Merge pull request #1041 from dahlia/fep-938-map-local-vector

Support map-local compound proofs

Author: dahlia

CHANGES.md

@@ -127,13 +127,22 @@ To be released.
     `esnext.temporal` lib reference.
     [[#823], [#925]]
 
+ -  Security: Inbox processing now independently verifies each portable actor,
+    activity, and object in a compound JSON document against its own map-local
+    Object Integrity Proof before dispatch.  A valid outer proof no longer
+    authenticates an unsigned or invalid nested portable object.
+    Portable documents with proof sets or which exceed the inbox compound
+    traversal limits are rejected as unsupported.
+    [[#288], [#938], [#1041]]
+
 [key–value store guide]: https://fedify.dev/manual/kv
 [FEP-ef61]: https://w3id.org/fep/ef61
 [FEP-8b32]: https://w3id.org/fep/8b32
 [FEP-fe34]: https://w3id.org/fep/fe34
 [ActivityPub Media Upload extension]: https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload
 [Standard Schema]: https://standardschema.dev/
 [#206]: https://github.com/fedify-dev/fedify/issues/206
+[#288]: https://github.com/fedify-dev/fedify/issues/288
 [#754]: https://github.com/fedify-dev/fedify/issues/754
 [#797]: https://github.com/fedify-dev/fedify/issues/797
 [#798]: https://github.com/fedify-dev/fedify/issues/798
@@ -152,9 +161,11 @@ To be released.
 [#927]: https://github.com/fedify-dev/fedify/pull/927
 [#930]: https://github.com/fedify-dev/fedify/issues/930
 [#934]: https://github.com/fedify-dev/fedify/pull/934
+[#938]: https://github.com/fedify-dev/fedify/issues/938
 [#968]: https://github.com/fedify-dev/fedify/pull/968
 [#1017]: https://github.com/fedify-dev/fedify/issues/1017
 [#1027]: https://github.com/fedify-dev/fedify/pull/1027
+[#1041]: https://github.com/fedify-dev/fedify/pull/1041
 
 ### @fedify/adonisjs
 

changes.d/fedify/compound-portable-proofs.md

@@ -0,0 +1,13 @@
+---
+links:
+  '#1041': https://github.com/fedify-dev/fedify/pull/1041
+  '#288': https://github.com/fedify-dev/fedify/issues/288
+  '#938': https://github.com/fedify-dev/fedify/issues/938
+---
+ -  Security: Inbox processing now independently verifies each portable actor,
+    activity, and object in a compound JSON document against its own map-local
+    Object Integrity Proof before dispatch.  A valid outer proof no longer
+    authenticates an unsigned or invalid nested portable object.
+    Portable documents with proof sets or which exceed the inbox compound
+    traversal limits are rejected as unsupported.
+    [[#288], [#938], [#1041]]

docs/manual/inbox.md

@@ -37,6 +37,26 @@ why some activities are rejected, you can turn on [logging](./log.md) for
 [Linked Data Signatures]: https://web.archive.org/web/20170923124140/https://w3c-dvcg.github.io/ld-signatures/
 [FEP-8b32]: https://w3id.org/fep/8b32
 
+### Compound portable objects
+
+The inbox independently verifies every JSON map with an [FEP-ef61] portable
+`id` or `@id`, including embedded collections, with the
+[map-local compound-proof profile](./send.md#compound-portable-objects).  A
+valid proof on the outer activity does not authenticate an unsigned or invalid
+portable object embedded within it.  The gateway trust allowance for an
+unsigned top-level portable collection does not apply inside a compound
+document; an embedded portable collection needs its own proof and `@context`.
+
+This check uses the original received JSON after the normal outer
+authentication and actor ownership checks.  Fedify consumes a deferred
+signature nonce only after the entire compound document passes verification.
+It also verifies the complete result before dispatching the activity through a
+queue, route, or listener.  Unsupported proof shapes and documents that exceed
+the inspection or verification limits receive `401 Unauthorized`.  Fedify does
+not dispatch any part of those documents to application code.
+
+[FEP-ef61]: https://w3id.org/fep/ef61
+
 ### `Accept-Signature` challenges
 
 *This API is available since Fedify 2.1.0.*

docs/manual/send.md

@@ -1139,6 +1139,51 @@ caller can apply the separate gateway trust policy allowed by [FEP-ef61].
 embedded portable object needs its own verification; success for an outer
 activity does not authenticate portable objects nested inside it.
 
+[FEP-8b32]: https://w3id.org/fep/8b32
+[FEP-ef61]: https://w3id.org/fep/ef61
+[FEP-fe34]: https://w3id.org/fep/fe34
+
+### Compound portable objects
+
+For compound documents containing [FEP-ef61] portable objects, Fedify inboxes
+use a bounded, map-local interoperability profile.  Neither [FEP-8b32] nor
+Verifiable Credential Data Integrity currently specifies this compound-document
+algorithm.
+
+The profile treats each JSON map with a direct literal `proof` property as a
+separate secured document.  Verification removes only that map's `proof` and
+leaves proofs on descendant maps in place.  Replacing a valid child proof
+therefore invalidates an outer proof that covered the original secured child.
+Fedify requires a direct proof.  It does not treat proof aliases, sets, chains,
+or remote references as alternatives.
+
+Every embedded portable map needs one direct inline proof and its own explicit
+`@context`.  Fedify verifies each map against an immutable copy of the received
+JSON and applies the FEP-ef61 portable-ID and controlling-DID policy to that
+map. It does not copy a parent's context into a child, try several
+proof-removal rules, or fetch an unpinned context from the live network.
+Inputs that exceed the traversal limits are rejected.  Fedify does not return
+authentication results for only part of a compound document.
+
+This profile authenticates JSON snapshots.  A child proof may be valid when
+verified in isolation even if the parent's active context causes the embedded
+JSON-LD to expand differently.  Proof success does not establish that the
+isolated and embedded expansions are equivalent.
+
+> [!WARNING]
+> Typed vocabulary serialization can change the secured representation of a
+> signed embedded object.  Signing a typed child, assigning it to a typed
+> parent, and serializing the parent can remove the child's document and proof
+> contexts while retaining its `proofValue`.  Do not serialize a signed typed
+> child through a typed parent when producing a map-local compound document.
+> The profile also accepts exactly one direct proof per map, while Fedify's
+> ordinary activity signer creates one proof for each Ed25519 key.  A sender
+> producing a portable compound document must arrange for exactly one direct
+> proof on each map.
+> When forwarding an already signed payload, use
+> [`forwardActivity()`](./outbox.md#federating-posted-activities) to avoid a
+> vocabulary-object round trip.
+
 > [!TIP]
 > HTTPS Signatures, Linked Data Signatures, and Object Integrity Proofs can
 > coexist in an application and be used together for maximum compatibility.
@@ -1154,10 +1199,6 @@ activity does not authenticate portable objects nested inside it.
 > Proofs simultaneously, you need to generate both RSA-PKCS#1-v1.5 and Ed25519
 > key pairs for each actor, and store them in the database.
 
-[FEP-8b32]: https://w3id.org/fep/8b32
-[FEP-ef61]: https://w3id.org/fep/ef61
-[FEP-fe34]: https://w3id.org/fep/fe34
-
 
 Activity transformers
 ---------------------

packages/fedify/deno.json

@@ -46,6 +46,7 @@
       "src/testing/",
       "tsdown.config.ts",
       "scripts/",
+      "test-vectors/",
       "wrangler.toml"
     ]
   },