@fedify/webfinger 2.0.35-dev.2480 → 2.0.35

package/src/lookup.test.ts

@@ -1,12 +1,47 @@
 import { test } from "@fedify/fixture";
 import { UrlError } from "@fedify/vocab-runtime";
+import {
+  openDirectFetch,
+  openPublicFetch,
+  type PublicFetchSession,
+} from "@fedify/vocab-runtime/internal";
 import { configure, type LogRecord, reset } from "@logtape/logtape";
 import { withTimeout } from "es-toolkit";
 import fetchMock from "fetch-mock";
 import { deepStrictEqual, ok } from "node:assert/strict";
-import dns from "node:dns/promises";
+import type { LookupAddress } from "node:dns";
 import type { ResourceDescriptor } from "./jrd.ts";
-import { lookupWebFinger } from "./lookup.ts";
+import { lookupWebFinger, type LookupWebFingerOptions } from "./lookup.ts";
+import { lookupWebFingerInternal } from "./lookup-impl.ts";
+
+// fetch-mock routes match hostnames, but on runtimes that pin connections
+// the request URL has the resolved IP address instead.  Tests of the response
+// handling therefore skip address validation, and tests of the address policy
+// inject the DNS lookup:
+function lookupDirect(
+  resource: URL | string,
+  options?: LookupWebFingerOptions,
+): Promise<ResourceDescriptor | null> {
+  return lookupWebFingerInternal(resource, options, {
+    openHop: openDirectFetch,
+  });
+}
+
+function lookupResolving(
+  addresses: readonly LookupAddress[],
+): (hostname: string) => Promise<readonly LookupAddress[]> {
+  return () => Promise.resolve(addresses);
+}
+
+// Lets example.com through without validation, and validates every other
+// host with a lookup that resolves to a public address:
+function openExampleDirectly(url: string): Promise<PublicFetchSession> {
+  return new URL(url).hostname === "example.com"
+    ? openDirectFetch(url)
+    : openPublicFetch(url, {
+      lookup: lookupResolving([{ address: "93.184.215.14", family: 4 }]),
+    });
+}
 
 test({
   name: "lookupWebFinger()",
@@ -31,6 +66,47 @@ test({
       );
     });
 
+    await t.step(
+      "fedify-test.internal resolving to a private address",
+      async () => {
+        fetchMock.mockGlobal();
+        fetchMock.catch(500);
+        try {
+          const hosts: string[] = [];
+          const openHop = (url: string) =>
+            openPublicFetch(url, {
+              lookup: (hostname) => {
+                hosts.push(hostname);
+                return Promise.resolve([{ address: "10.0.0.1", family: 4 }]);
+              },
+            });
+          deepStrictEqual(
+            await lookupWebFingerInternal(
+              "acct:johndoe@fedify-test.internal",
+              {},
+              { openHop },
+            ),
+            null,
+          );
+          deepStrictEqual(
+            await lookupWebFingerInternal(
+              "https://fedify-test.internal/foo",
+              {},
+              { openHop },
+            ),
+            null,
+          );
+          deepStrictEqual(hosts, [
+            "fedify-test.internal",
+            "fedify-test.internal",
+          ]);
+          deepStrictEqual(fetchMock.callHistory.calls().length, 0);
+        } finally {
+          fetchMock.hardReset();
+        }
+      },
+    );
+
     fetchMock.spyGlobal();
     fetchMock.get(
       "begin:https://example.com/.well-known/webfinger?",
@@ -38,8 +114,8 @@ test({
     );
 
     await t.step("not found", async () => {
-      deepStrictEqual(await lookupWebFinger("acct:johndoe@example.com"), null);
-      deepStrictEqual(await lookupWebFinger("https://example.com/foo"), null);
+      deepStrictEqual(await lookupDirect("acct:johndoe@example.com"), null);
+      deepStrictEqual(await lookupDirect("https://example.com/foo"), null);
     });
 
     const expected: ResourceDescriptor = {
@@ -54,7 +130,7 @@ test({
 
     await t.step("acct", async () => {
       deepStrictEqual(
-        await lookupWebFinger("acct:johndoe@example.com"),
+        await lookupDirect("acct:johndoe@example.com"),
         expected,
       );
     });
@@ -71,7 +147,7 @@ test({
 
