@fedify/webfinger 2.5.0-dev.2446 → 2.5.0-dev.2492

package/src/lookup.test.ts

@@ -4,44 +4,122 @@ import { configure, type LogRecord, reset } from "@logtape/logtape";
 import { withTimeout } from "es-toolkit";
 import fetchMock from "fetch-mock";
 import { deepStrictEqual, ok } from "node:assert/strict";
-import dns from "node:dns/promises";
 import type { ResourceDescriptor } from "./jrd.ts";
-import { lookupWebFinger, type LookupWebFingerOptions } from "./lookup.ts";
+import {
+  lookupWebFinger,
+  type LookupWebFingerOptions,
+  lookupWebFingerWithDependencies,
+  type WebFingerLookupOutcome,
+} from "./lookup.ts";
+import {
+  type LookupWebFingerDependencies,
+  lookupWebFingerInternal,
+} from "./lookup-impl.ts";
+import {
+  openDirectFetch,
+  openPublicFetch,
+  type PublicFetchSession,
+} from "@fedify/vocab-runtime/internal";
+import type { LookupAddress } from "node:dns";
+import { test as nodeTest } from "node:test";
+
+// Inject only the transport boundary, so the public tracing and metrics
+// wrapper remains under test while fetch-mock sees the original hostname.
+function lookupMock(
+  resource: URL | string,
+  options: LookupWebFingerOptions & { withDiagnostics: true },
+): Promise<WebFingerLookupOutcome>;
+function lookupMock(
+  resource: URL | string,
+  options?: LookupWebFingerOptions & { withDiagnostics?: false },
+): Promise<ResourceDescriptor | null>;
+function lookupMock(
+  resource: URL | string,
+  options: LookupWebFingerOptions & { withDiagnostics?: boolean } = {},
+): Promise<ResourceDescriptor | null | WebFingerLookupOutcome> {
+  if (resource.toString().includes("fedify-test.internal")) {
+    return lookupWebFingerWithDependencies(resource, options, {
+      openHop: (url) =>
+        Promise.resolve({
+          url: new URL(url),
+          fetch: () => Promise.reject(new TypeError("Connection refused")),
+          close: () => Promise.resolve(),
+        }),
+    });
+  }
+  return lookupWebFingerWithDependencies(resource, options, {
+    openHop: options.allowPrivateAddress === true
+      ? openDirectFetch
+      : openExampleDirectly,
+  });
+}
+
+function lookupDirect(
+  resource: URL | string,
+  options?: LookupWebFingerOptions,
+): Promise<ResourceDescriptor | null> {
+  return lookupWebFingerWithDependencies(resource, options, {
+    openHop: openDirectFetch,
+  });
+}
+
+function lookupResolving(
+  addresses: readonly LookupAddress[],
+): (hostname: string) => Promise<readonly LookupAddress[]> {
+  return () => Promise.resolve(addresses);
+}
+
+function openExampleDirectly(url: string): Promise<PublicFetchSession> {
+  return new URL(url).hostname === "example.com"
+    ? openDirectFetch(url)
+    : openPublicFetch(url, {
+      lookup: lookupResolving([{ address: "93.184.215.14", family: 4 }]),
+    });
+}
+
+async function lookupResourceWithDependencies(
+  resource: URL | string,
+  options: LookupWebFingerOptions,
+  deps: LookupWebFingerDependencies,
+): Promise<ResourceDescriptor | null> {
+  return (await lookupWebFingerInternal(resource, options, deps)).resource;
+}
 
 test({
   name: "lookupWebFinger()",
   sanitizeOps: false,
   sanitizeResources: false,
   async fn(t) {
+    const responseTimers: ReturnType<typeof setTimeout>[] = [];
     await t.step("invalid resource", async () => {
-      deepStrictEqual(await lookupWebFinger("acct:johndoe"), null);
-      deepStrictEqual(await lookupWebFinger(new URL("acct:johndoe")), null);
-      deepStrictEqual(await lookupWebFinger("acct:johndoe@"), null);
-      deepStrictEqual(await lookupWebFinger(new URL("acct:johndoe@")), null);
+      deepStrictEqual(await lookupMock("acct:johndoe"), null);
+      deepStrictEqual(await lookupMock(new URL("acct:johndoe")), null);
+      deepStrictEqual(await lookupMock("acct:johndoe@"), null);
+      deepStrictEqual(await lookupMock(new URL("acct:johndoe@")), null);
       // Per RFC 7565, the acct: authority is bare `host`: no path,
       // query, or fragment is allowed.  Reject such inputs rather than
       // forwarding them to a remote WebFinger lookup.
       deepStrictEqual(
-        await lookupWebFinger("acct:johndoe@example.com/exploit"),
+        await lookupMock("acct:johndoe@example.com/exploit"),
         null,
       );
       deepStrictEqual(
-        await lookupWebFinger("acct:johndoe@example.com?x=1"),
+        await lookupMock("acct:johndoe@example.com?x=1"),
         null,
       );
       deepStrictEqual(
-        await lookupWebFinger("acct:johndoe@example.com#frag"),
+        await lookupMock("acct:johndoe@example.com#frag"),
         null,
       );
     });
 
