@fedify/vocab-tools 2.4.0-dev.2056 → 2.4.0-dev.2065

package/src/class.ts

@@ -19,8 +19,21 @@ const INTERNAL_RUNTIME_IMPORTS = [
   "normalizeJsonLdIris",
 ].join(",\n    ");
 const PORTABLE_DEREFERENCE_IMPORTS = [
+  "copyPortableProvenance",
+  "createSnapshotContextLoader",
   "dereferencePortableIri",
+  "getPortableResponseClaim",
   "isPortableIri",
+  "isPortableMode",
+  "isUnsecuredPortableObject",
+  "isUnverifiedPortableClaim",
+  "markUnverifiedPortableClaim",
+  "mustDereferencePortableObject",
+  "parseCompatibleEf61Reference",
+  "type PortableResponseClaim",
+  "recordPortableReferrer",
+  "rejectMalformedCompatibleReference",
+  "warnUnverifiableEmbeddedObject",
 ].join(",\n    ");
 const SIGNED_REPRESENTATION_IMPORTS = [
   "enterSignedValueScope",

package/src/constructor.ts

@@ -246,6 +246,7 @@ export async function* generateCloner(
       { id: values.id ?? this.id },
       options
     );
+    copyPortableProvenance(this, clone);
     `;
   } else {
     yield `const clone = super.clone(values, options) as unknown as ${type.name};`;

