@fedify/webfinger 2.2.18 → 2.2.20

package/dist/mod.cjs

@@ -1,10 +1,11 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let _opentelemetry_api = require("@opentelemetry/api");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
+let _fedify_vocab_runtime_internal = require("@fedify/vocab-runtime/internal");
 let _logtape_logtape = require("@logtape/logtape");
-let _opentelemetry_api = require("@opentelemetry/api");
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.2.18";
+var version = "2.2.20";
 //#endregion
 //#region src/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */
@@ -80,7 +81,7 @@ async function readBoundedText(message, maxBytes, url) {
 	}
 }
 //#endregion
-//#region src/lookup.ts
+//#region src/lookup-impl.ts
 const logger = (0, _logtape_logtape.getLogger)([
 	"fedify",
 	"webfinger",
@@ -88,36 +89,16 @@ const logger = (0, _logtape_logtape.getLogger)([
 ]);
 const DEFAULT_MAX_REDIRECTION = 5;
 /**
-* Looks up a WebFinger resource.
+* Looks up a WebFinger resource, opening a fetch session per hop.  This is
+* the implementation of {@link lookupWebFinger}, which is not exported from
+* the package entry point.
 * @param resource The resource URL to look up.
 * @param options Extra options for looking up the resource.
+* @param deps The dependencies.
 * @returns The resource descriptor, or `null` if not found.
-* @since 0.2.0
+* @internal
 */
-async function lookupWebFinger(resource, options = {}) {
-	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(name, version).startActiveSpan("webfinger.lookup", {
-		kind: _opentelemetry_api.SpanKind.CLIENT,
-		attributes: {
-			"webfinger.resource": resource.toString(),
-			"webfinger.resource.scheme": typeof resource === "string" ? resource.replace(/:.*$/, "") : resource.protocol.replace(/:$/, "")
-		}
-	}, async (span) => {
-		try {
-			const result = await lookupWebFingerInternal(resource, options);
-			span.setStatus({ code: result === null ? _opentelemetry_api.SpanStatusCode.ERROR : _opentelemetry_api.SpanStatusCode.OK });
-			return result;
-		} catch (error) {
-			span.setStatus({
-				code: _opentelemetry_api.SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			span.end();
-		}
-	});
-}
-async function lookupWebFingerInternal(resource, options = {}) {
+async function lookupWebFingerInternal(resource, options = {}, deps = {}) {
 	if (typeof resource === "string") resource = new URL(resource);
 	let protocol = "https:";
 	let server;
@@ -132,76 +113,154 @@ async function lookupWebFingerInternal(resource, options = {}) {
 	}
 	let url = new URL(`${protocol}//${server}/.well-known/webfinger`);
 	url.searchParams.set("resource", resource.href);
+	const openHop = deps.openHop ?? ((hopUrl) => options.allowPrivateAddress === true ? (0, _fedify_vocab_runtime_internal.openDirectFetch)(hopUrl) : (0, _fedify_vocab_runtime_internal.openPublicFetch)(hopUrl, { signal: options.signal }));
 	let redirected = 0;
 	while (true) {
 		logger.debug("Fetching WebFinger resource descriptor from {url}...", { url: url.href });
-		let response;
-		if (options.allowPrivateAddress !== true) try {
-			await (0, _fedify_vocab_runtime.validatePublicUrl)(url.href);
-		} catch (e) {
-			if (e instanceof _fedify_vocab_runtime.UrlError) {
-				if (e.reason === "dns") logger.debug("DNS lookup failed for {url}", {
-					url: url.href,
-					error: e
-				});
-				else logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
-				return null;
-			}
-			throw e;
-		}
