@geekity/cms 0.3.0 → 0.4.0

package/dist/federation/keys.js

@@ -1,60 +1,290 @@
+import { mkdirSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
 import { exportJwk, generateCryptoKeyPair, importJwk } from '@fedify/fedify';
-import { ACTOR_KEY_ALGORITHMS } from '../admin/store.js';
+import { readFileIfPresentSync, updateFileAtomically, writeFileAtomicallySync, } from '../files/atomic.js';
 /**
- * The site actor's internal identifier.
+ * The algorithms an actor holds a key pair for, in the order Fedify wants them:
+ * the RSA pair signs HTTP Signatures for Mastodon and friends, the Ed25519
+ * pair signs FEP-8b32 integrity proofs.
+ */
+export const ACTOR_KEY_ALGORITHMS = ['RSASSA-PKCS1-v1_5', 'Ed25519'];
+/** Where an actor's key files live: `data/keys`, beside the disposable index. */
+export function actorKeysDir(dataDir) {
+    return path.join(dataDir, 'keys');
+}
+/**
+ * The file one key pair lives in, e.g. `data/keys/ada.ed25519.jwk`.
+ *
+ * The identifier is the user's username (decision-14), which is also what
+ * their actor id is built from, so a site can tell at a glance whose key a
+ * file is; and the algorithm is in the name too, so the two pairs are
+ * independent files that can be backed up, restored and regenerated one at a
+ * time.
+ *
+ * `algorithm` is a bare string rather than an {@link ActorKeyAlgorithm}, for
+ * the migration's sake: a row written by a version that knows an algorithm
+ * this one does not still has to reach a file before the table is dropped.
+ */
+export function actorKeyFile(dataDir, identifier, algorithm) {
+    return path.join(actorKeysDir(dataDir), `${fileToken(identifier)}.${fileToken(algorithm)}.jwk`);
+}
+/**
+ * Put one private JWK on disk as a user's key file for an algorithm, replacing
+ * whatever was there, and answer with the path it was written to.
+ *
+ * The only door into `data/keys` that is not {@link loadActorKeyPairs}, and it
+ * exists for the import (TASK-71): a key pair that arrives from somewhere else
+ * is the one case where a file has to be written from bytes the CMS did not
+ * mint. Everything about the layout stays here rather than at the caller — the
+ * name, the `0700` directory and the `0600` file — so there is one answer to
+ * where a user's key lives.
  *
- * Fedify keys actors by an identifier rather than by handle, and the two are
- * deliberately not the same thing here: the handle is a setting somebody may
- * change, while the identifier is what the actor's id, its inbox, its outbox
- * and its stored keys are all built from. Renaming `@blog@example.com` to
- * `@notes@example.com` therefore leaves every URL — and every follower — alone.
+ * It does not decide whether writing is allowed: an existing key is somebody's
+ * identity, and the caller is the one that knows whether it was told to
+ * replace it.
  */
-export const SITE_ACTOR_IDENTIFIER = 'actor';
+export function writeActorKeyFile(dataDir, identifier, algorithm, privateJwk) {
+    const file = actorKeyFile(dataDir, identifier, algorithm);
+    ensureKeysDir(dataDir);
+    writeFileAtomicallySync(file, `${privateJwk.trimEnd()}\n`, { mode: KEY_FILE_MODE });
+    return file;
+}
 /**
- * The actor's key pairs, generated on the first call and read from SQLite on
- * every one after that.
+ * One user's key pairs, generated on the first call and read from
+ * `data/keys` on every one after that.
  *
- * Both of {@link ACTOR_KEY_ALGORITHMS} are returned, in that order, which is
- * the order Fedify wants them in: the RSA pair signs HTTP Signatures for
- * Mastodon and friends, the Ed25519 pair signs FEP-8b32 integrity proofs.
+ * Both of {@link ACTOR_KEY_ALGORITHMS} are returned, in that order. Each file
+ * holds the private JWK alone, because the public key is derivable from it:
+ * one file per pair is one thing to back up and one thing that cannot fall
+ * half out of step with itself.
  *
- * A stored pair that will not import — a half-written row, a key from a JWK
- * shape that has since changed — is replaced rather than thrown, so a damaged
- * table heals on the next boot instead of wedging every boot after it. That
- * costs the site its old key for that algorithm, which is why the two are
- * stored and healed independently.
+ * A file that will not import is thrown over rather than replaced (decision-9).
+ * The old code healed a damaged row by generating a new pair, which is exactly
+ * the wrong thing to do with an identity: every follower holds the public key
+ * and would stop verifying the site's posts. A site that really does want a
+ * new key deletes the file, which is a deliberate act rather than an accident
+ * of a half-written byte.
