@fedify/vocab 2.0.30 → 2.0.31-dev.2297

package/dist-tests/vocab.test.mjs

@@ -1,9 +1,9 @@
 import { Temporal } from "@js-temporal/polyfill";
 globalThis.addEventListener = () => {};
-import { _ as PropertyValue, a as Create, b as Source, d as Note, f as Object$1, g as Place, h as Person, i as Collection, l as Hashtag, n as Announce, o as CryptographicKey, p as OrderedCollectionPage, s as Follow, t as Activity, u as Link, v as Question, x as vocab_exports } from "./vocab-Ci3g_-fe.mjs";
+import { S as vocab_exports, _ as Place, a as Collection, c as Follow, d as Link, f as Note, g as Person, m as OrderedCollectionPage, n as Activity, o as Create, p as Object$1, r as Announce, s as CryptographicKey, t as Accept, u as Hashtag, v as PropertyValue, x as Source, y as Question } from "./vocab-ChQFW7FV.mjs";
 import { t as assertInstanceOf } from "./utils-CE8Dk5hm.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
-import { deepStrictEqual, notDeepStrictEqual, ok, rejects, throws } from "node:assert/strict";
+import { deepStrictEqual, notDeepStrictEqual, ok, rejects, strictEqual, throws } from "node:assert/strict";
 import { LanguageString, decodeMultibase } from "@fedify/vocab-runtime";
 import { pascalCase } from "es-toolkit";
 import { areAllScalarTypes, loadSchemaFiles } from "@fedify/vocab-tools";
@@ -839,6 +839,158 @@ test("FEP-fe34: Trust tracking in object cloning", () => {
 	});
 	deepStrictEqual(create.clone({ object: newNote }).objectId, new URL("https://example.com/new-note"));
 });
+for (const property of ["object", "attachment"]) for (const fetchOriginal of [false, true]) test(`clone() isolates ${property} dereferencing (${fetchOriginal ? "original" : "clone"} first)`, async () => {
+	const embedded = {
+		id: "https://b.example/notes/1",
+		type: "Note",
+		content: "embedded"
+	};
+	const json = {
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://a.example/activities/1",
+		type: "Create",
+		[property]: embedded
+	};
+	const original = await Create.fromJsonLd(json, { contextLoader: mockDocumentLoader });
+	const copy = original.clone();
+	const fetching = fetchOriginal ? original : copy;
+	const untouched = fetchOriginal ? copy : original;
+	let fetches = 0;
+	const documentLoader = async (url) => {
+		fetches++;
+		return {
+			contextUrl: null,
+			documentUrl: url,
+			document: {
+				"@context": "https://www.w3.org/ns/activitystreams",
+				...embedded,
+				content: "fetched"
+			}
+		};
+	};
+	const options = {
+		documentLoader,
+		contextLoader: mockDocumentLoader
+	};
+	const fetched = property === "object" ? await fetching.getObject(options) : (await Array.fromAsync(fetching.getAttachments(options)))[0];
+	assertInstanceOf(fetched, Note);
+	deepStrictEqual(fetched.content, "fetched");
+	const trusted = { crossOrigin: "trust" };
+	const preserved = property === "object" ? await untouched.getObject(trusted) : (await Array.fromAsync(untouched.getAttachments(trusted)))[0];
+	assertInstanceOf(preserved, Note);
+	deepStrictEqual(preserved.content, "embedded");
+	deepStrictEqual((await original.toJsonLd())[property], fetchOriginal ? {
+		...embedded,
+		content: "fetched"
+	} : embedded);
+	const nested = (await new Accept({ object: untouched }).toJsonLd()).object;
+	deepStrictEqual(nested[property], embedded);
+	strictEqual(property === "object" ? await fetching.getObject(options) : (await Array.fromAsync(fetching.getAttachments(options)))[0], fetched);
+	deepStrictEqual(fetches, 1);
+	const independentlyFetched = property === "object" ? await untouched.getObject(options) : (await Array.fromAsync(untouched.getAttachments(options)))[0];
+	assertInstanceOf(independentlyFetched, Note);
+	deepStrictEqual(independentlyFetched.content, "fetched");
+	deepStrictEqual(fetches, 2);
+	const warmedClone = fetching.clone();
