@fedify/vocab 2.0.35-dev.2470 → 2.0.35-dev.2485

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab",
-  "version": "2.0.35-dev.2470+891ba128",
+  "version": "2.0.35-dev.2485+75206550",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts"

package/dist/mod.cjs

@@ -33,7 +33,7 @@ let _fedify_vocab_runtime_temporal = require("@fedify/vocab-runtime/temporal");
 let es_toolkit = require("es-toolkit");
 //#region deno.json
 var name = "@fedify/vocab";
-var version = "2.0.35-dev.2470+891ba128";
+var version = "2.0.35-dev.2485+75206550";
 //#endregion
 //#region src/type.ts
 function getTypeId(object) {

package/dist/mod.js

@@ -9,7 +9,7 @@ import { isTemporalDuration, isTemporalInstant } from "@fedify/vocab-runtime/tem
 import { delay } from "es-toolkit";
 //#region deno.json
 var name = "@fedify/vocab";
-var version = "2.0.35-dev.2470+891ba128";
+var version = "2.0.35-dev.2485+75206550";
 //#endregion
 //#region src/type.ts
 function getTypeId(object) {

package/dist-tests/actor.test.mjs

@@ -1,7 +1,7 @@
 import "@js-temporal/polyfill";
 globalThis.addEventListener = () => {};
 import { b as Service, g as Person, h as Organization, i as Application, l as Group, w as __exportAll } from "./vocab-4POt9BSw.mjs";
-import { n as version, r as esm_default, t as name } from "./deno-Br3-WDen.mjs";
+import { n as version, r as esm_default, t as name } from "./deno-CMV97EJ4.mjs";
 import { t as getTypeId } from "./type-Cf-vxmre.mjs";
 import { test } from "@fedify/fixture";
 import { deepStrictEqual, ok, rejects, strictEqual, throws } from "node:assert/strict";

package/dist-tests/{deno-Br3-WDen.mjs → deno-CMV97EJ4.mjs}

@@ -1204,6 +1204,6 @@ var esm_default = new class FetchMock {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab";
-var version = "2.0.35-dev.2470+891ba128";
+var version = "2.0.35-dev.2485+75206550";
 //#endregion
 export { version as n, esm_default as r, name as t };

package/dist-tests/lookup.test.mjs

@@ -1,7 +1,7 @@
 import { Temporal } from "@js-temporal/polyfill";
 globalThis.addEventListener = () => {};
 import { a as Collection, f as Note, g as Person, p as Object$1 } from "./vocab-4POt9BSw.mjs";
-import { n as version, r as esm_default, t as name } from "./deno-Br3-WDen.mjs";
+import { n as version, r as esm_default, t as name } from "./deno-CMV97EJ4.mjs";
 import { t as getTypeId } from "./type-Cf-vxmre.mjs";
 import { t as assertInstanceOf } from "./utils-CE8Dk5hm.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
@@ -220,6 +220,7 @@ async function* traverseCollection(collection, options = {}) {
 }
 //#endregion
 //#region src/lookup.test.ts
+const allowPrivateAddress = { allowPrivateAddress: true };
 test("lookupObject()", {
 	sanitizeResources: false,
 	sanitizeOps: false
@@ -247,7 +248,8 @@ test("lookupObject()", {
 	});
 	const options = {
 		documentLoader: mockDocumentLoader,
-		contextLoader: mockDocumentLoader
+		contextLoader: mockDocumentLoader,
+		...allowPrivateAddress
 	};
 	await t.step("actor", async () => {
 		const person = await lookupObject("@johndoe@example.com", options);
@@ -538,15 +540,18 @@ test("FEP-fe34: lookupObject() cross-origin security", {
 			throw new Error(`Unexpected URL: ${url}`);
 		};
 		deepStrictEqual(await lookupObject("@user@example.com", {
+			...allowPrivateAddress,
 			documentLoader: webfingerDocumentLoader,
 			contextLoader: mockDocumentLoader
 		}), null);
 		await rejects(() => lookupObject("@user@example.com", {
+			...allowPrivateAddress,
 			documentLoader: webfingerDocumentLoader,
 			contextLoader: mockDocumentLoader,
 			crossOrigin: "throw"
 		}), Error, "The object's @id (https://malicious.com/fake-actor) has a different origin than the document URL (https://different-origin.com/actor)");
 		const result2 = await lookupObject("@user@example.com", {
+			...allowPrivateAddress,
 			documentLoader: webfingerDocumentLoader,
 			contextLoader: mockDocumentLoader,
 			crossOrigin: "trust"
@@ -617,11 +622,20 @@ test("FEP-fe34: lookupObject() cross-origin security", {
 		const errorDocumentLoader = async (_url) => {
 			throw new Error("Network error");
 		};
-		deepStrictEqual(await lookupObject("https://example.com/note", {
-			documentLoader: errorDocumentLoader,
-			contextLoader: mockDocumentLoader,
-			crossOrigin: "throw"
-		}), null);
+		esm_default.spyGlobal();
+		esm_default.get("begin:https://example.com/.well-known/webfinger", 404);
+		let result;
+		try {
+			result = await lookupObject("https://example.com/note", {
+				...allowPrivateAddress,
+				documentLoader: errorDocumentLoader,
+				contextLoader: mockDocumentLoader,
+				crossOrigin: "throw"
+			});
+		} finally {
+			esm_default.hardReset();
+		}
+		deepStrictEqual(result, null);
 	});
 	await t.step("malformed JSON handling with cross-origin policy", async () => {
 		const malformedJsonDocumentLoader = async (url) => {

