feat: create @helia/verified-fetch (#392)

Adds a `@helia/verified-fetch` module that makes fetching verified, trustless content from the distributed web as easy as using window.fetch.

```typescript
import { createVerifiedFetch } from '@helia/verified-fetch'

const fetch = await createVerifiedFetch({
  gateways: ['https://mygateway.example.net', 'https://trustless-gateway.link'],
  routers: ['https://myrouter.example.net', 'https://delegated-ipfs.dev']
})

const resp = await fetch('ipfs://bafy...')
const json = await resp.json()
```

Fixes #348

---------

Co-authored-by: Daniel Norman <1992255+2color@users.noreply.github.com>
Co-authored-by: Alex Potsides <alex@achingbrain.net>
Co-authored-by: Marcin Rataj <lidel@lidel.org>

.release-please-manifest.json

@@ -13,5 +13,6 @@
   "packages/unixfs": "3.0.0",
   "packages/utils": "0.0.1",
   "packages/http": "1.0.1",
-  "packages/routers": "1.0.0"
+  "packages/routers": "1.0.0",
+  "packages/verified-fetch": "0.0.0"
 }

.release-please.json

@@ -23,6 +23,7 @@
     "packages/routers": {},
     "packages/strings": {},
     "packages/unixfs": {},
-    "packages/utils": {}
+    "packages/utils": {},
+    "packages/verified-fetch": {}
   }
 }

packages/interop/package.json

@@ -70,9 +70,10 @@
     "@helia/routers": "^1.0.0",
     "@helia/strings": "^3.0.0",
     "@helia/unixfs": "^3.0.0",
+    "@helia/verified-fetch": "^0.0.0",
     "@ipld/car": "^5.2.5",
-    "@ipld/dag-cbor": "^9.0.7",
-    "@libp2p/interface": "^1.1.1",
+    "@ipld/dag-cbor": "^9.1.0",
+    "@libp2p/interface": "^1.1.2",
     "@libp2p/kad-dht": "^12.0.2",
     "@libp2p/keychain": "^4.0.7",
     "@libp2p/peer-id": "^4.0.5",

packages/interop/src/fixtures/load-fixture-data.ts

@@ -0,0 +1,9 @@
+import loadFixture from 'aegir/fixtures'
+import drain from 'it-drain'
+import type { Controller } from 'ipfsd-ctl'
+
+export async function loadFixtureDataCar (controller: Controller, path: string): Promise<void> {
+  const fixtureData = `src/fixtures/data/${path}`
+  const buf = loadFixture(fixtureData)
+  await drain(controller.api.dag.import([buf]))
+}

packages/interop/src/verified-fetch-json.spec.ts

@@ -0,0 +1,48 @@
+/* eslint-env mocha */
+import { createVerifiedFetch } from '@helia/verified-fetch'
+import { expect } from 'aegir/chai'
+import { CID } from 'multiformats/cid'
