@fedify/vocab 2.3.14 → 2.3.15

package/dist-tests/vocab.test.mjs

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 globalThis.addEventListener = () => {};
-import { A as Question, C as Offer, D as Place, E as Person, F as Source, I as Tombstone, M as QuoteRequest, N as Reject, O as PropertyValue, S as Object$1, _ as InteractionPolicy, b as Measure, c as Create, d as Document, f as Endpoints, g as Intent, h as Hashtag, i as Announce, j as QuoteAuthorization, k as Proposal, l as CryptographicKey, n as Activity, o as Collection, p as Follow, r as Agreement, s as Commitment, t as Accept, u as Delete, v as InteractionRule, w as OrderedCollectionPage, x as Note, y as Link, z as vocab_exports } from "./vocab-Cyuznh-0.mjs";
+import { A as Question, C as Offer, D as Place, E as Person, F as Source, I as Tombstone, M as QuoteRequest, N as Reject, O as PropertyValue, S as Object$1, _ as InteractionPolicy, b as Measure, c as Create, d as Document, f as Endpoints, g as Intent, h as Hashtag, i as Announce, j as QuoteAuthorization, k as Proposal, l as CryptographicKey, n as Activity, o as Collection, p as Follow, r as Agreement, s as Commitment, t as Accept, u as Delete, v as InteractionRule, w as OrderedCollectionPage, x as Note, y as Link, z as vocab_exports } from "./vocab-DHuK2moR.mjs";
 import { t as assertInstanceOf } from "./utils-CE8Dk5hm.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, notDeepStrictEqual, ok, rejects, strictEqual, throws } from "node:assert/strict";
@@ -424,7 +424,11 @@ test({
 				}
 			}
 		});
-		deepStrictEqual(await new Activity({ object: new URL("https://example.com/not-found") }).getObject({ suppressError: true }), null);
+		deepStrictEqual(await new Activity({ object: new URL("https://example.com/not-found") }).getObject({
+			documentLoader: mockDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			suppressError: true
+		}), null);
 		const object3 = await (await Activity.fromJsonLd({
 			"@context": "https://www.w3.org/ns/activitystreams",
 			type: "Create",
@@ -461,7 +465,11 @@ test({
 		assertInstanceOf(objects[1], Object$1);
 		deepStrictEqual(objects[1].name, "Second object");
 		const activity2 = new Activity({ objects: [new URL("https://example.com/not-found"), new Object$1({ name: "Second object" })] });
-		const objects2 = await Array.fromAsync(activity2.getObjects({ suppressError: true }));
+		const objects2 = await Array.fromAsync(activity2.getObjects({
+			documentLoader: mockDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			suppressError: true
+		}));
 		deepStrictEqual(objects2.length, 1);
 		assertInstanceOf(objects2[0], Object$1);
 		deepStrictEqual(objects2[0].name, "Second object");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab",
-  "version": "2.3.14",
+  "version": "2.3.15",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -41,14 +41,14 @@
     "@js-temporal/polyfill": "^0.5.1",
     "@multiformats/base-x": "^4.0.1",
     "@logtape/logtape": "^2.2.0",
-    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/api": "~1.9.1",
     "asn1js": "^3.0.10",
     "es-toolkit": "1.46.1",
     "jsonld": "^9.0.0",
     "pkijs": "^3.3.3",
-    "@fedify/vocab-tools": "2.3.14",
-    "@fedify/vocab-runtime": "2.3.14",
-    "@fedify/webfinger": "2.3.14"
+    "@fedify/vocab-runtime": "2.3.15",
+    "@fedify/vocab-tools": "2.3.15",
+    "@fedify/webfinger": "2.3.15"
   },
   "devDependencies": {
     "@types/node": "^22.17.0",

package/src/lookup.test.ts

@@ -10,10 +10,17 @@ import { lookupObject, traverseCollection } from "./lookup.ts";
 import { assertInstanceOf } from "./utils.ts";
 import { Collection, Note, Object, Person } from "./vocab.ts";
 
+// lookupObject() accepts this option without declaring it, since Fedify's
+// Context passes it.  It makes WebFinger lookups use the global fetch()
+// (fetch-mock here) without resolving hostnames, so that the tests do not
+// depend on the real DNS:
+const allowPrivateAddress = { allowPrivateAddress: true };
+
 test("lookupObject()", {
   sanitizeResources: false,
   sanitizeOps: false,
 }, async (t) => {
+  const responseTimers: ReturnType<typeof setTimeout>[] = [];
   fetchMock.spyGlobal();
 
   fetchMock.get(
@@ -43,6 +50,7 @@ test("lookupObject()", {
   const options = {
     documentLoader: mockDocumentLoader,
     contextLoader: mockDocumentLoader,
+    ...allowPrivateAddress,
   };
 
   await t.step("actor", async () => {
@@ -106,7 +114,7 @@ test("lookupObject()", {
     "begin:https://example.com/.well-known/webfinger",
     () =>
       new Promise((resolve) => {
-        setTimeout(() => {
+        responseTimers.push(setTimeout(() => {
           resolve({
             subject: "acct:johndoe@example.com",
             links: [
@@ -117,7 +125,7 @@ test("lookupObject()", {
               },
             ],
           });
-        }, 1000);
+        }, 1000));
       }),
   );
 
@@ -162,7 +170,7 @@ test("lookupObject()", {
     "begin:https://example.com/.well-known/webfinger",
     () =>
       new Promise((resolve) => {
-        setTimeout(() => {
+        responseTimers.push(setTimeout(() => {
           resolve({
             subject: "acct:johndoe@example.com",
             links: [
@@ -173,7 +181,7 @@ test("lookupObject()", {
               },
             ],
           });
-        }, 500);
+        }, 500));
       }),
   );
 
