@oxy.so/federation 2.10.0 → 2.12.0

package/dist/cjs/httpSignature.js

@@ -169,19 +169,30 @@ async function verifyHttpSignature(req, fetchPublicKey, options = {}) {
         return `${name}: ${Array.isArray(value) ? value[0] : value}`;
     });
     const signingString = signingParts.join('\n');
-    const verifier = node_crypto_1.default.createVerify('sha256');
-    verifier.update(signingString);
-    verifier.end();
-    try {
-        const isValid = verifier.verify(keyData.publicKeyPem, parsed.signature, 'base64');
-        return {
-            verified: isValid,
-            actorUri: isValid ? keyData.actorUri : undefined,
-            reason: isValid ? undefined : 'verify-failed',
-        };
-    }
-    catch (err) {
-        options.onDebug?.('HTTP signature verification failed:', err);
-        return { verified: false, reason: err instanceof Error ? err.message : 'verify-exception' };
+    /** `true` when `publicKeyPem` verifies the signature, otherwise why it does not. */
+    const check = (publicKeyPem) => {
+        const verifier = node_crypto_1.default.createVerify('sha256');
+        verifier.update(signingString);
+        verifier.end();
+        try {
+            return verifier.verify(publicKeyPem, parsed.signature, 'base64') || 'verify-failed';
+        }
+        catch (err) {
+            options.onDebug?.('HTTP signature verification failed:', err);
+            return err instanceof Error ? err.message : 'verify-exception';
+        }
+    };
+    const verdict = check(keyData.publicKeyPem);
+    if (verdict === true)
+        return { verified: true, actorUri: keyData.actorUri };
+    // The key may only be out of date: an actor that rotates its key keeps the
+    // keyId and signs with the new one. Ask the owner once before rejecting.
+    const fresh = await fetchPublicKey(parsed.keyId, { refresh: true });
+    if (!fresh || fresh.publicKeyPem === keyData.publicKeyPem) {
+        return { verified: false, reason: verdict };
     }
+    const freshVerdict = check(fresh.publicKeyPem);
+    return freshVerdict === true
+        ? { verified: true, actorUri: fresh.actorUri }
+        : { verified: false, reason: freshVerdict };
 }