+import { createKuboNode } from './fixtures/create-kubo.js'
+import { loadFixtureDataCar } from './fixtures/load-fixture-data.js'
+import type { Controller } from 'ipfsd-ctl'
+
+describe('@helia/verified-fetch - json', () => {
+  describe('unixfs - multiblock', () => {
+    let controller: Controller<'go'>
+    let verifiedFetch: Awaited<ReturnType<typeof createVerifiedFetch>>
+
+    before(async () => {
+      controller = await createKuboNode()
+      await controller.start()
+      // As of 2024-01-18, https://cloudflare-ipfs.com/ipns/tokens.uniswap.org resolves to:
+      // root: QmQJ8fxavY54CUsxMSx9aE9Rdcmvhx8awJK2jzJp4iAqCr
+      // child1: QmNik5N4ryNwzzXYq5hCYKGcRjAf9QtigxtiJh9o8aXXbG // partial JSON
+      // child2: QmWNBJX6fZyNTLWNYBHxAHpBctCP43R2zeqV2G8uavqFZn // partial JSON
+      await loadFixtureDataCar(controller, 'QmQJ8fxavY54CUsxMSx9aE9Rdcmvhx8awJK2jzJp4iAqCr-tokens.uniswap.org-2024-01-18.car')
+      verifiedFetch = await createVerifiedFetch({
+        gateways: [`http://${controller.api.gatewayHost}:${controller.api.gatewayPort}`],
+        // Temporarily disabling delegated routers in browser until CORS issue is fixed. see https://github.com/ipshipyard/waterworks-community/issues/4
+        routers: process.env.RUNNER_ENV === 'node' ? [`http://${controller.api.gatewayHost}:${controller.api.gatewayPort}`] : []
+      })
+    })
+
+    after(async () => {
+      await controller.stop()
+      await verifiedFetch.stop()
+    })
+
+    it('handles UnixFS-chunked JSON file', async () => {
+      const resp = await verifiedFetch(CID.parse('QmQJ8fxavY54CUsxMSx9aE9Rdcmvhx8awJK2jzJp4iAqCr'))
+      expect(resp).to.be.ok()
+      const jsonObj = await resp.json()
+      expect(jsonObj).to.be.ok()
+      expect(jsonObj).to.have.property('name').equal('Uniswap Labs Default')
+      expect(jsonObj).to.have.property('timestamp').equal('2023-12-13T18:25:25.830Z')
+      expect(jsonObj).to.have.property('version').to.deep.equal({ major: 11, minor: 11, patch: 0 })
+      expect(jsonObj).to.have.property('tags')
+      expect(jsonObj).to.have.property('logoURI').equal('ipfs://QmNa8mQkrNKp1WEEeGjFezDmDeodkWRevGFN8JCV7b4Xir')
+      expect(jsonObj).to.have.property('keywords').to.deep.equal(['uniswap', 'default'])
+      expect(jsonObj.tokens).to.be.an('array').of.length(767)
+    })
+  })
+})