     await t.step("connection refused", async () => {
       deepStrictEqual(
-        await lookupWebFinger("acct:johndoe@fedify-test.internal"),
+        await lookupMock("acct:johndoe@fedify-test.internal"),
         null,
       );
       deepStrictEqual(
-        await lookupWebFinger("https://fedify-test.internal/foo"),
+        await lookupMock("https://fedify-test.internal/foo"),
         null,
       );
     });
@@ -59,10 +137,10 @@ test({
 
       await t.step("not found", async () => {
         deepStrictEqual(
-          await lookupWebFinger("acct:johndoe@example.com"),
+          await lookupMock("acct:johndoe@example.com"),
           null,
         );
-        deepStrictEqual(await lookupWebFinger("https://example.com/foo"), null);
+        deepStrictEqual(await lookupMock("https://example.com/foo"), null);
       });
 
       const expected: ResourceDescriptor = {
@@ -77,7 +155,7 @@ test({
 
       await t.step("acct", async () => {
         deepStrictEqual(
-          await lookupWebFinger("acct:johndoe@example.com"),
+          await lookupMock("acct:johndoe@example.com"),
           expected,
         );
       });
@@ -94,7 +172,7 @@ test({
 
       await t.step("https", async () => {
         deepStrictEqual(
-          await lookupWebFinger("https://example.com/foo"),
+          await lookupMock("https://example.com/foo"),
           expected2,
         );
       });
@@ -115,7 +193,7 @@ test({
         // host extraction (after the last `@`) applies to `mailto:` just
         // like `acct:`.
         deepStrictEqual(
-          await lookupWebFinger("mailto:juliet@example.com"),
+          await lookupMock("mailto:juliet@example.com"),
           mailtoExpected,
         );
       });
@@ -137,7 +215,7 @@ test({
         // must accept them and forward the full resource URI to the
         // WebFinger endpoint.
         deepStrictEqual(
-          await lookupWebFinger("mailto:juliet@example.com?subject=Hi"),
+          await lookupMock("mailto:juliet@example.com?subject=Hi"),
           mailtoQueryExpected,
         );
       });
@@ -150,7 +228,7 @@ test({
 
       await t.step("invalid response", async () => {
         deepStrictEqual(
-          await lookupWebFinger("acct:johndoe@example.com"),
+          await lookupMock("acct:johndoe@example.com"),
           null,
         );
       });
@@ -171,9 +249,9 @@ test({
       );
 
       await t.step("private address", async () => {
-        deepStrictEqual(await lookupWebFinger("acct:test@localhost"), null);
+        deepStrictEqual(await lookupMock("acct:test@localhost"), null);
         deepStrictEqual(
-          await lookupWebFinger("acct:test@localhost", {
+          await lookupMock("acct:test@localhost", {
             allowPrivateAddress: true,
           }),
           {
@@ -204,7 +282,7 @@ test({
 
       await t.step("redirection", async () => {
         deepStrictEqual(
-          await lookupWebFinger("acct:johndoe@example.com"),
+          await lookupMock("acct:johndoe@example.com"),
           expected,
         );
       });
@@ -220,7 +298,7 @@ test({
 
       await t.step("infinite redirection", async () => {
         const result = await withTimeout(
-          () => lookupWebFinger("acct:johndoe@example.com"),
+          () => lookupMock("acct:johndoe@example.com"),
           2000,
         );
         deepStrictEqual(result, null);
@@ -237,7 +315,7 @@ test({
 
       await t.step("redirection to different protocol", async () => {
         deepStrictEqual(
-          await lookupWebFinger("acct:johndoe@example.com"),
+          await lookupMock("acct:johndoe@example.com"),
           null,
         );
       });
@@ -253,7 +331,7 @@ test({
 