package/dist/cjs/node/actorResolver.js

@@ -32,6 +32,13 @@ const boundedBody_1 = require("./boundedBody");
 const ACTOR_REFRESH_MIN_INTERVAL_MS = 6 * 60 * 60 * 1000; // 6 hours
 /** Staleness threshold after which a cached actor is eligible for a background re-fetch. */
 const ACTOR_STALE_MS = 24 * 60 * 60 * 1000; // 24 hours
+/**
+ * How recently fetched an actor must be for its stored key to count as current
+ * when a signature fails against it. An actor fetched this recently is not
+ * fetched again: the key that failed is the one it publishes, and anyone can
+ * send a bad signature naming a real actor's keyId.
+ */
+const KEY_REFETCH_MIN_INTERVAL_MS = 60 * 1000; // 1 minute
 /** The AP content type asked for on signed actor/collection fetches. */
 const AP_CONTENT_TYPE = 'application/activity+json';
 /** Maximum decompressed response sizes accepted from untrusted federation hosts. */
@@ -128,6 +135,8 @@ class ActorResolver {
         this.config = config;
         /** Actor URIs with an in-flight background refresh (guards against refresh storms). */
         this.inFlightActorRefreshes = new Set();
+        /** Actor key refetches in flight, by actor URI: concurrent failed signatures share one. */
+        this.inFlightKeyRefetches = new Map();
     }
     /**
      * Whether an actor URI's host is refused by the instance domain policy. An
@@ -622,14 +631,21 @@ class ActorResolver {
      * still evaluated honestly and its activity is then dropped as policy, rather
      * than being reported as a forged signature. The uncached branch still refuses,
      * because resolving it would mean network I/O toward a blocked host.
+     *
+     * With `refresh`, the key is fetched again from the actor that owns it — asked
+     * when the stored key did not verify a signature, because an actor that rotated
+     * its key keeps its keyId. The stored actor is updated with what comes back.
      */
-    async fetchPublicKey(keyId) {
+    async fetchPublicKey(keyId, options = {}) {
+        const stored = await this.config.store.findActorByPublicKeyId(keyId);
         // keyId is typically the actor URI with #main-key appended
-        const actorUri = keyId.replace(/#.*$/, '');
-        // Check local cache first
-        const cached = await this.config.store.findActorByPublicKeyId(keyId);
-        if (cached?.publicKeyPem) {
-            return { publicKeyPem: cached.publicKeyPem, actorUri: cached.uri };
+        const actorUri = stored?.uri ?? keyId.replace(/#.*$/, '');
+        if (options.refresh) {
+            const actor = await this.refetchActorKey(actorUri);
+            return actor?.publicKeyPem ? { publicKeyPem: actor.publicKeyPem, actorUri: actor.uri } : null;
+        }
+        if (stored?.publicKeyPem) {
+            return { publicKeyPem: stored.publicKeyPem, actorUri: stored.uri };
         }
         // Fetch the actor to get the public key (uses 24h cache)
         const actor = await this.getOrFetchActor(actorUri);
@@ -637,6 +653,28 @@ class ActorResolver {
             return null;
         return { publicKeyPem: actor.publicKeyPem, actorUri: actor.uri };
     }
+    /**
+     * Fetch `actorUri` again for its current key, or null when it was fetched too
+     * recently for that to tell anything new (see {@link KEY_REFETCH_MIN_INTERVAL_MS})
+     * or cannot be fetched. `fetchRemoteActor` refuses a blocked host.
+     */
+    refetchActorKey(actorUri) {
+        let refetch = this.inFlightKeyRefetches.get(actorUri);
+        if (!refetch) {
+            refetch = (async () => {
+                const existing = await this.config.store.findActorByUri(actorUri);
+                const fetchedMs = existing?.lastFetchedAt?.getTime();
+                if (typeof fetchedMs === 'number' && Date.now() - fetchedMs < KEY_REFETCH_MIN_INTERVAL_MS) {
+                    return null;
+                }
+                return this.fetchRemoteActor(actorUri, false, existing?.acct);
+            })().finally(() => {
+                this.inFlightKeyRefetches.delete(actorUri);
+            });
+            this.inFlightKeyRefetches.set(actorUri, refetch);
+        }
+        return refetch;
+    }
 }
 exports.ActorResolver = ActorResolver;
 /** Build the remote-actor resolver from an app's storage + identity + transports. */

package/dist/cjs/node/actorRouter.js

@@ -87,7 +87,7 @@ function createActorRouter(config) {
                 path: req.originalUrl || req.path,
                 headers: req.headers,
                 body: req.rawBody ?? req.body,
-            }, (keyId) => config.inbound.fetchPublicKey(keyId), {
+            }, (keyId, options) => config.inbound.fetchPublicKey(keyId, options), {
                 trustForwardedHost: config.inbound.trustForwardedHost,
                 onDebug: (message, detail) => logger.debug(message, detail),
             });

package/dist/esm/httpSignature.js

@@ -161,19 +161,30 @@ export async function verifyHttpSignature(req, fetchPublicKey, options = {}) {
         return `${name}: ${Array.isArray(value) ? value[0] : value}`;
     });
     const signingString = signingParts.join('\n');
-    const verifier = crypto.createVerify('sha256');
-    verifier.update(signingString);
-    verifier.end();
-    try {
-        const isValid = verifier.verify(keyData.publicKeyPem, parsed.signature, 'base64');
-        return {
-            verified: isValid,
-            actorUri: isValid ? keyData.actorUri : undefined,
-            reason: isValid ? undefined : 'verify-failed',
-        };
-    }
-    catch (err) {
-        options.onDebug?.('HTTP signature verification failed:', err);
-        return { verified: false, reason: err instanceof Error ? err.message : 'verify-exception' };
+    /** `true` when `publicKeyPem` verifies the signature, otherwise why it does not. */
+    const check = (publicKeyPem) => {
+        const verifier = crypto.createVerify('sha256');
+        verifier.update(signingString);
+        verifier.end();
+        try {
+            return verifier.verify(publicKeyPem, parsed.signature, 'base64') || 'verify-failed';
+        }
+        catch (err) {
+            options.onDebug?.('HTTP signature verification failed:', err);
+            return err instanceof Error ? err.message : 'verify-exception';
+        }
+    };
+    const verdict = check(keyData.publicKeyPem);
+    if (verdict === true)
+        return { verified: true, actorUri: keyData.actorUri };
+    // The key may only be out of date: an actor that rotates its key keeps the
+    // keyId and signs with the new one. Ask the owner once before rejecting.
+    const fresh = await fetchPublicKey(parsed.keyId, { refresh: true });
+    if (!fresh || fresh.publicKeyPem === keyData.publicKeyPem) {
+        return { verified: false, reason: verdict };
     }
+    const freshVerdict = check(fresh.publicKeyPem);
+    return freshVerdict === true
+        ? { verified: true, actorUri: fresh.actorUri }
+        : { verified: false, reason: freshVerdict };
 }

