@fedify/vocab-tools 2.4.0-dev.2054 → 2.4.0-dev.2063

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-tools",
-  "version": "2.4.0-dev.2054+1756e190",
+  "version": "2.4.0-dev.2063+366c0362",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts"

package/dist/mod.cjs

@@ -8,7 +8,7 @@ let yaml = require("yaml");
 let es_toolkit = require("es-toolkit");
 //#region deno.json
 var name = "@fedify/vocab-tools";
-var version = "2.4.0-dev.2054+1756e190";
+var version = "2.4.0-dev.2063+366c0362";
 //#endregion
 //#region src/type.ts
 const HEURISTICS_CONTEXTS = [
@@ -1425,6 +1425,7 @@ async function* generateCloner(typeUri, types) {
       { id: values.id ?? this.id },
       options
     );
+    copyPortableProvenance(this, clone);
     `;
 	else yield `const clone = super.clone(values, options) as unknown as ${type.name};`;
 	for (const property of type.properties) {
@@ -1680,6 +1681,10 @@ async function* generateProperty(type, property, types, moduleVarNames) {
               tracerProvider,
               gateways: options.gateways,
               verifyPortableObject: options.verifyPortableObject,
+              referrer: {
+                object: this,
+                property: ${JSON.stringify(property.uri)},
+              },
               suppressError: options.suppressError,
               crossOrigin: options.crossOrigin,
               span,
@@ -1711,6 +1716,11 @@ async function* generateProperty(type, property, types, moduleVarNames) {
           }
         }
         const lookupUrl = formatIri(url);
+        const inPortableChain = isInPortableChain(this);
+        if (inPortableChain && isCompatibleEf61Iri(url)) {
+          span.end();
+          return rejectPortableChainReference(lookupUrl, options.crossOrigin);
+        }
         let fetchResult: RemoteDocument;
         try {
           fetchResult = await documentLoader(lookupUrl);
@@ -1736,6 +1746,17 @@ async function* generateProperty(type, property, types, moduleVarNames) {
             document,
             { documentLoader, contextLoader, tracerProvider, baseUrl }
           );
+          if (
+            inPortableChain &&
+            (isCompatibleEf61Iri(documentUrl) ||
+              (obj.id != null &&
+                (isPortableIri(obj.id) || isCompatibleEf61Iri(obj.id))))
+          ) {
+            return rejectPortableChainReference(
+              documentUrl,
+              options.crossOrigin,
+            );
+          }
           if (obj?.id != null && !isTrustedIriOrigin(options, obj.id, baseUrl)) {
             if (options.crossOrigin === "throw") {
               throw new Error(
@@ -1888,10 +1909,19 @@ async function* generateProperty(type, property, types, moduleVarNames) {
         if (this.${await getFieldName(property.uri)}.length < 1) return null;
         let v = this.${await getFieldName(property.uri)}[0];
         if (!(v instanceof URL) &&
-            v.id != null &&
-            !isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
             !this.${await getFieldName(property.uri, "#_trust")}.has(0)) {
-          v = v.id;
+          if (v.id == null) {
+            if (isUnsecuredPortableObject(this)) {
+              warnUnverifiableEmbeddedObject(this, ${JSON.stringify(property.uri)});
+              return null;
+            }
+          } else if (
+            !isTrustedIriOrigin(options, v.id, ${trustOwner}) ||
+            isUnsecuredPortableObject(this) ||
+            (isInPortableChain(this) && isCompatibleEf61Iri(v.id))
+          ) {
+            v = v.id;
+          }
         }
         if (v instanceof URL) {
           const fetched =
@@ -1900,6 +1930,7 @@ async function* generateProperty(type, property, types, moduleVarNames) {
           this.${await getFieldName(property.uri)}[0] = fetched;
           this.${await getFieldName(property.uri, "#_trust")}.add(0);
           this._cachedJsonLd = undefined;
+          recordPortableReferrer(this, fetched, ${JSON.stringify(property.uri)});
           return fetched;
         }
       `;
@@ -1929,12 +1960,14 @@ async function* generateProperty(type, property, types, moduleVarNames) {
 			}
 			yield `
         if (v?.id != null &&
-            ${type.trustEmbeddedObjects === false ? "" : "this.id != null && "}!isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
+            ((${type.trustEmbeddedObjects === false ? "" : "this.id != null && "}!isTrustedIriOrigin(options, v.id, ${trustOwner})) ||
+              isUnsecuredPortableObject(this) ||
+              (isInPortableChain(this) && isCompatibleEf61Iri(v.id))) &&
             !this.${await getFieldName(property.uri, "#_trust")}.has(0)) {
           if (options.crossOrigin === "throw") {
             throw new Error(
               "The property object's @id (" + v.id.href + ") has a different " +
-              "origin than the property owner's @id (" + ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "this.id.href"} + "); " +
+              "origin than the property owner's @id (" + ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "(this.id?.href ?? null)"} + "); " +
               "refusing to return the object.  If you want to bypass this " +
               "check and are aware of the security implications, set the " +
               'crossOrigin option to "trust".'
