@fedify/vocab 2.4.0-dev.2054 → 2.4.0-dev.2063

package/dist-tests/{actor-DT_jVPKe.mjs → actor-hpNVHQvY.mjs}

@@ -1,6 +1,6 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { H as Service, N as Organization, P as Person, a as Application, y as Group } from "./vocab-BJGPw--L.mjs";
+import { F as Person, P as Organization, U as Service, a as Application, b as Group } from "./vocab-DZq1JW3s.mjs";
 import { t as getTypeId } from "./type-BMdjm4Eg.mjs";
 import { canonicalizePortableUri, formatIri, fromCompatibleEf61Id, isGatewayUrl } from "@fedify/vocab-runtime";
 import { lookupWebFinger } from "@fedify/webfinger";
@@ -8,7 +8,7 @@ import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { domainToASCII, domainToUnicode } from "node:url";
 //#region deno.json
 var name = "@fedify/vocab";
-var version = "2.4.0-dev.2054+1756e190";
+var version = "2.4.0-dev.2063+366c0362";
 //#endregion
 //#region src/actor.ts
 const ACTOR_DISCOVERY_HISTOGRAM_BUCKETS = [

package/dist-tests/actor.test.mjs

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { H as Service, N as Organization, P as Person, Z as __exportAll, a as Application, y as Group } from "./vocab-BJGPw--L.mjs";
-import { t as esm_default } from "./esm-Df0Yo-Tp.mjs";
-import { a as normalizeActorHandle, i as isActor, n as getActorHandle, r as getActorTypeName, t as getActorClassByTypeName } from "./actor-DT_jVPKe.mjs";
+import { F as Person, P as Organization, Q as __exportAll, U as Service, a as Application, b as Group } from "./vocab-DZq1JW3s.mjs";
+import { t as esm_default } from "./esm-CuilqPDu.mjs";
+import { a as normalizeActorHandle, i as isActor, n as getActorHandle, r as getActorTypeName, t as getActorClassByTypeName } from "./actor-hpNVHQvY.mjs";
 import { createTestMeterProvider, test } from "@fedify/fixture";
 import { deepStrictEqual, ok, rejects, strictEqual, throws } from "node:assert/strict";
 //#region ../../node_modules/.pnpm/fast-check@3.23.2/node_modules/fast-check/lib/esm/check/precondition/PreconditionFailure.js

package/dist-tests/{esm-Df0Yo-Tp.mjs → esm-CuilqPDu.mjs}

@@ -1,6 +1,6 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { Q as __toESM, X as __commonJSMin } from "./vocab-BJGPw--L.mjs";
+import { $ as __toESM, Z as __commonJSMin } from "./vocab-DZq1JW3s.mjs";
 //#endregion
 //#region ../../node_modules/.pnpm/regexparam@3.0.0/node_modules/regexparam/dist/index.mjs
 var import_glob_to_regexp = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {

package/dist-tests/gateway.test.mjs

@@ -1,7 +1,8 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { O as Note, l as Create } from "./vocab-BJGPw--L.mjs";
-import { t as esm_default } from "./esm-Df0Yo-Tp.mjs";
+import { F as Person, M as OrderedCollection, c as CollectionPage, k as Note, s as Collection, u as Create } from "./vocab-DZq1JW3s.mjs";
+import { t as esm_default } from "./esm-CuilqPDu.mjs";
+import { n as traverseCollection } from "./lookup-Bi6dOTm_.mjs";
 import { t as assertInstanceOf } from "./utils-Df2odC27.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, ok, rejects } from "node:assert/strict";
@@ -600,5 +601,241 @@ test("getObject() sends the ActivityStreams Accept header to gateways", {
 		esm_default.hardReset();
 	}
 });
+const AS = "https://www.w3.org/ns/activitystreams#";
+function gatewayUrl(gateway, path) {
+	return `${gateway}/.well-known/apgateway/${did}${path}`;
+}
+function createRecordingVerifier(decide = () => ({ verified: true })) {
+	const calls = [];
+	const verifier = async (document, options) => {
+		calls.push({
+			document,
+			options
+		});
+		return decide(document, options);
+	};
+	return Object.assign(verifier, { calls });
+}
+function portableCollection(path, extra = {}) {
+	return {
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: `ap://${did}${path}`,
+		type: "OrderedCollection",
+		totalItems: 0,
+		...extra
+	};
+}
+test("getOutbox() passes the fetch source and referrer to the verifier", async () => {
+	const person = await Person.fromJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: `ap://${did}/actor`,
+		type: "Person",
+		inbox: `ap://${did}/actor/inbox`,
+		outbox: `ap://${did}/actor/outbox?@gateway=${encodeURIComponent("https://hint.example")}`
+	}, { contextLoader: mockDocumentLoader });
+	const documentLoader = createLoader({ [gatewayUrl("https://hint.example", "/actor/outbox")]: portableCollection("/actor/outbox") });
+	const verifier = createRecordingVerifier();
+	assertInstanceOf(await person.getOutbox({
+		documentLoader,
+		contextLoader: mockDocumentLoader,
+		verifyPortableObject: verifier
+	}), Collection);
+	deepStrictEqual(verifier.calls.length, 1);
+	const { options } = verifier.calls[0];
+	deepStrictEqual(options.documentUrl, new URL(gatewayUrl("https://hint.example", "/actor/outbox")));
+	deepStrictEqual(options.gateways, void 0);
+	deepStrictEqual(options.gatewayHints, [new URL("https://hint.example")]);
+	ok(options.referrer?.object === person);
+	deepStrictEqual(options.referrer?.property, `${AS}outbox`);
+	deepStrictEqual(options.referrer?.acceptance, void 0);
+	const person2 = await Person.fromJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: `ap://${did}/actor`,
+		type: "Person",
+		inbox: `ap://${did}/actor/inbox`,
+		outbox: `ap://${did}/actor/outbox`
+	}, { contextLoader: mockDocumentLoader });
+	const verifier2 = createRecordingVerifier();
+	await person2.getOutbox({
+		documentLoader: createLoader({ [gatewayUrl("https://gw.example", "/actor/outbox")]: portableCollection("/actor/outbox") }),
+		contextLoader: mockDocumentLoader,
+		gateways: ["https://gw.example"],
+		verifyPortableObject: verifier2
+	});
+	deepStrictEqual(verifier2.calls[0].options.gateways, [new URL("https://gw.example")]);
+	deepStrictEqual(verifier2.calls[0].options.gatewayHints, void 0);
+});
+test("getFirst() passes the referrer chain and collection context", async () => {
+	const context = Object.freeze({});
+	const documentLoader = createLoader({
+		[gatewayUrl("https://gw.example", "/actor")]: {
+			"@context": "https://www.w3.org/ns/activitystreams",
+			id: `ap://${did}/actor`,
+			type: "Person",
+			inbox: `ap://${did}/actor/inbox`,
+			outbox: `ap://${did}/actor/outbox`
+		},
+		[gatewayUrl("https://gw.example", "/actor/outbox")]: portableCollection("/actor/outbox", { first: {
+			id: `ap://${did}/actor/outbox?page=1`,
+			type: "OrderedCollectionPage",
+			next: `ap://${did}/actor/outbox?page=2`
+		} }),
+		[gatewayUrl("https://gw.example", "/actor/outbox?page=2")]: {
+			"@context": "https://www.w3.org/ns/activitystreams",
+			id: `ap://${did}/actor/outbox?page=2`,
+			type: "OrderedCollectionPage",
+			orderedItems: []
+		}
+	});
+	const verifier = createRecordingVerifier((document) => document.type === "OrderedCollection" ? {
+		verified: true,
+		collectionContext: context
+	} : { verified: true });
+	const options = {
+		documentLoader,
+		contextLoader: mockDocumentLoader,
+		gateways: ["https://gw.example"],
+		verifyPortableObject: verifier
+	};
+	const create = await createActivity(`ap://${did}/actor`);
+	const actor = await create.getObject(options);
+	assertInstanceOf(actor, Person);
+	const outbox = await actor.getOutbox(options);
+	assertInstanceOf(outbox, Collection);
+	const first = await outbox.getFirst(options);
+	assertInstanceOf(first, CollectionPage);
+	assertInstanceOf(await first.getNext(options), CollectionPage);
+	const { referrer } = verifier.calls[verifier.calls.length - 1].options;
+	ok(referrer?.object === first);
+	deepStrictEqual(referrer?.property, `${AS}next`);
+	deepStrictEqual(referrer?.acceptance, void 0);