package/dist/esm/node/actorResolver.js

@@ -28,6 +28,13 @@ import { readBodyChunks, ResponseBodyTooLargeError } from './boundedBody.js';
 const ACTOR_REFRESH_MIN_INTERVAL_MS = 6 * 60 * 60 * 1000; // 6 hours
 /** Staleness threshold after which a cached actor is eligible for a background re-fetch. */
 const ACTOR_STALE_MS = 24 * 60 * 60 * 1000; // 24 hours
+/**
+ * How recently fetched an actor must be for its stored key to count as current
+ * when a signature fails against it. An actor fetched this recently is not
+ * fetched again: the key that failed is the one it publishes, and anyone can
+ * send a bad signature naming a real actor's keyId.
+ */
+const KEY_REFETCH_MIN_INTERVAL_MS = 60 * 1000; // 1 minute
 /** The AP content type asked for on signed actor/collection fetches. */
 const AP_CONTENT_TYPE = 'application/activity+json';
 /** Maximum decompressed response sizes accepted from untrusted federation hosts. */
@@ -124,6 +131,8 @@ export class ActorResolver {
         this.config = config;
         /** Actor URIs with an in-flight background refresh (guards against refresh storms). */
         this.inFlightActorRefreshes = new Set();
+        /** Actor key refetches in flight, by actor URI: concurrent failed signatures share one. */
+        this.inFlightKeyRefetches = new Map();
     }
     /**
      * Whether an actor URI's host is refused by the instance domain policy. An
@@ -618,14 +627,21 @@ export class ActorResolver {
      * still evaluated honestly and its activity is then dropped as policy, rather
      * than being reported as a forged signature. The uncached branch still refuses,
      * because resolving it would mean network I/O toward a blocked host.
+     *
+     * With `refresh`, the key is fetched again from the actor that owns it — asked
+     * when the stored key did not verify a signature, because an actor that rotated
+     * its key keeps its keyId. The stored actor is updated with what comes back.
      */
-    async fetchPublicKey(keyId) {
+    async fetchPublicKey(keyId, options = {}) {
+        const stored = await this.config.store.findActorByPublicKeyId(keyId);
         // keyId is typically the actor URI with #main-key appended
-        const actorUri = keyId.replace(/#.*$/, '');
-        // Check local cache first
-        const cached = await this.config.store.findActorByPublicKeyId(keyId);
-        if (cached?.publicKeyPem) {
-            return { publicKeyPem: cached.publicKeyPem, actorUri: cached.uri };
+        const actorUri = stored?.uri ?? keyId.replace(/#.*$/, '');
+        if (options.refresh) {
+            const actor = await this.refetchActorKey(actorUri);
+            return actor?.publicKeyPem ? { publicKeyPem: actor.publicKeyPem, actorUri: actor.uri } : null;
+        }
+        if (stored?.publicKeyPem) {
+            return { publicKeyPem: stored.publicKeyPem, actorUri: stored.uri };
         }
         // Fetch the actor to get the public key (uses 24h cache)
         const actor = await this.getOrFetchActor(actorUri);
@@ -633,6 +649,28 @@ export class ActorResolver {
             return null;
         return { publicKeyPem: actor.publicKeyPem, actorUri: actor.uri };
     }
+    /**
+     * Fetch `actorUri` again for its current key, or null when it was fetched too
+     * recently for that to tell anything new (see {@link KEY_REFETCH_MIN_INTERVAL_MS})
+     * or cannot be fetched. `fetchRemoteActor` refuses a blocked host.
+     */
+    refetchActorKey(actorUri) {
+        let refetch = this.inFlightKeyRefetches.get(actorUri);
+        if (!refetch) {
+            refetch = (async () => {
+                const existing = await this.config.store.findActorByUri(actorUri);
+                const fetchedMs = existing?.lastFetchedAt?.getTime();
+                if (typeof fetchedMs === 'number' && Date.now() - fetchedMs < KEY_REFETCH_MIN_INTERVAL_MS) {
+                    return null;
+                }
+                return this.fetchRemoteActor(actorUri, false, existing?.acct);
+            })().finally(() => {
+                this.inFlightKeyRefetches.delete(actorUri);
+            });
+            this.inFlightKeyRefetches.set(actorUri, refetch);
+        }
+        return refetch;
+    }
 }
 /** Build the remote-actor resolver from an app's storage + identity + transports. */
 export function createActorResolver(config) {