  */
-export async function loadActorKeyPairs(store, identifier) {
-    const stored = new Map(store.listActorKeys(identifier).map((key) => [key.algorithm, key]));
+export async function loadActorKeyPairs(dataDir, identifier) {
     const pairs = [];
     for (const algorithm of ACTOR_KEY_ALGORITHMS) {
-        const row = stored.get(algorithm);
-        const imported = row === undefined ? undefined : await importPair(row.privateJwk, row.publicJwk);
-        pairs.push(imported ?? (await generatePair(store, identifier, algorithm)));
+        pairs.push(await loadPair(dataDir, identifier, algorithm));
     }
     return pairs;
 }
-/** A stored pair as `CryptoKey`s, or `undefined` when it will not import. */
-async function importPair(privateJwk, publicJwk) {
+/**
+ * Turn an older site's `actor_keys` rows into files under `data/keys`, once,
+ * and drop the table.
+ *
+ * The rows this writes out are the site actor's, which no version after
+ * TASK-68 has: decision-14 replaced it with one actor per user, and a user's
+ * keys are named after their username rather than after the sentinel `actor`.
+ * The files are still written rather than dropped on the floor, because a
+ * private key is the one thing this CMS never deletes for somebody — an
+ * operator who wants the old identity back has it on disk to move.
+ *
+ * This is the migration decision-9 calls the one that must not fail. Settings
+ * a site could type again and followers a site could ask for again; an actor's
+ * private key is the site's identity, and losing it means every follower's
+ * cached public key stops verifying its posts for good. So the rows are
+ * written out before the table goes, never after, and a file that is already
+ * there always wins — a site that has booted this version once has the truth
+ * on disk, and a row left over from before it did must not overwrite it.
+ *
+ * Synchronous because `createCms` is: it runs before the server is listening
+ * and before anything has asked for a key.
+ */
+export function migrateActorKeysToFiles(options) {
+    const { admin, dataDir } = options;
+    const rows = admin.legacyActorKeys();
+    if (rows !== undefined && rows.length > 0) {
+        ensureKeysDir(dataDir);
+        for (const row of rows) {
+            const file = actorKeyFile(dataDir, row.identifier, row.algorithm);
+            // Only the private half is written: the public one is derived from it,
+            // and a stored pair whose halves disagreed would be worse than none. The
+            // row is written out as it stands, byte for byte apart from the trailing
+            // newline every file here ends with — a key is not something to
+            // re-encode on the way past.
+            if (readFileIfPresentSync(file) === undefined) {
+                writeFileAtomicallySync(file, `${row.privateJwk.trimEnd()}\n`, { mode: KEY_FILE_MODE });
+            }
+        }
+    }
+    // Dropped whether or not it had rows: a fresh database gets the table from
+    // migration 4, which has shipped and so is never edited, and a site that has
+    // been migrated must not be asked again on the next boot.
+    admin.dropLegacyTable('actor_keys');
+}
+/**
+ * Refuse to boot on a key file that is there but is not a key.
+ *
+ * `loadActorKeyPairs` throws over such a file, but nothing useful happens to
+ * that throw: Fedify catches whatever the key pairs dispatcher raises and
+ * hands back an empty list, so the site would go on answering with an actor
+ * that publishes no `publicKey` and no `assertionMethod` — unverifiable to
+ * every follower, and silent about it. Boot is where that is caught instead,
+ * and refusing to start is the report: a site is down for a minute and the
+ * message names the file to restore, rather than up for a week signing
+ * nothing.
+ *
+ * The checks are the ones `importJwk` makes, minus the arithmetic, because
+ * they are all that can be made without an `await` inside a synchronous boot.
+ * That is enough for every way a key file really goes wrong — truncated by a
+ * crash, emptied, replaced by something that is not a key at all. A JWK that
+ * is well formed and still will not import is left to
+ * {@link loadActorKeyPairs}, which throws the same error with the same advice.
+ */
+export function assertActorKeysUsable(dataDir, identifier) {
+    for (const algorithm of ACTOR_KEY_ALGORITHMS) {
+        const file = actorKeyFile(dataDir, identifier, algorithm);
+        const contents = readFileIfPresentSync(file);
+        // Absent is not damaged: the first boot of a new site has no key files at
+        // all, and the first actor request writes them.