       await t.step("redirection to private address", async () => {
         deepStrictEqual(
-          await lookupWebFinger("acct:johndoe@example.com"),
+          await lookupMock("acct:johndoe@example.com"),
           null,
         );
       });
@@ -280,7 +358,7 @@ test({
         // Test with maxRedirection: 1 (should fail; mock has 2 redirects)
         redirectCount = 0;
         deepStrictEqual(
-          await lookupWebFinger("acct:johndoe@example.com", {
+          await lookupMock("acct:johndoe@example.com", {
             maxRedirection: 1,
           }),
           null,
@@ -290,7 +368,7 @@ test({
         // redirects, and `maxRedirection: N` follows up to N redirects)
         redirectCount = 0;
         deepStrictEqual(
-          await lookupWebFinger("acct:johndoe@example.com", {
+          await lookupMock("acct:johndoe@example.com", {
             maxRedirection: 2,
           }),
           expected,
@@ -299,7 +377,7 @@ test({
         // Test with maxRedirection: 3 (should succeed)
         redirectCount = 0;
         deepStrictEqual(
-          await lookupWebFinger("acct:johndoe@example.com", {
+          await lookupMock("acct:johndoe@example.com", {
             maxRedirection: 3,
           }),
           expected,
@@ -308,7 +386,7 @@ test({
         // Test with default maxRedirection: 5 (should succeed)
         redirectCount = 0;
         deepStrictEqual(
-          await lookupWebFinger("acct:johndoe@example.com"),
+          await lookupMock("acct:johndoe@example.com"),
           expected,
         );
       });
@@ -338,7 +416,7 @@ test({
             },
           );
           deepStrictEqual(
-            await lookupWebFinger("acct:johndoe@example.com", {
+            await lookupMock("acct:johndoe@example.com", {
               maxRedirection: 1,
             }),
             expected,
@@ -363,7 +441,7 @@ test({
             },
           );
           deepStrictEqual(
-            await lookupWebFinger("acct:johndoe@example.com", {
+            await lookupMock("acct:johndoe@example.com", {
               maxRedirection: 1,
             }),
             null,
@@ -380,14 +458,14 @@ test({
               resolve({ body: expected });
             }, 1000);
 
-            return () => clearTimeout(timeoutId);
+            responseTimers.push(timeoutId);
           }),
       );
 
       await t.step("request cancellation", async () => {
         // Test cancelling a request immediately using AbortController
         const controller = new AbortController();
-        const promise = lookupWebFinger("acct:johndoe@example.com", {
+        const promise = lookupMock("acct:johndoe@example.com", {
           signal: controller.signal,
         });
 
@@ -413,7 +491,7 @@ test({
               resolve({ body: expected });
             }, 1000);
 
-            return () => clearTimeout(timeoutId);
+            responseTimers.push(timeoutId);
           });
         },
       );
@@ -421,7 +499,7 @@ test({
       await t.step("cancellation during redirection", async () => {
         // Test cancelling a request during redirection process
         const controller = new AbortController();
-        const promise = lookupWebFinger("acct:johndoe@example.com", {
+        const promise = lookupMock("acct:johndoe@example.com", {
           signal: controller.signal,
         });
 
@@ -439,7 +517,7 @@ test({
               resolve({ body: expected });
             }, 500);
 
-            return () => clearTimeout(timeoutId);
+            responseTimers.push(timeoutId);
           }),
       );
 
@@ -449,7 +527,7 @@ test({
         controller.abort();
 