package/dist/esm/node/actorRouter.js

@@ -84,7 +84,7 @@ export function createActorRouter(config) {
                 path: req.originalUrl || req.path,
                 headers: req.headers,
                 body: req.rawBody ?? req.body,
-            }, (keyId) => config.inbound.fetchPublicKey(keyId), {
+            }, (keyId, options) => config.inbound.fetchPublicKey(keyId, options), {
                 trustForwardedHost: config.inbound.trustForwardedHost,
                 onDebug: (message, detail) => logger.debug(message, detail),
             });

package/dist/types/httpSignature.d.ts

@@ -74,11 +74,21 @@ export interface VerifyHttpResult {
     actorUri?: string;
     reason?: string;
 }
+/** How {@link FetchPublicKey} is asked for a key. */
+export interface FetchPublicKeyOptions {
+    /**
+     * Fetch the key from the actor that owns it rather than from any copy kept
+     * locally. {@link verifyHttpSignature} asks this once when the key it was
+     * given does not verify: an actor that rotated its key signs with one a
+     * stored copy has never seen. `null` means nothing newer could be had.
+     */
+    refresh?: boolean;
+}
 /**
  * Resolve a `keyId` to its public key PEM and the actor URI that owns it, or
  * `null` when the key cannot be fetched (a failed fetch fails verification).
  */
-export type FetchPublicKey = (keyId: string) => Promise<{
+export type FetchPublicKey = (keyId: string, options?: FetchPublicKeyOptions) => Promise<{
     publicKeyPem: string;
     actorUri: string;
 } | null>;

package/dist/types/index.d.ts

@@ -25,7 +25,7 @@
  * ActivityPub federation shares. Private-key custody is injected; the key never
  * enters this package.
  */
-export { signRequest, verifyHttpSignature, HTTP_SIGNATURE_ALGORITHM, DEFAULT_SIGNED_CONTENT_TYPE, type HttpSignatureSigner, type SignRequestOptions, type VerifyHttpRequest, type VerifyHttpResult, type FetchPublicKey, type VerifyHttpSignatureOptions, } from './httpSignature';
+export { signRequest, verifyHttpSignature, HTTP_SIGNATURE_ALGORITHM, DEFAULT_SIGNED_CONTENT_TYPE, type HttpSignatureSigner, type SignRequestOptions, type VerifyHttpRequest, type VerifyHttpResult, type FetchPublicKey, type FetchPublicKeyOptions, type VerifyHttpSignatureOptions, } from './httpSignature';
 /**
  * Domain-parameterized ActivityPub URL builders — each app instantiates them once
  * with its own `FEDERATION_DOMAIN` so every actor stays `@user@its-own-domain`.