+        if (contents === undefined)
+            continue;
+        let jwk;
+        try {
+            jwk = JSON.parse(contents);
+        }
+        catch (error) {
+            throw unusableKey(file, error);
+        }
+        const problem = jwkProblem(jwk, algorithm);
+        if (problem !== undefined)
+            throw unusableKey(file, new Error(problem));
+    }
+}
+/** What is wrong with a parsed key file, or `undefined` when nothing is. */
+function jwkProblem(jwk, algorithm) {
+    if (typeof jwk !== 'object' || jwk === null)
+        return 'it is not a JSON object';
+    const key = jwk;
+    const has = (member) => typeof key[member] === 'string';
+    if (!has('d'))
+        return 'it carries no private key: a JWK with no "d" is only the public half';
+    if (algorithm === 'RSASSA-PKCS1-v1_5') {
+        if (key['kty'] !== 'RSA')
+            return `its "kty" is ${JSON.stringify(key['kty'])}, not "RSA"`;
+        if (key['alg'] !== 'RS256')
+            return `its "alg" is ${JSON.stringify(key['alg'])}, not "RS256"`;
+        if (!has('n') || !has('e'))
+            return 'an RSA key needs both "n" and "e"';
+        return undefined;
+    }
+    if (key['kty'] !== 'OKP')
+        return `its "kty" is ${JSON.stringify(key['kty'])}, not "OKP"`;
+    if (key['crv'] !== 'Ed25519') {
+        return `its "crv" is ${JSON.stringify(key['crv'])}, not "Ed25519"`;
+    }
+    if (!has('x'))
+        return 'an Ed25519 key needs an "x"';
+    return undefined;
+}
+/** One algorithm's pair: the file's, or a new one written to the file. */
+async function loadPair(dataDir, identifier, algorithm) {
+    const file = actorKeyFile(dataDir, identifier, algorithm);
+    const stored = await readIfPresent(file);
+    if (stored !== undefined)
+        return await importPair(file, stored);
+    // Absent: generate. The write goes through the queue and looks again inside
+    // it, so two first calls racing each other cannot each mint a key and leave
+    // the site publishing one it does not hold.
+    let jwk = '';
+    ensureKeysDir(dataDir);
+    await updateFileAtomically(file, async (current) => {
+        if (current !== undefined) {
+            jwk = current;
+            return current;
+        }
+        const pair = await generateCryptoKeyPair(algorithm);
+        jwk = `${JSON.stringify(await exportJwk(pair.privateKey), undefined, 2)}\n`;
+        return jwk;
+    }, { mode: KEY_FILE_MODE });
+    return await importPair(file, jwk);
+}
+/** A file's contents, or `undefined` when it is not there. */
+async function readIfPresent(file) {
     try {
-        return {
-            privateKey: await importJwk(JSON.parse(privateJwk), 'private'),
-            publicKey: await importJwk(JSON.parse(publicJwk), 'public'),
-        };
+        return await readFile(file, 'utf8');
     }
     catch {
         return undefined;
     }
 }
-/** A fresh pair, written to the store before it is handed back. */
-async function generatePair(store, identifier, algorithm) {
-    const pair = await generateCryptoKeyPair(algorithm);
-    store.putActorKey({
-        identifier,
-        algorithm,
-        privateJwk: JSON.stringify(await exportJwk(pair.privateKey)),
-        publicJwk: JSON.stringify(await exportJwk(pair.publicKey)),
-    });
-    return pair;
+/**
+ * The pair a stored private JWK stands for, or a thrown error naming the file.
+ *
+ * The public half is derived rather than stored: the private JWK carries every
+ * public member already, so dropping the private ones leaves exactly the
+ * public key. Nothing else could be true — a stored public key that disagreed
+ * with the private one would be a site signing with a key nobody could check.
+ */
+async function importPair(file, contents) {
+    let jwk;
+    try {
+        jwk = JSON.parse(contents);
+    }
+    catch (error) {
+        throw unusableKey(file, error);
+    }
+    try {
+        return {
+            privateKey: await importJwk(jwk, 'private'),
+            publicKey: await importJwk(publicHalfOf(jwk), 'public'),
+        };
+    }
+    catch (error) {
+        throw unusableKey(file, error);
+    }
+}
+/**
+ * The public members of a JWK, and only those.
+ *
+ * `d`, `p`, `q`, `dp`, `dq` and `qi` are the private ones; `key_ops` has to go
+ * too, because a key exported for signing says `["sign"]` and importing it for
+ * verification with that still on it is refused.
