Fix split-origin WebFinger subjects

CHANGES.md

@@ -18,8 +18,16 @@ To be released.
     collections instead of being treated as unknown routes.
     [[#849], [#851] by ChanHaeng Lee]
 
+ -  Fixed split-origin WebFinger responses for `acct:` aliases on the web
+    origin host.  When a local actor is queried through the server-origin
+    `acct:` alias, Fedify now returns the canonical handle-host `acct:` URI as
+    the JRD `subject` and keeps the queried `acct:` URI in `aliases`.
+    [[#920], [#921]]
+
 [#849]: https://github.com/fedify-dev/fedify/issues/849
 [#851]: https://github.com/fedify-dev/fedify/pull/851
+[#920]: https://github.com/fedify-dev/fedify/issues/920
+[#921]: https://github.com/fedify-dev/fedify/pull/921
 
 ### @fedify/cli
 

packages/fedify/src/federation/webfinger.test.ts

@@ -402,22 +402,47 @@ test("handleWebFinger()", async (t) => {
   });
 
   await t.step("handleHost", async () => {
-    const u = new URL(url);
-    u.searchParams.set("resource", "acct:someone@example.com");
+    let u = new URL("https://ap.example.com/.well-known/webfinger");
+    u.searchParams.set("resource", "acct:someone@ap.example.com");
     let context = createContext(u);
     let request = context.request;
     let response = await handleWebFinger(request, {
       context,
-      host: "handle.example.com",
+      host: "example.com",
       actorDispatcher,
       onNotFound,
     });
     assertEquals(response.status, 200);
     assertEquals(await response.json(), {
-      ...expected,
-      aliases: [...expected.aliases, "acct:someone@handle.example.com"],
+      subject: "acct:someone@example.com",
+      aliases: [
+        "https://ap.example.com/users/someone",
+        "acct:someone@ap.example.com",
+      ],
+      links: [
+        {
+          href: "https://ap.example.com/users/someone",
+          rel: "self",
+          type: "application/activity+json",
+        },
+        {
+          href: "https://ap.example.com/@someone",
+          rel: "http://webfinger.net/rel/profile-page",
+        },
+        {
+          href: "https://ap.example.com/@someone",
+          rel: "alternate",
+          type: "text/html",
+        },
+        {
+          href: "https://ap.example.com/icon.jpg",
+          rel: "http://webfinger.net/rel/avatar",
+          type: "image/jpeg",
+        },
+      ],
     });
 
+    u = new URL(url);
     u.searchParams.set("resource", "acct:someone@handle.example.com");
     context = createContext(u);
     request = context.request;

packages/fedify/src/federation/webfinger.ts

@@ -240,6 +240,7 @@ async function handleWebFingerInternal<TContextData>(
   }
 
   const aliases: string[] = [];
+  let subject = resourceUrl.href;
   if (resourceUrl.protocol != "acct:" && actor.preferredUsername != null) {
     aliases.push(`acct:${actor.preferredUsername}@${host ?? context.url.host}`);
     if (host != null && host !== context.url.host) {
@@ -255,10 +256,11 @@ async function handleWebFingerInternal<TContextData>(
     !resourceUrl.href.endsWith(`@${host}`)
   ) {
     const username = resourceUrl.href.replace(/^acct:/, "").replace(/@.*$/, "");
-    aliases.push(`acct:${username}@${host}`);
+    subject = `acct:${actor.preferredUsername ?? username}@${host}`;
+    aliases.push(resourceUrl.href);
   }
   const jrd: ResourceDescriptor = {
-    subject: resourceUrl.href,
+    subject,
     aliases,
     links,
   };