@@ -1946,10 +1979,11 @@ async function* generateProperty(type, property, types, moduleVarNames) {
             "return the object.  If you want to bypass this check and are " +
             "aware of the security implications, set the crossOrigin option " +
             'to "trust".',
-            { objectId: v.id.href, parentObjectId: ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "this.id.href"} },
+            { objectId: v.id.href, parentObjectId: ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "(this.id?.href ?? null)"} },
           );
           return null;
         }
+        recordPortableReferrer(this, v, ${JSON.stringify(property.uri)});
         return v;
       }
       `;
@@ -1996,10 +2030,19 @@ async function* generateProperty(type, property, types, moduleVarNames) {
         for (let i = 0; i < vs.length; i++) {
           let v = vs[i];
           if (!(v instanceof URL) &&
-              v.id != null &&
-              !isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
               !this.${await getFieldName(property.uri, "#_trust")}.has(i)) {
-            v = v.id;
+            if (v.id == null) {
+              if (isUnsecuredPortableObject(this)) {
+                warnUnverifiableEmbeddedObject(this, ${JSON.stringify(property.uri)});
+                continue;
+              }
+            } else if (
+              !isTrustedIriOrigin(options, v.id, ${trustOwner}) ||
+              isUnsecuredPortableObject(this) ||
+              (isInPortableChain(this) && isCompatibleEf61Iri(v.id))
+            ) {
+              v = v.id;
+            }
           }
           if (v instanceof URL) {
             const fetched =
@@ -2008,6 +2051,7 @@ async function* generateProperty(type, property, types, moduleVarNames) {
             vs[i] = fetched;
             this.${await getFieldName(property.uri, "#_trust")}.add(i);
             this._cachedJsonLd = undefined;
+            recordPortableReferrer(this, fetched, ${JSON.stringify(property.uri)});
             yield fetched;
             continue;
           }
@@ -2038,12 +2082,14 @@ async function* generateProperty(type, property, types, moduleVarNames) {
 			}
 			yield `
           if (v?.id != null &&
-              ${type.trustEmbeddedObjects === false ? "" : "this.id != null && "}!isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
+              ((${type.trustEmbeddedObjects === false ? "" : "this.id != null && "}!isTrustedIriOrigin(options, v.id, ${trustOwner})) ||
+                isUnsecuredPortableObject(this) ||
+                (isInPortableChain(this) && isCompatibleEf61Iri(v.id))) &&
               !this.${await getFieldName(property.uri, "#_trust")}.has(i)) {
             if (options.crossOrigin === "throw") {
               throw new Error(
                 "The property object's @id (" + v.id.href + ") has a different " +
-                "origin than the property owner's @id (" + ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "this.id.href"} + "); " +
+                "origin than the property owner's @id (" + ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "(this.id?.href ?? null)"} + "); " +
                 "refusing to return the object.  If you want to bypass this " +
                 "check and are aware of the security implications, set the " +
                 'crossOrigin option to "trust".'
@@ -2055,10 +2101,11 @@ async function* generateProperty(type, property, types, moduleVarNames) {
               "return the object.  If you want to bypass this check and are " +
               "aware of the security implications, set the crossOrigin " +
               'option to "trust".',
-              { objectId: v.id.href, parentObjectId: ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "this.id.href"} },
+              { objectId: v.id.href, parentObjectId: ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "(this.id?.href ?? null)"} },
             );
             continue;
           }
+          recordPortableReferrer(this, v, ${JSON.stringify(property.uri)});
           yield v;
         }
       }
@@ -2080,7 +2127,17 @@ const INTERNAL_RUNTIME_IMPORTS = [
 	"isTrustedIriOrigin",
 	"normalizeJsonLdIris"
 ].join(",\n    ");
-const PORTABLE_DEREFERENCE_IMPORTS = ["dereferencePortableIri", "isPortableIri"].join(",\n    ");
+const PORTABLE_DEREFERENCE_IMPORTS = [
+	"copyPortableProvenance",
+	"dereferencePortableIri",
+	"isCompatibleEf61Iri",
+	"isInPortableChain",
+	"isPortableIri",
+	"isUnsecuredPortableObject",
+	"recordPortableReferrer",
+	"rejectPortableChainReference",
+	"warnUnverifiableEmbeddedObject"
+].join(",\n    ");
 const SIGNED_REPRESENTATION_IMPORTS = [
 	"enterSignedValueScope",
 	"resolveSignedValues",

package/dist/mod.js

@@ -7,7 +7,7 @@ import { parse } from "yaml";
 import { pascalCase } from "es-toolkit";
 //#region deno.json
 var name = "@fedify/vocab-tools";
