@oxy.so/federation 1.0.0 → 1.0.1

package/dist/cjs/networkIdentity.js

@@ -132,6 +132,8 @@ function parseUpstreamProfileUrl(candidateUrl, networks = Object.values(exports.
     }
     if (url.protocol !== 'https:' && url.protocol !== 'http:')
         return undefined;
+    if (url.username || url.password || url.port)
+        return undefined;
     const host = (0, apUri_1.canonicalFederationHost)(url.hostname);
     for (const network of networks) {
         if (!network.profileHosts.some((allowed) => (0, apUri_1.canonicalFederationHost)(allowed) === host))
@@ -188,6 +190,8 @@ function profileUrlHandle(href, allowedHosts, pathPrefix) {
     }
     if (url.protocol !== 'https:' && url.protocol !== 'http:')
         return undefined;
+    if (url.username || url.password || url.port)
+        return undefined;
     const host = (0, apUri_1.canonicalFederationHost)(url.hostname);
     if (!allowedHosts.some((allowed) => (0, apUri_1.canonicalFederationHost)(allowed) === host))
         return undefined;
@@ -201,8 +205,19 @@ function profileUrlHandle(href, allowedHosts, pathPrefix) {
     return decodeURIComponent(segments[pathPrefix.length]);
 }
 /** Every `href="…"` in a sanitized field value, in document order. */
-function fieldHrefs(value) {
+function fieldHrefs(value, requireRelMe = false) {
     const hrefs = [];
+    if (requireRelMe) {
+        for (const anchor of value.matchAll(/<a\b([^>]*)>/gi)) {
+            const rel = /\brel\s*=\s*(?:"([^"]*)"|'([^']*)')/i.exec(anchor[1]);
+            if (!(rel?.[1] ?? rel?.[2] ?? '').toLowerCase().split(/\s+/).includes('me'))
+                continue;
+            const href = /\bhref\s*=\s*(?:"([^"]*)"|'([^']*)')/i.exec(anchor[1]);
+            if (href)
+                hrefs.push(href[1] ?? href[2]);
+        }
+        return hrefs;
+    }
     const pattern = /href="([^"]*)"/gi;
     let match = pattern.exec(value);
     while (match !== null) {
@@ -221,16 +236,29 @@ function upstreamHandleFromProfileField(options) {
     const wanted = options.fieldName.toLowerCase();
     const prefix = options.pathPrefix ?? [];
     return (candidate) => {
+        const handles = new Map();
         for (const field of candidate.fields) {
             if (field.name.trim().toLowerCase() !== wanted)
                 continue;
-            for (const href of fieldHrefs(field.value)) {
-                const handle = profileUrlHandle(href, options.hosts, prefix);
+            for (const href of fieldHrefs(field.value, options.requireRelMe)) {
+                // Observed bird.makeup Official assertion, 2026-09-13:
+                // https://https://twitter.com/jordievole. Repair exactly one duplicated
+                // HTTPS prefix, then run the ordinary host/path/credential validation.
+                const candidateHref = options.repairRepeatedHttpsScheme && href.startsWith('https://https://')
+                    ? href.slice('https://'.length) : href;
+                let handle;
+                try {
+                    handle = profileUrlHandle(candidateHref, options.hosts, prefix);
+                }
+                catch {
+                    continue;
+                }
                 if (handle !== undefined && handle.length > 0)
-                    return handle;
+                    handles.set(handle.toLowerCase(), handle);
             }
         }
-        return undefined;
+        // Conflicting source assertions cannot be settled by document order.
+        return handles.size === 1 ? handles.values().next().value : undefined;
     };
 }
 /**