package/src/property.ts

@@ -89,14 +89,27 @@ async function* generateProperty(
         ${JSON.stringify(metadata.version)},
       );
       return await tracer.startActiveSpan("activitypub.lookup_object", async (span) => {
-        if (isPortableIri(url)) {
+        const dereferencePortable = async (
+          portableUrl: URL,
+          extra: {
+            inferredGateways?: readonly URL[];
+            response?: RemoteDocument;
+            contextLoader?: DocumentLoader;
+          } = {},
+        ) => {
           try {
-            const obj = await dereferencePortableIri(url, {
+            const obj = await dereferencePortableIri(portableUrl, {
               documentLoader,
-              contextLoader,
+              contextLoader: extra.contextLoader ?? contextLoader,
               tracerProvider,
               gateways: options.gateways,
+              inferredGateways: extra.inferredGateways,
+              response: extra.response,
               verifyPortableObject: options.verifyPortableObject,
+              referrer: {
+                object: this,
+                property: ${JSON.stringify(property.uri)},
+              },
               suppressError: options.suppressError,
               crossOrigin: options.crossOrigin,
               span,
@@ -109,7 +122,10 @@ async function* generateProperty(
                 }),
             });
             if (obj != null) {
-              span.setAttribute("activitypub.object.id", (obj.id ?? url).href);
+              span.setAttribute(
+                "activitypub.object.id",
+                (obj.id ?? portableUrl).href,
+              );
               span.setAttribute(
                 "activitypub.object.type",
                 // @ts-ignore: obj.constructor always has a typeId.
@@ -126,8 +142,21 @@ async function* generateProperty(
           } finally {
             span.end();
           }
-        }
+        };
+        if (isPortableIri(url)) return await dereferencePortable(url);
         const lookupUrl = formatIri(url);
+        const portableMode = isPortableMode(this, options);
+        if (portableMode) {
+          const compatible = parseCompatibleEf61Reference(url);
+          if (compatible === null) {
+            span.end();
+            return rejectMalformedCompatibleReference(lookupUrl, options);
+          } else if (compatible != null) {
+            return await dereferencePortable(compatible.id, {
+              inferredGateways: [compatible.gateway],
+            });
+          }
+        }
         let fetchResult: RemoteDocument;
         try {
           fetchResult = await documentLoader(lookupUrl);
@@ -147,52 +176,90 @@ async function* generateProperty(
           throw error;
         }
         const { document, documentUrl } = fetchResult;
-        const baseUrl = parseIri(documentUrl);
+        // In portable mode, the document may turn out to be a portable object,
+        // which has to be verified with the same context documents:
+        const snapshot = portableMode
+          ? createSnapshotContextLoader(contextLoader)
+          : null;
         try {
-          const obj = await this.#${property.singularName}_fromJsonLd(
-            document,
-            { documentLoader, contextLoader, tracerProvider, baseUrl }
-          );
-          if (obj?.id != null && !isTrustedIriOrigin(options, obj.id, baseUrl)) {
-            if (options.crossOrigin === "throw") {
-              throw new Error(
-                "The object's @id (" + obj.id.href + ") has a different origin " +
-                "than the document URL (" + baseUrl.href + "); refusing to return " +
-                "the object.  If you want to bypass this check and are aware of" +
-                'the security implications, set the crossOrigin option to "trust".'
+          let claim: PortableResponseClaim | null | undefined;
+          try {
+            const baseUrl = parseIri(documentUrl);
+            const obj = await this.#${property.singularName}_fromJsonLd(
+              document,
+              {
+                documentLoader,
+                contextLoader: snapshot?.loader ?? contextLoader,
+                tracerProvider,
+                baseUrl,
+              }
+            );
+            if (snapshot == null) {
+              markUnverifiedPortableClaim(obj, url, documentUrl);
+            } else {
+              claim = getPortableResponseClaim(documentUrl, obj.id);
+            }
+            if (claim === undefined) {
+              if (
+                obj?.id != null &&
+                !isTrustedIriOrigin(options, obj.id, baseUrl)
+              ) {
+                if (options.crossOrigin === "throw") {
+                  throw new Error(
+                    "The object's @id (" + obj.id.href + ") has a different origin " +
+                    "than the document URL (" + baseUrl.href + "); refusing to return " +
+                    "the object.  If you want to bypass this check and are aware of" +
+                    'the security implications, set the crossOrigin option to "trust".'
+                  );
+                }
+                getLogger(["fedify", "vocab"]).warn(
+                  "The object's @id ({objectId}) has a different origin than the document " +
+                  "URL ({documentUrl}); refusing to return the object.  If you want to " +
+                  "bypass this check and are aware of the security implications, " +
+                  'set the crossOrigin option to "trust".',
+                  { ...fetchResult, objectId: obj.id.href },
+                );
+                span.end();
+                return null;
+              }
+              span.setAttribute("activitypub.object.id", (obj.id ?? url).href);
+              span.setAttribute(
+                "activitypub.object.type",
+                // @ts-ignore: obj.constructor always has a typeId.
+                obj.constructor.typeId.href
               );
+              span.end();
+              return obj;
             }
-            getLogger(["fedify", "vocab"]).warn(
-              "The object's @id ({objectId}) has a different origin than the document " +
-              "URL ({documentUrl}); refusing to return the object.  If you want to " +
-              "bypass this check and are aware of the security implications, " +
-              'set the crossOrigin option to "trust".',
-              { ...fetchResult, objectId: obj.id.href },
-            );
-            return null;
+          } catch (e) {
+            if (options.suppressError) {
+              getLogger(["fedify", "vocab"]).error(
+                "Failed to parse {url}: {error}",
+                { error: e, url: lookupUrl }
+              );
+              span.end();
+              return null;
+            }
+            span.setStatus({
+              code: SpanStatusCode.ERROR,
+              message: String(e),
+            });
+            span.end();
+            throw e;
           }
-          span.setAttribute("activitypub.object.id", (obj.id ?? url).href);
-          span.setAttribute(
-            "activitypub.object.type",
-            // @ts-ignore: obj.constructor always has a typeId.
-            obj.constructor.typeId.href
-          );
-          return obj;
-        } catch (e) {
