@fedify/vocab 2.4.0-dev.2056 → 2.4.0-dev.2065

package/dist-tests/{lookup-C13R72YU.mjs → lookup-BnzAXNN7.mjs}

@@ -1,13 +1,13 @@
 import { Temporal } from "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { k as Object$1 } from "./vocab-BJGPw--L.mjs";
-import { i as isActor, o as name, s as version } from "./actor-BgeBgt_8.mjs";
+import { A as Object$1 } from "./vocab-BHtBRusa.mjs";
+import { i as isActor, o as name, s as version } from "./actor-B0IFZjgb.mjs";
 import { t as getTypeId } from "./type-BMdjm4Eg.mjs";
-import { canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getDocumentLoader, haveSameFe34Origin, haveSameIriOrigin, parseIri } from "@fedify/vocab-runtime";
+import { canonicalizePortableUri, formatIri, getDocumentLoader, haveSameFe34Origin, haveSameIriOrigin, parseIri } from "@fedify/vocab-runtime";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";
-import { PortableObjectRejectedError, dereferencePortableIri, getPortableGatewayCandidates, isPortableIri } from "@fedify/vocab-runtime/internal/portable-dereference";
+import { PortableObjectRejectedError, createSnapshotContextLoader, dereferencePortableIri, getPortableGatewayCandidates, getPortableResponseClaim, isPortableIri, parseCompatibleEf61Reference } from "@fedify/vocab-runtime/internal/portable-dereference";
 import { delay } from "es-toolkit";
 //#region src/handle.ts
 /**
@@ -269,35 +269,50 @@ async function lookupObjectInternal(identifier, options = {}) {
 		}
 	}
 	if (remoteDoc == null) return null;
-	let object;
-	let documentUrl;
+	const snapshot = options.verifyPortableObject == null ? null : createSnapshotContextLoader(options.contextLoader ?? getDocumentLoader({ userAgent: options.userAgent }));
 	try {
-		documentUrl = parseIri(remoteDoc.documentUrl);
-		object = await Object$1.fromJsonLd(remoteDoc.document, {
-			documentLoader,
-			contextLoader: options.contextLoader,
-			tracerProvider: options.tracerProvider,
-			baseUrl: documentUrl
-		});
-	} catch (error) {
-		if (error instanceof TypeError) {
-			logger.debug("Failed to parse JSON-LD document: {error}\n{document}", {
+		let object;
+		let documentUrl;
+		try {
+			documentUrl = parseIri(remoteDoc.documentUrl);
+			object = await Object$1.fromJsonLd(remoteDoc.document, {
+				documentLoader,
+				contextLoader: snapshot?.loader ?? options.contextLoader,
+				tracerProvider: options.tracerProvider,
+				baseUrl: documentUrl
+			});
+		} catch (error) {
+			if (error instanceof TypeError) {
+				logger.debug("Failed to parse JSON-LD document: {error}\n{document}", {
+					...remoteDoc,
+					error
+				});
+				return null;
+			}
+			throw error;
+		}
+		if (snapshot != null) {
+			const claim = getPortableResponseClaim(remoteDoc.documentUrl, object.id);
+			if (claim === null) {
+				logger.debug("Refusing the document {documentUrl}, as it claims to be a portable object with a malformed compatible identifier.", { documentUrl: remoteDoc.documentUrl });
+				return null;
+			} else if (claim != null) return await dereference(portable, claim.id, claim.inferredGateways, {
+				response: remoteDoc,
+				contextLoader: snapshot.loader
+			});
+		}
+		if (object.id != null && (options.crossOrigin !== "trust" || isPortableIri(object.id)) && !haveSameIriOrigin(object.id, documentUrl) && !haveSameFe34Origin(object.id, documentUrl)) {
+			if (options.crossOrigin === "throw") throw new Error(`The object's @id (${object.id.href}) has a different origin than the document URL (${remoteDoc.documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to "trust".`);
+			logger.warn("The object's @id ({objectId}) has a different origin than the document URL ({documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to \"trust\".", {
 				...remoteDoc,
-				error
+				objectId: object.id.href
 			});
 			return null;
 		}
-		throw error;
+		return object;
+	} finally {
+		snapshot?.release();
 	}
-	if (object.id != null && (options.crossOrigin !== "trust" || isPortableIri(object.id)) && !haveSameIriOrigin(object.id, documentUrl) && !haveSameFe34Origin(object.id, documentUrl)) {
-		if (options.crossOrigin === "throw") throw new Error(`The object's @id (${object.id.href}) has a different origin than the document URL (${remoteDoc.documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to "trust".`);
-		logger.warn("The object's @id ({objectId}) has a different origin than the document URL ({documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to \"trust\".", {
-			...remoteDoc,
-			objectId: object.id.href
-		});
-		return null;
-	}
-	return object;
 }
 const PORTABLE_IRI_PATTERN = /^ap(?:\+ef61)?:/i;
 /**
@@ -334,25 +349,8 @@ function parsePortableCandidate(iri) {
 *          the gateway to ask.
 */
 function getCompatibleCandidate(href, options) {
-	if (options.verifyPortableObject == null || !URL.canParse(href)) return;
-	const url = new URL(href);
-	try {
-		const id = fromCompatibleEf61Id(url);
-		if (id == null) return void 0;
-		return {
-			id,
-			gateway: new URL(url.origin)
-		};
-	} catch (error) {
-		if (error instanceof TypeError) {
-			logger.debug("Invalid FEP-ef61 compatible identifier {href}: {error}", {
-				href,
-				error
-			});
-			return null;
-		}
-		throw error;
-	}
+	if (options.verifyPortableObject == null) return void 0;
+	return parseCompatibleEf61Reference(href);
 }
 /**
 * Gets the origin of the WebFinger server that {@link lookupWebFinger} asks
@@ -405,14 +403,15 @@ async function lookupPortableObject(lookup, id, gateways) {
 	lookup.remaining -= selected.length;
 	return await dereference(lookup, id, selected);
 }
-async function dereference({ options, documentLoader }, id, gateways) {
+async function dereference({ options, documentLoader }, id, gateways, extra = {}) {
 	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
 	try {
 		return await dereferencePortableIri(id, {
 			documentLoader,
-			contextLoader: options.contextLoader ?? getDocumentLoader({ userAgent: options.userAgent }),
+			contextLoader: extra.contextLoader ?? options.contextLoader ?? getDocumentLoader({ userAgent: options.userAgent }),
 			tracerProvider,
-			gateways,
+			inferredGateways: gateways,
+			response: extra.response,
 			verifyPortableObject: options.verifyPortableObject,
 			crossOrigin: options.crossOrigin === "throw" ? "throw" : "ignore",
 			signal: options.signal,