+ */
+function publicHalfOf(jwk) {
+    const publicMembers = ['kty', 'alg', 'crv', 'n', 'e', 'x'];
+    const half = {};
+    for (const member of publicMembers) {
+        if (jwk[member] !== undefined)
+            half[member] = jwk[member];
+    }
+    return half;
+}
+/** The error a key file that will not import raises, with what to do about it. */
+function unusableKey(file, cause) {
+    return new Error(`The actor key file ${file} could not be read as a JWK private key: ` +
+        `${cause instanceof Error ? cause.message : String(cause)}. ` +
+        'It has deliberately not been replaced, because a new key would change the ' +
+        'actor’s identity and every follower would stop verifying the site. Restore ' +
+        'the file from a backup, or delete it to ask for a new key on purpose.', { cause });
+}
+/** The permissions a private key file is created and rewritten with. */
+const KEY_FILE_MODE = 0o600;
+/** The permissions `data/keys` is created with, when this is what creates it. */
+const KEYS_DIR_MODE = 0o700;
+/**
+ * The part of a file name one identifier or algorithm contributes.
+ *
+ * Lower case, because `RSASSA-PKCS1-v1_5` on a case-insensitive filesystem is
+ * the same file as `rsassa-pkcs1-v1_5` and only one of them should ever be
+ * written; and anything that is not a letter, a digit, a dash or an underscore
+ * becomes a dash, so nothing a name carries — a dot, a slash, a `..` — can
+ * reach out of `data/keys` or split the file name into more parts than it has.
+ */
+function fileToken(value) {
+    return value.toLowerCase().replace(/[^a-z0-9_-]+/g, '-');
+}
+/**
+ * Make `data/keys` before anything is written into it, so it exists with the
+ * permissions a directory of private keys wants rather than the ones the
+ * atomic writer's `mkdir -p` would give it.
+ */
+function ensureKeysDir(dataDir) {
+    mkdirSync(actorKeysDir(dataDir), { recursive: true, mode: KEYS_DIR_MODE });
 }
 //# sourceMappingURL=keys.js.map

package/dist/federation/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/federation/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAGzD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAiB,EACjB,UAAkB;IAElB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAoB,EAAE,CAAC;IAElC,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,QAAQ,GACZ,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAClF,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,UAAU,CACvB,UAAkB,EAClB,SAAiB;IAEjB,IAAI,CAAC;QACH,OAAO;YACL,UAAU,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAe,EAAE,SAAS,CAAC;YAC5E,SAAS,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAe,EAAE,QAAQ,CAAC;SAC1E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,YAAY,CACzB,KAAiB,EACjB,UAAkB,EAClB,SAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACpD,KAAK,CAAC,WAAW,CAAC;QAChB,UAAU;QACV,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5D,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;KAC3D,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/federation/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG7E,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAU,CAAC;AAK9E,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,UAAkB,EAAE,SAAiB;IACjF,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAClG,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,UAAkB,EAClB,SAA4B,EAC5B,UAAkB;IAElB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC1D,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,uBAAuB,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,UAAkB;IAElB,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA+C;IACrF,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC;IAErC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YAClE,uEAAuE;YACvE,yEAAyE;YACzE,yEAAyE;YACzE,gEAAgE;YAChE,6BAA6B;YAC7B,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC9C,uBAAuB,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,0DAA0D;IAC1D,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,UAAkB;IACvE,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC7C,0EAA0E;QAC1E,gDAAgD;QAChD,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QAErC,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,UAAU,CAAC,GAAY,EAAE,SAA4B;IAC5D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,yBAAyB,CAAC;IAC9E,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,GAAG,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC;IAEzE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,sEAAsE,CAAC;IAE7F,IAAI,SAAS,KAAK,mBAAmB,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK;YAAE,OAAO,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC;QACzF,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,OAAO;YAAE,OAAO,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC;QAC7F,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,mCAAmC,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC;IACzF,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,6BAA6B,CAAC;IACpD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,QAAQ,CACrB,OAAe,EACf,UAAkB,EAClB,SAA4B;IAE5B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEhE,4EAA4E;IAC5E,4EAA4E;IAC5E,4CAA4C;IAC5C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,oBAAoB,CACxB,IAAI,EACJ,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,GAAG,OAAO,CAAC;YACd,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACpD,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC;QAC5E,OAAO,GAAG,CAAC;IACb,CAAC,EACD,EAAE,IAAI,EAAE,aAAa,EAAE,CACxB,CAAC;IAEF,OAAO,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,8DAA8D;AAC9D,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,QAAgB;IACtD,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAe,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC;QACH,OAAO;YACL,UAAU,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC;YAC3C,SAAS,EAAE,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC;SACxD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,GAAe;IACnC,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAU,CAAC;IACpE,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;QACnC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,SAAS,WAAW,CAAC,IAAY,EAAE,KAAc;IAC/C,OAAO,IAAI,KAAK,CACd,sBAAsB,IAAI,2CAA2C;QACnE,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;QAC7D,4EAA4E;QAC5E,6EAA6E;QAC7E,uEAAuE,EACzE,EAAE,KAAK,EAAE,CACV,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B,iFAAiF;AACjF,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;AAC7E,CAAC"}

package/dist/federation/mount.d.ts

@@ -1,23 +1,55 @@
-import type { Hono } from 'hono';
+import type { Context, Hono } from 'hono';
+import type { User } from '../admin/accounts.ts';
 import type { GeekityEnv } from '../env.ts';
 import type { SiteFederation } from './federation.ts';
 /**
  * Put Fedify in front of the rest of the app.