         // Use a signal that was already aborted before starting the request
-        const result = await lookupWebFinger("acct:johndoe@example.com", {
+        const result = await lookupMock("acct:johndoe@example.com", {
           signal: controller.signal,
         });
         deepStrictEqual(result, null);
@@ -464,12 +542,13 @@ test({
       await t.step("successful request with signal", async () => {
         // Test successful request with a normal AbortController signal
         const controller = new AbortController();
-        const result = await lookupWebFinger("acct:johndoe@example.com", {
+        const result = await lookupMock("acct:johndoe@example.com", {
           signal: controller.signal,
         });
         deepStrictEqual(result, expected);
       });
     } finally {
+      for (const timer of responseTimers) clearTimeout(timer);
       fetchMock.removeRoutes();
       fetchMock.hardReset();
     }
@@ -496,7 +575,7 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
           { body: expected },
         );
         const [meterProvider, recorder] = createTestMeterProvider();
-        const result = await lookupWebFinger("acct:johndoe@example.com", {
+        const result = await lookupMock("acct:johndoe@example.com", {
           meterProvider,
         });
         deepStrictEqual(result, expected);
@@ -546,7 +625,7 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
           { body: { subject: "https://example.com/foo", links: [] } },
         );
         const [meterProvider, recorder] = createTestMeterProvider();
-        await lookupWebFinger("https://example.com/foo", { meterProvider });
+        await lookupMock("https://example.com/foo", { meterProvider });
         const counters = recorder.getMeasurements("webfinger.lookup");
         deepStrictEqual(counters.length, 1);
         deepStrictEqual(
@@ -569,7 +648,7 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
           { body: { subject: "https://example.com:8443/foo", links: [] } },
         );
         const [meterProvider, recorder] = createTestMeterProvider();
-        await lookupWebFinger("https://example.com:8443/foo", {
+        await lookupMock("https://example.com:8443/foo", {
           meterProvider,
         });
         const counter = recorder.getMeasurement("webfinger.lookup");
@@ -588,7 +667,7 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
         { status: 404 },
       );
       const [meterProvider, recorder] = createTestMeterProvider();
-      const result = await lookupWebFinger("acct:johndoe@example.com", {
+      const result = await lookupMock("acct:johndoe@example.com", {
         meterProvider,
       });
       deepStrictEqual(result, null);
@@ -623,7 +702,7 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
         { status: 410 },
       );
       const [meterProvider, recorder] = createTestMeterProvider();
-      await lookupWebFinger("acct:johndoe@example.com", { meterProvider });
+      await lookupMock("acct:johndoe@example.com", { meterProvider });
       const counter = recorder.getMeasurement("webfinger.lookup");
       ok(counter != null);
       deepStrictEqual(
@@ -642,7 +721,7 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
           { status: 500 },
         );
         const [meterProvider, recorder] = createTestMeterProvider();
-        await lookupWebFinger("acct:johndoe@example.com", { meterProvider });
+        await lookupMock("acct:johndoe@example.com", { meterProvider });
         const counter = recorder.getMeasurement("webfinger.lookup");
         ok(counter != null);
         deepStrictEqual(
@@ -662,7 +741,7 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
           { body: "not json" },
         );
         const [meterProvider, recorder] = createTestMeterProvider();
-        await lookupWebFinger("acct:johndoe@example.com", { meterProvider });
+        await lookupMock("acct:johndoe@example.com", { meterProvider });
         const counter = recorder.getMeasurement("webfinger.lookup");
         ok(counter != null);
         deepStrictEqual(
@@ -678,7 +757,7 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
       async () => {
         fetchMock.removeRoutes();
         const [meterProvider, recorder] = createTestMeterProvider();
-        const result = await lookupWebFinger(
+        const result = await lookupMock(
           "acct:johndoe@fedify-test.internal",
           { meterProvider },
         );
@@ -705,7 +784,7 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
       "records result=invalid for malformed acct: resources",
       async () => {
         const [meterProvider, recorder] = createTestMeterProvider();
-        const result = await lookupWebFinger("acct:johndoe", { meterProvider });
+        const result = await lookupMock("acct:johndoe", { meterProvider });
         deepStrictEqual(result, null);
         const counter = recorder.getMeasurement("webfinger.lookup");
         ok(counter != null);
@@ -742,7 +821,7 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
         const [meterProvider, recorder] = createTestMeterProvider();
         const result = await withTimeout(
           () =>
-            lookupWebFinger("acct:johndoe@example.com", {
+            lookupMock("acct:johndoe@example.com", {
               meterProvider,
               maxRedirection: 3,
             }),
@@ -775,7 +854,7 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
           },
         );
         const [meterProvider, recorder] = createTestMeterProvider();
-        await lookupWebFinger("acct:johndoe@example.com", { meterProvider });
+        await lookupMock("acct:johndoe@example.com", { meterProvider });
         const counter = recorder.getMeasurement("webfinger.lookup");
         ok(counter != null);
         deepStrictEqual(
@@ -798,7 +877,7 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
           },
         );
         const [meterProvider, recorder] = createTestMeterProvider();
-        await lookupWebFinger("acct:johndoe@example.com", { meterProvider });
+        await lookupMock("acct:johndoe@example.com", { meterProvider });
         const counter = recorder.getMeasurement("webfinger.lookup");
         ok(counter != null);
         deepStrictEqual(
@@ -825,7 +904,7 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
           },
         );
         const [meterProvider, recorder] = createTestMeterProvider();
-        await lookupWebFinger("acct:johndoe@example.com", { meterProvider });
+        await lookupMock("acct:johndoe@example.com", { meterProvider });
         const counter = recorder.getMeasurement("webfinger.lookup");
         ok(counter != null);
         deepStrictEqual(
@@ -852,7 +931,7 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
         // attempt to build a host from the URL, fail, and return null.
         // The metric still records, and its scheme attribute must be
         // bucketed as `other`.
-        await lookupWebFinger("ssh://example.com/foo", { meterProvider });
+        await lookupMock("ssh://example.com/foo", { meterProvider });
         const counter = recorder.getMeasurement("webfinger.lookup");
         ok(counter != null);
         deepStrictEqual(
@@ -871,7 +950,7 @@ test("lookupWebFinger() records webfinger.lookup counter and duration", {
           { body: expected },
         );
         const [_unused, recorder] = createTestMeterProvider();
-        await lookupWebFinger("acct:johndoe@example.com");
+        await lookupMock("acct:johndoe@example.com");
         deepStrictEqual(
           recorder.getMeasurements("webfinger.lookup").length,
           0,
@@ -909,14 +988,14 @@ test("lookupWebFinger() bounds resource descriptors", async () => {
         ),
     );
     deepStrictEqual(
-      await lookupWebFinger("acct:alice@example.com", {
+      await lookupMock("acct:alice@example.com", {
         allowPrivateAddress: true,
       }),
       null,
     );
     oversized = false;
     deepStrictEqual(
-      await lookupWebFinger("acct:alice@example.com", {
+      await lookupMock("acct:alice@example.com", {
         allowPrivateAddress: true,
       }),
       { subject: "acct:alice@example.com" },
@@ -927,28 +1006,18 @@ test("lookupWebFinger() bounds resource descriptors", async () => {
 });
 