package/dist-tests/vocab.test.mjs

@@ -363,7 +363,11 @@ test({
 				}
 			}
 		});
-		deepStrictEqual(await new Activity({ object: new URL("https://example.com/not-found") }).getObject({ suppressError: true }), null);
+		deepStrictEqual(await new Activity({ object: new URL("https://example.com/not-found") }).getObject({
+			documentLoader: mockDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			suppressError: true
+		}), null);
 		const object3 = await (await Activity.fromJsonLd({
 			"@context": "https://www.w3.org/ns/activitystreams",
 			type: "Create",
@@ -400,7 +404,11 @@ test({
 		assertInstanceOf(objects[1], Object$1);
 		deepStrictEqual(objects[1].name, "Second object");
 		const activity2 = new Activity({ objects: [new URL("https://example.com/not-found"), new Object$1({ name: "Second object" })] });
-		const objects2 = await Array.fromAsync(activity2.getObjects({ suppressError: true }));
+		const objects2 = await Array.fromAsync(activity2.getObjects({
+			documentLoader: mockDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			suppressError: true
+		}));
 		deepStrictEqual(objects2.length, 1);
 		assertInstanceOf(objects2[0], Object$1);
 		deepStrictEqual(objects2[0].name, "Second object");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab",
-  "version": "2.0.35-dev.2470+891ba128",
+  "version": "2.0.35-dev.2485+75206550",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -41,14 +41,14 @@
     "@js-temporal/polyfill": "^0.5.1",
     "@multiformats/base-x": "^4.0.1",
     "@logtape/logtape": "^2.0.0",
-    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/api": "~1.9.0",
     "asn1js": "^3.0.6",
     "es-toolkit": "1.43.0",
     "jsonld": "^9.0.0",
     "pkijs": "^3.3.3",
-    "@fedify/vocab-tools": "2.0.35-dev.2470+891ba128",
-    "@fedify/webfinger": "2.0.35-dev.2470+891ba128",
-    "@fedify/vocab-runtime": "2.0.35-dev.2470+891ba128"
+    "@fedify/vocab-tools": "2.0.35-dev.2485+75206550",
+    "@fedify/vocab-runtime": "2.0.35-dev.2485+75206550",
+    "@fedify/webfinger": "2.0.35-dev.2485+75206550"
   },
   "devDependencies": {
     "@types/node": "^22.17.0",

package/src/lookup.test.ts

@@ -9,6 +9,12 @@ import { lookupObject, traverseCollection } from "./lookup.ts";
 import { assertInstanceOf } from "./utils.ts";
 import { Collection, Note, Object, Person } from "./vocab.ts";
 