  *
  * The middleware only answers the paths Fedify registered — the actor, its
- * collections, the post objects, WebFinger and NodeInfo; everything else falls
- * through to `next()` and reaches the admin and the public site as before.
- * That is why it is mounted first: the public site claims every unmatched path
- * in its not-found handler, so anything registered after it never sees a
- * request.
+ * collections, WebFinger and NodeInfo; everything else falls through to
+ * `next()` and reaches the admin and the public site as before. That is why it
+ * is mounted first: the public site claims every unmatched path in its
+ * not-found handler, so anything registered after it never sees a request.
  *
- * A post permalink asked for as ActivityStreams is answered here too, by
- * {@link activityStreamsDocument}, because Fedify only knows about the URLs it
- * minted and a permalink is not one of them.
+ * A post's object is not one of Fedify's paths at all. decision-13 makes a
+ * post's ActivityStreams id its permalink, so {@link activityStreamsDocument}
+ * is what serves the `Article`: one URL, answering a browser with the page and
+ * a peer with the object. The same handler answers at the `activitypub.id` a
+ * migrated post's file names, and sends a browser from there to the permalink.
  *
  * The dispatchers are handed the stores off the Hono context rather than
  * closing over them, so one federation object could serve more than one CMS
  * and so a dispatcher is never reading a store the request did not come with.
  */
-export declare function mountFederation(app: Hono<GeekityEnv>, federation: SiteFederation): void;
+export declare function mountFederation(app: Hono<GeekityEnv>, federation: SiteFederation, options?: MountFederationOptions): void;
+/** What {@link mountFederation} takes beyond the site's own federation. */
+export interface MountFederationOptions {
+    /**
+     * The WordPress compatibility federation, built on demand (TASK-70).
+     *
+     * A factory rather than an object, because most sites will never turn the
+     * switch on and a second `Federation` they never use is a second set of
+     * dispatchers to build at boot. It is called the first time a request
+     * actually reaches one of the plugin's paths with the setting on, and the
+     * result is kept for the life of the site.
+     */
+    wordpress?: (() => SiteFederation) | undefined;
+}
+/** Where WebFinger lives, which is defined on the host rather than under a site. */
+export declare const WEBFINGER_PATH = "/.well-known/webfinger";
+/** `acct:{username}@{host}`, the handle a person types into a search box. */
+export declare function acctOf(username: string, baseUrl: string): string;
+/**
+ * The user a WebFinger `resource` asks about, or `undefined` for one this site
+ * answers for nobody.
+ *
+ * Every spelling of a person resolves, and they are the ones decision-14 lists
+ * as their aliases: the `acct:` handle, the author archive, `/@{username}` and
+ * — for somebody who was published elsewhere first — the id they were
+ * published under. Matching every one of them is what lets a peer that holds
+ * any one URL for this person find the others, which is the whole job of
+ * WebFinger, and it is how a server holding only `?author=2` discovers that
+ * the account it follows is still here.
+ */
+export declare function webFingerSubject(c: Context<GeekityEnv>, resource: string): User | undefined;
 //# sourceMappingURL=mount.d.ts.map

package/dist/federation/mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../src/federation/mount.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAW,IAAI,EAAqB,MAAM,MAAM,CAAC;AAE7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAK5C,OAAO,KAAK,EAAyB,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE7E;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,cAAc,GAAG,IAAI,CAoBvF"}
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../src/federation/mount.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAqB,MAAM,MAAM,CAAC;AAG7D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAGjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAO5C,OAAO,KAAK,EAAyB,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAQ7E;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,EACrB,UAAU,EAAE,cAAc,EAC1B,OAAO,GAAE,sBAA2B,GACnC,IAAI,CAgGN;AAED,2EAA2E;AAC3E,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,cAAc,CAAC,GAAG,SAAS,CAAC;CAChD;AA8KD,oFAAoF;AACpF,eAAO,MAAM,cAAc,2BAA2B,CAAC;AAEvD,6EAA6E;AAC7E,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAgB3F"}