 test("lookupWebFinger() logs DNS failures as such", async (t) => {
-  // The validator skips DNS when Deno has no network permission.  Checked
-  // here rather than with top-level await, which the CommonJS build rejects.
-  if (
-    "Deno" in globalThis &&
-    (await Deno.permissions.query({ name: "net" })).state !== "granted"
-  ) return;
   for (const result of ["throws", "empty", "private"] as const) {
     await t.step(result, async () => {
-      // Stubbing works only because vocab-runtime's url.ts uses the default
-      // node:dns/promises import; see the FIXME there.
-      const originalLookup = dns.lookup;
-      dns.lookup = (() =>
+      const lookup = () =>
         result === "throws"
           ? Promise.reject(new Error("Resolver unavailable"))
           : Promise.resolve(
             result === "empty" ? [] : [{ address: "127.0.0.1", family: 4 }],
-          )) as typeof dns.lookup;
+          );
       const records: LogRecord[] = [];
       await configure({
         sinks: {
-          buffer: (record) =>
-            records.push(record),
+          buffer: (record) => records.push(record),
         },
         loggers: [
           { category: "fedify", sinks: ["buffer"], lowestLevel: "debug" },
@@ -958,7 +1027,13 @@ test("lookupWebFinger() logs DNS failures as such", async (t) => {
       });
       try {
         deepStrictEqual(
-          await lookupWebFinger("acct:alice@dns-failure.invalid"),
+          await lookupResourceWithDependencies(
+            "acct:alice@dns-failure.invalid",
+            {},
+            {
+              openHop: (url) => openPublicFetch(url, { lookup }),
+            },
+          ),
           null,
         );
         const failures = records.filter((r) =>
@@ -984,7 +1059,6 @@ test("lookupWebFinger() logs DNS failures as such", async (t) => {
         );
       } finally {
         await reset();
-        dns.lookup = originalLookup;
       }
     });
   }
@@ -994,11 +1068,10 @@ test("lookupWebFinger() with withDiagnostics: true", {
   sanitizeOps: false,
   sanitizeResources: false,
 }, async (t) => {
-  // No fetch mock is active yet, so this reaches the real (non-existent)
-  // host and fails at the network layer, the same way the "connection
-  // refused" step above does.
+  // Inject the same failed session as the connection-refused transport test,
+  // so the diagnostics path does not depend on real DNS or networking.
   await t.step("network_error", async () => {
-    const outcome = await lookupWebFinger(
+    const outcome = await lookupMock(
       "acct:johndoe@fedify-test.internal",
       { withDiagnostics: true },
     );
@@ -1023,7 +1096,7 @@ test("lookupWebFinger() with withDiagnostics: true", {
         "https://example.com/.well-known/webfinger?resource=acct%3Ajohndoe%40example.com",
         { body: expected },
       );
-      const outcome = await lookupWebFinger("acct:johndoe@example.com", {
+      const outcome = await lookupMock("acct:johndoe@example.com", {
         withDiagnostics: true,
       });
       deepStrictEqual(outcome.resource, expected);
@@ -1038,7 +1111,7 @@ test("lookupWebFinger() with withDiagnostics: true", {
         "begin:https://example.com/.well-known/webfinger?",
         { status: 404 },
       );
-      const outcome = await lookupWebFinger("acct:johndoe@example.com", {
+      const outcome = await lookupMock("acct:johndoe@example.com", {
         withDiagnostics: true,
       });
       deepStrictEqual(outcome.resource, null);
@@ -1053,7 +1126,7 @@ test("lookupWebFinger() with withDiagnostics: true", {
         "begin:https://example.com/.well-known/webfinger?",
         { body: "not json" },
       );
-      const outcome = await lookupWebFinger("acct:johndoe@example.com", {
+      const outcome = await lookupMock("acct:johndoe@example.com", {
         withDiagnostics: true,
       });
       deepStrictEqual(outcome.resource, null);
@@ -1074,7 +1147,7 @@ test("lookupWebFinger() with withDiagnostics: true", {
           "begin:https://example.com/.well-known/webfinger?",
           { body: "null" },
         );
-        const outcome = await lookupWebFinger("acct:johndoe@example.com", {
+        const outcome = await lookupMock("acct:johndoe@example.com", {
           withDiagnostics: true,
         });
         deepStrictEqual(outcome.resource, null);
@@ -1094,7 +1167,7 @@ test("lookupWebFinger() with withDiagnostics: true", {
           "begin:https://example.com/.well-known/webfinger?",
           { body: "[]" },
         );
-        const outcome = await lookupWebFinger("acct:johndoe@example.com", {