     await t.step("https", async () => {
       deepStrictEqual(
-        await lookupWebFinger("https://example.com/foo"),
+        await lookupDirect("https://example.com/foo"),
         expected2,
       );
     });
@@ -83,7 +159,7 @@ test({
     );
 
     await t.step("invalid response", async () => {
-      deepStrictEqual(await lookupWebFinger("acct:johndoe@example.com"), null);
+      deepStrictEqual(await lookupDirect("acct:johndoe@example.com"), null);
     });
 
     fetchMock.removeRoutes();
@@ -135,7 +211,7 @@ test({
 
     await t.step("redirection", async () => {
       deepStrictEqual(
-        await lookupWebFinger("acct:johndoe@example.com"),
+        await lookupDirect("acct:johndoe@example.com"),
         expected,
       );
     });
@@ -151,7 +227,7 @@ test({
 
     await t.step("infinite redirection", async () => {
       const result = await withTimeout(
-        () => lookupWebFinger("acct:johndoe@example.com"),
+        () => lookupDirect("acct:johndoe@example.com"),
         2000,
       );
       deepStrictEqual(result, null);
@@ -167,7 +243,7 @@ test({
     );
 
     await t.step("redirection to different protocol", async () => {
-      deepStrictEqual(await lookupWebFinger("acct:johndoe@example.com"), null);
+      deepStrictEqual(await lookupDirect("acct:johndoe@example.com"), null);
     });
 
     fetchMock.removeRoutes();
@@ -180,7 +256,12 @@ test({
     );
 
     await t.step("redirection to private address", async () => {
-      deepStrictEqual(await lookupWebFinger("acct:johndoe@example.com"), null);
+      deepStrictEqual(
+        await lookupWebFingerInternal("acct:johndoe@example.com", {}, {
+          openHop: openExampleDirectly,
+        }),
+        null,
+      );
     });
 
     fetchMock.removeRoutes();
@@ -205,7 +286,7 @@ test({
       // Test with maxRedirection: 2 (should fail)
       redirectCount = 0;
       deepStrictEqual(
-        await lookupWebFinger("acct:johndoe@example.com", {
+        await lookupDirect("acct:johndoe@example.com", {
           maxRedirection: 2,
         }),
         null,
@@ -214,7 +295,7 @@ test({
       // Test with maxRedirection: 3 (should succeed)
       redirectCount = 0;
       deepStrictEqual(
-        await lookupWebFinger("acct:johndoe@example.com", {
+        await lookupDirect("acct:johndoe@example.com", {
           maxRedirection: 3,
         }),
         expected,
@@ -223,7 +304,7 @@ test({
       // Test with default maxRedirection: 5 (should succeed)
       redirectCount = 0;
       deepStrictEqual(
-        await lookupWebFinger("acct:johndoe@example.com"),
+        await lookupDirect("acct:johndoe@example.com"),
         expected,
       );
     });
@@ -244,7 +325,7 @@ test({
     await t.step("request cancellation", async () => {
       // Test cancelling a request immediately using AbortController
       const controller = new AbortController();
-      const promise = lookupWebFinger("acct:johndoe@example.com", {
+      const promise = lookupDirect("acct:johndoe@example.com", {
         signal: controller.signal,
       });
 
@@ -278,7 +359,7 @@ test({
     await t.step("cancellation during redirection", async () => {
       // Test cancelling a request during redirection process
       const controller = new AbortController();
-      const promise = lookupWebFinger("acct:johndoe@example.com", {
+      const promise = lookupDirect("acct:johndoe@example.com", {
         signal: controller.signal,
       });
 
@@ -306,10 +387,18 @@ test({
       controller.abort();
 
       // Use a signal that was already aborted before starting the request
-      const result = await lookupWebFinger("acct:johndoe@example.com", {
+      const result = await lookupDirect("acct:johndoe@example.com", {
         signal: controller.signal,
       });
       deepStrictEqual(result, null);
+
+      // Opening a validated session is aborted before the DNS lookup:
+      deepStrictEqual(
+        await lookupWebFinger("acct:johndoe@example.com", {
+          signal: controller.signal,
+        }),
+        null,
+      );
     });
 