-var version = "2.4.0-dev.2054+1756e190";
+var version = "2.4.0-dev.2063+366c0362";
 //#endregion
 //#region src/type.ts
 const HEURISTICS_CONTEXTS = [
@@ -1424,6 +1424,7 @@ async function* generateCloner(typeUri, types) {
       { id: values.id ?? this.id },
       options
     );
+    copyPortableProvenance(this, clone);
     `;
 	else yield `const clone = super.clone(values, options) as unknown as ${type.name};`;
 	for (const property of type.properties) {
@@ -1679,6 +1680,10 @@ async function* generateProperty(type, property, types, moduleVarNames) {
               tracerProvider,
               gateways: options.gateways,
               verifyPortableObject: options.verifyPortableObject,
+              referrer: {
+                object: this,
+                property: ${JSON.stringify(property.uri)},
+              },
               suppressError: options.suppressError,
               crossOrigin: options.crossOrigin,
               span,
@@ -1710,6 +1715,11 @@ async function* generateProperty(type, property, types, moduleVarNames) {
           }
         }
         const lookupUrl = formatIri(url);
+        const inPortableChain = isInPortableChain(this);
+        if (inPortableChain && isCompatibleEf61Iri(url)) {
+          span.end();
+          return rejectPortableChainReference(lookupUrl, options.crossOrigin);
+        }
         let fetchResult: RemoteDocument;
         try {
           fetchResult = await documentLoader(lookupUrl);
@@ -1735,6 +1745,17 @@ async function* generateProperty(type, property, types, moduleVarNames) {
             document,
             { documentLoader, contextLoader, tracerProvider, baseUrl }
           );
+          if (
+            inPortableChain &&
+            (isCompatibleEf61Iri(documentUrl) ||
+              (obj.id != null &&
+                (isPortableIri(obj.id) || isCompatibleEf61Iri(obj.id))))
+          ) {
+            return rejectPortableChainReference(
+              documentUrl,
+              options.crossOrigin,
+            );
+          }
           if (obj?.id != null && !isTrustedIriOrigin(options, obj.id, baseUrl)) {
             if (options.crossOrigin === "throw") {
               throw new Error(
@@ -1887,10 +1908,19 @@ async function* generateProperty(type, property, types, moduleVarNames) {
         if (this.${await getFieldName(property.uri)}.length < 1) return null;
         let v = this.${await getFieldName(property.uri)}[0];
         if (!(v instanceof URL) &&
-            v.id != null &&
-            !isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
             !this.${await getFieldName(property.uri, "#_trust")}.has(0)) {
-          v = v.id;
+          if (v.id == null) {
+            if (isUnsecuredPortableObject(this)) {
+              warnUnverifiableEmbeddedObject(this, ${JSON.stringify(property.uri)});
+              return null;
+            }
+          } else if (
+            !isTrustedIriOrigin(options, v.id, ${trustOwner}) ||
+            isUnsecuredPortableObject(this) ||
+            (isInPortableChain(this) && isCompatibleEf61Iri(v.id))
+          ) {
+            v = v.id;
+          }
         }
         if (v instanceof URL) {
           const fetched =
@@ -1899,6 +1929,7 @@ async function* generateProperty(type, property, types, moduleVarNames) {
           this.${await getFieldName(property.uri)}[0] = fetched;
           this.${await getFieldName(property.uri, "#_trust")}.add(0);
           this._cachedJsonLd = undefined;
+          recordPortableReferrer(this, fetched, ${JSON.stringify(property.uri)});
           return fetched;
         }
       `;
@@ -1928,12 +1959,14 @@ async function* generateProperty(type, property, types, moduleVarNames) {
 			}
 			yield `
         if (v?.id != null &&
-            ${type.trustEmbeddedObjects === false ? "" : "this.id != null && "}!isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
+            ((${type.trustEmbeddedObjects === false ? "" : "this.id != null && "}!isTrustedIriOrigin(options, v.id, ${trustOwner})) ||
+              isUnsecuredPortableObject(this) ||
+              (isInPortableChain(this) && isCompatibleEf61Iri(v.id))) &&
             !this.${await getFieldName(property.uri, "#_trust")}.has(0)) {
           if (options.crossOrigin === "throw") {
             throw new Error(
               "The property object's @id (" + v.id.href + ") has a different " +
-              "origin than the property owner's @id (" + ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "this.id.href"} + "); " +
+              "origin than the property owner's @id (" + ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "(this.id?.href ?? null)"} + "); " +
               "refusing to return the object.  If you want to bypass this " +
               "check and are aware of the security implications, set the " +
               'crossOrigin option to "trust".'