+        const outcome = await lookupMock("acct:johndoe@example.com", {
           withDiagnostics: true,
         });
         deepStrictEqual(outcome.resource, null);
@@ -1110,7 +1183,7 @@ test("lookupWebFinger() with withDiagnostics: true", {
         "begin:https://example.com/.well-known/webfinger?",
         { status: 500 },
       );
-      const outcome = await lookupWebFinger("acct:johndoe@example.com", {
+      const outcome = await lookupMock("acct:johndoe@example.com", {
         withDiagnostics: true,
       });
       deepStrictEqual(outcome.resource, null);
@@ -1141,7 +1214,10 @@ test(
         "https://example.com/.well-known/webfinger?resource=acct%3Ajohndoe%40example.com",
         { body: expected },
       );
-      const options: LookupWebFingerOptions = { userAgent: "test-agent" };
+      const options: LookupWebFingerOptions = {
+        userAgent: "test-agent",
+        allowPrivateAddress: true,
+      };
       const result = await lookupWebFinger(
         "acct:johndoe@example.com",
         options,
@@ -1153,3 +1229,416 @@ test(
     }
   },
 );
+
+interface FakeResponse {
+  readonly status?: number;
+  readonly headers?: Record<string, string>;
+  readonly body?: string;
+  /** The `url` of the response, as a pinned fetch reports it. */
+  readonly url?: string;
+  /** Makes cancelling the body fail. */
+  readonly cancelFails?: boolean;
+  /** Makes cancelling the body never settle. */
+  readonly cancelNeverSettles?: boolean;
+}
+
+interface HopRecorder {
+  readonly events: string[];
+  readonly openHop: (url: string) => Promise<PublicFetchSession>;
+  /**
+   * Asserts that every opened session is closed, and that every response
+   * body was consumed or cancelled before its session was closed.
+   */
+  assertInvariants(): void;
+}
+
+// A fake server that records the lifecycle of each session and response.
+// Unlike real sessions, closing a fake session never cancels bodies, so that
+// the caller's own cleanup is observed:
+function recordHops(respond: (url: URL) => FakeResponse): HopRecorder {
+  const events: string[] = [];
+  const unsettled: string[] = [];
+  let opens = 0;
+  let closes = 0;
+  let responses = 0;
+  return {
+    events,
+    // deno-lint-ignore require-await
+    async openHop(url) {
+      opens++;
+      events.push(`open ${url}`);
+      const states: { id: number; settled: boolean }[] = [];
+      let closed = false;
+      return {
+        url: new URL(url),
+        // deno-lint-ignore require-await
+        async fetch(input) {
+          if (closed) throw new TypeError("The fetch session is closed.");
+          const target = new URL(input instanceof Request ? input.url : input);
+          const id = ++responses;
+          events.push(`fetch ${target.href} #${id}`);
+          const fake = respond(target);
+          const state = { id, settled: false };
+          states.push(state);
+          let sent = false;
+          const body = new ReadableStream<Uint8Array>({
+            pull(controller) {
+              if (!sent && fake.body != null && fake.body !== "") {
+                sent = true;
+                controller.enqueue(new TextEncoder().encode(fake.body));
+                return;
+              }
+              state.settled = true;
+              events.push(`consumed #${id}`);
+              controller.close();
+            },
+            cancel() {
+              state.settled = true;
+              events.push(`cancel #${id}`);
+              if (fake.cancelFails) throw new Error("Cancellation failed");
+              if (fake.cancelNeverSettles) return new Promise(() => {});
+            },
+          }, { highWaterMark: 0 });
+          const response = new Response(body, {
+            status: fake.status ?? 200,
+            headers: fake.headers,
+          });
+          if (fake.url != null) {
+            Object.defineProperty(response, "url", { value: fake.url });
+          }
+          return response;
+        },
+        // deno-lint-ignore require-await
+        async close() {
+          if (closed) return;
+          closed = true;
+          closes++;
+          for (const state of states) {
+            if (!state.settled) unsettled.push(`#${state.id}`);
+          }
+          events.push(`close ${url}`);
+        },
+      };
+    },
+    assertInvariants() {
+      deepStrictEqual(closes, opens);
+      deepStrictEqual(unsettled, []);
+    },
+  };
+}
+
+test("lookupWebFinger() closes each hop after cleaning up its body", async (t) => {
+  const descriptor: ResourceDescriptor = {
+    subject: "acct:johndoe@example.com",
+    links: [],
+  };