     fetchMock.removeRoutes();
@@ -321,7 +410,7 @@ test({
     await t.step("successful request with signal", async () => {
       // Test successful request with a normal AbortController signal
       const controller = new AbortController();
-      const result = await lookupWebFinger("acct:johndoe@example.com", {
+      const result = await lookupDirect("acct:johndoe@example.com", {
         signal: controller.signal,
       });
       deepStrictEqual(result, expected);
@@ -370,28 +459,18 @@ test("lookupWebFinger() bounds resource descriptors", async () => {
 });
 
 test("lookupWebFinger() logs DNS failures as such", async (t) => {
-  // The validator skips DNS when Deno has no network permission.  Checked
-  // here rather than with top-level await, which the CommonJS build rejects.
-  if (
-    "Deno" in globalThis &&
-    (await Deno.permissions.query({ name: "net" })).state !== "granted"
-  ) return;
   for (const result of ["throws", "empty", "private"] as const) {
     await t.step(result, async () => {
-      // Stubbing works only because vocab-runtime's url.ts uses the default
-      // node:dns/promises import; see the FIXME there.
-      const originalLookup = dns.lookup;
-      dns.lookup = (() =>
+      const lookup = () =>
         result === "throws"
           ? Promise.reject(new Error("Resolver unavailable"))
           : Promise.resolve(
             result === "empty" ? [] : [{ address: "127.0.0.1", family: 4 }],
-          )) as typeof dns.lookup;
+          );
       const records: LogRecord[] = [];
       await configure({
         sinks: {
-          buffer: (record) =>
-            records.push(record),
+          buffer: (record) => records.push(record),
         },
         loggers: [
           { category: "fedify", sinks: ["buffer"], lowestLevel: "debug" },
@@ -401,7 +480,9 @@ test("lookupWebFinger() logs DNS failures as such", async (t) => {
       });
       try {
         deepStrictEqual(
-          await lookupWebFinger("acct:alice@dns-failure.invalid"),
+          await lookupWebFingerInternal("acct:alice@dns-failure.invalid", {}, {
+            openHop: (url) => openPublicFetch(url, { lookup }),
+          }),
           null,
         );
         const failures = records.filter((r) =>
@@ -427,8 +508,357 @@ test("lookupWebFinger() logs DNS failures as such", async (t) => {
         );
       } finally {
         await reset();
-        dns.lookup = originalLookup;
       }
     });
   }
 });
+
+interface FakeResponse {
+  readonly status?: number;
+  readonly headers?: Record<string, string>;
+  readonly body?: string;
+  /** The `url` of the response, as a pinned fetch reports it. */
+  readonly url?: string;
+  /** Makes cancelling the body fail. */
+  readonly cancelFails?: boolean;
+  /** Makes cancelling the body never settle. */
+  readonly cancelNeverSettles?: boolean;
+}
+
+interface HopRecorder {
+  readonly events: string[];
+  readonly openHop: (url: string) => Promise<PublicFetchSession>;
+  /**
+   * Asserts that every opened session is closed, and that every response
+   * body was consumed or cancelled before its session was closed.
+   */
+  assertInvariants(): void;
+}
+
+// A fake server that records the lifecycle of each session and response.
+// Unlike real sessions, closing a fake session never cancels bodies, so that
+// the caller's own cleanup is observed:
+function recordHops(respond: (url: URL) => FakeResponse): HopRecorder {
+  const events: string[] = [];
+  const unsettled: string[] = [];
+  let opens = 0;
+  let closes = 0;
+  let responses = 0;
+  return {
+    events,
+    // deno-lint-ignore require-await
+    async openHop(url) {
+      opens++;
+      events.push(`open ${url}`);
+      const states: { id: number; settled: boolean }[] = [];
+      let closed = false;
+      return {
+        url: new URL(url),
+        // deno-lint-ignore require-await
+        async fetch(input) {
+          if (closed) throw new TypeError("The fetch session is closed.");
+          const target = new URL(input instanceof Request ? input.url : input);
+          const id = ++responses;
+          events.push(`fetch ${target.href} #${id}`);
+          const fake = respond(target);
+          const state = { id, settled: false };
+          states.push(state);
+          let sent = false;
+          const body = new ReadableStream<Uint8Array>({