+		const session = await openSession(url, openHop, options.signal);
+		if (session == null) return null;
+		let hop;
 		try {
-			response = await fetch(url, {
-				headers: {
-					Accept: "application/jrd+json",
-					"User-Agent": typeof options.userAgent === "string" ? options.userAgent : (0, _fedify_vocab_runtime.getUserAgent)(options.userAgent)
-				},
-				redirect: "manual",
-				signal: options.signal
+			hop = await fetchHop(session, url, options);
+		} finally {
+			await session.close();
+		}
+		if ("result" in hop) return hop.result;
+		redirected++;
+		const maxRedirection = options.maxRedirection ?? DEFAULT_MAX_REDIRECTION;
+		if (redirected >= maxRedirection) {
+			logger.error("Too many redirections ({redirections}) while fetching WebFinger resource descriptor.", { redirections: redirected });
+			return null;
+		}
+		const redirectedUrl = new URL(hop.redirect, url);
+		if (redirectedUrl.protocol !== url.protocol) {
+			logger.error("Redirected to a different protocol ({protocol} to {redirectedProtocol}) while fetching WebFinger resource descriptor.", {
+				protocol: url.protocol,
+				redirectedProtocol: redirectedUrl.protocol
 			});
-		} catch (error) {
-			logger.debug("Failed to fetch WebFinger resource descriptor: {error}", {
+			return null;
+		}
+		url = redirectedUrl;
+	}
+}
+/**
+* Opens a fetch session for a hop.  A disallowed URL, a failed DNS lookup,
+* or an aborted lookup yields `null` instead of an error.
+*/
+async function openSession(url, openHop, signal) {
+	try {
+		return await openHop(url.href);
+	} catch (e) {
+		if (e instanceof _fedify_vocab_runtime.UrlError) {
+			if (e.reason === "dns") logger.debug("DNS lookup failed for {url}", {
 				url: url.href,
-				error
+				error: e
 			});
+			else logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
 			return null;
 		}
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-			redirected++;
-			const maxRedirection = options.maxRedirection ?? DEFAULT_MAX_REDIRECTION;
-			if (redirected >= maxRedirection) {
-				logger.error("Too many redirections ({redirections}) while fetching WebFinger resource descriptor.", { redirections: redirected });
-				return null;
-			}
-			const redirectedUrl = new URL(response.headers.get("Location"), response.url == null || response.url === "" ? url : response.url);
-			if (redirectedUrl.protocol !== url.protocol) {
-				logger.error("Redirected to a different protocol ({protocol} to {redirectedProtocol}) while fetching WebFinger resource descriptor.", {
-					protocol: url.protocol,
-					redirectedProtocol: redirectedUrl.protocol
-				});
-				return null;
-			}
-			url = redirectedUrl;
-			continue;
-		}
-		if (!response.ok) {
-			logger.debug("Failed to fetch WebFinger resource descriptor: {status} {statusText}.", {
+		if (signal?.aborted) {
+			logger.debug("Failed to fetch WebFinger resource descriptor: {error}", {
 				url: url.href,
-				status: response.status,
-				statusText: response.statusText
+				error: e
 			});
 			return null;
 		}
-		try {
-			return JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url));
-		} catch (e) {
-			if (e instanceof BodyTooLargeError) return null;
-			if (e instanceof SyntaxError) {
-				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
-				return null;
-			}
-			throw e;
+		throw e;
+	}
+}
+/**
+* Fetches a hop with the given session, and consumes the response body or
+* starts cancelling it before returning.  The caller closes the session.
