@fedify/vocab 2.1.30 → 2.1.31

package/dist-tests/vocab.test.mjs

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 globalThis.addEventListener = () => {};
-import { C as vocab_exports, S as Source, _ as Person, a as Collection, b as Question, c as Endpoints, d as Hashtag, f as Link, h as OrderedCollectionPage, l as Follow, m as Object$1, n as Activity, o as Create, p as Note, r as Announce, s as CryptographicKey, t as Accept, v as Place, y as PropertyValue } from "./vocab-BdFWN1ns.mjs";
+import { C as vocab_exports, S as Source, _ as Person, a as Collection, b as Question, c as Endpoints, d as Hashtag, f as Link, h as OrderedCollectionPage, l as Follow, m as Object$1, n as Activity, o as Create, p as Note, r as Announce, s as CryptographicKey, t as Accept, v as Place, y as PropertyValue } from "./vocab-De7fFc2M.mjs";
 import { t as assertInstanceOf } from "./utils-CE8Dk5hm.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, notDeepStrictEqual, ok, rejects, strictEqual, throws } from "node:assert/strict";
@@ -366,7 +366,11 @@ test({
 				}
 			}
 		});
-		deepStrictEqual(await new Activity({ object: new URL("https://example.com/not-found") }).getObject({ suppressError: true }), null);
+		deepStrictEqual(await new Activity({ object: new URL("https://example.com/not-found") }).getObject({
+			documentLoader: mockDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			suppressError: true
+		}), null);
 		const object3 = await (await Activity.fromJsonLd({
 			"@context": "https://www.w3.org/ns/activitystreams",
 			type: "Create",
@@ -403,7 +407,11 @@ test({
 		assertInstanceOf(objects[1], Object$1);
 		deepStrictEqual(objects[1].name, "Second object");
 		const activity2 = new Activity({ objects: [new URL("https://example.com/not-found"), new Object$1({ name: "Second object" })] });
-		const objects2 = await Array.fromAsync(activity2.getObjects({ suppressError: true }));
+		const objects2 = await Array.fromAsync(activity2.getObjects({
+			documentLoader: mockDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			suppressError: true
+		}));
 		deepStrictEqual(objects2.length, 1);
 		assertInstanceOf(objects2[0], Object$1);
 		deepStrictEqual(objects2[0].name, "Second object");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab",
-  "version": "2.1.30",
+  "version": "2.1.31",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -41,14 +41,14 @@
     "@js-temporal/polyfill": "^0.5.1",
     "@multiformats/base-x": "^4.0.1",
     "@logtape/logtape": "^2.0.5",
-    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/api": "~1.9.0",
     "asn1js": "^3.0.6",
     "es-toolkit": "1.43.0",
     "jsonld": "^9.0.0",
     "pkijs": "^3.3.3",
-    "@fedify/vocab-tools": "2.1.30",
-    "@fedify/webfinger": "2.1.30",
-    "@fedify/vocab-runtime": "2.1.30"
+    "@fedify/vocab-tools": "2.1.31",
+    "@fedify/vocab-runtime": "2.1.31",
+    "@fedify/webfinger": "2.1.31"
   },
   "devDependencies": {
     "@types/node": "^22.17.0",

package/src/lookup.test.ts

@@ -9,6 +9,12 @@ import { lookupObject, traverseCollection } from "./lookup.ts";
 import { assertInstanceOf } from "./utils.ts";
 import { Collection, Note, Object, Person } from "./vocab.ts";
 
+// lookupObject() accepts this option without declaring it, since Fedify's
+// Context passes it.  It makes WebFinger lookups use the global fetch()
+// (fetch-mock here) without resolving hostnames, so that the tests do not
+// depend on the real DNS:
+const allowPrivateAddress = { allowPrivateAddress: true };
+
 test("lookupObject()", {
   sanitizeResources: false,
   sanitizeOps: false,
@@ -42,6 +48,7 @@ test("lookupObject()", {
   const options = {
     documentLoader: mockDocumentLoader,
     contextLoader: mockDocumentLoader,
+    ...allowPrivateAddress,
   };
 
   await t.step("actor", async () => {
@@ -479,6 +486,7 @@ test("FEP-fe34: lookupObject() cross-origin security", {
 
     // Default behavior should return null
     const result1 = await lookupObject("@user@example.com", {
+      ...allowPrivateAddress,
       documentLoader: webfingerDocumentLoader,
       contextLoader: mockDocumentLoader,
     });
@@ -488,6 +496,7 @@ test("FEP-fe34: lookupObject() cross-origin security", {
     await rejects(
       () =>
         lookupObject("@user@example.com", {
+          ...allowPrivateAddress,
           documentLoader: webfingerDocumentLoader,
           contextLoader: mockDocumentLoader,
           crossOrigin: "throw",
@@ -498,6 +507,7 @@ test("FEP-fe34: lookupObject() cross-origin security", {
 
     // With crossOrigin: trust, should return the object
     const result2 = await lookupObject("@user@example.com", {
+      ...allowPrivateAddress,
       documentLoader: webfingerDocumentLoader,
       contextLoader: mockDocumentLoader,
       crossOrigin: "trust",
@@ -597,12 +607,22 @@ test("FEP-fe34: lookupObject() cross-origin security", {
       throw new Error("Network error");
     };
 
+    // The WebFinger fallback must not reach the network:
+    fetchMock.spyGlobal();
+    fetchMock.get("begin:https://example.com/.well-known/webfinger", 404);
+
     // Network errors should not be confused with cross-origin errors
-    const result = await lookupObject("https://example.com/note", {
-      documentLoader: errorDocumentLoader,
-      contextLoader: mockDocumentLoader,
-      crossOrigin: "throw",
-    });
+    let result;
+    try {
+      result = await lookupObject("https://example.com/note", {
+        ...allowPrivateAddress,
+        documentLoader: errorDocumentLoader,
+        contextLoader: mockDocumentLoader,
+        crossOrigin: "throw",
+      });
+    } finally {
+      fetchMock.hardReset();
+    }
 
     // Should return null because the document loader failed,
     // not because of cross-origin policy

package/src/vocab.test.ts

@@ -552,7 +552,14 @@ test({
     const activity2 = new Activity({
       object: new URL("https://example.com/not-found"),
     });
-    deepStrictEqual(await activity2.getObject({ suppressError: true }), null);
+    deepStrictEqual(
+      await activity2.getObject({
+        documentLoader: mockDocumentLoader,
+        contextLoader: mockDocumentLoader,
+        suppressError: true,
+      }),
+      null,
+    );
 
     const activity3 = await Activity.fromJsonLd({
       "@context": "https://www.w3.org/ns/activitystreams",
@@ -607,7 +614,11 @@ test({
       ],
     });
     const objects2 = await Array.fromAsync(
-      activity2.getObjects({ suppressError: true }),
+      activity2.getObjects({
+        documentLoader: mockDocumentLoader,
+        contextLoader: mockDocumentLoader,
+        suppressError: true,
+      }),
     );
     deepStrictEqual(objects2.length, 1);
     assertInstanceOf(objects2[0], Object);