package/dist/types/node/actorResolver.d.ts

@@ -22,6 +22,7 @@ import { type DeriveNetworkIdentity } from '../networkIdentity';
 import type { NormalizedExternalActor } from '../index';
 import type { SignedFetch } from './signedFetch';
 import type { ReportActorGoneOutcome } from './identityBridge';
+import type { FetchPublicKeyOptions } from '../httpSignature';
 /** The minimal fields the resolver reads off / writes to a stored actor record. */
 export interface FederatedActorRecordBase {
     _id?: unknown;
@@ -221,6 +222,8 @@ export declare class ActorResolver<TActor extends FederatedActorRecordBase> {
     private readonly config;
     /** Actor URIs with an in-flight background refresh (guards against refresh storms). */
     private readonly inFlightActorRefreshes;
+    /** Actor key refetches in flight, by actor URI: concurrent failed signatures share one. */
+    private readonly inFlightKeyRefetches;
     constructor(config: ActorResolverConfig<TActor>);
     /**
      * Whether an actor URI's host is refused by the instance domain policy. An
@@ -312,11 +315,21 @@ export declare class ActorResolver<TActor extends FederatedActorRecordBase> {
      * still evaluated honestly and its activity is then dropped as policy, rather
      * than being reported as a forged signature. The uncached branch still refuses,
      * because resolving it would mean network I/O toward a blocked host.
+     *
+     * With `refresh`, the key is fetched again from the actor that owns it — asked
+     * when the stored key did not verify a signature, because an actor that rotated
+     * its key keeps its keyId. The stored actor is updated with what comes back.
      */
-    fetchPublicKey(keyId: string): Promise<{
+    fetchPublicKey(keyId: string, options?: FetchPublicKeyOptions): Promise<{
         publicKeyPem: string;
         actorUri: string;
     } | null>;
+    /**
+     * Fetch `actorUri` again for its current key, or null when it was fetched too
+     * recently for that to tell anything new (see {@link KEY_REFETCH_MIN_INTERVAL_MS})
+     * or cannot be fetched. `fetchRemoteActor` refuses a blocked host.
+     */
+    private refetchActorKey;
 }
 /** Build the remote-actor resolver from an app's storage + identity + transports. */
 export declare function createActorResolver<TActor extends FederatedActorRecordBase>(config: ActorResolverConfig<TActor>): ActorResolver<TActor>;

package/dist/types/node/actorRouter.d.ts

@@ -23,6 +23,7 @@
 import { Router } from 'express';
 import type { AccountKind } from '@oxy.so/contracts';
 import type { User } from '@oxy.so/core';
+import { type FetchPublicKey } from '../httpSignature';
 import type { UrlBuilders } from '../urls';
 import type { LocalActorBuilder } from '../actorObject';
 import { type IsActorGone } from './goneActor';
@@ -93,11 +94,11 @@ export interface ActorRouterConfig {
     getBanner(oxyUserId: string): Promise<string | null>;
     /** Inbound-delivery adapters. */
     inbound: {
-        /** Resolve a `keyId` to its public key PEM + owning actor uri (HTTP-sig verify). */
-        fetchPublicKey(keyId: string): Promise<{
-            publicKeyPem: string;
-            actorUri: string;
-        } | null>;
+        /**
+         * Resolve a `keyId` to its public key PEM + owning actor uri (HTTP-sig verify).
+         * Asked again with `refresh` when the key it gave does not verify.
+         */
+        fetchPublicKey: FetchPublicKey;
         /** Whether to trust `X-Forwarded-Host` when reconstructing the signed host line. */
         trustForwardedHost: boolean;
         /** Enqueue a verified inbound activity for async processing (false ⇒ process inline). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/federation",
-  "version": "2.10.0",
+  "version": "2.12.0",
   "description": "Oxy Federation — the app-agnostic ActivityPub identity + follow engine substrate: the network-connector contract, normalized cross-network DTOs, HTTP signatures, actor resolution, the outbound delivery transport + follow lifecycle, the inbound dispatcher, and the webfinger/actor/inbox Express routers. Domain-parameterized so every Oxy app backend federates under its own domain.",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -75,12 +75,11 @@
     "clean": "rm -rf dist",
     "typescript": "tsc --noEmit",
     "test": "jest --passWithNoTests",
-    "lint": "biome lint --error-on-warnings ./src",
-    "prepublishOnly": "node ../../scripts/assert-bun-publish.mjs && bun run clean && bun run build"
+    "lint": "biome lint --error-on-warnings ./src"
   },
   "dependencies": {
-    "@oxy.so/contracts": "^1.0.0 || ^2.0.0 || ^3.0.0 || ^4.0.0 || ^5.0.0 || 4.11.0-oxy-one.0",
-    "@oxy.so/core": "^6.14.0"
+    "@oxy.so/contracts": "^1.0.0 || ^2.0.0 || ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || 4.11.0-oxy-one.0",
+    "@oxy.so/core": "^6.14.0 || ^7.0.0"
   },
   "peerDependencies": {
     "express": "^4.18.0 || ^5.0.0"

package/src/__tests__/actorResolver.test.ts

@@ -173,6 +173,26 @@ describe('fetchPublicKey — signature lookups stay honest', () => {
     });
   });
 