package/dist-tests/lookup.test.mjs

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { O as Note, P as Person, k as Object$1, s as Collection } from "./vocab-BJGPw--L.mjs";
-import { t as esm_default } from "./esm-Df0Yo-Tp.mjs";
+import { A as Object$1, F as Person, k as Note, s as Collection } from "./vocab-BHtBRusa.mjs";
+import { t as esm_default } from "./esm-C9nxP5_e.mjs";
+import { n as traverseCollection, t as lookupObject } from "./lookup-BnzAXNN7.mjs";
 import { t as assertInstanceOf } from "./utils-Df2odC27.mjs";
-import { n as traverseCollection, t as lookupObject } from "./lookup-C13R72YU.mjs";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, equal, ok, rejects } from "node:assert/strict";
 //#region src/lookup.test.ts

package/dist-tests/portable-lookup.test.mjs

@@ -1,10 +1,10 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { P as Person } from "./vocab-BJGPw--L.mjs";
-import { t as esm_default } from "./esm-Df0Yo-Tp.mjs";
-import { n as getActorHandle } from "./actor-BgeBgt_8.mjs";
+import { F as Person } from "./vocab-BHtBRusa.mjs";
+import { t as esm_default } from "./esm-C9nxP5_e.mjs";
+import { n as getActorHandle } from "./actor-B0IFZjgb.mjs";
+import { t as lookupObject } from "./lookup-BnzAXNN7.mjs";
 import { t as assertInstanceOf } from "./utils-Df2odC27.mjs";
-import { t as lookupObject } from "./lookup-C13R72YU.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, equal, rejects } from "node:assert/strict";
 import { FetchError, parseIri } from "@fedify/vocab-runtime";
@@ -331,5 +331,101 @@ test("getActorHandle() with FEP-ef61 portable actors", {
 		esm_default.hardReset();
 	}
 });
+test("lookupObject() reports inferred gateways as hints", async () => {
+	const calls = [];
+	const verifyPortableObject = async (_, options) => {
+		calls.push(options);
+		return { verified: true };
+	};
+	assertInstanceOf(await lookupObject(compatibleId, {
+		documentLoader: createLoader({ [compatibleId]: person() }),
+		contextLoader: mockDocumentLoader,
+		verifyPortableObject
+	}), Person);
+	deepStrictEqual(calls.length, 1);
+	deepStrictEqual(calls[0].gateways, void 0);
+	deepStrictEqual(calls[0].gatewayHints, [new URL("https://example.com")]);
+});
+test("lookupObject() verifies fetched documents that stand for portable objects", async (t) => {
+	const plainUrl = "https://example.com/users/alice";
+	const redirectingLoader = (documentUrl, document) => {
+		const fetched = [];
+		const loader = async (url) => {
+			fetched.push(url);
+			if (url !== plainUrl) throw new FetchError(url, "HTTP 404", new globalThis.Response(null, { status: 404 }));
+			return {
+				contextUrl: null,
+				documentUrl,
+				document
+			};
+		};
+		return Object.assign(loader, { fetched });
+	};
+	await t.step("a redirect to a compatible identifier", async () => {
+		const calls = [];
+		const documentLoader = redirectingLoader(compatibleId, person());
+		const actor = await lookupObject(plainUrl, {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			verifyPortableObject: async (_, options) => {
+				calls.push(options);
+				return { verified: true };
+			}
+		});
+		assertInstanceOf(actor, Person);
+		deepStrictEqual(actor.id, parseIri(actorId));
+		deepStrictEqual(documentLoader.fetched, [plainUrl]);
+		deepStrictEqual(calls.length, 1);
+		deepStrictEqual(calls[0].documentUrl, new URL(compatibleId));
+		deepStrictEqual(calls[0].gatewayHints, [new URL("https://example.com")]);
+		equal(await lookupObject(plainUrl, {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			verifyPortableObject: createVerifier(false)