+            pull(controller) {
+              if (!sent && fake.body != null && fake.body !== "") {
+                sent = true;
+                controller.enqueue(new TextEncoder().encode(fake.body));
+                return;
+              }
+              state.settled = true;
+              events.push(`consumed #${id}`);
+              controller.close();
+            },
+            cancel() {
+              state.settled = true;
+              events.push(`cancel #${id}`);
+              if (fake.cancelFails) throw new Error("Cancellation failed");
+              if (fake.cancelNeverSettles) return new Promise(() => {});
+            },
+          }, { highWaterMark: 0 });
+          const response = new Response(body, {
+            status: fake.status ?? 200,
+            headers: fake.headers,
+          });
+          if (fake.url != null) {
+            Object.defineProperty(response, "url", { value: fake.url });
+          }
+          return response;
+        },
+        // deno-lint-ignore require-await
+        async close() {
+          if (closed) return;
+          closed = true;
+          closes++;
+          for (const state of states) {
+            if (!state.settled) unsettled.push(`#${state.id}`);
+          }
+          events.push(`close ${url}`);
+        },
+      };
+    },
+    assertInvariants() {
+      deepStrictEqual(closes, opens);
+      deepStrictEqual(unsettled, []);
+    },
+  };
+}
+
+test("lookupWebFinger() closes each hop after cleaning up its body", async (t) => {
+  const descriptor: ResourceDescriptor = {
+    subject: "acct:johndoe@example.com",
+    links: [],
+  };
+  const first =
+    "https://example.com/.well-known/webfinger?resource=acct%3Ajohndoe%40example.com";
+  const second = "https://example.com/.well-known/webfinger2";
+
+  await t.step("redirect", async () => {
+    const recorder = recordHops((url) =>
+      url.pathname === "/.well-known/webfinger"
+        ? {
+          status: 302,
+          headers: { Location: "/.well-known/webfinger2" },
+          body: "redirecting",
+          // A pinned response's url has the IP address, which must not be
+          // used as the base of the Location:
+          url: url.href.replace("example.com", "93.184.215.14"),
+        }
+        : { body: JSON.stringify(descriptor) }
+    );
+    deepStrictEqual(
+      await lookupWebFingerInternal("acct:johndoe@example.com", {}, {
+        openHop: recorder.openHop,
+      }),
+      descriptor,
+    );
+    deepStrictEqual(recorder.events, [
+      `open ${first}`,
+      `fetch ${first} #1`,
+      "cancel #1",
+      `close ${first}`,
+      `open ${second}`,
+      `fetch ${second} #2`,
+      "consumed #2",
+      `close ${second}`,
+    ]);
+    recorder.assertInvariants();
+  });
+
+  await t.step("non-2xx response", async () => {
+    const recorder = recordHops(() => ({ status: 404, body: "not found" }));
+    deepStrictEqual(
+      await lookupWebFingerInternal("acct:johndoe@example.com", {}, {
+        openHop: recorder.openHop,
+      }),
+      null,
+    );
+    deepStrictEqual(recorder.events, [
+      `open ${first}`,
+      `fetch ${first} #1`,
+      "cancel #1",
+      `close ${first}`,
+    ]);
+    recorder.assertInvariants();
+  });
+
+  await t.step("too many redirections", async () => {
+    const recorder = recordHops(() => ({
+      status: 302,
+      headers: { Location: "/.well-known/webfinger2" },
+      body: "redirecting",
+    }));
+    deepStrictEqual(
+      await lookupWebFingerInternal("acct:johndoe@example.com", {
+        maxRedirection: 2,
+      }, { openHop: recorder.openHop }),
+      null,
+    );
+    deepStrictEqual(recorder.events, [
+      `open ${first}`,
+      `fetch ${first} #1`,
+      "cancel #1",
+      `close ${first}`,
+      `open ${second}`,
+      `fetch ${second} #2`,
+      "cancel #2",
+      `close ${second}`,
+    ]);
+    recorder.assertInvariants();
+  });
+
+  await t.step("failed redirect body cancellation", async () => {
+    const recorder = recordHops((url) =>
+      url.pathname === "/.well-known/webfinger"
+        ? {
+          status: 302,
+          headers: { Location: "/.well-known/webfinger2" },
+          body: "redirecting",
+          cancelFails: true,
+        }
+        : { body: JSON.stringify(descriptor) }
+    );
+    const records: LogRecord[] = [];
+    await configure({