+  it('refetches a key on refresh, unless its actor was fetched just now', async () => {
+    const keyId = `${ALLOWED_ACTOR}#main-key`;
+    const cachedKey = { uri: ALLOWED_ACTOR, publicKeyPem: 'PEM' };
+    const lastWeek = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);
+
+    const stale = makeResolver({
+      cachedKey,
+      cached: { uri: ALLOWED_ACTOR, lastFetchedAt: lastWeek },
+    });
+    await stale.resolver.fetchPublicKey(keyId, { refresh: true });
+    expect(stale.signedFetchCalls).toEqual([ALLOWED_ACTOR]);
+
+    const fresh = makeResolver({
+      cachedKey,
+      cached: { uri: ALLOWED_ACTOR, lastFetchedAt: new Date() },
+    });
+    await expect(fresh.resolver.fetchPublicKey(keyId, { refresh: true })).resolves.toBeNull();
+    expect(fresh.signedFetchCalls).toHaveLength(0);
+  });
+
   it('will not resolve a blocked domain key that would require network I/O', async () => {
     const rig = makeResolver({ cachedKey: null, cached: null });
     await expect(rig.resolver.fetchPublicKey(`${BLOCKED_ACTOR}#main-key`)).resolves.toBeNull();

package/src/__tests__/httpSignature.test.ts

@@ -249,6 +249,28 @@ describe('verifyHttpSignature', () => {
     expect(result.reason).toBe('verify-failed');
   });
 
+  it('asks for the key again once when the stored one is out of date', async () => {
+    const body = JSON.stringify({ type: 'Create', id: 'https://remote/a/1' });
+    const signed = await signRequest(sign, KEY_ID, 'POST', INBOX_URL, body);
+    const { publicKey: replacedKey } = crypto.generateKeyPairSync('rsa', {
+      modulusLength: 2048,
+      publicKeyEncoding: { type: 'spki', format: 'pem' },
+    });
+    const asked: unknown[] = [];
+    const result = await verifyHttpSignature(
+      { method: 'POST', path: new URL(INBOX_URL).pathname, headers: lowerHeaders(signed), body },
+      async (keyId, options) => {
+        asked.push(options);
+        return {
+          publicKeyPem: options?.refresh ? TEST_PUBLIC_KEY_PEM : replacedKey,
+          actorUri: ACTOR_URI,
+        };
+      },
+    );
+    expect(result).toEqual({ verified: true, actorUri: ACTOR_URI });
+    expect(asked).toEqual([undefined, { refresh: true }]);
+  });
+
   it('rejects when the Date header is outside the allowed skew', async () => {
     const body = JSON.stringify({ type: 'Create', id: 'https://remote/a/1' });
     const signed = await signRequest(sign, KEY_ID, 'POST', INBOX_URL, body);

package/src/httpSignature.ts

@@ -155,12 +155,24 @@ export interface VerifyHttpResult {
   reason?: string;
 }
 
+/** How {@link FetchPublicKey} is asked for a key. */
+export interface FetchPublicKeyOptions {
+  /**
+   * Fetch the key from the actor that owns it rather than from any copy kept
+   * locally. {@link verifyHttpSignature} asks this once when the key it was
+   * given does not verify: an actor that rotated its key signs with one a
+   * stored copy has never seen. `null` means nothing newer could be had.
+   */
+  refresh?: boolean;
+}
+
 /**
  * Resolve a `keyId` to its public key PEM and the actor URI that owns it, or
  * `null` when the key cannot be fetched (a failed fetch fails verification).
  */
 export type FetchPublicKey = (
   keyId: string,
+  options?: FetchPublicKeyOptions,
 ) => Promise<{ publicKeyPem: string; actorUri: string } | null>;
 
 /** Options controlling inbound signature verification. */
@@ -264,19 +276,30 @@ export async function verifyHttpSignature(
   });
 
   const signingString = signingParts.join('\n');
-  const verifier = crypto.createVerify('sha256');
-  verifier.update(signingString);
-  verifier.end();
+  /** `true` when `publicKeyPem` verifies the signature, otherwise why it does not. */
+  const check = (publicKeyPem: string): true | string => {
+    const verifier = crypto.createVerify('sha256');
+    verifier.update(signingString);
+    verifier.end();
+    try {
+      return verifier.verify(publicKeyPem, parsed.signature, 'base64') || 'verify-failed';
+    } catch (err) {
+      options.onDebug?.('HTTP signature verification failed:', err);
+      return err instanceof Error ? err.message : 'verify-exception';
+    }
+  };
+
+  const verdict = check(keyData.publicKeyPem);
+  if (verdict === true) return { verified: true, actorUri: keyData.actorUri };
 