+*/
+async function fetchHop(session, url, options) {
+	let response;
+	try {
+		response = await session.fetch(url, {
+			headers: {
+				Accept: "application/jrd+json",
+				"User-Agent": typeof options.userAgent === "string" ? options.userAgent : (0, _fedify_vocab_runtime.getUserAgent)(options.userAgent)
+			},
+			redirect: "manual",
+			signal: options.signal
+		});
+	} catch (error) {
+		logger.debug("Failed to fetch WebFinger resource descriptor: {error}", {
+			url: url.href,
+			error
+		});
+		return { result: null };
+	}
+	if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+		cancelBody(response, url);
+		return { redirect: response.headers.get("Location") };
+	}
+	if (!response.ok) {
+		logger.debug("Failed to fetch WebFinger resource descriptor: {status} {statusText}.", {
+			url: url.href,
+			status: response.status,
+			statusText: response.statusText
+		});
+		cancelBody(response, url);
+		return { result: null };
+	}
+	try {
+		return { result: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url)) };
+	} catch (e) {
+		if (e instanceof BodyTooLargeError) return { result: null };
+		if (e instanceof SyntaxError) {
+			logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
+			return { result: null };
 		}
+		throw e;
 	}
 }
+/**
+* Starts cancelling a response body that is not read, without waiting for it
+* to settle.  The cancellation of a branch of a tee (e.g., a body cloned by
+* a fetch mock) settles only after the other branch is cancelled too, per
+* the Streams standard, so awaiting it could block forever.  A failure is
+* only logged.
+*/
+function cancelBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		logger.debug("Failed to cancel the response body from {url}: {error}", {
+			url: url.href,
+			error
+		});
+	});
+}
+//#endregion
+//#region src/lookup.ts
+/**
+* Looks up a WebFinger resource.
+* @param resource The resource URL to look up.
+* @param options Extra options for looking up the resource.
+* @returns The resource descriptor, or `null` if not found.
+* @since 0.2.0
+*/
+async function lookupWebFinger(resource, options = {}) {
+	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(name, version).startActiveSpan("webfinger.lookup", {
+		kind: _opentelemetry_api.SpanKind.CLIENT,
+		attributes: {
+			"webfinger.resource": resource.toString(),
+			"webfinger.resource.scheme": typeof resource === "string" ? resource.replace(/:.*$/, "") : resource.protocol.replace(/:$/, "")
+		}
+	}, async (span) => {
+		try {
+			const result = await lookupWebFingerInternal(resource, options);
+			span.setStatus({ code: result === null ? _opentelemetry_api.SpanStatusCode.ERROR : _opentelemetry_api.SpanStatusCode.OK });
+			return result;
+		} catch (error) {
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			span.end();
+		}
+	});
+}
 //#endregion
 exports.lookupWebFinger = lookupWebFinger;

package/dist/mod.d.ts

@@ -1,5 +1,5 @@
-import { GetUserAgentOptions } from "@fedify/vocab-runtime";
 import { TracerProvider } from "@opentelemetry/api";
+import { GetUserAgentOptions } from "@fedify/vocab-runtime";
 
 //#region src/jrd.d.ts
 /**

package/dist/mod.js

@@ -1,9 +1,10 @@
-import { FetchError, UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
-import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
+import { FetchError, UrlError, getUserAgent } from "@fedify/vocab-runtime";
+import { openDirectFetch, openPublicFetch } from "@fedify/vocab-runtime/internal";
+import { getLogger } from "@logtape/logtape";
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.2.18";
+var version = "2.2.20";
 //#endregion
 //#region src/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */
@@ -79,7 +80,7 @@ async function readBoundedText(message, maxBytes, url) {
 	}
 }
 //#endregion
-//#region src/lookup.ts
+//#region src/lookup-impl.ts
 const logger = getLogger([
 	"fedify",
 	"webfinger",
@@ -87,36 +88,16 @@ const logger = getLogger([
 ]);
 const DEFAULT_MAX_REDIRECTION = 5;
 /**
-* Looks up a WebFinger resource.
+* Looks up a WebFinger resource, opening a fetch session per hop.  This is
+* the implementation of {@link lookupWebFinger}, which is not exported from
+* the package entry point.
 * @param resource The resource URL to look up.
 * @param options Extra options for looking up the resource.
+* @param deps The dependencies.
 * @returns The resource descriptor, or `null` if not found.