+// lookupObject() accepts this option without declaring it, since Fedify's
+// Context passes it.  It makes WebFinger lookups use the global fetch()
+// (fetch-mock here) without resolving hostnames, so that the tests do not
+// depend on the real DNS:
+const allowPrivateAddress = { allowPrivateAddress: true };
+
 test("lookupObject()", {
   sanitizeResources: false,
   sanitizeOps: false,
@@ -42,6 +48,7 @@ test("lookupObject()", {
   const options = {
     documentLoader: mockDocumentLoader,
     contextLoader: mockDocumentLoader,
+    ...allowPrivateAddress,
   };
 
   await t.step("actor", async () => {
@@ -479,6 +486,7 @@ test("FEP-fe34: lookupObject() cross-origin security", {
 
     // Default behavior should return null
     const result1 = await lookupObject("@user@example.com", {
+      ...allowPrivateAddress,
       documentLoader: webfingerDocumentLoader,
       contextLoader: mockDocumentLoader,
     });
@@ -488,6 +496,7 @@ test("FEP-fe34: lookupObject() cross-origin security", {
     await rejects(
       () =>
         lookupObject("@user@example.com", {
+          ...allowPrivateAddress,
           documentLoader: webfingerDocumentLoader,
           contextLoader: mockDocumentLoader,
           crossOrigin: "throw",
@@ -498,6 +507,7 @@ test("FEP-fe34: lookupObject() cross-origin security", {
 
     // With crossOrigin: trust, should return the object
     const result2 = await lookupObject("@user@example.com", {
+      ...allowPrivateAddress,
       documentLoader: webfingerDocumentLoader,
       contextLoader: mockDocumentLoader,
       crossOrigin: "trust",
@@ -597,12 +607,22 @@ test("FEP-fe34: lookupObject() cross-origin security", {
       throw new Error("Network error");
     };
 
+    // The WebFinger fallback must not reach the network:
+    fetchMock.spyGlobal();
+    fetchMock.get("begin:https://example.com/.well-known/webfinger", 404);
+
     // Network errors should not be confused with cross-origin errors
-    const result = await lookupObject("https://example.com/note", {
-      documentLoader: errorDocumentLoader,
-      contextLoader: mockDocumentLoader,
-      crossOrigin: "throw",
-    });
+    let result;
+    try {
+      result = await lookupObject("https://example.com/note", {
+        ...allowPrivateAddress,
+        documentLoader: errorDocumentLoader,
+        contextLoader: mockDocumentLoader,
+        crossOrigin: "throw",
+      });
+    } finally {
+      fetchMock.hardReset();
+    }
 
     // Should return null because the document loader failed,
     // not because of cross-origin policy

package/src/vocab.test.ts

@@ -548,7 +548,14 @@ test({
     const activity2 = new Activity({
       object: new URL("https://example.com/not-found"),
     });
-    deepStrictEqual(await activity2.getObject({ suppressError: true }), null);
+    deepStrictEqual(
+      await activity2.getObject({
+        documentLoader: mockDocumentLoader,
+        contextLoader: mockDocumentLoader,
+        suppressError: true,
+      }),
+      null,
+    );
 
     const activity3 = await Activity.fromJsonLd({
       "@context": "https://www.w3.org/ns/activitystreams",
@@ -603,7 +610,11 @@ test({
       ],
     });
     const objects2 = await Array.fromAsync(
-      activity2.getObjects({ suppressError: true }),
+      activity2.getObjects({
+        documentLoader: mockDocumentLoader,
+        contextLoader: mockDocumentLoader,
+        suppressError: true,
+      }),
     );
     deepStrictEqual(objects2.length, 1);
     assertInstanceOf(objects2[0], Object);