-          if (options.suppressError) {
-            getLogger(["fedify", "vocab"]).error(
-              "Failed to parse {url}: {error}",
-              { error: e, url: lookupUrl }
-            );
-            return null;
+          // The document stands for a portable object, so it is verified as
+          // one instead of being trusted because of where it came from:
+          if (claim === null) {
+            span.end();
+            return rejectMalformedCompatibleReference(documentUrl, options);
           }
-          span.setStatus({
-            code: SpanStatusCode.ERROR,
-            message: String(e),
+          return await dereferencePortable(claim.id, {
+            inferredGateways: claim.inferredGateways,
+            response: fetchResult,
+            contextLoader: snapshot?.loader,
           });
-          throw e;
         } finally {
-          span.end();
+          snapshot?.release();
         }
       });
     }
@@ -319,18 +386,35 @@ async function* generateProperty(
         if (this.${await getFieldName(property.uri)}.length < 1) return null;
         let v = this.${await getFieldName(property.uri)}[0];
         if (!(v instanceof URL) &&
-            v.id != null &&
-            !isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
             !this.${await getFieldName(property.uri, "#_trust")}.has(0)) {
-          v = v.id;
+          if (v.id == null) {
+            if (isUnsecuredPortableObject(this)) {
+              warnUnverifiableEmbeddedObject(this, ${
+        JSON.stringify(property.uri)
+      });
+              return null;
+            }
+          } else if (
+            !isTrustedIriOrigin(options, v.id, ${trustOwner}) ||
+            isUnsecuredPortableObject(this) ||
+            mustDereferencePortableObject(this, ${trustOwner}, v.id, options)
+          ) {
+            v = v.id;
+          }
         }
         if (v instanceof URL) {
           const fetched =
             await this.#fetch${pascalCase(property.singularName)}(v, options);
           if (fetched == null) return null;
+          // Not cached, so that it is verified when the portable object
+          // policy applies later:
+          if (isUnverifiedPortableClaim(fetched)) return fetched;
           this.${await getFieldName(property.uri)}[0] = fetched;
           this.${await getFieldName(property.uri, "#_trust")}.add(0);
           this._cachedJsonLd = undefined;
+          recordPortableReferrer(this, fetched, ${
+        JSON.stringify(property.uri)
+      });
           return fetched;
         }
       `;
@@ -360,9 +444,13 @@ async function* generateProperty(
       }
       yield `
         if (v?.id != null &&
-            ${
+            ((${
         type.trustEmbeddedObjects === false ? "" : "this.id != null && "
-      }!isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
+      }!isTrustedIriOrigin(options, v.id, ${trustOwner})) ||
+              isUnsecuredPortableObject(this) ||
+              mustDereferencePortableObject(
+                this, ${trustOwner}, v.id, options,
+              )) &&
             !this.${await getFieldName(property.uri, "#_trust")}.has(0)) {
           if (options.crossOrigin === "throw") {
             throw new Error(
@@ -370,7 +458,7 @@ async function* generateProperty(
               "origin than the property owner's @id (" + ${
         type.trustEmbeddedObjects === false
           ? '"untrusted metadata"'
-          : "this.id.href"
+          : "(this.id?.href ?? null)"
       } + "); " +
               "refusing to return the object.  If you want to bypass this " +
               "check and are aware of the security implications, set the " +
@@ -386,11 +474,12 @@ async function* generateProperty(
             { objectId: v.id.href, parentObjectId: ${
         type.trustEmbeddedObjects === false
           ? '"untrusted metadata"'
-          : "this.id.href"
+          : "(this.id?.href ?? null)"
       } },
           );
           return null;
         }
+        recordPortableReferrer(this, v, ${JSON.stringify(property.uri)});
         return v;
       }
       `;
@@ -437,18 +526,38 @@ async function* generateProperty(
         for (let i = 0; i < vs.length; i++) {
           let v = vs[i];
           if (!(v instanceof URL) &&
-              v.id != null &&
-              !isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
               !this.${await getFieldName(property.uri, "#_trust")}.has(i)) {
-            v = v.id;
+            if (v.id == null) {
+              if (isUnsecuredPortableObject(this)) {
+                warnUnverifiableEmbeddedObject(this, ${
+        JSON.stringify(property.uri)
+      });
+                continue;
+              }
+            } else if (
+              !isTrustedIriOrigin(options, v.id, ${trustOwner}) ||
+              isUnsecuredPortableObject(this) ||
+              mustDereferencePortableObject(this, ${trustOwner}, v.id, options)
+            ) {
+              v = v.id;
+            }
           }
           if (v instanceof URL) {
             const fetched =
               await this.#fetch${pascalCase(property.singularName)}(v, options);
             if (fetched == null) continue;
+            // Not cached, so that it is verified when the portable object
+            // policy applies later:
+            if (isUnverifiedPortableClaim(fetched)) {
+              yield fetched;
+              continue;
+            }
             vs[i] = fetched;
             this.${await getFieldName(property.uri, "#_trust")}.add(i);
             this._cachedJsonLd = undefined;
+            recordPortableReferrer(this, fetched, ${
+        JSON.stringify(property.uri)
+      });
             yield fetched;
             continue;
           }
@@ -479,9 +588,13 @@ async function* generateProperty(
       }
       yield `
           if (v?.id != null &&
-              ${
+              ((${
         type.trustEmbeddedObjects === false ? "" : "this.id != null && "
-      }!isTrustedIriOrigin(options, v.id, ${trustOwner}) &&
+      }!isTrustedIriOrigin(options, v.id, ${trustOwner})) ||
+                isUnsecuredPortableObject(this) ||
+                mustDereferencePortableObject(
+                  this, ${trustOwner}, v.id, options,
+                )) &&
               !this.${await getFieldName(property.uri, "#_trust")}.has(i)) {
             if (options.crossOrigin === "throw") {
               throw new Error(
@@ -489,7 +602,7 @@ async function* generateProperty(
                 "origin than the property owner's @id (" + ${
         type.trustEmbeddedObjects === false
           ? '"untrusted metadata"'
-          : "this.id.href"
+          : "(this.id?.href ?? null)"
       } + "); " +
                 "refusing to return the object.  If you want to bypass this " +
                 "check and are aware of the security implications, set the " +
@@ -505,11 +618,12 @@ async function* generateProperty(
               { objectId: v.id.href, parentObjectId: ${
         type.trustEmbeddedObjects === false
           ? '"untrusted metadata"'
-          : "this.id.href"
+          : "(this.id?.href ?? null)"
       } },
             );
             continue;
           }
+          recordPortableReferrer(this, v, ${JSON.stringify(property.uri)});
           yield v;
         }
       }