact(values, docContext, {
+          documentLoader: options.contextLoader,
+        });
+      }
+    }
+    `;
+  }
+  yield `
     if (docContext != null) {
       // Embed context
   `;
@@ -309,7 +331,10 @@ export async function* generateEncoder(
   protected ${emitOverride(typeUri, types)} isCompactable(): boolean {
 `;
   for (const property of type.properties) {
-    if (!property.range.every((r) => isCompactableType(r, types))) {
+    if (
+      property.extraContext != null ||
+      !property.range.every((r) => isCompactableType(r, types))
+    ) {
       yield `
       if (
         this.${await getFieldName(property.uri)} != null &&

package/src/property.ts

@@ -29,6 +29,7 @@ async function* generateProperty(
   moduleVarNames: ReadonlyMap<string, string>,
 ): AsyncIterable<string> {
   const override = emitOverride(type.uri, types, property);
+  const trustOwner = type.trustEmbeddedObjects === false ? "null" : "this.id";
   const doc = `\n/** ${property.description.replaceAll("\n", "\n * ")}\n */\n`;
   const cachedPropertyBaseUrl = `(options as { baseUrl?: URL }).baseUrl ??
                 this._baseUrl ??
@@ -277,7 +278,7 @@ async function* generateProperty(
         let v = this.${await getFieldName(property.uri)}[0];
         if (!(v instanceof URL) &&
             v.id != null &&
-            !isTrustedIriOrigin(options, v.id, this.id) &&
+            !isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
             !this.${await getFieldName(property.uri, "#_trust")}.has(0)) {
           v = v.id;
         }
@@ -317,12 +318,18 @@ async function* generateProperty(
       }
       yield `
         if (v?.id != null &&
-            this.id != null && !isTrustedIriOrigin(options, v.id, this.id) &&
+            ${
+        type.trustEmbeddedObjects === false ? "" : "this.id != null && "
+      }!isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
             !this.${await getFieldName(property.uri, "#_trust")}.has(0)) {
           if (options.crossOrigin === "throw") {
             throw new Error(
               "The property object's @id (" + v.id.href + ") has a different " +
-              "origin than the property owner's @id (" + this.id.href + "); " +
+              "origin than the property owner's @id (" + ${
+        type.trustEmbeddedObjects === false
+          ? '"untrusted metadata"'
+          : "this.id.href"
+      } + "); " +
               "refusing to return the object.  If you want to bypass this " +
               "check and are aware of the security implications, set the " +
               'crossOrigin option to "trust".'
@@ -334,7 +341,11 @@ async function* generateProperty(
             "return the object.  If you want to bypass this check and are " +
             "aware of the security implications, set the crossOrigin option " +
             'to "trust".',
-            { objectId: v.id.href, parentObjectId: this.id.href },
+            { objectId: v.id.href, parentObjectId: ${
+        type.trustEmbeddedObjects === false
+          ? '"untrusted metadata"'
+          : "this.id.href"
+      } },
           );
           return null;
         }
@@ -383,7 +394,7 @@ async function* generateProperty(
           let v = vs[i];
           if (!(v instanceof URL) &&
               v.id != null &&
-              !isTrustedIriOrigin(options, v.id, this.id) &&
+              !isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
               !this.${await getFieldName(property.uri, "#_trust")}.has(i)) {
             v = v.id;
           }
@@ -424,12 +435,18 @@ async function* generateProperty(
       }
       yield `
           if (v?.id != null &&
-              this.id != null && !isTrustedIriOrigin(options, v.id, this.id) &&
+              ${
+        type.trustEmbeddedObjects === false ? "" : "this.id != null && "
+      }!isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
               !this.${await getFieldName(property.uri, "#_trust")}.has(i)) {
             if (options.crossOrigin === "throw") {
               throw new Error(
                 "The property object's @id (" + v.id.href + ") has a different " +
-                "origin than the property owner's @id (" + this.id.href + "); " +
+                "origin than the property owner's @id (" + ${
+        type.trustEmbeddedObjects === false
+          ? '"untrusted metadata"'
+          : "this.id.href"
+      } + "); " +
                 "refusing to return the object.  If you want to bypass this " +
                 "check and are aware of the security implications, set the " +
                 'crossOrigin option to "trust".'
@@ -441,7 +458,11 @@ async function* generateProperty(
               "return the object.  If you want to bypass this check and are " +
               "aware of the security implications, set the crossOrigin " +
               'option to "trust".',
-              { objectId: v.id.href, parentObjectId: this.id.href },
+              { objectId: v.id.href, parentObjectId: ${
+        type.trustEmbeddedObjects === false
+          ? '"untrusted metadata"'
+          : "this.id.href"
+      } },
             );
             continue;
           }

package/src/schema.ts

@@ -47,6 +47,14 @@ export interface TypeSchema {
    */
   entity: boolean;
 
+  /**
+   * Whether this type's id can establish same-origin trust for its own
+   * embedded entity-valued properties.  Defaults to true.  Set to false for
+   * metadata whose id does not identify an independently fetched resource.
+   * Locally constructed and explicitly trusted values remain trusted.
+   */
+  trustEmbeddedObjects?: boolean;
+
   /**
    * Whether the type omits `@type` in JSON-LD serialization.  When `true`,
    * the generated `toJsonLd()` method will not emit `@type` (or `type` in
@@ -77,6 +85,14 @@ export interface TypeSchema {
 }
 
 export interface PropertySchemaBase {
+  /**
+   * A context URL added to the default serialization context when this
+   * property's expanded IRI appears in the compacted document.  Explicit
+   * caller contexts are unchanged.  Populated properties with this option
+   * use the JSON-LD processor instead of compact serialization heuristics.
+   */
+  extraContext?: string;
+
   /**
    * The singular form of the property name.  It is used as the name of the
    * generated property accessors.

package/src/schema.yaml

@@ -72,6 +72,14 @@ $defs:
   property-base:
     type: object
     properties:
+      extraContext:
+        description: >-
+          A context URL added to default serialization when this property's
+          expanded IRI appears in the compacted document. Explicit caller
+          contexts are unchanged. Populated properties use the JSON-LD
+          processor instead of compact serialization heuristics.
+        type: string
+        format: uri
       singularName:
         description: >-
           The singular form of the property name.  It is used as the name of the
@@ -250,6 +258,13 @@ properties:
 
       The extended subtypes must have the consistent value of this flag.
     type: boolean
+  trustEmbeddedObjects:
+    description: >-
+      Whether this type's id establishes same-origin trust for its own
+      embedded entity-valued properties. Defaults to true. Set to false
+      for metadata ids that do not identify independently fetched resources.
+      Locally constructed and explicitly trusted values remain trusted.
+    type: boolean
   typeless:
     description: >-
       Whether the type omits @type in JSON-LD serialization.  When true,