@@ -193,7 +201,7 @@ test("lookupObject()", {
     "https://example.com/slow-object",
     () =>
       new Promise((resolve) => {
-        setTimeout(() => {
+        responseTimers.push(setTimeout(() => {
           resolve({
             status: 200,
             headers: { "Content-Type": "application/activity+json" },
@@ -203,7 +211,7 @@ test("lookupObject()", {
               content: "Slow response",
             },
           });
-        }, 1000);
+        }, 1000));
       }),
   );
 
@@ -218,6 +226,7 @@ test("lookupObject()", {
     deepStrictEqual(await promise, null);
   });
 
+  for (const timer of responseTimers) clearTimeout(timer);
   fetchMock.hardReset();
   fetchMock.removeRoutes();
 });
@@ -480,6 +489,7 @@ test("FEP-fe34: lookupObject() cross-origin security", {
 
     // Default behavior should return null
     const result1 = await lookupObject("@user@example.com", {
+      ...allowPrivateAddress,
       documentLoader: webfingerDocumentLoader,
       contextLoader: mockDocumentLoader,
     });
@@ -489,6 +499,7 @@ test("FEP-fe34: lookupObject() cross-origin security", {
     await rejects(
       () =>
         lookupObject("@user@example.com", {
+          ...allowPrivateAddress,
           documentLoader: webfingerDocumentLoader,
           contextLoader: mockDocumentLoader,
           crossOrigin: "throw",
@@ -499,6 +510,7 @@ test("FEP-fe34: lookupObject() cross-origin security", {
 
     // With crossOrigin: trust, should return the object
     const result2 = await lookupObject("@user@example.com", {
+      ...allowPrivateAddress,
       documentLoader: webfingerDocumentLoader,
       contextLoader: mockDocumentLoader,
       crossOrigin: "trust",
@@ -598,12 +610,22 @@ test("FEP-fe34: lookupObject() cross-origin security", {
       throw new Error("Network error");
     };
 
+    // The WebFinger fallback must not reach the network:
+    fetchMock.spyGlobal();
+    fetchMock.get("begin:https://example.com/.well-known/webfinger", 404);
+
     // Network errors should not be confused with cross-origin errors
-    const result = await lookupObject("https://example.com/note", {
-      documentLoader: errorDocumentLoader,
-      contextLoader: mockDocumentLoader,
-      crossOrigin: "throw",
-    });
+    let result;
+    try {
+      result = await lookupObject("https://example.com/note", {
+        ...allowPrivateAddress,
+        documentLoader: errorDocumentLoader,
+        contextLoader: mockDocumentLoader,
+        crossOrigin: "throw",
+      });
+    } finally {
+      fetchMock.hardReset();
+    }
 
     // Should return null because the document loader failed,
     // not because of cross-origin policy
@@ -721,6 +743,7 @@ test("lookupObject() records activitypub.object.lookup counter", {
     await t.step("records kind=actor for an actor result", async () => {
       const [meterProvider, recorder] = createTestMeterProvider();
       const person = await lookupObject("@johndoe@example.com", {
+        ...allowPrivateAddress,
         documentLoader: mockDocumentLoader,
         contextLoader: mockDocumentLoader,
         meterProvider,
@@ -807,6 +830,7 @@ test("lookupObject() records activitypub.object.lookup counter", {
       });
       const [meterProvider, recorder] = createTestMeterProvider();
       const result = await lookupObject("janedoe@example.com", {
+        ...allowPrivateAddress,
         documentLoader: mockDocumentLoader,
         contextLoader: mockDocumentLoader,
         meterProvider,
@@ -858,6 +882,7 @@ test("lookupObject() records activitypub.object.lookup counter", {
         );
         const [meterProvider, recorder] = createTestMeterProvider();
         await lookupObject("@johndoe@example.com", {
+          ...allowPrivateAddress,
           documentLoader: mockDocumentLoader,
           contextLoader: mockDocumentLoader,
           meterProvider,
@@ -891,6 +916,7 @@ test("lookupObject() records activitypub.object.lookup counter", {
         });
         const [meterProvider, recorder] = createTestMeterProvider();
         await lookupObject(new URL("acct:johndoe@example.com"), {
+          ...allowPrivateAddress,
           documentLoader: mockDocumentLoader,
           contextLoader: mockDocumentLoader,
           meterProvider,

package/src/vocab.test.ts

@@ -631,7 +631,14 @@ test({
     const activity2 = new Activity({
       object: new URL("https://example.com/not-found"),
     });
-    deepStrictEqual(await activity2.getObject({ suppressError: true }), null);
+    deepStrictEqual(
+      await activity2.getObject({
+        documentLoader: mockDocumentLoader,
+        contextLoader: mockDocumentLoader,
+        suppressError: true,
+      }),
+      null,
+    );
 
     const activity3 = await Activity.fromJsonLd({
       "@context": "https://www.w3.org/ns/activitystreams",
@@ -686,7 +693,11 @@ test({
       ],
     });
     const objects2 = await Array.fromAsync(
-      activity2.getObjects({ suppressError: true }),
+      activity2.getObjects({
+        documentLoader: mockDocumentLoader,
+        contextLoader: mockDocumentLoader,
+        suppressError: true,
+      }),
     );
     deepStrictEqual(objects2.length, 1);
     assertInstanceOf(objects2[0], Object);