-  try {
-    const isValid = verifier.verify(keyData.publicKeyPem, parsed.signature, 'base64');
-    return {
-      verified: isValid,
-      actorUri: isValid ? keyData.actorUri : undefined,
-      reason: isValid ? undefined : 'verify-failed',
-    };
-  } catch (err) {
-    options.onDebug?.('HTTP signature verification failed:', err);
-    return { verified: false, reason: err instanceof Error ? err.message : 'verify-exception' };
+  // The key may only be out of date: an actor that rotates its key keeps the
+  // keyId and signs with the new one. Ask the owner once before rejecting.
+  const fresh = await fetchPublicKey(parsed.keyId, { refresh: true });
+  if (!fresh || fresh.publicKeyPem === keyData.publicKeyPem) {
+    return { verified: false, reason: verdict };
   }
+  const freshVerdict = check(fresh.publicKeyPem);
+  return freshVerdict === true
+    ? { verified: true, actorUri: fresh.actorUri }
+    : { verified: false, reason: freshVerdict };
 }

package/src/index.ts

@@ -36,6 +36,7 @@ export {
   type VerifyHttpRequest,
   type VerifyHttpResult,
   type FetchPublicKey,
+  type FetchPublicKeyOptions,
   type VerifyHttpSignatureOptions,
 } from './httpSignature';
 

package/src/node/actorResolver.ts

@@ -30,6 +30,7 @@ import type { NormalizedExternalActor } from '../index';
 import { readBodyChunks, ResponseBodyTooLargeError } from './boundedBody';
 import type { SignedFetch } from './signedFetch';
 import type { ReportActorGoneOutcome } from './identityBridge';
+import type { FetchPublicKeyOptions } from '../httpSignature';
 
 /**
  * Minimum interval between background actor refreshes for the same actor.
@@ -40,6 +41,14 @@ const ACTOR_REFRESH_MIN_INTERVAL_MS = 6 * 60 * 60 * 1000; // 6 hours
 /** Staleness threshold after which a cached actor is eligible for a background re-fetch. */
 const ACTOR_STALE_MS = 24 * 60 * 60 * 1000; // 24 hours
 
+/**
+ * How recently fetched an actor must be for its stored key to count as current
+ * when a signature fails against it. An actor fetched this recently is not
+ * fetched again: the key that failed is the one it publishes, and anyone can
+ * send a bad signature naming a real actor's keyId.
+ */
+const KEY_REFETCH_MIN_INTERVAL_MS = 60 * 1000; // 1 minute
+
 /** The AP content type asked for on signed actor/collection fetches. */
 const AP_CONTENT_TYPE = 'application/activity+json';
 
@@ -342,6 +351,9 @@ export class ActorResolver<TActor extends FederatedActorRecordBase> {
   /** Actor URIs with an in-flight background refresh (guards against refresh storms). */
   private readonly inFlightActorRefreshes = new Set<string>();
 
+  /** Actor key refetches in flight, by actor URI: concurrent failed signatures share one. */
+  private readonly inFlightKeyRefetches = new Map<string, Promise<TActor | null>>();
+
   constructor(private readonly config: ActorResolverConfig<TActor>) {}
 
   /**
@@ -897,15 +909,26 @@ export class ActorResolver<TActor extends FederatedActorRecordBase> {
    * still evaluated honestly and its activity is then dropped as policy, rather
    * than being reported as a forged signature. The uncached branch still refuses,
    * because resolving it would mean network I/O toward a blocked host.
+   *
+   * With `refresh`, the key is fetched again from the actor that owns it — asked
+   * when the stored key did not verify a signature, because an actor that rotated
+   * its key keeps its keyId. The stored actor is updated with what comes back.
    */
-  async fetchPublicKey(keyId: string): Promise<{ publicKeyPem: string; actorUri: string } | null> {
+  async fetchPublicKey(
+    keyId: string,
+    options: FetchPublicKeyOptions = {},
+  ): Promise<{ publicKeyPem: string; actorUri: string } | null> {
+    const stored = await this.config.store.findActorByPublicKeyId(keyId);
     // keyId is typically the actor URI with #main-key appended
-    const actorUri = keyId.replace(/#.*$/, '');
+    const actorUri = stored?.uri ?? keyId.replace(/#.*$/, '');
+
+    if (options.refresh) {
+      const actor = await this.refetchActorKey(actorUri);
+      return actor?.publicKeyPem ? { publicKeyPem: actor.publicKeyPem, actorUri: actor.uri } : null;
+    }
 