+	ok(referrer?.referrer?.object === outbox);
+	deepStrictEqual(referrer?.referrer?.property, `${AS}first`);
+	deepStrictEqual(referrer?.referrer?.acceptance, "verified");
+	ok(referrer?.referrer?.collectionContext === context);
+	ok(referrer?.referrer?.referrer?.object === actor);
+	deepStrictEqual(referrer?.referrer?.referrer?.property, `${AS}outbox`);
+	deepStrictEqual(referrer?.referrer?.referrer?.acceptance, "verified");
+	ok(referrer?.referrer?.referrer?.referrer?.object === create);
+});
+test("accessors do not trust objects embedded in unsecured collections", async () => {
+	const itemPath = "/objects/1";
+	const options = {
+		documentLoader: createLoader({
+			[gatewayUrl("https://gw.example", "/actor/outbox")]: portableCollection("/actor/outbox", { orderedItems: [{
+				id: `ap://${did}${itemPath}`,
+				type: "Note",
+				content: "Forged"
+			}, {
+				type: "Note",
+				content: "Anonymous"
+			}] }),
+			[gatewayUrl("https://gw.example", itemPath)]: note()
+		}),
+		contextLoader: mockDocumentLoader,
+		gateways: ["https://gw.example"],
+		verifyPortableObject: createRecordingVerifier((document) => document.type === "OrderedCollection" ? {
+			verified: true,
+			unsecured: true
+		} : { verified: true })
+	};
+	const createPerson = () => Person.fromJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: `ap://${did}/actor`,
+		type: "Person",
+		inbox: `ap://${did}/actor/inbox`,
+		outbox: `ap://${did}/actor/outbox`
+	}, { contextLoader: mockDocumentLoader });
+	const outbox = await (await createPerson()).getOutbox(options);
+	assertInstanceOf(outbox, Collection);
+	deepStrictEqual((await Array.fromAsync(outbox.getItems(options))).map((item) => item instanceof Note ? item.content : null), ["Portable note"]);
+	const outbox2 = await (await createPerson()).getOutbox(options);
+	assertInstanceOf(outbox2, Collection);
+	deepStrictEqual((await Array.fromAsync(outbox2.getItems({
+		...options,
+		crossOrigin: "trust"
+	}))).length, 1);
+	const outbox3 = await (await createPerson()).getOutbox(options);
+	assertInstanceOf(outbox3, Collection);
+	deepStrictEqual(await Array.fromAsync(outbox3.clone().getItems({
+		...options,
+		documentLoader: createLoader({}),
+		suppressError: true
+	})), []);
+});
+test("accessors reject compatible identifiers from portable objects", async () => {
+	const compatibleId = gatewayUrl("https://evil.example", "/actor/outbox");
+	const collection = (id) => ({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id,
+		type: "OrderedCollection",
+		totalItems: 0
+	});
+	const person = (outbox) => Person.fromJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: `ap://${did}/actor`,
+		type: "Person",
+		inbox: `ap://${did}/actor/inbox`,
+		outbox
+	}, { contextLoader: mockDocumentLoader });
+	const redirectingLoader = (url) => Promise.resolve({
+		contextUrl: null,
+		documentUrl: url === "https://example.com/outbox" ? compatibleId : url,
+		document: collection(url === "https://example.com/outbox" ? compatibleId : url)
+	});
+	for (const crossOrigin of [void 0, "trust"]) {
+		const options = {
+			documentLoader: redirectingLoader,
+			contextLoader: mockDocumentLoader,
+			verifyPortableObject: createRecordingVerifier(),
+			crossOrigin
+		};
+		deepStrictEqual(await (await person(compatibleId)).getOutbox(options), null);
+		deepStrictEqual(await (await person("https://example.com/outbox")).getOutbox(options), null);
+		deepStrictEqual(await (await person(collection(compatibleId))).getOutbox(options), null);
+	}
+	await rejects(async () => await (await person(compatibleId)).getOutbox({
+		documentLoader: redirectingLoader,
+		contextLoader: mockDocumentLoader,
+		crossOrigin: "throw"
+	}), /portable object/);
+	assertInstanceOf(await (await Person.fromJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://evil.example/actor",
+		type: "Person",
+		inbox: "https://evil.example/actor/inbox",
+		outbox: compatibleId
+	}, { contextLoader: mockDocumentLoader })).getOutbox({
+		documentLoader: redirectingLoader,
+		contextLoader: mockDocumentLoader
+	}), OrderedCollection);
+});
+test("singular accessors drop anonymous objects embedded in unsecured collections", async () => {
+	const options = {
+		documentLoader: createLoader({ [gatewayUrl("https://gw.example", "/actor/outbox")]: portableCollection("/actor/outbox", { first: {
+			type: "OrderedCollectionPage",
+			orderedItems: [{
+				type: "Note",
+				content: "Anonymous"
+			}]
+		} }) }),
+		contextLoader: mockDocumentLoader,
+		gateways: ["https://gw.example"],
+		verifyPortableObject: createRecordingVerifier(() => ({
+			verified: true,
+			unsecured: true
+		}))
+	};
+	const outbox = await (await Person.fromJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: `ap://${did}/actor`,
+		type: "Person",
+		inbox: `ap://${did}/actor/inbox`,
+		outbox: `ap://${did}/actor/outbox`
+	}, { contextLoader: mockDocumentLoader })).getOutbox(options);
+	assertInstanceOf(outbox, OrderedCollection);
+	deepStrictEqual(await outbox.getFirst(options), null);
+	deepStrictEqual(await Array.fromAsync(traverseCollection(outbox, options)), []);
+});
 //#endregion
 export {};