-* @since 0.2.0
+* @internal
 */
-async function lookupWebFinger(resource, options = {}) {
-	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("webfinger.lookup", {
-		kind: SpanKind.CLIENT,
-		attributes: {
-			"webfinger.resource": resource.toString(),
-			"webfinger.resource.scheme": typeof resource === "string" ? resource.replace(/:.*$/, "") : resource.protocol.replace(/:$/, "")
-		}
-	}, async (span) => {
-		try {
-			const result = await lookupWebFingerInternal(resource, options);
-			span.setStatus({ code: result === null ? SpanStatusCode.ERROR : SpanStatusCode.OK });
-			return result;
-		} catch (error) {
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			span.end();
-		}
-	});
-}
-async function lookupWebFingerInternal(resource, options = {}) {
+async function lookupWebFingerInternal(resource, options = {}, deps = {}) {
 	if (typeof resource === "string") resource = new URL(resource);
 	let protocol = "https:";
 	let server;
@@ -131,76 +112,154 @@ async function lookupWebFingerInternal(resource, options = {}) {
 	}
 	let url = new URL(`${protocol}//${server}/.well-known/webfinger`);
 	url.searchParams.set("resource", resource.href);
+	const openHop = deps.openHop ?? ((hopUrl) => options.allowPrivateAddress === true ? openDirectFetch(hopUrl) : openPublicFetch(hopUrl, { signal: options.signal }));
 	let redirected = 0;
 	while (true) {
 		logger.debug("Fetching WebFinger resource descriptor from {url}...", { url: url.href });
-		let response;
-		if (options.allowPrivateAddress !== true) try {
-			await validatePublicUrl(url.href);
-		} catch (e) {
-			if (e instanceof UrlError) {
-				if (e.reason === "dns") logger.debug("DNS lookup failed for {url}", {
-					url: url.href,
-					error: e
-				});
-				else logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
-				return null;
-			}
-			throw e;
-		}
+		const session = await openSession(url, openHop, options.signal);
+		if (session == null) return null;
+		let hop;
 		try {
-			response = await fetch(url, {
-				headers: {
-					Accept: "application/jrd+json",
-					"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
-				},
-				redirect: "manual",
-				signal: options.signal
+			hop = await fetchHop(session, url, options);
+		} finally {
+			await session.close();
+		}
+		if ("result" in hop) return hop.result;
+		redirected++;
+		const maxRedirection = options.maxRedirection ?? DEFAULT_MAX_REDIRECTION;
+		if (redirected >= maxRedirection) {
+			logger.error("Too many redirections ({redirections}) while fetching WebFinger resource descriptor.", { redirections: redirected });
+			return null;
+		}
+		const redirectedUrl = new URL(hop.redirect, url);
+		if (redirectedUrl.protocol !== url.protocol) {
+			logger.error("Redirected to a different protocol ({protocol} to {redirectedProtocol}) while fetching WebFinger resource descriptor.", {
+				protocol: url.protocol,
+				redirectedProtocol: redirectedUrl.protocol
 			});
-		} catch (error) {
-			logger.debug("Failed to fetch WebFinger resource descriptor: {error}", {
+			return null;
+		}
+		url = redirectedUrl;
+	}
+}
+/**
+* Opens a fetch session for a hop.  A disallowed URL, a failed DNS lookup,
+* or an aborted lookup yields `null` instead of an error.