+		}), null);
+		equal(await lookupObject(plainUrl, {
+			documentLoader: redirectingLoader(compatibleId, person(`ap://${did}/other`)),
+			contextLoader: mockDocumentLoader,
+			verifyPortableObject: createVerifier()
+		}), null);
+	});
+	await t.step("a compatible @id", async () => {
+		const documentLoader = redirectingLoader(plainUrl, person(compatibleId));
+		const verifyPortableObject = createVerifier();
+		equal(await lookupObject(plainUrl, {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			verifyPortableObject
+		}), null);
+		deepStrictEqual(verifyPortableObject.documents, []);
+		const actor = await lookupObject(plainUrl, {
+			documentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertInstanceOf(actor, Person);
+		deepStrictEqual(actor.id, new URL(compatibleId));
+	});
+	await t.step("a portable @id", async () => {
+		const documentLoader = redirectingLoader(plainUrl, person());
+		const actor = await lookupObject(plainUrl, {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			verifyPortableObject: createVerifier()
+		});
+		assertInstanceOf(actor, Person);
+		deepStrictEqual(actor.id, parseIri(actorId));
+		equal(await lookupObject(plainUrl, {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			verifyPortableObject: createVerifier(false)
+		}), null);
+		await rejects(() => lookupObject(plainUrl, {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			verifyPortableObject: createVerifier(false),
+			crossOrigin: "throw"
+		}), /No gateway returned a valid portable object/);
+	});
+});
 //#endregion
 export {};

package/dist-tests/signed-representation.test.mjs

@@ -1,6 +1,6 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { O as Note, R as Question, Y as vocab_exports, i as Announce, j as OrderedCollection, l as Create } from "./vocab-BJGPw--L.mjs";
+import { M as OrderedCollection, X as vocab_exports, i as Announce, k as Note, u as Create, z as Question } from "./vocab-BHtBRusa.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, ok } from "node:assert/strict";
 import { isMarkerSafeContext, retainSignedRepresentation } from "@fedify/vocab-runtime/internal/signed-representation";

package/dist-tests/translation.test.mjs

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { G as Translation, H as Service, I as PropertyValue, K as Update, N as Organization, O as Note, P as Person, T as Link, a as Application, k as Object$1, l as Create, o as Article, s as Collection, y as Group } from "./vocab-BJGPw--L.mjs";
-import "./actor-BgeBgt_8.mjs";
-import "./lookup-C13R72YU.mjs";
+import { A as Object$1, E as Link, F as Person, K as Translation, L as PropertyValue, P as Organization, U as Service, a as Application, b as Group, k as Note, o as Article, q as Update, s as Collection, u as Create } from "./vocab-BHtBRusa.mjs";
+import "./actor-B0IFZjgb.mjs";
+import "./lookup-BnzAXNN7.mjs";
 import { test } from "@fedify/fixture";
 import { deepStrictEqual, ok, rejects } from "node:assert/strict";
 import { LanguageString as LanguageString$1, getDocumentLoader, preloadedContexts } from "@fedify/vocab-runtime";

package/dist-tests/type.test.mjs

@@ -1,6 +1,6 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { J as isEntityType, P as Person, T as Link, q as getEntityTypeById } from "./vocab-BJGPw--L.mjs";
+import { E as Link, F as Person, J as getEntityTypeById, Y as isEntityType } from "./vocab-BHtBRusa.mjs";
 import { t as getTypeId } from "./type-BMdjm4Eg.mjs";
 import { test } from "@fedify/fixture";
 import { deepStrictEqual } from "node:assert/strict";