+  const first =
+    "https://example.com/.well-known/webfinger?resource=acct%3Ajohndoe%40example.com";
+  const second = "https://example.com/.well-known/webfinger2";
+
+  await t.step("redirect", async () => {
+    const recorder = recordHops((url) =>
+      url.pathname === "/.well-known/webfinger"
+        ? {
+          status: 302,
+          headers: { Location: "/.well-known/webfinger2" },
+          body: "redirecting",
+          // A pinned response's url has the IP address, which must not be
+          // used as the base of the Location:
+          url: url.href.replace("example.com", "93.184.215.14"),
+        }
+        : { body: JSON.stringify(descriptor) }
+    );
+    deepStrictEqual(
+      await lookupResourceWithDependencies("acct:johndoe@example.com", {}, {
+        openHop: recorder.openHop,
+      }),
+      descriptor,
+    );
+    deepStrictEqual(recorder.events, [
+      `open ${first}`,
+      `fetch ${first} #1`,
+      "cancel #1",
+      `close ${first}`,
+      `open ${second}`,
+      `fetch ${second} #2`,
+      "consumed #2",
+      `close ${second}`,
+    ]);
+    recorder.assertInvariants();
+  });
+
+  await t.step("non-2xx response", async () => {
+    const recorder = recordHops(() => ({ status: 404, body: "not found" }));
+    deepStrictEqual(
+      await lookupResourceWithDependencies("acct:johndoe@example.com", {}, {
+        openHop: recorder.openHop,
+      }),
+      null,
+    );
+    deepStrictEqual(recorder.events, [
+      `open ${first}`,
+      `fetch ${first} #1`,
+      "cancel #1",
+      `close ${first}`,
+    ]);
+    recorder.assertInvariants();
+  });
+
+  await t.step("too many redirections", async () => {
+    const recorder = recordHops(() => ({
+      status: 302,
+      headers: { Location: "/.well-known/webfinger2" },
+      body: "redirecting",
+    }));
+    deepStrictEqual(
+      await lookupResourceWithDependencies("acct:johndoe@example.com", {
+        maxRedirection: 1,
+      }, { openHop: recorder.openHop }),
+      null,
+    );
+    deepStrictEqual(recorder.events, [
+      `open ${first}`,
+      `fetch ${first} #1`,
+      "cancel #1",
+      `close ${first}`,
+      `open ${second}`,
+      `fetch ${second} #2`,
+      "cancel #2",
+      `close ${second}`,
+    ]);
+    recorder.assertInvariants();
+  });
+
+  await t.step("failed redirect body cancellation", async () => {
+    const recorder = recordHops((url) =>
+      url.pathname === "/.well-known/webfinger"
+        ? {
+          status: 302,
+          headers: { Location: "/.well-known/webfinger2" },
+          body: "redirecting",
+          cancelFails: true,
+        }
+        : { body: JSON.stringify(descriptor) }
+    );
+    const records: LogRecord[] = [];
+    await configure({
+      sinks: { buffer: (record) => records.push(record) },
+      loggers: [
+        { category: "fedify", sinks: ["buffer"], lowestLevel: "debug" },
+        { category: ["logtape", "meta"], sinks: [] },
+      ],
+      reset: true,
+    });
+    try {
+      deepStrictEqual(
+        await lookupResourceWithDependencies("acct:johndoe@example.com", {}, {
+          openHop: recorder.openHop,
+        }),
+        descriptor,
+      );
+      const failures = records.filter((r) =>
+        r.rawMessage ===
+          "Failed to cancel the response body from {url}: {error}"
+      );
+      deepStrictEqual(
+        failures.map((r) => [r.level, r.properties.url]),
+        [["debug", first]],
+      );
+      const { error } = failures[0].properties;
+      ok(error instanceof Error);
+      deepStrictEqual(error.message, "Cancellation failed");
+    } finally {
+      await reset();
+    }
+    deepStrictEqual(recorder.events, [
+      `open ${first}`,
+      `fetch ${first} #1`,
+      "cancel #1",
+      `close ${first}`,
+      `open ${second}`,
+      `fetch ${second} #2`,
+      "consumed #2",
+      `close ${second}`,
+    ]);
+    recorder.assertInvariants();
+  });
+
+  await t.step("never-settling body cancellation", async () => {
+    const recorder = recordHops((url) =>
+      url.pathname === "/.well-known/webfinger"
+        ? {
+          status: 302,
+          headers: { Location: "/.well-known/webfinger2" },
+          body: "redirecting",
+          cancelNeverSettles: true,
+        }
+        : { status: 404, body: "not found", cancelNeverSettles: true }
+    );
+    deepStrictEqual(
+      await settleWithin(
+        lookupResourceWithDependencies("acct:johndoe@example.com", {}, {
+          openHop: recorder.openHop,
+        }),
+      ),
+      null,
+    );
+    deepStrictEqual(recorder.events, [