+	strictEqual(property === "object" ? await warmedClone.getObject(options) : (await Array.fromAsync(warmedClone.getAttachments(options)))[0], fetched);
+	deepStrictEqual(fetches, 2);
+});
+for (const clone of [false, true]) for (const frozen of [false, true]) test(`${clone ? "clone()" : "constructor"} copies ${frozen ? "frozen" : "mutable"} plural arrays`, async () => {
+	const items = [new URL("https://example.com/object"), new URL("https://example.com/object")];
+	const before = items.slice();
+	if (frozen) globalThis.Object.freeze(items);
+	const base = new Collection({});
+	const collection = clone ? base.clone({ items }) : new Collection({ items });
+	const sibling = clone ? base.clone({ items }) : new Collection({ items });
+	const fetched = await Array.fromAsync(collection.getItems({
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	}));
+	deepStrictEqual(fetched.length, 2);
+	deepStrictEqual(fetched.map((item) => item.name), ["Fetched object", "Fetched object"]);
+	deepStrictEqual(items, before);
+	strictEqual(items[0], before[0]);
+	strictEqual(items[1], before[1]);
+	deepStrictEqual((await sibling.toJsonLd()).items, before.map(String));
+	if (!frozen) {
+		items.push(new URL("https://example.com/extra"));
+		deepStrictEqual(collection.itemIds, before);
+		deepStrictEqual(sibling.itemIds, before);
+	}
+});
+test("clone() copies scalar arrays without changing sparse inputs", () => {
+	const names = ["original"];
+	const original = new Object$1({ names });
+	names.push("caller mutation");
+	deepStrictEqual(original.names, ["original"]);
+	const copy = original.clone();
+	copy.names.push("clone mutation");
+	deepStrictEqual(original.names, ["original"]);
+	deepStrictEqual(copy.names, ["original", "clone mutation"]);
+	const replacements = ["replacement"];
+	const replaced = original.clone({ names: replacements });
+	replacements.push("caller mutation");
+	deepStrictEqual(replaced.names, ["replacement"]);
+	const sparseNames = new Array(2);
+	sparseNames[1] = "kept";
+	const sparse = new Object$1({ names: sparseNames });
+	for (const instance of [
+		sparse,
+		sparse.clone(),
+		sparse.clone({ names: sparse.names })
+	]) {
+		deepStrictEqual(instance.names.length, 2);
+		deepStrictEqual(0 in instance.names, false);
+		deepStrictEqual(instance.names[1], "kept");
+	}
+});
+test("clone() preserves embedded object identity and trust", async () => {
+	const note = new Note({ id: new URL("https://b.example/note") });
+	const original = new Create({
+		id: new URL("https://a.example/create"),
+		object: note
+	});
+	const documentLoader = async () => {
+		throw new Error("Trusted embedded objects must not be fetched.");
+	};
+	for (const instance of [
+		original,
+		original.clone(),
+		original.clone({ objects: [note] })
+	]) {
+		strictEqual(await instance.getObject({ documentLoader }), note);
+		strictEqual(instance.objectId, note.id);
+	}
+});
+test("clone() isolates crossOrigin trust when fetching", async () => {
+	const original = new Create({
+		id: new URL("https://a.example/create"),
+		object: new URL("https://b.example/note")
+	});
+	const copy = original.clone();
+	const documentLoader = async (url) => ({
+		contextUrl: null,
+		documentUrl: url,
+		document: {
+			"@context": "https://www.w3.org/ns/activitystreams",
+			id: "https://other.example/note",
+			type: "Note",
+			content: "cross-origin"
+		}
+	});
+	const options = {
+		documentLoader,
+		contextLoader: mockDocumentLoader
+	};
+	const trusted = await copy.getObject({
+		...options,
+		crossOrigin: "trust"
+	});
+	assertInstanceOf(trusted, Note);
+	deepStrictEqual(trusted.content, "cross-origin");
+	deepStrictEqual(await original.getObject(options), null);
+	deepStrictEqual(original.objectId, new URL("https://b.example/note"));
+});