+      sinks: { buffer: (record) => records.push(record) },
+      loggers: [
+        { category: "fedify", sinks: ["buffer"], lowestLevel: "debug" },
+        { category: ["logtape", "meta"], sinks: [] },
+      ],
+      reset: true,
+    });
+    try {
+      deepStrictEqual(
+        await lookupWebFingerInternal("acct:johndoe@example.com", {}, {
+          openHop: recorder.openHop,
+        }),
+        descriptor,
+      );
+      const failures = records.filter((r) =>
+        r.rawMessage ===
+          "Failed to cancel the response body from {url}: {error}"
+      );
+      deepStrictEqual(
+        failures.map((r) => [r.level, r.properties.url]),
+        [["debug", first]],
+      );
+      const { error } = failures[0].properties;
+      ok(error instanceof Error);
+      deepStrictEqual(error.message, "Cancellation failed");
+    } finally {
+      await reset();
+    }
+    deepStrictEqual(recorder.events, [
+      `open ${first}`,
+      `fetch ${first} #1`,
+      "cancel #1",
+      `close ${first}`,
+      `open ${second}`,
+      `fetch ${second} #2`,
+      "consumed #2",
+      `close ${second}`,
+    ]);
+    recorder.assertInvariants();
+  });
+
+  await t.step("never-settling body cancellation", async () => {
+    const recorder = recordHops((url) =>
+      url.pathname === "/.well-known/webfinger"
+        ? {
+          status: 302,
+          headers: { Location: "/.well-known/webfinger2" },
+          body: "redirecting",
+          cancelNeverSettles: true,
+        }
+        : { status: 404, body: "not found", cancelNeverSettles: true }
+    );
+    deepStrictEqual(
+      await settleWithin(
+        lookupWebFingerInternal("acct:johndoe@example.com", {}, {
+          openHop: recorder.openHop,
+        }),
+      ),
+      null,
+    );
+    deepStrictEqual(recorder.events, [
+      `open ${first}`,
+      `fetch ${first} #1`,
+      "cancel #1",
+      `close ${first}`,
+      `open ${second}`,
+      `fetch ${second} #2`,
+      "cancel #2",
+      `close ${second}`,
+    ]);
+    recorder.assertInvariants();
+  });
+});
+
+/**
+ * Rejects if the given promise does not settle within the timeout, so that
+ * a hang fails the test instead of blocking it.
+ */
+async function settleWithin<T>(promise: Promise<T>, ms = 5000): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error(`Did not settle within ${ms} ms.`)),
+          ms,
+        );
+      }),
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// A body that a real session cannot cancel to completion: fetch-mock returns
+// a clone (a tee) of a Response instance, and the cancellation of a branch of
+// a tee settles only after the other branch is cancelled too.  Its source's
+// cancel callback never settles either:
+function neverCancellableResponse(init: ResponseInit): Response {
+  return new Response(
+    new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(new TextEncoder().encode("never cancelled"));
+      },
+      cancel: () => new Promise(() => {}),
+    }),
+    init,
+  );
+}
+
+test("lookupWebFinger() does not wait for cancelling response bodies", async (t) => {
+  const descriptor: ResourceDescriptor = {
+    subject: "acct:johndoe@example.com",
+    links: [],
+  };
+  fetchMock.mockGlobal();
+  try {
+    await t.step("redirect", async () => {
+      fetchMock.removeRoutes();
+      fetchMock.get(
+        "begin:https://example.com/.well-known/webfinger?",
+        () =>
+          neverCancellableResponse({
+            status: 302,
+            headers: { Location: "/.well-known/webfinger2" },
+          }),
+      );
+      fetchMock.get(
+        "https://example.com/.well-known/webfinger2",
+        () =>
+          new Response(JSON.stringify(descriptor), {
+            headers: { "Content-Type": "application/jrd+json" },
+          }),
+      );
+      deepStrictEqual(
+        await settleWithin(lookupDirect("acct:johndoe@example.com")),
+        descriptor,
+      );
+    });
+
+    await t.step("non-2xx response", async () => {
+      fetchMock.removeRoutes();
+      fetchMock.get(
+        "begin:https://example.com/.well-known/webfinger?",
+        () => neverCancellableResponse({ status: 404 }),
+      );
+      deepStrictEqual(
+        await settleWithin(lookupDirect("acct:johndoe@example.com")),
+        null,
+      );
+    });
+  } finally {
+    fetchMock.hardReset();
+  }
+});