@@ -1945,10 +1978,11 @@ async function* generateProperty(type, property, types, moduleVarNames) {
             "return the object.  If you want to bypass this check and are " +
             "aware of the security implications, set the crossOrigin option " +
             'to "trust".',
-            { objectId: v.id.href, parentObjectId: ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "this.id.href"} },
+            { objectId: v.id.href, parentObjectId: ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "(this.id?.href ?? null)"} },
           );
           return null;
         }
+        recordPortableReferrer(this, v, ${JSON.stringify(property.uri)});
         return v;
       }
       `;
@@ -1995,10 +2029,19 @@ async function* generateProperty(type, property, types, moduleVarNames) {
         for (let i = 0; i < vs.length; i++) {
           let v = vs[i];
           if (!(v instanceof URL) &&
-              v.id != null &&
-              !isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
               !this.${await getFieldName(property.uri, "#_trust")}.has(i)) {
-            v = v.id;
+            if (v.id == null) {
+              if (isUnsecuredPortableObject(this)) {
+                warnUnverifiableEmbeddedObject(this, ${JSON.stringify(property.uri)});
+                continue;
+              }
+            } else if (
+              !isTrustedIriOrigin(options, v.id, ${trustOwner}) ||
+              isUnsecuredPortableObject(this) ||
+              (isInPortableChain(this) && isCompatibleEf61Iri(v.id))
+            ) {
+              v = v.id;
+            }
           }
           if (v instanceof URL) {
             const fetched =
@@ -2007,6 +2050,7 @@ async function* generateProperty(type, property, types, moduleVarNames) {
             vs[i] = fetched;
             this.${await getFieldName(property.uri, "#_trust")}.add(i);
             this._cachedJsonLd = undefined;
+            recordPortableReferrer(this, fetched, ${JSON.stringify(property.uri)});
             yield fetched;
             continue;
           }
@@ -2037,12 +2081,14 @@ async function* generateProperty(type, property, types, moduleVarNames) {
 			}
 			yield `
           if (v?.id != null &&
-              ${type.trustEmbeddedObjects === false ? "" : "this.id != null && "}!isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
+              ((${type.trustEmbeddedObjects === false ? "" : "this.id != null && "}!isTrustedIriOrigin(options, v.id, ${trustOwner})) ||
+                isUnsecuredPortableObject(this) ||
+                (isInPortableChain(this) && isCompatibleEf61Iri(v.id))) &&
               !this.${await getFieldName(property.uri, "#_trust")}.has(i)) {
             if (options.crossOrigin === "throw") {
               throw new Error(
                 "The property object's @id (" + v.id.href + ") has a different " +
-                "origin than the property owner's @id (" + ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "this.id.href"} + "); " +
+                "origin than the property owner's @id (" + ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "(this.id?.href ?? null)"} + "); " +
                 "refusing to return the object.  If you want to bypass this " +
                 "check and are aware of the security implications, set the " +
                 'crossOrigin option to "trust".'
@@ -2054,10 +2100,11 @@ async function* generateProperty(type, property, types, moduleVarNames) {
               "return the object.  If you want to bypass this check and are " +
               "aware of the security implications, set the crossOrigin " +
               'option to "trust".',
-              { objectId: v.id.href, parentObjectId: ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "this.id.href"} },
+              { objectId: v.id.href, parentObjectId: ${type.trustEmbeddedObjects === false ? "\"untrusted metadata\"" : "(this.id?.href ?? null)"} },
             );
             continue;
           }
+          recordPortableReferrer(this, v, ${JSON.stringify(property.uri)});
           yield v;
         }
       }
@@ -2079,7 +2126,17 @@ const INTERNAL_RUNTIME_IMPORTS = [
 	"isTrustedIriOrigin",
 	"normalizeJsonLdIris"
 ].join(",\n    ");
-const PORTABLE_DEREFERENCE_IMPORTS = ["dereferencePortableIri", "isPortableIri"].join(",\n    ");
+const PORTABLE_DEREFERENCE_IMPORTS = [
+	"copyPortableProvenance",
+	"dereferencePortableIri",
+	"isCompatibleEf61Iri",
+	"isInPortableChain",
+	"isPortableIri",
+	"isUnsecuredPortableObject",
+	"recordPortableReferrer",
+	"rejectPortableChainReference",
+	"warnUnverifiableEmbeddedObject"
+].join(",\n    ");
 const SIGNED_REPRESENTATION_IMPORTS = [
 	"enterSignedValueScope",
 	"resolveSignedValues",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-tools",
-  "version": "2.4.0-dev.2054+1756e190",
+  "version": "2.4.0-dev.2063+366c0362",
   "description": "Code generator for Activity Vocabulary APIs",
   "homepage": "https://fedify.dev/",
   "repository": {