 test("FEP-fe34: crossOrigin ignore behavior (default)", async () => {
 	const crossOriginDocumentLoader = async (url) => {
 		if (url === "https://different-origin.com/note") return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab",
-  "version": "2.0.30",
+  "version": "2.0.31-dev.2297+58cbc917",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -46,9 +46,9 @@
     "es-toolkit": "1.43.0",
     "jsonld": "^9.0.0",
     "pkijs": "^3.3.3",
-    "@fedify/vocab-tools": "2.0.30",
-    "@fedify/vocab-runtime": "2.0.30",
-    "@fedify/webfinger": "2.0.30"
+    "@fedify/vocab-tools": "2.0.31-dev.2297+58cbc917",
+    "@fedify/webfinger": "2.0.31-dev.2297+58cbc917",
+    "@fedify/vocab-runtime": "2.0.31-dev.2297+58cbc917"
   },
   "devDependencies": {
     "@types/node": "^22.17.0",

package/src/vocab.test.ts

@@ -12,11 +12,13 @@ import {
   notDeepStrictEqual,
   ok,
   rejects,
+  strictEqual,
   throws,
 } from "node:assert/strict";
 import { assertInstanceOf } from "./utils.ts";
 import * as vocab from "./vocab.ts";
 import {
+  Accept,
   Activity,
   Announce,
   Collection,
@@ -1279,6 +1281,216 @@ test("FEP-fe34: Trust tracking in object cloning", () => {
   );
 });
 
+for (const property of ["object", "attachment"] as const) {
+  for (const fetchOriginal of [false, true]) {
+    test(
+      `clone() isolates ${property} dereferencing (${
+        fetchOriginal ? "original" : "clone"
+      } first)`,
+      async () => {
+        const embedded = {
+          id: "https://b.example/notes/1",
+          type: "Note",
+          content: "embedded",
+        };
+        const json = {
+          "@context": "https://www.w3.org/ns/activitystreams",
+          id: "https://a.example/activities/1",
+          type: "Create",
+          [property]: embedded,
+        };
+        const original = await Create.fromJsonLd(json, {
+          contextLoader: mockDocumentLoader,
+        });
+        const copy = original.clone();
+        const fetching = fetchOriginal ? original : copy;
+        const untouched = fetchOriginal ? copy : original;
+        let fetches = 0;
+        // deno-lint-ignore require-await
+        const documentLoader = async (url: string) => {
+          fetches++;
+          return {
+            contextUrl: null,
+            documentUrl: url,
+            document: {
+              "@context": "https://www.w3.org/ns/activitystreams",
+              ...embedded,
+              content: "fetched",
+            },
+          };
+        };
+        const options = { documentLoader, contextLoader: mockDocumentLoader };
+        const fetched = property === "object"
+          ? await fetching.getObject(options)
+          : (await Array.fromAsync(fetching.getAttachments(options)))[0];
+        assertInstanceOf(fetched, Note);
+        deepStrictEqual(fetched.content, "fetched");
+
+        // Inspect the other instance before it fetches anything itself.
+        const trusted = { crossOrigin: "trust" as const };
+        const preserved = property === "object"
+          ? await untouched.getObject(trusted)
+          : (await Array.fromAsync(untouched.getAttachments(trusted)))[0];
+        assertInstanceOf(preserved, Note);
+        deepStrictEqual(preserved.content, "embedded");
+        const serialized = await original.toJsonLd() as Record<string, unknown>;
+        deepStrictEqual(
+          serialized[property],
+          fetchOriginal ? { ...embedded, content: "fetched" } : embedded,
+        );
+        const accept = new Accept({ object: untouched });
+        const acceptJson = await accept.toJsonLd() as {
+          object: Record<string, unknown>;
+        };
+        const nested = acceptJson.object;
+        deepStrictEqual(nested[property], embedded);
+
+        // Successful lookups and their trust metadata belong to each instance.