packages/interop/src/verified-fetch-unixfs-dir.spec.ts

@@ -0,0 +1,76 @@
+/* eslint-env mocha */
+import { createVerifiedFetch } from '@helia/verified-fetch'
+import { expect } from 'aegir/chai'
+import { createKuboNode } from './fixtures/create-kubo.js'
+import { loadFixtureDataCar } from './fixtures/load-fixture-data.js'
+import type { Controller } from 'ipfsd-ctl'
+
+describe('@helia/verified-fetch - unixfs directory', () => {
+  let controller: Controller
+  let verifiedFetch: Awaited<ReturnType<typeof createVerifiedFetch>>
+
+  before(async () => {
+    controller = await createKuboNode()
+    await controller.start()
+    verifiedFetch = await createVerifiedFetch({
+      gateways: [`http://${controller.api.gatewayHost}:${controller.api.gatewayPort}`],
+      // Temporarily disabling delegated routers in browser until CORS issue is fixed. see https://github.com/ipshipyard/waterworks-community/issues/4
+      routers: process.env.RUNNER_ENV === 'node' ? [`http://${controller.api.gatewayHost}:${controller.api.gatewayPort}`] : []
+    })
+  })
+
+  after(async () => {
+    await controller.stop()
+    await verifiedFetch.stop()
+  })
+
+  describe('XKCD Barrel Part 1', () => {
+    before(async () => {
+      // This is the content of https://explore.ipld.io/#/explore/QmdmQXB2mzChmMeKY47C43LxUdg1NDJ5MWcKMKxDu7RgQm/1%20-%20Barrel%20-%20Part%201
+      await loadFixtureDataCar(controller, 'QmbQDovX7wRe9ek7u6QXe9zgCXkTzoUSsTFJEkrYV1HrVR-xkcd-Barrel-part-1.car')
+    })
+
+    it('fails to load when passed the root', async () => {
+      // The spec says we should generate HTML with directory listings, but we don't do that yet, so expect a failure
+      const resp = await verifiedFetch('ipfs://QmbQDovX7wRe9ek7u6QXe9zgCXkTzoUSsTFJEkrYV1HrVR')
+      expect(resp).to.be.ok()
+      expect(resp.status).to.equal(501) // TODO: we should do a directory listing instead
+    })
+
+    it('can return a string for unixfs pathed data', async () => {
+      const resp = await verifiedFetch('ipfs://QmbQDovX7wRe9ek7u6QXe9zgCXkTzoUSsTFJEkrYV1HrVR/1 - Barrel - Part 1 - alt.txt')
+      expect(resp).to.be.ok()
+      const text = await resp.text()
+      expect(text).to.equal('Don\'t we all.')
+      expect(resp.headers.get('content-type')).to.equal('text/plain')
+    })
+
+    it('can return an image for unixfs pathed data', async () => {
+      const resp = await verifiedFetch('ipfs://QmbQDovX7wRe9ek7u6QXe9zgCXkTzoUSsTFJEkrYV1HrVR/1 - Barrel - Part 1.png')
+      expect(resp).to.be.ok()
+      expect(resp.headers.get('content-type')).to.equal('image/png')
+      const imgData = await resp.blob()
+      expect(imgData).to.be.ok()
+      expect(imgData.size).to.equal(24848)
+    })
+  })
+
+  // TODO: find a smaller car file so the test doesn't timeout locally or flake on CI
+  describe.skip('HAMT-sharded directory', () => {
+    before(async () => {
+      // from https://github.com/ipfs/gateway-conformance/blob/193833b91f2e9b17daf45c84afaeeae61d9d7c7e/fixtures/trustless_gateway_car/single-layer-hamt-with-multi-block-files.car
+      await loadFixtureDataCar(controller, 'bafybeidbclfqleg2uojchspzd4bob56dqetqjsj27gy2cq3klkkgxtpn4i-single-layer-hamt-with-multi-block-files.car')
+    })
+
+    it('loads path /ipfs/bafybeidbclfqleg2uojchspzd4bob56dqetqjsj27gy2cq3klkkgxtpn4i/685.txt', async () => {
+      const resp = await verifiedFetch('ipfs://bafybeidbclfqleg2uojchspzd4bob56dqetqjsj27gy2cq3klkkgxtpn4i/685.txt')
+      expect(resp).to.be.ok()
+      expect(resp.headers.get('content-type')).to.equal('text/plain')
+      const text = await resp.text()
+      // npx kubo@0.25.0 cat '/ipfs/bafybeidbclfqleg2uojchspzd4bob56dqetqjsj27gy2cq3klkkgxtpn4i/685.txt'
+      expect(text).to.equal(`Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nunc non imperdiet nunc. Proin ac quam ut nibh eleifend aliquet. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia curae; Sed ligula dolor, imperdiet sagittis arcu et, semper tincidunt urna. Donec et tempor augue, quis sollicitudin metus. Curabitur semper ullamcorper aliquet. Mauris hendrerit sodales lectus eget fermentum. Proin sollicitudin vestibulum commodo. Vivamus nec lectus eu augue aliquet dignissim nec condimentum justo. In hac habitasse platea dictumst. Mauris vel sem neque.
+
+Vivamus finibus, enim at lacinia semper, arcu erat gravida lacus, sit amet gravida magna orci sit amet est. Sed non leo lacus. Nullam viverra ipsum a tincidunt dapibus. Nulla pulvinar ligula sit amet ante ultrices tempus. Proin purus urna, semper sed lobortis quis, gravida vitae ipsum. Aliquam mi urna, pulvinar eu bibendum quis, convallis ac dolor. In gravida justo sed risus ullamcorper, vitae luctus massa hendrerit. Pellentesque habitant amet.`)
+    })
+  })
+})