-    // Check local cache first
-    const cached = await this.config.store.findActorByPublicKeyId(keyId);
-    if (cached?.publicKeyPem) {
-      return { publicKeyPem: cached.publicKeyPem, actorUri: cached.uri };
+    if (stored?.publicKeyPem) {
+      return { publicKeyPem: stored.publicKeyPem, actorUri: stored.uri };
     }
 
     // Fetch the actor to get the public key (uses 24h cache)
@@ -914,6 +937,29 @@ export class ActorResolver<TActor extends FederatedActorRecordBase> {
 
     return { publicKeyPem: actor.publicKeyPem, actorUri: actor.uri };
   }
+
+  /**
+   * Fetch `actorUri` again for its current key, or null when it was fetched too
+   * recently for that to tell anything new (see {@link KEY_REFETCH_MIN_INTERVAL_MS})
+   * or cannot be fetched. `fetchRemoteActor` refuses a blocked host.
+   */
+  private refetchActorKey(actorUri: string): Promise<TActor | null> {
+    let refetch = this.inFlightKeyRefetches.get(actorUri);
+    if (!refetch) {
+      refetch = (async () => {
+        const existing = await this.config.store.findActorByUri(actorUri);
+        const fetchedMs = existing?.lastFetchedAt?.getTime();
+        if (typeof fetchedMs === 'number' && Date.now() - fetchedMs < KEY_REFETCH_MIN_INTERVAL_MS) {
+          return null;
+        }
+        return this.fetchRemoteActor(actorUri, false, existing?.acct);
+      })().finally(() => {
+        this.inFlightKeyRefetches.delete(actorUri);
+      });
+      this.inFlightKeyRefetches.set(actorUri, refetch);
+    }
+    return refetch;
+  }
 }
 
 /** Build the remote-actor resolver from an app's storage + identity + transports. */

package/src/node/actorRouter.ts

@@ -26,7 +26,7 @@ import type { AccountKind } from '@oxy.so/contracts';
 import type { User } from '@oxy.so/core';
 import { AP_CONTEXT } from '../apContext';
 import { discoveryCacheControl } from './httpCacheControl';
-import { verifyHttpSignature } from '../httpSignature';
+import { type FetchPublicKey, verifyHttpSignature } from '../httpSignature';
 import type { UrlBuilders } from '../urls';
 import { INSTANCE_ACTOR_USERNAME, normalizeActorUsername } from '../urls';
 import type { LocalActorBuilder } from '../actorObject';
@@ -104,8 +104,11 @@ export interface ActorRouterConfig {
   getBanner(oxyUserId: string): Promise<string | null>;
   /** Inbound-delivery adapters. */
   inbound: {
-    /** Resolve a `keyId` to its public key PEM + owning actor uri (HTTP-sig verify). */
-    fetchPublicKey(keyId: string): Promise<{ publicKeyPem: string; actorUri: string } | null>;
+    /**
+     * Resolve a `keyId` to its public key PEM + owning actor uri (HTTP-sig verify).
+     * Asked again with `refresh` when the key it gave does not verify.
+     */
+    fetchPublicKey: FetchPublicKey;
     /** Whether to trust `X-Forwarded-Host` when reconstructing the signed host line. */
     trustForwardedHost: boolean;
     /** Enqueue a verified inbound activity for async processing (false ⇒ process inline). */
@@ -212,7 +215,7 @@ export function createActorRouter(config: ActorRouterConfig): Router {
           headers: req.headers as Record<string, string | string[] | undefined>,
           body: req.rawBody ?? req.body,
         },
-        (keyId) => config.inbound.fetchPublicKey(keyId),
+        (keyId, options) => config.inbound.fetchPublicKey(keyId, options),
         {
           trustForwardedHost: config.inbound.trustForwardedHost,
           onDebug: (message, detail) => logger.debug(message, detail),