package/dist-tests/{lookup-4fEg7Ybl.mjs → lookup-Bi6dOTm_.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { k as Object$1 } from "./vocab-BJGPw--L.mjs";
-import { i as isActor, o as name, s as version } from "./actor-DT_jVPKe.mjs";
+import { A as Object$1 } from "./vocab-DZq1JW3s.mjs";
+import { i as isActor, o as name, s as version } from "./actor-hpNVHQvY.mjs";
 import { t as getTypeId } from "./type-BMdjm4Eg.mjs";
 import { canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getDocumentLoader, haveSameFe34Origin, haveSameIriOrigin, parseIri } from "@fedify/vocab-runtime";
 import { lookupWebFinger } from "@fedify/webfinger";

package/dist-tests/lookup.test.mjs

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { O as Note, P as Person, k as Object$1, s as Collection } from "./vocab-BJGPw--L.mjs";
-import { t as esm_default } from "./esm-Df0Yo-Tp.mjs";
+import { A as Object$1, F as Person, k as Note, s as Collection } from "./vocab-DZq1JW3s.mjs";
+import { t as esm_default } from "./esm-CuilqPDu.mjs";
+import { n as traverseCollection, t as lookupObject } from "./lookup-Bi6dOTm_.mjs";
 import { t as assertInstanceOf } from "./utils-Df2odC27.mjs";
-import { n as traverseCollection, t as lookupObject } from "./lookup-4fEg7Ybl.mjs";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, equal, ok, rejects } from "node:assert/strict";
 //#region src/lookup.test.ts

package/dist-tests/portable-lookup.test.mjs

@@ -1,10 +1,10 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { P as Person } from "./vocab-BJGPw--L.mjs";
-import { t as esm_default } from "./esm-Df0Yo-Tp.mjs";
-import { n as getActorHandle } from "./actor-DT_jVPKe.mjs";
+import { F as Person } from "./vocab-DZq1JW3s.mjs";
+import { t as esm_default } from "./esm-CuilqPDu.mjs";
+import { n as getActorHandle } from "./actor-hpNVHQvY.mjs";
+import { t as lookupObject } from "./lookup-Bi6dOTm_.mjs";
 import { t as assertInstanceOf } from "./utils-Df2odC27.mjs";
-import { t as lookupObject } from "./lookup-4fEg7Ybl.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, equal, rejects } from "node:assert/strict";
 import { FetchError, parseIri } from "@fedify/vocab-runtime";

package/dist-tests/signed-representation.test.mjs

@@ -1,6 +1,6 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { O as Note, R as Question, Y as vocab_exports, i as Announce, j as OrderedCollection, l as Create } from "./vocab-BJGPw--L.mjs";
+import { M as OrderedCollection, X as vocab_exports, i as Announce, k as Note, u as Create, z as Question } from "./vocab-DZq1JW3s.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, ok } from "node:assert/strict";
 import { isMarkerSafeContext, retainSignedRepresentation } from "@fedify/vocab-runtime/internal/signed-representation";

package/dist-tests/translation.test.mjs

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { G as Translation, H as Service, I as PropertyValue, K as Update, N as Organization, O as Note, P as Person, T as Link, a as Application, k as Object$1, l as Create, o as Article, s as Collection, y as Group } from "./vocab-BJGPw--L.mjs";
-import "./actor-DT_jVPKe.mjs";
-import "./lookup-4fEg7Ybl.mjs";
+import { A as Object$1, E as Link, F as Person, K as Translation, L as PropertyValue, P as Organization, U as Service, a as Application, b as Group, k as Note, o as Article, q as Update, s as Collection, u as Create } from "./vocab-DZq1JW3s.mjs";
+import "./actor-hpNVHQvY.mjs";
+import "./lookup-Bi6dOTm_.mjs";
 import { test } from "@fedify/fixture";
 import { deepStrictEqual, ok, rejects } from "node:assert/strict";
 import { LanguageString as LanguageString$1, getDocumentLoader, preloadedContexts } from "@fedify/vocab-runtime";

package/dist-tests/type.test.mjs

@@ -1,6 +1,6 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { J as isEntityType, P as Person, T as Link, q as getEntityTypeById } from "./vocab-BJGPw--L.mjs";
+import { E as Link, F as Person, J as getEntityTypeById, Y as isEntityType } from "./vocab-DZq1JW3s.mjs";
 import { t as getTypeId } from "./type-BMdjm4Eg.mjs";
 import { test } from "@fedify/fixture";
 import { deepStrictEqual } from "node:assert/strict";