+        const cached = property === "object"
+          ? await fetching.getObject(options)
+          : (await Array.fromAsync(fetching.getAttachments(options)))[0];
+        strictEqual(cached, fetched);
+        deepStrictEqual(fetches, 1);
+        const independentlyFetched = property === "object"
+          ? await untouched.getObject(options)
+          : (await Array.fromAsync(untouched.getAttachments(options)))[0];
+        assertInstanceOf(independentlyFetched, Note);
+        deepStrictEqual(independentlyFetched.content, "fetched");
+        deepStrictEqual(fetches, 2);
+        const warmedClone = fetching.clone();
+        strictEqual(
+          property === "object"
+            ? await warmedClone.getObject(options)
+            : (await Array.fromAsync(warmedClone.getAttachments(options)))[0],
+          fetched,
+        );
+        deepStrictEqual(fetches, 2);
+      },
+    );
+  }
+}
+
+for (const clone of [false, true]) {
+  for (const frozen of [false, true]) {
+    test(
+      `${clone ? "clone()" : "constructor"} copies ${
+        frozen ? "frozen" : "mutable"
+      } plural arrays`,
+      async () => {
+        const items = [
+          new URL("https://example.com/object"),
+          new URL("https://example.com/object"),
+        ];
+        const before = items.slice();
+        if (frozen) globalThis.Object.freeze(items);
+        const base = new Collection({});
+        const collection = clone
+          ? base.clone({ items })
+          : new Collection({ items });
+        const sibling = clone
+          ? base.clone({ items })
+          : new Collection({ items });
+        const fetched = await Array.fromAsync(collection.getItems({
+          documentLoader: mockDocumentLoader,
+          contextLoader: mockDocumentLoader,
+        }));
+        deepStrictEqual(fetched.length, 2);
+        deepStrictEqual(fetched.map((item) => item.name), [
+          "Fetched object",
+          "Fetched object",
+        ]);
+        deepStrictEqual(items, before);
+        strictEqual(items[0], before[0]);
+        strictEqual(items[1], before[1]);
+        const siblingJson = await sibling.toJsonLd() as { items: unknown };
+        deepStrictEqual(siblingJson.items, before.map(String));
+        if (!frozen) {
+          items.push(new URL("https://example.com/extra"));
+          deepStrictEqual(collection.itemIds, before);
+          deepStrictEqual(sibling.itemIds, before);
+        }
+      },
+    );
+  }
+}
+
+test("clone() copies scalar arrays without changing sparse inputs", () => {
+  const names = ["original"];
+  const original = new Object({ names });
+  names.push("caller mutation");
+  deepStrictEqual(original.names, ["original"]);
+  const copy = original.clone();
+  copy.names.push("clone mutation");
+  deepStrictEqual(original.names, ["original"]);
+  deepStrictEqual(copy.names, ["original", "clone mutation"]);
+  const replacements = ["replacement"];
+  const replaced = original.clone({ names: replacements });
+  replacements.push("caller mutation");
+  deepStrictEqual(replaced.names, ["replacement"]);
+
+  const sparseNames = new Array<string>(2);
+  sparseNames[1] = "kept";
+  const sparse = new Object({ names: sparseNames });
+  for (
+    const instance of [
+      sparse,
+      sparse.clone(),
+      sparse.clone({ names: sparse.names }),
+    ]
+  ) {
+    deepStrictEqual(instance.names.length, 2);
+    deepStrictEqual(0 in instance.names, false);
+    deepStrictEqual(instance.names[1], "kept");
+  }
+});
+
+test("clone() preserves embedded object identity and trust", async () => {
+  const note = new Note({ id: new URL("https://b.example/note") });
+  const original = new Create({
+    id: new URL("https://a.example/create"),
+    object: note,
+  });
+  // deno-lint-ignore require-await
+  const documentLoader = async () => {
+    throw new Error("Trusted embedded objects must not be fetched.");
+  };
+  for (
+    const instance of [
+      original,
+      original.clone(),
+      original.clone({ objects: [note] }),
+    ]
+  ) {
+    strictEqual(await instance.getObject({ documentLoader }), note);
+    strictEqual(instance.objectId, note.id);
+  }
+});
+
+test("clone() isolates crossOrigin trust when fetching", async () => {
+  const original = new Create({
+    id: new URL("https://a.example/create"),
+    object: new URL("https://b.example/note"),
+  });
+  const copy = original.clone();
+  // deno-lint-ignore require-await
+  const documentLoader = async (url: string) => ({
+    contextUrl: null,
+    documentUrl: url,
+    document: {
+      "@context": "https://www.w3.org/ns/activitystreams",
+      id: "https://other.example/note",
+      type: "Note",
+      content: "cross-origin",
+    },
+  });
+  const options = { documentLoader, contextLoader: mockDocumentLoader };
+  const trusted = await copy.getObject({ ...options, crossOrigin: "trust" });
+  assertInstanceOf(trusted, Note);
+  deepStrictEqual(trusted.content, "cross-origin");
+  deepStrictEqual(await original.getObject(options), null);
+  deepStrictEqual(original.objectId, new URL("https://b.example/note"));
+});
+
 test("FEP-fe34: crossOrigin ignore behavior (default)", async () => {
   // Create a mock document loader that returns objects with different origins
   // deno-lint-ignore require-await