packages/interop/src/verified-fetch-websites.spec.ts

@@ -0,0 +1,87 @@
+/* eslint-env mocha */
+import { createVerifiedFetch } from '@helia/verified-fetch'
+import { expect } from 'aegir/chai'
+import { createKuboNode } from './fixtures/create-kubo.js'
+import { loadFixtureDataCar } from './fixtures/load-fixture-data.js'
+import type { Controller } from 'ipfsd-ctl'
+
+describe('@helia/verified-fetch - websites', () => {
+  describe('helia-identify.on.fleek.co', () => {
+    let controller: Controller<'go'>
+    let verifiedFetch: Awaited<ReturnType<typeof createVerifiedFetch>>
+
+    before(async () => {
+      controller = await createKuboNode()
+      await controller.start()
+      // 2024-01-22 CID for _dnslink.helia-identify.on.fleek.co
+      await loadFixtureDataCar(controller, 'QmbxpRxwKXxnJQjnPqm1kzDJSJ8YgkLxH23mcZURwPHjGv-helia-identify-website.car')
+      verifiedFetch = await createVerifiedFetch({
+        gateways: [`http://${controller.api.gatewayHost}:${controller.api.gatewayPort}`],
+        // Temporarily disabling delegated routers in browser until CORS issue is fixed. see https://github.com/ipshipyard/waterworks-community/issues/4
+        routers: process.env.RUNNER_ENV === 'node' ? [`http://${controller.api.gatewayHost}:${controller.api.gatewayPort}`] : []
+      })
+    })
+
+    after(async () => {
+      await controller.stop()
+      await verifiedFetch.stop()
+    })
+
+    it('loads index.html when passed helia-identify.on.fleek.co root CID', async () => {
+      const resp = await verifiedFetch('ipfs://QmbxpRxwKXxnJQjnPqm1kzDJSJ8YgkLxH23mcZURwPHjGv')
+      expect(resp).to.be.ok()
+      const html = await resp.text()
+      expect(html).to.be.ok()
+      expect(html).to.include('<title>Run Identify on a remote node with Helia</title>')
+    })
+
+    it('loads helia-identify.on.fleek.co index.html directly ', async () => {
+      const resp = await verifiedFetch('ipfs://QmbxpRxwKXxnJQjnPqm1kzDJSJ8YgkLxH23mcZURwPHjGv/index.html')
+      expect(resp).to.be.ok()
+      const html = await resp.text()
+      expect(html).to.be.ok()
+      expect(html).to.include('<title>Run Identify on a remote node with Helia</title>')
+    })
+  })
+
+  /**
+   *
+   * Created on 2024-01-23. /ipns/blog.libp2p.io/index.html resolved to QmVZNGy6SPvUbvQCXXaGDdp8kvfJm9MMozjU12dyzH6hKf
+   *
+   * ```shell
+   * mkdir fake-blog.libp2p.io
+   * npx kubo@0.25.0 cat '/ipfs/QmVZNGy6SPvUbvQCXXaGDdp8kvfJm9MMozjU12dyzH6hKf' > fake-blog.libp2p.io/index.html
+   * npx kubo@0.25.0 add -r fake-blog.libp2p.io
+   * npx kubo@0.25.0 dag export QmeiDMLtPUS3RT2xAcUwsNyZz169wPke2q7im9vZpVLSYw > QmeiDMLtPUS3RT2xAcUwsNyZz169wPke2q7im9vZpVLSYw-fake-blog.libp2p.io.car
+   * ```
+   */
+  describe('fake blog.libp2p.io', () => {
+    let controller: Controller<'go'>
+    let verifiedFetch: Awaited<ReturnType<typeof createVerifiedFetch>>
+
+    before(async () => {
+      controller = await createKuboNode()
+      await controller.start()
+      await loadFixtureDataCar(controller, 'QmeiDMLtPUS3RT2xAcUwsNyZz169wPke2q7im9vZpVLSYw-fake-blog.libp2p.io.car')
+      verifiedFetch = await createVerifiedFetch({
+        gateways: [`http://${controller.api.gatewayHost}:${controller.api.gatewayPort}`],
+        // Temporarily disabling delegated routers in browser until CORS issue is fixed. see https://github.com/ipshipyard/waterworks-community/issues/4
+        routers: process.env.RUNNER_ENV === 'node' ? [`http://${controller.api.gatewayHost}:${controller.api.gatewayPort}`] : []
+      })
+    })
+
+    after(async () => {
+      await controller.stop()
+      await verifiedFetch.stop()
+    })
+
+    it('loads index.html when passed fake-blog.libp2p.io root CID', async () => {
+      const resp = await verifiedFetch('ipfs://QmeiDMLtPUS3RT2xAcUwsNyZz169wPke2q7im9vZpVLSYw')
+      expect(resp).to.be.ok()
+      const html = await resp.text()
+      expect(html).to.be.ok()
+      expect(html).to.include('<title>Home | libp2p Blog &#x26; News</title>')
+      expect(html).to.include('<link href="https://libp2p.io/" rel="canonical">')
+    })
+  })
+})

packages/interop/tsconfig.json

@@ -46,6 +46,9 @@
     },
     {
       "path": "../unixfs"
+    },
+    {
+      "path": "../verified-fetch"
     }
   ]
 }

packages/verified-fetch/LICENSE

@@ -0,0 +1,4 @@
+This project is dual licensed under MIT and Apache-2.0.
+
+MIT: https://www.opensource.org/licenses/mit
+Apache-2.0: https://www.apache.org/licenses/license-2.0

packages/verified-fetch/LICENSE-APACHE

@@ -0,0 +1,5 @@
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

packages/verified-fetch/LICENSE-MIT

@@ -0,0 +1,19 @@
+The MIT License (MIT)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.