+      `open ${first}`,
+      `fetch ${first} #1`,
+      "cancel #1",
+      `close ${first}`,
+      `open ${second}`,
+      `fetch ${second} #2`,
+      "cancel #2",
+      `close ${second}`,
+    ]);
+    recorder.assertInvariants();
+  });
+});
+
+/**
+ * Rejects if the given promise does not settle within the timeout, so that
+ * a hang fails the test instead of blocking it.
+ */
+async function settleWithin<T>(promise: Promise<T>, ms = 5000): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error(`Did not settle within ${ms} ms.`)),
+          ms,
+        );
+      }),
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// A body that a real session cannot cancel to completion: fetch-mock returns
+// a clone (a tee) of a Response instance, and the cancellation of a branch of
+// a tee settles only after the other branch is cancelled too.  Its source's
+// cancel callback never settles either:
+function neverCancellableResponse(init: ResponseInit): Response {
+  return new Response(
+    new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(new TextEncoder().encode("never cancelled"));
+      },
+      cancel: () => new Promise(() => {}),
+    }),
+    init,
+  );
+}
+
+test("lookupWebFinger() does not wait for cancelling response bodies", async (t) => {
+  const descriptor: ResourceDescriptor = {
+    subject: "acct:johndoe@example.com",
+    links: [],
+  };
+  fetchMock.mockGlobal();
+  try {
+    await t.step("redirect", async () => {
+      fetchMock.removeRoutes();
+      fetchMock.get(
+        "begin:https://example.com/.well-known/webfinger?",
+        () =>
+          neverCancellableResponse({
+            status: 302,
+            headers: { Location: "/.well-known/webfinger2" },
+          }),
+      );
+      fetchMock.get(
+        "https://example.com/.well-known/webfinger2",
+        () =>
+          new Response(JSON.stringify(descriptor), {
+            headers: { "Content-Type": "application/jrd+json" },
+          }),
+      );
+      deepStrictEqual(
+        await settleWithin(lookupDirect("acct:johndoe@example.com")),
+        descriptor,
+      );
+    });
+
+    await t.step("non-2xx response", async () => {
+      fetchMock.removeRoutes();
+      fetchMock.get(
+        "begin:https://example.com/.well-known/webfinger?",
+        () => neverCancellableResponse({ status: 404 }),
+      );
+      deepStrictEqual(
+        await settleWithin(lookupDirect("acct:johndoe@example.com")),
+        null,
+      );
+    });
+  } finally {
+    fetchMock.hardReset();
+  }
+});
+
+nodeTest(
+  "lookupWebFinger() records network_error for rejected hop addresses",
+  async () => {
+    for (
+      const lookup of [
+        () => Promise.reject(new Error("DNS unavailable")),
+        () => Promise.resolve([]),
+        () => Promise.resolve([{ address: "127.0.0.1", family: 4 }]),
+      ]
+    ) {
+      const [meterProvider, recorder] = createTestMeterProvider();
+      const result = await lookupWebFingerWithDependencies(
+        "acct:alice@dns-failure.invalid",
+        { meterProvider },
+        { openHop: (url) => openPublicFetch(url, { lookup }) },
+      );
+      deepStrictEqual(result, null);
+      const counter = recorder.getMeasurement("webfinger.lookup");
+      ok(counter != null);
+      deepStrictEqual(
+        counter.attributes["webfinger.lookup.result"],
+        "network_error",
+      );
+      deepStrictEqual(
+        counter.attributes["activitypub.remote.host"],
+        "dns-failure.invalid",
+      );
+      deepStrictEqual("http.response.status_code" in counter.attributes, false);
+    }
+  },
+);
+
+nodeTest(
+  "WebFinger diagnostics classify non-object JSON after closing the hop",
+  async () => {
+    for (const body of ["null", "[]", "42", '"text"', "true"]) {
+      const hops = recordHops(() => ({ body }));
+      const [meterProvider, recorder] = createTestMeterProvider();
+      const outcome = await lookupWebFingerWithDependencies(
+        "acct:alice@example.com",
+        { withDiagnostics: true, meterProvider },
+        { openHop: hops.openHop },
+      );
+      deepStrictEqual(outcome, {
+        resource: null,
+        result: "invalid",
+        statusCode: 200,
+        remoteHost: "example.com",
+      });
+      deepStrictEqual(
+        hops.events.at(-1),
+        "close https://example.com/.well-known/webfinger?resource=acct%3Aalice%40example.com",
+      );
+      hops.assertInvariants();
+      deepStrictEqual(
+        recorder.getMeasurement("webfinger.lookup")
+          ?.attributes["webfinger.lookup.result"],
+        "invalid",
+      );
+    }
+  },
+);