+*/
+async function openSession(url, openHop, signal) {
+	try {
+		return await openHop(url.href);
+	} catch (e) {
+		if (e instanceof UrlError) {
+			if (e.reason === "dns") logger.debug("DNS lookup failed for {url}", {
 				url: url.href,
-				error
+				error: e
 			});
+			else logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
 			return null;
 		}
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-			redirected++;
-			const maxRedirection = options.maxRedirection ?? DEFAULT_MAX_REDIRECTION;
-			if (redirected >= maxRedirection) {
-				logger.error("Too many redirections ({redirections}) while fetching WebFinger resource descriptor.", { redirections: redirected });
-				return null;
-			}
-			const redirectedUrl = new URL(response.headers.get("Location"), response.url == null || response.url === "" ? url : response.url);
-			if (redirectedUrl.protocol !== url.protocol) {
-				logger.error("Redirected to a different protocol ({protocol} to {redirectedProtocol}) while fetching WebFinger resource descriptor.", {
-					protocol: url.protocol,
-					redirectedProtocol: redirectedUrl.protocol
-				});
-				return null;
-			}
-			url = redirectedUrl;
-			continue;
-		}
-		if (!response.ok) {
-			logger.debug("Failed to fetch WebFinger resource descriptor: {status} {statusText}.", {
+		if (signal?.aborted) {
+			logger.debug("Failed to fetch WebFinger resource descriptor: {error}", {
 				url: url.href,
-				status: response.status,
-				statusText: response.statusText
+				error: e
 			});
 			return null;
 		}
-		try {
-			return JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url));
-		} catch (e) {
-			if (e instanceof BodyTooLargeError) return null;
-			if (e instanceof SyntaxError) {
-				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
-				return null;
-			}
-			throw e;
+		throw e;
+	}
+}
+/**
+* Fetches a hop with the given session, and consumes the response body or
+* starts cancelling it before returning.  The caller closes the session.
+*/
+async function fetchHop(session, url, options) {
+	let response;
+	try {
+		response = await session.fetch(url, {
+			headers: {
+				Accept: "application/jrd+json",
+				"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
+			},
+			redirect: "manual",
+			signal: options.signal
+		});
+	} catch (error) {
+		logger.debug("Failed to fetch WebFinger resource descriptor: {error}", {
+			url: url.href,
+			error
+		});
+		return { result: null };
+	}
+	if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+		cancelBody(response, url);
+		return { redirect: response.headers.get("Location") };
+	}
+	if (!response.ok) {
+		logger.debug("Failed to fetch WebFinger resource descriptor: {status} {statusText}.", {
+			url: url.href,
+			status: response.status,
+			statusText: response.statusText
+		});
+		cancelBody(response, url);
+		return { result: null };
+	}
+	try {
+		return { result: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url)) };
+	} catch (e) {
+		if (e instanceof BodyTooLargeError) return { result: null };
+		if (e instanceof SyntaxError) {
+			logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
+			return { result: null };
 		}
+		throw e;
 	}
 }
+/**
+* Starts cancelling a response body that is not read, without waiting for it
+* to settle.  The cancellation of a branch of a tee (e.g., a body cloned by
+* a fetch mock) settles only after the other branch is cancelled too, per
+* the Streams standard, so awaiting it could block forever.  A failure is
+* only logged.
+*/
+function cancelBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		logger.debug("Failed to cancel the response body from {url}: {error}", {
+			url: url.href,
+			error
+		});
+	});
+}
+//#endregion
+//#region src/lookup.ts
+/**
+* Looks up a WebFinger resource.
+* @param resource The resource URL to look up.
+* @param options Extra options for looking up the resource.
+* @returns The resource descriptor, or `null` if not found.
+* @since 0.2.0
+*/
+async function lookupWebFinger(resource, options = {}) {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("webfinger.lookup", {
+		kind: SpanKind.CLIENT,
+		attributes: {
+			"webfinger.resource": resource.toString(),
+			"webfinger.resource.scheme": typeof resource === "string" ? resource.replace(/:.*$/, "") : resource.protocol.replace(/:$/, "")
+		}
+	}, async (span) => {
+		try {
+			const result = await lookupWebFingerInternal(resource, options);
+			span.setStatus({ code: result === null ? SpanStatusCode.ERROR : SpanStatusCode.OK });
+			return result;
+		} catch (error) {
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			span.end();
+		}
+	});
+}
 //#endregion
 export { lookupWebFinger };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/webfinger",
-  "version": "2.2.18",
+  "version": "2.2.20",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -58,9 +58,9 @@
   },
   "dependencies": {
     "@logtape/logtape": "^2.0.5",
-    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/api": "~1.9.0",
     "es-toolkit": "1.43.0",
-    "@fedify/vocab-runtime": "2.2.18"
+    "@fedify/vocab-runtime": "2.2.20"
   },
   "scripts": {
     "build:self": "tsdown",